last executing test programs: 17.111916289s ago: executing program 3 (id=6693): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x48, &(0x7f00000000c0)=[@in6={0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x843}, @in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e24, 0x7, @private2, 0x767c}]}, &(0x7f0000000080)=0x10) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) connect$inet6(r1, &(0x7f00000003c0)={0xa, 0x4e24, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x20000023896) 15.195709179s ago: executing program 3 (id=6697): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) openat$nullb(0xffffffffffffff9c, 0x0, 0xa4242, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000001, 0x401d132, 0xffffffffffffffff, 0x0) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) 12.323126477s ago: executing program 4 (id=6702): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x48, &(0x7f00000000c0)=[@in6={0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x843}, @in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e24, 0x7, @private2, 0x767c}]}, &(0x7f0000000080)=0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) connect$inet6(r1, &(0x7f00000003c0)={0xa, 0x4e24, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket(0x10, 0x3, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) recvmmsg(r4, &(0x7f00000021c0), 0x5b, 0x40, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYRESOCT=r1], 0xa4}}, 0x4) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000380)=ANY=[@ANYBLOB="18000000"], 0x18}}, 0x2000481c) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r2, 0x0, 0x20048883) mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x480c0}, 0x4000000) sendmmsg(r7, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 12.296699422s ago: executing program 0 (id=6703): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$key(0xf, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) socket$alg(0x26, 0x5, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket(0x2, 0x80805, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="190000000400000004"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r2}, &(0x7f0000000240), &(0x7f0000000340)=r3}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000008c0)={r3, r1, 0x25, 0x2, @val=@tracing={0x0, 0x2e5b}}, 0x20) syz_emit_ethernet(0x3e, 0x0, 0x0) 11.584069877s ago: executing program 0 (id=6705): r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000007240)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)="1ce02c7a", 0xfe60}], 0x1}}, {{0x0, 0x0, &(0x7f0000000000), 0x1}}], 0x3, 0x1c000) ppoll(&(0x7f0000000140)=[{r0, 0x5}], 0x1, 0x0, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000180)="58d8e764d9487be91c14b3489aaf78c3e8b191ea9bb17d23cde598c4b97ebfa415164f99a216f9baa1cb04ffa0ddaaf6a8a5ca01dfbb96de2771ce5b4c59e5dc796627", 0x43}, {&(0x7f0000000280)="8a4c20fde6b17d2e137e87ab0ab3941529888fb2653b93412d7437a565d8d709c6bec15b7017c964eb7630230d24489c9d0fc7b1e48c1337d4557f670bf0157ed86cb92e08ee6a00bda8c13b17716dd24a08f043e7c6b972402c1ffa054831958a982d1a7743306e632eb214ce24305f5dd7749e537a2650e9d7ad55538194c62b968d0c", 0x84}, {&(0x7f0000000340)="ef3a011786849eb33d6f97d60a54a48c4cbea855b8b663a3db4d0f884a7b347f5e843d46c6d2725e5b50976d4134ccaf6816b79c84c727e807ac2289310df99cb0d71985b8409832f4a88129dfbda80c7a93c9e53ccc83eaee9228089fb0f859915b655864cf1f46e0c280dee1d38c2156e7c5c87b331e3d6847de2d29c2f0b7908745f9935506d8bb80a84254432bfaf9c47f71c85581f65ce2c6ffefe170f3de8502dcf5d9", 0xa6}], 0x3}}], 0x1, 0x4c144) 11.540322473s ago: executing program 2 (id=6706): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace(0x10, 0x1) prctl$PR_MCE_KILL(0x35, 0x0, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/timers\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000480)={0x2020}, 0x2020) 11.282044783s ago: executing program 1 (id=6707): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=ANY=[@ANYBLOB="700000000002010300000000000000000200001040000a8008000140000000013400028006000340000100000c000280050001003a000000060003400000000006000340000400000c00028005000100010008001c000a801800028014000180080001000a01010108000200ffff"], 0x70}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 11.264971394s ago: executing program 2 (id=6708): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f00000007c0)="7800000018002502b9409b02ffff48000203be04020406050a08040c5c000900580004000a0000000d0085a168d0bf46d32345653600648d270005000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902007a00", 0x5a, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r2, 0xc138fd03, &(0x7f0000000240)="0400000000000000000000003801000000000000000000fffffffffffffffe000000000000000fffff000000000000002e79") ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000003c0)=0x2) mount(0x0, &(0x7f0000000000)='./proc\x00', 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0xbbd25b33d864198e, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet6_IPV6_RTHDR(r3, 0x29, 0x39, &(0x7f0000000100)={0x32, 0x2, 0x0, 0xa1, 0x0, [@dev={0xfe, 0x80, '\x00', 0xe}]}, 0x18) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0xffffff, 0x0, 0x0, 0x4}, 0x10) write(r5, &(0x7f0000000000)="240000001a00590214f9f407000904101f00000000000000000200000800040001000000", 0x24) semctl$IPC_INFO(0x0, 0x2, 0x3, &(0x7f0000000000)=""/141) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = dup(r6) syz_usb_connect$midi(0x5, 0x40, &(0x7f0000000280)=ANY=[@ANYBLOB="120110030000002030144b4740000102030109022e00010118100409040000020103000609058e0b20000fd702052501012709058c0200066df780052501013a"], &(0x7f0000000640)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x200, 0x9, 0x9, 0xe, 0x40, 0x40}, 0x8, &(0x7f00000000c0)=ANY=[@ANYBLOB="050f08000103100b3d797dda9cb253ede8d06a432fac1e81be175e2c74d61a346d06d7cde9adea62b4f973ec0efc64fb72c3dafe092a81f9fc6dcd98c0e8013ac69765a4c4a48e641cdf954190a5f32346775e90aa8572db8140209476acc2784069260c352d0d7a54eabfa351812878a691ae4601000000cee491859a1857ba2d54ea6de5090c6a1ab1034f2de74a33a10a6e7459c82f87820545527fded64b567edb8a8ab5b6a78c257c21ab9589169d019cb76f789a31606263b9da99e65d0e17e686df3f58c83b06c45f2eb26f6cfa6ce40a9917354a3890ea0f0f8bbb845897a6e0659f4463284d0ba94671a907dfeb332c737efa86a75e4716991dc31969d8213ca4f0518741473361c42f93f34ab785008103843169c43f"], 0x60}) write$UHID_INPUT(r7, &(0x7f0000001040)={0xf, {"a2e3ad21ed0d09f91b3d090987f70e06d038e7ff7fc6e5539b0d650e8b089b3f360068090890e0878f0e1ac6e7049b3341959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07480936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) 11.122941188s ago: executing program 3 (id=6709): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x42}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x88}}, 0x8040) 10.829537615s ago: executing program 3 (id=6710): r0 = socket$nl_audit(0x10, 0x3, 0x9) openat(0xffffffffffffff9c, 0x0, 0x2, 0x58) bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbff}, 0xc) syz_ublk_setup_io_uring(0x4ad4, 0x0, &(0x7f0000000240), &(0x7f0000000280), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$setstatus(r1, 0x4, 0x42400) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x2000000) 9.396838164s ago: executing program 0 (id=6711): sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f646500000000000000000000000000000000000000000000000000000000050003"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xc, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_DQ_RATE_ESTIMATOR={0x8, 0xc, 0x1}]}}]}, 0x3c}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[], 0x5c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 8.470519773s ago: executing program 2 (id=6712): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0xf5d1b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x6b4, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$unix(r2, &(0x7f0000000180)=@file={0x1, './cgroup.cpu/cgroup.procs\x00'}, 0x6e) 8.34921532s ago: executing program 0 (id=6713): r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCGETNODEID(r0, 0x89e1, &(0x7f0000000000)={0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r1 = getpid() sched_setattr(r1, &(0x7f0000000080)={0x38, 0x0, 0x8, 0x9, 0x80000001, 0x3, 0x4, 0xffff, 0x0, 0x300000}, 0x0) sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/ipv4/ping_group_range\x00', 0x2, 0x0) read$msr(r2, &(0x7f0000000240)=""/163, 0xa3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf947b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$9p_rdma(&(0x7f0000000180), &(0x7f0000001400)='.\x00', &(0x7f0000001440), 0x1008840, &(0x7f0000000840)={'trans=rdma,', {'port', 0x3d, 0x4e24}}) r5 = socket$kcm(0xa, 0x2, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) syz_emit_ethernet(0x3e, &(0x7f0000001180)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0x8, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @local, {[@routing={0x84, 0x0, 0x0, 0x0, 0x500}]}}}}}, 0x0) setns(0xffffffffffffffff, 0x64000000) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) 8.292841812s ago: executing program 1 (id=6714): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000500)={0xa, 0xd, 0x0, 0x80000001, 0x7, '\x00\x00\r\x00'}) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0xff2e) setns(0xffffffffffffffff, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800001bc81a000000000000000001851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000101180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000e500010000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000140)={0x0, 0x5, 0x2, 0x1, 0x83, "0000000000001f000000ffff00000000000002"}) r4 = syz_open_pts(r3, 0x0) syz_emit_ethernet(0x2a, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaa0fbbbbbbbbbbbb88a81b0081003e00884845df001400650000f973907864010102ac1e2301"], 0x0) r5 = dup3(r4, r3, 0x0) read$FUSE(r5, &(0x7f0000003f80)={0x2020}, 0x2020) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = dup2(r6, r2) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r7, &(0x7f000000d6c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000800}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(r1, 0x25, &(0x7f0000000000)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x1000011) clock_gettime(0x0, &(0x7f00000001c0)) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) pread64(r1, 0x0, 0x0, 0x10000) r9 = socket$unix(0x1, 0x1, 0x0) timer_getoverrun(r8) bind$unix(r9, 0x0, 0x0) listen(r9, 0x802) mount$9p_unix(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000100)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000140), 0x2, &(0x7f0000000180)) close_range(r0, 0xffffffffffffffff, 0x0) 8.26250315s ago: executing program 3 (id=6715): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$NILFS_IOCTL_SET_ALLOC_RANGE(r0, 0x40106e8c, &(0x7f0000000080)=[0x4, 0x1]) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000040)=0x90000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="200000006900030500000000000000000000000000010000080001ab68fb9cb0fe2c8dae7428080e0ebb58c5e08fdd2c07a17505d801766d0feb3632c66450201ca4041926a441e8bce42122528635088b5468b162063b7d97d4c0155d27da23f70701aef94b49d6326b9a37522ba15c0b34237dc3c935e54479b01bb9e277da4ab94a8cbb9d5730c4086c0f3936616a797323476a"], 0x20}}, 0x20000000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@local}) syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000002c0)={0x1, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) syz_usb_connect(0x0, 0x97, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e04103000010000000109028500020100803209040000000101000009240100013f0001010c24020101020002030000000c24020203060002030000000c2402030506000203000000092405080301020300092403090101000800090401000001"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000640)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x1}, @empty, @private=0xa010101, 0xff000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000300)={@initdev, 0x0}, &(0x7f0000000380)=0x14) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000380)=@newtfilter={0x24, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x4}, {0xffe0, 0xfff3}, {0x8, 0x2}}}, 0x24}}, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000003c0)={@remote, @local, 0x0}, &(0x7f0000000400)=0xc) sendmsg$nl_route(r1, &(0x7f0000000680)={&(0x7f00000000c0), 0xc, &(0x7f0000000500)={&(0x7f0000000440)=@RTM_DELMDB={0xb8, 0x55, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x1, 0x0, 0x3, {@in6_addr=@private0={0xfc, 0x0, '\x00', 0x1}, 0x86dd}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r5, 0x1, 0x3, 0x4, {@in6_addr=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x8edd}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r6, 0x1, 0x0, 0x0, {@in6_addr=@mcast2, 0x800}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r8, 0x0, 0x3, 0x4, {@ip4=@loopback, 0x86dd}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r9, 0x1, 0x0, 0x1, {@ip4=@private=0xa010102, 0xcfc82a531ff983c8}}}]}, 0xb8}, 0x1, 0x0, 0x0, 0x4008851}, 0x4806) socket$kcm(0x10, 0x2, 0x0) r10 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) io_setup(0x4, &(0x7f0000000040)=0x0) io_submit(r11, 0x1, &(0x7f0000002300)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x3, r10, &(0x7f0000000080)="0ff45e62121223c9c947552953608c7efd990682030cb287fcadde2d056f2bc53b0a8d088500bc6d0f07b2e36e478edee8312f5f8256a0142775a28500"/72, 0x48}]) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) 7.572805198s ago: executing program 4 (id=6716): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) 7.38962737s ago: executing program 4 (id=6717): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x38, 0x0, 0x8, 0x9, 0x80000001, 0x3, 0x4, 0xffff, 0x0, 0x300000}, 0x0) sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf947b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$9p_rdma(&(0x7f0000000180), &(0x7f0000001400)='.\x00', &(0x7f0000001440), 0x1008840, &(0x7f0000000840)={'trans=rdma,', {'port', 0x3d, 0x4e24}}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) r4 = socket$kcm(0xa, 0x2, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) setns(0xffffffffffffffff, 0x64000000) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) ptrace$ARCH_GET_GS(0x1e, r0, &(0x7f0000000040), 0x1004) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) 7.150635586s ago: executing program 0 (id=6718): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x38, 0x0, 0x8, 0x9, 0x80000001, 0x3, 0x4, 0xffff, 0x0, 0x300000}, 0x0) sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf947b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$9p_rdma(&(0x7f0000000180), &(0x7f0000001400)='.\x00', &(0x7f0000001440), 0x1008840, &(0x7f0000000840)={'trans=rdma,', {'port', 0x3d, 0x4e24}}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) r4 = socket$kcm(0xa, 0x2, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) setns(0xffffffffffffffff, 0x64000000) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) ptrace$ARCH_GET_GS(0x1e, r0, &(0x7f0000000040), 0x1004) 7.14739278s ago: executing program 2 (id=6719): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f00000020c0)={'syz0\x00', {0x0, 0x0, 0x0, 0x2}, 0x0, [0x39, 0x3, 0x4000401, 0x8, 0xe, 0x0, 0x0, 0x6, 0x3, 0x0, 0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2a, 0xfffffffd, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xfffffffd, 0x10000000, 0x99, 0x8, 0x0, 0x0, 0xfffffffd, 0x0, 0x7fffffff, 0xfffffffc, 0x5, 0xfffffff6, 0x0, 0x8, 0x800000, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x1], [0x3, 0xfffff41a, 0x0, 0x0, 0x4, 0x20000, 0x2000000, 0xedc0, 0x0, 0x5ee, 0x5, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x8, 0x0, 0x4, 0x0, 0x0, 0x2, 0x5, 0x0, 0x9, 0x1, 0x0, 0xfffffff8, 0x2, 0x0, 0x5, 0x400, 0x0, 0x0, 0x8, 0x40000, 0x0, 0xc0804000, 0x100, 0x0, 0xfffffffd, 0x4, 0x0, 0x10000, 0x0, 0x0, 0x5, 0x4, 0x7, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, 0xfffffffe, 0xfffff986], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x80, 0xc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0xd6, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0xfffffffd, 0x2, 0xffffffff, 0x0, 0x8000, 0x0, 0x20, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x200, 0x2, 0xe, 0x80000000, 0x2, 0x47fff, 0x0, 0x0, 0x0, 0x3, 0xfffffffd, 0xf, 0x3, 0xffffff85, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4, 0xf88, 0x0, 0x0, 0x0, 0x7ff], [0xfffffffe, 0x0, 0x4, 0x0, 0x7fff, 0x0, 0x2, 0x4, 0xfffffffc, 0xffffffff, 0x0, 0x2, 0xfffffffc, 0x4, 0x803, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x10, 0x5, 0xfffffffe, 0xfff, 0x8, 0x4, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xea, 0x0, 0x1, 0xfffffffd, 0x8000000, 0x4, 0xffffffff, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) 6.872805318s ago: executing program 1 (id=6720): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x42}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x88}}, 0x8040) 6.540062845s ago: executing program 1 (id=6721): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xe}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{0x6, 0x29, 0x80, 0xf, 0xffffffff, 0x91b1}, [@TCA_NETEM_RATE={0x14, 0x6, {0xe, 0x7, 0x7fffffff, 0x80000000}}]}}}]}, 0x60}}, 0x0) socket$packet(0x11, 0x2, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = getpid() bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(r2, 0xe, &(0x7f0000000380)={0x9, 0x100008f}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r3) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="f5af24bd7018000000000e00000008000300", @ANYRES32=r4], 0x1c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r7, 0x0, 0x0) 6.498603076s ago: executing program 2 (id=6722): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f00000007c0)="7800000018002502b9409b02ffff48000203be04020406050a08040c5c000900580004000a0000000d0085a168d0bf46d32345653600648d270005000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902007a00", 0x5a, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r2, 0xc138fd03, &(0x7f0000000240)="0400000000000000000000003801000000000000000000fffffffffffffffe000000000000000fffff000000000000002e79") ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000003c0)=0x2) mount(0x0, &(0x7f0000000000)='./proc\x00', 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0xbbd25b33d864198e, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet6_IPV6_RTHDR(r3, 0x29, 0x39, &(0x7f0000000100)={0x32, 0x2, 0x0, 0xa1, 0x0, [@dev={0xfe, 0x80, '\x00', 0xe}]}, 0x18) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0xffffff, 0x0, 0x0, 0x4}, 0x10) write(r5, &(0x7f0000000000)="240000001a00590214f9f407000904101f00000000000000000200000800040001000000", 0x24) semctl$IPC_INFO(0x0, 0x2, 0x3, &(0x7f0000000000)=""/141) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = dup(r6) syz_usb_connect$midi(0x5, 