last executing test programs: 58.317026839s ago: executing program 4 (id=34): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e21, @private=0xa010102}], 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, 0x0, 0x80) syz_usb_connect$hid(0x2, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x644001, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) process_madvise(0xffffffffffffffff, 0x0, 0x0, 0xa, 0x0) rt_sigpending(0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$usbfs(0x0, 0x204, 0x260203) fcntl$setsig(0xffffffffffffffff, 0xa, 0x21) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000002c0)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2800003, 0x31, r2, 0x231cd000) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x428}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000340)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa04, &(0x7f0000000380)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) sendmsg$kcm(r1, &(0x7f0000000200)={0x0, 0xc3ff, &(0x7f0000000240)=[{&(0x7f0000000280)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfecc}, 0x40000002) r4 = landlock_create_ruleset(&(0x7f0000000080)={0x120, 0xd, 0x3}, 0x30, 0x0) landlock_restrict_self(r4, 0xe) r5 = inotify_init() inotify_add_watch(r5, &(0x7f00000000c0)='.\x00', 0x400017e) 54.696867386s ago: executing program 4 (id=44): r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000740), &(0x7f0000000780)='./file0\x00', 0x0, &(0x7f00000007c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) close(r1) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000004c0)='/sys/power/pm_freeze_timeout', 0x101, 0x10c) fcntl$lock(r2, 0x26, &(0x7f0000000500)={0x0, 0x2, 0x0, 0xffffffffffffffff}) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000880)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) open(&(0x7f0000000840)='./file0\x00', 0x410083, 0x2) fsetxattr(r0, &(0x7f00000006c0)=@random={'user.', '(+(.([\x00'}, 0x0, 0x0, 0x0) close(r0) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt(r3, 0x7, 0xf, &(0x7f0000003cc0)=""/4096, &(0x7f0000004cc0)=0x1000) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) r4 = add_key$user(&(0x7f0000000540), &(0x7f0000000580)={'syz', 0x1}, &(0x7f00000005c0)="d7f0ff64382de101025e0323d947f16caf07e194d9e4ebbf518405df3472a73fcb6611e1c73d747ab26b4b3666ebc040b07e2dbd8eb2c7734295826a39d515f86ed37a1474a8eb1014524eb6ed1a52d2f9552320d911847c27b08146d0227741460f10f0182e1743db0c9a3910a9bcd99429ffc4ffa4efe940cfdbcc8087e00d66b11caa4ac514e3a112b7d105e4de4c69c725a0f61cf2faa599651eae42e456d243ee6e3a04ab8ab776466863e413d18651931d23543670f5d906339148fee4d76ff0e6311a593e6216516ceb575b84301d759f7f47313af4d584467e", 0xdd, 0xfffffffffffffffc) keyctl$setperm(0x5, r4, 0x80408) recvmmsg(r3, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)=""/138, 0x8a}, {&(0x7f0000000380)=""/199, 0xc7}, {&(0x7f0000000480)=""/56, 0x38}, {&(0x7f0000000a00)=""/4092, 0xffc}], 0x4}, 0x2}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, &(0x7f00000004c0)}, 0x8fffff}], 0x7, 0x0, 0x0) 54.111794586s ago: executing program 4 (id=46): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bcb7f620e90f01d55023010203010902130001000000000904"], 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f00000004c0), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000500)={0xe9, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0xffffffff, 0x1, 0xffffbfff, 0x1, 0xffffdfff, 0x3, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x3fc, 0xffc, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) socket$nl_route(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@newtclass={0x24, 0x28, 0x4, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x9, 0x4}, {0x7, 0xb}, {0xb, 0xf}}}, 0x24}}, 0x80000) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000a40)=ANY=[@ANYBLOB="64000000100001042cbd700000000000000000008dfd38fb2b1c7a33b39077560c707a3d950919ab2a65ff4bd5314b64ef0a1d4ee96170600ffadfc95548354cc00360e755457281ce1f5d919d4f4e506e9d1ee8aa864a9806792427d5a78166ddf66e2a432f5d7d0d1effdba6b445c266103de764ea4100f395fb3b6791873d2e7b58182fa603", @ANYRES32=0x0, @ANYBLOB="998003000c200000300012800e00010069703665727370616e0000001c00028014000700ff02000000000000000000000000000104001200140003006e6963766630000000000000000000"], 0x64}, 0x1, 0x0, 0x0, 0x8c1}, 0x0) sendmmsg(r1, &(0x7f0000000a40), 0x40000000000009f, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000780)={'veth1_to_bond\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000007c0)={r3, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000800)={0x0, 0x8001}, 0x1) syz_emit_ethernet(0xfdef, &(0x7f0000000840)=ANY=[@ANYBLOB="e904a20000000180c20000008100020008004500001c0000e000001190780000510000200005eaffffffff079078"], 0x0) r6 = syz_open_dev$I2C(&(0x7f00000009c0), 0x1, 0x101d00) ioctl$I2C_RDWR(r6, 0x707, &(0x7f0000000100)={&(0x7f0000000140)=[{0xff7, 0xa000, 0x2000, &(0x7f00000001c0)="448ce418a216b3efbb2c4af8a98f2e9df3d89fa27fe120c695e6f1ce1e4d599b8ee81c85401eedf88f58f5ea340801d09b5b019aa8b420b3044e9a5b5aa7a2b26198494bc8c279337164ee1e84ba"}], 0x1}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {0x4, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x4c041) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newtfilter={0x38, 0x2c, 0xf3f, 0x7, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0xb, 0xfff3}, {0x0, 0xfff3}, {0xd, 0xfff1}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x0, 0x5}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x240000c0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="1800000058000d03000000000000000004479d8243000380"], 0x18}], 0x1}, 0x40040) setsockopt$sock_linger(r7, 0x1, 0xd, &(0x7f00000003c0)={0x1, 0xffffff01}, 0x8) r10 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$OCFS2_IOC_MOVE_EXT(r10, 0x40406f06, &(0x7f00000000c0)={0x3ff, 0x5, 0x4, 0x8000000000000001, 0x6}) 51.035734426s ago: executing program 4 (id=53): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000780)=[@text64={0x40, &(0x7f00000007c0)="b9800000c00f3235000800000f30805000fd450f01f40f017137400f1ee7c403957ca7fd5856025bb805000000b9620000000f01c1debfdbc40000400fc73dadc30000400f78741d01", 0x49}], 0x1, 0x49627e0e9a2bded4, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000840)=[@text16={0x10, &(0x7f0000000880)="66b8003000000f23c80f21f866350c0070000f23f8653e660ffa9700800f1bc6670f01c40f01c40f2265bad004edbaf80c66b8e8c54b8c66efbafc0c66edc225000f5fc9", 0x44}], 0x1, 0x18, 0x0, 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000900), 0x0, 0x2) ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000940)=@userptr={0x1, 0xa, 0x4, 0x80, 0x9, {0x77359400}, {0x2, 0x1, 0x1, 0x42, 0xf5, 0xa, "65caba5a"}, 0x3, 0x2, {0x0}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000100)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40, 0x1) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000500)='./file0\x00', &(0x7f0000000540), 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r9, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r10 = open_tree(0xffffffffffffff9c, &(0x7f0000000600)='\x00', 0x9801) move_mount(r10, 0x0, 0xffffffffffffff9c, 0x0, 0x44) r11 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89101) fchdir(r11) close(r11) pivot_root(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x101001, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_create_resource$binfmt(&(0x7f0000000080)='./file0\x00') sendmsg$IPCTNL_MSG_CT_NEW(r12, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b80)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r12, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="4c00000000010104000000000000000002000000240001801400018008000100e0000000ef000200e00000010c0002800500010000000000140018800800014000000006080002400000000247a504a901b219bb0e361130fc1cd1daf35a08bb9a4ca3730d3f740524aa9b46f8b4a70105cb5123cf9e3be0634abdc036808b17204223b8cffd50c45777d2cad2bb0c718a5fc97f2bc141162d98046eeb577f7df75b7f4e1d3e21922fa90170ee"], 0x4c}, 0x1, 0x0, 0x0, 0x2408c843}, 0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f0000000480)) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000e00)=@newlink={0xb0, 0x10, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x62002, 0x1b475}, [@IFLA_VF_PORTS={0x78, 0x18, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "ccca7eb957c19ec0a22a49cba8e1809d"}, @IFLA_PORT_VF={0x8, 0x1, 0x7f}]}, {0x54, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "82fb83d21a2795c8c95473b77f266001"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "e50000000000000000000000ffffff00"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "de8fb03ef2bfadea5b6997211739884a"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "f3ff6d444b0ac39136dfcb56aa46d59b"}]}]}, @IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN={0x10, 0x2, {0x4, 0x750, 0x1}}]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x24004844}, 0x80) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000d00)={&(0x7f0000000280)={0x114, 0x0, 0x1, 0x801, 0x0, 0x0, {0x1, 0x0, 0x2}, [@CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x1}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x8}, @CTA_TUPLE_MASTER={0xb4, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @rand_addr=0x64010100}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x90}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x3}, @CTA_SYNPROXY={0x4}, @CTA_TUPLE_MASTER={0x30, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @private1}}}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x14}, 0x0) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), r11) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r11, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r13, 0x20, 0x70bd28, 0x25dfdbfd, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24000001}, 0x0) 50.059161883s ago: executing program 4 (id=56): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r2 = socket$key(0xf, 0x3, 0x2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) copy_file_range(r6, 0x0, r6, 0x0, 0x35, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r5, 0x0, 0x0, 0x0, 0x0, 0x1}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001b80)=ANY=[@ANYRES8=r1], 0x0, 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x27}, 0x94) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0600000004000000990500000a"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001340), &(0x7f0000000900), 0x404, r8, 0x0, 0x1ba8847c99}, 0x38) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r5, 0x0, &(0x7f00002ce000/0x1000)=nil, 0x1000, 0x1020800}) ioctl$IOMMU_HWPT_ALLOC$TEST(r4, 0x3b89, &(0x7f0000000440)={0x28, 0x2, r7, r5, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000400)}) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(r4, 0x3b8b, &(0x7f0000000480)={0x10, 0x1, r9}) sendmsg$nl_xfrm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@allocspi={0xf8, 0x16, 0x1, 0x70bd2b, 0x25dfdbfe, {{{@in=@empty, @in=@private=0xa010101, 0x4e23, 0x0, 0x4e24, 0x0, 0xa, 0x80, 0x20, 0x5e}, {@in6=@local, 0x4d5, 0x33}, @in=@dev={0xac, 0x14, 0x14, 0x10}, {0x8, 0x7b5, 0x0, 0x6, 0x9, 0x0, 0xffffffff, 0x3}, {0x2, 0x3, 0x1, 0xfffffffffffffffa}, {0x0, 0x10001, 0xfffffff9}, 0x70bd2a, 0x0, 0x0, 0x2, 0x6, 0x1}, 0x8, 0x74f}}, 0xf8}, 0x1, 0x0, 0x0, 0x10}, 0x400c8c0) sendmsg$key(r2, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x7, 0x0, 0x70bd28, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@empty, @in=@rand_addr=0x64010100, 0x2c, 0x30}]}, 0x38}}, 0x40408c0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xc, 0xd}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x1, '\x00', 0x1, 0x7, 0x100, 0x9}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r10) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r12 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000140)={'syzkaller0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(r6, 0xc0189376, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) setsockopt$sock_attach_bpf(r12, 0x107, 0xf, &(0x7f0000000600), 0x56) 49.104869741s ago: executing program 4 (id=58): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f0000000040), 0x0, 0x0, 0x0, &(0x7f0000000080)) syz_open_dev$video4linux(0x0, 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004800}, 0x4) ftruncate(r1, 0x8008976) syz_usb_connect(0x3, 0x32, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd25, 0x25dfdbff, {{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x4, 0x400, 0xa, 0x80, 0x20, 0x87}, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000, 0xfffffffffffffffb}, {0x0, 0x1000, 0x200000000000004}, 0x800, 0x6e6bb0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x800}, 0x8008010) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, 0x0, 0x2c000010) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7c, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 47.218379352s ago: executing program 32 (id=58): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f0000000040), 0x0, 0x0, 0x0, &(0x7f0000000080)) syz_open_dev$video4linux(0x0, 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004800}, 0x4) ftruncate(r1, 0x8008976) syz_usb_connect(0x3, 0x32, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd25, 0x25dfdbff, {{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x4, 0x400, 0xa, 0x80, 0x20, 0x87}, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000, 0xfffffffffffffffb}, {0x0, 0x1000, 0x200000000000004}, 0x800, 0x6e6bb0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x800}, 0x8008010) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, 0x0, 0x2c000010) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7c, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12.317604086s ago: executing program 0 (id=202): r0 = syz_usb_connect(0x2, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_disconnect(0xffffffffffffffff) r1 = io_uring_setup(0x68f6, &(0x7f0000000240)={0x0, 0x2000e6ef, 0x8, 0x4, 0x110016b}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r2, 0x2000005) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1, 0x2000000, 0xaaedbc8f6d5e3af2, r1, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f00000002c0)={0xfb, 0x11, 0x30, 0x98, "4d512c91002a4950676142687108dcd3f82acf5a895bd90fca2bb40bb4fbf29c"}) socket(0x2, 0x3, 0xff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x48050) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0x10) sendmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0) read$char_usb(r3, &(0x7f0000000400)=""/188, 0xba) read$char_usb(r3, 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$hid(0x0, 0x34, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f6, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0x1ff, 0x1501) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f00000000c0)=@urb_type_control={0x2, {}, 0xffffffec, 0x81, &(0x7f0000000100)={0x0, 0x3, 0x18}, 0x8, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0}) 9.669608909s ago: executing program 0 (id=216): syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010003001f66088f0510660548020003010902120001049570810904008100ffffff02"], &(0x7f00000001c0)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) (async) r0 = syz_open_dev$I2C(&(0x7f0000000200), 0x1, 0x402) r1 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, 0x0) (async) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0x6, 0x4201, 0x0, 0x0}, {0x401, 0x2000, 0x0, 0x0}], 0x2}) (async) r2 = socket$igmp(0x2, 0x3, 0x2) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) syz_usb_connect(0x3, 0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="120110011d237220b40431689c4c0102030109021200015b9e00080904"], 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) (async) socket$can_bcm(0x1d, 0x2, 0x2) (async) r4 = syz_open_dev$vim2m(&(0x7f0000000040), 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000080)={0x1, 0x2, 0x1}) (async) ioctl$vim2m_VIDIOC_STREAMON(r4, 0x40045612, &(0x7f00000000c0)=0x2) (async) ioctl$VIDIOC_DECODER_CMD(r4, 0xc0485660, &(0x7f0000000100)={0x1, 0x1, @stop_pts=0x5}) (async) close(r3) (async) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x8, 0x3, 0x228, 0x0, 0xa, 0xd0e0000, 0x100, 0x100, 0x190, 0x1d8, 0x1d8, 0x190, 0x1d8, 0x3, 0x0, {[{{@uncond, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x0, {0x1}}}, @common=@inet=@l2tp={{0x30}, {0x2, 0x1, 0x23, 0x0, 0xc}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x4, 0x4}, {0x0, 0x6, 0x1}}}}, {{@ip={@private=0xa010100, @loopback, 0x0, 0xffffffff, 'batadv0\x00', 'tunl0\x00', {}, {0xff}, 0x11, 0x3}, 0x3202, 0x70, 0x90}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x288) 7.982101931s ago: executing program 5 (id=227): r0 = syz_io_uring_setup(0x6de4, &(0x7f0000000640)={0x0, 0x961b, 0x2, 0x2}, &(0x7f00000006c0), &(0x7f0000000700), &(0x7f0000000740)) io_uring_enter(r0, 0x0, 0xe38e, 0x5, 0x0, 0x0) (async) io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f0000000780)={0x2, 0x0, 0x0, &(0x7f00000007c0)=[{0x0}, {&(0x7f0000000800)=""/191, 0xbf}], &(0x7f00000008c0)=[0x0, 0x2]}, 0x20) (async) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)=[{0x0}, {0x0}], 0x0, 0x2}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$sierra_net(r2, 0x0, &(0x7f0000000100)={0x10, &(0x7f0000000140)=ANY=[], 0x0, 0x0}) (async) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) r4 = syz_io_uring_setup(0xf00, &(0x7f0000000180)={0x0, 0x5961, 0x10000, 0x0, 0xea}, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f00000002c0)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4007, @fd=r3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x18, 0x26, 0x301, 0x270bd1d, 0x25dfdbf4, {0x5}, [@generic="d4"]}, 0x18}, 0x1, 0x0, 0x0, 0x40811}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000004c0)={'wlan0\x00', 0x0}) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000500)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r8, &(0x7f0000000600)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x5c, 0x0, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x2e6}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x1d7}, @NL80211_ATTR_STA_VLAN={0x8, 0x14, r10}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0x3ff}, @NL80211_ATTR_VLAN_ID={0x6, 0x11a, 0x1}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6}, @NL80211_ATTR_STA_VLAN={0x8, 0x14, r11}]}, 0x5c}, 0x1, 0x0, 0x0, 0x44000}, 0x4000000) (async) io_uring_enter(r4, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newlink={0x54, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x115}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x8100}, @IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r13}, @IFLA_MASTER={0x8, 0xa, r13}]}, 0x54}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) (async) close_range(r1, 0xffffffffffffffff, 0x0) 6.420313506s ago: executing program 0 (id=234): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c00000001090212000100000000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000001280)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000012c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000001300)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r2 = getpid() process_vm_readv(r2, &(0x7f0000001340)=[{&(0x7f0000001380)=""/54, 0x7ffff000}, {&(0x7f00000013c0)=""/152, 0x98}], 0x2, &(0x7f0000001480)=[{&(0x7f00000014c0)=""/95, 0x7ffff000}], 0x286, 0x9000000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) 5.37451581s ago: executing program 2 (id=239): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_io_uring_setup(0x3b88, &(0x7f0000000240)={0x0, 0x9b6, 0x2, 0x23, 0x2bb}, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000600)) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) memfd_create(&(0x7f0000000000)='\x02A\xbb\xcc\x96\x0eo\x1f\xe2@\xcc\xb1Yg\x00\x00\x00\x00\x00\x00', 0xb) socket(0x2, 0x3, 0xff) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = fsopen(&(0x7f00000001c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0xa) fchdir(r4) chdir(&(0x7f0000000200)='./sys\x00') open(&(0x7f00000002c0)='./debug\x00', 0x8000, 0x50) socket$kcm(0x1e, 0x5, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r5, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4ea5, 0x9, @mcast1, 0x8}, 0xffffffffffffffff, 0x8001}}, 0x48) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 5.363832457s ago: executing program 1 (id=240): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x42, 0x0, &(0x7f0000000900)="b44c80630562443108347301af47fa0ff9b11fe7d5fe008c6392009c5bbd04080086ce51dec47deffb9de8b4645c2b9c0614907dac12c6d34a82e6e6124b92ca1e29", 