last executing test programs: 3m3.247479954s ago: executing program 32 (id=206): fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x4, 0x0, 0x1, 0x40}, @exit], &(0x7f00000002c0)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r0, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newlink={0x30, 0x10, 0x437, 0x1, 0x0, {0x0, 0x0, 0x0, r3, 0x308c3, 0xc4a48b7f26be2e0b}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @sit={{0x8}, {0x4}}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmmsg$inet(r1, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @empty, @dev={0xac, 0x14, 0x14, 0x41}}}}], 0x20}}], 0x1, 0x4880) 2m17.288889157s ago: executing program 33 (id=634): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0xe0000000, 0x0, 0xb, 0xffff, 0x5, 0x2, 0x0, 0x0, 0x80, 0x80000001}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) syz_fuse_handle_req(r0, &(0x7f0000008340)="ae9104f5e131d0eff851b5fdc5390a7c7f56681a20b26f178d0e1744701f203b65bae3a210c85d398dacba5fe7b46b6deb271af1f3f614ed140ce7d82692c24076cc29858ae0ef9e5ec4fe2af8da035b32d283a1bbe66a21b8d1031d6033a3110ff92565a24e7cd7374a27b307d464322e31faeffc62253cc1898b9b858ff9ebb6d325089a9e4c5054618d61f45d31157cb27557d6ff7210ec02d9907fe6c2e6d5544b3e5f623bf95dc7c1720152ab6c7837428d036904df79522b2b98bf4f2f63912a69dc2956cba1f1ace8d4e3aa9430b0a9ab63e297a299953dc40ea78c5c4739be290b13b0a1057a7414e6545612d4b4bff2ecea1808351dc6e6329963374ba106631be1c17c5ff70ea31b2d74de39c06591461dcebb33230f2ea6564266145dd7bd85c6a6885552bec51edd77e562b7ae5d7fe7bd9e5e5110ccf1843331f0a43db3322f5f512114b0f96efbd22421c3d049349887dca35caf1ed701af81c9a6c248b2cf3407e8bf3809b5f8a5f5ca0340cfbd7598d2ab6f3979d399c2adc15562ffedcb87ca94192d68ffea6544fb0b5e9ae67e6755b1a36e3e9e9c6538514ad06312ec6669d2120150f886959558d9a7081386f10e16a565e16720178040289b7b1d8acc19ceda06ccaaa9ba3e8216fa982322fe1e933e4966c393cc43acd49121ef635f34ffd6a6da8b15bd068677e0653bf957d4784327eeafd1065c4de8cec6f7c60ce667a6308cb743cf48d4cda74c26627a9e5f2e749058d071eff282a6d99cf1839d139a29a901356bbf23e40b3ffac59846f3f78cb2b0899ec4639881777bae26c33a0041a795f2882095c9cb0f8e9b041bd6e2d92ef90ab080b625b9b17a0587802e58597557e17e2ed731c1e2fa22e7c216ff03a828d5340ab0ada651981aae267f65cf202e3e07aed5db4755f502b99cd67bf253fbc12bdb112491e97ad51cc519b0cd6718a2f7970bd4eb8c4a7d0d1e3bd52f62849b97a58e7d3f49568f5e28583e596db5cc5346b13a1898dd42c78ea259768b5ba3957012a71e95376f735380209f3dc4f5a948f6212c682161734c37d96726c14efb925ad2b540c776f3b59b39b629405b3e7f949076d12ffca6863992d1c84b067233dafe3783757d2d1b8f0b1649730264a19f9b2e09bc33931d32505f37518d92b3f9e20e1753aa669ec0670c7207069b7379228a6d6194b65ce001e77340f92ad3c19b2ce6f04f176413e485f55c6de8ea401bb7ffcf49c0bba43d8700cc9a47928caeef46a9a1aa3d15d4c421859fbb96c15f0b263956b90d779032c1a56270f752128e79855453dbb08674614ecde64c9fe26ec58202b2c022c8cfa468c724c13ecd1c9e5c7e84f6dd73dfe55a299161a9cf4dfcbfee61099891b82c067779149c14390564640c5ba8d0c27575c0e8907c714104139ec424f6ee5e3eda2a2dfa92c7853f5487cb465f392a5fac57e3536c01dac9c7b8840a5a011b1d4a58db7ea7300b935bfb1574613f5e7c720545f449d4965aa6749cc05ad972d9dd3f45107631bd1d6c1c6893f3d92beb4d0e93192bd9474911ab7fdfe2e855bb440e63e95b47e882346e7b1d03118d9eb70f41fea069e853496bed77928775dec5cd5cda6de7f553f053e6d456cde7883537596b7798eee90b41e89d34a18775ab24641e2e42d686d45f19f40eb837c7b32d8205c11e211d158a6f2abd89b56e6bff4d9c725894e8ca0a82e0187b3d2686e7f6fbf3ffaf17c043419bf5e01c08ba8f34410e5020e5176e14e06e68b2e76b0d254ff0e36a2f071d00e2d79a23bd37a09cf9b40d5abcda3064ded4c45577e0d2c138ce7e53cfbc62a6071c8e9baefb43fc71d1ab4b305825e1dd49b36ed1ea9d9e8cb9c0c8e9d5238ab8ced7caba200875579c6869cdca19c71ce0f91737ce86873c32a399de7fe0699f6c5bffed3948a0eeebe01a0ec004601a1998119616838df779d218187fdaf5b4b0d5dad8a42a421cfcd8ec5dd077877d83a9d1e8e0296ffc759bf0b18784701924b5053916c8eb534d85af419372e0a90540148e7c4698de41b9b0381b8bbbf9f5f52c77c1dd0144a1ee05126c2dee830f437f11db53e98eb8295763328bc6261ea07c09c0cd7983aae24658b96a81566fba02a2a87625f5a01a76593bd07b8b70a029574adb0578617e5def835bf8b1694cfb728a1eec3bdb22d3ddbe8df086a6a369be3e05940005eb1daf4e4158847bfb73f6d88ca4a6411ea70a1eba2e7a6e02e0754963b23aa1f2c52c4ee27f3288904d407a0998f2c8de6d7d6c8e3ebe0a3f38f161fc811a03b8e2ee664b26c8d896bbac441c9c0cf0c5aae1c7450fba1c34b65beef201352785657414944f56f30f514cddea1f8cf0933292d26c37e156f582af27263ae52e33b95dceef1864f350a05248aae1162c94cfc0ed1251c2915bfc599cdf30f3252a3ce5a796a9be0b8294e38702dca2ad89414e7e5aa4810b842144df382d5675ae7d48b7185f1cf40629b1411a39f11b99cb519aa108b6f8f730adc60c94543877a14bb954c58944a868dd85cde1c696839c727af385b63b1eba6771d8ba5f936f0b9ee7416d0902e4caefa5350087ffb503ddf38fdc4e6597032e850ccdb3f66104be78339b9de220e94c826fb3a21d0b22cc494fc556ccac4d84e016024d00239b47add06d138360b619c42335509956889e500d5242577345b6f0418e6db73bf60206a822596e8b06a0f98c7ebaf5f06e3b979e4d1d2ebec972555341bbf45a61fcab998918db6e2d5135ae626d88c812383e378f84c0f33dd99be898ccf747a28fc54d2d6b5aa2f213dc2ad6aac63e42bbbf9c4a5a93e55b390dca1fd87a99e612c506d8272adc6c026e4e35a3f1666005cd283284d1f93f3f7a2c6e8676cbdb5fc47a4a0ef70d86acf45eebd60ee9afbcd7754eba7e701f2aba861182b49b96089f697695faba3096ba5b667388ebd33d29ad688ca97eed8bbd1fb8ab6a450dbc4874e64c086739aba5ab016ece6cbb3f8ff4bf0c3e0c77332888e814217afba62842002ea3c81fd8a3cd52de70d3005ad59d5713b7ec1ff51e58233a3bb606d6dfa991cd3ecb691d4295e7cf8c5f4615bd3422905b4f004f04abc71fadba1cbd1d17d0d6ae7bfe437bed460a9a62d7cd8bea589358135f8e4eb6c966256ab679846500671b7b9f82f537f58892a1286ad4d5084a9f11fee005de5ffe2f2bb357500ff23e69e53238232d560f6bad2cb97efde72e1dad8b9428a83363d6aac32ef5e58d25d4724c88ea5b439a1a458cc872163cdc69f366228b255211014bce56528134593d1354a62d9729bf0cf6ea156343ea811a1cfe0fcee7b1db2106338b5689c95c93d2302fa6f610d4443697a85e502bde43391500b839ff3ae66fb87494547d03b4a6e9fd000a4e7e98bdec7599aef93b4d5d2f91b05e2ce54e7b72e89b43a659f882dcc52a1fe022f03f93f966bbf7f66442f9ef291049de31901ebf4858d105b1459c83bfb74de42bd087660ce36e9d82fb00df5a7e3b462d36aa849df8fddbf40e2c24b1830662bcae090786d6a757db60328fc484a5adc488a42e12f62e77d5a6b1f76d849954ee9e664bf59d2c20fd3257878c64e94b6accaad8520716c39d4affc1428b16bc2be9e3026684694d18124be77083273be2bdd55215a081977e5c07434d62cf184f43068df39ddbc83f984c62704c6fa459f308af1b3b6a155e861e6c5d038ba241810b00b3880d9b56d312aa5c147c879f20965c22a95e22ebc9e50a5fa4100e23962c8feae30ffc74d4d1a484128d031a2fc68cde1043f3f57df3e9ec16d1b5d122b99b9504cf4fd8e50d99e4e3ca4a68fefbdb6e4c07005e9eed9e9a2b7f174aedd0aeb307650f112978c40ba7cc6e5f2776afa80c111165a2d3a3adac5cab1a2e907f21f40cb4c713034a7dd4be4218c385e8b118a4e622457d7424ac53310d0b9d6163358789c6d6f5b5a234a4460f0a5b8462c674da9cfc75d375d26f83ad419a36c2ab9b6ed7fdd84d780bf13c27e262676766eb84c8b895411f660cb9dc0a28a9271dea21a87d3c0d21ac60fe44029b579de6dc44ad71d16f8fc75bdb5185ac87ac036a88c3ea1a47159167624d05b000e640aee20da35bfd059faf97cd2ce808725f85c81552ec702fb2b51159f1ed7e101e3d4c0fc87afe3badd199f9044429cfc9925d0ff48dc2d19df2f3bb04ad10255f6163220815b48ff5b70f8100a65a2c992b4b39749ea6d89a65658603626402310b19b6fa2679ce5926642b4b9c0f5ea2485f6f95338301d992ab278c162cc2c84e0436a3d82e695df7ae81abbdeba3a80f09281c34a7856e8a85c22bcae5ba353a38ce6259b46def19d01797716867d064f7d69cdbd051b0189cb957c6372fbf86907c03218ad17f6daeea30e9e93e0fbdc6e5fa4759c5c514d04181383aa05694c0c75974aa91ba014f9dab4d90f5ca07d97705f95dd47813c5a8fb5dff8fc2c607d2c2ac5dd32c4e924b300716844f8ec6f4598bcc802ddb9155a27efea9f3f604241d9539d2feca0555607fe01cece67ce55c2aeb4aab512b8c01b45f643adff1e42e61ebc65d403375c705619833fab83635b371c90c7c572f175cc9038bbc16141f7ffe4ae9a888fbb2924c47112d7fed879faa8c5b5d4093f1d87b20a1953edd637f1f9ad38f63cde028ac30911726ea443dbd1234a85fad7d872b38aba96ea716bbced20485d57292d97eed1f444c614727655c395d78f78d471a7579e1c999aa3f887cae5b32cb4ad6e72c3b744ea4804e9e5f8fc186716f199a01e2f5e00c626f6c0619f721dcdfe29c7027e05b96bc0f16df3601105af92fb05769a5a3d5edd86e3043fcc007423220aa2a319d04ab102469c5687575ae986f7d70d4567e8a9aaa328ce6b89b7d4ca51c94159f81612ab6e633fd0f08f0b81cc6f83093eeb6cbbab3a686a3b038886162cfc3a2dcff76777c2dbf8e3925c7eba24615085b9132b81178a449831820ce288853d269018faeb0fffb027ae931a36a845e3d486885da575ef55645d71aa745b3ffa5336a2551bd8cc64b687bf04d0b92f43a2e00f9cdb2c944296053d7b3c564f6e3e246bc9468386a0cd8d4f7dcaff939fb4688c1f6bf829e89c4949da5bcbdd9515fcd2e41620f5983bfe17698b07a40abf27dafb8fc563e43312e5bbc4311ec1efc4009f4da909eb94ca6c59dd1ab60afbef0717d06f80618a8cb619780bb607b3fb1bd2a1f49e0b618cd7a61e030bbada12535e1a3d77453a65f97d67e3b37ba51c6e46070475d2839d4b8ecfcb155dcf9f50cbc71e7829bba5581ade6cdd2a899e714a033c66c2f9f0e37172428d69565885d4aa3cbc00bbe413c4c3b300d0a61e65eb2e5ec0afaec0116c9c21f8c78effe3b62ad7b045063f9c94e8f500143997354d085a9898157fa377fe224a4e4d49455ebaefebf3c126edc8980064a2b6fe171c2da2f217441bc1cdb3f817b0b026244077d11c066be6b203feedc782683e5324d521cc3327a9c0fbd4751fcb6b4dfedc814f2722763e78da72ac8a02bf02f3ac1eda4b6ebc0b95a9468ed7f9434b80fdcf86065104c2624b3bc16f7c1f6e555cdb66471fda5efe5d6116285fa257f393ad87b7bab00eeb5a79c557f5f2ef0c49471655de6c3bff999b9741b431cc133ea79676839081c712914dc0ceb99090cebf273f8dc94ea06d9178b71a795725644e42f867372d12fe24255c6da4175acc70f0c4035ba57b0babd10878b94fc91903fcca5a67839a7335dd8bf0dda1ab52295ab8a0d411b169046c0e4effa652d07760c4d3abae05b994ea5c680e44a0cd2196e8cf962da5a7ed0960fa6bda19a833b7e79a48c618b45639254e40c9211f40778143b4ff00e8ac44c19c18f09c08aac4772090a9544557047f72f20d930aa54da3ddaa2543599391f02cf2be9fced8b31ce163e986d20f85ed162daf14c7814636c3ee44402d4acf5113e4ab8db145055ed35924394a194eab3e5c754c09c4932fe3b8d77876522dd0071dcdda8c0ebafa88f151f7c3daaa692188326b50e7b1821b5e0cdb942d4748bcadc0b8612e4f98ba0a7f58286947707b158529c758dc4e69f41ec320f12fe0367007657509e835fe794512e2ef5f4cad852785c01d89df5de7b3025a3e4b2b4b803e6d6260a18464563c3c8fd5d18687dd60f0660cde23bed48f2f87fc2243b2c084295af9dd97a4b3a9e2696aedda0708c1b548070467966a6a32a4e65f00b43e248f4be6f0bc97734183e9edbc690b334e3d9453435c9c90341142779152ccbc476c5dfa914164f497edeb5a0834a71b19dacd71caca60fd35b73aca27369d4c41ff8c989d5c92ba90484f1b0251c94247c062d30138768d2a200dcf390a068c4b41cd48ebb5962221b1eb22dc208f0a1179f9665a29a69496fb3e42b293ac6d09203ae6ee0286ddb05807658cb3682b032d93d7755f731908dcc93e91a712d30928c74f00970e68df794cf64925d3158c50bc8b5fc6a22a68eebe8a21137e79a8563d66940d7fdfbec593a80f09e4dc10fd1c99a02f4da2f699cdf88cfc0fdf02d53ea905455adbe78d43ad588ff7ca1b509a4bbde0f34a2ea59e3a63569346c1eac934d15ecf19f4ed6882624fee55d986a8a69fa180a924ba8855fbfb58b1861ea4f51816f83aa5fda62cc40961016d048de4e350d7929a3fdae4baf2907134c20e756965133715ea1d73ff6577667d513ff429e10181cb88f493ecae6ab9ee407b275a31c91fd16f77123ebc0c141f45e71afcb96fcb658b457d1309234da9e042ac833b8d902b690ac43fd8c14b71d0a1711da1f0db2ded92c6c690a803a8b472992648a8974252f607e9dff3881f12fd5a7ef45fd5d155cb6ad65033a0f0085f7785e8c7f4122cc968e342abb0e4f93deee8af6b7cab52e2eae0bbb7b584822b5c225a39cd0b1f03157908018508ca2e1ae76f3979af187e738d8f000f3f905a8281bc5a486d0194fd8710ebbadc91f843042f46721c5f2ba3bdadc01cb34bf74a2b03f7bce5b48069ec83d8c9a1ec2b8318d6fb875a2df9c88086c9e53ab7fe5b8c88048185039ac8cec20b62267cc902dcffcf8d69cac06c74a3a3abf5b93830b0c1545305a576a0fce7d1a8f772a3be73e6c1fd3123d70874fb6843806d30885c61bdf7b950e54da1ca243d1867521d76e438b357563331fadd15033afe794ecdb06c81236d08a5189fe2efd40b9773c1acc5c2b750123f01e05c3ec9ec6be91015168187bc88a79b555a551af97ea9912c8d5eff507f8c0c8fbfb4e11fe01bf17f8d2bd4b2c87fae58d6bad3185990ab95734299c45d94bc9beb1abdd0193eb1e5d818e2ec1ec79960a48c5ffc2bba4923e6b3272b8bc601058a840119f89c4073fef547bff72abda289e119dfd5977978a6ee56a3bd1d55ec62db9ee09520d873b2d304adcb42487840e545c503bc3c7fd23337134dfe1f5218cd4cffb19a61ac09b46ad24d22ac53097d229e6fd7d2416a890d9e0b629c45a967c7ac67cbd57c1177fad750ab11d60cd5480e5223d933f448378435a040424b590f16ddc1d80031900d14fa3297723382547af2932fdf32280a17f0e5438359c1304f32e1a58abc97322e7250eb0e047b74b0f758928fd08c0ccd399bb0bea2f4356d95f1e52ecca8c7fa14af54cdcb318592910dcde24aab0967898f00465c8f7f45b17fe9542cc5959fdc3774a0240a2dab2a882301cbb97ebe56e527dd11a494bf63a193012808eff0846f18bcc67f8d3ef8e13babf0aa583a9ae7d665581e63353c07f1b335b20d59c9361567716ba5ccfb7c9011ed61fb831158c1588780759057956886b84f44cc00c51f0b0ce56f4532c5c9a82e260386860ac06c6fccc919e88adbda0e504d8e07e7e6751f4b53e33f8092c0f37b95e4afe121dbcb379d4669debbedb5794bc24cf4624bb471d5c829b9bb420775196dc14ee64b2e294b9caba354842247dd70c8fddd252c4143d3fdb6d87787edcb0936e75c535184d8b53943ca507789dce21aeb65d4fbbb6b978b0cd62de2140efb3c1f7c69c1062ffee16ebe2a736e18120ca21ef326309b16c9731caf16e425b7ceee27c0eeede689844a9d39834375f765e24a72222c9e0358f4de206017595f7c80fec861a79f7d5afa50b8c7c55d10aa3930bd203b36bcd5e79d64f5df866afe75c1f0722f3bbefbbd62683ad04e0a5abac975d4d77ca15aa0c95f49ef6ad08211caa98f0e0f67d18349c8ad65e60ab143bd5a5d79ac9eb151f382b854f40a9b6dd45940be2be91407f455a3f8196136f85972b1010c9102a64e8e20fc9c89c06c567b18f16187628b55c506725760107da1efb840c7ab748de4cf1d3fe5d8e36533769ce3fdbb9fd322e9ff82c52bb448bd5928a9933ae91287be98af1e02825b2db13dfac238430d96e17c8f88d92dc381bffc25712282013de0528d8618f7502578c4667fce087f0dd94659029808b9fc3c3c63aedde226ca7db58010af931690ed76679a23f54e239ac928117e0ec14eb9f9e74a207b18dcab63d13cd69fba8f9d3caf80e83cbf3bca3a8b6f52926325e60a9fda66472ebf2e21b98ea4ef7287db1a6986d042edb1e15839dfff4f9ace81191c4cf8491d2f3a62f59070e297b91568c0bed896a3153934c5aebd30b0c545b4f67b1765a429e1b79f8b3aca0840e0f336a154267b3d06dd65b89d5edf6753607846944d3c2383eb1a08ed6150ea01bc716ab0365057f31f6acdedc0d9da52b1e0d72d3c329416658567750ce6147890b5effd0994f04d37e4716b06e4a6d23303c2ebf20e5f9e6685ed4a28040eafe937c22cc5e6956038200e4f06c48541ba083a7d74d0f695c70152398f550d4db11528e821ac7741f792722b8b08fb9c98d1ff1530cb7c05bed8234d8d7b3b1fc029d62b9f394340097bf34978beada5cdc7b65a5b595e52ae50333e30ca2414d3e1296eb0e458427197a0e48729f4ba07a86cefd5210e11f8a1894c703e632038a88997e2a9c5f70fc0064aba1344d9409f8d84c034180b08bb209d3302b14774f0a576d4d81c64b205a9d5e5837e15c87fd7fbf4efca76e638364aaf2978f6616fe0281786f4c0f9c114ba212eab378b59101c1239d310481365594b95232b00ddd9eb353088481e8ee69e6d6668d5899d56e29358132139c47e31c75d6fbfd3a49b357757c36610cdec7dc7c9f3c6f0b0e336aabab5b2a01e08e1a44a4b1235b7b3da4097cae6d89c2d16823cbe35e7544001faa95b1ff11594f486b8ba29876b1a4222c7bce88537a141111f2b2735314c683cdd29a5dd9f94eaa99e37720c3d85cec96932a4bbb0f83be82cf6607872bf0b858b521dd2823743fb28077b2191dc523e08cbd73a1a1f881dbef85d0772d8f4b0cf4529d84c96a5f539b07188d177ba340c0e4286781dc30068e8bbd74f66fc9593f63e1e40aa89487d5e887f4f502ae9b6d112a0b62775e57dba8212be68293546c157b69a41f741da3413f84a31b6bf276317e5f6d0a61a10eae8117bf53f8f5f224fe799b9a096be476c1c2af18d6dc05ee086f251cd013eb0c0382a38d8619adbae7019ab5ddea1dba0486b61299702add51d6dfbc9cb8e9cfd030cd4f01cd4be206b700129fc96b54efbd7415996faf693046270abe93d8afd3d5a570c407266137e7281d9552fcf046f075e124ec23d51c5dbdeabbf2eeff18a46ab0a9fcffef9a60dea7790e57ab785916ae0b80ccd59a044bdc24ce6b4a05d20b70d2daa0e7aaf5d57ad0348deb886ddae682e041f5ea5cb861f54a2ef7e493f2bd313926eaca2c9b64e9d347dcc9d00ae17e0fdd677c5bf2521b34d376630ec3f355be7c8d9b43a02a7b4489de33a9c464ac2fb4dd127bcd50c1a96b384a375def1eac7226bd3069413a8cb585fd8c6e2ca07abb3e445817f9f3414c40fdbf416f67d28474528cd3d00f68a3512301842506f565bc57f84c3cc7c89d96709688773536a12f5f872c7476eeea9addadce80a30a52cccaf521e7e80657c3eec42c9e4b1aa1c305782a4480948ed6e91c88fce6413d876d16af0499358f6cfb5523e08dd0474ed6fdebd82e5fa4115a94e20eb925aa60795d3246cb44f2b620bd593559a032cce7f4549347b07104c0b6762e9d4ea8293b250ae78bc3e7003e9d335db4547a9ecee4ab62fbd9c14fbbbcf0df53c46371a5dab059e7b8394e64f5c1c3393431ba8fa0d032049cab859080d4e6d3e17cf02e3d3c21066ac9595661391071a1825261dbe52ca45cb083c562b30130df919b8e3e0d9947c91873f9f4fc3886e0de9d224e00ac81c929d435f2c2f00ad4e3af7fb5043127ea11c47c0984177a720be125fc18c1596a09dc1a13b1f36aab681f8ecc918d16849d6cb19d00c776952e504665902b52cd7c18869ddc027b5009aa322b95fb576ba192588daa0f1693fc258808cc8ceeb6f094f2b267bd50b7ad9924b6ba8790182f744127e3e3dc0407b1187970d2103698e17395d3f2a5080a63120eff1226205f44da66273b35c4b0e0106442a03988b32ef0b47e584ad82a97fb8cce6655e9d8d9f4256d99db52b4fed2848129683f63b2a87aa3cc44060acbbfda7cf40170e6b0579bf1a7c173c927e504b80c56935552c73048bcf1b2966dae1a3ddb76d2539417b81fe43a56c95cc829a3f66c8fa5e14304d57a4763475af814a11ce0543f8de3f8e517af86617ff320df7f75b0c9456e416e30472f4f1d5df24dd96ac4a353147703d0a0dcd22550f80ecc1acb099bf920caa14132d372a85d5f836c9f0d79d8c70d44d400c55c3605fba463fbbdc593dcb3b0057b50541dd54493548c4c602a7a2a9cf3f2e70c20502b30767bb20d2110a886ee2fd1d2a7396059d868fa87a69f331e0d46cb0fdb3d537fa7b5f6496062620d7c734b1df6c069dbd6c9f4af8414950b2892260195e765fcc6f9fb326ed63426bf85b32d5c04cb4d6e5af5846f01affd6d76d2f1c0136ec4a57275a667cec98ff5699d044cf0eb44cf3e9393effb8efc116c5064515a7d38b437220f51079773a99ec86f3678838bafa6dd09d705c80eae781ed6fbc847a6b88bd9cf0eb7dfb9f82b7690bd2f42e5e93f0a1fa6a852dfd1c981b1f9431ff1361b4768b5c77933af327860645e915595323e038ff55950811fcff5c1a909e14d9674436c9ab81718b7af45113a37228e74c039ce18f42d23115d755036979dfe5e696773dc6e94485c1275d9b2de41b513e764aa22d71e1c1c7f17373765b3265480802483a2af6f17f0fe3a7038aaea49474fd60a7278a17899d425c24d5892c65de662ebd1e6c3d62b4ab74f6ff514f66d3d5951ba112bc636cba7ccd7dc83073b691942f4540577dae500bf2695e405b74f0d8e09ff53a54aae698f9125cc836c84486d53d8d43b034cf11fc0d2228d111635bea072c65d9d9af4b8a2ebca135885837bd10c15b844ddb178bd48169e3c316bff5fa02dc1525c94753c98783f91d250ef654391683730cb371f95c489b05e20d5acb38a798e408a0754fee43a148208646fa1b4c87ac80a62c5ea358c23573b52b1679e7a37a265f0", 0x2000, &(0x7f0000001080)={&(0x7f0000000240)={0x50, 0xffffffffffffffda, 0xf992, {0x7, 0x2b, 0x4, 0x28000000, 0x23, 0x1, 0x8000, 0x9, 0x0, 0x0, 0x10, 0x8f}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$trusted_overlay_nlink(r2, &(0x7f0000000200), 0x0, 0x0, 0x2) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x0) 2m9.599280817s ago: executing program 34 (id=553): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000200)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='-2 -3\n', 0x6) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='tcp 20000\n', 0xa) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='1\n', 0x2) close(r2) 1m40.286984467s ago: executing program 35 (id=790): r0 = gettid() capset(&(0x7f0000000080)={0x20080522, r0}, 0x0) 1m10.724375111s ago: executing program 0 (id=1049): r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040960501000001000000010902190001010080320904000001000000000705810340"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x0, &(0x7f0000000100)={0x40, 0xa, 0x10, '\x00'/16}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000400), 0x0, 0x2) syz_open_dev$evdev(&(0x7f0000000400), 0x1, 0x2) syz_open_dev$evdev(&(0x7f0000000400), 0x3, 0x2) syz_open_dev$evdev(0x0, 0x4, 0x2) 1m8.48811217s ago: executing program 0 (id=1061): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\x00', 0x4) close(r0) ftruncate(0xffffffffffffffff, 0x2000000) pwrite64(0xffffffffffffffff, &(0x7f0000000280)="6269746d04000000001000000500000000000000", 0x14, 0x1000) r1 = syz_open_dev$loop(&(0x7f00000002c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000400)="000000000000000000000000000000000100000000040000010000000100000000000000010000000000000000000000010000000100"/72) ioctl(r2, 0x40140921, &(0x7f0000000500)="0000000007000000000000000000000006000000") r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/dev-loop0/offset\x00', 0x2, 0x0) write(r3, &(0x7f0000000700)='16\x00', 0x3) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-loop0/size\x00', 0x2, 0x0) write(r4, &(0x7f0000000840)='65500\x00', 0x6) close(r4) ioctl(r2, 0x400c0930, &(0x7f0000000700)='\x00'/12) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/bitmap/location\x00', 0x2, 0x0) write(r5, &(0x7f0000000940)='8\x00', 0x2) close(r5) 1m8.092034886s ago: executing program 0 (id=1065): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x210a055, 0x0, 0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000001040)='./file2\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000140), &(0x7f00000001c0)='./file0\x00', 0x40000, &(0x7f0000000380)=ANY=[], 0x1, 0x0, 0x0) getpid() sched_getaffinity(r0, 0x8, &(0x7f00000000c0)) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x2090) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x141842, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r4, &(0x7f0000000340)=ANY=[], 0x21) sendfile(r4, r3, 0x0, 0x40001) 1m7.050169456s ago: executing program 0 (id=1071): r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040960501000001000000010902190001010080320904000001000000000705810340"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x0, &(0x7f0000000100)={0x40, 0xa, 0x10, '\x00'/16}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000400), 0x0, 0x2) syz_open_dev$evdev(&(0x7f0000000400), 0x1, 0x2) syz_open_dev$evdev(&(0x7f0000000400), 0x3, 0x2) syz_open_dev$evdev(0x0, 0x4, 0x2) 1m5.081461793s ago: executing program 0 (id=1088): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/16, @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xfff2}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x20000003, 0x6}, @empty, @private=0xa010101, 0xff000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) write$tun(r0, &(0x7f0000000440)=ANY=[], 0x34) 1m4.695606776s ago: executing program 0 (id=1091): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='proc\x00', &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='nfsd\x00', &(0x7f0000000180)='./nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='-2 -3 +4 +4.1 +4.2\n', 0x14) write(0xffffffffffffffff, &(0x7f00000002c0)='tcp 204', 0x7) write(0xffffffffffffffff, &(0x7f0000000340)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000440)='localhost 1 \\x00000000 2147483647 /tmp\n', 0x27) openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) 49.51599557s ago: executing program 36 (id=1091): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='proc\x00', &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='nfsd\x00', &(0x7f0000000180)='./nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='-2 -3 +4 +4.1 +4.2\n', 0x14) write(0xffffffffffffffff, &(0x7f00000002c0)='tcp 204', 0x7) write(0xffffffffffffffff, &(0x7f0000000340)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000440)='localhost 1 \\x00000000 2147483647 /tmp\n', 0x27) openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) 47.777210829s ago: executing program 7 (id=1205): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x210a055, 0x0, 0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000001040)='./file2\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000140), &(0x7f00000001c0)='./file0\x00', 0x40000, &(0x7f0000000380)=ANY=[], 0x1, 0x0, 0x0) getpid() sched_getaffinity(r0, 0x8, &(0x7f00000000c0)) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x2090) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x141842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000340)=ANY=[], 0x21) sendfile(r2, r1, 0x0, 0x40001) 46.876634159s ago: executing program 7 (id=1210): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x35, 0x5, 0x57e, 0x330, 0x0, 0x0, "0600ff0901a101150026ff007508951f852009018102852109018102852209018102851609019102851709019102851509019102c0"}}, 0x14d) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, ' \x00'/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x16, "2100005000fa00000000000500"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) syz_open_dev$evdev(&(0x7f0000000500), 0x0, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x1, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x2, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x3, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x4, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x5, 0x2) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x16, "2100005000fa00000000000500"/22}}, 0x1c) 42.64921395s ago: executing program 9 (id=1190): mkdir(&(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) mkdir(&(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='nfsd 127.0.0.1 2147483647 localhost\n\x00', 0x24) close(r0) write(0xffffffffffffffff, &(0x7f0000000300)='localhost /\n\x00', 0xc) 42.525282725s ago: executing program 9 (id=1239): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) r2 = getpgid(0x0) kcmp(r2, r2, 0x266b12d42586f26e, 0xffffffffffffffff, 0xffffffffffffffff) r3 = mq_open(&(0x7f0000000000)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x40, 0x2c, 0x0) mq_timedsend(r3, 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) syz_emit_ethernet(0xac, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2, 0x0, @empty}, 0x1c) fsmount(0xffffffffffffffff, 0x1, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x48, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) 42.245902425s ago: executing program 5 (id=1241): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4$inet6(r0, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_buf(r1, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_buf(r2, 0x6, 0x1f, &(0x7f00000000c0)='espintcp\x00', 0x9) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newsa={0x16c, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x4e20, 0x0, 0x4e21, 0x0, 0xa, 0x80, 0x80}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x5f, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x98, 0x80, '\x00'/19}}, @encap={0x1c, 0x4, {0x7, 0x4e21, 0x4e20, @in6=@loopback}}]}, 0x16c}}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=@newpolicy={0xfc, 0x13, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x4e20, 0x0, 0x4e21, 0x0, 0xa, 0x80, 0x80}, {}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x32}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000740)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000000700)='testpacket', 0xa, 0x0, &(0x7f0000000800)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 41.834546161s ago: executing program 8 (id=1245): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xfff2}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x20000003, 0x6}, @empty, @private=0xa010101, 0xff000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) write$tun(r0, &(0x7f0000000440)=ANY=[], 0x34) 41.715248626s ago: executing program 8 (id=1246): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000002ac0)={0x2020}, 0x2020) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./trace/trace_marker\x00', 0x1, 0x102) write(r1, 0x0, 0x0) 41.602384139s ago: executing program 8 (id=1247): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="560000002a00000000000000000101000100"/49, 0x30) write(r0, &(0x7f0000000200), 0x0) write(r0, &(0x7f0000000400)="560002002a00000000000000000101000100"/49, 0x30) write(r0, &(0x7f0000000600)="560003002a00000000000000000101000100"/49, 0x30) 41.531014709s ago: executing program 8 (id=1248): r0 = syz_ublk_setup_io_uring(0x7c0, &(0x7f0000000040)={0x0, 0x455c, 0x100, 0x0, 0xffffffff}, &(0x7f0000000100)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x24, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000280)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f031c00", 0x4, 0x800, 0x0, 0x0) syz_ublk_setup_queues(r0, r5, &(0x7f0000000a40)={0x0, 0x1464, 0x100, 0x3, 0xb2}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf0b2, 0x40000, 0x2, 0x3ab, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8, 0x0, 0x3ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe900, 0x800, 0x0, 0x902c0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x1, 0x0, 0x821a, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x4e, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x6}, 0x0, r4, '\x00', {0x3, 0x48e, 0x0, 0x0}}, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2020) 41.470609075s ago: executing program 8 (id=1249): mkdir(&(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) mkdir(&(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='nfsd 127.0.0.1 2147483647 localhost\n\x00', 0x24) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000300)='localhost /\n\x00', 0xc) 41.409934436s ago: executing program 8 (id=1250): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) ftruncate(r0, 0x100000) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) dup2(r1, 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/cluster/c0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/c0/node/n0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/c0/node/n0/ipv4_address\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/c0/node/n0/ipv4_port\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='7777\n', 0x5) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, &(0x7f0000000440)='0\n', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/cluster/c0/node/n0/local\x00', 0x1, 0x0) write(r4, &(0x7f0000000540)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/cluster/c0/heartbeat/r0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/cluster/c0/heartbeat/r0/block_bytes\x00', 0x1, 0x0) write(r5, &(0x7f0000000740)='512\n', 0x4) r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/cluster/c0/heartbeat/r0/start_block\x00', 0x1, 0x0) write(r6, &(0x7f0000000840)='1\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/cluster/c0/heartbeat/r0/blocks\x00', 0x1, 0x0) write(r7, &(0x7f0000000940)='1\n', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/cluster/c0/heartbeat/r0/dev\x00', 0x1, 0x0) write(r8, &(0x7f0000000a40)='7\n', 0x2) 41.273278225s ago: executing program 5 (id=1251): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x35, 0x5, 0x57e, 0x330, 0x0, 0x0, "0600ff0901a101150026ff007508951f852009018102852109018102852209018102851609019102851709019102851509019102c0"}}, 0x14d) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, ' \x00'/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x16, "2100005000fa00000000000500"/22}}, 0x1c) syz_open_dev$evdev(&(0x7f0000000500), 0x0, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x1, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x2, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x3, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x4, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x5, 0x2) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) 40.105549301s ago: executing program 7 (id=1258): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="560000002a00000000000000000101000100"/49, 0x30) write(r0, &(0x7f0000000200)="560001002a0000000000000000010100010000000000000000", 0x19) write(r0, &(0x7f0000000400)="560002002a00000000000000000101000100"/49, 0x30) write(r0, &(0x7f0000000600)="560003002a00000000000000000101000100"/49, 0x30) 40.044876902s ago: executing program 7 (id=1259): r0 = syz_ublk_setup_io_uring(0x7c0, &(0x7f0000000040)={0x0, 0x455c, 0x100, 0x0, 0xffffffff}, &(0x7f0000000100)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x24, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000280)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f031c00", 0x4, 0x800, 0x0, 0x0) syz_ublk_setup_queues(r0, r5, &(0x7f0000000a40)={0x0, 0x1464, 0x100, 0x3, 0xb2}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf0b2, 0x40000, 0x2, 0x3ab, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8, 0x0, 0x3ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe900, 0x800, 0x0, 0x902c0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x1, 0x0, 0x821a, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x4e, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x6}, 0x0, r4, '\x00', {0x3, 0x48e, 0x0, 0x0}}, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2020) 39.991052812s ago: executing program 7 (id=1260): mkdir(&(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) mkdir(&(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='localhost /\n\x00', 0xc) 39.93323681s ago: executing program 7 (id=1261): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = syz_kvm_add_vcpu$x86(r0, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x78, {"c704250021200000002000c704250421200000000000c704250821200000102000c704250c21200000000000c704251021200000202000c704251421200000000000c704251821200000002000c704251c2120000000000031c0bb00212000b9000020000f01cf"}}], 0x78}) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000400)={0x4, 0x0, [{0x0, 0x0, 0x0, 0x12}, {0x1}, {0x7, 0x0, 0x1, 0x0, 0x4}, {0x12, 0x0, 0x1, 0x1, 0xffffffff, 0x0, 0xffffffff}]}) 37.648782826s ago: executing program 5 (id=1269): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="560000002a00000000000000000101000100"/49, 0x30) write(r0, &(0x7f0000000200)="560001002a0000000000000000010100010000000000000000", 0x19) write(r0, &(0x7f0000000400)="560002002a00000000000000000101000100"/49, 0x30) write(r0, &(0x7f0000000600)="560003002a00000000000000000101000100"/49, 0x30) 37.595403309s ago: executing program 5 (id=1270): r0 = syz_ublk_setup_io_uring(0x7c0, &(0x7f0000000040)={0x0, 0x455c, 0x100, 0x0, 0xffffffff}, &(0x7f0000000100)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x24, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000280)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f031c00", 0x4, 0x800, 0x0, 0x0) syz_ublk_setup_queues(r0, r5, &(0x7f0000000a40)={0x0, 0x1464, 0x100, 0x3, 0xb2}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf0b2, 0x40000, 0x2, 0x3ab, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8, 0x0, 0x3ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe900, 0x800, 0x0, 0x902c0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x1, 0x0, 0x821a, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x4e, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x6}, 0x0, r4, '\x00', {0x3, 0x48e, 0x0, 0x0}}, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2020) 37.537560322s ago: executing program 5 (id=1271): mkdir(&(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) mkdir(&(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='localhost /\n\x00', 0xc) 37.485614315s ago: executing program 5 (id=1272): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000100)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000002140)={0x50, 0x0, r2, {0x7, 0x27, 0x0, 0x14a4014, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, 0x50) read$FUSE(r0, &(0x7f000000b040)={0x2020}, 0x2020) open_by_handle_at(r1, &(0x7f00000021c0)=ANY=[@ANYBLOB="1c000000810000000000000001"], 0xfeffffff) 26.932103622s ago: executing program 37 (id=1239): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) r2 = getpgid(0x0) kcmp(r2, r2, 0x266b12d42586f26e, 0xffffffffffffffff, 0xffffffffffffffff) r3 = mq_open(&(0x7f0000000000)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x40, 0x2c, 0x0) mq_timedsend(r3, 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) syz_emit_ethernet(0xac, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2, 0x0, @empty}, 0x1c) fsmount(0xffffffffffffffff, 0x1, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x48, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) 25.541124063s ago: executing program 38 (id=1250): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) ftruncate(r0, 0x100000) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) dup2(r1, 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/cluster/c0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/c0/node/n0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/c0/node/n0/ipv4_address\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/c0/node/n0/ipv4_port\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='7777\n', 0x5) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, &(0x7f0000000440)='0\n', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/cluster/c0/node/n0/local\x00', 0x1, 0x0) write(r4, &(0x7f0000000540)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/cluster/c0/heartbeat/r0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/cluster/c0/heartbeat/r0/block_bytes\x00', 0x1, 0x0) write(r5, &(0x7f0000000740)='512\n', 0x4) r6 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/cluster/c0/heartbeat/r0/start_block\x00', 0x1, 0x0) write(r6, &(0x7f0000000840)='1\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/cluster/c0/heartbeat/r0/blocks\x00', 0x1, 0x0) write(r7, &(0x7f0000000940)='1\n', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/cluster/c0/heartbeat/r0/dev\x00', 0x1, 0x0) write(r8, &(0x7f0000000a40)='7\n', 0x2) 24.446194915s ago: executing program 39 (id=1261): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = syz_kvm_add_vcpu$x86(r0, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x78, {"c704250021200000002000c704250421200000000000c704250821200000102000c704250c21200000000000c704251021200000202000c704251421200000000000c704251821200000002000c704251c2120000000000031c0bb00212000b9000020000f01cf"}}], 0x78}) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000400)={0x4, 0x0, [{0x0, 0x0, 0x0, 0x12}, {0x1}, {0x7, 0x0, 0x1, 0x0, 0x4}, {0x12, 0x0, 0x1, 0x1, 0xffffffff, 0x0, 0xffffffff}]}) 21.489458581s ago: executing program 40 (id=1272): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000100)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000002140)={0x50, 0x0, r2, {0x7, 0x27, 0x0, 0x14a4014, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, 0x50) read$FUSE(r0, &(0x7f000000b040)={0x2020}, 0x2020) open_by_handle_at(r1, &(0x7f00000021c0)=ANY=[@ANYBLOB="1c000000810000000000000001"], 0xfeffffff) 9.309635139s ago: executing program 3 (id=1326): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xb, 0x0, 0x2}, 0x1c) close(0x3) 9.169472459s ago: executing program 3 (id=1328): rmdir(0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000440)=[{0x20, 0x0, 0x9, 0xfffff010}, {0x6, 0x0, 0x3, 0xfffffffd}]}, 0x10) syz_emit_ethernet(0xfc0, &(0x7f0000000480)={@broadcast, @local, @void, {@ipv6={0x86dd, @tcp={0x2, 0x6, "4f148a", 0xf8a, 0x6, 0xff, @loopback, @remote, {[], {{0x4e22, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x40, 0x3, 0x0, 