0x40, &(0x7f0000000280)=ANY=[@ANYBLOB="120110030000002030144b4740000102030109022e00010118100409040000020103000609058e0b20000fd702052501012709058c0200066df780052501013a"], &(0x7f0000000640)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x200, 0x9, 0x9, 0xe, 0x40, 0x40}, 0x8, &(0x7f00000000c0)=ANY=[@ANYBLOB="050f08000103100b3d797dda9cb253ede8d06a432fac1e81be175e2c74d61a346d06d7cde9adea62b4f973ec0efc64fb72c3dafe092a81f9fc6dcd98c0e8013ac69765a4c4a48e641cdf954190a5f32346775e90aa8572db8140209476acc2784069260c352d0d7a54eabfa351812878a691ae4601000000cee491859a1857ba2d54ea6de5090c6a1ab1034f2de74a33a10a6e7459c82f87820545527fded64b567edb8a8ab5b6a78c257c21ab9589169d019cb76f789a31606263b9da99e65d0e17e686df3f58c83b06c45f2eb26f6cfa6ce40a9917354a3890ea0f0f8bbb845897a6e0659f4463284d0ba94671a907dfeb332c737efa86a75e4716991dc31969d8213ca4f0518741473361c42f93f34ab785008103843169c43f"], 0x60}) write$UHID_INPUT(r7, &(0x7f0000001040)={0xf, {"a2e3ad21ed0d09f91b3d090987f70e06d038e7ff7fc6e5539b0d650e8b089b3f360068090890e0878f0e1ac6e7049b3341959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07480936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) 6.05062641s ago: executing program 4 (id=6723): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000400)={0x0, 0x3}, 0x8) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000200)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x80000001, 0x30}, 0xc) r1 = dup(r0) write$cgroup_subtree(r1, &(0x7f00000001c0)=ANY=[], 0x32600) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = syz_open_dev$vim2m(&(0x7f0000000140), 0x10002, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000080)=0x2) ioctl$vim2m_VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000380)=@mmap={0x401, 0x2, 0x4, 0x4, 0x4, {0x77359400}, {0x3, 0x2, 0xf, 0x6, 0x3, 0x1, "a91b63d9"}, 0x2, 0x1, {}, 0x101}) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x4}}, 0xffcc) 5.16168362s ago: executing program 0 (id=6724): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x48, &(0x7f00000000c0)=[@in6={0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x843}, @in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e24, 0x7, @private2, 0x767c}]}, &(0x7f0000000080)=0x10) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) connect$inet6(r1, &(0x7f00000003c0)={0xa, 0x4e24, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) socket(0x10, 0x3, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x20000023896) 3.191913201s ago: executing program 4 (id=6725): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=ANY=[@ANYBLOB="700000000002010300000000000000000200001040000a8008000140000000013400028006000340000100000c000280050001003a000000060003400000000006000340000400000c00028005000100010008001c000a801800028014000180080001000a01010108000200ffff"], 0x70}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.648941068s ago: executing program 3 (id=6726): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = mq_open(&(0x7f0000000980)='&\x00\x12|\xd6hJ\x1e\xc6\xea\xc3\xe5\xa3\xf9\xb8Bmp\x9e\xdb \x86\x11NLd\xe8\x8b\xacg\xf4\xd9L+\x95.\xf8\x00\x16sS\xef\x15\x9eii%\x7f\xba}MO\xb3\x82\xb4\xe8d-P\x99!\x84<,\xc0\xc2\xf4\xe4\x81\x80\xe4Y\xa9l\xf3\x7ff\x96\xc0d\xd7x$\x83\xb8\x80Xh\xe4g\xcdA\x8c\x83`^De\'\xd8\x18\x99\xaf\x95\xcd+\xa6\xa7\xda\x9bmT\x96&\x93\\\x93\xca0\x88\xb5Iq\x91?\xda\xc9]>K\xf4G9\x00\x00\x00\x00\xc4\x0e\x9e\xd3\xb5\x9d]\xabe\xef%\xb9\xf6Q\xc2\xb1\"r\x1d\x11\x81\xf7\xa0\x87T\xb0\x86\xcaw\xdb\xfe8J\x86,\xaa\x0e\a\xc1ac\xf3\xddf\xa4\x05\v\xe9\xf0d\n\x00\a\xdc\xea\x87\x00\xfc^/\xbcdD\x87\xa7C\xef\x85\xdd\x95\xca\a\x87\x16\x90/\n\x14\xb9e\x15\xc4\x8f\xe7\xfd\xb6y,~\x1c\xf7\xb7\x84\x02\x82T!\xd2\x8eWL\xeb\xdd\xe4\r/\xb3M\x00\rd\xdc\x944\xdc\xb3\xbb:|\xd3\xc8\xfb<\x9c\xc3\t\xc6M\xf9\f\x8c.\xde\xf3\x16_\xc9\x15Ua)\xf2\xbe\t\xc3\xa9\xc7\xee5{\x8f\xa8Y>\b\xfco\xab\x9b\x9f\xae7\xa2\xe0\x95pVl\x914\x86\xe0\xc3\xc2\x90\x9e\x9f%\xf3^\x107\xe6\xbd}\xfazE\x85\x91Lk\xb5O\xffK\xc9\xc8\x8eo\xeb)I\xaf\xf5\xd9\xbe\xba\'\xdb{wQS\xb0&\x92W\xb0\x87\x93\xf2\n\xc8U\xe5O\x1a\xfc&\xe2\xe4g.\x00&Z:\xec\xacp\x9a1n\xa6\t\xd3uc\xad\x0f\xd2\xc7\x0e\xc13J\x9cZ\xff\xdf\x8b\xd9\x8b\xcb\xe9\x90Gc\xd4\x83\x9a@\x86_\b\x00\x00\x00\xfd\xce\xa9\xe6hjU\xb3Qt\xc5\xf4\xd0\xf3\xec\xf8\x14LH\xfa\x13\xb5\b\xbek\xd5\x04\x8f3xC\x0e\xd2\xfe\xd8\xa1\xdb\xd4\xdak3\x9a\xb1\xcfX3\xfc_\xae\xd8\xe7aRa/\xf5\xdc^\xfa\xf3\xdd\x1a\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\x00(\xdfJoa\x81\xaen\x88Z\x86\xc0\x05\xa8?\x86\xe9\xd2\xb43eA\x14\x01\x0f\x85Y5\xe5\xfb2\xa6\xbd{\x1d|P\x14\x82M\n\xcf\xa3\bfk\v\xb1Y\xa3\x16AE\xc6\x11>\x93\x05w\x87\xed\xb9\xd2\xb6\xa4\xfaT\xfa\xda\x91\x11\xb1*B\x17\x03\\{\xa0\xc8\xf3\xf7\xefYOs\xf7\xdc>\xd9,\xbe\x9dL\xdf\x0f\xd9\x8a~D\vU\\5\xee\xb8:\xf7\x01\xb7\xd1y\x83\x8c\xe6\xb4\xa3KY\xf1\xc5\xaf\xf2\x8dW\xaf\xf2\xae\xed\x01\xa0\x00\x87)A\x05\xdae\x9c;/\xf4/\xe4\xe9\xec\xb1ga4\xf9f\x1d*\x9aX\xff\xb7\x96t$\x05\x11y\xef\xb4+\x88db\x1a\x1e\x1f\x00\x00\x00\x00\x00\x00\x00\x00', 0x40, 0x80, 0x0) mq_notify(r0, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$comedi(0xffffffffffffff9c, 0x0, 0x1, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x10) ioctl$EXT4_IOC_MOVE_EXT(r3, 0x40305829, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x75, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r4, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)=[0x4, 0x100], &(0x7f00000001c0), 0x0, 0x2, 0x1}}, 0x40) r6 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) mmap(&(0x7f00001f8000/0x3000)=nil, 0x3000, 0x0, 0x12012, r6, 0x0) close_range(r5, r5, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, 0x0) gettid() sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x64, 0x30, 0x871a15abc695fb3d, 0x70bd2d, 0x25dfdbfd, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x81, 0xffffadf3, 0xffffffffffffffff, 0x3, 0x10000}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000044}, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x31e728a5b70dda2, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904"], 0x0) 2.562260215s ago: executing program 1 (id=6727): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 604.864296ms ago: executing program 2 (id=6728): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c3000000000300003e851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608fffffff30500180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, 0x0, 0xc800) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000dc0)=ANY=[@ANYRES32=r3], 0x20}, 0x1, 0x0, 0x0, 0x4000011}, 0x8010) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f0000000000), 0x4) ioctl$XFS_IOC_FSGEOMETRY_V1(r0, 0x80705864, &(0x7f0000000140)) r4 = epoll_create1(0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="08000000040000000400000007"], 0x48) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f0000000080)={0x1}) pselect6(0x40, &(0x7f0000000000)={0xa, 0xb98, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5, 0x9}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0xffffffffffffff24, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x74, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x3, 0xf}, {}, {0x7, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x44, 0x2, [@TCA_FLOW_EMATCHES={0x40, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x34, 0x2, 0x0, 0x1, [@TCF_EM_META={0x0, 0x3, 0x0, 0x0, {{0xfffd, 0x4, 0x8}, [@TCA_EM_META_LVALUE={0x0, 0x2, [@TCF_META_TYPE_INT=0x5, @TCF_META_TYPE_INT=0x4, @TCF_META_TYPE_INT=0x5, @TCF_META_TYPE_INT=0x4]}]}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x1fde, 0x3, 0x5}, {0x6, 0x2, 0x2}}}]}]}]}}]}, 0x74}, 0x1, 0x0, 0x0, 0x24000045}, 0x2008c014) 604.260764ms ago: executing program 4 (id=6729): r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCGETNODEID(r0, 0x89e1, &(0x7f0000000000)={0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r1 = getpid() sched_setattr(r1, &(0x7f0000000080)={0x38, 0x0, 0x8, 0x9, 0x80000001, 0x3, 0x4, 0xffff, 0x0, 0x300000}, 0x0) sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/ipv4/ping_group_range\x00', 0x2, 0x0) read$msr(r2, &(0x7f0000000240)=""/163, 0xa3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf947b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$9p_rdma(&(0x7f0000000180), &(0x7f0000001400)='.\x00', &(0x7f0000001440), 0x1008840, &(0x7f0000000840)={'trans=rdma,', {'port', 0x3d, 0x4e24}}) r5 = socket$kcm(0xa, 0x2, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) syz_emit_ethernet(0x3e, &(0x7f0000001180)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0x8, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @local, {[@routing={0x84, 0x0, 0x0, 0x0, 0x500}]}}}}}, 0x0) setns(0xffffffffffffffff, 0x64000000) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) 0s ago: executing program 1 (id=6730): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000f00)={0x0, 0x2, 0x2, 0x1, 0x0, [@mcast2]}, 0x18) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1df) mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/gssd/clntXX/gssd\x00', 0x2, 0x0) readv(r3, &(0x7f0000002100)=[{&(0x7f0000000140)=""/1, 0x1}, {0x0}], 0x2) kernel console output (not intermixed with test programs): ci0: command tx timeout [ 1635.508098][T25067] bridge0: port 1(bridge_slave_0) entered blocking state [ 1635.508262][T25067] bridge0: port 1(bridge_slave_0) entered disabled state [ 1635.509865][T25067] bridge_slave_0: entered allmulticast mode [ 1635.511385][T25067] bridge_slave_0: entered promiscuous mode [ 1635.513515][T25067] bridge0: port 2(bridge_slave_1) entered blocking state [ 1635.513656][T25067] bridge0: port 2(bridge_slave_1) entered disabled state [ 1635.513758][T25067] bridge_slave_1: entered allmulticast mode [ 1635.515182][T25067] bridge_slave_1: entered promiscuous mode [ 1635.540304][T25067] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1635.543569][T25067] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1635.566663][T25067] team0: Port device team_slave_0 added [ 1635.569043][T25067] team0: Port device team_slave_1 added [ 1635.592286][T25067] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1635.592300][T25067] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1635.592322][T25067] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1635.594115][T25067] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1635.594128][T25067] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1635.594150][T25067] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1635.699896][T25067] hsr_slave_0: entered promiscuous mode [ 1635.700466][T25067] hsr_slave_1: entered promiscuous mode [ 1635.704546][T25067] debugfs: 'hsr0' already exists in 'hsr' [ 1635.704565][T25067] Cannot create hsr debugfs directory [ 1636.496591][T25162] FAULT_INJECTION: forcing a failure. [ 1636.496591][T25162] name failslab, interval 1, probability 0, space 0, times 0 [ 1636.496621][T25162] CPU: 0 UID: 0 PID: 25162 Comm: syz.0.5935 Tainted: G L syzkaller #0 PREEMPT(full) [ 1636.496649][T25162] Tainted: [L]=SOFTLOCKUP [ 1636.496657][T25162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1636.496670][T25162] Call Trace: [ 1636.496679][T25162] [ 1636.496687][T25162] dump_stack_lvl+0x100/0x190 [ 1636.496720][T25162] should_fail_ex.cold+0x5/0xa [ 1636.496748][T25162] should_failslab+0xc2/0x120 [ 1636.496775][T25162] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1636.496795][T25162] ? __asan_memcpy+0x3c/0x60 [ 1636.496812][T25162] ? __kernfs_new_node+0xd2/0xa10 [ 1636.496845][T25162] __kernfs_new_node+0xd2/0xa10 [ 1636.496874][T25162] ? __pfx___kernfs_new_node+0x10/0x10 [ 1636.496902][T25162] ? lock_acquire+0x1d1/0x380 [ 1636.496921][T25162] ? kernfs_root+0x23/0x2a0 [ 1636.496945][T25162] ? find_held_lock+0x2b/0x80 [ 1636.496968][T25162] ? kernfs_root+0xee/0x2a0 [ 1636.496990][T25162] ? kernfs_root+0xee/0x2a0 [ 1636.497019][T25162] kernfs_create_dir_ns+0xa6/0x2b0 [ 1636.497041][T25162] sysfs_create_dir_ns+0x13a/0x2b0 [ 1636.497065][T25162] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1636.497087][T25162] ? find_held_lock+0x2b/0x80 [ 1636.497109][T25162] ? kobject_add_internal+0x25f/0x930 [ 1636.497130][T25162] ? kobject_add_internal+0x25f/0x930 [ 1636.497152][T25162] ? do_raw_spin_unlock+0x145/0x1e0 [ 1636.497177][T25162] kobject_add_internal+0x2c8/0x930 [ 1636.497201][T25162] kobject_init_and_add+0x121/0x180 [ 1636.497228][T25162] ? __pfx_kobject_init_and_add+0x10/0x10 [ 1636.497250][T25162] ? do_syscall_64+0x123/0x790 [ 1636.497285][T25162] ? __pfx_net_shaper_set_real_num_tx_queues+0x10/0x10 [ 1636.497318][T25162] net_rx_queue_update_kobjects+0x37e/0x760 [ 1636.497347][T25162] netif_set_real_num_rx_queues+0x216/0x380 [ 1636.497373][T25162] tun_attach.isra.0+0x770/0x1870 [ 1636.497402][T25162] ? tun_get+0x191/0x370 [ 1636.497429][T25162] __tun_chr_ioctl+0x1313/0x4880 [ 1636.497449][T25162] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1636.497466][T25162] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 1636.497494][T25162] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 1636.497513][T25162] ? __fget_files+0x34/0x3d0 [ 1636.497545][T25162] ? selinux_file_ioctl+0x13b/0x290 [ 1636.497565][T25162] ? selinux_file_ioctl+0xb6/0x290 [ 1636.497586][T25162] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 1636.497608][T25162] __x64_sys_ioctl+0x18e/0x210 [ 1636.497629][T25162] do_syscall_64+0x123/0x790 [ 1636.497656][T25162] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1636.497675][T25162] RIP: 0033:0x7f3f2319e159 [ 1636.497691][T25162] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1636.497708][T25162] RSP: 002b:00007f3f2406c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1636.497727][T25162] RAX: ffffffffffffffda RBX: 00007f3f23426090 RCX: 00007f3f2319e159 [ 1636.497741][T25162] RDX: 00002000000002c0 RSI: 00000000400454ca RDI: 0000000000000004 [ 1636.497754][T25162] RBP: 00007f3f2323506b R08: 0000000000000000 R09: 0000000000000000 [ 1636.497765][T25162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1636.497776][T25162] R13: 00007f3f23426128 R14: 00007f3f23426090 R15: 00007fff3386af28 [ 1636.497802][T25162] [ 1636.499490][T25162] kobject: kobject_add_internal failed for rx-1 (error: -12 parent: queues) [ 1636.703207][ T52] Bluetooth: hci0: command tx timeout [ 1637.059997][T25169] tipc: Started in network mode [ 1637.060026][T25169] tipc: Node identity ac1414aa, cluster identity 4711 [ 1637.060332][T25169] tipc: New replicast peer: 172.20.20.187 [ 1637.067204][T25169] tipc: Enabled bearer , priority 10 [ 1637.179174][ T49] bridge_slave_1: left allmulticast mode [ 1637.179202][ T49] bridge_slave_1: left promiscuous mode [ 1637.179555][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 1637.194857][ T49] bridge_slave_0: left allmulticast mode [ 1637.194878][ T49] bridge_slave_0: left promiscuous mode [ 1637.195086][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 1638.734994][ T52] Bluetooth: hci0: command tx timeout [ 1638.834859][T25182] gadgetfs: bound to dummy_udc driver [ 1638.969203][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1638.969492][ T49] bond_slave_0: left promiscuous mode [ 1638.970943][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1638.971372][ T49] bond_slave_1: left promiscuous mode [ 1639.002627][ T49] bond0 (unregistering): Released all slaves [ 1639.111317][T21628] tipc: Node number set to 2886997162 [ 1639.111546][ T49] tipc: Left network mode [ 1639.235372][T25191] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5944'. [ 1639.607105][ T49] IPVS: stopping master sync thread 19670 ... [ 1640.016692][T25204] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[16180] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[25204] [ 1640.045675][ T31] audit: type=1400 audit(1790046322.747:2201): avc: denied { mounton } for pid=25209 comm="syz.1.5949" path="/524/proc" dev="tmpfs" ino=2732 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1640.091389][T25215] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 1641.260914][ T49] hsr_slave_0: left promiscuous mode [ 1641.261518][ T49] hsr_slave_1: left promiscuous mode [ 1641.276196][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1641.279295][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1641.413266][ T31] audit: type=1400 audit(1790046324.117:2202): avc: denied { write } for pid=25203 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1641.684742][ T31] audit: type=1400 audit(1790046324.387:2203): avc: denied { write } for pid=25243 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1641.760704][T25248] netlink: 80 bytes leftover after parsing attributes in process `syz.0.5958'. [ 1641.778335][T25248] netlink: 80 bytes leftover after parsing attributes in process `syz.0.5958'. [ 1642.012083][ T49] team0 (unregistering): Port device team_slave_1 removed [ 1642.043215][ T49] team0 (unregistering): Port device team_slave_0 removed [ 1643.417017][T25278] netlink: 72 bytes leftover after parsing attributes in process `syz.3.5967'. [ 1643.653593][T25067] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1643.792652][T25290] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5970'. [ 1643.857512][T25067] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1643.862202][T25067] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1643.891388][T25067] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1643.918359][T25067] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1643.943527][T25067] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1643.953810][T25067] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1643.987984][T25067] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1644.121825][ T49] IPVS: stop unused estimator thread 0... [ 1644.304179][T25067] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1644.323250][T25067] 8021q: adding VLAN 0 to HW filter on device team0 [ 1644.335645][ T6706] bridge0: port 1(bridge_slave_0) entered blocking state [ 1644.335733][ T6706] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1644.730042][ T31] audit: type=1400 audit(1790046327.427:2204): avc: denied { write } for pid=25274 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1644.741279][ T6706] bridge0: port 2(bridge_slave_1) entered blocking state [ 1644.741385][ T6706] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1645.483681][T12776] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1645.518545][ T31] audit: type=1400 audit(1790046328.207:2205): avc: denied { write } for pid=25320 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1645.694277][T12776] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1645.694322][T12776] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 1645.695238][T12776] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1645.695261][T12776] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1645.703804][T12776] usb 4-1: string descriptor 0 read error: -22 [ 1645.703921][T12776] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1645.732576][T12776] usb 4-1: selecting invalid altsetting 1 [ 