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0xfffffce2}, 0x50) r0 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x401) ioctl$FIBMAP(r0, 0x5381, &(0x7f0000000040)=0x85) 5.136007838s ago: executing program 1 (id=241): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="05000000e4ef1f00680000007f00000001"], 0x48) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, 0x0) prctl$PR_SET_NAME(0x4, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0xa4342, 0x0) syz_clone3(&(0x7f0000000040)={0xa690b000, &(0x7f0000000100)=0xffffffffffffffff, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) pidfd_getfd(r1, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000580)={r0, 0x0, 0x0}, 0x20) 4.979234977s ago: executing program 2 (id=242): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) (async) close(0xffffffffffffffff) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x1, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x20020800) (async) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0x6}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x5}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) (async) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x2, 0x40, 0x7fff0000}]}) open_tree(0xffffffffffffff9c, 0x0, 0x89901) (async) r3 = gettid() ioprio_get$pid(0x2, r3) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) (async, rerun: 64) msgsnd(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="030000"], 0x8, 0x0) (async, rerun: 64) r4 = socket$packet(0x11, 0x3, 0x300) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r5, 0x84, 0x81, &(0x7f0000000000)="1a00000002000000", 0x8) (async) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, 0x0, 0x9) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000340), 0x0) ioctl$BLKDISCARD(r6, 0x1277, &(0x7f0000000380)=0x5) (async) syz_emit_ethernet(0x7a, &(0x7f0000000280)={@random="856b934629fa", @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "381f34", 0x44, 0x2f, 0x0, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8100, 0x0, 0x892f}, {}, {}, {0xa888, 0x88be, 0x0, {{}, 0x1, {0xb5}}}}}}}}}, 0x0) (async) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) read(r4, &(0x7f0000000200)=""/49, 0x31) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) (rerun: 64) sendto$packet(r4, &(0x7f00000002c0)="0503e5fdd3fc14f9fd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x8100, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) 4.745479721s ago: executing program 1 (id=243): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000040), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000080)=0xcde, 0x4) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f00000000c0)={@private1={0xfc, 0x1, '\x00', 0x1}, @mcast2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) sendmsg$NL80211_CMD_START_P2P_DEVICE(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x18000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x20, r2, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x9, 0x3a}}}}, ["", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xd0}, 0x4000000) 4.628825236s ago: executing program 5 (id=244): bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1a, 0x4, 0x8, 0x1, 0x481, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0xa455, 0x0, @void, @value, @void, @value=0x13}, 0x50) 4.550090554s ago: executing program 1 (id=245): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$key(0xf, 0x3, 0x2) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) copy_file_range(r7, 0x0, r7, 0x0, 0x35, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r6, 0x0, 0x0, 0x0, 0x0, 0x1}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0600000004000000990500000a"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001340), &(0x7f0000000900), 0x404, r9, 0x0, 0x1ba8847c99}, 0x38) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r6, 0x0, &(0x7f00002ce000/0x1000)=nil, 0x1000, 0x1020800}) ioctl$IOMMU_HWPT_ALLOC$TEST(r5, 0x3b89, &(0x7f0000000440)={0x28, 0x2, r8, r6, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000400)}) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(r5, 0x3b8b, &(0x7f0000000480)={0x10, 0x1, r10}) sendmsg$nl_xfrm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@allocspi={0xf8, 0x16, 0x1, 0x70bd2b, 0x25dfdbfe, {{{@in=@empty, @in=@private=0xa010101, 0x4e23, 0x0, 0x4e24, 0x0, 0xa, 0x80, 0x20, 0x5e}, {@in6=@local, 0x4d5, 0x33}, @in=@dev={0xac, 0x14, 0x14, 0x10}, {0x8, 0x7b5, 0x0, 0x6, 0x9, 0x0, 0xffffffff, 0x3}, {0x2, 0x3, 0x1, 0xfffffffffffffffa}, {0x0, 0x10001, 0xfffffff9}, 0x70bd2a, 0x0, 0x0, 0x2, 0x6, 0x1}, 0x8, 0x74f}}, 0xf8}, 0x1, 0x0, 0x0, 0x10}, 0x400c8c0) sendmsg$key(r3, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x7, 0x0, 0x70bd28, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@empty, @in=@rand_addr=0x64010100, 0x2c, 0x30}]}, 0x38}}, 0x40408c0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xc, 0xd}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x1, '\x00', 0x1, 0x7, 0x100, 0x9}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r13 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000140)={'syzkaller0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(r7, 0xc0189376, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) setsockopt$sock_attach_bpf(r13, 0x107, 0xf, &(0x7f0000000600), 0x56) 4.341433712s ago: executing program 5 (id=246): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x50, 0xff}, {0x16, 0x0, 0x3, 0x1}]}, 0x10) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)={0x58, 0x2, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x40000000}]}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008010}, 0x48040880) 4.08502102s ago: executing program 5 (id=248): sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000040)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000100)="88", 0x1}], 0x1}, 0x4048043) r0 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f00000001c0)=0x3) fcntl$setsig(r1, 0xa, 0x12) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000340)={0x0, 0x1c, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x4, @local, 0x9}]}, &(0x7f00000003c0)=0x10) clock_gettime(0x0, &(0x7f0000000400)) rt_sigtimedwait(&(0x7f0000000440)={[0x8000000000000000]}, &(0x7f0000000480), 0x0, 0x8) poll(&(0x7f0000000500)=[{r2}], 0x2c, 0xffffffffffbffff8) r4 = dup2(r1, r2) fcntl$setown(r4, 0x8, r0) tkill(r0, 0x13) getsockopt$inet_sctp6_SCTP_REMOTE_UDP_ENCAPS_PORT(0xffffffffffffffff, 0x84, 0x84, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @local}}, 0x4e24}, &(0x7f0000000300)=0x90) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@ipv4_delrule={0x30, 0x21, 0x1, 0x70bd2b, 0x25dfdbdb, {0x2, 0x0, 0x0, 0xdd, 0x0, 0x0, 0x0, 0x1, 0x10008}, [@FRA_GENERIC_POLICY=@FRA_OIFNAME={0x14, 0x11, 'pimreg\x00'}]}, 0x30}}, 0x8810) 3.995568831s ago: executing program 1 (id=249): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'wg2\x00'}) (async) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[], 0x68}}, 0x0) (async) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f0000000100), 0x10) (async) sendmsg$can_bcm(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="05000000c304115a0000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64, @ANYBLOB="0000004001"], 0x48}, 0x1, 0x0, 0x0, 0x5}, 0x40090) (async) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r2, 0x84, 0x74, &(0x7f0000000600)=""/221, &(0x7f0000000700)=0xdd) (async) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000040)=0x2, 0x4) (async, rerun: 32) sendmmsg$inet(r2, &(0x7f0000000080)=[{{&(0x7f0000000400)={0x2, 0x4e24, @private=0xa010100}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000240)='\x00'}, {&(0x7f0000000180)="52202ed50d9f3e7ae17a769ee60d1230a3ea5564639a3e635c3ce48ffbc57b05"}], 0x1, 0x0, 0xffffffffffffffd0}}, {{&(0x7f0000000200)={0x2, 0x4e24, @multicast1}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000340)="d2a505b308", 0x5}], 0x1}}], 0x2, 0x40) (async, rerun: 32) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x9) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x20004000) (rerun: 32) 3.664210069s ago: executing program 1 (id=251): socket$inet_udp(0x2, 0x2, 0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000040)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000000c0), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) syz_usb_connect$uac2(0x1, 0x87, &(0x7f0000000400)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x582, 0x10f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x75, 0x3, 0x1, 0x10, 0xdb8df2ae77b8443f, 0x9, {0x8, 0xb, 0x1, 0x1, 0x1, 0x7, 0x20, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5, 0xa, 0x15, 0x3}, [@output_terminal={0xc, 0x24, 0x3, 0x5, 0x303, 0x3, 0x6, 0x9, 0x8faf, 0xa}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0xf9, 0x3, 0x2, {0x8, 0x25, 0x1, 0x100, 0xc, 0xe}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x80, 0x5, 0x1, {0x8, 0x25, 0x1, 0x1, 0x30, 0xfc, 0x6}}}}}}}}]}}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x2, &(0x7f0000000540)=@string={0x2}}, {0x0, 0x0}, {0x12, &(0x7f0000000580)=@string={0x12, 0x3, "53a2f6073e9f95a0b7176885390b0828"}}, {0x0, 0x0}]}) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f00000001c0)) r0 = syz_open_dev$vim2m(&(0x7f0000000200), 0x7f9, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000240)={0x0, 0x59565955, 0x1, @stepwise={0x5, 0x0, 0x0, 0x9, 0x0, 0x7}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, &(0x7f0000000300)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r1, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r1, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) fanotify_mark(r1, 0x80, 0x8, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, 0x0) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)) syz_open_dev$video(0x0, 0x3, 0x5c1803) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) 3.643079333s ago: executing program 3 (id=252): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_io_uring_setup(0x3b88, &(0x7f0000000240)={0x0, 0x9b6, 0x2, 0x23, 0x2bb}, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000600)) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) memfd_create(&(0x7f0000000000)='\x02A\xbb\xcc\x96\x0eo\x1f\xe2@\xcc\xb1Yg\x00\x00\x00\x00\x00\x00', 0xb) socket(0x2, 0x3, 0xff) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = fsopen(&(0x7f00000001c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0xa) fchdir(r4) chdir(&(0x7f0000000200)='./sys\x00') open(&(0x7f00000002c0)='./debug\x00', 0x8000, 0x50) socket$kcm(0x1e, 0x5, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r5, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4ea5, 0x9, @mcast1, 0x8}, 0xffffffffffffffff, 0x8001}}, 0x48) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 3.53918478s ago: executing program 5 (id=253): mkdir(0x0, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) fcntl$dupfd(r0, 0x0, r2) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x48, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}]}, 0x48}}, 0x0) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x44, 0xa, 0x6, 0x101, 0xd000000, 0x0, {0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x14, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAME={0x9, 0x12, 'syz2\x00'}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_LINENO={0x8}]}, 0x44}}, 0x0) r3 = socket(0x18, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bond_slave_0\x00', 0x0}) r5 = syz_open_procfs(0x0, &(0x7f0000000380)='ns\x00') renameat2(r5, &(0x7f0000000400)='./file0\x00', r5, &(0x7f0000000440)='./file0\x00', 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x44, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xffff, 0xf}, {0x0, 0xfff3}, {0x2, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x88a8}, @TCA_FLOWER_KEY_VLAN_PRIO={0x5, 0x18, 0x3}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) syz_usb_connect(0x3, 0x50, &(0x7f00000003c0)=ANY=[@ANYBLOB="1201000200000040ca08100100010102030109023e0001010080fa0904000002ff00000007058302000200070504"], 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000240)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) ioctl$VIDIOC_G_TUNER(r5, 0xc054561d, &(0x7f0000000480)={0x0, "28c59013ab993994c099bd49e2fdc41e8007e0a4746963854c06de4c70ae4b84", 0x1, 0x1, 0x0, 0x0, 0x4, 0x3, 0x4}) listen(r6, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000300)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0xff, @remote, @local, {[], {{0x4e20, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x0, 0x0, 0x3ff}}}}}}}, 0x0) r7 = openat$nsim_port_pp_hold(0xffffffffffffff9c, 0x0, 0x200, 0x0) lseek(r7, 0x4, 0x0) 3.538809106s ago: executing program 2 (id=254): socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000080), 0x4bd) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, 0x38, 0x301, 0x70bd25, 0x25dfdbfd, {0x10}}, 0x14}, 0x1, 0x0, 0x0, 0x200448d3}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='=\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='\t'], 0x20) 3.332951387s ago: executing program 2 (id=255): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000040), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000080)=0xcde, 0x4) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f00000000c0)={@private1={0xfc, 0x1, '\x00', 0x1}, @mcast2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) sendmsg$NL80211_CMD_START_P2P_DEVICE(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x18000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x20, r2, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x9, 0x3a}}}}, ["", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xd0}, 0x4000000) 3.248516103s ago: executing program 3 (id=256): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_emit_vhci(&(0x7f0000000280)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0xc, 0xa}, {0x5, 0x8, 0x891b, 0x8, 0x8a}}}}, 0x17) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@ipv4_newaddr={0x20, 0x14, 0x503, 0x0, 0x1000000, {0x2, 0x18, 0x0, 0x0, r3}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000500)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@ipv4_newaddr={0x20, 0x14, 0x503, 0x70bd26, 0x25dfdbff, {0x2, 0x20, 0x53, 0xfe, r6}, [@IFA_LOCAL={0x8, 0x2, @loopback}]}, 0x20}, 0x1, 0x0, 0x0, 0xc091}, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000600)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0) quotactl_fd$Q_GETFMT(0xffffffffffffffff, 0xffffffff80000400, 0x0, 0x0) r7 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) bind$can_j1939(r7, &(0x7f0000000300)={0x1d, 0x0, 0x8000000000000003}, 0x18) sendmsg$NL80211_CMD_RELOAD_REGDB(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x14, 0x0, 0x10, 0x70bd2c, 0x25dfdbff}, 0x206c}, 0x1, 0x0, 0x0, 0x40000}, 0x400c801) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r8, 0x4008ae90, &(0x7f0000002000)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x200000}]}) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x1, 0x3ff, 0x0, 0x0, r9, 0x10000, '\x00', r10, 0xffffffffffffffff, 0x0, 0x4, 0x1, 0x7}, 0x50) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="240000001e00010000000000000000000732"], 0x24}, 0x1, 0x0, 0x0, 0x440d5}, 0x80) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x1b, 0x0, 0xfe600d00}, {0x80f, 0x0, 0x80000000000001ff}]}) 3.206179097s ago: executing program 2 (id=257): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x3000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r0 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000000040), 0x2e9, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x1, &(0x7f0000000080), 0x10) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000000c0)={0x5, 0x81, 0x2, 0x4}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x4, 0x2) 2.402063944s ago: executing program 0 (id=258): r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f00000000c0)={0x1, {{0xa, 0x4e1f, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000000)={0x7, {{0xa, 0x4e21, 0x2, @remote, 0x400}}}, 0x88) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x510, 0x288, 0x288, 0x440, 0x1b8, 0x358, 0x440, 0x440, 0x440, 0x440, 0x440, 0x6, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @empty, [0xffffffff, 0xff000000, 0xffffff00, 0xff000000], [0xffffff00, 0xff, 0xff, 0x7fffffff], 'hsr0\x00', 'xfrm0\x00', {0xff}, {0xff}, 0x29, 0x7, 0x2, 0x1}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x12}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x570) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000240), 0x900, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000280)) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000180)=ANY=[@ANYBLOB="00000000000000000aff0200000000000000000000000000010600000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c2378bcb00"/144], 0x90) 2.349275434s ago: executing program 3 (id=259): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$key(0xf, 0x3, 0x2) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) copy_file_range(r7, 0x0, r7, 0x0, 0x35, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r6, 0x0, 0x0, 0x0, 0x0, 0x1}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0600000004000000990500000a"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001340), &(0x7f0000000900), 0x404, r9, 0x0, 0x1ba8847c99}, 0x38) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r6, 0x0, &(0x7f00002ce000/0x1000)=nil, 0x1000, 0x1020800}) ioctl$IOMMU_HWPT_ALLOC$TEST(r5, 0x3b89, &(0x7f0000000440)={0x28, 0x2, r8, r6, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000400)}) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(r5, 0x3b8b, &(0x7f0000000480)={0x10, 0x1, r10}) sendmsg$nl_xfrm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@allocspi={0xf8, 0x16, 0x1, 0x70bd2b, 0x25dfdbfe, {{{@in=@empty, @in=@private=0xa010101, 0x4e23, 0x0, 0x4e24, 0x0, 0xa, 0x80, 0x20, 0x5e}, {@in6=@local, 0x4d5, 0x33}, @in=@dev={0xac, 0x14, 0x14, 0x10}, {0x8, 0x7b5, 0x0, 0x6, 0x9, 0x0, 0xffffffff, 0x3}, {0x2, 0x3, 0x1, 0xfffffffffffffffa}, {0x0, 0x10001, 0xfffffff9}, 0x70bd2a, 0x0, 0x0, 0x2, 0x6, 0x1}, 0x8, 0x74f}}, 0xf8}, 0x1, 0x0, 0x0, 0x10}, 0x400c8c0) sendmsg$key(r3, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x7, 0x0, 0x70bd28, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@empty, @in=@rand_addr=0x64010100, 0x2c, 0x30}]}, 0x38}}, 0x40408c0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xc, 0xd}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x1, '\x00', 0x1, 0x7, 0x100, 0x9}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r13 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000140)={'syzkaller0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(r7, 0xc0189376, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) setsockopt$sock_attach_bpf(r13, 0x107, 0xf, &(0x7f0000000600), 0x56) 1.854159382s ago: executing program 5 (id=260): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000800}, 0x80) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000480)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b80, &(0x7f0000000540)={0x0, 0x8970, 0x1f280, 0x0, 0x8000399}) syz_emit_ethernet(0x3e, &(0x7f00000005c0)=ANY=[@ANYBLOB="aaaaaaaaaa"], 0x0) io_uring_enter(r0, 0x8ae, 0xfbb9, 0x1f, 0x0, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x27c}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x3}) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000180)={&(0x7f000018e000/0x3000)=nil, &(0x7f00000da000/0x4000)=nil, 0x3000}) syz_clone(0x20000, &(0x7f00000001c0), 0x0, 0x0, 0x0, &(0x7f0000000200)) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000003, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x2000000, 0x6, 0x40000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x5400, 0x3f00) sendto$inet(r1, 0x0, 0x0, 0x28040041, &(0x7f0000000300)={0x2, 0x24e23, @loopback}, 0x10) sendmsg$inet(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000003c0)="17", 0x1}], 0x1}, 0x48c0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0xe2002, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = open(&(0x7f0000000000)='./file2\x00', 0x101042, 0xa3) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2000002, 0x4052, r4, 0x0) mmap$KVM_VCPU(0x0, 0x50000, 0x3, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_RESET_DIRTY_RINGS(r3, 0xaec7) 1.695140705s ago: executing program 0 (id=261): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001400)={0x28, r1, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz0\x00'}}}, 0x28}, 0x1, 0x0, 0x0, 0xc090}, 0x84) 1.329223797s ago: executing