0x7fff}, {"a96b46785d1a313f80c6a0f2e5bc8593126e2c5b09dd4b9e82715d8ee1af82bc88bd37dcfe536de21f02bae9ece576ee98a25de65b506b8bcf8e3d387406e93ab4fcd19a8dd05c2fd93481a889b40402fcc5f1221924ec5023d75532bac4ce1ceb0244fc858b3eca9ff62b9b472ce469ee9d1105cb39507c15d126a4067979ece1fb05f398b366d6c2c96a30fa7e55094f2c6e9ba7de3fc8dcd3c06005edcfad14b7b63e4388e52f0bcf915b2d733effa2fbab00d6f3c4b76fa4c7266802536904ebcf2e3da4c1f3e5297931b3ee06094797170a0a766b5b7414c5b3b14a6cbb8d9fbda455d1395063a2fe5718e0b33109566dc72f808ccded04c02b76b201eaca39e6d88c8b6b952cb32fc5705e10b3b6f242b3bb9b7dad144a0003dcd10ed69b558c605cc143bc7e8af3c6ec32cf6a0ab51c79388f39c60fb7f11539535399d8df061d694c6b978db045b34a9e416c521936de899230fb4f7fab61c4538d292e1dbe260800f2636faa8e8e3ce78a0e56afbef095b809108001b6a9fa4bf5420bc669ca197ee6357923acc8c2d02200d91eecbd826f8a06b2a12d7ac72eb4e3056a31b86173b3429a0c52254b7430449576c4f72b8307ee3e2f16b03fc7f4f380827813e997a4f35a8ed517e15144f8a8116706e128d2d7b8d8bc29de08de620a722bdf34a3a8212f6a2814c47c90dc7e54cc7ad0bace83a685cc174603f82b43b8d81818880d6843b139df636d2996b7b5af05720014622564226c0e27acc91dc34ed1f9d8322835d0daf9f11e9f69eedfba13e9112de11e5bd8419cb61774eb6d7780b6df5a398f87cb43a7e2b4ee85b7479571f4280aa4ac6744846d59ebd7999293f8bad2b1c1f071911e49e7a0975a79c704539f75d4cd386f3ebfa313cc8e8cbc43039b28133beaa28e71398de569adc41b8509b5c3b75b20cfac0bd7fcabb8798dde9f643b344ab62fcc30b0a8f78c4bdd4dc4d719f03e0dea1a901b46d9724a836a4da7e56acb5ddd2331e3919187434d3a13b9c48133db905b3e25f4ad0500ba47fe95a02209b6a734112d8f790ed2be746c84f4f0cb2d02942aa49435930f03b6ead95237e0f98b84039a27efb9af0bdd407c0c0ad8a2e1b6d62e8186e3ecaa34f3f98c9f96d55a1431f36034cd58476533a63cfb838b445dd92c09ab840fe4226291831cb3f02150e720cb5835a70143ac483e50b342f6a8cc7f286b8fd420dc8a54bed372d7a3952110de1a4c4e2f7668e6fcc2f34e632c1f82f524bbd689470f1effc89425a20e29adc8e908c44c7dcaaae0045024f5e20b116deb861710871c9766096aa6bf11195ef13389410cbedaeee3e7960f0abcf65fce661d954bcfb03481a87f7bf47428e7cb04ca08028c7acea99b13c6a9d2663ca9fa5ca0c1346f8cdd7149f5acb35b1843e16a8770454eb137ce9dd0e55b181698c1326f4671b60691471516a133d8bf1a592cbe930ba5290968e720c18077831c9f03a346afd09a0be222b9f325af7e40e88dc5157d0babd248c874de39773c658c1302fcef866311640f4807d4395781d52655cab2a508165034f9f4197b2bd9a3714e2f0eabeff9772f16af203e8434d77102d4343fb0b8e04080ff4f5e3ed32cec4626619e9eb7d6bbe46c03960e62af37a4e7b7282d7ad70931dbba82151b4069bfa4a7b65932ac48f806aad190c9b481f70b3891c143cd4def1418fcf1f784c681fcde6f9cde5479b459f15c8eba472e21e8eb448501ba17bd3a9788f57557c10e0c9db58d09933ea237e35f4ca657be7826cbea3344399219a2b88a58c3fb5af8660fa989e68285cc9c150cc00d240c0fbc0a49d0f6d055ff31324e1f998da3af28e0b28b93d5c6c543f2630815a3e250dd5a69951b3ebeb215314ba42b45e9480c1312abcedbff6fa9ef6706b5735fd17668747b53dc9212dc3179cd8d14e5290cb48bf840f74abf7ef7b4a31b92537c2b6f8bb7fad21911cd864ec00a18c31c36c82ecb4f4eb69b953042bf73a18534ab5a08da993b61ff41462f9fbae7bf1cc64a48ac4a2dc82b81c3db4d6e51e76b0250eff5a9e5ef3fa0d329f9fc5989a1d4968c5095b5a5f1843529da0c44d2f6f764c56b5ed2a2dce1797451b2751db769f70a444e95dfbacb644550de7e1b0d8bd64895925ab8348442f4cd382c6ecfff4262503caedf512abb177b8b4c3d67b640fe8c717d918f889274da272bb958df6d3ecb78754b497459191a246396a63ba2af5b27a79b6f97aa2f0d037144a4854ce7470665346a6570498e8596cc598d5bc549796bace4cbc106ffc8e7e2a5432c6e06c269f33445b5f19426b9d27835b1de956128180c3ff67ad0421e359a2cfb0a97991c8c0d367d058ea998ddd8994174011317c394d40c6ca74b86a3812431bd1a3fa98469d47b9eb174e13c8ace6c535ffd7e27bc45fdeeb4f1df9f1779ae40e96cd9fc9e5fdf575ed06d5b5dd613464530d536a440e374fc07f88af85895037d421ab60edf7788d601ea19056f9125841b57c7bb744e796190473ec0b4422f7a42db53bede56d3be81b9247a089104a61e8a9df36927ad0fff52ce3a4626dcdde1ea31ea81e5202e22554da24324f24086903386e1fc4f8f71e671a243f030b9ef6549d352f7f6d564c2e96b706f802b80987ed723f0c80c8ae08f326837e5abccff3849f9d7821424d4f79fb08cfc65d71868246694d48a21ca69fb59e83c716a28ed5cfea2ff8f74256f12f4969126d558cfa13e812130d392e1eaecabed42dd13876c843c13221baa581aea99ac11f7d2bb609b4d492bc5590b483f5a659357473da6b3f9a00946445bcb8605653bbb86eac925ada06176948a912605df9693e770cbd583a2e79e8c2c365260709cb9a31af8550f1642bdc106e050b83e6fb2e483487e4f9be7b278b24110a337d960311af391084fcf170b5bf81095e1995cc47b22299302b953d248c69f0b923baf84c71364f536d3a4400db69a4e6841d6654affea274d2d0e8df3fc788c86c213a89ace1647c42f02d391e9aed3c0bcda5feaa9933a6c5359c847467366c456295d8ec0db6eb2a93fde2cd60cee5874da2361dd7e80aef9edb870a49e08446319059785062eaf0201b9c9f45fdbdd978b0ac234118710a6c79feb6e45b2f567ae89f7522e8a3cdb09fd509b46589f6f7aeb0700158ce170e498d240fa1defc7bc6f537c9c2ecae3277bdf88c7919cff58479421462a3c49fa546d23d39a06f2ad577b45d7412aee6e420e5067107bb0453d0dee73f3c08b24fa4bd54da3183beddaa0c8466c038dc7528f2cef518da4b25dd07ad3e966203d7269310c57db126f9268bb069d9009b1decaa05ca289d4566593a68beccc38bebd457c48bfd384989d21bf4d6488de744c4da83fa807c99e66677924e90646e8264d9a7ab279df46785353d040496ca628028e6d5043a5405b4810a5fc9dd5ff8d8070faff2fde040da943d9cd0f1fdf5f5ab495cec133c962d8ea7cfd0314c4eb243963df075d300ae1e625d9949b8757d253a62a5dc166e6d2f12ab09e60b0009d002842be7687e30f6e95ea17033a4d932b28378e59efa9cb521f9bbe3f08978ed31e58b7715727e8d2a3685b0fdbdb3e59cfc0dde30635c4ff82eb634699c65cf8e914217283019da83cbc1e86e52f438a2fb2376f822a8054c1e7764ad2231d1631558d482b9c26f628734bddb4c7048f36ebed6ef9df5e3d3fa9852e96de151d01cc3e4278715de8b6a22e8afac49e9534862e85681be69f0fe94c3b56278d5e4c768267fbb95af98174b91d51431e5e2f5b4bd6a3c29a7ce7d2f99d3eeeeea29aff8bf329076eac06dcd041150d441abf624005434f0d946a27fa1dacd35cd3401c91d5dc6431ef32412c05e856d4d20c249be1bd1ab37421912dee63ce9d45ba6a81871ff5a7ae60dd5ade3fddd7a9ef80b79899e9c08eee43e305bbabf231346c9ba85f862ed280cf9ebff8d18bedaffcef437c1a5bfa5ab30e23afc74a840bc5288b6dfd88f28abec76d43e962a35189849c5d8a02b3351d2c021eb86f3da71e79f3dfd6a71d828bcb9ec6b1abe4a7cd54e590bfbe6d2064bc453122ead8293dde9bc67525367f6997f371a52f7c2d7c7d8480865fd0db762d5284459aeb394cc11b6008e32d0c1376138de5547cb0d91b35c4cb332ee2e894f690bb752ab60a6eba690c7ea11977dcab7c088f4a4523d4e258bcaefa98d2158eff5a8a8cda92e6d9a3650e5af8f3056f69fa7b9b7c47e52f3c43dd56d83888152c35f04e858603e259106e84b56bfdd316665c0a95fe10c2e267054daafdb2596bbf4dd1a91e5ebca6432d9a5cfd62c36416608800f5a0650a3871abd084e462ab1d0befccb659204d5d0181d4ef4e957a811bf0af69868e723fefb3a3281e776ee1ea8ae60f000b806df8979d4d216750b2e498753678689cab29c7b941cad3355484ca3d5f3fac0c799161d57b739821707bba990721e4d08a75a821e3b031bacd9e18914fee00861d2f9c8df9fd1382c8d0c99d70bc4446e15da515825d4836aafc86d13d2146d2ebc15ca12dc549bd954aac16a379679ac74abd4a9fa573899125901783664d53b6a5649cc75d0f539df0bf1308174ff589041e43442e5b97f658c712feafe1e9973c5eca9155da594b9420aad05ca6a4f48c5556ae083cc20408f70a21f13aca51140b2a7b3fc767afda0c33ea24a20cb3d798c2571a0f96c0e9a1a491cb7cc93c27a3ecfd8accb97ff017136897163a00d2221201ddb16417c7d55b30f1a68319ed4f90fd065d54458ad90b9da89af541fbe6da8152dc1343e3180510ded7efcb7ea9965700c3a5c14233c62ca2bcc76873ec14e49f235f6bf5877fc1928ee1587dff66e850f41b1c71f0a215ec4b8b88d164b9bafc1bcbf20678e817639c1beefee030e02123f9e18fa4532622b2069059e2c05e72f76ba86d74e9f43e40dcc0fdc927e2921618b80e530d9508e6d3b38780dbca1ae155ed882a0cd5247758d9b61031ba58bb41ec7308a02e3374ac1cc51e475f88e695ce764a2b198ac6b22395a6cc33598544524f4d1adf044af7784bacde3f093e22f13cb59e1ac3c7071b0ed08bc7c7840a115c66e98ac107bfa69200dc7412b602a9ce759e164af127a884878d10d5f418c1225cd46bf3d30e8966984d4356721da21634f8695a4fdd22dc58e43d45b6f373cbe30ea575e91061764e2d7bbaace1b0b00eea1f4def1ac8e948db637a19a47a5ca4f1064f05cdd10b20278560bfd505a75700a2216cb9841f6fb2da224ccdaf8a7baf6180004744b6b721fbb356787eabcc0393d32f2b98f12f5e33f79368e762067b0ad80fca51681facd7134de4b6d19fa2fb958e04034f1579d8de9caa26b6269ac8196b58b57ecc938e038e663e724546c27405606e78674b0da9467bdf7b8ceda580258dfce0df4672a6e2166ae267d1802c57019cdde7743b4f5cdb13b04fbdb669b9510b395214ba235f7b62d96e64986baa9ffb055d92324e6c0196ca7946fabdefe5b4fedb36964c98f921b82c7ec6a6bd24229590138c0bbd22f8af4a1e1c0c6603b5ba9eb0ff4ddc77dc147075da"}}}}}}}, 0x0) 8.993894379s ago: executing program 3 (id=1329): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='rd_pages=1024\n', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ed) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='0x0525\n', 0x7) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r3, &(0x7f0000000280)='0xa4a5\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ed) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r4, &(0x7f0000000280)='0000001\n', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/lun/lun_0\x00', 0x1ed) symlinkat(&(0x7f00000003c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/lun/lun_0/rd_mcp_0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x1, 0x0) write(r5, &(0x7f0000000480)='naa.5001405000000001\n', 0x15) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/acls/naa.5001405000000002/lun_0\x00', 0x1ed) symlinkat(&(0x7f0000000580)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/lun/lun_0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/acls/naa.5001405000000002/lun_0/lun_0\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r6, &(0x7f0000000740)='dummy_udc.0\n', 0xc) r7 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2) syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x2) syz_open_dev$sg(&(0x7f0000000000), 0x2, 0x2) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000500)={0x53, 0xfffffffffffffffe, 0xa, 0x20, @buffer={0x0, 0x34, &(0x7f0000000200)=""/52}, &(0x7f0000000100)='_\x00\x00\x00\x00\x00\x00\x004\x00', &(0x7f0000000300)=""/32, 0x3e8, 0x0, 0x0, 0x0}) 8.787416638s ago: executing program 3 (id=1332): r0 = syz_ublk_setup_io_uring(0x7c0, &(0x7f0000000040)={0x0, 0x455c, 0x100, 0x0, 0xffffffff}, &(0x7f0000000100)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x24, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x2, 0xd75, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x2a}}}, &(0x7f0000000280)=0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, 0x0) syz_ublk_setup_queues(r0, r5, &(0x7f0000000a40)={0x0, 0x1464, 0x100, 0x3, 0xb2}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf0b2, 0x40000, 0x2, 0x3ab, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8, 0x0, 0x3ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe900, 0x800, 0x0, 0x902c0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x1, 0x0, 0x821a, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x4e, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x6}, 0x0, r4, '\x00', {0x3, 0x48e, 0x0, 0x0}}, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2020) 8.678378993s ago: executing program 2 (id=1334): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000002ac0)={0x2020}, 0x2020) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) 8.444701022s ago: executing program 3 (id=1337): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, 0x0, 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000300)) ioctl(r1, 0x40140921, &(0x7f0000000400)="00000000010000000000000000000000060000") ioctl(r1, 0x40140921, &(0x7f0000000440)="0100000001000000010000000100000006000000") ioctl(r1, 0x400c0930, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='check\n\x00', 0x6) close(r2) nanosleep(&(0x7f0000000600)={0x1}, 0x0) 7.713443327s ago: executing program 2 (id=1345): ioctl$KVM_CAP_HYPERV_SYNIC2(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000140)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000008c0)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r1, &(0x7f0000004cc0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000048c0)="04", 0x1}], 0x1}}], 0x1, 0x4000001) r2 = dup(r1) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r2) close_range(r0, 0xffffffffffffffff, 0x0) 7.449390185s ago: executing program 2 (id=1348): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x20) write(r1, &(0x7f0000000000)='3', 0x4e) fsmount(r0, 0x1, 0x6) 7.407784809s ago: executing program 3 (id=1350): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x35, 0x5, 0x57e, 0x330, 0x0, 0x0, "0600ff0901a101150026ff007508951f852009018102852109018102852209018102851609019102851709019102851509019102c0"}}, 0x14d) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, ' \x00'/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) syz_open_dev$evdev(&(0x7f0000000500), 0x0, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x1, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x2, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x3, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x4, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x5, 0x2) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) 7.0408126s ago: executing program 2 (id=1351): r0 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000d40)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000000700)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) 6.633455889s ago: executing program 2 (id=1356): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x35, 0x5, 0x57e, 0x330, 0x0, 0x0, "0600ff0901a101150026ff007508951f852009018102852109018102852209018102851609019102851709019102851509019102c0"}}, 0x14d) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, ' \x00'/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x16, "2100005000fa00000000000500"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) syz_open_dev$evdev(&(0x7f0000000500), 0x0, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x1, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x2, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x3, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x4, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x5, 0x2) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x16, "2200001600"/22}}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x16, "2100005000fa00000000000500"/22}}, 0x1c) 2.100675663s ago: executing program 6 (id=1388): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, 0x0, 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000300)) ioctl(r1, 0x40140921, &(0x7f0000000400)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, 0x0) ioctl(r1, 0x400c0930, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='check\n\x00', 0x6) close(r2) nanosleep(&(0x7f0000000600)={0x1}, 0x0) 1.529117276s ago: executing program 4 (id=1392): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) ioctl$TIOCSBRK(r0, 0x5427) 1.369817885s ago: executing program 4 (id=1394): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffd}, 0x39) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000003, 0x20031, 0xffffffffffffffff, 0xffffe000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb010018000000000000006c0000006c00000008000000060000000800008d"], &(0x7f0000000d40)=""/35, 0x8c, 0x23, 0x1, 0x7}, 0x28) 1.255209456s ago: executing program 1 (id=1395): mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) 1.252356127s ago: executing program 4 (id=1396): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000780)={'veth1_to_hsr\x00', 0x400}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r2, {0x4}, {}, {0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x4044084}, 0xc000) 1.147703622s ago: executing program 6 (id=1397): rseq(&(0x7f0000000240)={0x0, 0x0, 0x0, 0x4}, 0x20, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) pwritev2(r0, &(0x7f0000000080)=[{&(0x7f00000004c0)='\"', 0x1}], 0x1, 0x5, 0x7ffffc, 0x1) 1.005721267s ago: executing program 1 (id=1398): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="560000002a00000000000000000101000100"/49, 0x30) write(r0, &(0x7f0000000200)="560001002a00000000000000000101000100"/46, 0x2e) write(r0, &(0x7f0000000400)="560002002a00000000000000000101000100"/49, 0x30) write(r0, &(0x7f0000000600)="560003002a00000000000000000101000100"/49, 0x30) 1.005544462s ago: executing program 6 (id=1399): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) 981.905875ms ago: executing program 4 (id=1400): r0 = syz_open_procfs(0x0, &(0x7f0000000440)='coredump_filter\x00') unshare(0x2040400) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x65, 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r2, 0x0, 0x0) write$FUSE_ENTRY(r0, 0x0, 0x0) 881.791814ms ago: executing program 4 (id=1401): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) ftruncate(0xffffffffffffffff, 0x2000000) pwrite64(0xffffffffffffffff, &(0x7f0000000280)="6269746d04000000001000000500000000000000", 0x14, 0x1000) r1 = syz_open_dev$loop(0x0, 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000400)="000000000000000000000000000000000100000000040000010000000100000000000000010000000000000000000000010000000100"/72) ioctl(r2, 0x40140921, &(0x7f0000000500)="0000000007000000000000000000000006000000") r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/dev-loop0/offset\x00', 0x2, 0x0) write(r3, &(0x7f0000000700)='16\x00', 0x3) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-loop0/size\x00', 0x2, 0x0) write(r4, &(0x7f0000000840)='65500\x00', 0x6) close(r4) ioctl(r2, 0x400c0930, &(0x7f0000000700)='\x00'/12) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/bitmap/location\x00', 0x2, 0x0) write(r5, &(0x7f0000000940)='8\x00', 0x2) close(r5) 822.771853ms ago: executing program 1 (id=1402): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1e, 0x0, 0x4, 0x5}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x23, 0x28, 0x66, 0x0, 0x6, 0x6, 0x0, @private=0xa010102, @remote}, {{0x4e21, 0x4e24, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x6, 0x0, 0xe7}}}}}}, 0x0) 816.329769ms ago: executing program 6 (id=1403): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000100)={'\x00', 0x1}) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0x1}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x44, r1, 0x601, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_BYTES={0x14}]}, 0x44}}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x44, r1, 0x601, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}]}, 0x44}}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x34, r1, 0x601, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0xff}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}]}, 0x34}}, 0x0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x20, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0x1}]}, 0x20}}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x4c, r1, 0x601, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_BYTES={0x14}]}, 0x4c}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000600)={'wpan0\x00'}) sendto$packet(r3, &(0x7f0000000700)="410801ffffffffff77665544332211000d01000000010102030400000000", 0x1e, 0x0, 0x0, 0x0) 554.031934ms ago: executing program 1 (id=1404): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 502.938095ms ago: executing program 2 (id=1405): r0 = syz_ublk_setup_io_uring(0x7c0, &(0x7f0000000040)={0x0, 0x455c, 0x100, 0x0, 0xffffffff}, &(0x7f0000000100)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x24, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x2, 0xd75, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x2a}}}, &(0x7f0000000280)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x800, 0x0, 0x0) syz_ublk_setup_queues(r0, r5, &(0x7f0000000a40)={0x0, 0x1464, 0x100, 0x3, 0xb2}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf0b2, 0x40000, 0x2, 0x3ab, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8, 0x0, 0x3ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe900, 0x800, 0x0, 0x902c0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x1, 0x0, 0x821a, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x4e, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x6}, 0x0, r4, '\x00', {0x3, 0x48e, 0x0, 0x0}}, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2020) 395.571165ms ago: executing program 1 (id=1406): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffd}, 0x39) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000003, 0x20031, 0xffffffffffffffff, 0xffffe000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb010018000000000000006c0000006c00000008000000060000000800008d"], &(0x7f0000000d40)=""/35, 0x8c, 0x23, 0x1, 0x7}, 0x28) 364.7404ms ago: executing program 4 (id=1407): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, 0x0, 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000300)) ioctl(r1, 0x40140921, &(0x7f0000000400)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, 0x0) ioctl(r1, 0x400c0930, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/sync_action\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='check\n\x00', 0x6) close(r2) nanosleep(&(0x7f0000000600)={0x1}, 0x0) 300.580166ms ago: executing program 6 (id=1408): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000040)=0x2, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000940)=[@in={0x2, 0x4e23, @remote}, @in6={0xa, 0x4e22, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}], 0x2c) 164.484676ms ago: executing program 1 (id=1409): socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x56ab, &(0x7f0000000040)={0x0, 0x36d, 0xc000, 0xc, 0x177}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x7, 0xfffffffffffffda2, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffff7}, 0x75) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1b) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 0s ago: executing program 6 (id=1410): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xb}}}, 0x24}}, 0x20000000) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0x1c}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x381, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x5032}) io_setup(0xa, &(0x7f00000103c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000340)=[&(0x7f00000000c0)={0x20000000, 0x0, 0x7, 0x8, 0x0, r0, &(0x7f0000000080)='\x00', 0x1}]) kernel console output (not intermixed with test programs): 0001fee RSI: 0000200000001ffb RDI: 0000200000000040 [ 192.351047][ T8173] RBP: 00007fd507e3506b R08: 0000000000000000 R09: 0000000000000000 [ 192.351061][ T8173] R10: fffffffffffffffe R11: 0000000000000246 R12: 0000000000000000 [ 192.351076][ T8173] R13: 00007fd508026038 R14: 00007fd508025fa0 R15: 00007ffe4b8a2738 [ 192.351111][ T8173] [ 192.849486][ T8179] syz.6.825: attempt to access beyond end of device [ 192.849486][ T8179] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 192.849597][ T8179] syz.6.825: attempt to access beyond end of device [ 192.849597][ T8179] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 192.849625][ T8179] md: md0: failed to read bitmap from any device [ 193.271785][ T8193] loop7: detected capacity change from 0 to 764 [ 193.772385][ T8202] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.773048][ T8202] bridge0: port 1(bridge_slave_0) entered disabled state [ 194.044757][ T8202] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 194.061609][ T8202] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 194.337332][ T1160] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.337398][ T1160] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.337427][ T1160] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.337455][ T1160] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.590423][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.590485][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.807962][ T8223] syz.7.842: attempt to access beyond end of device [ 194.807962][ T8223] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 194.808070][ T8223] syz.7.842: attempt to access beyond end of device [ 194.808070][ T8223] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 194.808097][ T8223] md: md0: failed to read bitmap from any device [ 196.506823][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 196.537347][ T8258] syz.5.855: attempt to access beyond end of device [ 196.537347][ T8258] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 196.537444][ T8258] syz.5.855: attempt to access beyond end of device [ 196.537444][ T8258] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 196.537471][ T8258] md: md0: failed to read bitmap from any device [ 198.639009][ T8291] syz.6.868: attempt to access beyond end of device [ 198.639009][ T8291] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 198.639127][ T8291] syz.6.868: attempt to access beyond end of device [ 198.639127][ T8291] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 198.639156][ T8291] md: md0: failed to read bitmap from any device [ 198.955694][ T7332] wiimote 0005:057E:0330.0009: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 198.957150][ T7332] wiimote 0005:057E:0330.0009: New device registered [ 199.059575][ T7332] wiimote 0005:057E:0330.0009: detected device: Nintendo Wii Remote Plus (Gen 2) [ 199.727980][ T7332] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0009/input/input45 [ 199.758410][ T7332] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0009/input/input46 [ 199.779643][ T7332] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0009/input/input44 [ 200.218918][ T8296] wiimote 0005:057E:0330.0009: Device removed [ 201.457955][ T8326] syz.0.882: attempt to access beyond end of device [ 201.457955][ T8326] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 201.458067][ T8326] syz.0.882: attempt to access beyond end of device [ 201.458067][ T8326] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 201.458106][ T8326] md: md0: failed to read bitmap from any device [ 202.379636][ T5755] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 202.530192][ T5755] usb 1-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 202.531309][ T5755] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 202.531359][ T5755] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.202000][ T8346] FAULT_INJECTION: forcing a failure. [ 203.202000][ T8346] name failslab, interval 1, probability 0, space 0, times 0 [ 203.202035][ T8346] CPU: 0 UID: 0 PID: 8346 Comm: syz.7.892 Not tainted syzkaller #0 PREEMPT(full) [ 203.202061][ T8346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 203.202075][ T8346] Call Trace: [ 203.202084][ T8346] [ 203.202094][ T8346] dump_stack_lvl+0xe8/0x150 [ 203.202133][ T8346] should_fail_ex+0x3eb/0x540 [ 203.202167][ T8346] should_failslab+0xa8/0x100 [ 203.202198][ T8346] __kmalloc_cache_noprof+0x9e/0x600 [ 203.202231][ T8346] ? alloc_fs_context+0x66/0xd00 [ 203.202254][ T8346] ? alloc_fs_context+0x66/0xd00 [ 203.202287][ T8346] alloc_fs_context+0x66/0xd00 [ 203.202317][ T8346] ? bpf_lsm_namespace_init+0x9/0x20 [ 203.202353][ T8346] mq_init_ns+0x10d/0x770 [ 203.202381][ T8346] copy_ipcs+0x460/0x6c0 [ 203.202415][ T8346] create_new_namespaces+0x210/0x6b0 [ 203.202452][ T8346] ? security_capable+0x7e/0x2c0 [ 203.202489][ T8346] unshare_nsproxy_namespaces+0x144/0x190 [ 203.202527][ T8346] ksys_unshare+0x53c/0x890 [ 203.202565][ T8346] ? __pfx_ksys_unshare+0x10/0x10 [ 203.202601][ T8346] ? rcu_is_watching+0x16/0xb0 [ 203.202646][ T8346] __x64_sys_unshare+0x38/0x50 [ 203.202667][ T8346] do_syscall_64+0x166/0x520 [ 203.202699][ T8346] ? trace_irq_disable+0x3b/0x140 [ 203.202728][ T8346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 203.202752][ T8346] ? clear_bhb_loop+0x70/0xc0 [ 203.202779][ T8346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 203.202802][ T8346] RIP: 0033:0x7fe51599e159 [ 203.202824][ T8346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 203.202843][ T8346] RSP: 002b:00007fe516946028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 203.202868][ T8346] RAX: ffffffffffffffda RBX: 00007fe515c25fa0 RCX: 00007fe51599e159 [ 203.202885][ T8346] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000 [ 203.202900][ T8346] RBP: 00007fe515a3506b R08: 0000000000000000 R09: 0000000000000000 [ 203.202915][ T8346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 203.202930][ T8346] R13: 00007fe515c26038 R14: 00007fe515c25fa0 R15: 00007ffd0840ed78 [ 203.202970][ T8346] [ 203.230412][ T5755] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input47 [ 203.549731][ T5755] usb 1-1: USB disconnect, device number 5 [ 203.797534][ T8348] syz.7.893: attempt to access beyond end of device [ 203.797534][ T8348] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 203.797648][ T8348] syz.7.893: attempt to access beyond end of device [ 203.797648][ T8348] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 203.797676][ T8348] md: md0: failed to read bitmap from any device [ 203.856165][ T5610] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 203.866844][ T5610] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 203.867988][ T5610] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 203.869378][ T5610] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 203.870018][ T5610] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 204.724002][ T61] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.944601][ T61] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.080141][ T8371] capability: warning: `syz.7.898' uses deprecated v2 capabilities in a way that may be insecure [ 205.238279][ T61] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.504456][ T61] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.717386][ T8383] syz.7.903: attempt to access beyond end of device [ 205.717386][ T8383] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 205.717502][ T8383] syz.7.903: attempt to access beyond end of device [ 205.717502][ T8383] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 205.717529][ T8383] md: md0: failed to read bitmap from any device [ 205.947355][ T5612] Bluetooth: hci3: command tx timeout [ 206.188748][ T5720] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 206.341833][ T61] bridge_slave_1: left allmulticast mode [ 206.341865][ T61] bridge_slave_1: left promiscuous mode [ 206.342090][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.370852][ T5720] usb 6-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 206.374145][ T5720] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 206.374196][ T5720] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.383693][ T61] bridge_slave_0: left allmulticast mode [ 206.383770][ T61] bridge_slave_0: left promiscuous mode [ 206.384577][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.881175][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 206.895020][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 206.913259][ T5612] Bluetooth: hci0: command 0x0406 tx timeout [ 206.913369][ T5612] Bluetooth: hci1: command 0x0406 tx timeout [ 206.940812][ T61] bond0 (unregistering): Released all slaves [ 207.085918][ T5720] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input48 [ 207.115140][ T61] ovs-dp0: left promiscuous mode [ 207.313115][ T5735] usb 6-1: USB disconnect, device number 3 [ 207.313240][ C0] usbtouchscreen 6-1:1.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 207.658298][ T61] tipc: Disabling bearer [ 207.658429][ T61] tipc: Left network mode [ 208.028286][ T4925] Bluetooth: hci3: command tx timeout [ 208.232799][ T8434] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 208.397386][ T8434] syz.7.915: attempt to access beyond end of device [ 208.397386][ T8434] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 208.397495][ T8434] syz.7.915: attempt to access beyond end of device [ 208.397495][ T8434] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 208.397527][ T8434] md: md0: failed to read bitmap from any device [ 208.405965][ T8349] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.406142][ T8349] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.406309][ T8349] bridge_slave_0: entered allmulticast mode [ 208.430078][ T8349] bridge_slave_0: entered promiscuous mode [ 208.537094][ T61] hsr_slave_0: left promiscuous mode [ 208.631148][ T61] hsr_slave_1: left promiscuous mode [ 208.634995][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 208.635024][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 208.662888][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 208.662913][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 208.695081][ T61] veth1_macvtap: left promiscuous mode [ 208.695125][ T61] veth0_macvtap: left promiscuous mode [ 208.695264][ T61] veth1_vlan: left promiscuous mode [ 208.695338][ T61] veth0_vlan: left promiscuous mode [ 208.749859][ T1224] wiimote 0005:057E:0330.000A: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 208.750286][ T1224] wiimote 0005:057E:0330.000A: New device registered [ 209.034428][ T8442] wiimote 0005:057E:0330.000A: Device removed [ 209.476411][ T61] team0 (unregistering): Port device team_slave_1 removed [ 209.522837][ T61] team0 (unregistering): Port device team_slave_0 removed [ 209.791003][ T1224] wiimote 0005:057E:0330.000A: detected device: Nintendo Wii Remote Plus (Gen 2) [ 209.867209][ T1224] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.000A/input/input50 [ 209.905859][ T1224] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.000A/input/input51 [ 209.942782][ T1224] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.000A/input/input49 [ 210.056889][ T7332] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 210.106841][ T4925] Bluetooth: hci3: command tx timeout [ 210.148105][ T8349] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.148278][ T8349] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.148515][ T8349] bridge_slave_1: entered allmulticast mode [ 210.166219][ T8349] bridge_slave_1: entered promiscuous mode [ 210.210076][ T7332] usb 8-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 210.212005][ T7332] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 210.212055][ T7332] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.369320][ T5271] 8021q: adding VLAN 0 to HW filter on device eth5 [ 210.386578][ T8349] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 210.417506][ T8349] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 210.524105][ T8349] team0: Port device team_slave_0 added [ 210.564438][ T8349] team0: Port device team_slave_1 added [ 210.703274][ T8349] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 210.703293][ T8349] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 210.703316][ T8349] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 210.706291][ T8349] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 210.706307][ T8349] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 210.706332][ T8349] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 210.846064][ T8349] hsr_slave_0: entered promiscuous mode [ 210.853451][ T8349] hsr_slave_1: entered promiscuous mode [ 210.854369][ T8349] debugfs: 'hsr0' already exists in 'hsr' [ 210.854391][ T8349] Cannot create hsr debugfs directory [ 210.988093][ T7332] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/input/input52 [ 211.137555][ T61] IPVS: stop unused estimator thread 0... [ 211.190582][ T7332] usb 8-1: USB disconnect, device number 2 [ 211.716066][ T5271] 8021q: adding VLAN 0 to HW filter on device eth6 [ 211.837349][ T8493] md: couldn't update array info. -22 [ 211.879509][ T8493] md: could not open device unknown-block(7,0). [ 211.879591][ T8493] md: md_import_device returned -16 [ 212.039987][ T8491] syzkaller0: entered promiscuous mode [ 212.040014][ T8491] syzkaller0: entered allmulticast mode [ 212.189050][ T4925] Bluetooth: hci3: command tx timeout [ 212.351152][ T8349] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 212.378534][ T8349] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 212.380048][ T8349] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 212.394059][ T8349] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 214.670199][ T8349] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 214.673236][ T8349] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 214.674561][ T8349] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 214.704347][ T8349] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 214.712390][ T5271] 8021q: adding VLAN 0 to HW filter on device eth7 [ 215.117838][ T8541] syzkaller0: entered promiscuous mode [ 215.117868][ T8541] syzkaller0: entered allmulticast mode [ 215.277063][ T991] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 215.459981][ T991] usb 8-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 215.478737][ T991] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 215.478790][ T991] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.878570][ T8560] md: couldn't update array info. -22 [ 215.896912][ T8560] md: could not open device unknown-block(7,0). [ 215.896997][ T8560] md: md_import_device returned -16 [ 216.105488][ T991] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/input/input53 [ 216.352808][ T5742] usb 8-1: USB disconnect, device number 3 [ 217.712075][ T5271] 8021q: adding VLAN 0 to HW filter on device eth8 [ 217.723680][ T8566] tap0: tun_chr_ioctl cmd 1074025692 [ 217.723737][ T8567] tap0: tun_chr_ioctl cmd 21731 [ 217.756184][ T8578] tap0: tun_chr_ioctl cmd 2147767511 [ 217.762205][ T8579] tap0: tun_chr_ioctl cmd 21731 [ 217.833452][ T8349] 8021q: adding VLAN 0 to HW filter on device bond0 [ 217.937956][ T8349] 8021q: adding VLAN 0 to HW filter on device team0 [ 217.984354][ T116] bridge0: port 1(bridge_slave_0) entered blocking state [ 217.984474][ T116] bridge0: port 1(bridge_slave_0) entered forwarding state [ 218.057835][ T1147] bridge0: port 2(bridge_slave_1) entered blocking state [ 218.057945][ T1147] bridge0: port 2(bridge_slave_1) entered forwarding state [ 218.229199][ T991] wiimote 0005:057E:0330.000B: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 218.229514][ T991] wiimote 0005:057E:0330.000B: New device registered [ 218.253452][ T8591] md: couldn't update array info. -22 [ 218.289620][ T991] wiimote 0005:057E:0330.000B: detected device: Nintendo Wii Remote Plus (Gen 2) [ 218.348141][ T8591] md: could not open device unknown-block(7,0). [ 218.348208][ T8591] md: md_import_device returned -16 [ 218.361423][ T991] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.000B/input/input55 [ 218.364714][ T991] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.000B/input/input56 [ 218.404039][ T991] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.000B/input/input54 [ 219.359669][ T8592] wiimote 0005:057E:0330.000B: Device removed [ 219.807808][ T1224] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 219.978456][ T1224] usb 1-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 219.979898][ T1224] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 219.979948][ T1224] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.036288][ T8630] FAULT_INJECTION: forcing a failure. [ 220.036288][ T8630] name failslab, interval 1, probability 0, space 0, times 0 [ 220.036317][ T8630] CPU: 1 UID: 0 PID: 8630 Comm: syz.5.962 Not tainted syzkaller #0 PREEMPT(full) [ 220.036337][ T8630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 220.036348][ T8630] Call Trace: [ 220.036355][ T8630] [ 220.036364][ T8630] dump_stack_lvl+0xe8/0x150 [ 220.036403][ T8630] should_fail_ex+0x3eb/0x540 [ 220.036436][ T8630] should_failslab+0xa8/0x100 [ 220.036463][ T8630] __kmalloc_cache_noprof+0x9e/0x600 [ 220.036484][ T8630] ? trace_parse_run_command+0x5f/0x380 [ 220.036511][ T8630] ? trace_parse_run_command+0x5f/0x380 [ 220.036545][ T8630] trace_parse_run_command+0x5f/0x380 [ 220.036574][ T8630] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 220.036619][ T8630] vfs_writev+0x4bb/0x990 [ 220.036650][ T8630] ? __pfx_probes_write+0x10/0x10 [ 220.036684][ T8630] ? __pfx_vfs_writev+0x10/0x10 [ 220.036728][ T8630] ? __fget_files+0x2a/0x420 [ 220.036749][ T8630] ? __fget_files+0x3a2/0x420 [ 220.036776][ T8630] ? fdget+0x1ac/0x250 [ 220.036802][ T8630] do_writev+0x154/0x2e0 [ 220.036834][ T8630] ? __pfx_do_writev+0x10/0x10 [ 220.036877][ T8630] do_syscall_64+0x166/0x520 [ 220.036909][ T8630] ? trace_irq_disable+0x3b/0x140 [ 220.036938][ T8630] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.036962][ T8630] ? clear_bhb_loop+0x70/0xc0 [ 220.036989][ T8630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.037012][ T8630] RIP: 0033:0x7fd507d9e159 [ 220.037034][ T8630] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 220.037055][ T8630] RSP: 002b:00007fd508d3f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 220.037079][ T8630] RAX: ffffffffffffffda RBX: 00007fd508025fa0 RCX: 00007fd507d9e159 [ 220.037097][ T8630] RDX: 0000000000000001 RSI: 0000200000002100 RDI: 0000000000000003 [ 220.037111][ T8630] RBP: 00007fd507e3506b R08: 0000000000000000 R09: 0000000000000000 [ 220.037126][ T8630] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 220.037140][ T8630] R13: 00007fd508026038 R14: 00007fd508025fa0 R15: 00007ffe4b8a2738 [ 220.037177][ T8630] [ 220.581145][ T8349] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 220.703628][ T1224] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input57 [ 221.527049][ T5720] usb 1-1: USB disconnect, device number 6 [ 221.846006][ T8349] veth0_vlan: entered promiscuous mode [ 221.858420][ T8662] 8250_pericom 0000:00:00.0: probe with driver 8250_pericom failed with error -12 [ 221.862494][ T8349] veth1_vlan: entered promiscuous mode [ 221.926974][ T8349] veth0_macvtap: entered promiscuous mode [ 221.943811][ T8349] veth1_macvtap: entered promiscuous mode [ 221.979562][ T8349] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 221.998287][ T8349] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 222.093875][ T8666] nvmet: the ns:1 is already enabled. [ 222.108037][ T8666] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 222.117054][ T1160] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.118414][ T1160] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.118606][ T1160] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.118698][ T1160] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.246379][ T1160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 222.246402][ T1160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 222.310377][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 222.310400][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 222.749151][ T8677] Config c/1 of g1 needs at least one function. [ 222.749555][ T8677] udc dummy_udc.0: failed to start g1: -22 [ 222.749580][ T8677] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 222.821619][ T8677] UDC core: g1: couldn't find an available UDC or it's busy [ 223.112595][ T8686] bridge0: port 1(bridge_slave_0) entered disabled state [ 223.134780][ T8693] serial 00:02: in use; can't configure [ 223.144733][ T8693] serial 00:04: in use; can't configure [ 223.144897][ T8693] serial 00:02: in use; can't configure [ 223.145416][ T8693] serial 00:04: in use; can't configure [ 223.145543][ T8693] serial 00:05: in use; can't configure [ 223.145878][ T8693] serial 00:04: in use; can't configure [ 223.152526][ T8693] serial 00:05: in use; can't configure [ 223.161177][ T8693] serial 00:05: in use; can't configure [ 223.162568][ T8693] serial 00:02: in use; can't configure [ 223.163607][ T8693] serial 00:02: in use; can't configure [ 223.366932][ T1224] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 223.483897][ T8686] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 223.514991][ T8686] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 223.525847][ T1224] usb 6-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 223.536634][ T1224] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 223.536688][ T1224] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.816195][ T8699] nvmet: the ns:1 is already enabled. [ 223.825033][ T8699] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 223.955927][ T116] nvmet: connect by host nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b for subsystem testsubsys not allowed [ 223.970716][ T8699] nvme nvme0: Connect for subsystem testsubsys is not allowed, hostnqn: nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b [ 224.204380][ T1224] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input58 [ 224.417968][ T1224] usb 6-1: USB disconnect, device number 4 [ 225.132723][ T8726] loop5: detected capacity change from 0 to 128 [ 225.149120][ T8726] FAT-fs (loop5): bogus sectors per cluster 0 [ 225.149145][ T8726] FAT-fs (loop5): Can't find a valid FAT filesystem [ 225.337065][ T8730] md: couldn't update array info. -22 [ 225.358935][ T8732] nvmet: the ns:1 is already enabled. [ 225.377609][ T8732] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 225.398994][ T8730] md: could not open device unknown-block(7,0). [ 225.399059][ T8730] md: md_import_device returned -16 [ 225.542132][ T12] nvmet: connect by host nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b for subsystem testsubsys not allowed [ 225.544219][ T8732] nvme nvme0: Connect for subsystem testsubsys is not allowed, hostnqn: nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b [ 225.562727][ T8735] Config c/1 of g1 needs at least one function. [ 225.563094][ T8735] udc dummy_udc.0: failed to start g1: -22 [ 225.563142][ T8735] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 225.647264][ T8735] UDC core: g1: couldn't find an available UDC or it's busy [ 225.840740][ T1224] wiimote 0005:057E:0330.000C: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 225.841056][ T1224] wiimote 0005:057E:0330.000C: New device registered [ 225.906360][ T1224] wiimote 0005:057E:0330.000C: detected device: Nintendo Wii Remote Plus (Gen 2) [ 225.917599][ T1224] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 225.917626][ T1224] CPU: 0 UID: 0 PID: 1224 Comm: kworker/0:2 Tainted: G Y syzkaller #0 PREEMPT(full) [ 225.917656][ T1224] Tainted: [Y]=FORCED_BIND [ 225.917664][ T1224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 225.917688][ T1224] Workqueue: events wiimote_init_worker [ 225.917723][ T1224] Call Trace: [ 225.917732][ T1224] [ 225.917741][ T1224] dump_stack_lvl+0xe8/0x150 [ 225.917775][ T1224] sysfs_warn_dup+0x8e/0xa0 [ 225.917800][ T1224] sysfs_do_create_link_sd+0xc0/0x110 [ 225.917827][ T1224] device_add_class_symlinks+0x1cf/0x240 [ 225.917865][ T1224] device_add+0x467/0xb80 [ 225.917900][ T1224] __power_supply_register+0xb88/0xf60 [ 225.917936][ T1224] ? __pfx___power_supply_register+0x10/0x10 [ 225.917966][ T1224] ? trace_kmalloc+0x2a/0xf0 [ 225.917996][ T1224] wiimod_battery_probe+0x202/0x3a0 [ 225.918031][ T1224] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 225.918071][ T1224] ? input_ff_create_memless+0x2e4/0x600 [ 225.918107][ T1224] wiimote_init_worker+0x20c9/0x2f00 [ 225.918145][ T1224] ? __pfx_wiimote_init_worker+0x10/0x10 [ 225.918177][ T1224] ? do_raw_spin_lock+0x12b/0x2f0 [ 225.918210][ T1224] ? lock_acquire+0x115/0x350 [ 225.918246][ T1224] ? rcu_is_watching+0x16/0xb0 [ 225.918280][ T1224] ? process_scheduled_works+0x97a/0x1630 [ 225.918313][ T1224] process_scheduled_works+0xc3d/0x1630 [ 225.918379][ T1224] ? __pfx_process_scheduled_works+0x10/0x10 [ 225.918419][ T1224] ? assign_work+0x3cf/0x5d0 [ 225.918456][ T1224] worker_thread+0xa47/0xfb0 [ 225.918519][ T1224] kthread+0x38b/0x480 [ 225.918545][ T1224] ? __pfx_worker_thread+0x10/0x10 [ 225.918576][ T1224] ? __pfx_kthread+0x10/0x10 [ 225.918603][ T1224] ret_from_fork+0x514/0xb70 [ 225.918632][ T1224] ? __pfx_ret_from_fork+0x10/0x10 [ 225.918654][ T1224] ? __switch_to+0xc78/0x1410 [ 225.918693][ T1224] ? __pfx_kthread+0x10/0x10 [ 225.918720][ T1224] ret_from_fork_asm+0x1a/0x30 [ 225.918769][ T1224] [ 225.919574][ T1224] wiimote 0005:057E:0330.000C: cannot register battery device [ 226.496953][ T991] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 226.647825][ T991] usb 1-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 226.648982][ T991] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 226.649041][ T991] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.675801][ T8744] wiimote 0005:057E:0330.000C: Device removed [ 227.186294][ T8770] UDC core: g1: couldn't find an available UDC or it's busy [ 227.270638][ T991] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input60 [ 227.373895][ T8776] nvmet: the ns:1 is already enabled. [ 227.376101][ T8776] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 227.491883][ T991] usb 1-1: USB disconnect, device number 7 [ 227.491997][ C1] usbtouchscreen 1-1:1.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 227.539927][ T1160] nvmet: connect by host nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b for subsystem testsubsys not allowed [ 227.540081][ T8776] nvme nvme0: Connect for subsystem testsubsys is not allowed, hostnqn: nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b [ 227.794236][ T10] wiimote 0005:057E:0330.000D: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 227.794571][ T10] wiimote 0005:057E:0330.000D: New device registered [ 227.838322][ T10] wiimote 0005:057E:0330.000D: detected device: Nintendo Wii Remote Plus (Gen 2) [ 227.868943][ T10] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.000D/input/input62 [ 227.874993][ T10] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.000D/input/input63 [ 227.904187][ T10] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.000D/input/input61 [ 228.610409][ T8786] wiimote 0005:057E:0330.000D: Device removed [ 228.714130][ T8801] Config c/1 of g1 needs at least one function. [ 228.714261][ T8801] udc dummy_udc.0: failed to start g1: -22 [ 228.714284][ T8801] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 228.741740][ T8801] UDC core: g1: couldn't find an available UDC or it's busy [ 228.955742][ T8813] nvmet: the ns:1 is already enabled. [ 228.965479][ T8813] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 229.046461][ T61] nvmet: connect by host nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b for subsystem testsubsys not allowed [ 229.063669][ T8813] nvme nvme0: Connect for subsystem testsubsys is not allowed, hostnqn: nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b [ 229.358515][ T5757] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 229.507546][ T5757] usb 6-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 229.508696][ T5757] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 229.508743][ T5757] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 229.854183][ T991] wiimote 0005:057E:0330.000E: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 229.854590][ T991] wiimote 0005:057E:0330.000E: New device registered [ 229.883290][ T991] wiimote 0005:057E:0330.000E: detected device: Nintendo Wii Remote Plus (Gen 2) [ 229.883778][ T991] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 229.883820][ T991] CPU: 1 UID: 0 PID: 991 Comm: kworker/1:2 Tainted: G Y syzkaller #0 PREEMPT(full) [ 229.883844][ T991] Tainted: [Y]=FORCED_BIND [ 229.883850][ T991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 229.883863][ T991] Workqueue: events wiimote_init_worker [ 229.883891][ T991] Call Trace: [ 229.883898][ T991] [ 229.883906][ T991] dump_stack_lvl+0xe8/0x150 [ 229.883936][ T991] sysfs_warn_dup+0x8e/0xa0 [ 229.883955][ T991] sysfs_do_create_link_sd+0xc0/0x110 [ 229.883976][ T991] device_add_class_symlinks+0x1cf/0x240 [ 229.884007][ T991] device_add+0x467/0xb80 [ 229.884034][ T991] __power_supply_register+0xb88/0xf60 [ 229.884062][ T991] ? __pfx___power_supply_register+0x10/0x10 [ 229.884085][ T991] ? trace_kmalloc+0x2a/0xf0 [ 229.884108][ T991] wiimod_battery_probe+0x202/0x3a0 [ 229.884136][ T991] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 229.884167][ T991] ? input_ff_create_memless+0x2e4/0x600 [ 229.884194][ T991] wiimote_init_worker+0x20c9/0x2f00 [ 229.884224][ T991] ? __pfx_wiimote_init_worker+0x10/0x10 [ 229.884250][ T991] ? do_raw_spin_lock+0x12b/0x2f0 [ 229.884276][ T991] ? lock_acquire+0x115/0x350 [ 229.884305][ T991] ? rcu_is_watching+0x16/0xb0 [ 229.884332][ T991] ? process_scheduled_works+0x97a/0x1630 [ 229.884369][ T991] process_scheduled_works+0xc3d/0x1630 [ 229.884424][ T991] ? __pfx_process_scheduled_works+0x10/0x10 [ 229.884457][ T991] ? assign_work+0x3cf/0x5d0 [ 229.884489][ T991] worker_thread+0xa47/0xfb0 [ 229.884526][ T991] ? __kthread_parkme+0x71/0x1f0 [ 229.884551][ T991] kthread+0x38b/0x480 [ 229.884571][ T991] ? __pfx_worker_thread+0x10/0x10 [ 229.884595][ T991] ? __pfx_kthread+0x10/0x10 [ 229.884617][ T991] ret_from_fork+0x514/0xb70 [ 229.884637][ T991] ? __pfx_ret_from_fork+0x10/0x10 [ 229.884656][ T991] ? __switch_to+0xc78/0x1410 [ 229.884684][ T991] ? __pfx_kthread+0x10/0x10 [ 229.884709][ T991] ret_from_fork_asm+0x1a/0x30 [ 229.884758][ T991] [ 229.921535][ T991] wiimote 0005:057E:0330.000E: cannot register battery device [ 230.183892][ T5757] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input64 [ 230.396920][ T1224] usb 6-1: USB disconnect, device number 5 [ 230.419903][ T8850] md: couldn't update array info. -22 [ 230.477134][ T8850] md: could not open device unknown-block(7,0). [ 230.477199][ T8850] md: md_import_device returned -16 [ 230.693276][ T8854] Config c/1 of g1 needs at least one function. [ 230.693426][ T8854] udc dummy_udc.0: failed to start g1: -22 [ 230.693469][ T8854] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 230.722447][ T8854] UDC core: g1: couldn't find an available UDC or it's busy [ 230.786842][ T8836] wiimote 0005:057E:0330.000E: Device removed [ 231.099520][ T8864] nvmet: the ns:1 is already enabled. [ 231.104719][ T8864] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 231.564756][ T61] nvmet: connect by host nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b for subsystem testsubsys not allowed [ 231.564910][ T8864] nvme nvme0: Connect for subsystem testsubsys is not allowed, hostnqn: nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b [ 232.015006][ T8897] FAULT_INJECTION: forcing a failure. [ 232.015006][ T8897] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 232.015047][ T8897] CPU: 0 UID: 0 PID: 8897 Comm: syz.5.1043 Tainted: G Y syzkaller #0 PREEMPT(full) [ 232.015078][ T8897] Tainted: [Y]=FORCED_BIND [ 232.015087][ T8897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 232.015102][ T8897] Call Trace: [ 232.015110][ T8897] [ 232.015120][ T8897] dump_stack_lvl+0xe8/0x150 [ 232.015161][ T8897] should_fail_ex+0x3eb/0x540 [ 232.015196][ T8897] _copy_from_user+0x2d/0xb0 [ 232.015230][ T8897] memdup_user+0x5e/0xd0 [ 232.015252][ T8897] strndup_user+0x68/0xd0 [ 232.015273][ T8897] __se_sys_mount+0xdf/0x420 [ 232.015330][ T8897] ? __pfx___se_sys_mount+0x10/0x10 [ 232.015360][ T8897] ? __x64_sys_mount+0x20/0xc0 [ 232.015385][ T8897] do_syscall_64+0x166/0x520 [ 232.015418][ T8897] ? trace_irq_disable+0x3b/0x140 [ 232.015448][ T8897] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.015472][ T8897] ? clear_bhb_loop+0x70/0xc0 [ 232.015500][ T8897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.015524][ T8897] RIP: 0033:0x7fd507d9e159 [ 232.015546][ T8897] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 232.015567][ T8897] RSP: 002b:00007fd508d3f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 232.015595][ T8897] RAX: ffffffffffffffda RBX: 00007fd508025fa0 RCX: 00007fd507d9e159 [ 232.015613][ T8897] RDX: 00002000000001c0 RSI: 0000000000000000 RDI: 0000200000000100 [ 232.015630][ T8897] RBP: 00007fd507e3506b R08: 0000000000000000 R09: 0000000000000000 [ 232.015645][ T8897] R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000000 [ 232.015659][ T8897] R13: 00007fd508026038 R14: 00007fd508025fa0 R15: 00007ffe4b8a2738 [ 232.015696][ T8897] [ 232.064742][ T8896] serial 00:02: in use; can't configure [ 232.065780][ T8896] serial 00:04: in use; can't configure [ 232.066082][ T8896] serial 00:02: in use; can't configure [ 232.155512][ T8898] serial 00:04: in use; can't configure [ 232.160566][ T8896] serial 00:04: in use; can't configure [ 232.168342][ T8896] serial 00:02: in use; can't configure [ 232.168895][ T8896] serial 00:02: in use; can't configure [ 232.586166][ T8910] Config c/1 of g1 needs at least one function. [ 232.586308][ T8910] udc dummy_udc.0: failed to start g1: -22 [ 232.586424][ T8910] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 232.587990][ T8910] UDC core: g1: couldn't find an available UDC or it's busy [ 232.762480][ T8913] md: couldn't update array info. -22 [ 232.837352][ T8913] md: could not open device unknown-block(7,0). [ 232.837420][ T8913] md: md_import_device returned -16 [ 232.987053][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 233.117884][ T7332] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 233.288148][ T7332] usb 1-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 233.291222][ T7332] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 233.291273][ T7332] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.972815][ T1160] nvmet: connect by host nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b for subsystem testsubsys not allowed [ 233.973004][ T8936] nvme nvme0: Connect for subsystem testsubsys is not allowed, hostnqn: nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b [ 234.038199][ T7332] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input66 [ 234.173395][ T8947] serial 00:02: in use; can't configure [ 234.173723][ T8947] serial 00:04: in use; can't configure [ 234.173843][ T8947] serial 00:02: in use; can't configure [ 234.174036][ T8947] serial 00:04: in use; can't configure [ 234.175978][ T8947] serial 00:04: in use; can't configure [ 234.176289][ T8947] serial 00:02: in use; can't configure [ 234.176402][ T8947] serial 00:02: in use; can't configure [ 234.248549][ T7332] usb 1-1: USB disconnect, device number 8 [ 234.474850][ T10] wiimote 0005:057E:0330.000F: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 234.475302][ T10] wiimote 0005:057E:0330.000F: New device registered [ 234.511621][ T10] wiimote 0005:057E:0330.000F: detected device: Nintendo Wii Remote Plus (Gen 2) [ 234.512112][ T10] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 234.512136][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G Y syzkaller #0 PREEMPT(full) [ 234.512165][ T10] Tainted: [Y]=FORCED_BIND [ 234.512173][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 234.512188][ T10] Workqueue: events wiimote_init_worker [ 234.512225][ T10] Call Trace: [ 234.512234][ T10] [ 234.512243][ T10] dump_stack_lvl+0xe8/0x150 [ 234.512278][ T10] sysfs_warn_dup+0x8e/0xa0 [ 234.512303][ T10] sysfs_do_create_link_sd+0xc0/0x110 [ 234.512331][ T10] device_add_class_symlinks+0x1cf/0x240 [ 234.512370][ T10] device_add+0x467/0xb80 [ 234.512405][ T10] __power_supply_register+0xb88/0xf60 [ 234.512439][ T10] ? __pfx___power_supply_register+0x10/0x10 [ 234.512470][ T10] ? trace_kmalloc+0x2a/0xf0 [ 234.512500][ T10] wiimod_battery_probe+0x202/0x3a0 [ 234.512534][ T10] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 234.512574][ T10] ? input_ff_create_memless+0x2e4/0x600 [ 234.512610][ T10] wiimote_init_worker+0x20c9/0x2f00 [ 234.512648][ T10] ? __pfx_wiimote_init_worker+0x10/0x10 [ 234.512681][ T10] ? do_raw_spin_lock+0x12b/0x2f0 [ 234.512714][ T10] ? lock_acquire+0x115/0x350 [ 234.512749][ T10] ? rcu_is_watching+0x16/0xb0 [ 234.512783][ T10] ? process_scheduled_works+0x97a/0x1630 [ 234.512817][ T10] process_scheduled_works+0xc3d/0x1630 [ 234.512881][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 234.512922][ T10] ? assign_work+0x3cf/0x5d0 [ 234.512991][ T10] worker_thread+0xa47/0xfb0 [ 234.513037][ T10] ? __kthread_parkme+0x71/0x1f0 [ 234.513070][ T10] kthread+0x38b/0x480 [ 234.513096][ T10] ? __pfx_worker_thread+0x10/0x10 [ 234.513126][ T10] ? __pfx_kthread+0x10/0x10 [ 234.513152][ T10] ret_from_fork+0x514/0xb70 [ 234.513177][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 234.513199][ T10] ? __switch_to+0xc78/0x1410 [ 234.513234][ T10] ? __pfx_kthread+0x10/0x10 [ 234.513261][ T10] ret_from_fork_asm+0x1a/0x30 [ 234.513312][ T10] [ 234.604937][ T10] wiimote 0005:057E:0330.000F: cannot register battery device [ 235.094348][ T8965] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1063'. [ 235.107200][ T8967] md: couldn't update array info. -22 [ 235.238231][ T8967] md: could not open device unknown-block(7,0). [ 235.238300][ T8967] md: md_import_device returned -16 [ 235.252315][ T8953] wiimote 0005:057E:0330.000F: Device removed [ 235.581698][ T8980] nvmet: the ns:1 is already enabled. [ 235.583348][ T8980] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 235.658125][ T116] nvmet: connect by host nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b for subsystem testsubsys not allowed [ 235.658400][ T8980] nvme nvme0: Connect for subsystem testsubsys is not allowed, hostnqn: nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b [ 235.947582][ T8985] serial 00:02: in use; can't configure [ 235.948011][ T8985] serial 00:04: in use; can't configure [ 235.948139][ T8985] serial 00:02: in use; can't configure [ 235.948325][ T8985] serial 00:04: in use; can't configure [ 235.950611][ T8985] serial 00:04: in use; can't configure [ 235.951037][ T8985] serial 00:02: in use; can't configure [ 235.951170][ T8985] serial 00:02: in use; can't configure [ 236.709901][ T1224] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 236.796853][ T9001] md: couldn't update array info. -22 [ 236.839156][ T9003] md: could not open device unknown-block(7,0). [ 236.839236][ T9003] md: md_import_device returned -16 [ 236.861410][ T1224] usb 1-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 236.862785][ T1224] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 236.862832][ T1224] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.524320][ T1224] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input68 [ 237.709627][ T9011] nvmet: the ns:1 is already enabled. [ 237.711249][ T9011] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 237.753297][ T991] usb 1-1: USB disconnect, device number 9 [ 237.809983][ T154] nvmet: connect by host nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b for subsystem testsubsys not allowed [ 237.810224][ T9011] nvme nvme0: Connect for subsystem testsubsys is not allowed, hostnqn: nqn.2014-08.org.nvmexpress:uuid:a4f6ebe8-4867-426d-9ec4-e8f985bfbd0b [ 238.488719][ T9031] md: couldn't update array info. -22 [ 238.488878][ T9027] md: could not open device unknown-block(7,0). [ 238.488935][ T9027] md: md_import_device returned -16 [ 238.653576][ T10] wiimote 0005:057E:0330.0010: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 238.654779][ T10] wiimote 0005:057E:0330.0010: New device registered [ 238.694933][ T10] wiimote 0005:057E:0330.0010: detected device: Nintendo Wii Remote Plus (Gen 2) [ 238.724328][ T10] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0010/input/input70 [ 238.752831][ T10] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0010/input/input71 [ 238.755376][ T10] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0010/input/input69 [ 238.923001][ T9046] Config c/1 of g1 needs at least one function. [ 238.923132][ T9046] udc dummy_udc.0: failed to start g1: -22 [ 238.923154][ T9046] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 238.926463][ T9046] UDC core: g1: couldn't find an available UDC or it's busy [ 239.354176][ T991] wiimote 0005:057E:0330.0011: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 239.355313][ T991] wiimote 0005:057E:0330.0011: New device registered [ 239.400056][ T991] wiimote 0005:057E:0330.0011: detected device: Nintendo Wii Remote Plus (Gen 2) [ 239.401671][ T991] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 239.401698][ T991] CPU: 1 UID: 0 PID: 991 Comm: kworker/1:2 Tainted: G Y syzkaller #0 PREEMPT(full) [ 239.401728][ T991] Tainted: [Y]=FORCED_BIND [ 239.401736][ T991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 239.401753][ T991] Workqueue: events wiimote_init_worker [ 239.401788][ T991] Call Trace: [ 239.401796][ T991] [ 239.401806][ T991] dump_stack_lvl+0xe8/0x150 [ 239.401841][ T991] sysfs_warn_dup+0x8e/0xa0 [ 239.401866][ T991] sysfs_do_create_link_sd+0xc0/0x110 [ 239.401894][ T991] device_add_class_symlinks+0x1cf/0x240 [ 239.401933][ T991] device_add+0x467/0xb80 [ 239.401968][ T991] __power_supply_register+0xb88/0xf60 [ 239.402021][ T991] ? __pfx___power_supply_register+0x10/0x10 [ 239.402052][ T991] ? trace_kmalloc+0x2a/0xf0 [ 239.402082][ T991] wiimod_battery_probe+0x202/0x3a0 [ 239.402118][ T991] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 239.402158][ T991] ? input_ff_create_memless+0x2e4/0x600 [ 239.402195][ T991] wiimote_init_worker+0x20c9/0x2f00 [ 239.402234][ T991] ? __pfx_wiimote_init_worker+0x10/0x10 [ 239.402267][ T991] ? do_raw_spin_lock+0x12b/0x2f0 [ 239.402299][ T991] ? lock_acquire+0x115/0x350 [ 239.402336][ T991] ? rcu_is_watching+0x16/0xb0 [ 239.402370][ T991] ? process_scheduled_works+0x97a/0x1630 [ 239.402403][ T991] process_scheduled_works+0xc3d/0x1630 [ 239.402471][ T991] ? __pfx_process_scheduled_works+0x10/0x10 [ 239.402512][ T991] ? assign_work+0x3cf/0x5d0 [ 239.402550][ T991] worker_thread+0xa47/0xfb0 [ 239.402599][ T991] ? __kthread_parkme+0x71/0x1f0 [ 239.402634][ T991] kthread+0x38b/0x480 [ 239.402660][ T991] ? __pfx_worker_thread+0x10/0x10 [ 239.402691][ T991] ? __pfx_kthread+0x10/0x10 [ 239.402738][ T991] ret_from_fork+0x514/0xb70 [ 239.402764][ T991] ? __pfx_ret_from_fork+0x10/0x10 [ 239.402787][ T991] ? __switch_to+0xc78/0x1410 [ 239.402823][ T991] ? __pfx_kthread+0x10/0x10 [ 239.402851][ T991] ret_from_fork_asm+0x1a/0x30 [ 239.402905][ T991] [ 239.404674][ T991] wiimote 0005:057E:0330.0011: cannot register battery device [ 239.540636][ T9037] wiimote 0005:057E:0330.0010: Device removed [ 240.106915][ T9069] md: couldn't update array info. -22 [ 240.168334][ T9057] wiimote 0005:057E:0330.0011: Device removed [ 240.186880][ T9069] md: could not open device unknown-block(7,0). [ 240.186948][ T9069] md: md_import_device returned -16 [ 240.216696][ T5757] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 240.387520][ T5757] usb 8-1: New USB device found: idVendor=0596, idProduct=0001, bcdDevice=1.00 [ 240.388933][ T5757] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 240.388985][ T5757] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.038733][ T5757] input: USB Touchscreen 0596:0001 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/input/input73 [ 241.237655][ T5757] usb 8-1: USB disconnect, device number 4 [ 241.417217][ T9082] Config c/1 of g1 needs at least one function. [ 241.417344][ T9082] udc dummy_udc.0: failed to start g1: -22 [ 241.417366][ T9082] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 241.418154][ T9082] UDC core: g1: couldn't find an available UDC or it's busy [ 242.138150][ T9096] bonding: bond1 is being created... [ 242.316315][ T9102] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1111'. [ 242.350793][ T9096] 8021q: adding VLAN 0 to HW filter on device bond1 [ 242.578816][ T9096] bond0: (slave bond_slave_0): Releasing backup interface [ 242.601991][ T9096] 8021q: adding VLAN 0 to HW filter on device bond0 [ 242.748007][ T4925] Bluetooth: hci4: command 0x0406 tx timeout [ 242.871812][ T9117] Config c/1 of g1 needs at least one function. [ 242.871940][ T9117] udc dummy_udc.0: failed to start g1: -22 [ 242.871963][ T9117] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 242.875581][ T9117] UDC core: g1: couldn't find an available UDC or it's busy [ 243.411190][ T7332] wiimote 0005:057E:0330.0012: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 243.411562][ T7332] wiimote 0005:057E:0330.0012: New device registered [ 243.456723][ T7332] wiimote 0005:057E:0330.0012: detected device: Nintendo Wii Remote Plus (Gen 2) [ 243.457226][ T7332] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 243.457251][ T7332] CPU: 0 UID: 0 PID: 7332 Comm: kworker/0:8 Tainted: G Y syzkaller #0 PREEMPT(full) [ 243.457281][ T7332] Tainted: [Y]=FORCED_BIND [ 243.457289][ T7332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 243.457303][ T7332] Workqueue: events wiimote_init_worker [ 243.457338][ T7332] Call Trace: [ 243.457346][ T7332] [ 243.457356][ T7332] dump_stack_lvl+0xe8/0x150 [ 243.457390][ T7332] sysfs_warn_dup+0x8e/0xa0 [ 243.457415][ T7332] sysfs_do_create_link_sd+0xc0/0x110 [ 243.457442][ T7332] device_add_class_symlinks+0x1cf/0x240 [ 243.457481][ T7332] device_add+0x467/0xb80 [ 243.457517][ T7332] __power_supply_register+0xb88/0xf60 [ 243.457557][ T7332] ? __pfx___power_supply_register+0x10/0x10 [ 243.457588][ T7332] ? trace_kmalloc+0x2a/0xf0 [ 243.457618][ T7332] wiimod_battery_probe+0x202/0x3a0 [ 243.457653][ T7332] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 243.457692][ T7332] ? input_ff_create_memless+0x2e4/0x600 [ 243.457728][ T7332] wiimote_init_worker+0x20c9/0x2f00 [ 243.457767][ T7332] ? __pfx_wiimote_init_worker+0x10/0x10 [ 243.457800][ T7332] ? do_raw_spin_lock+0x12b/0x2f0 [ 243.457831][ T7332] ? lock_acquire+0x115/0x350 [ 243.457868][ T7332] ? rcu_is_watching+0x16/0xb0 [ 243.457902][ T7332] ? process_scheduled_works+0x97a/0x1630 [ 243.457936][ T7332] process_scheduled_works+0xc3d/0x1630 [ 243.458002][ T7332] ? __pfx_process_scheduled_works+0x10/0x10 [ 243.458042][ T7332] ? assign_work+0x3cf/0x5d0 [ 243.458081][ T7332] worker_thread+0xa47/0xfb0 [ 243.458144][ T7332] kthread+0x38b/0x480 [ 243.458178][ T7332] ? __pfx_worker_thread+0x10/0x10 [ 243.458209][ T7332] ? __pfx_kthread+0x10/0x10 [ 243.458236][ T7332] ret_from_fork+0x514/0xb70 [ 243.458257][ T7332] ? save_fpregs_to_fpstate+0x176/0x200 [ 243.458287][ T7332] ? __pfx_ret_from_fork+0x10/0x10 [ 243.458310][ T7332] ? __switch_to+0xc78/0x1410 [ 243.458344][ T7332] ? __pfx_kthread+0x10/0x10 [ 243.458371][ T7332] ret_from_fork_asm+0x1a/0x30 [ 243.458423][ T7332] [ 243.458989][ T7332] wiimote 0005:057E:0330.0012: cannot register battery device [ 243.817228][ T9138] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1122'. [ 243.877871][ T9140] bonding: bond1 is being created... [ 243.888530][ T9140] bonding: bond1 already exists [ 243.895699][ T9140] 8021q: adding VLAN 0 to HW filter on device bond1 [ 243.931961][ T9140] bond0: (slave bond_slave_0): Releasing backup interface [ 243.945144][ T9140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 244.228934][ T9129] wiimote 0005:057E:0330.0012: Device removed [ 244.606004][ T9150] Config c/1 of g1 needs at least one function. [ 244.606221][ T9150] udc dummy_udc.0: failed to start g1: -22 [ 244.606245][ T9150] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 244.632265][ T9150] UDC core: g1: couldn't find an available UDC or it's busy [ 246.172457][ T9168] bonding: bond1 is being created... [ 246.179161][ T9168] bonding: bond1 already exists [ 246.196087][ T9168] bond0: option slaves: invalid value (-bond_slave_0) [ 246.214350][ T9168] 8021q: adding VLAN 0 to HW filter on device bond0 [ 246.257957][ T9169] loop7: detected capacity change from 0 to 128 [ 246.553880][ T9175] Config c/1 of g1 needs at least one function. [ 246.556147][ T9175] udc dummy_udc.0: failed to start g1: -22 [ 246.556174][ T9175] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 246.583930][ T9175] UDC core: g1: couldn't find an available UDC or it's busy [ 247.945273][ T10] wiimote 0005:057E:0330.0013: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 247.966557][ T10] wiimote 0005:057E:0330.0013: New device registered [ 248.400108][ T9215] Config c/1 of g1 needs at least one function. [ 248.400227][ T9215] udc dummy_udc.0: failed to start g1: -22 [ 248.400250][ T9215] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 248.403288][ T9215] UDC core: g1: couldn't find an available UDC or it's busy [ 248.448383][ T9199] wiimote 0005:057E:0330.0013: Device removed [ 249.081170][ T10] wiimote 0005:057E:0330.0013: detected device: Nintendo Wii Remote Plus (Gen 2) [ 249.124736][ T10] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0013/input/input76 [ 249.194908][ T10] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0013/input/input77 [ 249.216352][ T10] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0013/input/input75 [ 249.608502][ T7332] wiimote 0005:057E:0330.0014: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 249.609505][ T7332] wiimote 0005:057E:0330.0014: New device registered [ 249.656450][ T7332] wiimote 0005:057E:0330.0014: detected device: Nintendo Wii Remote Plus (Gen 2) [ 249.657098][ T7332] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 249.657126][ T7332] CPU: 0 UID: 0 PID: 7332 Comm: kworker/0:8 Tainted: G Y syzkaller #0 PREEMPT(full) [ 249.657156][ T7332] Tainted: [Y]=FORCED_BIND [ 249.657164][ T7332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 249.657178][ T7332] Workqueue: events wiimote_init_worker [ 249.657212][ T7332] Call Trace: [ 249.657221][ T7332] [ 249.657230][ T7332] dump_stack_lvl+0xe8/0x150 [ 249.657264][ T7332] sysfs_warn_dup+0x8e/0xa0 [ 249.657288][ T7332] sysfs_do_create_link_sd+0xc0/0x110 [ 249.657316][ T7332] device_add_class_symlinks+0x1cf/0x240 [ 249.657354][ T7332] device_add+0x467/0xb80 [ 249.657388][ T7332] __power_supply_register+0xb88/0xf60 [ 249.657422][ T7332] ? __pfx___power_supply_register+0x10/0x10 [ 249.657454][ T7332] ? trace_kmalloc+0x2a/0xf0 [ 249.657484][ T7332] wiimod_battery_probe+0x202/0x3a0 [ 249.657519][ T7332] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 249.657560][ T7332] ? input_ff_create_memless+0x2e4/0x600 [ 249.657592][ T7332] wiimote_init_worker+0x20c9/0x2f00 [ 249.657636][ T7332] ? __pfx_wiimote_init_worker+0x10/0x10 [ 249.657670][ T7332] ? do_raw_spin_lock+0x12b/0x2f0 [ 249.657702][ T7332] ? lock_acquire+0x115/0x350 [ 249.657738][ T7332] ? rcu_is_watching+0x16/0xb0 [ 249.657772][ T7332] ? process_scheduled_works+0x97a/0x1630 [ 249.657805][ T7332] process_scheduled_works+0xc3d/0x1630 [ 249.657870][ T7332] ? __pfx_process_scheduled_works+0x10/0x10 [ 249.657909][ T7332] ? assign_work+0x3cf/0x5d0 [ 249.657946][ T7332] worker_thread+0xa47/0xfb0 [ 249.658009][ T7332] kthread+0x38b/0x480 [ 249.658036][ T7332] ? __pfx_worker_thread+0x10/0x10 [ 249.658067][ T7332] ? __pfx_kthread+0x10/0x10 [ 249.658094][ T7332] ret_from_fork+0x514/0xb70 [ 249.658115][ T7332] ? save_fpregs_to_fpstate+0x176/0x200 [ 249.658145][ T7332] ? __pfx_ret_from_fork+0x10/0x10 [ 249.658167][ T7332] ? __switch_to+0xc78/0x1410 [ 249.658202][ T7332] ? __pfx_kthread+0x10/0x10 [ 249.658228][ T7332] ret_from_fork_asm+0x1a/0x30 [ 249.658279][ T7332] [ 249.883427][ T7332] wiimote 0005:057E:0330.0014: cannot register battery device [ 250.402800][ T9248] Config c/1 of g1 needs at least one function. [ 250.402932][ T9248] udc dummy_udc.0: failed to start g1: -22 [ 250.402954][ T9248] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 250.403770][ T9248] UDC core: g1: couldn't find an available UDC or it's busy [ 250.434880][ T9232] wiimote 0005:057E:0330.0014: Device removed [ 251.936279][ T9277] Config c/1 of g1 needs at least one function. [ 251.936412][ T9277] udc dummy_udc.0: failed to start g1: -22 [ 251.936449][ T9277] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 251.964244][ T9277] UDC core: g1: couldn't find an available UDC or it's busy [ 253.334779][ T9318] intel_ish_ipc 0000:00:01.0: ISH: Failed to get PCI regions [ 253.334809][ T9318] intel_ish_ipc 0000:00:01.0: probe with driver intel_ish_ipc failed with error -22 [ 253.500624][ T9325] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1188'. [ 253.604547][ T5735] wiimote 0005:057E:0330.0015: hidraw2: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 253.607215][ T5735] wiimote 0005:057E:0330.0015: New device registered [ 253.639548][ T5735] wiimote 0005:057E:0330.0015: detected device: Nintendo Wii Remote Plus (Gen 2) [ 253.640052][ T5735] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 253.640078][ T5735] CPU: 1 UID: 0 PID: 5735 Comm: kworker/1:5 Tainted: G Y syzkaller #0 PREEMPT(full) [ 253.640126][ T5735] Tainted: [Y]=FORCED_BIND [ 253.640140][ T5735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 253.640161][ T5735] Workqueue: events wiimote_init_worker [ 253.640198][ T5735] Call Trace: [ 253.640206][ T5735] [ 253.640216][ T5735] dump_stack_lvl+0xe8/0x150 [ 253.640252][ T5735] sysfs_warn_dup+0x8e/0xa0 [ 253.640277][ T5735] sysfs_do_create_link_sd+0xc0/0x110 [ 253.640305][ T5735] device_add_class_symlinks+0x1cf/0x240 [ 253.640343][ T5735] device_add+0x467/0xb80 [ 253.640380][ T5735] __power_supply_register+0xb88/0xf60 [ 253.640416][ T5735] ? __pfx___power_supply_register+0x10/0x10 [ 253.640446][ T5735] ? trace_kmalloc+0x2a/0xf0 [ 253.640477][ T5735] wiimod_battery_probe+0x202/0x3a0 [ 253.640511][ T5735] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 253.640550][ T5735] ? input_ff_create_memless+0x2e4/0x600 [ 253.640586][ T5735] wiimote_init_worker+0x20c9/0x2f00 [ 253.640623][ T5735] ? __pfx_wiimote_init_worker+0x10/0x10 [ 253.640655][ T5735] ? do_raw_spin_lock+0x12b/0x2f0 [ 253.640686][ T5735] ? lock_acquire+0x115/0x350 [ 253.640721][ T5735] ? rcu_is_watching+0x16/0xb0 [ 253.640766][ T5735] ? process_scheduled_works+0x97a/0x1630 [ 253.640800][ T5735] process_scheduled_works+0xc3d/0x1630 [ 253.640873][ T5735] ? __pfx_process_scheduled_works+0x10/0x10 [ 253.640914][ T5735] ? assign_work+0x3cf/0x5d0 [ 253.640952][ T5735] worker_thread+0xa47/0xfb0 [ 253.641004][ T5735] ? __kthread_parkme+0x71/0x1f0 [ 253.641038][ T5735] kthread+0x38b/0x480 [ 253.641064][ T5735] ? __pfx_worker_thread+0x10/0x10 [ 253.641096][ T5735] ? __pfx_kthread+0x10/0x10 [ 253.641123][ T5735] ret_from_fork+0x514/0xb70 [ 253.641148][ T5735] ? __pfx_ret_from_fork+0x10/0x10 [ 253.641170][ T5735] ? __switch_to+0xc78/0x1410 [ 253.641205][ T5735] ? __pfx_kthread+0x10/0x10 [ 253.641233][ T5735] ret_from_fork_asm+0x1a/0x30 [ 253.641285][ T5735] [ 253.643394][ T5735] wiimote 0005:057E:0330.0015: cannot register battery device [ 254.051786][ T4925] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 254.054843][ T4925] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 254.072714][ T4925] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 254.081614][ T4925] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 254.082367][ T4925] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 254.267357][ T9341] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 254.270054][ T9343] Config c/1 of g1 needs at least one function. [ 254.270185][ T9343] udc dummy_udc.0: failed to start g1: -22 [ 254.270208][ T9343] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 254.271067][ T9343] UDC core: g1: couldn't find an available UDC or it's busy [ 254.274130][ T9341] bridge0: port 3(gretap0) entered blocking state [ 254.274228][ T9341] bridge0: port 3(gretap0) entered disabled state [ 254.274644][ T9341] gretap0: entered allmulticast mode [ 254.337651][ T9341] gretap0: entered promiscuous mode [ 254.358035][ T9344] bridge0: port 4(erspan0) entered blocking state [ 254.358186][ T9344] bridge0: port 4(erspan0) entered disabled state [ 254.358960][ T9344] erspan0: entered allmulticast mode [ 254.362575][ T9344] erspan0: entered promiscuous mode [ 254.393363][ T9341] bridge0: port 5(syz_tun) entered blocking state [ 254.395097][ T9341] bridge0: port 5(syz_tun) entered disabled state [ 254.395269][ T9341] syz_tun: entered allmulticast mode [ 254.411001][ T9341] syz_tun: entered promiscuous mode [ 254.421960][ T9328] wiimote 0005:057E:0330.0015: Device removed [ 254.430897][ T9341] bridge0: port 6(ip6gretap0) entered blocking state [ 254.431568][ T9341] bridge0: port 6(ip6gretap0) entered disabled state [ 254.431720][ T9341] ip6gretap0: entered allmulticast mode [ 254.436189][ T9341] ip6gretap0: entered promiscuous mode [ 254.492136][ T9341] bridge0: port 7(bond0) entered blocking state [ 254.492264][ T9341] bridge0: port 7(bond0) entered disabled state [ 254.492426][ T9341] bond0: entered allmulticast mode [ 254.492443][ T9341] bond_slave_1: entered allmulticast mode [ 254.501859][ T61] IPVS: starting estimator thread 0... [ 254.540516][ T9341] bond0: entered promiscuous mode [ 254.540543][ T9341] bond_slave_1: entered promiscuous mode [ 254.560666][ T9341] bridge0: port 7(bond0) entered blocking state [ 254.560816][ T9341] bridge0: port 7(bond0) entered forwarding state [ 254.599678][ T9344] bridge0: port 8(dummy0) entered blocking state [ 254.599867][ T9344] bridge0: port 8(dummy0) entered disabled state [ 254.600026][ T9344] dummy0: entered allmulticast mode [ 254.609631][ T9348] IPVS: using max 25 ests per chain, 60000 per kthread [ 254.650155][ T9344] dummy0: entered promiscuous mode [ 254.664505][ T9344] bridge0: port 8(dummy0) entered blocking state [ 254.664570][ T9344] bridge0: port 8(dummy0) entered forwarding state [ 255.076785][ T5735] wiimote 0005:057E:0330.0015: detected extension: Nintendo Wii Motion Plus [ 255.081973][ T5735] input: Nintendo Wii Remote Motion Plus as /devices/virtual/misc/uhid/0005:057E:0330.0015/input/input80 [ 255.343810][ T9377] Bluetooth: MGMT ver 1.23 [ 255.474533][ T9381] Config c/1 of g1 needs at least one function. [ 255.474666][ T9381] udc dummy_udc.0: failed to start g1: -22 [ 255.474689][ T9381] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 255.475568][ T9381] UDC core: g1: couldn't find an available UDC or it's busy [ 255.902339][ T9394] FAULT_INJECTION: forcing a failure. [ 255.902339][ T9394] name failslab, interval 1, probability 0, space 0, times 0 [ 255.902377][ T9394] CPU: 1 UID: 0 PID: 9394 Comm: syz.5.1207 Tainted: G Y syzkaller #0 PREEMPT(full) [ 255.902407][ T9394] Tainted: [Y]=FORCED_BIND [ 255.902415][ T9394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 255.902428][ T9394] Call Trace: [ 255.902437][ T9394] [ 255.902447][ T9394] dump_stack_lvl+0xe8/0x150 [ 255.902485][ T9394] should_fail_ex+0x3eb/0x540 [ 255.902520][ T9394] should_failslab+0xa8/0x100 [ 255.902551][ T9394] __kmalloc_cache_noprof+0x9e/0x600 [ 255.902576][ T9394] ? mutex_init_lockdep+0xdf/0x110 [ 255.902604][ T9394] ? do_inotify_init+0xa7/0x440 [ 255.902647][ T9394] ? do_inotify_init+0xa7/0x440 [ 255.902687][ T9394] do_inotify_init+0xa7/0x440 [ 255.902727][ T9394] __x64_sys_inotify_init1+0x37/0x40 [ 255.902761][ T9394] do_syscall_64+0x166/0x520 [ 255.902796][ T9394] ? trace_irq_disable+0x3b/0x140 [ 255.902825][ T9394] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.902848][ T9394] ? clear_bhb_loop+0x70/0xc0 [ 255.902876][ T9394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.902898][ T9394] RIP: 0033:0x7fd507d9e159 [ 255.902918][ T9394] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 255.902938][ T9394] RSP: 002b:00007fd508d3f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000126 [ 255.902962][ T9394] RAX: ffffffffffffffda RBX: 00007fd508025fa0 RCX: 00007fd507d9e159 [ 255.902978][ T9394] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 255.902992][ T9394] RBP: 00007fd507e3506b R08: 0000000000000000 R09: 0000000000000000 [ 255.903006][ T9394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 255.903019][ T9394] R13: 00007fd508026038 R14: 00007fd508025fa0 R15: 00007ffe4b8a2738 [ 255.903055][ T9394] [ 256.031979][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.032040][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.206711][ T5610] Bluetooth: hci6: command tx timeout [ 256.254418][ T9336] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.254536][ T9336] bridge0: port 1(bridge_slave_0) entered disabled state [ 256.254781][ T9336] bridge_slave_0: entered allmulticast mode [ 256.291851][ T9336] bridge_slave_0: entered promiscuous mode [ 256.317270][ T9336] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.317412][ T9336] bridge0: port 2(bridge_slave_1) entered disabled state [ 256.317582][ T9336] bridge_slave_1: entered allmulticast mode [ 256.359249][ T9336] bridge_slave_1: entered promiscuous mode [ 256.582746][ T9336] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 256.586089][ T9336] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 256.701035][ T9336] team0: Port device team_slave_0 added [ 256.724841][ T9336] team0: Port device team_slave_1 added [ 256.783662][ T1224] wiimote 0005:057E:0330.0016: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 256.783981][ T1224] wiimote 0005:057E:0330.0016: New device registered [ 256.862106][ T9408] bridge0: port 3(gretap0) entered blocking state [ 