1645.751258][T12776] usb 4-1: unit 3 not found! [ 1645.940849][T12776] usb 4-1: unit 0 not found! [ 1646.243883][T25316] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5975'. [ 1646.612574][T25316] batadv0: entered promiscuous mode [ 1646.617565][T25316] macvtap1: entered promiscuous mode [ 1646.664069][T25316] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 1646.950459][T25316] batadv0: left promiscuous mode [ 1647.172897][T21629] usb 4-1: USB disconnect, device number 78 [ 1647.193590][T25359] syzkaller1: entered allmulticast mode [ 1647.460201][T25374] XFS (nbd2): Invalid device [./loop0], error=-2 [ 1647.493721][T25067] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1648.164425][T25392] XFS (nbd1): SB validate failed with error -5. [ 1648.446603][T25067] veth0_vlan: entered promiscuous mode [ 1648.469050][T25067] veth1_vlan: entered promiscuous mode [ 1648.697587][T25067] veth0_macvtap: entered promiscuous mode [ 1648.701369][T25067] veth1_macvtap: entered promiscuous mode [ 1648.741047][T25067] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1648.761874][T25067] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1649.242018][ T59] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1649.243081][ T59] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1649.264400][ T59] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1649.265078][ T59] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1649.808143][ T987] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 1649.975740][ T987] usb 3-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 1649.976691][ T987] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1649.976716][ T987] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1649.978784][ T987] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1649.978807][ T987] usb 3-1: Product: syz [ 1649.978822][ T987] usb 3-1: Manufacturer: syz [ 1649.978836][ T987] usb 3-1: SerialNumber: syz [ 1650.070538][ T987] ums-sddr09 3-1:1.0: USB Mass Storage device detected [ 1650.101013][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1650.101032][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1650.143820][ T987] ums-sddr09 3-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 1650.143820][ T987] Please send a copy of this message to and [ 1650.204431][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1650.204449][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1650.215849][T25426] syzkaller0: entered promiscuous mode [ 1650.215876][T25426] syzkaller0: entered allmulticast mode [ 1650.339733][T25435] gadgetfs: bound to dummy_udc driver [ 1650.523601][ T987] ums-sddr09 3-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 1650.572613][T22662] usb 2-1: new full-speed USB device number 111 using dummy_hcd [ 1650.573020][ C1] gadgetfs: connected [ 1650.573502][T22662] gadgetfs: disconnected [ 1650.739990][ C1] gadgetfs: connected [ 1650.742709][T22662] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 1650.743527][T22662] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1650.743698][T22662] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1650.869919][ C1] gadgetfs: configuration #1 [ 1651.075840][T25433] gadgetfs: suspended from state 3 [ 1651.076016][T25433] gadgetfs: disconnected [ 1651.115801][ T987] usb 2-1: USB disconnect, device number 111 [ 1651.347052][T21629] usb 3-1: USB disconnect, device number 83 [ 1651.493712][T25441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6007'. [ 1651.561747][T12776] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 1651.740388][T12776] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1651.740789][T12776] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 1651.748064][T12776] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1651.748176][T12776] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1651.766194][T12776] usb 1-1: string descriptor 0 read error: -22 [ 1651.767555][T12776] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1651.970077][T12776] usb 1-1: selecting invalid altsetting 1 [ 1651.994525][T12776] usb 1-1: unit 3 not found! [ 1652.095048][T12776] usb 1-1: unit 0 not found! [ 1653.245435][T25460] IPVS: Error connecting to the multicast addr [ 1653.310649][T22662] usb 1-1: USB disconnect, device number 93 [ 1653.609600][ T4924] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1653.623863][ T4924] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1653.625264][ T4924] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1653.626073][ T4924] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1653.626613][ T4924] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1654.747413][T18168] syz_tun (unregistering): left allmulticast mode [ 1654.769313][T25485] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6015'. [ 1654.915101][T12776] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 1654.975884][T25494] XFS (nbd4): Invalid device [./loop0], error=-2 [ 1655.419768][T12776] usb 2-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 1655.420821][T12776] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1655.420846][T12776] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1655.422728][T12776] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1655.422752][T12776] usb 2-1: Product: syz [ 1655.422767][T12776] usb 2-1: Manufacturer: syz [ 1655.422785][T12776] usb 2-1: SerialNumber: syz [ 1655.454701][T12776] ums-sddr09 2-1:1.0: USB Mass Storage device detected [ 1655.488694][T12776] ums-sddr09 2-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 1655.488694][T12776] Please send a copy of this message to and [ 1656.771718][ T52] Bluetooth: hci5: command tx timeout [ 1656.786909][ T49] IPVS: starting estimator thread 0... [ 1656.852916][T12776] ums-sddr09 2-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 1656.882903][T25512] IPVS: using max 44 ests per chain, 105600 per kthread [ 1657.894967][T22662] usb 2-1: USB disconnect, device number 112 [ 1659.215772][ T52] Bluetooth: hci5: command tx timeout [ 1659.232451][T25468] bridge0: port 1(bridge_slave_0) entered blocking state [ 1659.232598][T25468] bridge0: port 1(bridge_slave_0) entered disabled state [ 1659.232708][T25468] bridge_slave_0: entered allmulticast mode [ 1659.234295][T25468] bridge_slave_0: entered promiscuous mode [ 1659.237417][T25468] bridge0: port 2(bridge_slave_1) entered blocking state [ 1659.237551][T25468] bridge0: port 2(bridge_slave_1) entered disabled state [ 1659.237879][T25468] bridge_slave_1: entered allmulticast mode [ 1659.239462][T25468] bridge_slave_1: entered promiscuous mode [ 1659.326641][T25468] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1659.437236][T25468] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1659.586480][T25468] team0: Port device team_slave_0 added [ 1659.596896][T25468] team0: Port device team_slave_1 added [ 1659.710713][T25468] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1659.710730][T25468] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1659.710752][T25468] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1659.758652][ T31] audit: type=1400 audit(1790046342.108:2206): avc: denied { read } for pid=25551 comm="syz.3.6035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1659.759027][T25468] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1659.759039][T25468] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1659.759061][T25468] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1659.860112][T25468] hsr_slave_0: entered promiscuous mode [ 1659.860928][T25468] hsr_slave_1: entered promiscuous mode [ 1659.861513][T25468] debugfs: 'hsr0' already exists in 'hsr' [ 1659.861530][T25468] Cannot create hsr debugfs directory [ 1661.163018][T21369] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 1661.260196][ T52] Bluetooth: hci5: command tx timeout [ 1661.450759][T21369] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1661.450806][T21369] usb 5-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 1661.451761][T21369] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1661.451785][T21369] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1661.458731][T21369] usb 5-1: string descriptor 0 read error: -22 [ 1661.458841][T21369] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1661.526377][T25564] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6036'. [ 1661.869732][T21369] usb 5-1: selecting invalid altsetting 1 [ 1661.870360][T21369] usb 5-1: unit 3 not found! [ 1662.021694][T21369] usb 5-1: unit 0 not found! [ 1662.226855][T25555] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6027'. [ 1662.876994][T25555] batadv0: entered promiscuous mode [ 1662.880570][T25555] macvtap1: entered promiscuous mode [ 1662.897643][T25555] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 1662.963919][T25555] batadv0: left promiscuous mode [ 1663.392039][T21629] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1663.392172][ T52] Bluetooth: hci5: command tx timeout [ 1663.399629][T22662] usb 5-1: USB disconnect, device number 102 [ 1663.569287][T21629] usb 4-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 1663.572890][T21629] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1663.572918][T21629] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1663.594469][T21629] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1663.594496][T21629] usb 4-1: Product: syz [ 1663.594511][T21629] usb 4-1: Manufacturer: syz [ 1663.594561][T21629] usb 4-1: SerialNumber: syz [ 1663.732060][T21629] ums-sddr09 4-1:1.0: USB Mass Storage device detected [ 1663.768035][T25468] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1663.781672][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 1663.781722][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 1663.797627][T25468] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1663.798714][T25468] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1663.817100][T25468] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1663.818144][T25468] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1663.836648][T25468] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1663.837727][T25468] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1663.841132][T25468] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1663.903819][T21629] ums-sddr09 4-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 1663.903819][T21629] Please send a copy of this message to and [ 1664.471381][T25468] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1664.516155][T25468] 8021q: adding VLAN 0 to HW filter on device team0 [ 1664.530584][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 1664.530679][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1664.708444][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 1664.708565][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1664.709288][T21629] ums-sddr09 4-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 1664.814909][T25593] XFS (nbd4): Invalid device [./loop0], error=-2 [ 1665.308666][T21629] usb 4-1: USB disconnect, device number 79 [ 1667.251733][T21629] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1667.425709][T21629] usb 4-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 1667.442364][T21629] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1667.442564][T21629] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1667.634786][T21624] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 1667.801004][T21624] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 1667.820147][T21624] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1667.868123][T21624] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1667.868175][T21624] usb 3-1: Product: syz [ 1667.868206][T21624] usb 3-1: Manufacturer: syz [ 1667.868245][T21624] usb 3-1: SerialNumber: syz [ 1668.534546][T25623] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6050'. [ 1668.534851][T25623] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6050'. [ 1668.536267][T25623] netlink: 'syz.4.6050': attribute type 12 has an invalid length. [ 1668.715246][T21624] usb 3-1: Cannot retrieve CPort count: -110 [ 1668.715818][T21624] usb 3-1: Cannot retrieve CPort count: -110 [ 1668.717220][T21624] es2_ap_driver 3-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 1669.794691][T25623] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6050'. [ 1669.795290][ T13] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1669.795367][T25623] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6050'. [ 1669.796817][T21624] usb 4-1: USB disconnect, device number 80 [ 1669.818353][T25623] netlink: 'syz.4.6050': attribute type 12 has an invalid length. [ 1669.864112][ T59] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1669.864201][ T59] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1669.864260][ T59] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1669.915181][T14190] usb 3-1: USB disconnect, device number 84 [ 1670.799595][T25468] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1670.853460][T25468] veth0_vlan: entered promiscuous mode [ 1670.860420][T25468] veth1_vlan: entered promiscuous mode [ 1670.884317][T14190] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 1670.922773][T25468] veth0_macvtap: entered promiscuous mode [ 1671.038310][T25468] veth1_macvtap: entered promiscuous mode [ 1671.056798][T14190] usb 5-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 1671.058642][T14190] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1671.058668][T14190] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1671.062719][T14190] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1671.062734][T14190] usb 5-1: Product: syz [ 1671.062743][T14190] usb 5-1: Manufacturer: syz [ 1671.062752][T14190] usb 5-1: SerialNumber: syz [ 1671.074977][T25468] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1671.077804][T14190] ums-sddr09 5-1:1.0: USB Mass Storage device detected [ 1671.090713][T25468] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1671.132994][T14190] ums-sddr09 5-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 1671.132994][T14190] Please send a copy of this message to and [ 1671.142651][ T43] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1671.142689][ T43] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1671.142721][ T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1671.142751][ T43] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1671.207474][T21369] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 1671.347738][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1671.347759][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1671.415250][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1671.415270][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1671.540347][T21369] usb 2-1: Using ep0 maxpacket: 16 [ 1671.541577][T21369] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1671.583666][T21369] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1671.736952][T25653] gadgetfs: bound to dummy_udc driver [ 1671.779765][T21369] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1671.779792][T21369] usb 2-1: Manufacturer: syz [ 1672.360243][T14190] ums-sddr09 5-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 1672.437693][T25650] gadgetfs: suspended from state 2 [ 1672.856310][T21369] usb 2-1: config 0 descriptor?? [ 1672.869914][T21629] usb 1-1: new full-speed USB device number 94 using dummy_hcd [ 1672.989252][T22663] usb 5-1: USB disconnect, device number 103 [ 1673.107671][T22662] usb 2-1: USB disconnect, device number 113 [ 1673.883660][ T4924] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1673.888764][ T4924] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1673.893705][ T4924] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1673.909442][ T4924] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1673.918115][ T4924] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1674.100056][ T987] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 1674.266616][ T987] usb 5-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 1674.269700][ T987] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1674.269755][ T987] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1674.927003][T20446] syz_tun (unregistering): left allmulticast mode [ 1675.145138][ T987] usb 5-1: USB disconnect, device number 104 [ 1675.905442][T21369] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 1676.094048][T21369] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 1676.098839][T21369] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1676.144573][T21369] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1676.144614][T21369] usb 1-1: Product: syz [ 1676.144653][T21369] usb 1-1: Manufacturer: syz [ 1676.144713][T21369] usb 1-1: SerialNumber: syz [ 1676.175463][ T4924] Bluetooth: hci4: command tx timeout [ 1676.998325][T21369] usb 1-1: Cannot retrieve CPort count: -110 [ 1676.998460][T21369] usb 1-1: Cannot retrieve CPort count: -110 [ 1676.998570][T21369] es2_ap_driver 1-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 1678.348983][T14190] usb 1-1: USB disconnect, device number 95 [ 1678.480336][ T4924] Bluetooth: hci4: command tx timeout [ 1679.182216][T25666] bridge0: port 1(bridge_slave_0) entered blocking state [ 1679.182362][T25666] bridge0: port 1(bridge_slave_0) entered disabled state [ 1679.182469][T25666] bridge_slave_0: entered allmulticast mode [ 1679.184476][T25666] bridge_slave_0: entered promiscuous mode [ 1679.187096][T25666] bridge0: port 2(bridge_slave_1) entered blocking state [ 1679.187228][T25666] bridge0: port 2(bridge_slave_1) entered disabled state [ 1679.187645][T25666] bridge_slave_1: entered allmulticast mode [ 1679.189131][T25666] bridge_slave_1: entered promiscuous mode [ 1679.231065][T25666] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1679.237062][T25666] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1680.688907][ T4924] Bluetooth: hci4: command tx timeout [ 1680.832913][T21376] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 1681.356339][ T43] bond0 (unregistering): Released all slaves [ 1681.388954][T25666] team0: Port device team_slave_0 added [ 1681.403128][T25666] team0: Port device team_slave_1 added [ 1681.414845][T21376] usb 2-1: Using ep0 maxpacket: 16 [ 1681.420757][T21376] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1681.421767][T21376] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1681.423056][T21376] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1681.423079][T21376] usb 2-1: Manufacturer: syz [ 1681.448106][ T31] audit: type=1400 audit(1790046362.603:2207): avc: denied { write } for pid=25731 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1681.455406][T21376] usb 2-1: config 0 descriptor?? [ 