program 3 (id=262): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) recvmmsg(r0, &(0x7f0000000500)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x1}, 0x9}], 0x1, 0x40012100, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="230000000800000002000000ffff0000"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000200)="0221ab344b3bc03e0d0715e014845551a8293d633889cc632386efad610ef91e09e0905f8c209cc56231ad357da338e182b5a1061ecd6159e49bed6f1136ac38b9f5d33d1afacc1371b44717881c5d4a7de1b5a597fcef54117c8b57aa401d895f46c0066580b4a20d0151b2a5c40eb5a33d2f78a651fa1add45c4cf68c3205042807f8343b44419faf0a324e940f8fddbd432d6cae5ab9ea859100cae27bc2e2df28365d8ae36db7ffb3b41755f95ed98315e1b686eb9671591779bc21d9a7a4cc6d3d3b37a853991ca3e69d5573f0000000000000000", 0xf504, r1}, 0x38) 1.135577225s ago: executing program 0 (id=263): pipe(0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000006c0)={'syzkaller0\x00'}) socket$inet(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000300), 0x80580, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000340)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000700)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000005343daf9ce93eb52bc31d1a8b651ba13000000010000002400015b7884050c4e230000060001000200000008000300ac1406000000000000000000d1ea152add1331a82507bc602179e9dd07f0b83ac59efc38977a5613c0590aac23d133522c1790fd4e710b561acfe95a16b94412a703c32038627a6d62ca9beb45587861b25f1632509a99e346514a6f28783c589e1b41e5b88ddd2966c9c97f5e19bcfd2aa2216574ea28d859fbbbb9888f9cc572eaeac2b148fc73fda836584e1909e5fb923c"], 0x38}}, 0x0) listen(r4, 0xc) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000480)={0x2, 0x4e22, @local}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="01000000000000002000010000001c000180060001000200000008000300ac1414aa0800060003000000"], 0x30}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r10 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f00000005c0)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25"}) close_range(r3, r10, 0x0) syz_open_dev$mouse(0x0, 0x0, 0x2) socket$inet6_mptcp(0xa, 0x1, 0x106) r11 = syz_io_uring_setup(0x6c96, &(0x7f00000000c0)={0x0, 0x0, 0x10040, 0x0, 0x40055}, &(0x7f0000000140)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r12, r13, r14, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r11, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 705.192261ms ago: executing program 3 (id=264): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001400)={0x28, r1, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz0\x00'}}}, 0x28}, 0x1, 0x0, 0x0, 0xc090}, 0x84) (fail_nth: 2) 94.71397ms ago: executing program 3 (id=265): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 0s ago: executing program 2 (id=266): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_io_uring_setup(0x3b88, &(0x7f0000000240)={0x0, 0x9b6, 0x2, 0x23, 0x2bb}, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000600)) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) memfd_create(&(0x7f0000000000)='\x02A\xbb\xcc\x96\x0eo\x1f\xe2@\xcc\xb1Yg\x00\x00\x00\x00\x00\x00', 0xb) socket(0x2, 0x3, 0xff) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = fsopen(&(0x7f00000001c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0xa) fchdir(r4) chdir(&(0x7f0000000200)='./sys\x00') open(&(0x7f00000002c0)='./debug\x00', 0x8000, 0x50) socket$kcm(0x1e, 0x5, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r5, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4ea5, 0x9, @mcast1, 0x8}, 0xffffffffffffffff, 0x8001}}, 0x48) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) kernel console output (not intermixed with test programs): anaged:2522804kB mlocked:0kB bounce:0kB free_pcp:59716kB local_pcp:54816kB free_cma:0kB [ 92.424705][ T5769] lowmem_reserve[]: 0 0 1 1 1 [ 92.424743][ T5769] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1392kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 92.424817][ T5769] lowmem_reserve[]: 0 0 0 0 0 [ 92.424855][ T5769] Node 1 Normal free:3929296kB boost:0kB min:55960kB low:69948kB high:83936kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:12kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:500kB local_pcp:500kB free_cma:0kB [ 92.424920][ T5769] lowmem_reserve[]: 0 0 0 0 0 [ 92.424959][ T5769] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 92.425112][ T5769] Node 0 DMA32: 33*4kB (UE) 10*8kB (UE) 1*16kB (M) 2*32kB (ME) 2*64kB (UM) 3*128kB (UME) 3*256kB (UME) 3*512kB (UM) 5*1024kB (M) 5*2048kB (ME) 330*4096kB (M) = 1370148kB [ 92.425286][ T5769] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 92.425397][ T5769] Node 1 Normal: 2*4kB (M) 1*8kB (M) 2*16kB (UM) 1*32kB (M) 4*64kB (UM) 3*128kB (UM) 2*256kB (M) 2*512kB (M) 1*1024kB (M) 3*2048kB (U) 957*4096kB (M) = 3929296kB [ 92.425579][ T5769] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 92.425599][ T5769] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 92.425618][ T5769] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 92.425636][ T5769] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 92.425654][ T5769] 43147 total pagecache pages [ 92.425669][ T5769] 0 pages in swap cache [ 92.425677][ T5769] Free swap = 124996kB [ 92.425686][ T5769] Total swap = 124996kB [ 92.425695][ T5769] 2097051 pages RAM [ 92.425703][ T5769] 0 pages HighMem/MovableOnly [ 92.425712][ T5769] 434386 pages reserved [ 92.425720][ T5769] 0 pages cma reserved [ 92.445881][ T5637] Bluetooth: hci2: command tx timeout [ 92.445972][ T5635] Bluetooth: hci4: command tx timeout [ 92.527388][ T5635] Bluetooth: hci3: command tx timeout [ 93.119410][ T5774] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8'. [ 93.157832][ T5732] usb 5-1: f81604_read: reg: 105 failed: -EPROTO [ 93.157865][ T5732] f81604 5-1:255.122: Setting termination of CH#0 failed: -EPROTO [ 93.157893][ T5732] f81604 5-1:255.122: probe with driver f81604 failed with error -71 [ 93.204886][ T5732] usb 5-1: USB disconnect, device number 2 [ 93.404486][ T5734] i2c i2c-1: failure sending STOP [ 93.445946][ T5732] usb 3-1: USB disconnect, device number 2 [ 93.550329][ T5785] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 93.704466][ T5788] netlink: 'syz.2.13': attribute type 1 has an invalid length. [ 93.797095][ T5793] netlink: 'syz.0.14': attribute type 1 has an invalid length. [ 94.228372][ T5815] syz.0.19 uses obsolete (PF_INET,SOCK_PACKET) [ 94.483376][ T5732] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 94.634244][ T5732] usb 1-1: Using ep0 maxpacket: 16 [ 94.638691][ T5732] usb 1-1: unable to get BOS descriptor or descriptor too short [ 94.638742][ T5732] usb 1-1: New USB device found: idVendor=045e, idProduct=0468, bcdDevice=b2.9c [ 94.640872][ T5732] usb 1-1: config 3 has an invalid interface number: 74 but max is 0 [ 94.640898][ T5732] usb 1-1: config 3 has no interface number 0 [ 94.640942][ T5732] usb 1-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83 [ 94.640973][ T5732] usb 1-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8 [ 94.641000][ T5732] usb 1-1: config 3 interface 74 has no altsetting 0 [ 94.717231][ T5732] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.717261][ T5732] usb 1-1: Product: syz [ 94.717276][ T5732] usb 1-1: Manufacturer: syz [ 94.717292][ T5732] usb 1-1: SerialNumber: syz [ 94.750457][ T5815] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 94.973317][ T5815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 94.978346][ T5815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.133952][ T5825] netlink: 'syz.1.20': attribute type 10 has an invalid length. [ 95.238978][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.273438][ T5825] team0: Port device bond0 added [ 95.551609][ T1242] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 95.611598][ T5694] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 95.702342][ T1242] usb 5-1: New USB device found: idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 95.703897][ T1242] usb 5-1: config 5 has an invalid interface number: 123 but max is 0 [ 95.703924][ T1242] usb 5-1: config 5 has no interface number 0 [ 95.703994][ T1242] usb 5-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 95.704024][ T1242] usb 5-1: config 5 interface 123 altsetting 7 endpoint 0x4 has invalid wMaxPacketSize 0 [ 95.704047][ T1242] usb 5-1: config 5 interface 123 has no altsetting 0 [ 95.708057][ T1242] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.708084][ T1242] usb 5-1: Product: syz [ 95.708129][ T1242] usb 5-1: Manufacturer: syz [ 95.708145][ T1242] usb 5-1: SerialNumber: syz [ 95.772162][ T5694] usb 3-1: Using ep0 maxpacket: 16 [ 95.806479][ T5694] usb 3-1: unable to get BOS descriptor or descriptor too short [ 95.806527][ T5694] usb 3-1: New USB device found: idVendor=103d, idProduct=0100, bcdDevice=0.40 [ 95.818260][ T5694] usb 3-1: config index 0 descriptor too short (expected 133, got 22) [ 95.818327][ T5694] usb 3-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 95.818380][ T5694] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 95.855765][ T5694] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.855849][ T5694] usb 3-1: Product: syz [ 95.855878][ T5694] usb 3-1: Manufacturer: syz [ 95.855919][ T5694] usb 3-1: SerialNumber: syz [ 96.011204][ T5732] ipaq 1-1:3.74: PocketPC PDA converter detected [ 96.022489][ T5732] usb 1-1: active config #3 != 1 ?? [ 96.051962][ T5732] usb 1-1: USB disconnect, device number 2 [ 96.088733][ T1242] ni6501 5-1:5.123: driver 'ni6501' failed to auto-configure device. [ 96.120835][ T1242] usb 5-1: USB disconnect, device number 3 [ 96.162992][ T973] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 96.321572][ T973] usb 2-1: Using ep0 maxpacket: 16 [ 96.323356][ T973] usb 2-1: New USB device found: idVendor=1781, idProduct=0898, bcdDevice=0.00 [ 96.324677][ T973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 96.324704][ T973] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 96.324748][ T973] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.332891][ T973] usb 2-1: config 0 descriptor?? [ 96.380941][ T973] pxrc 2-1:0.0: Could not find endpoint [ 96.395782][ T973] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 96.622634][ T5832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 96.623108][ T5832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 96.628814][ T5832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 96.636455][ T5832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 96.668007][ T5832] sg_write: data in/out 52706/8 bytes for SCSI command 0x0-- guessing data in; [ 96.668007][ T5832] program syz.1.23 not setting count and/or reply_len properly [ 96.694380][ T973] usb 2-1: USB disconnect, device number 2 [ 96.722081][ T1242] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 96.881597][ T1242] usb 4-1: Using ep0 maxpacket: 32 [ 96.883352][ T1242] usb 4-1: New USB device found: idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 96.884543][ T1242] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 96.884570][ T1242] usb 4-1: config 0 has no interface number 0 [ 96.917950][ T1242] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.917979][ T1242] usb 4-1: Product: syz [ 96.917995][ T1242] usb 4-1: Manufacturer: syz [ 96.918010][ T1242] usb 4-1: SerialNumber: syz [ 96.953705][ T1242] usb 4-1: config 0 descriptor?? [ 97.041903][ T5845] ip_tables: iptables: counters copy to user failed while replacing table [ 97.340952][ T5852] FAULT_INJECTION: forcing a failure. [ 97.340952][ T5852] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 97.340985][ T5852] CPU: 1 UID: 0 PID: 5852 Comm: syz.0.28 Not tainted syzkaller #0 PREEMPT(full) [ 97.341010][ T5852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 97.341023][ T5852] Call Trace: [ 97.341034][ T5852] [ 97.341044][ T5852] dump_stack_lvl+0xe8/0x150 [ 97.341085][ T5852] should_fail_ex+0x3eb/0x540 [ 97.341118][ T5852] _copy_from_user+0x2d/0xb0 [ 97.341148][ T5852] ___sys_sendmsg+0x1c6/0x360 [ 97.341173][ T5852] ? __lock_acquire+0x747/0x2de0 [ 97.341207][ T5852] ? __pfx____sys_sendmsg+0x10/0x10 [ 97.341239][ T5852] ? kstrtouint+0x6e/0xe0 [ 97.341287][ T5852] ? __fget_files+0x3a2/0x420 [ 97.341315][ T5852] ? __fget_files+0x2a/0x420 [ 97.341353][ T5852] __sys_sendmmsg+0x273/0x4e0 [ 97.341386][ T5852] ? __pfx___sys_sendmmsg+0x10/0x10 [ 97.341420][ T5852] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 97.341465][ T5852] ? ksys_write+0x242/0x270 [ 97.341498][ T5852] ? __pfx_ksys_write+0x10/0x10 [ 97.341537][ T5852] __x64_sys_sendmmsg+0xa0/0xc0 [ 97.341567][ T5852] do_syscall_64+0x16a/0x530 [ 97.341598][ T5852] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.341621][ T5852] ? clear_bhb_loop+0x70/0xc0 [ 97.341648][ T5852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.341670][ T5852] RIP: 0033:0x7f09a519fb19 [ 97.341690][ T5852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.341708][ T5852] RSP: 002b:00007f09a60a9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 97.341733][ T5852] RAX: ffffffffffffffda RBX: 00007f09a5426090 RCX: 00007f09a519fb19 [ 97.341749][ T5852] RDX: 0000000000000001 RSI: 00002000000006c0 RDI: 0000000000000003 [ 97.341763][ T5852] RBP: 00007f09a60a9090 R08: 0000000000000000 R09: 0000000000000000 [ 97.341777][ T5852] R10: 0000000004000801 R11: 0000000000000246 R12: 0000000000000001 [ 97.341791][ T5852] R13: 00007f09a5426128 R14: 00007f09a5426090 R15: 00007f09a554fa48 [ 97.341833][ T5852] [ 97.928878][ T1242] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 97.929204][ T1242] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 97.974405][ T1242] usb 4-1: USB disconnect, device number 2 [ 98.413126][ T5694] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 98.416835][ T973] usb 3-1: USB disconnect, device number 3 [ 98.564072][ T5694] usb 2-1: Using ep0 maxpacket: 8 [ 98.571932][ T5694] usb 2-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 98.581661][ T5694] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 98.581799][ T5694] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 98.581861][ T5694] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 98.581925][ T5694] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 98.581980][ T5694] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 98.582078][ T5694] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.921935][ T5694] usb 2-1: usb_control_msg returned -32 [ 98.921973][ T5694] usbtmc 2-1:16.0: can't read capabilities [ 99.274895][ T5855] usbtmc 2-1:16.0: usbtmc_ioctl_request failed -32 [ 99.310604][ T1242] usb 2-1: USB disconnect, device number 3 [ 99.510776][ T5881] nft_compat: unsupported protocol 0 [ 99.762695][ T5732] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 99.789457][ T5878] netlink: 'syz.4.34': attribute type 10 has an invalid length. [ 99.803524][ T5878] syz_tun: entered promiscuous mode [ 99.906821][ T5878] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 99.920423][ T5732] usb 1-1: device descriptor read/64, error -71 [ 99.984828][ T5869] netlink: 'syz.3.33': attribute type 1 has an invalid length. [ 100.052986][ T5869] netlink: 'syz.3.33': attribute type 2 has an invalid length. [ 100.162026][ T5732] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 100.311751][ T5732] usb 1-1: device descriptor read/64, error -71 [ 100.431900][ T5732] usb usb1-port1: attempt power cycle [ 100.801717][ T5732] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 100.822366][ T5732] usb 1-1: device descriptor read/8, error -71 [ 101.106609][ T5732] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 101.142324][ T5732] usb 1-1: device descriptor read/8, error -71 [ 101.251791][ T5732] usb usb1-port1: unable to enumerate USB device [ 102.041938][ T5694] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 102.194696][ T5694] usb 4-1: unable to get BOS descriptor or descriptor too short [ 102.194752][ T5694] usb 4-1: New USB device found: idVendor=1235, idProduct=0010, bcdDevice=0.40 [ 102.196131][ T5694] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 102.196157][ T5694] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 102.252397][ T5694] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.252425][ T5694] usb 4-1: Product: syz [ 102.252440][ T5694] usb 4-1: Manufacturer: syz [ 102.252454][ T5694] usb 4-1: SerialNumber: syz [ 102.321756][ T5694] usb 4-1: selecting invalid altsetting 1 [ 102.339326][ T5694] usb 4-1: unit 6 not found! [ 102.541632][ T30] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 102.602542][ T5701] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 102.703251][ T30] usb 2-1: New USB device found: idVendor=08ca, idProduct=0110, bcdDevice=1.00 [ 102.706960][ T30] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 102.707013][ T30] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 102.721429][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 102.752402][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.752422][ T30] usb 2-1: Product: syz [ 102.752448][ T30] usb 2-1: Manufacturer: syz [ 102.752464][ T30] usb 2-1: SerialNumber: syz [ 102.785475][ T5701] usb 3-1: Using ep0 maxpacket: 16 [ 102.790688][ T5701] usb 3-1: unable to get BOS descriptor or descriptor too short [ 102.790742][ T5701] usb 3-1: New USB device found: idVendor=103d, idProduct=0100, bcdDevice=0.40 [ 102.818283][ T5701] usb 3-1: config index 0 descriptor too short (expected 133, got 22) [ 102.818315][ T5701] usb 3-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 102.818343][ T5701] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 102.832275][ T5701] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.832403][ T5701] usb 3-1: Product: syz [ 102.832445][ T5701] usb 3-1: Manufacturer: syz [ 102.832485][ T5701] usb 3-1: SerialNumber: syz [ 102.883522][ T30] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 102.883682][ T30] gspca_mr97310a: reg write [21] error -8 [ 102.883764][ T30] mr97310a 2-1:1.0: probe with driver mr97310a failed with error -8 [ 103.225887][ T5906] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 103.258794][ T1242] usb 2-1: USB disconnect, device number 4 [ 103.571804][ T30] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 103.741486][ T30] usb 5-1: Using ep0 maxpacket: 32 [ 103.742881][ T30] usb 5-1: New USB device found: idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 103.747149][ T30] usb 5-1: config index 0 descriptor too short (expected 19, got 18) [ 103.789616][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.789644][ T30] usb 5-1: Product: syz [ 103.789665][ T30] usb 5-1: Manufacturer: syz [ 103.789676][ T30] usb 5-1: SerialNumber: syz [ 103.822172][ T30] usb 5-1: config 0 descriptor?? [ 103.853140][ T30] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 103.855554][ T30] dvb-usb: bulk message failed: -22 (2/0) [ 103.888675][ T30] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 103.889550][ T30] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 103.889619][ T30] usb 5-1: media controller created [ 104.010830][ T30] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 104.112558][ T30] usb 5-1: selecting invalid altsetting 7 [ 104.112582][ T30] cxusb: set interface failed [ 104.112595][ T30] dvb-usb: bulk message failed: -22 (1/0) [ 104.240118][ T5916] netlink: 68 bytes leftover after parsing attributes in process `syz.4.46'. [ 104.275084][ T5919] ip_tables: iptables: counters copy to user failed while replacing table [ 104.299758][ T5916] veth1_to_bond: entered allmulticast mode [ 104.336085][ T5916] cxusb: i2c wr: len=8192 is too big! [ 104.336085][ T5916] [ 104.377629][ T5916] netlink: 4 bytes leftover after parsing attributes in process `syz.4.46'. [ 104.424148][ T30] DVB: Unable to find symbol lgdt330x_attach() [ 104.424198][ T30] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 104.521810][ T5701] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 104.571724][ T30] rc_core: IR keymap rc-dvico-portable not found [ 104.572081][ T30] Registered IR keymap rc-empty [ 104.600417][ T30] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 104.619929][ T30] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input5 [ 104.649564][ T30] dvb-usb: schedule remote query interval to 100 msecs. [ 104.650056][ T30] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 104.753958][ T30] dvb-usb: bulk message failed: -22 (1/0) [ 104.765579][ T5701] usb 2-1: New USB device found: idVendor=0c45, idProduct=6280, bcdDevice=d5.fc [ 104.790363][ T5701] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.861578][ T30] dvb-usb: bulk message failed: -22 (1/0) [ 104.879803][ T5701] gspca_main: gspca_sn9c20x-2.14.0 probing 0c45:6280 [ 104.924049][ T5694] usb 4-1: 2:0: failed to get current value for ch 0 (-71) [ 104.976816][ T30] dvb-usb: bulk message failed: -22 (1/0) [ 105.081589][ T30] dvb-usb: bulk message failed: -22 (1/0) [ 105.193692][ T30] dvb-usb: bulk message failed: -22 (1/0) [ 105.275482][ T5923] netlink: 'syz.1.47': attribute type 11 has an invalid length. [ 105.311574][ T1242] dvb-usb: bulk message failed: -22 (1/0) [ 105.431914][ T5732] dvb-usb: bulk message failed: -22 (1/0) [ 105.541576][ T5732] dvb-usb: bulk message failed: -22 (1/0) [ 105.584755][ T5701] gspca_sn9c20x: Write register 1001 failed -110 [ 105.584797][ T5701] gspca_sn9c20x: Device initialization failed [ 105.584876][ T5701] gspca_sn9c20x 2-1:252.0: probe with driver gspca_sn9c20x failed with error -110 [ 105.632665][ T5709] usb 3-1: USB disconnect, device number 4 [ 105.652719][ T1242] dvb-usb: bulk message failed: -22 (1/0) [ 105.764491][ T5732] dvb-usb: bulk message failed: -22 (1/0) [ 105.881588][ T1242] dvb-usb: bulk message failed: -22 (1/0) [ 105.991956][ T1242] dvb-usb: bulk message failed: -22 (1/0) [ 106.062984][ T5916] veth1_to_bond: left allmulticast mode [ 106.109301][ T5694] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 106.119092][ T30] dvb-usb: bulk message failed: -22 (1/0) [ 106.137387][ T5709] usb 5-1: USB disconnect, device number 4 [ 106.189763][ T5694] usb 4-1: USB disconnect, device number 3 [ 106.319017][ T5645] udevd[5645]: setting mode of /dev/bus/usb/004/003 to 020664 failed: No such file or directory [ 106.319120][ T5645] udevd[5645]: setting owner of /dev/bus/usb/004/003 to uid=0, gid=0 failed: No such file or directory [ 106.411773][ T5645] udevd[5645]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 106.523957][ T5701] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 106.709501][ T5701] usb 1-1: unable to get BOS descriptor or descriptor too short [ 106.709555][ T5701] usb 1-1: New USB device found: idVendor=1235, idProduct=0010, bcdDevice=0.40 [ 106.737932][ T5701] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 106.737962][ T5701] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 106.792124][ T5701] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.792151][ T5701] usb 1-1: Product: syz [ 106.792165][ T5701] usb 1-1: Manufacturer: syz [ 106.792178][ T5701] usb 1-1: SerialNumber: syz [ 106.836026][ T5709] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 106.852062][ T5944] netlink: 8 bytes leftover after parsing attributes in process `syz.4.53'. [ 106.887440][ T5701] usb 1-1: selecting invalid altsetting 1 [ 106.889285][ T5701] usb 1-1: unit 6 not found! [ 106.892912][ T1242] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 107.075092][ T1242] usb 3-1: Using ep0 maxpacket: 32 [ 107.078202][ T1242] usb 3-1: New USB device found: idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 107.100238][ T1242] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 107.100272][ T1242] usb 3-1: config 0 has no interface number 0 [ 107.125611][ T1242] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.125644][ T1242] usb 3-1: Product: syz [ 107.125660][ T1242] usb 3-1: Manufacturer: syz [ 107.125675][ T1242] usb 3-1: SerialNumber: syz [ 107.174116][ T1242] usb 3-1: config 0 descriptor?? [ 107.481641][ T5732] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 107.569818][ T5646] bond0: (slave syz_tun): Releasing backup interface [ 107.687969][ T5732] usb 4-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 107.693914][ T5732] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 107.750979][ T5732] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 107.751002][ T5732] usb 4-1: Product: syz [ 107.751058][ T5732] usb 4-1: Manufacturer: syz [ 107.751074][ T5732] usb 4-1: SerialNumber: syz [ 107.907482][ T5694] usb 2-1: USB disconnect, device number 5 [ 108.116735][ T5732] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 4 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 108.506942][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.569519][ T5732] usb 4-1: USB disconnect, device number 4 [ 108.663241][ T5953] input: syz0 as /devices/virtual/input/input8 [ 108.759192][ T5732] usblp0: removed [ 108.835198][ T1242] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 108.835453][ T1242] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 109.004259][ T1242] usb 3-1: USB disconnect, device number 5 [ 109.234485][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.494013][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.733003][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.943295][ T5637] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 110.947929][ T5637] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 110.968254][ T5637] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 110.979897][ T5637] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 110.989509][ T5637] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 111.077693][ T5701] usb 1-1: 2:0: failed to get current value for ch 0 (-71) [ 111.484241][ T13] bridge_slave_1: left allmulticast mode [ 111.484281][ T13] bridge_slave_1: left promiscuous mode [ 111.485298][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.547999][ T5978] mmap: syz.3.64 (5978) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 111.581153][ T13] bridge_slave_0: left allmulticast mode [ 111.581182][ T13] bridge_slave_0: left promiscuous mode [ 111.581517][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.606631][ T5701] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 111.626680][ T5701] usb 1-1: USB disconnect, device number 7 [ 111.749773][ T5645] udevd[5645]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 111.911951][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 112.006504][ T5988] fuse: Bad value for 'fd' [ 112.411171][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 112.460889][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 112.481617][ T5727] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 112.501007][ T13] bond0 (unregistering): Released all slaves [ 112.635459][ T5727] usb 2-1: New USB device found: idVendor=0b48, idProduct=1005, bcdDevice=1.00 [ 112.636740][ T5727] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 64 [ 112.636772][ T5727] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x81 has invalid maxpacket 64 [ 112.636790][ T5727] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 112.636807][ T5727] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 112.640168][ T5727] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 112.640192][ T5727] usb 2-1: Product: syz [ 112.640207][ T5727] usb 2-1: Manufacturer: syz [ 112.972361][ T5996] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 112.972544][ T5996] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 113.020512][ T5727] dvb_ttusb_budget: ttusb_init_controller: error [ 113.020532][ T5727] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 113.082052][ T5637] Bluetooth: hci1: command tx timeout [ 113.183990][ T1242] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 113.188799][ T5996] dvb_ttusb_budget: failed urb submission (0: err = -90)! [ 113.338175][ T1242] usb 4-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 113.349982][ T1242] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.373591][ T1242] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 113.373611][ T1242] usb 4-1: Product: syz [ 113.373622][ T1242] usb 4-1: Manufacturer: syz [ 113.373632][ T1242] usb 4-1: SerialNumber: syz [ 113.482771][ T5727] DVB: Unable to find symbol cx22700_attach() [ 113.612039][ T5727] DVB: Unable to find symbol tda10046_attach() [ 113.612052][ T5727] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 113.667316][ T5727] usb 2-1: USB disconnect, device number 6 [ 113.706634][ T1242] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 5 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 114.006325][ T6016] input: syz0 as /devices/virtual/input/input9 [ 114.044263][ C1] usblp0: nonzero write bulk status received: -71 [ 114.047258][ T5727] usb 4-1: USB disconnect, device number 5 [ 114.225446][ T6020] usblp0: removed [ 114.340471][ T5296] 8021q: adding VLAN 0 to HW filter on device eth1 [ 114.354084][ T6024] FAULT_INJECTION: forcing a failure. [ 114.354084][ T6024] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 114.354130][ T6024] CPU: 1 UID: 0 PID: 6024 Comm: syz.1.72 Tainted: G L syzkaller #0 PREEMPT(full) [ 114.354151][ T6024] Tainted: [L]=SOFTLOCKUP [ 114.354156][ T6024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 114.354165][ T6024] Call Trace: [ 114.354171][ T6024] [ 114.354177][ T6024] dump_stack_lvl+0xe8/0x150 [ 114.354215][ T6024] should_fail_ex+0x3eb/0x540 [ 114.354238][ T6024] _copy_from_user+0x2d/0xb0 [ 114.354259][ T6024] ___sys_sendmsg+0x1c6/0x360 [ 114.354278][ T6024] ? __lock_acquire+0x747/0x2de0 [ 114.354303][ T6024] ? __pfx____sys_sendmsg+0x10/0x10 [ 114.354347][ T6024] ? __fget_files+0x3a2/0x420 [ 114.354367][ T6024] ? __fget_files+0x2a/0x420 [ 114.354396][ T6024] __x64_sys_sendmsg+0x1b1/0x290 [ 114.354417][ T6024] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 114.354450][ T6024] do_syscall_64+0x16a/0x530 [ 114.354470][ T6024] ? trace_irq_disable+0x3b/0x140 [ 114.354492][ T6024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.354507][ T6024] ? clear_bhb_loop+0x70/0xc0 [ 114.354526][ T6024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.354541][ T6024] RIP: 0033:0x7f67dfb9fb19 [ 114.354558][ T6024] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.354570][ T6024] RSP: 002b:00007f67e09d4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 114.354590][ T6024] RAX: ffffffffffffffda RBX: 00007f67dfe25fa0 RCX: 00007f67dfb9fb19 [ 114.354601][ T6024] RDX: 0000000000008010 RSI: 0000200000000100 RDI: 0000000000000003 [ 114.354610][ T6024] RBP: 00007f67e09d4090 R08: 0000000000000000 R09: 0000000000000000 [ 114.354620][ T6024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 114.354628][ T6024] R13: 00007f67dfe26038 R14: 00007f67dfe25fa0 R15: 00007f67dff4fa48 [ 114.354652][ T6024] [ 114.882153][ T5694] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 114.886817][ T6029] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 114.916544][ T13] hsr_slave_0: left promiscuous mode [ 114.936196][ T13] hsr_slave_1: left promiscuous mode [ 114.947629][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 114.947667][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 114.969411][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 114.969431][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 115.023615][ T13] veth1_macvtap: left promiscuous mode [ 115.023666][ T13] veth0_macvtap: left promiscuous mode [ 115.023740][ T13] veth1_vlan: left promiscuous mode [ 115.023881][ T13] veth0_vlan: left promiscuous mode [ 115.076050][ T5694] usb 1-1: New USB device found: idVendor=1199, idProduct=b000, bcdDevice=e5.38 [ 115.079814][ T5694] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 959 [ 115.079847][ T5694] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 115.079870][ T5694] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 115.138789][ T5694] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.138820][ T5694] usb 1-1: Product: syz [ 115.138836][ T5694] usb 1-1: Manufacturer: syz [ 115.138851][ T5694] usb 1-1: SerialNumber: syz [ 115.161558][ T5637] Bluetooth: hci1: command tx timeout [ 115.192859][ T5694] usb 1-1: config 0 descriptor?? [ 115.199331][ T6025] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 115.483808][ T5727] usb 1-1: USB disconnect, device number 8 [ 116.199632][ T13] team0 (unregistering): Port device team_slave_1 removed [ 116.285632][ T13] team0 (unregistering): Port device team_slave_0 removed [ 116.978128][ T6039] tipc: Enabling of bearer rejected, failed to enable media [ 117.242907][ T5637] Bluetooth: hci1: command tx timeout [ 117.886734][ T6068] kernel profiling enabled (shift: 9) [ 117.952641][ T31] kauditd_printk_skb: 2451 callbacks suppressed [ 117.952661][ T31] audit: type=1326 audit(1794251265.436:2463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6066 comm="syz.0.81" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f09a519fb19 code=0x0 [ 118.298910][ T5979] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.300678][ T5979] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.300833][ T5979] bridge_slave_0: entered allmulticast mode [ 118.330942][ T5979] bridge_slave_0: entered promiscuous mode [ 118.354715][ T5979] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.357216][ T5979] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.360946][ T5979] bridge_slave_1: entered allmulticast mode [ 118.389310][ T5979] bridge_slave_1: entered promiscuous mode [ 118.480970][ T6085] fuse: Bad value for 'fd' [ 118.532290][ T5979] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 118.555910][ T6085] syz.2.84: vmalloc error: size 2199023255701, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 118.555982][ T6085] CPU: 1 UID: 0 PID: 6085 Comm: syz.2.84 Tainted: G L syzkaller #0 PREEMPT(full) [ 118.556003][ T6085] Tainted: [L]=SOFTLOCKUP [ 118.556008][ T6085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 118.556017][ T6085] Call Trace: [ 118.556023][ T6085] [ 118.556029][ T6085] dump_stack_lvl+0xe8/0x150 [ 118.556059][ T6085] warn_alloc+0x24d/0x270 [ 118.556088][ T6085] ? __pfx_warn_alloc+0x10/0x10 [ 118.556123][ T6085] __vmalloc_node_range_noprof+0x12c/0x16f0 [ 118.556143][ T6085] ? __pfx___mutex_trylock_common+0x10/0x10 [ 118.556171][ T6085] ? rcu_is_watching+0x16/0xb0 [ 118.556195][ T6085] ? trace_contention_end+0x3d/0x140 [ 118.556220][ T6085] ? __mutex_lock+0x305/0x15a0 [ 118.556247][ T6085] ? tomoyo_path_number_perm+0x219/0x5f0 [ 118.556271][ T6085] ? tomoyo_path_number_perm+0x219/0x5f0 [ 118.556292][ T6085] ? dvb_dvr_do_ioctl+0x76/0x220 [ 118.556319][ T6085] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 118.556344][ T6085] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 118.556367][ T6085] vmalloc_noprof+0xb2/0xe0 [ 118.556413][ T6085] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 118.556450][ T6085] dvb_dvr_do_ioctl+0x12b/0x220 [ 118.556490][ T6085] dvb_usercopy+0x199/0x2e0 [ 118.556519][ T6085] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 118.556542][ T6085] ? __pfx_dvb_usercopy+0x10/0x10 [ 118.556613][ T6085] ? __fget_files+0x2a/0x420 [ 118.556649][ T6085] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 118.556685][ T6085] dvb_dvr_ioctl+0x29/0x40 [ 118.556708][ T6085] __se_sys_ioctl+0xfc/0x170 [ 118.556735][ T6085] do_syscall_64+0x16a/0x530 [ 118.556756][ T6085] ? trace_irq_disable+0x3b/0x140 [ 118.556778][ T6085] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.556794][ T6085] ? clear_bhb_loop+0x70/0xc0 [ 118.556813][ T6085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.556828][ T6085] RIP: 0033:0x7f1e3a59fb19 [ 118.556844][ T6085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.556857][ T6085] RSP: 002b:00007f1e3b499028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 118.556873][ T6085] RAX: ffffffffffffffda RBX: 00007f1e3a825fa0 RCX: 00007f1e3a59fb19 [ 118.556884][ T6085] RDX: 0000020000000095 RSI: 0000000000006f2d RDI: 0000000000000008 [ 118.556894][ T6085] RBP: 00007f1e3a637b70 R08: 0000000000000000 R09: 0000000000000000 [ 118.556903][ T6085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 118.556912][ T6085] R13: 00007f1e3a826038 R14: 00007f1e3a825fa0 R15: 00007f1e3a94fa48 [ 118.556936][ T6085] [ 118.633126][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 118.636039][ T6085] Mem-Info: [ 118.636074][ T6085] active_anon:23845 inactive_anon:0 isolated_anon:0 [ 118.636074][ T6085] active_file:0 inactive_file:55036 isolated_file:0 [ 118.636074][ T6085] unevictable:0 dirty:91 writeback:16 [ 118.636074][ T6085] slab_reclaimable:10603 slab_unreclaimable:92511 [ 118.636074][ T6085] mapped:34313 shmem:18274 pagetables:1255 [ 118.636074][ T6085] sec_pagetables:0 bounce:0 [ 118.636074][ T6085] kernel_misc_reclaimable:0 [ 118.636074][ T6085] free:1290426 free_pcp:13932 free_cma:0 [ 118.636222][ T6085] Node 0 active_anon:95380kB inactive_anon:0kB active_file:0kB inactive_file:219940kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:137252kB dirty:364kB writeback:64kB shmem:73096kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11840kB pagetables:4848kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 118.636380][ T6085] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 118.636526][ T6085] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 118.636688][ T6085] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 118.636794][ T6085] Node 0 DMA32 free:1216748kB boost:0kB min:33920kB low:42400kB high:50880kB reserved_highatomic:0kB free_highatomic:0kB active_anon:95380kB inactive_anon:0kB active_file:0kB inactive_file:219940kB unevictable:0kB writepending:428kB zspages:0kB present:3129332kB managed:2522804kB mlocked:0kB bounce:0kB free_pcp:55476kB local_pcp:27232kB free_cma:0kB [ 118.636957][ T6085] lowmem_reserve[]: 0 0 1 1 1 [ 118.637053][ T6085] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1392kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 118.637261][ T6085] lowmem_reserve[]: 0 0 0 0 0 [ 118.637357][ T6085] Node 1 Normal free:3929596kB boost:0kB min:55960kB low:69948kB high:83936kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:248kB local_pcp:248kB free_cma:0kB [ 118.637516][ T6085] lowmem_reserve[]: 0 0 0 0 0 [ 118.644034][ T5979] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 118.655293][ T6085] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 118.655651][ T6085] Node 0 DMA32: 6277*4kB (UME) 3451*8kB (UM) 962*16kB (UME) 567*32kB (UME) 221*64kB (UME) 54*128kB (UM) 12*256kB (UME) 5*512kB (UM) 2*1024kB (M) 2*2048kB (UM) 268*4096kB (UM) = 1216812kB [ 118.656111][ T6085] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 118.656394][ T6085] Node 1 Normal: 2*4kB (M) 2*8kB (UM) 1*16kB (M) 9*32kB (UM) 4*64kB (UM) 3*128kB (UM) 2*256kB (M) 2*512kB (M) 1*1024kB (M) 3*2048kB (U) 957*4096kB (M) = 3929544kB [ 118.728850][ T6085] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 118.728901][ T6085] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 118.728944][ T6085] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 118.728986][ T6085] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 118.729035][ T6085] 73281 total pagecache pages [ 118.729056][ T6085] 0 pages in swap cache [ 118.729080][ T6085] Free swap = 124996kB [ 118.729094][ T6085] Total swap = 124996kB [ 118.729123][ T6085] 2097051 pages RAM [ 118.729143][ T6085] 0 pages HighMem/MovableOnly [ 118.729157][ T6085] 434386 pages reserved [ 118.729185][ T6085] 0 pages cma reserved [ 119.332178][ T5637] Bluetooth: hci1: command tx timeout [ 119.420806][ T5979] team0: Port device team_slave_0 added [ 119.445584][ T5979] team0: Port device team_slave_1 added [ 119.677374][ T6096] loop5: detected capacity change from 0 to 8388608 [ 119.703126][ T5979] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 119.703145][ T5979] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 119.703175][ T5979] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 119.763044][ T5979] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 119.763062][ T5979] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 119.763091][ T5979] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 119.773169][ T6096] capability: warning: `syz.0.86' uses deprecated v2 capabilities in a way that may be insecure [ 119.893476][ T6095] syzkaller0: entered promiscuous mode [ 119.893500][ T6095] syzkaller0: entered allmulticast mode [ 120.336111][ T5296] 8021q: adding VLAN 0 to HW filter on device eth2 [ 120.418194][ T5979] hsr_slave_0: entered promiscuous mode [ 120.431095][ T5979] hsr_slave_1: entered promiscuous mode [ 120.443994][ T5979] debugfs: 'hsr0' already exists in 'hsr' [ 120.444038][ T5979] Cannot create hsr debugfs directory [ 120.624881][ T6108] tipc: Enabling of bearer rejected, failed to enable media [ 121.022159][ T5694] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 121.153177][ T5694] usb 1-1: device descriptor read/64, error -71 [ 121.235612][ T6124] netlink: 'syz.2.94': attribute type 11 has an invalid length. [ 121.393740][ T5694] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 121.494374][ T6131] fuse: Bad value for 'fd' [ 121.522505][ T5694] usb 1-1: device descriptor read/64, error -71 [ 121.633570][ T5694] usb usb1-port1: attempt power cycle [ 121.689407][ T31] audit: type=1326 audit(1794251269.166:2464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6132 comm="syz.2.97" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1e3a59fb19 code=0x0 [ 121.982700][ T5694] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 122.002143][ T5694] usb 1-1: device descriptor read/8, error -71 [ 122.160932][ T5979] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 122.198209][ T5979] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 122.219618][ T5979] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 122.241858][ T5694] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 122.262584][ T5694] usb 1-1: device descriptor read/8, error -71 [ 122.268378][ T5979] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 122.279778][ T5979] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 122.354586][ T5979] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 122.372114][ T5694] usb usb1-port1: unable to enumerate USB device [ 122.388245][ T5979] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 122.418718][ T5979] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 122.824144][ T5979] 8021q: adding VLAN 0 to HW filter on device bond0 [ 122.922818][ T5979] 8021q: adding VLAN 0 to HW filter on device team0 [ 122.973804][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.973879][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 123.013092][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.013203][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 123.153977][ T5732] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 123.291641][ T5732] usb 4-1: device descriptor read/64, error -71 [ 123.349272][ T5979] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 123.392667][ T5296] 8021q: adding VLAN 0 to HW filter on device eth3 [ 123.523124][ T5979] veth0_vlan: entered promiscuous mode [ 123.543938][ T5732] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 123.563058][ T5979] veth1_vlan: entered promiscuous mode [ 123.645452][ T5979] veth0_macvtap: entered promiscuous mode [ 123.661104][ T5979] veth1_macvtap: entered promiscuous mode [ 123.677713][ T5732] usb 4-1: device descriptor read/64, error -71 [ 123.691166][ T5979] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 123.714125][ T5979] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 123.735797][ T278] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.735860][ T278] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.735895][ T278] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.782850][ T5732] usb usb4-port1: attempt power cycle [ 123.821982][ T272] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.913987][ T278] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.914010][ T278] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 124.074678][ T6175] tipc: Enabling of bearer rejected, failed to enable media [ 124.079534][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 124.079556][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 124.154286][ T5732] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 124.179123][ T5732] usb 4-1: device descriptor read/8, error -71 [ 124.411482][ T5732] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 124.431167][ T6187] fuse: Bad value for 'fd' [ 124.433069][ T5732] usb 4-1: device descriptor read/8, error -71 [ 124.549615][ T5732] usb usb4-port1: unable to enumerate USB device [ 124.649941][ T6194] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 124.690518][ T31] audit: type=1326 audit(1794251272.166:2465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6196 comm="syz.0.108" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f09a519fb19 code=0x0 [ 125.116295][ T6221] FAULT_INJECTION: forcing a failure. [ 125.116295][ T6221] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 125.116338][ T6221] CPU: 0 UID: 0 PID: 6221 Comm: syz.5.110 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.116368][ T6221] Tainted: [L]=SOFTLOCKUP [ 125.116376][ T6221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 125.116388][ T6221] Call Trace: [ 125.116396][ T6221] [ 125.116406][ T6221] dump_stack_lvl+0xe8/0x150 [ 125.116448][ T6221] should_fail_ex+0x3eb/0x540 [ 125.116481][ T6221] _copy_from_user+0x2d/0xb0 [ 125.116512][ T6221] kstrtouint_from_user+0xd6/0x180 [ 125.116538][ T6221] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 125.116563][ T6221] ? trace_ocfs2_unlink_noent+0x190/0x200 [ 125.116600][ T6221] ? lock_acquire+0x115/0x350 [ 125.116634][ T6221] proc_fail_nth_write+0x8e/0x210 [ 125.116658][ T6221] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 125.116691][ T6221] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 125.116713][ T6221] vfs_write+0x296/0xba0 [ 125.116743][ T6221] ? trace_contention_end+0x3d/0x140 [ 125.116783][ T6221] ? __pfx_vfs_write+0x10/0x10 [ 125.116813][ T6221] ? odev_ioctl+0xc1/0xf0 [ 125.116850][ T6221] ? __mutex_unlock_slowpath+0x731/0x900 [ 125.116885][ T6221] ? fdget+0x16b/0x250 [ 125.116922][ T6221] ksys_write+0x150/0x270 [ 125.116956][ T6221] ? __pfx_ksys_write+0x10/0x10 [ 125.116985][ T6221] ? __pfx_odev_ioctl+0x10/0x10 [ 125.117027][ T6221] do_syscall_64+0x16a/0x530 [ 125.117056][ T6221] ? trace_irq_disable+0x3b/0x140 [ 125.117087][ T6221] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.117109][ T6221] ? clear_bhb_loop+0x70/0xc0 [ 125.117136][ T6221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.117157][ T6221] RIP: 0033:0x7fcb7876034e [ 125.117178][ T6221] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 125.117196][ T6221] RSP: 002b:00007fcb769f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 125.117223][ T6221] RAX: ffffffffffffffda RBX: 00007fcb769f66c0 RCX: 00007fcb7876034e [ 125.117239][ T6221] RDX: 0000000000000001 RSI: 00007fcb769f60a0 RDI: 0000000000000006 [ 125.117252][ T6221] RBP: 00007fcb769f6090 R08: 0000000000000000 R09: 0000000000000000 [ 125.117266][ T6221] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.117279][ T6221] R13: 00007fcb78a26038 R14: 00007fcb78a25fa0 R15: 00007fcb78b4fa48 [ 125.117321][ T6221] [ 125.239118][ T5694] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 125.453592][ T5694] usb 2-1: Using ep0 maxpacket: 32 [ 125.458371][ T5694] usb 2-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 125.460300][ T5694] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 125.460331][ T5694] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 125.460354][ T5694] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 125.460377][ T5694] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 30768, setting to 1024 [ 125.460404][ T5694] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 125.460427][ T5694] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 26 [ 125.549004][ T5694] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 125.549035][ T5694] usb 2-1: SerialNumber: syz [ 125.579607][ T6214] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 125.591784][ T5694] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 125.593567][ T5694] cdc_acm 2-1:1.0: probe with driver cdc_acm failed with error -12 [ 125.665461][ T5296] 8021q: adding VLAN 0 to HW filter on device eth4 [ 125.715803][ T6229] lo: entered promiscuous mode [ 125.719396][ T6229] tunl0: entered promiscuous mode [ 125.721262][ T6229] gre0: entered promiscuous mode [ 125.748301][ T6229] gretap0: entered promiscuous mode [ 125.763333][ T6229] erspan0: entered promiscuous mode [ 125.771188][ T6229] ip_vti0: entered promiscuous mode [ 125.790271][ T6229] ip6_vti0: entered promiscuous mode [ 125.800028][ T6229] sit0: entered promiscuous mode [ 125.827741][ T6229] ip6tnl0: entered promiscuous mode [ 125.830423][ T6229] ip6gre0: entered promiscuous mode [ 125.857160][ T6229] syz_tun: entered promiscuous mode [ 125.860961][ T6229] ip6gretap0: entered promiscuous mode [ 125.878726][ T6229] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.879780][ T6229] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.880939][ T6229] bridge0: entered promiscuous mode [ 125.906982][ T6229] vcan0: entered promiscuous mode [ 125.908197][ T6229] bond0: entered promiscuous mode [ 125.908217][ T6229] bond_slave_0: entered promiscuous mode [ 125.908436][ T6229] bond_slave_1: entered promiscuous mode [ 125.935338][ T6229] team0: entered promiscuous mode [ 125.935360][ T6229] team_slave_0: entered promiscuous mode [ 125.935563][ T6229] team_slave_1: entered promiscuous mode [ 125.939169][ T6229] dummy0: entered promiscuous mode [ 125.976868][ T6229] nlmon0: entered promiscuous mode [ 125.979209][ T6229] batadv0: entered promiscuous mode [ 125.994404][ T6229] vxcan0: entered promiscuous mode [ 125.995595][ T6229] vxcan1: entered promiscuous mode [ 125.996754][ T6229] veth0: entered promiscuous mode [ 126.000107][ T6229] veth1: entered promiscuous mode [ 126.030462][ T6229] wg0: entered promiscuous mode [ 126.046807][ T6229] wg1: entered promiscuous mode [ 126.058829][ T6229] wg2: entered promiscuous mode [ 126.066338][ T6229] veth0_to_bridge: entered promiscuous mode [ 126.079852][ T6229] veth1_to_bridge: entered promiscuous mode [ 126.093804][ T6229] veth0_to_bond: entered promiscuous mode [ 126.098277][ T6229] veth1_to_bond: entered promiscuous mode [ 126.116393][ T6229] veth0_to_team: entered promiscuous mode [ 126.129358][ T6229] veth1_to_team: entered promiscuous mode [ 126.145033][ T6229] veth0_to_batadv: entered promiscuous mode [ 126.147839][ T6229] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 126.147896][ T6229] batadv_slave_0: entered promiscuous mode [ 126.171763][ T6229] veth1_to_batadv: entered promiscuous mode [ 126.186646][ T6229] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 126.186692][ T6229] batadv_slave_1: entered promiscuous mode [ 126.203163][ T6229] xfrm0: entered promiscuous mode [ 126.213435][ T6229] veth0_to_hsr: entered promiscuous mode [ 126.219274][ T6229] veth1_to_hsr: entered promiscuous mode [ 126.219708][ T6236] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 126.246056][ T6229] hsr0: entered promiscuous mode [ 126.249085][ T6229] veth1_virt_wifi: entered promiscuous mode [ 126.265913][ T6229] veth0_virt_wifi: entered promiscuous mode [ 126.270502][ T6229] virt_wifi0: entered promiscuous mode [ 126.293438][ T6229] vlan0: entered promiscuous mode [ 126.297431][ T6229] vlan1: entered promiscuous mode [ 126.314729][ T6229] macvlan0: entered promiscuous mode [ 126.318380][ T6229] macvlan1: entered promiscuous mode [ 126.335874][ T6229] ipvlan0: entered promiscuous mode [ 126.336053][ T6229] ipvlan1: entered promiscuous mode [ 126.354906][ T6229] macvtap0: entered promiscuous mode [ 126.357836][ T6229] macsec0: entered promiscuous mode [ 126.361086][ T6229] geneve0: entered promiscuous mode [ 126.384563][ T6229] geneve1: entered promiscuous mode [ 126.399796][ T6229] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 126.414491][ T6229] netdevsim netdevsim5 netdevsim1: entered promiscuous mode [ 126.419804][ T6229] netdevsim netdevsim5 netdevsim2: entered promiscuous mode [ 126.445415][ T6229] netdevsim netdevsim5 netdevsim3: entered promiscuous mode [ 126.450200][ T6229] mac80211_hwsim hwsim12 wlan0: entered promiscuous mode [ 126.450423][ T6229] mac80211_hwsim hwsim13 wlan1: entered promiscuous mode [ 126.452628][ T84] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.453047][ T84] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.453411][ T84] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.453515][ T84] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.725363][ T6244] fuse: Bad value for 'fd' [ 126.808731][ T6246] tipc: Enabling of bearer rejected, failed to enable media [ 126.981783][ T6251] netlink: 4 bytes leftover after parsing attributes in process `syz.5.118'. [ 126.981819][ T6251] netlink: 8 bytes leftover after parsing attributes in process `syz.5.118'. [ 127.150128][ T6255] bridge0: port 3(gretap0) entered blocking state [ 127.150292][ T6255] bridge0: port 3(gretap0) entered disabled state [ 127.150551][ T6255] gretap0: entered allmulticast mode [ 127.175046][ T6255] gretap0: entered promiscuous mode [ 127.175951][ T6255] bridge0: port 3(gretap0) entered blocking state [ 127.176074][ T6255] bridge0: port 3(gretap0) entered forwarding state [ 127.220522][ T31] audit: type=1326 audit(1794251274.696:2466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6253 comm="syz.3.119" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f327899fb19 code=0x0 [ 127.276139][ T6258] fuse: root generation should be zero [ 127.346848][ T6258] fuse: Bad value for 'fd' [ 127.472123][ T5732] usb 2-1: USB disconnect, device number 7 [ 127.635368][ T31] audit: type=1326 audit(1794251275.116:2467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6267 comm="syz.0.122" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f09a519fb19 code=0x0 [ 128.087805][ T6284] netlink: 140 bytes leftover after parsing attributes in process `syz.3.125'. [ 128.087995][ T6284] netlink: 48 bytes leftover after parsing attributes in process `syz.3.125'. [ 128.241813][ T30] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 128.336504][ T6291] FAULT_INJECTION: forcing a failure. [ 128.336504][ T6291] name failslab, interval 1, probability 0, space 0, times 0 [ 128.336539][ T6291] CPU: 1 UID: 0 PID: 6291 Comm: syz.5.126 Tainted: G L syzkaller #0 PREEMPT(full) [ 128.336569][ T6291] Tainted: [L]=SOFTLOCKUP [ 128.336577][ T6291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 128.336589][ T6291] Call Trace: [ 128.336597][ T6291] [ 128.336607][ T6291] dump_stack_lvl+0xe8/0x150 [ 128.336648][ T6291] should_fail_ex+0x3eb/0x540 [ 128.336682][ T6291] should_failslab+0xa8/0x100 [ 128.336707][ T6291] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 128.336738][ T6291] ? __d_alloc+0x37/0x820 [ 128.336766][ T6291] ? __d_alloc+0x37/0x820 [ 128.336803][ T6291] __d_alloc+0x37/0x820 [ 128.336838][ T6291] d_alloc+0x4b/0x190 [ 128.336866][ T6291] ? lookup_one_qstr_excl+0xc4/0x360 [ 128.336900][ T6291] lookup_one_qstr_excl+0xd8/0x360 [ 128.336935][ T6291] ? lookup_noperm_common+0x245/0x430 [ 128.336968][ T6291] start_dirop+0x5c/0x90 [ 128.336996][ T6291] simple_start_creating+0xcc/0x110 [ 128.337038][ T6291] ? __pfx_simple_start_creating+0x10/0x10 [ 128.337071][ T6291] ? do_raw_spin_unlock+0xf5/0x200 [ 128.337095][ T6291] ? mntput+0x65/0xc0 [ 128.337123][ T6291] debugfs_start_creating+0xca/0x1b0 [ 128.337153][ T6291] __debugfs_create_file+0x6f/0x400 [ 128.337185][ T6291] debugfs_create_file_full+0x3f/0x60 [ 128.337216][ T6291] ref_tracker_dir_debugfs+0x197/0x360 [ 128.337248][ T6291] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 128.337308][ T6291] ? __kvmalloc_node_noprof+0x52a/0x820 [ 128.337342][ T6291] ? __kvmalloc_node_noprof+0x340/0x820 [ 128.337378][ T6291] ? __raw_spin_lock_init+0x45/0x100 [ 128.337404][ T6291] alloc_netdev_mqs+0x275/0x1240 [ 128.337435][ T6291] ? __pfx_snprintf+0x10/0x10 [ 128.337458][ T6291] ? __pfx_hsr_dev_setup+0x10/0x10 [ 128.337487][ T6291] rtnl_create_link+0x321/0xd70 [ 128.337527][ T6291] rtnl_newlink_create+0x258/0x7b0 [ 128.337563][ T6291] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 128.337596][ T6291] ? __pfx___mutex_lock+0x10/0x10 [ 128.337639][ T6291] ? ns_capable+0x84/0xe0 [ 128.337675][ T6291] rtnl_newlink+0x167a/0x1c30 [ 128.337718][ T6291] ? __pfx_rtnl_newlink+0x10/0x10 [ 128.337744][ T6291] ? __lock_acquire+0x747/0x2de0 [ 128.337780][ T6291] ? __lock_acquire+0x747/0x2de0 [ 128.337817][ T6291] ? __lock_acquire+0x747/0x2de0 [ 128.337862][ T6291] ? lock_acquire+0x115/0x350 [ 128.337897][ T6291] ? lock_acquire+0x115/0x350 [ 128.337938][ T6291] ? __lock_acquire+0x747/0x2de0 [ 128.337969][ T6291] ? is_bpf_text_address+0x292/0x2b0 [ 128.337995][ T6291] ? __pfx_hook_capable+0x10/0x10 [ 128.338026][ T6291] ? kernel_text_address+0xa5/0xe0 [ 128.338056][ T6291] ? __pfx_hook_capable+0x10/0x10 [ 128.338077][ T6291] ? unwind_get_return_address+0x4d/0x90 [ 128.338140][ T6291] ? __pfx_rtnl_newlink+0x10/0x10 [ 128.338163][ T6291] rtnetlink_rcv_msg+0x802/0xc00 [ 128.338192][ T6291] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 128.338217][ T6291] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 128.338242][ T6291] ? __lock_acquire+0x747/0x2de0 [ 128.338285][ T6291] netlink_rcv_skb+0x226/0x4a0 [ 128.338321][ T6291] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 128.338348][ T6291] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 128.338398][ T6291] ? netlink_deliver_tap+0x2e/0x1b0 [ 128.338431][ T6291] ? netlink_deliver_tap+0x2e/0x1b0 [ 128.338472][ T6291] netlink_unicast+0x8ef/0xa80 [ 128.338523][ T6291] netlink_sendmsg+0x7f0/0xb20 [ 128.338553][ T6291] ? __pfx_netlink_sendmsg+0x10/0x10 [ 128.338579][ T6291] ? aa_sock_msg_perm+0x144/0x210 [ 128.338607][ T6291] ? apparmor_socket_sendmsg+0x98/0x360 [ 128.338642][ T6291] ? __pfx_netlink_sendmsg+0x10/0x10 [ 128.338663][ T6291] sock_sendmsg_nosec+0x14e/0x190 [ 128.338700][ T6291] ____sys_sendmsg+0x54e/0x850 [ 128.338733][ T6291] ? __pfx_____sys_sendmsg+0x10/0x10 [ 128.338771][ T6291] ? import_iovec+0x73/0xa0 [ 128.338804][ T6291] ___sys_sendmsg+0x2a5/0x360 [ 128.338828][ T6291] ? __lock_acquire+0x747/0x2de0 [ 128.338862][ T6291] ? __pfx____sys_sendmsg+0x10/0x10 [ 128.338895][ T6291] ? kstrtouint+0x6e/0xe0 [ 128.338949][ T6291] ? __fget_files+0x3a2/0x420 [ 128.338975][ T6291] ? __fget_files+0x2a/0x420 [ 128.339022][ T6291] __sys_sendmmsg+0x273/0x4e0 [ 128.339057][ T6291] ? __pfx___sys_sendmmsg+0x10/0x10 [ 128.339095][ T6291] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 128.339143][ T6291] ? ksys_write+0x242/0x270 [ 128.339177][ T6291] ? __pfx_ksys_write+0x10/0x10 [ 128.339217][ T6291] __x64_sys_sendmmsg+0xa0/0xc0 [ 128.339247][ T6291] do_syscall_64+0x16a/0x530 [ 128.339276][ T6291] ? trace_irq_disable+0x3b/0x140 [ 128.339307][ T6291] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.339330][ T6291] ? clear_bhb_loop+0x70/0xc0 [ 128.339358][ T6291] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.339380][ T6291] RIP: 0033:0x7fcb7879fb19 [ 128.339401][ T6291] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.339419][ T6291] RSP: 002b:00007fcb769f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 128.339442][ T6291] RAX: ffffffffffffffda RBX: 00007fcb78a25fa0 RCX: 00007fcb7879fb19 [ 128.339459][ T6291] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 128.339474][ T6291] RBP: 00007fcb769f6090 R08: 0000000000000000 R09: 0000000000000000 [ 128.339488][ T6291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 128.339501][ T6291] R13: 00007fcb78a26038 R14: 00007fcb78a25fa0 R15: 00007fcb78b4fa48 [ 128.339549][ T6291] [ 128.354648][ T5701] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 128.417814][ T30] usb 2-1: New USB device found: idVendor=9710, idProduct=7810, bcdDevice=1.00 [ 128.438536][ T30] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 128.438614][ T30] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 128.465549][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 128.465622][ T30] usb 2-1: Product: syz [ 128.465749][ T30] usb 2-1: Manufacturer: syz [ 128.556091][ T5701] usb 4-1: New USB device found: idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 128.636476][ T30] mos7840 2-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 128.681307][ T6291] hsr1: Slave A (dummy0) is not up; please bring it up to get a fully working HSR network [ 128.681883][ T6291] hsr1: Slave B (gretap0) is not up; please bring it up to get a fully working HSR network [ 128.716528][ T5701] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.716558][ T5701] usb 4-1: Product: syz [ 128.716574][ T5701] usb 4-1: Manufacturer: syz [ 128.716589][ T5701] usb 4-1: SerialNumber: syz [ 128.729954][ T6291] hsr1: entered allmulticast mode [ 128.730083][ T6291] dummy0: entered allmulticast mode [ 128.730279][ T6291] gretap0: entered allmulticast mode [ 129.039299][ T5701] usb 4-1: config 0 descriptor?? [ 129.055942][ T5701] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 129.079417][ T5701] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 129.080213][ T5701] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 129.080267][ T5701] usb 4-1: media controller created [ 129.117770][ T30] mos7840 ttyUSB0: probe with driver mos7840 failed with error -32 [ 129.156876][ T5701] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 129.234582][ T6300] fuse: Bad value for 'fd' [ 129.260652][ T6300] warn_alloc: 3 callbacks suppressed [ 129.260667][ T6300] syz.0.128: vmalloc error: size 2199023255701, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 129.260713][ T6300] CPU: 1 UID: 0 PID: 6300 Comm: syz.0.128 Tainted: G L syzkaller #0 PREEMPT(full) [ 129.260734][ T6300] Tainted: [L]=SOFTLOCKUP [ 129.260740][ T6300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 129.260749][ T6300] Call Trace: [ 129.260755][ T6300] [ 129.260762][ T6300] dump_stack_lvl+0xe8/0x150 [ 129.260791][ T6300] warn_alloc+0x24d/0x270 [ 129.260818][ T6300] ? __pfx_warn_alloc+0x10/0x10 [ 129.260853][ T6300] __vmalloc_node_range_noprof+0x12c/0x16f0 [ 129.260903][ T6300] ? __pfx___mutex_trylock_common+0x10/0x10 [ 129.260950][ T6300] ? rcu_is_watching+0x16/0xb0 [ 129.260975][ T6300] ? trace_contention_end+0x3d/0x140 [ 129.261001][ T6300] ? __mutex_lock+0x305/0x15a0 [ 129.261028][ T6300] ? tomoyo_path_number_perm+0x219/0x5f0 [ 129.261054][ T6300] ? tomoyo_path_number_perm+0x219/0x5f0 [ 129.261075][ T6300] ? dvb_dvr_do_ioctl+0x76/0x220 [ 129.261104][ T6300] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 129.261129][ T6300] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 129.261153][ T6300] vmalloc_noprof+0xb2/0xe0 [ 129.261171][ T6300] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 129.261195][ T6300] dvb_dvr_do_ioctl+0x12b/0x220 [ 129.261224][ T6300] dvb_usercopy+0x199/0x2e0 [ 129.261244][ T6300] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 129.261267][ T6300] ? __pfx_dvb_usercopy+0x10/0x10 [ 129.261295][ T6300] ? __fget_files+0x2a/0x420 [ 129.261319][ T6300] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 129.261342][ T6300] dvb_dvr_ioctl+0x29/0x40 [ 129.261384][ T6300] __se_sys_ioctl+0xfc/0x170 [ 129.261420][ T6300] do_syscall_64+0x16a/0x530 [ 129.261449][ T6300] ? trace_irq_disable+0x3b/0x140 [ 129.261479][ T6300] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.261505][ T6300] ? clear_bhb_loop+0x70/0xc0 [ 129.261533][ T6300] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.261559][ T6300] RIP: 0033:0x7f09a519fb19 [ 129.261574][ T6300] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.261587][ T6300] RSP: 002b:00007f09a60ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 129.261603][ T6300] RAX: ffffffffffffffda RBX: 00007f09a5425fa0 RCX: 00007f09a519fb19 [ 129.261614][ T6300] RDX: 0000020000000095 RSI: 0000000000006f2d RDI: 0000000000000008 [ 129.261624][ T6300] RBP: 00007f09a5237b70 R08: 0000000000000000 R09: 0000000000000000 [ 129.261633][ T6300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 129.261642][ T6300] R13: 00007f09a5426038 R14: 00007f09a5425fa0 R15: 00007f09a554fa48 [ 129.261667][ T6300] [ 129.282771][ T6300] Mem-Info: [ 129.282813][ T6300] active_anon:6249 inactive_anon:0 isolated_anon:0 [ 129.282813][ T6300] active_file:0 inactive_file:55209 isolated_file:0 [ 129.282813][ T6300] unevictable:0 dirty:372 writeback:0 [ 129.282813][ T6300] slab_reclaimable:11227 slab_unreclaimable:94734 [ 129.282813][ T6300] mapped:30408 shmem:524 pagetables:1357 [ 129.282813][ T6300] sec_pagetables:0 bounce:0 [ 129.282813][ T6300] kernel_misc_reclaimable:0 [ 129.282813][ T6300] free:1307160 free_pcp:10853 free_cma:0 [ 129.282968][ T6300] Node 0 active_anon:24996kB inactive_anon:0kB active_file:0kB inactive_file:220632kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:121632kB dirty:1488kB writeback:0kB shmem:2096kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12140kB pagetables:5256kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 129.283121][ T6300] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 129.283265][ T6300] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 129.283420][ T6300] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 129.283525][ T6300] Node 0 DMA32 free:1283520kB boost:0kB min:33920kB low:42400kB high:50880kB reserved_highatomic:0kB free_highatomic:0kB active_anon:24996kB inactive_anon:0kB active_file:0kB inactive_file:220632kB unevictable:0kB writepending:1488kB zspages:0kB present:3129332kB managed:2522804kB mlocked:0kB bounce:0kB free_pcp:43408kB local_pcp:23200kB free_cma:0kB [ 129.283683][ T6300] lowmem_reserve[]: 0 0 1 1 1 [ 129.283784][ T6300] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1392kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 129.283931][ T6300] lowmem_reserve[]: 0 0 0 0 0 [ 129.284040][ T6300] Node 1 Normal free:3929760kB boost:0kB min:55960kB low:69948kB high:83936kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 129.284218][ T6300] lowmem_reserve[]: 0 0 0 0 0 [ 129.288596][ T6300] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 129.290978][ T6300] Node 0 DMA32: 3044*4kB (UME) 2738*8kB (UM) 1186*16kB (UME) 998*32kB (UM) 498*64kB (UM) 240*128kB (UME) 79*256kB (UM) 21*512kB (UME) 5*1024kB (M) 7*2048kB (UME) 265*4096kB (M) = 1283456kB [ 129.301194][ T6300] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 129.309679][ T6300] Node 1 Normal: 2*4kB (M) 3*8kB (UM) 12*16kB (UM) 10*32kB (UM) 4*64kB (UM) 3*128kB (UM) 2*256kB (M) 2*512kB (M) 1*1024kB (M) 3*2048kB (U) 957*4096kB (M) = 3929760kB [ 129.310257][ T6300] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 129.310301][ T6300] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 129.310349][ T6300] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 129.310391][ T6300] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 129.310434][ T6300] 55729 total pagecache pages [ 129.310458][ T6300] 0 pages in swap cache [ 129.310478][ T6300] Free swap = 124996kB [ 129.310499][ T6300] Total swap = 124996kB [ 129.310520][ T6300] 2097051 pages RAM [ 129.310541][ T6300] 0 pages HighMem/MovableOnly [ 129.310561][ T6300] 434386 pages reserved [ 129.310580][ T6300] 0 pages cma reserved [ 129.956750][ T5701] DVB: Unable to find symbol mt352_attach() [ 130.036555][ T5701] DVB: Unable to find symbol nxt6000_attach() [ 130.036568][ T5701] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 130.063400][ T5701] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input11 [ 130.089082][ T5701] dvb-usb: schedule remote query interval to 1000 msecs. [ 130.089106][ T5701] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 130.089164][ T5701] dvb-usb: bulk message failed: -22 (7/0) [ 130.089179][ T5701] dvb-usb: bulk message failed: -22 (7/0) [ 130.129514][ T5701] usb 4-1: USB disconnect, device number 10 [ 130.387408][ T5701] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 130.389684][ T6315] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 130.493825][ T6317] tipc: Enabling of bearer rejected, failed to enable media [ 130.725268][ T31] audit: type=1326 audit(1794251278.206:2468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6323 comm="syz.3.132" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f327899fb19 code=0x7ffc0000 [ 130.727046][ T31] audit: type=1326 audit(1794251278.206:2469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6323 comm="syz.3.132" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f327899fb19 code=0x7ffc0000 [ 130.729381][ T31] audit: type=1326 audit(1794251278.206:2470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6323 comm="syz.3.132" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=104 compat=0 ip=0x7f327899fb19 code=0x7ffc0000 [ 130.729431][ T31] audit: type=1326 audit(1794251278.206:2471): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6323 comm="syz.3.132" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f327899fb19 code=0x7ffc0000 [ 130.729485][ T31] audit: type=1326 audit(1794251278.206:2472): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6323 comm="syz.3.132" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f327899fb19 code=0x7ffc0000 [ 130.730089][ T31] audit: type=1326 audit(1794251278.206:2473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6323 comm="syz.3.132" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f327899fb19 code=0x7ffc0000 [ 130.731018][ T31] audit: type=1326 audit(1794251278.206:2474): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6323 comm="syz.3.132" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f327899fb19 code=0x7ffc0000 [ 130.731065][ T31] audit: type=1326 audit(1794251278.206:2475): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6323 comm="syz.3.132" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f327899fb19 code=0x7ffc0000 [ 130.805581][ T31] audit: type=1326 audit(1794251278.296:2476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6323 comm="syz.3.132" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f327899fb19 code=0x7ffc0000 [ 131.058597][ T31] audit: type=1326 audit(1794251278.536:2477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6323 comm="syz.3.132" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f327899fb19 code=0x7ffc0000 [ 131.428753][ T30] usb 2-1: USB disconnect, device number 8 [ 131.472842][ T30] mos7840 2-1:1.0: device disconnected [ 131.674044][ T6354] netlink: 64 bytes leftover after parsing attributes in process `syz.1.136'. [ 131.704815][ T6354] syzkaller1: entered promiscuous mode [ 131.704839][ T6354] syzkaller1: entered allmulticast mode [ 131.887338][ T5709] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 132.071593][ T5709] usb 1-1: Using ep0 maxpacket: 16 [ 132.072358][ T5709] usb 1-1: New USB device found: idVendor=04d8, idProduct=00dd, bcdDevice=0.00 [ 132.073661][ T5709] usb 1-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 132.073693][ T5709] usb 1-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 132.073716][ T5709] usb 1-1: config 0 interface 0 has no altsetting 0 [ 132.073750][ T5709] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.132915][ T5709] usb 1-1: config 0 descriptor?? [ 132.237595][ T6368] netlink: 'syz.5.139': attribute type 15 has an invalid length. [ 132.422190][ T1242] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 132.448766][ T6374] fuse: Bad value for 'fd' [ 132.583559][ T1242] usb 2-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 132.586641][ T1242] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 132.586705][ T1242] usb 2-1: config 0 has no interfaces? [ 132.615503][ T1242] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 132.615534][ T1242] usb 2-1: Product: syz [ 132.615549][ T1242] usb 2-1: Manufacturer: syz [ 132.615563][ T1242] usb 2-1: SerialNumber: syz [ 132.642634][ T1242] usb 2-1: config 0 descriptor?? [ 133.003982][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.004066][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.321133][ T6365] input: syz0 as /devices/virtual/input/input12 [ 133.434095][ T5709] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 133.434140][ T5709] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 133.434177][ T5709] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 133.434207][ T5709] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 133.434235][ T5709] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 133.485373][ T5709] mcp2221 0003:04D8:00DD.0001: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 133.617246][ T5709] usb 1-1: USB disconnect, device number 13 [ 133.650122][ T30] usb 2-1: USB disconnect, device number 9 [ 134.159061][ T6404] tipc: Enabling of bearer rejected, failed to enable media [ 134.335764][ T6395] netlink: 'syz.5.143': attribute type 11 has an invalid length. [ 134.436292][ T6410] FAULT_INJECTION: forcing a failure. [ 134.436292][ T6410] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 134.436327][ T6410] CPU: 1 UID: 0 PID: 6410 Comm: syz.3.146 Tainted: G L syzkaller #0 PREEMPT(full) [ 134.436355][ T6410] Tainted: [L]=SOFTLOCKUP [ 134.436363][ T6410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 134.436375][ T6410] Call Trace: [ 134.436383][ T6410] [ 134.436392][ T6410] dump_stack_lvl+0xe8/0x150 [ 134.436431][ T6410] should_fail_ex+0x3eb/0x540 [ 134.436462][ T6410] _copy_from_user+0x2d/0xb0 [ 134.436490][ T6410] ___sys_sendmsg+0x1c6/0x360 [ 134.436514][ T6410] ? __lock_acquire+0x747/0x2de0 [ 134.436547][ T6410] ? __pfx____sys_sendmsg+0x10/0x10 [ 134.436609][ T6410] ? __fget_files+0x3a2/0x420 [ 134.436635][ T6410] ? __fget_files+0x2a/0x420 [ 134.436671][ T6410] __x64_sys_sendmsg+0x1b1/0x290 [ 134.436708][ T6410] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 134.436755][ T6410] do_syscall_64+0x16a/0x530 [ 134.436787][ T6410] ? trace_irq_disable+0x3b/0x140 [ 134.436816][ T6410] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.436837][ T6410] ? clear_bhb_loop+0x70/0xc0 [ 134.436863][ T6410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.436884][ T6410] RIP: 0033:0x7f327899fb19 [ 134.436904][ T6410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.436921][ T6410] RSP: 002b:00007f3276bf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 134.436943][ T6410] RAX: ffffffffffffffda RBX: 00007f3278c25fa0 RCX: 00007f327899fb19 [ 134.436958][ T6410] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000003 [ 134.436972][ T6410] RBP: 00007f3276bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 134.436984][ T6410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 134.436996][ T6410] R13: 00007f3278c26038 R14: 00007f3278c25fa0 R15: 00007f3278d4fa48 [ 134.437038][ T6410] [ 135.132834][ T6423] batman_adv: batadv0: Adding interface: vlan2 [ 135.132849][ T6423] batman_adv: batadv0: The MTU of interface vlan2 is too small (1450) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 135.136319][ T6423] batman_adv: batadv0: Not using interface vlan2 (retrying later): interface not active [ 135.366739][ T6429] fuse: Bad value for 'fd' [ 136.582505][ T6458] tipc: Enabling of bearer rejected, failed to enable media [ 137.015318][ T5694] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 137.178033][ T5694] usb 1-1: New USB device found: idVendor=05c6, idProduct=1000, bcdDevice=0.00 [ 137.179230][ T5694] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 137.179268][ T5694] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 137.179309][ T5694] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.258008][ T5694] usb-storage 1-1:1.0: USB Mass Storage device detected [ 137.283927][ T6473] ip_tables: iptables: counters copy to user failed while replacing table [ 137.313037][ T6478] fuse: Bad value for 'fd' [ 137.318886][ T6479] ip_tables: iptables: counters copy to user failed while replacing table [ 137.360908][ T5694] scsi host1: usb-storage 1-1:1.0 [ 137.375826][ T6485] FAULT_INJECTION: forcing a failure. [ 137.375826][ T6485] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 137.375851][ T6485] CPU: 0 UID: 0 PID: 6485 Comm: syz.1.166 Tainted: G L syzkaller #0 PREEMPT(full) [ 137.375871][ T6485] Tainted: [L]=SOFTLOCKUP [ 137.375876][ T6485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 137.375885][ T6485] Call Trace: [ 137.375891][ T6485] [ 137.375898][ T6485] dump_stack_lvl+0xe8/0x150 [ 137.375935][ T6485] should_fail_ex+0x3eb/0x540 [ 137.375959][ T6485] _copy_from_user+0x2d/0xb0 [ 137.375980][ T6485] ___sys_sendmsg+0x1c6/0x360 [ 137.375998][ T6485] ? __lock_acquire+0x747/0x2de0 [ 137.376021][ T6485] ? __pfx____sys_sendmsg+0x10/0x10 [ 137.376065][ T6485] ? __fget_files+0x3a2/0x420 [ 137.376085][ T6485] ? __fget_files+0x2a/0x420 [ 137.376111][ T6485] __x64_sys_sendmsg+0x1b1/0x290 [ 137.376131][ T6485] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 137.376165][ T6485] do_syscall_64+0x16a/0x530 [ 137.376185][ T6485] ? trace_irq_disable+0x3b/0x140 [ 137.376207][ T6485] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.376222][ T6485] ? clear_bhb_loop+0x70/0xc0 [ 137.376241][ T6485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.376256][ T6485] RIP: 0033:0x7f67dfb9fb19 [ 137.376269][ T6485] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.376281][ T6485] RSP: 002b:00007f67e09d4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 137.376298][ T6485] RAX: ffffffffffffffda RBX: 00007f67dfe25fa0 RCX: 00007f67dfb9fb19 [ 137.376309][ T6485] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003 [ 137.376318][ T6485] RBP: 00007f67e09d4090 R08: 0000000000000000 R09: 0000000000000000 [ 137.376327][ T6485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 137.376335][ T6485] R13: 00007f67dfe26038 R14: 00007f67dfe25fa0 R15: 00007f67dff4fa48 [ 137.376359][ T6485] [ 137.815292][ T1242] usb 1-1: USB disconnect, device number 14 [ 138.003086][ T6503] FAULT_INJECTION: forcing a failure. [ 138.003086][ T6503] name failslab, interval 1, probability 0, space 0, times 0 [ 138.003112][ T6503] CPU: 1 UID: 0 PID: 6503 Comm: syz.1.168 Tainted: G L syzkaller #0 PREEMPT(full) [ 138.003133][ T6503] Tainted: [L]=SOFTLOCKUP [ 138.003139][ T6503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 138.003147][ T6503] Call Trace: [ 138.003153][ T6503] [ 138.003160][ T6503] dump_stack_lvl+0xe8/0x150 [ 138.003192][ T6503] should_fail_ex+0x3eb/0x540 [ 138.003214][ T6503] ? alloc_slab_obj_exts+0x5c/0x180 [ 138.003232][ T6503] should_failslab+0xa8/0x100 [ 138.003248][ T6503] ? alloc_slab_obj_exts+0x5c/0x180 [ 138.003264][ T6503] __kmalloc_flags_noprof+0x123/0x790 [ 138.003287][ T6503] ? alloc_slab_obj_exts+0x5c/0x180 [ 138.003309][ T6503] alloc_slab_obj_exts+0x5c/0x180 [ 138.003329][ T6503] __memcg_slab_post_alloc_hook+0x5f0/0xdb0 [ 138.003367][ T6503] __kvmalloc_node_noprof+0x5ec/0x820 [ 138.003390][ T6503] ? __kvmalloc_node_noprof+0x340/0x820 [ 138.003411][ T6503] ? xt_alloc_table_info+0x40/0xb0 [ 138.003433][ T6503] ? xt_alloc_table_info+0x40/0xb0 [ 138.003461][ T6503] xt_alloc_table_info+0x40/0xb0 [ 138.003484][ T6503] do_ip6t_set_ctl+0x96b/0xe30 [ 138.003512][ T6503] ? rcu_is_watching+0x16/0xb0 [ 138.003536][ T6503] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 138.003570][ T6503] ? __mutex_unlock_slowpath+0x731/0x900 [ 138.003596][ T6503] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 138.003627][ T6503] nf_setsockopt+0x26f/0x290 [ 138.003649][ T6503] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 138.003682][ T6503] do_sock_setsockopt+0x17c/0x1b0 [ 138.003703][ T6503] __x64_sys_setsockopt+0x13d/0x1b0 [ 138.003724][ T6503] do_syscall_64+0x16a/0x530 [ 138.003745][ T6503] ? trace_irq_disable+0x3b/0x140 [ 138.003767][ T6503] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.003782][ T6503] ? clear_bhb_loop+0x70/0xc0 [ 138.003801][ T6503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.003816][ T6503] RIP: 0033:0x7f67dfb9fb19 [ 138.003829][ T6503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.003841][ T6503] RSP: 002b:00007f67e09d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 138.003857][ T6503] RAX: ffffffffffffffda RBX: 00007f67dfe25fa0 RCX: 00007f67dfb9fb19 [ 138.003868][ T6503] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000007 [ 138.003877][ T6503] RBP: 00007f67e09d4090 R08: 0000000000000590 R09: 0000000000000000 [ 138.003887][ T6503] R10: 00002000000013c0 R11: 0000000000000246 R12: 0000000000000001 [ 138.003896][ T6503] R13: 00007f67dfe26038 R14: 00007f67dfe25fa0 R15: 00007f67dff4fa48 [ 138.003919][ T6503] [ 138.684674][ T31] kauditd_printk_skb: 74 callbacks suppressed [ 138.684695][ T31] audit: type=1326 audit(1794251286.166:2552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6505 comm="syz.2.170" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1e3a59fb19 code=0x0 [ 138.881555][ T30] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 138.948321][ T6522] netlink: 64 bytes leftover after parsing attributes in process `syz.0.174'. [ 139.041985][ T30] usb 2-1: New USB device found: idVendor=18b1, idProduct=0037, bcdDevice=0.00 [ 139.043023][ T30] usb 2-1: config 0 interface 0 has no altsetting 0 [ 139.043050][ T30] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.078779][ T30] usb 2-1: config 0 descriptor?? [ 139.488633][ T6537] fuse: Bad value for 'fd' [ 139.515383][ T30] input: HID 18b1:0037 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:18B1:0037.0002/input/input14 [ 139.519210][ T6537] warn_alloc: 3 callbacks suppressed [ 139.519227][ T6537] syz.2.179: vmalloc error: size 2199023255701, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 139.519290][ T6537] CPU: 0 UID: 0 PID: 6537 Comm: syz.2.179 Tainted: G L syzkaller #0 PREEMPT(full) [ 139.519320][ T6537] Tainted: [L]=SOFTLOCKUP [ 139.519328][ T6537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 139.519339][ T6537] Call Trace: [ 139.519348][ T6537] [ 139.519357][ T6537] dump_stack_lvl+0xe8/0x150 [ 139.519398][ T6537] warn_alloc+0x24d/0x270 [ 139.519434][ T6537] ? __pfx_warn_alloc+0x10/0x10 [ 139.519486][ T6537] __vmalloc_node_range_noprof+0x12c/0x16f0 [ 139.519514][ T6537] ? __pfx___mutex_trylock_common+0x10/0x10 [ 139.519551][ T6537] ? rcu_is_watching+0x16/0xb0 [ 139.519586][ T6537] ? trace_contention_end+0x3d/0x140 [ 139.519619][ T6537] ? __mutex_lock+0x305/0x15a0 [ 139.519658][ T6537] ? tomoyo_path_number_perm+0x219/0x5f0 [ 139.519692][ T6537] ? tomoyo_path_number_perm+0x219/0x5f0 [ 139.519721][ T6537] ? dvb_dvr_do_ioctl+0x76/0x220 [ 139.519761][ T6537] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 139.519797][ T6537] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 139.519829][ T6537] vmalloc_noprof+0xb2/0xe0 [ 139.519853][ T6537] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 139.519885][ T6537] dvb_dvr_do_ioctl+0x12b/0x220 [ 139.519924][ T6537] dvb_usercopy+0x199/0x2e0 [ 139.519951][ T6537] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 139.519984][ T6537] ? __pfx_dvb_usercopy+0x10/0x10 [ 139.520026][ T6537] ? __fget_files+0x2a/0x420 [ 139.520069][ T6537] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 139.520102][ T6537] dvb_dvr_ioctl+0x29/0x40 [ 139.520136][ T6537] __se_sys_ioctl+0xfc/0x170 [ 139.520173][ T6537] do_syscall_64+0x16a/0x530 [ 139.520201][ T6537] ? trace_irq_disable+0x3b/0x140 [ 139.520232][ T6537] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.520256][ T6537] ? clear_bhb_loop+0x70/0xc0 [ 139.520284][ T6537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.520306][ T6537] RIP: 0033:0x7f1e3a59fb19 [ 139.520327][ T6537] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 139.520345][ T6537] RSP: 002b:00007f1e3b478028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 139.520367][ T6537] RAX: ffffffffffffffda RBX: 00007f1e3a826090 RCX: 00007f1e3a59fb19 [ 139.520384][ T6537] RDX: 0000020000000095 RSI: 0000000000006f2d RDI: 0000000000000008 [ 139.520398][ T6537] RBP: 00007f1e3a637b70 R08: 0000000000000000 R09: 0000000000000000 [ 139.520413][ T6537] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 139.520426][ T6537] R13: 00007f1e3a826128 R14: 00007f1e3a826090 R15: 00007f1e3a94fa48 [ 139.520461][ T6537] [ 139.520469][ T6537] Mem-Info: [ 139.520479][ T6537] active_anon:17184 inactive_anon:0 isolated_anon:0 [ 139.520479][ T6537] active_file:0 inactive_file:56309 isolated_file:0 [ 139.520479][ T6537] unevictable:0 dirty:457 writeback:0 [ 139.520479][ T6537] slab_reclaimable:11220 slab_unreclaimable:96533 [ 139.520479][ T6537] mapped:39207 shmem:9855 pagetables:1404 [ 139.520479][ T6537] sec_pagetables:0 bounce:0 [ 139.520479][ T6537] kernel_misc_reclaimable:0 [ 139.520479][ T6537] free:1295151 free_pcp:8274 free_cma:0 [ 139.520527][ T6537] Node 0 active_anon:68736kB inactive_anon:0kB active_file:0kB inactive_file:225032kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:156828kB dirty:1828kB writeback:0kB shmem:39420kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12344kB pagetables:5444kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 139.520595][ T6537] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 139.569487][ T6537] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 139.569660][ T6537] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 139.569764][ T6537] Node 0 DMA32 free:1233732kB boost:0kB min:33920kB low:42400kB high:50880kB reserved_highatomic:0kB free_highatomic:0kB active_anon:68736kB inactive_anon:0kB active_file:0kB inactive_file:225032kB unevictable:0kB writepending:1828kB zspages:0kB present:3129332kB managed:2522804kB mlocked:0kB bounce:0kB free_pcp:34676kB local_pcp:16120kB free_cma:0kB [ 139.569929][ T6537] lowmem_reserve[]: 0 0 1 1 1 [ 139.570024][ T6537] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1392kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 139.570213][ T6537] lowmem_reserve[]: 0 0 0 0 0 [ 139.570309][ T6537] Node 1 Normal free:3929512kB boost:0kB min:55960kB low:69948kB high:83936kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:240kB local_pcp:0kB free_cma:0kB [ 139.570472][ T6537] lowmem_reserve[]: 0 0 0 0 0 [ 139.570576][ T6537] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 139.570914][ T6537] Node 0 DMA32: 221*4kB (UME) 14*8kB (UE) 1105*16kB (UM) 676*32kB (ME) 426*64kB (UM) 241*128kB (UM) 86*256kB (UME) 22*512kB (UM) 6*1024kB (UM) 5*2048kB (ME) 265*4096kB (UM) = 1233524kB [ 139.720005][ T6537] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 139.720284][ T6537] Node 1 Normal: 2*4kB (M) 2*8kB (UM) 1*16kB (M) 8*32kB (UM) 4*64kB (UM) 3*128kB (UM) 2*256kB (M) 2*512kB (M) 1*1024kB (M) 3*2048kB (U) 957*4096kB (M) = 3929512kB [ 139.720758][ T6537] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 139.720802][ T6537] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 139.720837][ T6537] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 139.720880][ T6537] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 139.720922][ T6537] 66210 total pagecache pages [ 139.720944][ T6537] 0 pages in swap cache [ 139.821538][ T6537] Free swap = 124996kB [ 139.821609][ T6537] Total swap = 124996kB [ 139.821640][ T6537] 2097051 pages RAM [ 139.821654][ T6537] 0 pages HighMem/MovableOnly [ 139.821675][ T6537] 434386 pages reserved [ 139.821697][ T6537] 0 pages cma reserved [ 140.316677][ T30] petalynx 0003:18B1:0037.0002: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 18b1:0037] on usb-dummy_hcd.1-1/input0 [ 140.365533][ T30] usb 2-1: USB disconnect, device number 10 [ 140.590451][ T6540] fido_id[6540]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 140.656563][ T6547] netlink: 4 bytes leftover after parsing attributes in process `syz.5.181'. [ 140.738374][ T6547] team0: Port device team_slave_0 removed [ 140.939650][ T6549] netlink: 36 bytes leftover after parsing attributes in process `syz.1.182'. [ 141.481765][ T5637] Bluetooth: hci0: command 0x0c1a tx timeout [ 141.483229][ T6529] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 141.790514][ T6529] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 141.819704][ T6529] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 141.832833][ T6529] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 141.832947][ T6529] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 141.854447][ T6529] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 141.860495][ T6529] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 141.862113][ T6529] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 141.883968][ T6529] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 141.905614][ T6529] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 141.905706][ T6529] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 141.909307][ T6529] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 141.925960][ T6529] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 141.926456][ T6529] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 141.947801][ T6529] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 142.045124][ T6559] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 142.163158][ T6563] netlink: 28 bytes leftover after parsing attributes in process `syz.1.186'. [ 142.617341][ T973] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 142.780999][ T973] usb 2-1: unable to get BOS descriptor or descriptor too short [ 142.781051][ T973] usb 2-1: New USB device found: idVendor=1235, idProduct=0010, bcdDevice=0.40 [ 142.804129][ T973] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 142.804158][ T973] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 142.808677][ T973] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.808705][ T973] usb 2-1: Product: syz [ 142.808722][ T973] usb 2-1: Manufacturer: syz [ 142.808738][ T973] usb 2-1: SerialNumber: syz [ 142.875528][ T973] usb 2-1: selecting invalid altsetting 1 [ 142.879775][ T973] usb 2-1: unit 6 not found! [ 143.059288][ T6580] netlink: 'syz.2.192': attribute type 30 has an invalid length. [ 143.332687][ T5709] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 143.472480][ T5709] usb 6-1: device descriptor read/64, error -71 [ 143.561732][ T5637] Bluetooth: hci0: command 0x0c1a tx timeout [ 143.693147][ T6604] fuse: Bad value for 'fd' [ 143.711550][ T5709] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 143.846893][ T5709] usb 6-1: device descriptor read/64, error -71 [ 143.882290][ T5637] Bluetooth: hci2: command 0x0c1a tx timeout [ 143.882350][ T5637] Bluetooth: hci4: command 0x0c1a tx timeout [ 143.952745][ T5709] usb usb6-port1: attempt power cycle [ 143.961585][ T5637] Bluetooth: hci3: command 0x0c1a tx timeout [ 143.961821][ T5635] Bluetooth: hci1: command 0x0c1a tx timeout [ 144.291568][ T5709] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 144.312288][ T5709] usb 6-1: device descriptor read/8, error -71 [ 144.561557][ T5709] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 144.563675][ T6623] warning: `syz.3.199' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 144.598648][ T5709] usb 6-1: device descriptor read/8, error -71 [ 144.711834][ T5709] usb usb6-port1: unable to enumerate USB device [ 144.945829][ T973] usb 2-1: 2:0: failed to get current value for ch 0 (-71) [ 145.240607][ T973] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 145.255837][ T973] usb 2-1: USB disconnect, device number 11 [ 145.268626][ T1242] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 145.369470][ T5645] udevd[5645]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 145.388892][ T6640] FAULT_INJECTION: forcing a failure. [ 145.388892][ T6640] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 145.397379][ T6640] CPU: 1 UID: 0 PID: 6640 Comm: syz.2.204 Tainted: G L syzkaller #0 PREEMPT(full) [ 145.397413][ T6640] Tainted: [L]=SOFTLOCKUP [ 145.397422][ T6640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 145.397435][ T6640] Call Trace: [ 145.397444][ T6640] [ 145.397454][ T6640] dump_stack_lvl+0xe8/0x150 [ 145.397495][ T6640] should_fail_ex+0x3eb/0x540 [ 145.397529][ T6640] copy_folio_from_iter_atomic+0x45a/0x1a80 [ 145.397581][ T6640] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 145.397619][ T6640] ? shmem_write_begin+0x1d8/0x330 [ 145.397658][ T6640] generic_perform_write+0x5c7/0x8e0 [ 145.397695][ T6640] ? __pfx_generic_perform_write+0x10/0x10 [ 145.397732][ T6640] ? do_raw_spin_unlock+0xf5/0x200 [ 145.397756][ T6640] ? mnt_put_write_access_file+0xc3/0x100 [ 145.397794][ T6640] ? file_update_time_flags+0x3ab/0x440 [ 145.397832][ T6640] shmem_file_write_iter+0xf8/0x120 [ 145.397869][ T6640] vfs_write+0x612/0xba0 [ 145.397911][ T6640] ? __pfx_vfs_write+0x10/0x10 [ 145.397946][ T6640] ? do_sys_openat2+0x18d/0x200 [ 145.397969][ T6640] ? kmem_cache_free+0x182/0x650 [ 145.398006][ T6640] ? fdget+0x16b/0x250 [ 145.398042][ T6640] ksys_write+0x150/0x270 [ 145.398085][ T6640] ? __pfx_ksys_write+0x10/0x10 [ 145.398130][ T6640] do_syscall_64+0x16a/0x530 [ 145.398160][ T6640] ? trace_irq_disable+0x3b/0x140 [ 145.398191][ T6640] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.398214][ T6640] ? clear_bhb_loop+0x70/0xc0 [ 145.398242][ T6640] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.398265][ T6640] RIP: 0033:0x7f1e3a59fb19 [ 145.398285][ T6640] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 145.398305][ T6640] RSP: 002b:00007f1e3b499028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 145.398329][ T6640] RAX: ffffffffffffffda RBX: 00007f1e3a825fa0 RCX: 00007f1e3a59fb19 [ 145.398346][ T6640] RDX: 0000000000010448 RSI: 0000200000000a40 RDI: 000000000000000a [ 145.398361][ T6640] RBP: 00007f1e3b499090 R08: 0000000000000000 R09: 0000000000000000 [ 145.398375][ T6640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 145.398389][ T6640] R13: 00007f1e3a826038 R14: 00007f1e3a825fa0 R15: 00007f1e3a94fa48 [ 145.398425][ T6640] [ 145.440973][ T1242] usb 1-1: New USB device found: idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 145.472229][ T1242] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 145.472343][ T1242] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 145.472444][ T1242] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 64 [ 145.472510][ T1242] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 145.472576][ T1242] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 145.472649][ T1242] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 145.472714][ T1242] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 145.472772][ T1242] usb 1-1: config 168 interface 0 has no altsetting 0 [ 145.482620][ T1242] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 145.482659][ T1242] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 145.482698][ T1242] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 64 [ 145.482729][ T1242] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 145.483101][ T1242] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 145.483173][ T1242] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 145.483246][ T1242] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 145.483368][ T1242] usb 1-1: config 168 interface 0 has no altsetting 0 [ 145.559005][ T1242] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 145.559048][ T1242] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 145.559136][ T1242] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 64 [ 145.559165][ T1242] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 145.559191][ T1242] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 145.559219][ T1242] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 145.559246][ T1242] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 145.559274][ T1242] usb 1-1: config 168 interface 0 has no altsetting 0 [ 145.642979][ T973] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 145.644749][ T5635] Bluetooth: hci0: command 0x0c1a tx timeout [ 145.744278][ T1242] usb 1-1: string descriptor 0 read error: -22 [ 145.744424][ T1242] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.857762][ T973] usb 2-1: New USB device found: idVendor=041e, idProduct=400c, bcdDevice=af.98 [ 145.888059][ T973] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 145.888146][ T973] usb 2-1: config 0 has no interfaces? [ 145.888229][ T973] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.963256][ T5637] Bluetooth: hci2: command 0x0c1a tx timeout [ 145.963362][ T5635] Bluetooth: hci4: command 0x0c1a tx timeout [ 146.004322][ T1242] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 146.004978][ T973] usb 2-1: config 0 descriptor?? [ 146.041702][ T5635] Bluetooth: hci1: command 0x0c1a tx timeout [ 146.041741][ T5635] Bluetooth: hci3: command 0x0c1a tx timeout [ 146.284095][ T6638] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 146.284576][ T6638] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 146.304194][ T1242] usb 2-1: USB disconnect, device number 12 [ 146.308141][ T6650] ucma_write: process 154 (syz.3.205) changed security contexts after opening file descriptor, this is not allowed. [ 146.328227][ T6653] fuse: Bad value for 'fd' [ 146.579416][ T973] usb 1-1: USB disconnect, device number 15 [ 146.797789][ T6636] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 147.060431][ T6678] fuse: Unknown parameter '^' [ 147.071031][ T6676] input: syz0 as /devices/virtual/input/input16 [ 147.151709][ T5732] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 147.266637][ T6685] netlink: 28 bytes leftover after parsing attributes in process `syz.3.214'. [ 147.302350][ T5732] usb 6-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 147.303516][ T5732] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 147.305278][ T5732] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 147.359688][ T5732] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 147.359720][ T5732] usb 6-1: Product: syz [ 147.359737][ T5732] usb 6-1: Manufacturer: syz [ 147.359753][ T5732] usb 6-1: SerialNumber: syz [ 147.540196][ T31] audit: type=1326 audit(1794251295.016:2553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6690 comm="syz.0.216" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f09a519fb19 code=0x0 [ 147.559453][ T6693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.570639][ T6693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.593200][ T6695] xt_l2tp: wrong L2TP version: 35 [ 147.761504][ T5732] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 147.876018][ T6700] fuse: Bad value for 'fd' [ 147.911456][ T5732] usb 1-1: Using ep0 maxpacket: 8 [ 147.914952][ T5732] usb 1-1: unable to get BOS descriptor or descriptor too short [ 147.915002][ T5732] usb 1-1: New USB device found: idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 147.917146][ T5732] usb 1-1: config 4 interface 0 has no altsetting 0 [ 147.951669][ T5732] usb 1-1: string descriptor 0 read error: -22 [ 147.951773][ T5732] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 147.978120][ T5732] usb 1-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 147.996994][ T5732] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 147.997409][ T5732] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 147.997462][ T5732] usb 1-1: media controller created [ 148.037418][ T6701] input: syz0 as /devices/virtual/input/input17 [ 148.048688][ T5637] Bluetooth: hci4: command 0x0c1a tx timeout [ 148.048704][ T5635] Bluetooth: hci2: command 0x0c1a tx timeout [ 148.062646][ T5732] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 148.121554][ T5635] Bluetooth: hci3: command 0x0c1a tx timeout [ 148.121564][ T5637] Bluetooth: hci1: command 0x0c1a tx timeout [ 148.249098][ T5709] usb 6-1: USB disconnect, device number 6 [ 149.161550][ T5637] Bluetooth: hci0: command 0x0c1a tx timeout [ 149.164407][ T5694] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 149.164431][ T5694] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 149.165553][ T5732] zl10353_read_register: readreg error (reg=127, ret==0) [ 149.572153][ T5732] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 149.711204][ T6734] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 149.719082][ T6735] fuse: Bad value for 'fd' [ 149.729362][ T5732] usb 6-1: Using ep0 maxpacket: 8 [ 149.729974][ T5732] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 149.747027][ T5732] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 149.747082][ T5732] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 149.747106][ T5732] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 149.747132][ T5732] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 149.747157][ T5732] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 149.747201][ T5732] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.828935][ T6735] warn_alloc: 3 callbacks suppressed [ 149.828950][ T6735] syz.3.230: vmalloc error: size 2199023255701, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 149.829008][ T6735] CPU: 0 UID: 0 PID: 6735 Comm: syz.3.230 Tainted: G L syzkaller #0 PREEMPT(full) [ 149.829028][ T6735] Tainted: [L]=SOFTLOCKUP [ 149.829034][ T6735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 149.829043][ T6735] Call Trace: [ 149.829048][ T6735] [ 149.829055][ T6735] dump_stack_lvl+0xe8/0x150 [ 149.829083][ T6735] warn_alloc+0x24d/0x270 [ 149.829108][ T6735] ? __pfx_warn_alloc+0x10/0x10 [ 149.829142][ T6735] __vmalloc_node_range_noprof+0x12c/0x16f0 [ 149.829161][ T6735] ? __pfx___mutex_trylock_common+0x10/0x10 [ 149.829188][ T6735] ? rcu_is_watching+0x16/0xb0 [ 149.829214][ T6735] ? trace_contention_end+0x3d/0x140 [ 149.829239][ T6735] ? __mutex_lock+0x305/0x15a0 [ 149.829265][ T6735] ? tomoyo_path_number_perm+0x219/0x5f0 [ 149.829290][ T6735] ? tomoyo_path_number_perm+0x219/0x5f0 [ 149.829311][ T6735] ? dvb_dvr_do_ioctl+0x76/0x220 [ 149.829338][ T6735] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 149.829362][ T6735] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 149.829384][ T6735] vmalloc_noprof+0xb2/0xe0 [ 149.829402][ T6735] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 149.829425][ T6735] dvb_dvr_do_ioctl+0x12b/0x220 [ 149.829454][ T6735] dvb_usercopy+0x199/0x2e0 [ 149.829473][ T6735] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 149.829495][ T6735] ? __pfx_dvb_usercopy+0x10/0x10 [ 149.829523][ T6735] ? __fget_files+0x2a/0x420 [ 149.829546][ T6735] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 149.829568][ T6735] dvb_dvr_ioctl+0x29/0x40 [ 149.829591][ T6735] __se_sys_ioctl+0xfc/0x170 [ 149.829616][ T6735] do_syscall_64+0x16a/0x530 [ 149.829636][ T6735] ? trace_irq_disable+0x3b/0x140 [ 149.829657][ T6735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.829672][ T6735] ? clear_bhb_loop+0x70/0xc0 [ 149.829691][ T6735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.829706][ T6735] RIP: 0033:0x7f327899fb19 [ 149.829720][ T6735] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 149.829732][ T6735] RSP: 002b:00007f3276bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 149.829747][ T6735] RAX: ffffffffffffffda RBX: 00007f3278c25fa0 RCX: 00007f327899fb19 [ 149.829758][ T6735] RDX: 0000020000000095 RSI: 0000000000006f2d RDI: 0000000000000008 [ 149.829768][ T6735] RBP: 00007f3278a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 149.829777][ T6735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 149.829792][ T6735] R13: 00007f3278c26038 R14: 00007f3278c25fa0 R15: 00007f3278d4fa48 [ 149.829816][ T6735] [ 149.831085][ T6735] Mem-Info: [ 149.831098][ T6735] active_anon:20411 inactive_anon:14 isolated_anon:0 [ 149.831098][ T6735] active_file:0 inactive_file:58934 isolated_file:0 [ 149.831098][ T6735] unevictable:0 dirty:368 writeback:0 [ 149.831098][ T6735] slab_reclaimable:11177 slab_unreclaimable:96492 [ 149.831098][ T6735] mapped:41029 shmem:14500 pagetables:1481 [ 149.831098][ T6735] sec_pagetables:0 bounce:0 [ 149.831098][ T6735] kernel_misc_reclaimable:0 [ 149.831098][ T6735] free:1287931 free_pcp:7067 free_cma:0 [ 149.831157][ T6735] Node 0 active_anon:81644kB inactive_anon:56kB active_file:0kB inactive_file:235532kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:164116kB dirty:1472kB writeback:0kB shmem:58000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12548kB pagetables:5752kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 149.831219][ T6735] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 149.831276][ T6735] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 149.831375][ T6735] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 149.854677][ T6735] Node 0 DMA32 free:1206612kB boost:0kB min:33920kB low:42400kB high:50880kB reserved_highatomic:0kB free_highatomic:0kB active_anon:81644kB inactive_anon:56kB active_file:0kB inactive_file:235532kB unevictable:0kB writepending:1472kB zspages:0kB present:3129332kB managed:2522804kB mlocked:0kB bounce:0kB free_pcp:28192kB local_pcp:13580kB free_cma:0kB [ 149.854868][ T6735] lowmem_reserve[]: 0 0 1 1 1 [ 149.854955][ T6735] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1392kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 149.855116][ T6735] lowmem_reserve[]: 0 0 0 0 0 [ 149.855211][ T6735] Node 1 Normal free:3929752kB boost:0kB min:55960kB low:69948kB high:83936kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 149.855362][ T6735] lowmem_reserve[]: 0 0 0 0 0 [ 149.858994][ T6735] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 149.859328][ T6735] Node 0 DMA32: 418*4kB (UME) 133*8kB (UME) 590*16kB (UM) 296*32kB (UME) 436*64kB (UM) 227*128kB (UM) 88*256kB (UME) 21*512kB (UM) 5*1024kB (M) 4*2048kB (UME) 264*4096kB (UM) = 1206544kB [ 149.891142][ T6735] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 149.895673][ T6735] Node 1 Normal: 2*4kB (M) 2*8kB (UM) 12*16kB (UM) 10*32kB (UM) 4*64kB (UM) 3*128kB (UM) 2*256kB (M) 2*512kB (M) 1*1024kB (M) 3*2048kB (U) 957*4096kB (M) = 3929752kB [ 149.914980][ T6735] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 149.915032][ T6735] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 149.915102][ T6735] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 149.915130][ T6735] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 149.915147][ T6735] 73489 total pagecache pages [ 149.915156][ T6735] 9 pages in swap cache [ 149.915163][ T6735] Free swap = 124996kB [ 149.915172][ T6735] Total swap = 124996kB [ 149.915183][ T6735] 2097051 pages RAM [ 149.915191][ T6735] 0 pages HighMem/MovableOnly [ 149.915210][ T6735] 434386 pages reserved [ 149.915239][ T6735] 0 pages cma reserved [ 150.200115][ T5732] usb 6-1: GET_CAPABILITIES returned 0 [ 150.200172][ T5732] usbtmc 6-1:16.0: can't read capabilities [ 150.537007][ T6728] netlink: 4 bytes leftover after parsing attributes in process `syz.5.227'. [ 150.610160][ T5732] usb 6-1: USB disconnect, device number 7 [ 150.639361][ T6728] vlan2: entered promiscuous mode [ 150.760242][ T5641] usb 1-1: USB disconnect, device number 16 [ 150.979602][ T6746] FAULT_INJECTION: forcing a failure. [ 150.979602][ T6746] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 150.979628][ T6746] CPU: 0 UID: 0 PID: 6746 Comm: syz.1.231 Tainted: G L syzkaller #0 PREEMPT(full) [ 150.979649][ T6746] Tainted: [L]=SOFTLOCKUP [ 150.979655][ T6746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 150.979665][ T6746] Call Trace: [ 150.979673][ T6746] [ 150.979680][ T6746] dump_stack_lvl+0xe8/0x150 [ 150.979709][ T6746] should_fail_ex+0x3eb/0x540 [ 150.979733][ T6746] _copy_to_user+0x31/0xb0 [ 150.979755][ T6746] simple_read_from_buffer+0xe1/0x170 [ 150.979780][ T6746] proc_fail_nth_read+0x1bb/0x230 [ 150.979798][ T6746] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 150.979817][ T6746] ? rw_verify_area+0x24a/0x4c0 [ 150.979840][ T6746] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 150.979855][ T6746] vfs_read+0x213/0xa80 [ 150.979880][ T6746] ? __pfx___mutex_lock+0x10/0x10 [ 150.979902][ T6746] ? __pfx_vfs_read+0x10/0x10 [ 150.979924][ T6746] ? __fget_files+0x2a/0x420 [ 150.979943][ T6746] ? __fget_files+0x3a2/0x420 [ 150.979961][ T6746] ? __fget_files+0x2a/0x420 [ 150.979984][ T6746] ? fdget+0x1ac/0x250 [ 150.980008][ T6746] ksys_read+0x150/0x270 [ 150.980034][ T6746] ? __pfx_ksys_read+0x10/0x10 [ 150.980065][ T6746] do_syscall_64+0x16a/0x530 [ 150.980085][ T6746] ? trace_irq_disable+0x3b/0x140 [ 150.980107][ T6746] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.980122][ T6746] ? clear_bhb_loop+0x70/0xc0 [ 150.980141][ T6746] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.980157][ T6746] RIP: 0033:0x7f67dfb6034e [ 150.980177][ T6746] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 150.980190][ T6746] RSP: 002b:00007f67e09d3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 150.980206][ T6746] RAX: ffffffffffffffda RBX: 00007f67e09d46c0 RCX: 00007f67dfb6034e [ 150.980218][ T6746] RDX: 000000000000000f RSI: 00007f67e09d40a0 RDI: 0000000000000007 [ 150.980227][ T6746] RBP: 00007f67e09d4090 R08: 0000000000000000 R09: 0000000000000000 [ 150.980237][ T6746] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 150.980246][ T6746] R13: 00007f67dfe26038 R14: 00007f67dfe25fa0 R15: 00007f67dff4fa48 [ 150.980270][ T6746] [ 151.241532][ T5637] Bluetooth: hci2: command 0x0c1a tx timeout [ 151.243714][ T5694] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 151.243730][ T5694] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 151.481533][ T5701] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 151.632765][ T5701] usb 1-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 151.638438][ T5701] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 151.638467][ T5701] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 151.638505][ T5701] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.685092][ T5701] usb 1-1: config 0 descriptor?? [ 152.838073][ T6792] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 153.209721][ T6800] sch_tbf: burst 2 is lower than device syzkaller0 mtu (1514) ! [ 153.219780][ T6800] syzkaller0: entered promiscuous mode [ 153.219796][ T6800] syzkaller0: entered allmulticast mode [ 153.321958][ T5637] Bluetooth: hci4: command 0x0c1a tx timeout [ 153.323213][ T5694] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 153.323231][ T5694] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 153.982816][ T5732] usb 2-1: new low-speed USB device number 13 using dummy_hcd [ 154.021848][ T5641] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 154.146792][ T5732] usb 2-1: unable to get BOS descriptor or descriptor too short [ 154.146864][ T5732] usb 2-1: New USB device found: idVendor=0582, idProduct=010f, bcdDevice=0.40 [ 154.171501][ T5732] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 249, changing to 4 [ 154.171537][ T5732] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 64, setting to 0 [ 154.171579][ T5732] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 128, changing to 4 [ 154.171609][ T5732] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 32, setting to 0 [ 154.174530][ T5732] usb 2-1: language id specifier not provided by device, defaulting to English [ 154.249483][ T5641] usb 6-1: New USB device found: idVendor=08ca, idProduct=0110, bcdDevice=1.00 [ 154.260620][ T5641] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 154.260675][ T5641] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 154.292321][ T5732] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.292351][ T5732] usb 2-1: Product: ꉓ߶鼾ꂕិ蕨ହ⠈ [ 154.300664][ T5641] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.300696][ T5641] usb 6-1: Product: syz [ 154.300714][ T5641] usb 6-1: Manufacturer: syz [ 154.300729][ T5641] usb 6-1: SerialNumber: syz [ 154.355732][ T5641] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 154.355875][ T5641] gspca_mr97310a: reg write [21] error -8 [ 154.355952][ T5641] mr97310a 6-1:1.0: probe with driver mr97310a failed with error -8 [ 154.582944][ T5641] usb 6-1: USB disconnect, device number 8 [ 154.737897][ T30] usb 1-1: USB disconnect, device number 17 [ 155.185099][ T6842] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 155.222580][ T6844] xt_TPROXY: Can be used only with -p tcp or -p udp [ 155.402909][ T5637] Bluetooth: hci3: command 0x0c1a tx timeout [ 155.410260][ T5694] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 155.410289][ T5694] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 156.725417][ T6865] FAULT_INJECTION: forcing a failure. [ 156.725417][ T6865] name failslab, interval 1, probability 0, space 0, times 0 [ 156.725462][ T6865] CPU: 1 UID: 0 PID: 6865 Comm: syz.3.264 Tainted: G L syzkaller #0 PREEMPT(full) [ 156.725483][ T6865] Tainted: [L]=SOFTLOCKUP [ 156.725489][ T6865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 156.725498][ T6865] Call Trace: [ 156.725505][ T6865] [ 156.725511][ T6865] dump_stack_lvl+0xe8/0x150 [ 156.725541][ T6865] should_fail_ex+0x3eb/0x540 [ 156.725563][ T6865] ? __alloc_skb+0x1db/0x7a0 [ 156.725582][ T6865] should_failslab+0xa8/0x100 [ 156.725598][ T6865] ? __alloc_skb+0x1db/0x7a0 [ 156.725612][ T6865] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 156.725632][ T6865] ? __alloc_skb+0x18d/0x7a0 [ 156.725647][ T6865] ? __alloc_skb+0x1db/0x7a0 [ 156.725667][ T6865] __alloc_skb+0x1db/0x7a0 [ 156.725685][ T6865] netlink_sendmsg+0x5cd/0xb20 [ 156.725706][ T6865] ? __pfx_netlink_sendmsg+0x10/0x10 [ 156.725723][ T6865] ? aa_sock_msg_perm+0x144/0x210 [ 156.725741][ T6865] ? apparmor_socket_sendmsg+0x98/0x360 [ 156.725765][ T6865] ? __pfx_netlink_sendmsg+0x10/0x10 [ 156.725779][ T6865] sock_sendmsg_nosec+0x14e/0x190 [ 156.725807][ T6865] ____sys_sendmsg+0x54e/0x850 [ 156.725830][ T6865] ? __pfx_____sys_sendmsg+0x10/0x10 [ 156.725855][ T6865] ? import_iovec+0x73/0xa0 [ 156.725877][ T6865] ___sys_sendmsg+0x2a5/0x360 [ 156.725894][ T6865] ? __lock_acquire+0x747/0x2de0 [ 156.725917][ T6865] ? __pfx____sys_sendmsg+0x10/0x10 [ 156.725961][ T6865] ? __fget_files+0x3a2/0x420 [ 156.725980][ T6865] ? __fget_files+0x2a/0x420 [ 156.726006][ T6865] __x64_sys_sendmsg+0x1b1/0x290 [ 156.726027][ T6865] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 156.726061][ T6865] do_syscall_64+0x16a/0x530 [ 156.726081][ T6865] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.726097][ T6865] ? clear_bhb_loop+0x70/0xc0 [ 156.726116][ T6865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.726132][ T6865] RIP: 0033:0x7f327899fb19 [ 156.726146][ T6865] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.726174][ T6865] RSP: 002b:00007f3276bf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 156.726191][ T6865] RAX: ffffffffffffffda RBX: 00007f3278c25fa0 RCX: 00007f327899fb19 [ 156.726202][ T6865] RDX: 0000000000000084 RSI: 0000200000001380 RDI: 0000000000000003 [ 156.726212][ T6865] RBP: 00007f3276bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 156.726221][ T6865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 156.726231][ T6865] R13: 00007f3278c26038 R14: 00007f3278c25fa0 R15: 00007f3278d4fa48 [ 156.726254][ T6865] [ 157.482428][ T5694] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 157.482458][ T5694] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 157.492119][ C1] ------------[ cut here ]------------ [ 157.492143][ C1] workqueue: cannot queue hci_cmd_timeout on wq hci1 [ 157.492182][ C1] WARNING: kernel/workqueue.c:2437 at __queue_work+0xdfc/0x1360, CPU#1: swapper/1/0 [ 157.527740][ C1] Modules linked in: [ 157.531649][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 157.542179][ C1] Tainted: [L]=SOFTLOCKUP [ 157.546510][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 157.556602][ C1] RIP: 0010:__queue_work+0xe1a/0x1360 [ 157.562021][ C1] Code: 28 78 01 00 00 4c 8d 35 84 d6 31 10 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 12 aa b1 00 49 8b 77 18 4c 89 f7 48 8b 54 24 28 <67> 48 0f b9 3a 4c 89 f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 [ 157.581635][ C1] RSP: 0018:ffffc90000a18be8 EFLAGS: 00010046 [ 157.587730][ C1] RAX: 1ffff1100af2d94e RBX: dffffc0000000000 RCX: ffff88801f68ddc0 [ 157.595706][ C1] RDX: ffff8880520ab178 RSI: ffffffff8af3aaa0 RDI: ffffffff91c0d6c0 [ 157.603685][ C1] RBP: 0000000000010000 R08: 0000000000000100 R09: 1ffffffff237c017 [ 157.611660][ C1] R10: dffffc0000000000 R11: ffffffff818f0970 R12: ffff8880520ab1c0 [ 157.619631][ C1] R13: 0000000000000008 R14: ffffffff91c0d6c0 R15: ffff88805796ca58 [ 157.627603][ C1] FS: 0000000000000000(0000) GS:ffff888123509000(0000) knlGS:0000000000000000 [ 157.636532][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 157.643119][ C1] CR2: 00007f1e3b477ff8 CR3: 00000000226ce000 CR4: 00000000003526f0 [ 157.651096][ C1] Call Trace: [ 157.654382][ C1] [ 157.657231][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 157.662617][ C1] call_timer_fn+0x18d/0x5f0 [ 157.667225][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 157.673032][ C1] ? call_timer_fn+0xd5/0x5f0 [ 157.677715][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 157.682836][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 157.687961][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 157.693782][ C1] __run_timer_base+0x67e/0x8b0 [ 157.698658][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 157.704060][ C1] ? lapic_next_event+0x11/0x20 [ 157.708936][ C1] ? clockevents_program_event+0x491/0x630 [ 157.714746][ C1] run_timer_softirq+0xb7/0x170 [ 157.719606][ C1] handle_softirqs+0x265/0x8d0 [ 157.724387][ C1] __irq_exit_rcu+0xc6/0x220 [ 157.728991][ C1] irq_exit_rcu+0x9/0x30 [ 157.733237][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 157.738879][ C1] [ 157.741810][ C1] [ 157.744742][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 157.750762][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 157.756400][ C1] Code: 4a 92 02 e9 03 18 03 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 da 23 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 157.776008][ C1] RSP: 0018:ffffc900001a7e40 EFLAGS: 00000246 [ 157.782092][ C1] RAX: 0000000000102071 RBX: ffffffff819ca8c0 RCX: 8000000000000001 [ 157.790066][ C1] RDX: 0000000000000001 RSI: ffffffff8e6a82c4 RDI: ffffffff8c8ea380 [ 157.798051][ C1] RBP: ffffc900001a7f10 R08: ffff8880b8333d9b R09: 1ffff110170667b3 [ 157.806050][ C1] R10: dffffc0000000000 R11: ffffed10170667b4 R12: 0000000000000000 [ 157.814028][ C1] R13: 1ffff11003ed1bb8 R14: 1ffff92000034fd0 R15: dffffc0000000000 [ 157.822007][ C1] ? do_idle+0x2e0/0x540 [ 157.826265][ C1] default_idle+0x9/0x20 [ 157.830514][ C1] default_idle_call+0x72/0xb0 [ 157.835286][ C1] do_idle+0x2e0/0x540 [ 157.839361][ C1] ? __pfx_do_idle+0x10/0x10 [ 157.843971][ C1] cpu_startup_entry+0x43/0x60 [ 157.848758][ C1] start_secondary+0x101/0x110 [ 157.853525][ C1] common_startup_64+0x13e/0x157 [ 157.858485][ C1] [ 157.861509][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 157.868797][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 157.879293][ C1] Tainted: [L]=SOFTLOCKUP [ 157.883621][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 157.893678][ C1] Call Trace: [ 157.896973][ C1] [ 157.899818][ C1] vpanic+0x26f/0x710 [ 157.903805][ C1] panic+0xc5/0xd0 [ 157.907525][ C1] ? __pfx_panic+0x10/0x10 [ 157.911947][ C1] ? common_startup_64+0x13e/0x157 [ 157.917083][ C1] __warn+0x315/0x4c0 [ 157.921098][ C1] ? __queue_work+0xdfc/0x1360 [ 157.925892][ C1] ? __queue_work+0xdfc/0x1360 [ 157.930681][ C1] __report_bug+0x276/0x570 [ 157.935194][ C1] ? __queue_work+0xdfc/0x1360 [ 157.939980][ C1] ? __pfx___report_bug+0x10/0x10 [ 157.945030][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 157.950329][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 157.955353][ C1] ? look_up_lock_class+0x57/0x110 [ 157.960557][ C1] ? register_lock_class+0x31/0x2e0 [ 157.965783][ C1] report_bug_entry+0x19b/0x290 [ 157.970655][ C1] ? __queue_work+0xe1a/0x1360 [ 157.975461][ C1] ? __queue_work+0xe1f/0x1360 [ 157.980235][ C1] handle_bug+0xce/0x200 [ 157.984487][ C1] exc_invalid_op+0x1a/0x50 [ 157.989002][ C1] asm_exc_invalid_op+0x1a/0x20 [ 157.993875][ C1] RIP: 0010:__queue_work+0xe1a/0x1360 [ 157.999290][ C1] Code: 28 78 01 00 00 4c 8d 35 84 d6 31 10 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 12 aa b1 00 49 8b 77 18 4c 89 f7 48 8b 54 24 28 <67> 48 0f b9 3a 4c 89 f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 [ 158.018905][ C1] RSP: 0018:ffffc90000a18be8 EFLAGS: 00010046 [ 158.024992][ C1] RAX: 1ffff1100af2d94e RBX: dffffc0000000000 RCX: ffff88801f68ddc0 [ 158.032979][ C1] RDX: ffff8880520ab178 RSI: ffffffff8af3aaa0 RDI: ffffffff91c0d6c0 [ 158.041198][ C1] RBP: 0000000000010000 R08: 0000000000000100 R09: 1ffffffff237c017 [ 158.049180][ C1] R10: dffffc0000000000 R11: ffffffff818f0970 R12: ffff8880520ab1c0 [ 158.057162][ C1] R13: 0000000000000008 R14: ffffffff91c0d6c0 R15: ffff88805796ca58 [ 158.065173][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 158.070994][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 158.076295][ C1] ? __queue_work+0xdcf/0x1360 [ 158.081077][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 158.086462][ C1] call_timer_fn+0x18d/0x5f0 [ 158.091068][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 158.096887][ C1] ? call_timer_fn+0xd5/0x5f0 [ 158.101583][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 158.106717][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 158.111835][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 158.117651][ C1] __run_timer_base+0x67e/0x8b0 [ 158.122540][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 158.127933][ C1] ? lapic_next_event+0x11/0x20 [ 158.132789][ C1] ? clockevents_program_event+0x491/0x630 [ 158.138608][ C1] run_timer_softirq+0xb7/0x170 [ 158.143481][ C1] handle_softirqs+0x265/0x8d0 [ 158.148264][ C1] __irq_exit_rcu+0xc6/0x220 [ 158.152861][ C1] irq_exit_rcu+0x9/0x30 [ 158.157111][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 158.162774][ C1] [ 158.165712][ C1] [ 158.168642][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 158.174621][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 158.180263][ C1] Code: 4a 92 02 e9 03 18 03 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 da 23 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 158.199875][ C1] RSP: 0018:ffffc900001a7e40 EFLAGS: 00000246 [ 158.205973][ C1] RAX: 0000000000102071 RBX: ffffffff819ca8c0 RCX: 8000000000000001 [ 158.213952][ C1] RDX: 0000000000000001 RSI: ffffffff8e6a82c4 RDI: ffffffff8c8ea380 [ 158.221926][ C1] RBP: ffffc900001a7f10 R08: ffff8880b8333d9b R09: 1ffff110170667b3 [ 158.229904][ C1] R10: dffffc0000000000 R11: ffffed10170667b4 R12: 0000000000000000 [ 158.237882][ C1] R13: 1ffff11003ed1bb8 R14: 1ffff92000034fd0 R15: dffffc0000000000 [ 158.245864][ C1] ? do_idle+0x2e0/0x540 [ 158.250147][ C1] default_idle+0x9/0x20 [ 158.254402][ C1] default_idle_call+0x72/0xb0 [ 158.259177][ C1] do_idle+0x2e0/0x540 [ 158.263278][ C1] ? __pfx_do_idle+0x10/0x10 [ 158.267890][ C1] cpu_startup_entry+0x43/0x60 [ 158.272660][ C1] start_secondary+0x101/0x110 [ 158.277449][ C1] common_startup_64+0x13e/0x157 [ 158.282422][ C1] [ 158.285611][ C1] Kernel Offset: disabled [ 158.289961][ C1] Rebooting in 86400 seconds..