256.862203][ T9408] bridge0: port 3(gretap0) entered disabled state [ 256.862359][ T9408] gretap0: entered allmulticast mode [ 256.894836][ T9408] gretap0: entered promiscuous mode [ 256.895457][ T9408] bridge0: port 3(gretap0) entered blocking state [ 256.895557][ T9408] bridge0: port 3(gretap0) entered forwarding state [ 256.922762][ T9336] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 256.922782][ T9336] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 256.922811][ T9336] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 256.923909][ T9398] bridge0: port 4(erspan0) entered blocking state [ 256.924010][ T9398] bridge0: port 4(erspan0) entered disabled state [ 256.924170][ T9398] erspan0: entered allmulticast mode [ 256.983219][ T9398] erspan0: entered promiscuous mode [ 256.998153][ T9398] bridge0: port 4(erspan0) entered blocking state [ 256.998249][ T9398] bridge0: port 4(erspan0) entered forwarding state [ 257.001659][ T9409] md: check of RAID array md0 [ 257.003412][ T9336] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 257.003429][ T9336] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 257.003459][ T9336] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 257.094104][ T9409] md: md0: check done. [ 257.136350][ T9411] Config c/1 of g1 needs at least one function. [ 257.136488][ T9411] udc dummy_udc.0: failed to start g1: -22 [ 257.136509][ T9411] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 257.167399][ T9411] UDC core: g1: couldn't find an available UDC or it's busy [ 257.205019][ T9400] wiimote 0005:057E:0330.0016: Device removed [ 257.221694][ T9336] hsr_slave_0: entered promiscuous mode [ 257.222784][ T9336] hsr_slave_1: entered promiscuous mode [ 257.223506][ T9336] debugfs: 'hsr0' already exists in 'hsr' [ 257.223525][ T9336] Cannot create hsr debugfs directory [ 257.238181][ T9404] bridge0: port 5(syz_tun) entered blocking state [ 257.238359][ T9404] bridge0: port 5(syz_tun) entered disabled state [ 257.239094][ T9404] syz_tun: entered allmulticast mode [ 257.251156][ T9404] syz_tun: entered promiscuous mode [ 257.254252][ T9404] bridge0: port 5(syz_tun) entered blocking state [ 257.258161][ T9404] bridge0: port 5(syz_tun) entered forwarding state [ 257.262676][ T9398] bridge0: port 6(ip6gretap0) entered blocking state [ 257.263143][ T9398] bridge0: port 6(ip6gretap0) entered disabled state [ 257.263537][ T9398] ip6gretap0: entered allmulticast mode [ 257.307471][ T9398] ip6gretap0: entered promiscuous mode [ 257.308092][ T9398] bridge0: port 6(ip6gretap0) entered blocking state [ 257.308188][ T9398] bridge0: port 6(ip6gretap0) entered forwarding state [ 257.365121][ T9398] bridge0: port 7(bond0) entered blocking state [ 257.365217][ T9398] bridge0: port 7(bond0) entered disabled state [ 257.365369][ T9398] bond0: entered allmulticast mode [ 257.365386][ T9398] bond_slave_1: entered allmulticast mode [ 257.386574][ T9398] bond0: entered promiscuous mode [ 257.389449][ T9398] bond_slave_1: entered promiscuous mode [ 257.402893][ T9398] bridge0: port 7(bond0) entered blocking state [ 257.402999][ T9398] bridge0: port 7(bond0) entered forwarding state [ 257.437005][ T9398] bridge0: port 8(dummy0) entered blocking state [ 257.437185][ T9398] bridge0: port 8(dummy0) entered disabled state [ 257.437301][ T9398] dummy0: entered allmulticast mode [ 257.438621][ T9398] dummy0: entered promiscuous mode [ 257.439338][ T9398] bridge0: port 8(dummy0) entered blocking state [ 257.439413][ T9398] bridge0: port 8(dummy0) entered forwarding state [ 257.791609][ T1224] wiimote 0005:057E:0330.0016: detected device: Nintendo Wii Remote Plus (Gen 2) [ 257.849365][ T154] IPVS: starting estimator thread 0... [ 257.919375][ T1224] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0016/input/input82 [ 257.939216][ T9421] IPVS: using max 26 ests per chain, 62400 per kthread [ 257.951311][ T1224] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0016/input/input83 [ 257.966051][ T1224] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0016/input/input81 [ 258.036460][ T9336] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 258.050039][ T9336] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 258.051945][ T9336] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 258.073137][ T9336] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 258.074175][ T9336] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 258.079918][ T9336] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 258.102445][ T9336] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 258.121594][ T9336] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 258.148724][ T9428] md: couldn't update array info. -22 [ 258.227363][ T9428] md: could not open device unknown-block(7,0). [ 258.227433][ T9428] md: md_import_device returned -16 [ 258.248372][ T9437] syz.8.1220: attempt to access beyond end of device [ 258.248372][ T9437] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 258.248483][ T9437] syz.8.1220: attempt to access beyond end of device [ 258.248483][ T9437] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 258.248520][ T9437] md: md0: failed to read bitmap from any device [ 258.271245][ T5610] Bluetooth: hci6: command tx timeout [ 258.436040][ T9336] 8021q: adding VLAN 0 to HW filter on device bond0 [ 258.451190][ T5735] wiimote 0005:057E:0330.0017: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 258.453186][ T5735] wiimote 0005:057E:0330.0017: New device registered [ 258.489868][ T5735] wiimote 0005:057E:0330.0017: detected device: Nintendo Wii Remote Plus (Gen 2) [ 258.490354][ T5735] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 258.490387][ T5735] CPU: 1 UID: 0 PID: 5735 Comm: kworker/1:5 Tainted: G Y syzkaller #0 PREEMPT(full) [ 258.490416][ T5735] Tainted: [Y]=FORCED_BIND [ 258.490424][ T5735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 258.490437][ T5735] Workqueue: events wiimote_init_worker [ 258.490472][ T5735] Call Trace: [ 258.490480][ T5735] [ 258.490490][ T5735] dump_stack_lvl+0xe8/0x150 [ 258.490525][ T5735] sysfs_warn_dup+0x8e/0xa0 [ 258.490551][ T5735] sysfs_do_create_link_sd+0xc0/0x110 [ 258.490578][ T5735] device_add_class_symlinks+0x1cf/0x240 [ 258.490615][ T5735] device_add+0x467/0xb80 [ 258.490651][ T5735] __power_supply_register+0xb88/0xf60 [ 258.490687][ T5735] ? __pfx___power_supply_register+0x10/0x10 [ 258.490718][ T5735] ? trace_kmalloc+0x2a/0xf0 [ 258.490748][ T5735] wiimod_battery_probe+0x202/0x3a0 [ 258.490784][ T5735] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 258.490826][ T5735] ? input_ff_create_memless+0x2e4/0x600 [ 258.490862][ T5735] wiimote_init_worker+0x20c9/0x2f00 [ 258.490901][ T5735] ? __pfx_wiimote_init_worker+0x10/0x10 [ 258.490936][ T5735] ? do_raw_spin_lock+0x12b/0x2f0 [ 258.490969][ T5735] ? lock_acquire+0x115/0x350 [ 258.491006][ T5735] ? rcu_is_watching+0x16/0xb0 [ 258.491041][ T5735] ? process_scheduled_works+0x97a/0x1630 [ 258.491075][ T5735] process_scheduled_works+0xc3d/0x1630 [ 258.491144][ T5735] ? __pfx_process_scheduled_works+0x10/0x10 [ 258.491185][ T5735] ? assign_work+0x3cf/0x5d0 [ 258.491224][ T5735] worker_thread+0xa47/0xfb0 [ 258.491274][ T5735] ? __kthread_parkme+0x71/0x1f0 [ 258.491313][ T5735] kthread+0x38b/0x480 [ 258.491341][ T5735] ? __pfx_worker_thread+0x10/0x10 [ 258.491372][ T5735] ? __pfx_kthread+0x10/0x10 [ 258.491407][ T5735] ret_from_fork+0x514/0xb70 [ 258.491434][ T5735] ? __pfx_ret_from_fork+0x10/0x10 [ 258.491456][ T5735] ? __switch_to+0xc78/0x1410 [ 258.491491][ T5735] ? __pfx_kthread+0x10/0x10 [ 258.491519][ T5735] ret_from_fork_asm+0x1a/0x30 [ 258.491571][ T5735] [ 258.493531][ T5735] wiimote 0005:057E:0330.0017: cannot register battery device [ 258.534690][ T9336] 8021q: adding VLAN 0 to HW filter on device team0 [ 258.729386][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.729546][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 258.755764][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.755887][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 258.797565][ T9444] Config c/1 of g1 needs at least one function. [ 258.797691][ T9444] udc dummy_udc.0: failed to start g1: -22 [ 258.797714][ T9444] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 258.798513][ T9444] UDC core: g1: couldn't find an available UDC or it's busy [ 259.262657][ T9438] wiimote 0005:057E:0330.0017: Device removed [ 259.391061][ T9463] md: check of RAID array md0 [ 259.426984][ T9463] md: md0: check done. [ 259.442440][ T9464] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1228'. [ 259.713048][ T9336] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 259.887107][ T9481] md: couldn't update array info. -22 [ 259.929310][ T9481] md: could not open device unknown-block(7,0). [ 259.929378][ T9481] md: md_import_device returned -16 [ 259.957014][ T9481] syz.6.1232: attempt to access beyond end of device [ 259.957014][ T9481] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 259.957120][ T9481] syz.6.1232: attempt to access beyond end of device [ 259.957120][ T9481] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 259.957147][ T9481] md: md0: failed to read bitmap from any device [ 260.153603][ T9336] veth0_vlan: entered promiscuous mode [ 260.170253][ T9336] veth1_vlan: entered promiscuous mode [ 260.218816][ T9336] veth0_macvtap: entered promiscuous mode [ 260.224601][ T9336] veth1_macvtap: entered promiscuous mode [ 260.256146][ T9336] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 260.276098][ T9336] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 260.359473][ T5610] Bluetooth: hci6: command tx timeout [ 260.380583][ T5925] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.380628][ T5925] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.380659][ T5925] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.380687][ T5925] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.430039][ T9490] Config c/1 of g1 needs at least one function. [ 260.430167][ T9490] udc dummy_udc.0: failed to start g1: -22 [ 260.430190][ T9490] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 260.432799][ T9490] UDC core: g1: couldn't find an available UDC or it's busy [ 260.511812][ T5925] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 260.511837][ T5925] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 260.612506][ T1147] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 260.612531][ T1147] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 260.975519][ T9504] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1238'. [ 261.268128][ T9510] md: couldn't update array info. -22 [ 261.307125][ T9510] md: could not open device unknown-block(7,0). [ 261.307192][ T9510] md: md_import_device returned -16 [ 261.429414][ T9518] md: check of RAID array md0 [ 261.494800][ T9518] md: md0: check done. [ 261.524139][ T9520] Config c/1 of g1 needs at least one function. [ 261.524253][ T9520] udc dummy_udc.0: failed to start g1: -22 [ 261.524308][ T9520] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 261.525121][ T9520] UDC core: g1: couldn't find an available UDC or it's busy [ 261.842850][ T9527] Bluetooth: MGMT ver 1.23 [ 261.844510][ T9527] Bluetooth: MGMT ver 1.23 [ 262.143503][ T5755] wiimote 0005:057E:0330.0018: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 262.143853][ T5755] wiimote 0005:057E:0330.0018: New device registered [ 262.189804][ T5755] wiimote 0005:057E:0330.0018: detected device: Nintendo Wii Remote Plus (Gen 2) [ 262.190304][ T5755] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 262.190328][ T5755] CPU: 1 UID: 0 PID: 5755 Comm: kworker/1:6 Tainted: G Y syzkaller #0 PREEMPT(full) [ 262.190358][ T5755] Tainted: [Y]=FORCED_BIND [ 262.190367][ T5755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 262.190381][ T5755] Workqueue: events wiimote_init_worker [ 262.190414][ T5755] Call Trace: [ 262.190424][ T5755] [ 262.190433][ T5755] dump_stack_lvl+0xe8/0x150 [ 262.190468][ T5755] sysfs_warn_dup+0x8e/0xa0 [ 262.190493][ T5755] sysfs_do_create_link_sd+0xc0/0x110 [ 262.190522][ T5755] device_add_class_symlinks+0x1cf/0x240 [ 262.190561][ T5755] device_add+0x467/0xb80 [ 262.190597][ T5755] __power_supply_register+0xb88/0xf60 [ 262.190633][ T5755] ? __pfx___power_supply_register+0x10/0x10 [ 262.190665][ T5755] ? trace_kmalloc+0x2a/0xf0 [ 262.190703][ T5755] wiimod_battery_probe+0x202/0x3a0 [ 262.190739][ T5755] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 262.190780][ T5755] ? input_ff_create_memless+0x2e4/0x600 [ 262.190815][ T5755] wiimote_init_worker+0x20c9/0x2f00 [ 262.190855][ T5755] ? __pfx_wiimote_init_worker+0x10/0x10 [ 262.190887][ T5755] ? do_raw_spin_lock+0x12b/0x2f0 [ 262.190921][ T5755] ? lock_acquire+0x115/0x350 [ 262.190958][ T5755] ? rcu_is_watching+0x16/0xb0 [ 262.191005][ T5755] ? process_scheduled_works+0x97a/0x1630 [ 262.191038][ T5755] process_scheduled_works+0xc3d/0x1630 [ 262.191104][ T5755] ? __pfx_process_scheduled_works+0x10/0x10 [ 262.191144][ T5755] ? assign_work+0x3cf/0x5d0 [ 262.191182][ T5755] worker_thread+0xa47/0xfb0 [ 262.191242][ T5755] kthread+0x38b/0x480 [ 262.191271][ T5755] ? __pfx_worker_thread+0x10/0x10 [ 262.191301][ T5755] ? __pfx_kthread+0x10/0x10 [ 262.191328][ T5755] ret_from_fork+0x514/0xb70 [ 262.191349][ T5755] ? save_fpregs_to_fpstate+0x176/0x200 [ 262.191378][ T5755] ? __pfx_ret_from_fork+0x10/0x10 [ 262.191400][ T5755] ? __switch_to+0xc78/0x1410 [ 262.191435][ T5755] ? __pfx_kthread+0x10/0x10 [ 262.191480][ T5755] ret_from_fork_asm+0x1a/0x30 [ 262.191555][ T5755] [ 262.418205][ T5755] wiimote 0005:057E:0330.0018: cannot register battery device [ 262.424814][ T9538] serial 00:02: in use; can't configure [ 262.425149][ T9538] serial 00:04: in use; can't configure [ 262.425280][ T9538] serial 00:02: in use; can't configure [ 262.425452][ T9538] serial 00:04: in use; can't configure [ 262.425770][ T9538] serial 00:04: in use; can't configure [ 262.426158][ T9538] serial 00:02: in use; can't configure [ 262.426294][ T9538] serial 00:02: in use; can't configure [ 262.426820][ T5610] Bluetooth: hci6: command tx timeout [ 262.585975][ T9543] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1253'. [ 262.748937][ T9547] md: couldn't update array info. -22 [ 262.786896][ T9547] md: could not open device unknown-block(7,0). [ 262.786987][ T9547] md: md_import_device returned -16 [ 262.836945][ T9547] syz.6.1254: attempt to access beyond end of device [ 262.836945][ T9547] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 262.837114][ T9547] syz.6.1254: attempt to access beyond end of device [ 262.837114][ T9547] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 262.837134][ T9547] md: md0: failed to read bitmap from any device [ 262.959021][ T9532] wiimote 0005:057E:0330.0018: Device removed [ 262.966381][ T9549] Config c/1 of g1 needs at least one function. [ 262.966531][ T9549] udc dummy_udc.0: failed to start g1: -22 [ 262.966547][ T9549] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 263.000717][ T9549] UDC core: g1: couldn't find an available UDC or it's busy [ 264.077937][ T9563] md: check of RAID array md0 [ 264.096865][ T9563] md: md0: check done. [ 264.968565][ T9565] serial 00:02: in use; can't configure [ 264.968923][ T9565] serial 00:04: in use; can't configure [ 264.969063][ T9565] serial 00:02: in use; can't configure [ 264.969264][ T9565] serial 00:04: in use; can't configure [ 264.969562][ T9565] serial 00:04: in use; can't configure [ 264.969865][ T9565] serial 00:02: in use; can't configure [ 264.969991][ T9565] serial 00:02: in use; can't configure [ 265.146784][ T9569] md: couldn't update array info. -22 [ 265.187106][ T9569] md: could not open device unknown-block(7,0). [ 265.187168][ T9569] md: md_import_device returned -16 [ 265.227827][ T9569] syz.6.1265: attempt to access beyond end of device [ 265.227827][ T9569] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 265.227938][ T9569] syz.6.1265: attempt to access beyond end of device [ 265.227938][ T9569] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 265.227967][ T9569] md: md0: failed to read bitmap from any device [ 265.351539][ T9571] Config c/1 of g1 needs at least one function. [ 265.351630][ T9571] udc dummy_udc.0: failed to start g1: -22 [ 265.351646][ T9571] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 265.352233][ T9571] UDC core: g1: couldn't find an available UDC or it's busy [ 265.550932][ T7332] wiimote 0005:057E:0330.0019: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 265.551290][ T7332] wiimote 0005:057E:0330.0019: New device registered [ 265.592360][ T1224] wiimote 0005:057E:0330.0019: detected device: Nintendo Wii Remote Plus (Gen 2) [ 265.618846][ T1224] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0019/input/input87 [ 265.622595][ T1224] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0019/input/input88 [ 265.626037][ T1224] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0019/input/input86 [ 266.365797][ T9577] wiimote 0005:057E:0330.0019: Device removed [ 274.059893][ T9590] md: check of RAID array md0 [ 274.078360][ T9590] md: md0: check done. [ 274.924526][ T9592] serial 00:02: in use; can't configure [ 274.924879][ T9592] serial 00:04: in use; can't configure [ 274.925019][ T9592] serial 00:02: in use; can't configure [ 274.925215][ T9592] serial 00:04: in use; can't configure [ 274.925504][ T9592] serial 00:04: in use; can't configure [ 274.925811][ T9592] serial 00:02: in use; can't configure [ 274.925925][ T9592] serial 00:02: in use; can't configure [ 275.183396][ T9601] Config c/1 of g1 needs at least one function. [ 275.183496][ T9601] udc dummy_udc.0: failed to start g1: -22 [ 275.183511][ T9601] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 275.184082][ T9601] UDC core: g1: couldn't find an available UDC or it's busy [ 275.500001][ T5742] wiimote 0005:057E:0330.001A: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 275.500335][ T5742] wiimote 0005:057E:0330.001A: New device registered [ 275.548314][ T5742] wiimote 0005:057E:0330.001A: detected device: Nintendo Wii Remote Plus (Gen 2) [ 275.574875][ T5742] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.001A/input/input90 [ 275.582932][ T5742] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.001A/input/input91 [ 275.592374][ T5742] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.001A/input/input89 [ 276.322857][ T9611] wiimote 0005:057E:0330.001A: Device removed [ 276.587338][ T4925] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 276.588581][ T4925] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 276.593540][ T4925] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 276.606934][ T4925] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 276.623385][ T4925] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 277.314767][ T1147] bridge_slave_1: left allmulticast mode [ 277.314798][ T1147] bridge_slave_1: left promiscuous mode [ 277.315012][ T1147] bridge0: port 2(bridge_slave_1) entered disabled state [ 277.322408][ T1147] bridge_slave_0: left allmulticast mode [ 277.322484][ T1147] bridge_slave_0: left promiscuous mode [ 277.326437][ T1147] bridge0: port 1(bridge_slave_0) entered disabled state [ 277.543823][ T1147] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 277.545896][ T1147] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 277.564256][ T1147] bond0 (unregistering): Released all slaves [ 277.687271][ T1147] tipc: Disabling bearer [ 277.687395][ T1147] tipc: Left network mode [ 277.757295][ T5271] 8021q: adding VLAN 0 to HW filter on device eth9 [ 278.017627][ T1147] hsr_slave_0: left promiscuous mode [ 278.020024][ T1147] hsr_slave_1: left promiscuous mode [ 278.021020][ T1147] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 278.023112][ T1147] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 278.111689][ T5610] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 278.114988][ T5610] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 278.124892][ T5610] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 278.143572][ T5610] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 278.144223][ T5610] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 278.428647][ T1147] team0 (unregistering): Port device