1681.554709][T25666] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1681.554726][T25666] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1681.554753][T25666] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1681.638771][T25666] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1681.638787][T25666] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1681.638810][T25666] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1681.697458][ T43] : left promiscuous mode [ 1681.743086][T14190] usb 2-1: USB disconnect, device number 114 [ 1681.812912][ T31] audit: type=1400 audit(1790046362.935:2208): avc: denied { write } for pid=25756 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1681.821131][T25666] hsr_slave_0: entered promiscuous mode [ 1681.825394][T25666] hsr_slave_1: entered promiscuous mode [ 1681.825974][T25666] debugfs: 'hsr0' already exists in 'hsr' [ 1681.825991][T25666] Cannot create hsr debugfs directory [ 1681.826150][ T43] tipc: Disabling bearer [ 1681.826282][ T43] tipc: Left network mode [ 1682.008381][ T5270] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1682.214104][T25762] nvme_fabrics: missing parameter 'transport=%s' [ 1682.214121][T25762] nvme_fabrics: missing parameter 'nqn=%s' [ 1682.271467][ T43] hsr_slave_0: left promiscuous mode [ 1682.276754][ T43] hsr_slave_1: left promiscuous mode [ 1682.596102][T25775] gadgetfs: bound to dummy_udc driver [ 1682.941429][ T4924] Bluetooth: hci4: command tx timeout [ 1682.941664][T14190] usb 1-1: new full-speed USB device number 96 using dummy_hcd [ 1682.942164][ C0] gadgetfs: connected [ 1682.947816][T14190] gadgetfs: disconnected [ 1684.036458][T25770] gadgetfs: suspended from state 2 [ 1684.285662][T14190] usb 1-1: device not accepting address 96, error -71 [ 1684.623177][ T31] audit: type=1400 audit(1790046365.539:2209): avc: denied { write } for pid=25769 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1684.929965][ T31] audit: type=1400 audit(1790046365.816:2210): avc: denied { write } for pid=25794 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1685.354665][ T5270] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1685.373153][T25797] kvm [25795]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0x0 [ 1685.802209][T21369] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 1685.965127][T21369] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 1685.980609][T21369] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1686.017172][T21369] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1686.017257][T21369] usb 5-1: Product: syz [ 1686.017274][T21369] usb 5-1: Manufacturer: syz [ 1686.017289][T21369] usb 5-1: SerialNumber: syz [ 1686.765444][T21369] usb 5-1: Cannot retrieve CPort count: -110 [ 1686.765602][T21369] usb 5-1: Cannot retrieve CPort count: -110 [ 1686.765680][T21369] es2_ap_driver 5-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 1687.058121][T25814] netlink: 72 bytes leftover after parsing attributes in process `syz.1.6091'. [ 1687.300608][T25814] netlink: 72 bytes leftover after parsing attributes in process `syz.1.6091'. [ 1687.700471][ T43] IPVS: stop unused estimator thread 0... [ 1688.212357][T22663] usb 5-1: USB disconnect, device number 105 [ 1688.718567][T21624] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1688.853945][T25832] XFS (nbd1): Invalid device [./loop0], error=-2 [ 1689.353603][T21624] usb 4-1: Using ep0 maxpacket: 32 [ 1689.355340][T21624] usb 4-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 1689.356459][T21624] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 1689.356477][T21624] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 1689.361813][T21624] usb 4-1: string descriptor 0 read error: -22 [ 1689.361938][T21624] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1689.364227][T22663] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 1689.374581][T25823] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1689.395032][T21624] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1689.395079][T21624] usb 4-1: MIDIStreaming interface descriptor not found [ 1689.551643][T22663] usb 1-1: Using ep0 maxpacket: 16 [ 1689.552835][T22663] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1689.556187][T22663] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1689.559472][T22663] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1689.559487][T22663] usb 1-1: Manufacturer: syz [ 1689.567298][T22663] usb 1-1: config 0 descriptor?? [ 1689.704939][ T31] audit: type=1400 audit(1790046370.229:2211): avc: denied { write } for pid=25812 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1689.708718][T21624] usb 4-1: USB disconnect, device number 81 [ 1690.772141][T21629] usb 1-1: USB disconnect, device number 98 [ 1690.824110][ T31] audit: type=1400 audit(1790046371.254:2212): avc: denied { write } for pid=25842 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1690.948522][T25844] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1691.145007][T25666] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1691.154798][T25666] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1691.159030][T25666] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1691.175353][T25666] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1691.179431][T25666] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1691.195769][T25666] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1691.196687][T25666] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1691.216506][T25666] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1691.316647][T25666] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1691.349202][T25666] 8021q: adding VLAN 0 to HW filter on device team0 [ 1691.354534][ T7025] bridge0: port 1(bridge_slave_0) entered blocking state [ 1691.354616][ T7025] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1691.385128][ T3413] bridge0: port 2(bridge_slave_1) entered blocking state [ 1691.385209][ T3413] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1691.700282][ T31] audit: type=1400 audit(1790046372.066:2213): avc: denied { write } for pid=25848 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1691.855317][ T31] audit: type=1400 audit(1790046372.205:2214): avc: denied { write } for pid=25876 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1692.417012][T25902] XFS (nbd3): Invalid device [./loop0], error=-2 [ 1692.830948][T25906] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6104'. [ 1692.834303][ T31] audit: type=1400 audit(1790046373.119:2215): avc: denied { write } for pid=25883 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1692.837929][T25666] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1692.891408][T25906] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6104'. [ 1692.979802][T25666] veth0_vlan: entered promiscuous mode [ 1693.006199][ T31] audit: type=1400 audit(1790046373.276:2216): avc: denied { write } for pid=25909 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1693.014327][T25666] veth1_vlan: entered promiscuous mode [ 1693.201901][T25666] veth0_macvtap: entered promiscuous mode [ 1693.354941][T25666] veth1_macvtap: entered promiscuous mode [ 1693.512793][T21629] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 1693.680969][T21629] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 1693.704129][T21629] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1693.727925][T21629] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1693.727960][T21629] usb 1-1: Product: syz [ 1693.727987][T21629] usb 1-1: Manufacturer: syz [ 1693.728147][T21629] usb 1-1: SerialNumber: syz [ 1693.908725][T25666] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1694.204796][T25666] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1694.630479][T21629] usb 1-1: Cannot retrieve CPort count: -110 [ 1694.630628][T21629] usb 1-1: Cannot retrieve CPort count: -110 [ 1694.630746][T21629] es2_ap_driver 1-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 1694.632277][T22663] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1694.773461][ T6706] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1694.773576][ T6706] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1694.845199][T22663] usb 4-1: Using ep0 maxpacket: 16 [ 1694.871526][T22663] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1694.914384][T22663] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1694.951019][T22663] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1694.951881][T22663] usb 4-1: Manufacturer: syz [ 1695.043945][T12886] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1695.101437][T22663] usb 4-1: config 0 descriptor?? [ 1695.442274][ T7025] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1695.726585][T22663] usb 4-1: USB disconnect, device number 82 [ 1695.735431][T21628] usb 1-1: USB disconnect, device number 99 [ 1695.881369][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1695.881391][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1695.954692][ T1368] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1695.954714][ T1368] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1696.838828][T22663] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 1697.106934][ T31] audit: type=1400 audit(1790046376.996:2217): avc: denied { write } for pid=25918 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1697.136210][T22663] usb 2-1: Using ep0 maxpacket: 32 [ 1697.136522][ T31] audit: type=1400 audit(1790046377.070:2218): avc: denied { write } for pid=25939 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1697.180682][T22663] usb 2-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 1697.196565][T22663] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 1697.196598][T22663] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 1697.232769][T22663] usb 2-1: string descriptor 0 read error: -22 [ 1697.232885][T22663] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1697.261085][T25928] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1697.286900][T22663] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1697.286945][T22663] usb 2-1: MIDIStreaming interface descriptor not found [ 1697.464445][T25948] kvm [25947]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x2 [ 1697.517655][T22663] usb 2-1: USB disconnect, device number 115 [ 1697.724310][T25957] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1697.978305][ T31] audit: type=1400 audit(1790046377.864:2219): avc: denied { write } for pid=25941 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1698.274422][ T31] audit: type=1400 audit(1790046378.141:2220): avc: denied { write } for pid=25974 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1698.526873][T25979] loop2: detected capacity change from 0 to 7 [ 1698.568277][T25979] Dev loop2: unable to read RDB block 7 [ 1698.568329][T25979] loop2: unable to read partition table [ 1698.568777][T25979] loop2: partition table beyond EOD, truncated [ 1698.569357][T25979] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1699.080389][T21629] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 1699.262527][T21376] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 1699.262668][T21629] usb 5-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 1699.263559][T21629] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1699.263610][T21629] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1699.831641][T21376] usb 1-1: Using ep0 maxpacket: 16 [ 1699.832541][T21376] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1699.835874][T21376] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1699.837685][T21376] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1699.837714][T21376] usb 1-1: Manufacturer: syz [ 1699.872788][T21376] usb 1-1: config 0 descriptor?? [ 1700.116418][T21629] usb 5-1: USB disconnect, device number 106 [ 1700.116954][T21376] usb 1-1: USB disconnect, device number 100 [ 1701.296251][T26006] kvm [26005]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x2 [ 1702.668600][T26033] FAULT_INJECTION: forcing a failure. [ 1702.668600][T26033] name failslab, interval 1, probability 0, space 0, times 0 [ 1702.668635][T26033] CPU: 0 UID: 0 PID: 26033 Comm: syz.4.6133 Tainted: G L syzkaller #0 PREEMPT(full) [ 1702.668666][T26033] Tainted: [L]=SOFTLOCKUP [ 1702.668674][T26033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1702.668688][T26033] Call Trace: [ 1702.668696][T26033] [ 1702.668705][T26033] dump_stack_lvl+0x100/0x190 [ 1702.668744][T26033] should_fail_ex.cold+0x5/0xa [ 1702.668781][T26033] should_failslab+0xc2/0x120 [ 1702.668809][T26033] __kmalloc_noprof+0xfc/0x840 [ 1702.668842][T26033] ? lsm_blob_alloc+0x68/0x90 [ 1702.668877][T26033] lsm_blob_alloc+0x68/0x90 [ 1702.668906][T26033] security_tun_dev_alloc_security+0x21/0x430 [ 1702.668937][T26033] tun_net_init+0x71/0x560 [ 1702.668963][T26033] ? __pfx_tun_net_init+0x10/0x10 [ 1702.668987][T26033] register_netdevice+0x685/0x25a0 [ 1702.669025][T26033] ? __pfx_register_netdevice+0x10/0x10 [ 1702.669056][T26033] ? alloc_netdev_mqs+0x120a/0x15c0 [ 1702.669091][T26033] __tun_chr_ioctl+0x1ef4/0x4880 [ 1702.669116][T26033] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1702.669138][T26033] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 1702.669171][T26033] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 1702.669193][T26033] ? __fget_files+0x34/0x3d0 [ 1702.669233][T26033] ? selinux_file_ioctl+0x13b/0x290 [ 1702.669256][T26033] ? selinux_file_ioctl+0xb6/0x290 [ 1702.669281][T26033] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 1702.669308][T26033] __x64_sys_ioctl+0x18e/0x210 [ 1702.669332][T26033] do_syscall_64+0x123/0x790 [ 1702.669366][T26033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1702.669389][T26033] RIP: 0033:0x7f3026d9e159 [ 1702.669408][T26033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1702.669430][T26033] RSP: 002b:00007f3027d39028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1702.669452][T26033] RAX: ffffffffffffffda RBX: 00007f3027025fa0 RCX: 00007f3026d9e159 [ 1702.669466][T26033] RDX: 00002000000002c0 RSI: 00000000400454ca RDI: 0000000000000003 [ 1702.669481][T26033] RBP: 00007f3026e3506b R08: 0000000000000000 R09: 0000000000000000 [ 1702.669494][T26033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1702.669508][T26033] R13: 00007f3027026038 R14: 00007f3027025fa0 R15: 00007fffbdfe61f8 [ 1702.669539][T26033] [ 1703.370137][T21376] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 1703.543335][T21376] usb 5-1: Using ep0 maxpacket: 16 [ 1703.546466][T21376] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1703.572471][T21376] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1703.595208][T21376] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1703.595375][T21376] usb 5-1: Manufacturer: syz [ 1703.689919][T21376] usb 5-1: config 0 descriptor?? [ 1703.919855][T21376] usb 5-1: USB disconnect, device number 107 [ 1704.908557][T26080] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6149'. [ 1705.813470][T26092] nvme_fabrics: missing parameter 'transport=%s' [ 1705.813487][T26092] nvme_fabrics: missing parameter 'nqn=%s' [ 1706.805620][ T31] audit: type=1400 audit(1790046386.016:2221): avc: denied { setopt } for pid=26109 comm="syz.0.6160" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1706.855638][T26110] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1706.984666][T26115] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6163'. [ 1706.984688][T26115] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6163'. [ 1706.984726][T26115] netlink: 'syz.0.6163': attribute type 12 has an invalid length. [ 1707.007667][T26115] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6163'. [ 1707.007739][ T13] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1707.007926][ T13] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1707.007972][ T13] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1707.008003][ T13] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1707.013581][T26115] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6163'. [ 1707.013612][T26115] netlink: 'syz.0.6163': attribute type 12 has an invalid length. [ 1707.105518][T26117] loop2: detected capacity change from 0 to 7 [ 1707.108906][T26117] Dev loop2: unable to read RDB block 7 [ 1707.108941][T26117] loop2: unable to read partition table [ 1707.109133][T26117] loop2: partition table beyond EOD, truncated [ 1707.109160][T26117] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1707.451555][T26128] FAULT_INJECTION: forcing a failure. [ 1707.451555][T26128] name failslab, interval 1, probability 0, space 0, times 0 [ 1707.451592][T26128] CPU: 1 UID: 0 PID: 26128 Comm: syz.3.6170 Tainted: G L syzkaller #0 PREEMPT(full) [ 1707.451623][T26128] Tainted: [L]=SOFTLOCKUP [ 1707.451631][T26128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1707.451644][T26128] Call Trace: [ 1707.451653][T26128] [ 1707.451662][T26128] dump_stack_lvl+0x100/0x190 [ 1707.451700][T26128] should_fail_ex.cold+0x5/0xa [ 1707.451732][T26128] should_failslab+0xc2/0x120 [ 1707.451760][T26128] __kmalloc_noprof+0xfc/0x840 [ 1707.451786][T26128] ? lsm_blob_alloc+0x68/0x90 [ 1707.451818][T26128] lsm_blob_alloc+0x68/0x90 [ 1707.451847][T26128] security_tun_dev_alloc_security+0x21/0x430 [ 1707.451881][T26128] tun_net_init+0x71/0x560 [ 1707.451910][T26128] ? __pfx_tun_net_init+0x10/0x10 [ 1707.451933][T26128] register_netdevice+0x685/0x25a0 [ 1707.451971][T26128] ? __pfx_register_netdevice+0x10/0x10 [ 1707.452000][T26128] ? alloc_netdev_mqs+0x120a/0x15c0 [ 1707.452034][T26128] __tun_chr_ioctl+0x1ef4/0x4880 [ 1707.452058][T26128] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1707.452079][T26128] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 1707.452112][T26128] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 1707.452136][T26128] ? __fget_files+0x34/0x3d0 [ 1707.452175][T26128] ? selinux_file_ioctl+0x13b/0x290 [ 1707.452198][T26128] ? selinux_file_ioctl+0xb6/0x290 [ 1707.452224][T26128] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 1707.452251][T26128] __x64_sys_ioctl+0x18e/0x210 [ 1707.452275][T26128] do_syscall_64+0x123/0x790 [ 1707.452310][T26128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1707.452333][T26128] RIP: 0033:0x7f4f2819e159 [ 1707.452353][T26128] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1707.452381][T26128] RSP: 002b:00007f4f29134028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1707.452403][T26128] RAX: ffffffffffffffda RBX: 00007f4f28425fa0 RCX: 00007f4f2819e159 [ 1707.452418][T26128] RDX: 00002000000002c0 RSI: 00000000400454ca RDI: 0000000000000004 [ 1707.452433][T26128] RBP: 00007f4f2823506b R08: 0000000000000000 R09: 0000000000000000 [ 1707.452447][T26128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1707.452458][T26128] R13: 00007f4f28426038 R14: 00007f4f28425fa0 R15: 00007fff32d7b188 [ 1707.452488][T26128] [ 1707.960884][T26136] loop2: detected capacity change from 0 to 7 [ 1707.968885][T26136] Dev loop2: unable to read RDB block 7 [ 1707.968922][T26136] loop2: unable to read partition table [ 1707.969092][T26136] loop2: partition table beyond EOD, truncated [ 1707.969109][T26136] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1708.898262][T26145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6176'. [ 1708.898506][T26145] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6176'. [ 1708.898889][T26145] netlink: 'syz.1.6176': attribute type 12 has an invalid length. [ 1708.965387][T26145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6176'. [ 1708.966066][T26145] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6176'. [ 1708.966714][T26145] netlink: 'syz.1.6176': attribute type 12 has an invalid length. [ 1709.036177][T22660] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 1711.358344][T26161] XFS (nbd1): Invalid device [./loop0], error=-2 [ 1711.947723][T22660] usb 4-1: device descriptor read/all, error -71 [ 1712.397190][T26171] IPVS: lc: UDP 172.20.20.11:20001 - no destination available [ 1714.037728][T26185] nfs4: Unknown parameter 'pr' [ 1714.360137][ T31] audit: type=1804 audit(1790046392.995:2222): pid=26192 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.4.6191" name="/newroot/39/mnt/bridge_slave_0" dev="sda1" ino=2067 res=1 errno=0 [ 1714.992762][T22663] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 1715.296560][T22663] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 1715.298728][T22663] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1715.303742][T22663] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1715.303775][T22663] usb 5-1: Product: syz [ 1715.303818][T22663] usb 5-1: Manufacturer: syz [ 1715.303857][T22663] usb 5-1: SerialNumber: syz [ 1716.371279][T22663] usb 5-1: Cannot retrieve CPort count: -110 [ 1716.371306][T22663] usb 5-1: Cannot retrieve CPort count: -110 [ 1716.371321][T22663] es2_ap_driver 5-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 1716.898441][T21369] usb 5-1: USB disconnect, device number 108 [ 1717.110780][T26214] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1718.678672][T26256] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1718.799787][ T31] audit: type=1400 audit(1790046397.076:2223): avc: denied { mount } for pid=26252 comm="syz.3.6208" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1720.083462][T26266] kvm [26265]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x2 [ 1720.186620][T26275] bridge0: port 3(wlan1) entered blocking state [ 1720.186799][T26275] bridge0: port 3(wlan1) entered disabled state [ 1720.186962][T26275] mac80211_hwsim hwsim32 wlan1: entered allmulticast mode [ 1720.202945][T26275] mac80211_hwsim hwsim32 wlan1: entered promiscuous mode [ 1720.416251][T26279] loop2: detected capacity change from 0 to 7 [ 1720.417360][T26279] Dev loop2: unable to read RDB block 7 [ 1720.417410][T26279] loop2: unable to read partition table [ 1720.417918][T26279] loop2: partition table beyond EOD, truncated [ 1720.417951][T26279] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1720.557908][T26287] FAULT_INJECTION: forcing a failure. [ 1720.557908][T26287] name failslab, interval 1, probability 0, space 0, times 0 [ 1720.557943][T26287] CPU: 1 UID: 0 PID: 26287 Comm: syz.3.6219 Tainted: G L syzkaller #0 PREEMPT(full) [ 1720.557974][T26287] Tainted: [L]=SOFTLOCKUP [ 1720.557982][T26287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1720.557996][T26287] Call Trace: [ 1720.558004][T26287] [ 1720.558013][T26287] dump_stack_lvl+0x100/0x190 [ 1720.558063][T26287] should_fail_ex.cold+0x5/0xa [ 1720.558094][T26287] should_failslab+0xc2/0x120 [ 1720.558121][T26287] __kvmalloc_node_noprof+0x113/0x9b0 [ 1720.558146][T26287] ? tun_attach.isra.0+0x97b/0x1870 [ 1720.558176][T26287] tun_attach.isra.0+0x97b/0x1870 [ 1720.558210][T26287] ? round_jiffies_up+0xea/0x130 [ 1720.558234][T26287] ? __pfx_round_jiffies_up+0x10/0x10 [ 1720.558258][T26287] ? timer_init_key+0x150/0x310 [ 1720.558286][T26287] tun_net_init+0x416/0x560 [ 1720.558313][T26287] ? __pfx_tun_net_init+0x10/0x10 [ 1720.558336][T26287] register_netdevice+0x685/0x25a0 [ 1720.558374][T26287] ? __pfx_register_netdevice+0x10/0x10 [ 1720.558402][T26287] ? alloc_netdev_mqs+0x120a/0x15c0 [ 1720.558435][T26287] __tun_chr_ioctl+0x1ef4/0x4880 [ 1720.558457][T26287] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1720.558477][T26287] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 1720.558512][T26287] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 1720.558536][T26287] ? __fget_files+0x34/0x3d0 [ 1720.558574][T26287] ? selinux_file_ioctl+0x13b/0x290 [ 1720.558596][T26287] ? selinux_file_ioctl+0xb6/0x290 [ 1720.558620][T26287] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 1720.558644][T26287] __x64_sys_ioctl+0x18e/0x210 [ 1720.558669][T26287] do_syscall_64+0x123/0x790 [ 1720.558703][T26287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1720.558726][T26287] RIP: 0033:0x7f4f2819e159 [ 1720.558745][T26287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1720.558766][T26287] RSP: 002b:00007f4f29134028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1720.558787][T26287] RAX: ffffffffffffffda RBX: 00007f4f28425fa0 RCX: 00007f4f2819e159 [ 1720.558802][T26287] RDX: 00002000000002c0 RSI: 00000000400454ca RDI: 0000000000000004 [ 1720.558816][T26287] RBP: 00007f4f2823506b R08: 0000000000000000 R09: 0000000000000000 [ 1720.558830][T26287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1720.558844][T26287] R13: 00007f4f28426038 R14: 00007f4f28425fa0 R15: 00007fff32d7b188 [ 1720.558875][T26287] [ 1720.641843][T26283] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1720.905239][T26298] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 1720.905426][T26298] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1721.002696][T26301] XFS (nbd0): Invalid device [./loop0], error=-2 [ 1721.686584][ T31] audit: type=1400 audit(1790046399.744:2224): avc: denied { getopt } for pid=26308 comm="syz.1.6228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1722.007584][T26324] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6231'. [ 1722.039631][T26316] kvm [26315]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x2 [ 1722.225815][ T31] audit: type=1800 audit(1790046400.252:2225): pid=26319 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.6230" name="file1" dev="sda1" ino=2058 res=0 errno=0 [ 1722.963903][T26342] XFS (nbd2): Invalid device [./loop0], error=-2 [ 1723.472048][T26347] 9p: Bad value for 'wfdno' [ 1723.774005][T26353] XFS (nbd1): Invalid device [./loop0], error=-2 [ 1724.260337][T26359] gadgetfs: bound to dummy_udc driver [ 1724.535507][T26361] IPVS: lc: UDP 172.20.20.11:20001 - no destination available [ 1724.644077][T21629] usb 1-1: new full-speed USB device number 101 using dummy_hcd [ 1724.644832][ C1] gadgetfs: connected [ 1724.645213][T21629] gadgetfs: disconnected [ 1724.924236][T26366] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6245'. [ 1725.030298][T26374] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6245'. [ 1725.112999][T26366] syz.3.6245 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1725.113036][T26366] CPU: 1 UID: 0 PID: 26366 Comm: syz.3.6245 Tainted: G L syzkaller #0 PREEMPT(full) [ 1725.113066][T26366] Tainted: [L]=SOFTLOCKUP [ 1725.113074][T26366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1725.113088][T26366] Call Trace: [ 1725.113096][T26366] [ 1725.113106][T26366] dump_stack_lvl+0x100/0x190 [ 1725.113141][T26366] dump_header+0xfb/0x606 [ 1725.113167][T26366] oom_kill_process.cold+0xd/0x380 [ 1725.113194][T26366] out_of_memory+0x340/0x14f0 [ 1725.113230][T26366] ? __pfx_out_of_memory+0x10/0x10 [ 1725.113266][T26366] mem_cgroup_out_of_memory+0xc6/0x130 [ 1725.113291][T26366] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 1725.113315][T26366] ? find_held_lock+0x2b/0x80 [ 1725.113351][T26366] ? do_raw_spin_unlock+0x145/0x1e0 [ 1725.113378][T26366] ? _raw_spin_unlock+0x28/0x50 [ 1725.113409][T26366] try_charge_memcg+0x783/0xf60 [ 1725.113446][T26366] ? __pfx_try_charge_memcg+0x10/0x10 [ 1725.113473][T26366] ? find_held_lock+0x2b/0x80 [ 1725.113501][T26366] ? rcu_read_unlock+0x17/0x60 [ 1725.113531][T26366] ? rcu_read_unlock+0x17/0x60 [ 1725.113561][T26366] ? find_held_lock+0x2b/0x80 [ 1725.113590][T26366] ? rcu_read_unlock+0x17/0x60 [ 1725.113627][T26366] charge_memcg+0x1ae/0x210 [ 1725.113663][T26366] __mem_cgroup_charge+0x2b/0x1c0 [ 1725.113687][T26366] do_wp_page+0xe40/0x45c0 [ 1725.113721][T26366] ? lock_acquire+0x1d1/0x380 [ 1725.113744][T26366] ? __pfx_do_wp_page+0x10/0x10 [ 1725.113771][T26366] ? do_raw_spin_lock+0x128/0x260 [ 1725.113797][T26366] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1725.113831][T26366] __handle_mm_fault+0x1cd2/0x2f60 [ 1725.113868][T26366] ? __pfx___handle_mm_fault+0x10/0x10 [ 1725.113895][T26366] ? __pfx_mt_find+0x10/0x10 [ 1725.113934][T26366] ? find_vma+0xbf/0x140 [ 1725.113959][T26366] ? __pfx_find_vma+0x10/0x10 [ 1725.113985][T26366] handle_mm_fault+0x363/0xa20 [ 1725.114022][T26366] do_user_addr_fault+0x745/0x12f0 [ 1725.114059][T26366] exc_page_fault+0x6f/0xd0 [ 1725.114090][T26366] asm_exc_page_fault+0x26/0x30 [ 1725.114111][T26366] RIP: 0010:__put_user_4+0xd/0x30 [ 1725.114140][T26366] Code: 66 89 01 31 c9 0f 01 ca e9 10 ed 03 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 [ 1725.114158][T26366] RSP: 0018:ffffc90006b4fcd8 EFLAGS: 00050202 [ 1725.114177][T26366] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000200000005038 [ 1725.114191][T26366] RDX: 0000000000080000 RSI: ffffffff82617601 RDI: ffffffff8c623580 [ 1725.114205][T26366] RBP: 000000000000012e R08: 0000000000006d05 R09: 00000000000001cf [ 1725.114218][T26366] R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000040000 [ 1725.114230][T26366] R13: 00000000000002e8 R14: 00000000000002e9 R15: 0000200000005000 [ 1725.114254][T26366] ? __might_fault+0x111/0x140 [ 1725.114289][T26366] __sys_sendmmsg+0x240/0x440 [ 1725.114321][T26366] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1725.114358][T26366] ? __pfx_do_futex+0x10/0x10 [ 1725.114402][T26366] ? xfd_validate_state+0x129/0x190 [ 1725.114435][T26366] __x64_sys_sendmmsg+0x9c/0x100 [ 1725.114461][T26366] ? lockdep_hardirqs_on+0x7d/0x110 [ 1725.114490][T26366] do_syscall_64+0x123/0x790 [ 1725.114522][T26366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1725.114543][T26366] RIP: 0033:0x7f4f2819e159 [ 1725.114560][T26366] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1725.114579][T26366] RSP: 002b:00007f4f29134028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1725.114599][T26366] RAX: ffffffffffffffda RBX: 00007f4f28425fa0 RCX: 00007f4f2819e159 [ 1725.114613][T26366] RDX: 00000000000002e9 RSI: 0000200000000480 RDI: 000000000000000c [ 1725.114626][T26366] RBP: 00007f4f2823506b R08: 0000000000000000 R09: 0000000000000000 [ 1725.114640][T26366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1725.114658][T26366] R13: 00007f4f28426038 R14: 00007f4f28425fa0 R15: 00007fff32d7b188 [ 1725.114690][T26366] [ 1725.132317][T26366] memory: usage 0kB, limit 0kB, failcnt 394 [ 1725.132333][T26366] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1725.132346][T26366] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1725.132358][T26366] Memory cgroup stats for /syz3/test: [ 1725.132473][T26366] cache 0 [ 1725.132482][T26366] rss 0 [ 1725.132489][T26366] rss_huge 0 [ 1725.132496][T26366] shmem 0 [ 1725.132503][T26366] mapped_file 0 [ 1725.132511][T26366] dirty 0 [ 1725.132518][T26366] writeback 0 [ 1725.132525][T26366] workingset_refault_anon 0 [ 1725.132533][T26366] workingset_refault_file 0 [ 1725.132542][T26366] swap 0 [ 1725.132548][T26366] swapcached 0 [ 1725.132556][T26366] pgpgin 0 [ 1725.132563][T26366] pgpgout 0 [ 1725.132570][T26366] pgfault 19 [ 1725.132577][T26366] pgmajfault 0 [ 1725.132584][T26366] inactive_anon 0 [ 1725.132592][T26366] active_anon 0 [ 1725.132600][T26366] inactive_file 0 [ 1725.132607][T26366] active_file 0 [ 1725.132615][T26366] unevictable 0 [ 1725.132623][T26366] hierarchical_memory_limit 0 [ 1725.132631][T26366] hierarchical_memsw_limit 9223372036854771712 [ 1725.132640][T26366] total_cache 0 [ 1725.132648][T26366] total_rss 0 [ 1725.132660][T26366] total_rss_huge 0 [ 1725.132668][T26366] total_shmem 0 [ 1725.132676][T26366] total_mapped_file 0 [ 1725.132683][T26366] total_dirty 0 [ 1725.132691][T26366] total_writeback 0 [ 1725.132699][T26366] total_workingset_refault_anon 0 [ 1725.132708][T26366] total_workingset_refault_file 0 [ 1725.132716][T26366] total_swap 0 [ 1725.132724][T26366] total_swapcached 0 [ 1725.132731][T26366] total_pgpgin 0 [ 1725.132739][T26366] total_pgpgout 0 [ 1725.132746][T26366] total_pgfault 19 [ 1725.132754][T26366] total_pgmajfault 0 [ 1725.132762][T26366] total_inactive_anon 0 [ 1725.132770][T26366] total_active_anon 0 [ 1725.132778][T26366] total_inactive_file 0 [ 1725.132786][T26366] total_active_file 0 [ 1725.132794][T26366] total_unevictable 0 [ 1725.132801][T26366] anon_cost 0 [ 1725.132809][T26366] file_cost 0 [ 1725.132817][T26366] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.6245,pid=26363,uid=0 [ 1725.132932][T26366] Memory cgroup out of memory: Killed process 26363 (syz.3.6245) total-vm:102384kB, anon-rss:1448kB, file-rss:23824kB, shmem-rss:0kB, UID:0 pgtables:140kB oom_score_adj:1000 [ 1725.552217][T26388] 9p: Bad value for 'wfdno' [ 1725.677400][T26390] netlink: 80 bytes leftover after parsing attributes in process `syz.0.6254'. [ 1725.717256][T26390] netlink: 80 bytes leftover after parsing attributes in process `syz.0.6254'. [ 1725.726789][T21628] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 1726.098290][T26402] XFS (nbd2): Invalid device [./loop0], error=-2 [ 1726.436433][T21628] usb 2-1: Using ep0 maxpacket: 32 [ 1726.438147][T21628] usb 2-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 1726.439278][T21628] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 1726.439309][T21628] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 1726.442459][T21628] usb 2-1: string descriptor 0 read error: -22 [ 1726.442571][T21628] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1726.450335][T26383] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1726.456841][T21628] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1726.456885][T21628] usb 2-1: MIDIStreaming interface descriptor not found [ 1726.726536][T21629] usb 2-1: USB disconnect, device number 116 [ 1726.855120][T26409] FAULT_INJECTION: forcing a failure. [ 1726.855120][T26409] name failslab, interval 1, probability 0, space 0, times 0 [ 1726.855155][T26409] CPU: 1 UID: 0 PID: 26409 Comm: syz.4.6261 Tainted: G L syzkaller #0 PREEMPT(full) [ 1726.855184][T26409] Tainted: [L]=SOFTLOCKUP [ 1726.855192][T26409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1726.855208][T26409] Call Trace: [ 1726.855216][T26409] [ 1726.855225][T26409] dump_stack_lvl+0x100/0x190 [ 1726.855263][T26409] should_fail_ex.cold+0x5/0xa [ 1726.855291][T26409] should_failslab+0xc2/0x120 [ 1726.855320][T26409] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1726.855343][T26409] ? do_raw_spin_unlock+0x145/0x1e0 [ 1726.855370][T26409] ? alloc_empty_file+0x5b/0x1c0 [ 1726.855403][T26409] alloc_empty_file+0x5b/0x1c0 [ 1726.855431][T26409] dentry_open+0x46/0xd0 [ 1726.855467][T26409] open_namespace_file+0xd7/0x130 [ 1726.855499][T26409] ? __pfx_open_namespace_file+0x10/0x10 [ 1726.855535][T26409] vfs_open_tree+0x8ec/0xae0 [ 1726.855563][T26409] ? _raw_spin_unlock+0x28/0x50 [ 1726.855590][T26409] ? __pfx_vfs_open_tree+0x10/0x10 [ 1726.855629][T26409] __x64_sys_open_tree+0xa3/0x150 [ 1726.855661][T26409] do_syscall_64+0x123/0x790 [ 1726.855693][T26409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1726.855716][T26409] RIP: 0033:0x7f3026d9e159 [ 1726.855735][T26409] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1726.855756][T26409] RSP: 002b:00007f3027d39028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ac [ 1726.855778][T26409] RAX: ffffffffffffffda RBX: 00007f3027025fa0 RCX: 00007f3026d9e159 [ 1726.855792][T26409] RDX: 0000000000081102 RSI: 0000200000000640 RDI: ffffffffffffff9c [ 1726.855806][T26409] RBP: 00007f3026e3506b R08: 0000000000000000 R09: 0000000000000000 [ 1726.855819][T26409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1726.855831][T26409] R13: 00007f3027026038 R14: 00007f3027025fa0 R15: 00007fffbdfe61f8 [ 1726.855861][T26409] [ 1727.732255][T26422] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6265'. [ 1728.030931][T26432] IPVS: lc: UDP 172.20.20.11:20001 - no destination available [ 1728.140942][T26433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6267'. [ 1728.219374][T26435] XFS (nbd1): Invalid device [./loop0], error=-2 [ 1728.500241][T26438] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6267'. [ 1729.712727][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1729.721348][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1729.733194][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1729.748958][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1729.752653][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1730.179118][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.179174][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 1730.675627][T26456] syzkaller0: entered promiscuous mode [ 1730.675653][T26456] syzkaller0: entered allmulticast mode [ 1730.813798][T16717] syz_tun (unregistering): left allmulticast mode [ 1731.152027][T26475] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6280'. [ 1731.241828][T26479] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 1731.241892][T26479] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1731.287208][T26483] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6280'. [ 1731.415617][T26480] syz.3.6280 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1731.415654][T26480] CPU: 0 UID: 0 PID: 26480 Comm: syz.3.6280 Tainted: G L syzkaller #0 PREEMPT(full) [ 1731.415683][T26480] Tainted: [L]=SOFTLOCKUP [ 1731.415692][T26480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1731.415704][T26480] Call Trace: [ 1731.415712][T26480] [ 1731.415721][T26480] dump_stack_lvl+0x100/0x190 [ 1731.415756][T26480] dump_header+0xfb/0x606 [ 1731.415783][T26480] oom_kill_process.cold+0xd/0x380 [ 1731.415810][T26480] out_of_memory+0x340/0x14f0 [ 1731.415842][T26480] ? __pfx_out_of_memory+0x10/0x10 [ 1731.415872][T26480] mem_cgroup_out_of_memory+0xc6/0x130 [ 1731.415893][T26480] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 1731.415912][T26480] ? find_held_lock+0x2b/0x80 [ 1731.415947][T26480] ? do_raw_spin_unlock+0x145/0x1e0 [ 1731.415974][T26480] ? _raw_spin_unlock+0x28/0x50 [ 1731.416010][T26480] try_charge_memcg+0x783/0xf60 [ 1731.416043][T26480] ? __pfx_try_charge_memcg+0x10/0x10 [ 1731.416070][T26480] ? find_held_lock+0x2b/0x80 [ 1731.416096][T26480] ? rcu_read_unlock+0x17/0x60 [ 1731.416125][T26480] ? rcu_read_unlock+0x17/0x60 [ 1731.416154][T26480] ? find_held_lock+0x2b/0x80 [ 1731.416181][T26480] ? rcu_read_unlock+0x17/0x60 [ 1731.416215][T26480] charge_memcg+0x1ae/0x210 [ 1731.416244][T26480] __mem_cgroup_charge+0x2b/0x1c0 [ 1731.416264][T26480] do_wp_page+0xe40/0x45c0 [ 1731.416296][T26480] ? lock_acquire+0x1d1/0x380 [ 1731.416317][T26480] ? __pfx_do_wp_page+0x10/0x10 [ 1731.416347][T26480] ? do_raw_spin_lock+0x128/0x260 [ 1731.416373][T26480] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1731.416406][T26480] __handle_mm_fault+0x1cd2/0x2f60 [ 1731.416444][T26480] ? __pfx___handle_mm_fault+0x10/0x10 [ 1731.416472][T26480] ? __pfx_mt_find+0x10/0x10 [ 1731.416510][T26480] ? find_vma+0xbf/0x140 [ 1731.416531][T26480] ? __pfx_find_vma+0x10/0x10 [ 1731.416556][T26480] handle_mm_fault+0x363/0xa20 [ 1731.416588][T26480] do_user_addr_fault+0x745/0x12f0 [ 1731.416623][T26480] exc_page_fault+0x6f/0xd0 [ 1731.416654][T26480] asm_exc_page_fault+0x26/0x30 [ 1731.416675][T26480] RIP: 0010:__put_user_4+0xd/0x30 [ 1731.416703][T26480] Code: 66 89 01 31 c9 0f 01 ca e9 10 ed 03 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 [ 1731.416720][T26480] RSP: 0018:ffffc90004a07cd8 EFLAGS: 00050202 [ 1731.416737][T26480] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000200000009038 [ 1731.416749][T26480] RDX: 0000000000080000 RSI: ffffffff82617601 RDI: ffffffff8c623580 [ 1731.416762][T26480] RBP: 000000000000022e R08: 0000000000006d05 R09: 00000000000001cf [ 1731.416775][T26480] R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000040000 [ 1731.416788][T26480] R13: 00000000000002e8 R14: 00000000000002e9 R15: 0000200000009000 [ 1731.416810][T26480] ? __might_fault+0x111/0x140 [ 1731.416843][T26480] __sys_sendmmsg+0x240/0x440 [ 1731.416876][T26480] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1731.416909][T26480] ? __pfx_do_futex+0x10/0x10 [ 1731.416951][T26480] ? xfd_validate_state+0x129/0x190 [ 1731.416983][T26480] __x64_sys_sendmmsg+0x9c/0x100 [ 1731.417015][T26480] ? lockdep_hardirqs_on+0x7d/0x110 [ 1731.417041][T26480] do_syscall_64+0x123/0x790 [ 1731.417071][T26480] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1731.417092][T26480] RIP: 0033:0x7f4f2819e159 [ 1731.417109][T26480] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1731.417128][T26480] RSP: 002b:00007f4f29113028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1731.417148][T26480] RAX: ffffffffffffffda RBX: 00007f4f28426090 RCX: 00007f4f2819e159 [ 1731.417164][T26480] RDX: 00000000000002e9 RSI: 0000200000000480 RDI: 000000000000000c [ 1731.417179][T26480] RBP: 00007f4f2823506b R08: 0000000000000000 R09: 0000000000000000 [ 1731.417192][T26480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1731.417204][T26480] R13: 00007f4f28426128 R14: 00007f4f28426090 R15: 00007fff32d7b188 [ 1731.417234][T26480] [ 1731.417348][T26480] memory: usage 0kB, limit 0kB, failcnt 430 [ 1731.417361][T26480] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1731.417373][T26480] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1731.417386][T26480] Memory cgroup stats for /syz3/test: [ 1731.417502][T26480] cache 0 [ 1731.417511][T26480] rss 0 [ 1731.417519][T26480] rss_huge 0 [ 1731.417526][T26480] shmem 0 [ 1731.417534][T26480] mapped_file 0 [ 1731.417542][T26480] dirty 0 [ 1731.417549][T26480] writeback 0 [ 1731.417557][T26480] workingset_refault_anon 0 [ 1731.417565][T26480] workingset_refault_file 0 [ 1731.417573][T26480] swap 0 [ 1731.417580][T26480] swapcached 0 [ 1731.417588][T26480] pgpgin 0 [ 1731.417595][T26480] pgpgout 0 [ 1731.417603][T26480] pgfault 22 [ 1731.417610][T26480] pgmajfault 0 [ 1731.417618][T26480] inactive_anon 0 [ 1731.417626][T26480] active_anon 0 [ 1731.417634][T26480] inactive_file 0 [ 1731.417642][T26480] active_file 0 [ 1731.417650][T26480] unevictable 0 [ 1731.417658][T26480] hierarchical_memory_limit 0 [ 1731.417666][T26480] hierarchical_memsw_limit 9223372036854771712 [ 1731.417675][T26480] total_cache 0 [ 1731.417683][T26480] total_rss 0 [ 1731.417690][T26480] total_rss_huge 0 [ 1731.417698][T26480] total_shmem 0 [ 1731.417706][T26480] total_mapped_file 0 [ 1731.417713][T26480] total_dirty 0 [ 1731.417721][T26480] total_writeback 0 [ 1731.417729][T26480] total_workingset_refault_anon 0 [ 1731.417738][T26480] total_workingset_refault_file 0 [ 1731.417748][T26480] total_swap 0 [ 1731.417756][T26480] total_swapcached 0 [ 1731.417763][T26480] total_pgpgin 0 [ 1731.417771][T26480] total_pgpgout 0 [ 1731.417779][T26480] total_pgfault 22 [ 1731.417788][T26480] total_pgmajfault 0 [ 1731.417796][T26480] total_inactive_anon 0 [ 1731.417804][T26480] total_active_anon 0 [ 1731.417812][T26480] total_inactive_file 0 [ 1731.417821][T26480] total_active_file 0 [ 1731.417829][T26480] total_unevictable 0 [ 1731.417837][T26480] anon_cost 0 [ 1731.417845][T26480] file_cost 0 [ 1731.417853][T26480] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.6280,pid=26474,uid=0 [ 1731.417971][T26480] Memory cgroup out of memory: Killed process 26474 (syz.3.6280) total-vm:106752kB, anon-rss:1480kB, file-rss:27600kB, shmem-rss:0kB, UID:0 pgtables:152kB oom_score_adj:1000 [ 1731.995631][ T52] Bluetooth: hci2: command tx timeout [ 1733.635278][ T33] oom_reaper: reaped process 26474 (syz.3.6280), now anon-rss:0kB, file-rss:26504kB, shmem-rss:0kB [ 1733.840596][T26494] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 1733.840623][T26494] CIFS: Attempting to mount //127.0.0.1/share [ 1733.908332][T26493] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1734.229880][ T52] Bluetooth: hci2: command tx timeout [ 1734.498601][T26511] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6284'. [ 1734.697684][T26452] bridge0: port 1(bridge_slave_0) entered blocking state [ 1734.698846][T26452] bridge0: port 1(bridge_slave_0) entered disabled state [ 1734.699183][T26452] bridge_slave_0: entered allmulticast mode [ 1734.702657][T26452] bridge_slave_0: entered promiscuous mode [ 1734.751389][T26494] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1734.753033][T26452] bridge0: port 2(bridge_slave_1) entered blocking state [ 1734.753703][T26452] bridge0: port 2(bridge_slave_1) entered disabled state [ 1734.753824][T26452] bridge_slave_1: entered allmulticast mode [ 1734.762645][T26452] bridge_slave_1: entered promiscuous mode [ 1734.908728][T26452] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1734.940306][T26452] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1735.006275][T26452] team0: Port device team_slave_0 added [ 1735.007785][T26452] team0: Port device team_slave_1 added [ 1735.068348][T26452] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1735.068365][T26452] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1735.068387][T26452] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1735.069984][T26452] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1735.069997][T26452] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1735.070019][T26452] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1735.160160][T26452] hsr_slave_0: entered promiscuous mode [ 1735.160980][T26452] hsr_slave_1: entered promiscuous mode [ 1735.163840][T26452] debugfs: 'hsr0' already exists in 'hsr' [ 1735.163854][T26452] Cannot create hsr debugfs directory [ 1735.801501][T26534] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6294'. [ 1735.909634][T26536] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6294'. [ 1735.955633][T26534] syz.3.6294 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1735.955666][T26534] CPU: 1 UID: 0 PID: 26534 Comm: syz.3.6294 Tainted: G L syzkaller #0 PREEMPT(full) [ 1735.955691][T26534] Tainted: [L]=SOFTLOCKUP [ 1735.955698][T26534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1735.955709][T26534] Call Trace: [ 1735.955716][T26534] [ 1735.955724][T26534] dump_stack_lvl+0x100/0x190 [ 1735.955759][T26534] dump_header+0xfb/0x606 [ 1735.955784][T26534] oom_kill_process.cold+0xd/0x380 [ 1735.955809][T26534] out_of_memory+0x340/0x14f0 [ 1735.955844][T26534] ? __pfx_out_of_memory+0x10/0x10 [ 1735.955878][T26534] mem_cgroup_out_of_memory+0xc6/0x130 [ 1735.955904][T26534] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 1735.955926][T26534] ? find_held_lock+0x2b/0x80 [ 1735.955964][T26534] ? do_raw_spin_unlock+0x145/0x1e0 [ 1735.955990][T26534] ? _raw_spin_unlock+0x28/0x50 [ 1735.956020][T26534] try_charge_memcg+0x783/0xf60 [ 1735.956066][T26534] ? __pfx_try_charge_memcg+0x10/0x10 [ 1735.956093][T26534] ? find_held_lock+0x2b/0x80 [ 1735.956121][T26534] ? rcu_read_unlock+0x17/0x60 [ 1735.956150][T26534] ? rcu_read_unlock+0x17/0x60 [ 1735.956178][T26534] ? find_held_lock+0x2b/0x80 [ 1735.956207][T26534] ? rcu_read_unlock+0x17/0x60 [ 1735.956242][T26534] charge_memcg+0x1ae/0x210 [ 1735.956271][T26534] __mem_cgroup_charge+0x2b/0x1c0 [ 1735.956292][T26534] do_wp_page+0xe40/0x45c0 [ 1735.956325][T26534] ? lock_acquire+0x1d1/0x380 [ 1735.956347][T26534] ? __pfx_do_wp_page+0x10/0x10 [ 1735.956376][T26534] ? do_raw_spin_lock+0x128/0x260 [ 1735.956402][T26534] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1735.956437][T26534] __handle_mm_fault+0x1cd2/0x2f60 [ 1735.956473][T26534] ? __pfx___handle_mm_fault+0x10/0x10 [ 1735.956501][T26534] ? __pfx_mt_find+0x10/0x10 [ 1735.956538][T26534] ? find_vma+0xbf/0x140 [ 1735.956561][T26534] ? __pfx_find_vma+0x10/0x10 [ 1735.956587][T26534] handle_mm_fault+0x363/0xa20 [ 1735.956623][T26534] do_user_addr_fault+0x745/0x12f0 [ 1735.956661][T26534] exc_page_fault+0x6f/0xd0 [ 1735.956692][T26534] asm_exc_page_fault+0x26/0x30 [ 1735.956711][T26534] RIP: 0010:__put_user_4+0xd/0x30 [ 1735.956737][T26534] Code: 66 89 01 31 c9 0f 01 ca e9 10 ed 03 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 [ 1735.956754][T26534] RSP: 0018:ffffc9000357fcd8 EFLAGS: 00050202 [ 1735.956771][T26534] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000020000000b038 [ 1735.956782][T26534] RDX: 0000000000080000 RSI: ffffffff82617601 RDI: ffffffff8c623580 [ 1735.956795][T26534] RBP: 00000000000002ae R08: 0000000000006d05 R09: 00000000000001cf [ 1735.956807][T26534] R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000040000 [ 1735.956818][T26534] R13: 00000000000002e8 R14: 00000000000002e9 R15: 000020000000b000 [ 1735.956841][T26534] ? __might_fault+0x111/0x140 [ 1735.956875][T26534] __sys_sendmmsg+0x240/0x440 [ 1735.956905][T26534] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1735.956940][T26534] ? __pfx_do_futex+0x10/0x10 [ 1735.956983][T26534] ? __pfx___x64_sys_futex+0x10/0x10 [ 1735.957012][T26534] ? __sys_setsockopt+0x1b5/0x220 [ 1735.957048][T26534] __x64_sys_sendmmsg+0x9c/0x100 [ 1735.957075][T26534] ? lockdep_hardirqs_on+0x7d/0x110 [ 1735.957105][T26534] do_syscall_64+0x123/0x790 [ 1735.957137][T26534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1735.957158][T26534] RIP: 0033:0x7f4f2819e159 [ 1735.957176][T26534] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1735.957194][T26534] RSP: 002b:00007f4f29134028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1735.957214][T26534] RAX: ffffffffffffffda RBX: 00007f4f28425fa0 RCX: 00007f4f2819e159 [ 1735.957228][T26534] RDX: 00000000000002e9 RSI: 0000200000000480 RDI: 000000000000000c [ 1735.957241][T26534] RBP: 00007f4f2823506b R08: 0000000000000000 R09: 0000000000000000 [ 1735.957254][T26534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1735.957267][T26534] R13: 00007f4f28426038 R14: 00007f4f28425fa0 R15: 00007fff32d7b188 [ 1735.957297][T26534] [ 1735.957315][T26534] memory: usage 0kB, limit 0kB, failcnt 472 [ 1735.957328][T26534] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1735.957341][T26534] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1735.957353][T26534] Memory cgroup stats for /syz3/test: [ 1735.957469][T26534] cache 0 [ 1735.957478][T26534] rss 0 [ 1735.957486][T26534] rss_huge 0 [ 1735.957493][T26534] shmem 0 [ 1735.957501][T26534] mapped_file 0 [ 1735.957508][T26534] dirty 0 [ 1735.957516][T26534] writeback 0 [ 1735.957523][T26534] workingset_refault_anon 0 [ 1735.957531][T26534] workingset_refault_file 0 [ 1735.957539][T26534] swap 0 [ 1735.957546][T26534] swapcached 0 [ 1735.957554][T26534] pgpgin 0 [ 1735.957561][T26534] pgpgout 0 [ 1735.957569][T26534] pgfault 29 [ 1735.957576][T26534] pgmajfault 0 [ 1735.957583][T26534] inactive_anon 0 [ 1735.957591][T26534] active_anon 0 [ 1735.957598][T26534] inactive_file 0 [ 1735.957606][T26534] active_file 0 [ 1735.957614][T26534] unevictable 0 [ 1735.957622][T26534] hierarchical_memory_limit 0 [ 1735.957630][T26534] hierarchical_memsw_limit 9223372036854771712 [ 1735.957640][T26534] total_cache 0 [ 1735.957647][T26534] total_rss 0 [ 1735.957655][T26534] total_rss_huge 0 [ 1735.957663][T26534] total_shmem 0 [ 1735.957671][T26534] total_mapped_file 0 [ 1735.957679][T26534] total_dirty 0 [ 1735.957687][T26534] total_writeback 0 [ 1735.957694][T26534] total_workingset_refault_anon 0 [ 1735.957703][T26534] total_workingset_refault_file 0 [ 1735.957721][T26534] total_swap 0 [ 1735.957729][T26534] total_swapcached 0 [ 1735.957737][T26534] total_pgpgin 0 [ 1735.957763][T26534] total_pgpgout 0 [ 1735.957771][T26534] total_pgfault 29 [ 1735.957779][T26534] total_pgmajfault 0 [ 1735.957786][T26534] total_inactive_anon 0 [ 1735.957795][T26534] total_active_anon 0 [ 1735.957803][T26534] total_inactive_file 0 [ 1735.957811][T26534] total_active_file 0 [ 1735.957819][T26534] total_unevictable 0 [ 1735.957826][T26534] anon_cost 0 [ 1735.957833][T26534] file_cost 0 [ 1735.957841][T26534] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.6294,pid=26533,uid=0 [ 1735.957957][T26534] Memory cgroup out of memory: Killed process 26533 (syz.3.6294) total-vm:102384kB, anon-rss:1472kB, file-rss:23568kB, shmem-rss:0kB, UID:0 pgtables:140kB oom_score_adj:1000 [ 1736.484680][ T52] Bluetooth: hci2: command tx timeout [ 1736.867843][T26546] XFS (nbd0): Invalid device [./loop0], error=-2 [ 1737.814725][T26452] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1737.832900][T26452] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1737.835146][T26452] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1737.868548][T26452] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1737.869289][T26452] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1737.917593][T26452] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1737.931337][T26452] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1737.948389][T26452] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1738.121170][T26558] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6302'. [ 1738.272325][T26570] XFS (nbd4): Invalid device [./loop0], error=-2 [ 1738.567235][ T52] Bluetooth: hci2: command tx timeout [ 1738.899466][T26578] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6305'. [ 1738.962109][T26452] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1738.985944][T26452] 8021q: adding VLAN 0 to HW filter on device team0 [ 1739.008137][ T6708] bridge0: port 1(bridge_slave_0) entered blocking state [ 1739.008197][ T6708] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1739.035855][ T6708] bridge0: port 2(bridge_slave_1) entered blocking state [ 1739.035923][ T6708] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1739.085561][T26583] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6305'. [ 1739.130213][T26578] syz.2.6305 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1739.130248][T26578] CPU: 0 UID: 0 PID: 26578 Comm: syz.2.6305 Tainted: G L syzkaller #0 PREEMPT(full) [ 1739.130276][T26578] Tainted: [L]=SOFTLOCKUP [ 1739.130284][T26578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1739.130296][T26578] Call Trace: [ 1739.130304][T26578] [ 1739.130313][T26578] dump_stack_lvl+0x100/0x190 [ 1739.130346][T26578] dump_header+0xfb/0x606 [ 1739.130371][T26578] oom_kill_process.cold+0xd/0x380 [ 1739.130396][T26578] out_of_memory+0x340/0x14f0 [ 1739.130437][T26578] ? __pfx_out_of_memory+0x10/0x10 [ 1739.130476][T26578] mem_cgroup_out_of_memory+0xc6/0x130 [ 1739.130501][T26578] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 1739.130524][T26578] ? find_held_lock+0x2b/0x80 [ 1739.130563][T26578] ? do_raw_spin_unlock+0x145/0x1e0 [ 1739.130593][T26578] ? _raw_spin_unlock+0x28/0x50 [ 1739.130622][T26578] try_charge_memcg+0x783/0xf60 [ 1739.130660][T26578] ? __pfx_try_charge_memcg+0x10/0x10 [ 1739.130688][T26578] ? find_held_lock+0x2b/0x80 [ 1739.130718][T26578] ? rcu_read_unlock+0x17/0x60 [ 1739.130746][T26578] ? rcu_read_unlock+0x17/0x60 [ 1739.130775][T26578] ? find_held_lock+0x2b/0x80 [ 1739.130815][T26578] ? rcu_read_unlock+0x17/0x60 [ 1739.130851][T26578] charge_memcg+0x1ae/0x210 [ 1739.130882][T26578] __mem_cgroup_charge+0x2b/0x1c0 [ 1739.130905][T26578] do_wp_page+0xe40/0x45c0 [ 1739.130939][T26578] ? lock_acquire+0x1d1/0x380 [ 1739.130960][T26578] ? __pfx_do_wp_page+0x10/0x10 [ 1739.130987][T26578] ? do_raw_spin_lock+0x128/0x260 [ 1739.131013][T26578] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1739.131048][T26578] __handle_mm_fault+0x1cd2/0x2f60 [ 1739.131083][T26578] ? __pfx___handle_mm_fault+0x10/0x10 [ 1739.131110][T26578] ? __pfx_mt_find+0x10/0x10 [ 1739.131148][T26578] ? find_vma+0xbf/0x140 [ 1739.131171][T26578] ? __pfx_find_vma+0x10/0x10 [ 1739.131197][T26578] handle_mm_fault+0x363/0xa20 [ 1739.131232][T26578] do_user_addr_fault+0x745/0x12f0 [ 1739.131268][T26578] exc_page_fault+0x6f/0xd0 [ 1739.131297][T26578] asm_exc_page_fault+0x26/0x30 [ 1739.131317][T26578] RIP: 0010:__put_user_4+0xd/0x30 [ 1739.131346][T26578] Code: 66 89 01 31 c9 0f 01 ca e9 10 ed 03 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 [ 1739.131370][T26578] RSP: 0018:ffffc90005787cd8 EFLAGS: 00050202 [ 1739.131387][T26578] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000200000003038 [ 1739.131400][T26578] RDX: 0000000000080000 RSI: ffffffff82617601 RDI: ffffffff8c623580 [ 1739.131414][T26578] RBP: 00000000000000ae R08: 0000000000006d05 R09: 00000000000001cf [ 1739.131427][T26578] R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000040000 [ 1739.131439][T26578] R13: 00000000000002e8 R14: 00000000000002e9 R15: 0000200000003000 [ 1739.131462][T26578] ? __might_fault+0x111/0x140 [ 1739.131499][T26578] __sys_sendmmsg+0x240/0x440 [ 1739.131534][T26578] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1739.131568][T26578] ? __pfx_do_futex+0x10/0x10 [ 1739.131611][T26578] ? xfd_validate_state+0x129/0x190 [ 1739.131643][T26578] __x64_sys_sendmmsg+0x9c/0x100 [ 1739.131669][T26578] ? lockdep_hardirqs_on+0x7d/0x110 [ 1739.131698][T26578] do_syscall_64+0x123/0x790 [ 1739.131730][T26578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1739.131750][T26578] RIP: 0033:0x7f206a59e159 [ 1739.131767][T26578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1739.131786][T26578] RSP: 002b:00007f206b4ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1739.131815][T26578] RAX: ffffffffffffffda RBX: 00007f206a825fa0 RCX: 00007f206a59e159 [ 1739.131830][T26578] RDX: 00000000000002e9 RSI: 0000200000000480 RDI: 000000000000000c [ 1739.131843][T26578] RBP: 00007f206a63506b R08: 0000000000000000 R09: 0000000000000000 [ 1739.131856][T26578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1739.131869][T26578] R13: 00007f206a826038 R14: 00007f206a825fa0 R15: 00007ffef1f33678 [ 1739.131899][T26578] [ 1739.137437][T26578] memory: usage 0kB, limit 0kB, failcnt 163 [ 1739.137453][T26578] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1739.137466][T26578] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1739.137478][T26578] Memory cgroup stats for /syz2/test: [ 1739.137593][T26578] cache 0 [ 1739.137606][T26578] rss 0 [ 1739.137614][T26578] rss_huge 0 [ 1739.137621][T26578] shmem 0 [ 1739.137629][T26578] mapped_file 0 [ 1739.137636][T26578] dirty 0 [ 1739.137644][T26578] writeback 0 [ 1739.137652][T26578] workingset_refault_anon 0 [ 1739.137660][T26578] workingset_refault_file 0 [ 1739.137668][T26578] swap 0 [ 1739.137676][T26578] swapcached 0 [ 1739.137684][T26578] pgpgin 0 [ 1739.137691][T26578] pgpgout 0 [ 1739.137699][T26578] pgfault 8 [ 1739.137707][T26578] pgmajfault 0 [ 1739.137714][T26578] inactive_anon 0 [ 1739.137722][T26578] active_anon 0 [ 1739.137730][T26578] inactive_file 0 [ 1739.137738][T26578] active_file 0 [ 1739.137745][T26578] unevictable 0 [ 1739.137753][T26578] hierarchical_memory_limit 0 [ 1739.137761][T26578] hierarchical_memsw_limit 9223372036854771712 [ 1739.137771][T26578] total_cache 0 [ 1739.137778][T26578] total_rss 0 [ 1739.137785][T26578] total_rss_huge 0 [ 1739.137799][T26578] total_shmem 0 [ 1739.137807][T26578] total_mapped_file 0 [ 1739.137814][T26578] total_dirty 0 [ 1739.137822][T26578] total_writeback 0 [ 1739.137829][T26578] total_workingset_refault_anon 0 [ 1739.137837][T26578] total_workingset_refault_file 0 [ 1739.137845][T26578] total_swap 0 [ 1739.137852][T26578] total_swapcached 0 [ 1739.137860][T26578] total_pgpgin 0 [ 1739.137867][T26578] total_pgpgout 0 [ 1739.137874][T26578] total_pgfault 8 [ 1739.137881][T26578] total_pgmajfault 0 [ 1739.137888][T26578] total_inactive_anon 0 [ 1739.137897][T26578] total_active_anon 0 [ 1739.137905][T26578] total_inactive_file 0 [ 1739.137912][T26578] total_active_file 0 [ 1739.137919][T26578] total_unevictable 0 [ 1739.137927][T26578] anon_cost 0 [ 1739.137935][T26578] file_cost 0 [ 1739.137943][T26578] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2/test,task_memcg=/syz2/test,task=syz.2.6305,pid=26577,uid=0 [ 1739.138067][T26578] Memory cgroup out of memory: Killed process 26577 (syz.2.6305) total-vm:102384kB, anon-rss:1440kB, file-rss:23824kB, shmem-rss:0kB, UID:0 pgtables:140kB oom_score_adj:1000 [ 1739.548316][T26586] bridge0: port 3(wlan1) entered blocking state [ 1739.548395][T26586] bridge0: port 3(wlan1) entered disabled state [ 1739.548552][T26586] mac80211_hwsim hwsim34 wlan1: entered allmulticast mode [ 1739.647824][T26586] mac80211_hwsim hwsim34 wlan1: entered promiscuous mode [ 1739.649853][T26586] bridge0: port 3(wlan1) entered blocking state [ 1739.649946][T26586] bridge0: port 3(wlan1) entered forwarding state [ 1739.766867][ T1368] bridge0: port 3(wlan1) entered disabled state [ 1740.160721][T26596] XFS (nbd4): Invalid device [./loop0], error=-2 [ 1741.650481][T26452] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1741.716310][T26452] veth0_vlan: entered promiscuous mode [ 1741.755822][T26452] veth1_vlan: entered promiscuous mode [ 1741.843286][T26452] veth0_macvtap: entered promiscuous mode [ 1741.856381][T26452] veth1_macvtap: entered promiscuous mode [ 1741.891569][T26452] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1741.922341][T26452] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1741.963398][T26623] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6317'. [ 1741.975888][ T1545] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1741.976668][ T1545] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1741.976975][ T1545] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1741.982515][ T6708] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1742.871579][T26632] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6318'. [ 1742.907307][ T6708] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1742.907325][ T6708] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1742.995220][ T6708] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1742.995239][ T6708] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1743.504289][T26638] XFS (nbd0): Invalid device [./loop0], error=-2 [ 1744.654179][T26650] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[25468] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26650] [ 1745.233333][T26659] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 1745.233399][T26659] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1745.856411][T26672] tipc: Enabling of bearer rejected, failed to enable media [ 1745.896503][T26672] Bluetooth: MGMT ver 1.23 [ 1748.579683][T26697] 9p: Bad value for 'rfdno' [ 1748.712197][T26704] netlink: 72 bytes leftover after parsing attributes in process `syz.1.6343'. [ 1748.725911][T26704] netlink: 72 bytes leftover after parsing attributes in process `syz.1.6343'. [ 1748.746048][T26708] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6342'. [ 1751.150032][T26740] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6354'. [ 1751.172583][T26740] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6354'. [ 1751.570967][T26759] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[25067] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26759] [ 1752.856665][T26788] tipc: Started in network mode [ 1752.856695][T26788] tipc: Node identity 7ad059a0d85e, cluster identity 4711 [ 1752.856834][T26788] tipc: Enabled bearer , priority 0 [ 1752.859350][T26788] syzkaller0: entered promiscuous mode [ 1752.859371][T26788] syzkaller0: entered allmulticast mode [ 1752.905232][T26788] tipc: Resetting bearer [ 1752.917097][T26787] tipc: Resetting bearer [ 1752.957824][T26787] tipc: Disabling bearer [ 1753.325276][T26801] XFS (nbd3): Invalid device [./loop0], error=-2 [ 1754.159592][T26822] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26452] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26822] [ 1754.294699][ T4924] Bluetooth: hci3: command 0x0406 tx timeout [ 1756.377000][ T31] audit: type=1800 audit(1790046432.277:2226): pid=26826 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.6386" name="file1" dev="sda1" ino=2058 res=0 errno=0 [ 1756.524468][T26849] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[25666] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26849] [ 1756.686959][ T31] audit: type=1800 audit(1790046432.572:2227): pid=26857 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.6395" name="mnt" dev="sda1" ino=2069 res=0 errno=0 [ 1757.350213][T26871] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26452] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26871] [ 1759.146731][ T31] audit: type=1800 audit(1790046434.835:2228): pid=26881 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.6403" name="file1" dev="sda1" ino=2058 res=0 errno=0 [ 1759.960765][ T52] Bluetooth: hci0: command 0x0406 tx timeout [ 1760.536140][T26910] tipc: Started in network mode [ 1760.536172][T26910] tipc: Node identity ac14140f, cluster identity 4711 [ 1760.562521][T26910] tipc: New replicast peer: 255.255.255.255 [ 1760.569339][T26910] tipc: Enabled bearer , priority 10 [ 1761.765460][T21628] tipc: Node number set to 2886997007 [ 1761.893439][T26937] netlink: 830 bytes leftover after parsing attributes in process `syz.4.6424'. [ 1762.539708][T26946] netlink: zone id is out of range [ 1762.539724][T26946] netlink: zone id is out of range [ 1762.539732][T26946] netlink: zone id is out of range [ 1762.539739][T26946] netlink: zone id is out of range [ 1762.539747][T26946] netlink: zone id is out of range [ 1762.539754][T26946] netlink: zone id is out of range [ 1762.539762][T26946] netlink: zone id is out of range [ 1763.529002][T26975] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[25067] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26975] [ 1764.935563][ T31] audit: type=1400 audit(1790046440.181:2229): avc: denied { remount } for pid=26970 comm="syz.2.6436" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1764.970968][ T31] audit: type=1800 audit(1790046440.209:2230): pid=26984 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.6436" name="file1" dev="sda1" ino=2058 res=0 errno=0 [ 1768.659441][T27017] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 1768.659511][T27017] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1769.562721][T27048] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[25468] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[27048] [ 1771.979446][T27079] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[26452] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[27079] [ 1772.506562][T27086] loop2: detected capacity change from 0 to 7 [ 1772.507567][T27086] Dev loop2: unable to read RDB block 7 [ 1772.507590][T27086] loop2: unable to read partition table [ 1772.507691][T27086] loop2: partition table beyond EOD, truncated [ 1772.507703][T27086] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1773.151728][T21624] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1773.314942][T21624] usb 4-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 1773.315912][T21624] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1773.315968][T21624] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1773.945817][ T31] audit: type=1804 audit(1790046448.487:2231): pid=27112 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.6474" name="/newroot/38/mnt/bridge_slave_0" dev="sda1" ino=2067 res=1 errno=0 [ 1776.683108][T27114] tipc: Started in network mode [ 1776.683136][T27114] tipc: Node identity ac14140f, cluster identity 4711 [ 1776.715652][T27114] tipc: New replicast peer: 255.255.255.255 [ 1776.719884][T27114] tipc: Enabled bearer , priority 10 [ 1776.724668][T21376] usb 4-1: USB disconnect, device number 85 [ 1777.028144][T27127] syzkaller0: entered promiscuous mode [ 1777.028167][T27127] syzkaller0: entered allmulticast mode [ 1777.691783][T27132] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1777.893416][T21629] tipc: Node number set to 2886997007 [ 1779.632642][T21376] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1779.799065][T21376] usb 4-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 1779.802983][T21376] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1779.803214][T21376] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1781.030823][T21376] usb 4-1: USB disconnect, device number 86 [ 1781.438903][ T4924] Bluetooth: hci2: link tx timeout [ 1781.439040][ T4924] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 1782.075707][T27191] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[24656] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[27191] [ 1783.722839][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 1783.927937][ T31] audit: type=1804 audit(1790046457.696:2232): pid=27217 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.4.6502" name="/newroot/98/mnt/bridge_slave_0" dev="sda1" ino=2067 res=1 errno=0 [ 1785.771844][T14190] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1785.916149][T14190] usb 4-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 1785.917672][T14190] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1785.917732][T14190] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1787.123962][ T4924] Bluetooth: hci5: command 0x0406 tx timeout [ 1788.141374][T27249] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[25067] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[27249] [ 1789.187334][ T954] bond0 (unregistering): Released all slaves [ 1789.313783][T12776] usb 4-1: USB disconnect, device number 87 [ 1789.407529][ T954] : left promiscuous mode [ 1790.213248][ T954] tipc: Left network mode [ 1790.503197][ T954] IPVS: stopping master sync thread 22073 ... [ 1791.596404][T27291] tipc: New replicast peer: 255.255.255.255 [ 1791.597108][T27291] tipc: Enabled bearer , priority 10 [ 1791.864737][ T954] hsr_slave_0: left promiscuous mode [ 1791.874368][ T954] hsr_slave_1: left promiscuous mode [ 1791.934020][T27311] jffs2: notice: (27311) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1793.690881][T27327] bridge0: port 3(wlan1) entered disabled state [ 1793.695634][T27327] mac80211_hwsim hwsim34 wlan1 (unregistering): left allmulticast mode [ 1793.695653][T27327] mac80211_hwsim hwsim34 wlan1 (unregistering): left promiscuous mode [ 1793.695703][T27327] bridge0: port 3(wlan1) entered disabled state [ 1793.991822][ T954] IPVS: stop unused estimator thread 0... [ 1795.337264][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 1795.337715][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 1800.609645][ T5695] kworker/0:4 (5695) used greatest stack depth: 16720 bytes left [ 1805.804611][T27477] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 1805.875959][T27477] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1807.193086][T27493] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 1807.217417][T27493] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1809.100829][T27516] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1809.686193][T27528] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1811.816141][T27539] IPVS: lc: FWM 3 0x00000003 - no destination available [ 1814.166360][T27572] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1814.453137][T27584] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6591'. [ 1815.672360][T27597] IPVS: lc: FWM 3 0x00000003 - no destination available [ 1816.620564][ T10] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 1816.808261][ T10] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1816.882451][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1816.882516][ T10] usb 5-1: Product: syz [ 1816.882561][ T10] usb 5-1: Manufacturer: syz [ 1816.882620][ T10] usb 5-1: SerialNumber: syz [ 1817.915044][ T10] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1817.940708][ T10] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1817.957407][T27611] bridge0: port 3(wlan1) entered blocking state [ 1817.957454][T27611] bridge0: port 3(wlan1) entered disabled state [ 1817.957577][T27611] mac80211_hwsim hwsim38 wlan1: entered allmulticast mode [ 1818.021159][T27611] mac80211_hwsim hwsim38 wlan1: entered promiscuous mode [ 1818.055363][T27609] bridge0: port 3(wlan1) entered disabled state [ 1818.057224][T27609] mac80211_hwsim hwsim38 wlan1 (unregistering): left allmulticast mode [ 1818.057253][T27609] mac80211_hwsim hwsim38 wlan1 (unregistering): left promiscuous mode [ 1818.057338][T27609] bridge0: port 3(wlan1) entered disabled state [ 1819.270393][T27630] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6612'. [ 1819.348583][T27636] syzkaller0: entered promiscuous mode [ 1819.348605][T27636] syzkaller0: entered allmulticast mode [ 1819.435969][ T10] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000118. ret = -EPROTO [ 1819.436037][ T10] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1819.456786][ T10] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1819.489636][ T10] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 1819.525572][ T10] usb 5-1: USB disconnect, device number 109 [ 1820.563410][ T31] audit: type=1800 audit(1790046492.665:2233): pid=27665 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.6623" name="(" dev="sda1" ino=2070 res=0 errno=0 [ 1820.571907][T27663] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[25666] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[27663] [ 1825.244151][T27701] FAULT_INJECTION: forcing a failure. [ 1825.244151][T27701] name failslab, interval 1, probability 0, space 0, times 0 [ 1825.244190][T27701] CPU: 0 UID: 0 PID: 27701 Comm: syz.3.6632 Tainted: G L syzkaller #0 PREEMPT(full) [ 1825.244221][T27701] Tainted: [L]=SOFTLOCKUP [ 1825.244229][T27701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1825.244244][T27701] Call Trace: [ 1825.244253][T27701] [ 1825.244262][T27701] dump_stack_lvl+0x100/0x190 [ 1825.244302][T27701] should_fail_ex.cold+0x5/0xa [ 1825.244336][T27701] should_failslab+0xc2/0x120 [ 1825.244374][T27701] __kmalloc_noprof+0xfc/0x840 [ 1825.244398][T27701] ? rcu_is_watching+0x13/0xc0 [ 1825.244429][T27701] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1825.244471][T27701] tomoyo_realpath_from_path+0xb6/0x690 [ 1825.244506][T27701] tomoyo_path_number_perm+0x23c/0x580 [ 1825.244531][T27701] ? tomoyo_path_number_perm+0x22e/0x580 [ 1825.244558][T27701] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1825.244585][T27701] ? __pfx_futex_wait+0x10/0x10 [ 1825.244615][T27701] ? __lock_acquire+0x5c0/0x1f40 [ 1825.244654][T27701] ? __fget_files+0x34/0x3d0 [ 1825.244681][T27701] ? find_held_lock+0x2b/0x80 [ 1825.244710][T27701] ? hook_file_ioctl_common+0x140/0x440 [ 1825.244747][T27701] ? __fget_files+0x21f/0x3d0 [ 1825.244778][T27701] security_file_ioctl+0xd3/0x230 [ 1825.244805][T27701] __x64_sys_ioctl+0xb7/0x210 [ 1825.244831][T27701] do_syscall_64+0x123/0x790 [ 1825.244866][T27701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1825.244888][T27701] RIP: 0033:0x7f4f2819e159 [ 1825.244907][T27701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1825.244931][T27701] RSP: 002b:00007f4f29134028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1825.244953][T27701] RAX: ffffffffffffffda RBX: 00007f4f28425fa0 RCX: 00007f4f2819e159 [ 1825.244969][T27701] RDX: 0000000000000000 RSI: 00000000c040563e RDI: 0000000000000003 [ 1825.244983][T27701] RBP: 00007f4f2823506b R08: 0000000000000000 R09: 0000000000000000 [ 1825.244997][T27701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1825.245011][T27701] R13: 00007f4f28426038 R14: 00007f4f28425fa0 R15: 00007fff32d7b188 [ 1825.245044][T27701] [ 1825.245085][T27701] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1827.429576][ T31] audit: type=1400 audit(1790046499.565:2234): avc: denied { write } for pid=27726 comm="syz.1.6642" name="nullb" dev="configfs" ino=371 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1827.574823][T27734] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[25468] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[27734] [ 1828.200112][T27728] null_blk: rnullb0: using native zone append [ 1828.718891][T27751] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 1828.718929][T27751] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1828.898327][T27728] null_blk: disk rnullb0 created [ 1829.656703][T27773] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6651'. [ 1831.472361][T27788] IPVS: lc: FWM 3 0x00000003 - no destination available [ 1831.769495][T27793] syzkaller0: entered promiscuous mode [ 1831.769510][T27793] syzkaller0: entered allmulticast mode [ 1832.686741][T27805] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 1832.686806][T27805] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1833.464577][T21371] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 1833.651389][T21371] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1833.655267][T21371] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1833.655294][T21371] usb 2-1: Product: syz [ 1833.655309][T21371] usb 2-1: Manufacturer: syz [ 1833.655324][T21371] usb 2-1: SerialNumber: syz [ 1833.921705][T27833] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 1833.921745][T27833] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1834.225882][T21371] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1834.225916][T21371] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1835.570042][T21371] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000118. ret = -EPROTO [ 1835.570163][T21371] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1835.747222][T21371] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1835.763674][T21371] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 1835.801117][T21371] usb 2-1: USB disconnect, device number 117 [ 1838.280180][T12776] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 1838.450508][T12776] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1838.453329][T12776] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1838.453352][T12776] usb 2-1: Product: syz [ 1838.453367][T12776] usb 2-1: Manufacturer: syz [ 1838.453382][T12776] usb 2-1: SerialNumber: syz [ 1839.950354][T12776] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1839.950574][T12776] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1841.502097][T12776] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000118. ret = -EPROTO [ 1841.502150][T12776] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1841.502739][T12776] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1841.740696][T27915] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 1841.741697][T27915] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1843.035458][T12776] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 1843.039255][T12776] usb 2-1: USB disconnect, device number 118 [ 1844.139016][T27940] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[25666] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[27940] [ 1844.601928][T21371] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 1844.782866][T21371] usb 3-1: Using ep0 maxpacket: 32 [ 1844.789560][T21371] usb 3-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 1844.794216][T21371] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 1844.794283][T21371] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 1844.805414][T21371] usb 3-1: string descriptor 0 read error: -22 [ 1844.806163][T21371] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1844.939200][T27945] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1845.121321][T21371] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1845.121720][T21371] usb 3-1: MIDIStreaming interface descriptor not found [ 1847.041920][T21371] usb 3-1: USB disconnect, device number 85 [ 1847.093622][T27958] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6711'. [ 1847.093731][T27958] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6711'. [ 1848.044280][T27973] FAULT_INJECTION: forcing a failure. [ 1848.044280][T27973] name failslab, interval 1, probability 0, space 0, times 0 [ 1848.044314][T27973] CPU: 0 UID: 0 PID: 27973 Comm: syz.4.6716 Tainted: G L syzkaller #0 PREEMPT(full) [ 1848.044338][T27973] Tainted: [L]=SOFTLOCKUP [ 1848.044343][T27973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1848.044350][T27973] Call Trace: [ 1848.044355][T27973] [ 1848.044360][T27973] dump_stack_lvl+0x100/0x190 [ 1848.044382][T27973] should_fail_ex.cold+0x5/0xa [ 1848.044400][T27973] should_failslab+0xc2/0x120 [ 1848.044416][T27973] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 1848.044431][T27973] ? sock_alloc_inode+0x26/0x2c0 [ 1848.044449][T27973] ? __pfx_sock_alloc_inode+0x10/0x10 [ 1848.044467][T27973] sock_alloc_inode+0x26/0x2c0 [ 1848.044483][T27973] ? __pfx_sock_alloc_inode+0x10/0x10 [ 1848.044499][T27973] alloc_inode+0x68/0x250 [ 1848.044511][T27973] sock_alloc+0x44/0x280 [ 1848.044525][T27973] ? security_socket_create+0x7f/0x250 [ 1848.044538][T27973] __sock_create+0xc2/0x860 [ 1848.044552][T27973] __sys_socket+0x14d/0x260 [ 1848.044563][T27973] ? fput+0x7c/0x100 [ 1848.044578][T27973] ? __pfx___sys_socket+0x10/0x10 [ 1848.044588][T27973] ? ksys_write+0x1ac/0x250 [ 1848.044600][T27973] ? __pfx_ksys_write+0x10/0x10 [ 1848.044615][T27973] __x64_sys_socket+0x72/0xb0 [ 1848.044626][T27973] ? lockdep_hardirqs_on+0x7d/0x110 [ 1848.044644][T27973] do_syscall_64+0x123/0x790 [ 1848.044662][T27973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1848.044681][T27973] RIP: 0033:0x7f3026d9e159 [ 1848.044692][T27973] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1848.044704][T27973] RSP: 002b:00007f3027d39028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 1848.044717][T27973] RAX: ffffffffffffffda RBX: 00007f3027025fa0 RCX: 00007f3026d9e159 [ 1848.044725][T27973] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000010 [ 1848.044733][T27973] RBP: 00007f3026e3506b R08: 0000000000000000 R09: 0000000000000000 [ 1848.044741][T27973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1848.044749][T27973] R13: 00007f3027026038 R14: 00007f3027025fa0 R15: 00007fffbdfe61f8 [ 1848.044765][T27973] [ 1848.044772][T27973] socket: no more sockets [ 1848.364681][T21624] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1848.504766][T27977] IPVS: lc: FWM 3 0x00000003 - no destination available [ 1848.843145][T27982] input: syz0 as /devices/virtual/input/input57 [ 1848.974354][T21624] usb 4-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 1848.975893][T21624] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1848.975944][T21624] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1851.129018][ T52] Bluetooth: hci3: command 0x0406 tx timeout [ 1851.192225][T21371] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 1851.252425][T21371] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 1852.299730][T21624] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 1852.461172][T21624] usb 3-1: Using ep0 maxpacket: 32 [ 1852.463273][T21624] usb 3-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 1852.464234][T21624] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 1852.464270][T21624] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 1852.519069][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 1852.802775][T21633] usb 4-1: USB disconnect, device number 88 [ 1852.830847][T21624] usb 3-1: string descriptor 0 read error: -22 [ 1852.831438][T21624] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1852.886580][T27992] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1852.917524][T21624] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1852.917572][T21624] usb 3-1: MIDIStreaming interface descriptor not found [ 1853.318693][T21371] bridge0: port 3(wlan1) entered disabled state [ 1853.576111][T21633] usb 3-1: USB disconnect, device number 86 [ 1853.620294][T12776] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1853.784734][T12776] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 1853.790880][T12776] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1853.830472][T12776] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1853.830567][T12776] usb 4-1: Product: syz [ 1853.830726][T12776] usb 4-1: Manufacturer: syz [ 1853.830807][T12776] usb 4-1: SerialNumber: syz [ 1854.758749][T12776] usb 4-1: Cannot retrieve CPort count: -110 [ 1854.759072][T12776] usb 4-1: Cannot retrieve CPort count: -110 [ 1854.759868][T12776] es2_ap_driver 4-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 1855.635002][T21371] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1855.635068][T21371] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 1855.646128][ C1] ------------[ cut here ]------------ [ 1855.646140][ C1] workqueue: cannot queue hci_cmd_timeout on wq hci0 [ 1855.646179][ C1] WARNING: kernel/workqueue.c:2352 at __queue_work+0xdb7/0x1370, CPU#1: kworker/1:2H/20916 [ 1855.682151][ C1] Modules linked in: [ 1855.686028][ C1] CPU: 1 UID: 0 PID: 20916 Comm: kworker/1:2H Tainted: G L syzkaller #0 PREEMPT(full) [ 1855.697114][ C1] Tainted: [L]=SOFTLOCKUP [ 1855.701423][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1855.711470][ C1] Workqueue: events_highpri snd_vmidi_output_work [ 1855.717873][ C1] RIP: 0010:__queue_work+0xdbb/0x1370 [ 1855.723237][ C1] Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 84 05 00 00 48 8d 3d e9 7f 77 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 [ 1855.742829][ C1] RSP: 0018:ffffc90000a18b68 EFLAGS: 00010046 [ 1855.748873][ C1] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1101383994e [ 1855.756821][ C1] RDX: ffff88807ca48170 RSI: ffffffff8ac38140 RDI: ffffffff91482bc0 [ 1855.764772][ C1] RBP: ffff88809c1cca58 R08: 0000000000000007 R09: 0000000000000000 [ 1855.772720][ C1] R10: 0000000000000100 R11: 0000000000000001 R12: ffff88807ca48000 [ 1855.780674][ C1] R13: 1ffff92000143177 R14: 0000000000000000 R15: ffffffff81d0b1a0 [ 1855.788622][ C1] FS: 0000000000000000(0000) GS:ffff888123c53000(0000) knlGS:0000000000000000 [ 1855.797527][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1855.804085][ C1] CR2: 000020000000e000 CR3: 00000000661d7000 CR4: 00000000003526f0 [ 1855.812038][ C1] Call Trace: [ 1855.815292][ C1] [ 1855.818115][ C1] ? lock_acquire+0x1d1/0x380 [ 1855.822772][ C1] ? call_timer_fn+0x11d/0x5f0 [ 1855.827514][ C1] ? __pfx___queue_work+0x10/0x10 [ 1855.832528][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1855.838328][ C1] call_timer_fn+0x198/0x5f0 [ 1855.842896][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 1855.847982][ C1] ? lock_acquire+0x1d1/0x380 [ 1855.852642][ C1] ? __run_timers+0x560/0xb00 [ 1855.857299][ C1] ? __run_timers+0x560/0xb00 [ 1855.861958][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1855.867749][ C1] __run_timers+0x570/0xb00 [ 1855.872235][ C1] ? __pfx___run_timers+0x10/0x10 [ 1855.877236][ C1] ? clockevents_program_event+0x23e/0x820 [ 1855.883029][ C1] ? lock_acquire+0x1d1/0x380 [ 1855.887701][ C1] ? _raw_spin_lock_irq+0x45/0x50 [ 1855.892710][ C1] run_timer_base+0x114/0x190 [ 1855.897365][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 1855.902546][ C1] run_timer_softirq+0x1a/0x50 [ 1855.907291][ C1] handle_softirqs+0x1e6/0x9d0 [ 1855.912049][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 1855.917331][ C1] ? _raw_spin_unlock+0x28/0x50 [ 1855.922164][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 1855.927817][ C1] __irq_exit_rcu+0x16a/0x210 [ 1855.932474][ C1] irq_exit_rcu+0x9/0x30 [ 1855.936695][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 1855.942311][ C1] [ 1855.945217][ C1] [ 1855.948128][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1855.954084][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 1855.960481][ C1] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 b6 eb 12 f6 48 89 df e8 3e 42 13 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 c5 38 02 f6 65 48 83 3d 34 64 b8 08 00 74 16 5b [ 1855.980079][ C1] RSP: 0018:ffffc90005477b18 EFLAGS: 00000246 [ 1855.986121][ C1] RAX: 0000000000000002 RBX: ffff88802be7a738 RCX: 0000000000000040 [ 1855.994069][ C1] RDX: 0000000000000001 RSI: ffffffff8e38cf0c RDI: ffffffff8c623580 [ 1856.002015][ C1] RBP: 0000000000000293 R08: 0000000000000001 R09: 0000000000000000 [ 1856.009965][ C1] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000293 [ 1856.017918][ C1] R13: ffff88802be7a738 R14: 0000000000000001 R15: ffff88803369ec00 [ 1856.025893][ C1] snd_rawmidi_transmit+0xf1/0x130 [ 1856.030993][ C1] snd_vmidi_output_work+0x111/0x390 [ 1856.036272][ C1] ? process_one_work+0xa2c/0x1b10 [ 1856.041368][ C1] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 1856.047155][ C1] ? process_one_work+0x906/0x1b10 [ 1856.052254][ C1] ? process_one_work+0x906/0x1b10 [ 1856.057369][ C1] process_one_work+0xac7/0x1b10 [ 1856.062297][ C1] ? __pfx_process_one_work+0x10/0x10 [ 1856.067654][ C1] ? lock_acquire+0x1d1/0x380 [ 1856.072315][ C1] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 1856.078110][ C1] worker_thread+0x5ef/0xe50 [ 1856.082690][ C1] ? __pfx_worker_thread+0x10/0x10 [ 1856.087787][ C1] ? kthread+0x13a/0x450 [ 1856.092031][ C1] ? __pfx_worker_thread+0x10/0x10 [ 1856.097129][ C1] kthread+0x373/0x450 [ 1856.101179][ C1] ? __pfx_kthread+0x10/0x10 [ 1856.105754][ C1] ret_from_fork+0x730/0xd60 [ 1856.110325][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1856.115413][ C1] ? __switch_to+0x800/0x10f0 [ 1856.120082][ C1] ? __pfx_kthread+0x10/0x10 [ 1856.124674][ C1] ret_from_fork_asm+0x1a/0x30 [ 1856.129446][ C1] [ 1856.132446][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1856.139710][ C1] CPU: 1 UID: 0 PID: 20916 Comm: kworker/1:2H Tainted: G L syzkaller #0 PREEMPT(full) [ 1856.150793][ C1] Tainted: [L]=SOFTLOCKUP [ 1856.155093][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1856.165126][ C1] Workqueue: events_highpri snd_vmidi_output_work [ 1856.171525][ C1] Call Trace: [ 1856.174782][ C1] [ 1856.177606][ C1] dump_stack_lvl+0x100/0x190 [ 1856.182273][ C1] vpanic+0x553/0x970 [ 1856.186245][ C1] ? __pfx_vpanic+0x10/0x10 [ 1856.190732][ C1] panic+0xd1/0xe0 [ 1856.194445][ C1] ? __pfx_panic+0x10/0x10 [ 1856.198850][ C1] check_panic_on_warn.cold+0x19/0x34 [ 1856.204234][ C1] ? __queue_work+0xdb7/0x1370 [ 1856.208984][ C1] __warn.cold+0x191/0x318 [ 1856.213379][ C1] __report_bug+0x30f/0x440 [ 1856.217878][ C1] ? __queue_work+0xdb7/0x1370 [ 1856.222639][ C1] ? __pfx___report_bug+0x10/0x10 [ 1856.227646][ C1] ? debug_object_activate+0x343/0x4b0 [ 1856.233085][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 1856.238350][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1856.244137][ C1] ? debug_object_activate+0x343/0x4b0 [ 1856.249577][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1856.254934][ C1] report_bug_entry+0xe2/0x290 [ 1856.259680][ C1] ? __queue_work+0xdbb/0x1370 [ 1856.264432][ C1] handle_bug+0x1cd/0x2a0 [ 1856.268746][ C1] exc_invalid_op+0x17/0x50 [ 1856.273229][ C1] asm_exc_invalid_op+0x1a/0x20 [ 1856.278081][ C1] RIP: 0010:__queue_work+0xdbb/0x1370 [ 1856.283436][ C1] Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 84 05 00 00 48 8d 3d e9 7f 77 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 [ 1856.303020][ C1] RSP: 0018:ffffc90000a18b68 EFLAGS: 00010046 [ 1856.309070][ C1] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1101383994e [ 1856.317025][ C1] RDX: ffff88807ca48170 RSI: ffffffff8ac38140 RDI: ffffffff91482bc0 [ 1856.324974][ C1] RBP: ffff88809c1cca58 R08: 0000000000000007 R09: 0000000000000000 [ 1856.332945][ C1] R10: 0000000000000100 R11: 0000000000000001 R12: ffff88807ca48000 [ 1856.340915][ C1] R13: 1ffff92000143177 R14: 0000000000000000 R15: ffffffff81d0b1a0 [ 1856.348864][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1856.354666][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 1856.359950][ C1] ? __queue_work+0xd89/0x1370 [ 1856.364700][ C1] ? lock_acquire+0x1d1/0x380 [ 1856.369363][ C1] ? call_timer_fn+0x11d/0x5f0 [ 1856.374102][ C1] ? __pfx___queue_work+0x10/0x10 [ 1856.379119][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1856.384938][ C1] call_timer_fn+0x198/0x5f0 [ 1856.389513][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 1856.394602][ C1] ? lock_acquire+0x1d1/0x380 [ 1856.399275][ C1] ? __run_timers+0x560/0xb00 [ 1856.403931][ C1] ? __run_timers+0x560/0xb00 [ 1856.408590][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1856.414385][ C1] __run_timers+0x570/0xb00 [ 1856.418880][ C1] ? __pfx___run_timers+0x10/0x10 [ 1856.423904][ C1] ? clockevents_program_event+0x23e/0x820 [ 1856.429698][ C1] ? lock_acquire+0x1d1/0x380 [ 1856.434356][ C1] ? _raw_spin_lock_irq+0x45/0x50 [ 1856.439368][ C1] run_timer_base+0x114/0x190 [ 1856.444030][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 1856.449208][ C1] run_timer_softirq+0x1a/0x50 [ 1856.453949][ C1] handle_softirqs+0x1e6/0x9d0 [ 1856.458696][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 1856.463961][ C1] ? _raw_spin_unlock+0x28/0x50 [ 1856.468792][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 1856.474429][ C1] __irq_exit_rcu+0x16a/0x210 [ 1856.479086][ C1] irq_exit_rcu+0x9/0x30 [ 1856.483306][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 1856.488922][ C1] [ 1856.491831][ C1] [ 1856.494744][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1856.500711][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 1856.507110][ C1] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 b6 eb 12 f6 48 89 df e8 3e 42 13 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 c5 38 02 f6 65 48 83 3d 34 64 b8 08 00 74 16 5b [ 1856.526694][ C1] RSP: 0018:ffffc90005477b18 EFLAGS: 00000246 [ 1856.532751][ C1] RAX: 0000000000000002 RBX: ffff88802be7a738 RCX: 0000000000000040 [ 1856.540698][ C1] RDX: 0000000000000001 RSI: ffffffff8e38cf0c RDI: ffffffff8c623580 [ 1856.548650][ C1] RBP: 0000000000000293 R08: 0000000000000001 R09: 0000000000000000 [ 1856.556613][ C1] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000293 [ 1856.564560][ C1] R13: ffff88802be7a738 R14: 0000000000000001 R15: ffff88803369ec00 [ 1856.572518][ C1] snd_rawmidi_transmit+0xf1/0x130 [ 1856.577622][ C1] snd_vmidi_output_work+0x111/0x390 [ 1856.582892][ C1] ? process_one_work+0xa2c/0x1b10 [ 1856.587994][ C1] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 1856.593803][ C1] ? process_one_work+0x906/0x1b10 [ 1856.598911][ C1] ? process_one_work+0x906/0x1b10 [ 1856.604010][ C1] process_one_work+0xac7/0x1b10 [ 1856.608958][ C1] ? __pfx_process_one_work+0x10/0x10 [ 1856.614317][ C1] ? lock_acquire+0x1d1/0x380 [ 1856.618976][ C1] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 1856.624774][ C1] worker_thread+0x5ef/0xe50 [ 1856.629369][ C1] ? __pfx_worker_thread+0x10/0x10 [ 1856.634491][ C1] ? kthread+0x13a/0x450 [ 1856.638727][ C1] ? __pfx_worker_thread+0x10/0x10 [ 1856.643908][ C1] kthread+0x373/0x450 [ 1856.647959][ C1] ? __pfx_kthread+0x10/0x10 [ 1856.652532][ C1] ret_from_fork+0x730/0xd60 [ 1856.657103][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1856.662196][ C1] ? __switch_to+0x800/0x10f0 [ 1856.666944][ C1] ? __pfx_kthread+0x10/0x10 [ 1856.671519][ C1] ret_from_fork_asm+0x1a/0x30 [ 1856.676281][ C1] [ 1856.679524][ C1] Kernel Offset: disabled [ 1856.683830][ C1] Rebooting in 86400 seconds..