team_slave_1 removed [ 278.460484][ T1147] team0 (unregistering): Port device team_slave_0 removed [ 278.668725][ T4925] Bluetooth: hci7: command tx timeout [ 278.712377][ T5271] 8021q: adding VLAN 0 to HW filter on device eth10 [ 278.733869][ T9617] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.734061][ T9617] bridge0: port 1(bridge_slave_0) entered disabled state [ 278.734198][ T9617] bridge_slave_0: entered allmulticast mode [ 278.735679][ T9617] bridge_slave_0: entered promiscuous mode [ 278.744352][ T9617] bridge0: port 2(bridge_slave_1) entered blocking state [ 278.744617][ T9617] bridge0: port 2(bridge_slave_1) entered disabled state [ 278.744949][ T9617] bridge_slave_1: entered allmulticast mode [ 278.749748][ T9617] bridge_slave_1: entered promiscuous mode [ 278.829755][ T9617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 278.839147][ T9617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 278.964941][ T9617] team0: Port device team_slave_0 added [ 278.986321][ T9617] team0: Port device team_slave_1 added [ 279.102871][ T9617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 279.102893][ T9617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 279.102922][ T9617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 279.121157][ T9617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 279.121210][ T9617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 279.121282][ T9617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 279.373146][ T5610] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 279.377409][ T5610] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 279.395556][ T5610] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 279.396536][ T5610] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 279.412712][ T9617] hsr_slave_0: entered promiscuous mode [ 279.417008][ T5610] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 279.423867][ T9617] hsr_slave_1: entered promiscuous mode [ 279.429898][ T9617] debugfs: 'hsr0' already exists in 'hsr' [ 279.429959][ T9617] Cannot create hsr debugfs directory [ 280.045920][ T5271] 8021q: adding VLAN 0 to HW filter on device eth11 [ 280.267098][ T4925] Bluetooth: hci8: command tx timeout [ 280.746739][ T4925] Bluetooth: hci7: command tx timeout [ 280.795680][ T5271] 8021q: adding VLAN 0 to HW filter on device eth12 [ 280.796014][ T9617] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 280.813753][ T9617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 280.863581][ T9617] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 280.874276][ T9617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 280.896440][ T9653] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.903785][ T9653] bridge0: port 1(bridge_slave_0) entered disabled state [ 280.904187][ T9653] bridge_slave_0: entered allmulticast mode [ 280.909260][ T9653] bridge_slave_0: entered promiscuous mode [ 280.923169][ T9617] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 280.928969][ T9617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 280.931682][ T9617] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 280.950790][ T9617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 280.964200][ T9653] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.964359][ T9653] bridge0: port 2(bridge_slave_1) entered disabled state [ 280.964754][ T9653] bridge_slave_1: entered allmulticast mode [ 280.973093][ T9653] bridge_slave_1: entered promiscuous mode [ 281.049644][ T9653] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 281.068620][ T9653] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 281.128138][ T9653] team0: Port device team_slave_0 added [ 281.149634][ T9653] team0: Port device team_slave_1 added [ 281.247944][ T9653] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 281.247965][ T9653] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 281.248002][ T9653] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 281.330624][ T9653] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 281.330644][ T9653] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 281.330674][ T9653] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 281.406290][ T9679] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.406456][ T9679] bridge0: port 1(bridge_slave_0) entered disabled state [ 281.421265][ T9679] bridge_slave_0: entered allmulticast mode [ 281.424498][ T9679] bridge_slave_0: entered promiscuous mode [ 281.461209][ T9679] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.461393][ T9679] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.461793][ T9679] bridge_slave_1: entered allmulticast mode [ 281.464040][ T9679] bridge_slave_1: entered promiscuous mode [ 281.471944][ T4925] Bluetooth: hci9: command tx timeout [ 281.551484][ T9679] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 281.555144][ T9679] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 281.585193][ T9653] hsr_slave_0: entered promiscuous mode [ 281.586355][ T9653] hsr_slave_1: entered promiscuous mode [ 281.599277][ T9653] debugfs: 'hsr0' already exists in 'hsr' [ 281.599300][ T9653] Cannot create hsr debugfs directory [ 281.679216][ T9679] team0: Port device team_slave_0 added [ 281.702188][ T9679] team0: Port device team_slave_1 added [ 281.769598][ T9679] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 281.769630][ T9679] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 281.769657][ T9679] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 281.833783][ T9679] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 281.833803][ T9679] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 281.833831][ T9679] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 282.134052][ T5610] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 282.140690][ T5610] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 282.154712][ T5610] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 282.164391][ T5610] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 282.165825][ T5610] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 282.219740][ T9679] hsr_slave_0: entered promiscuous mode [ 282.220546][ T9679] hsr_slave_1: entered promiscuous mode [ 282.221122][ T9679] debugfs: 'hsr0' already exists in 'hsr' [ 282.221142][ T9679] Cannot create hsr debugfs directory [ 282.222796][ T5271] 8021q: adding VLAN 0 to HW filter on device eth13 [ 282.347158][ T4925] Bluetooth: hci8: command tx timeout [ 282.449764][ T9617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 282.683500][ T9617] 8021q: adding VLAN 0 to HW filter on device team0 [ 282.795253][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 282.795381][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 282.824483][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 282.824594][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 282.827101][ T4925] Bluetooth: hci7: command tx timeout [ 283.163177][ T9770] md: check of RAID array md0 [ 283.212728][ T9770] md: md0: check done. [ 283.538088][ T9653] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 283.548389][ T4925] Bluetooth: hci9: command tx timeout [ 283.571611][ T9653] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 283.582399][ T9653] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 283.615042][ T9653] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 283.645562][ T9653] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 283.663050][ T9653] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 283.736135][ T9653] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 283.754612][ T9653] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 284.069762][ T9798] serial 00:02: in use; can't configure [ 284.070125][ T9798] serial 00:04: in use; can't configure [ 284.070250][ T9798] serial 00:02: in use; can't configure [ 284.070691][ T9798] serial 00:04: in use; can't configure [ 284.072579][ T9798] serial 00:04: in use; can't configure [ 284.072907][ T9798] serial 00:02: in use; can't configure [ 284.073027][ T9798] serial 00:02: in use; can't configure [ 284.267138][ T4925] Bluetooth: hci10: command tx timeout [ 284.427860][ T4925] Bluetooth: hci8: command tx timeout [ 284.512544][ T9747] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.512710][ T9747] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.512838][ T9747] bridge_slave_0: entered allmulticast mode [ 284.514395][ T9747] bridge_slave_0: entered promiscuous mode [ 284.546375][ T9747] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.546511][ T9747] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.546907][ T9747] bridge_slave_1: entered allmulticast mode [ 284.551661][ T9747] bridge_slave_1: entered promiscuous mode [ 284.596267][ T9617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 284.653399][ T9820] Config c/1 of g1 needs at least one function. [ 284.653527][ T9820] udc dummy_udc.0: failed to start g1: -22 [ 284.653547][ T9820] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 284.654275][ T9820] UDC core: g1: couldn't find an available UDC or it's busy [ 284.710099][ T9747] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 284.713412][ T9747] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 284.843322][ T9747] team0: Port device team_slave_0 added [ 284.889311][ T9747] team0: Port device team_slave_1 added [ 284.907827][ T4925] Bluetooth: hci7: command tx timeout [ 285.110826][ T9747] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 285.110847][ T9747] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 285.110875][ T9747] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 285.179951][ T9747] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 285.179969][ T9747] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 285.179993][ T9747] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 285.484907][ T9653] 8021q: adding VLAN 0 to HW filter on device bond0 [ 285.515259][ T5742] wiimote 0005:057E:0330.001B: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 285.515595][ T5742] wiimote 0005:057E:0330.001B: New device registered [ 285.565830][ T5742] wiimote 0005:057E:0330.001B: detected device: Nintendo Wii Remote Plus (Gen 2) [ 285.569438][ T9679] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 285.590981][ T5742] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.001B/input/input93 [ 285.609584][ T5742] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.001B/input/input94 [ 285.612927][ T5742] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.001B/input/input92 [ 285.629373][ T4925] Bluetooth: hci9: command tx timeout [ 285.648176][ T9679] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 285.665671][ T9747] hsr_slave_0: entered promiscuous mode [ 285.673079][ T9747] hsr_slave_1: entered promiscuous mode [ 285.673929][ T9747] debugfs: 'hsr0' already exists in 'hsr' [ 285.673951][ T9747] Cannot create hsr debugfs directory [ 285.674317][ T9617] veth0_vlan: entered promiscuous mode [ 285.712010][ T9679] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 285.727582][ T9679] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 285.730990][ T9679] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 285.749084][ T9679] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 285.814883][ T9679] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 285.856355][ T9679] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 285.970258][ T9617] veth1_vlan: entered promiscuous mode [ 286.001075][ T9653] 8021q: adding VLAN 0 to HW filter on device team0 [ 286.077144][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 286.077324][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 286.192505][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.192637][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 286.334650][ T9842] wiimote 0005:057E:0330.001B: Device removed [ 286.348024][ T4925] Bluetooth: hci10: command tx timeout [ 286.371287][ T9617] veth0_macvtap: entered promiscuous mode [ 286.484452][ T9617] veth1_macvtap: entered promiscuous mode [ 286.507815][ T4925] Bluetooth: hci8: command tx timeout [ 286.612486][ T9617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 286.639559][ T9617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 286.832067][ T154] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.869057][ T154] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.872734][ T61] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.872786][ T61] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.944715][ T9679] 8021q: adding VLAN 0 to HW filter on device bond0 [ 287.118101][ T9679] 8021q: adding VLAN 0 to HW filter on device team0 [ 287.142541][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 287.142565][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 287.221877][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.221987][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 287.336070][ T1147] bridge0: port 2(bridge_slave_1) entered blocking state [ 287.336187][ T1147] bridge0: port 2(bridge_slave_1) entered forwarding state [ 287.375701][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 287.375726][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 287.422619][ T9747] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 287.438714][ T9747] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 287.441429][ T9747] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 287.466097][ T9747] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 287.495323][ T9747] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 287.519851][ T9747] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 287.525593][ T9747] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 287.551759][ T9747] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 287.708337][ T5610] Bluetooth: hci9: command tx timeout [ 288.054354][ T9747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 288.109286][ T9747] 8021q: adding VLAN 0 to HW filter on device team0 [ 288.143195][ T9653] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 288.159677][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 288.159843][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 288.203614][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 288.203724][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 288.428497][ T5610] Bluetooth: hci10: command tx timeout [ 288.477292][ T9920] md: check of RAID array md0 [ 288.526515][ T9920] md: md0: check done. [ 288.827204][ T5610] Bluetooth: hci2: command 0x0406 tx timeout [ 288.920621][ T9653] veth0_vlan: entered promiscuous mode [ 288.956940][ T9653] veth1_vlan: entered promiscuous mode [ 289.051480][ T9653] veth0_macvtap: entered promiscuous mode [ 289.093705][ T9653] veth1_macvtap: entered promiscuous mode [ 289.137954][ T9653] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 289.178308][ T9653] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 289.211243][ T154] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.258134][ T51] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.259934][ T1147] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.259979][ T1147] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.566359][ T9679] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 289.592866][ T9952] serial 00:02: in use; can't configure [ 289.593201][ T9952] serial 00:04: in use; can't configure [ 289.593321][ T9952] serial 00:02: in use; can't configure [ 289.593490][ T9952] serial 00:04: in use; can't configure [ 289.594262][ T9952] serial 00:04: in use; can't configure [ 289.596284][ T9952] serial 00:02: in use; can't configure [ 289.596408][ T9952] serial 00:02: in use; can't configure [ 289.665679][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 289.665703][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 289.918734][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 289.918758][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.039147][ T9747] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 290.100540][ T9679] veth0_vlan: entered promiscuous mode [ 290.223288][ T9679] veth1_vlan: entered promiscuous mode [ 290.393187][ T9747] veth0_vlan: entered promiscuous mode [ 290.452370][ T9679] veth0_macvtap: entered promiscuous mode [ 290.473347][ T9747] veth1_vlan: entered promiscuous mode [ 290.490910][ T9679] veth1_macvtap: entered promiscuous mode [ 290.506776][ T4925] Bluetooth: hci10: command tx timeout [ 290.541632][ T9979] Config c/1 of g1 needs at least one function. [ 290.541765][ T9979] udc dummy_udc.0: failed to start g1: -22 [ 290.541787][ T9979] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 290.542561][ T9979] UDC core: g1: couldn't find an available UDC or it's busy [ 290.618353][ T9679] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 290.666057][ T9679] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 290.743461][ T9747] veth0_macvtap: entered promiscuous mode [ 290.769746][ T61] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.772106][ T61] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.772802][ T61] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.772863][ T61] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.869166][ T9747] veth1_macvtap: entered promiscuous mode [ 291.156112][ T9747] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 291.187553][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 291.187574][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 291.273485][ T9747] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 291.390059][ T1160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 291.390079][ T1160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 291.421479][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 291.427041][ T1147] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 291.431015][ T1147] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 291.431124][ T1147] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 291.478699][T10005] serial 00:02: in use; can't configure [ 291.479040][T10005] serial 00:04: in use; can't configure [ 291.479142][T10006] md: check of RAID array md0 [ 291.479175][T10005] serial 00:02: in use; can't configure [ 291.479363][T10005] serial 00:04: in use; can't configure [ 291.479643][T10005] serial 00:04: in use; can't configure [ 291.479958][T10005] serial 00:02: in use; can't configure [ 291.480087][T10005] serial 00:02: in use; can't configure [ 291.672240][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 291.672264][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 291.686251][T10006] md: md0: check done. [ 291.824124][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 291.824148][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 292.063477][ T5757] wiimote 0005:057E:0330.001C: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 292.063792][ T5757] wiimote 0005:057E:0330.001C: New device registered [ 292.117858][ T5757] wiimote 0005:057E:0330.001C: detected device: Nintendo Wii Remote Plus (Gen 2) [ 292.118321][ T5757] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 292.118342][ T5757] CPU: 1 UID: 0 PID: 5757 Comm: kworker/1:7 Tainted: G Y syzkaller #0 PREEMPT(full) [ 292.118363][ T5757] Tainted: [Y]=FORCED_BIND [ 292.118369][ T5757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 292.118380][ T5757] Workqueue: events wiimote_init_worker [ 292.118408][ T5757] Call Trace: [ 292.118416][ T5757] [ 292.118423][ T5757] dump_stack_lvl+0xe8/0x150 [ 292.118451][ T5757] sysfs_warn_dup+0x8e/0xa0 [ 292.118471][ T5757] sysfs_do_create_link_sd+0xc0/0x110 [ 292.118491][ T5757] device_add_class_symlinks+0x1cf/0x240 [ 292.118521][ T5757] device_add+0x467/0xb80 [ 292.118547][ T5757] __power_supply_register+0xb88/0xf60 [ 292.118573][ T5757] ? __pfx___power_supply_register+0x10/0x10 [ 292.118596][ T5757] ? trace_kmalloc+0x2a/0xf0 [ 292.118617][ T5757] wiimod_battery_probe+0x202/0x3a0 [ 292.118643][ T5757] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 292.118673][ T5757] ? input_ff_create_memless+0x2e4/0x600 [ 292.118699][ T5757] wiimote_init_worker+0x20c9/0x2f00 [ 292.118728][ T5757] ? __pfx_wiimote_init_worker+0x10/0x10 [ 292.118771][ T5757] ? do_raw_spin_lock+0x12b/0x2f0 [ 292.118797][ T5757] ? lock_acquire+0x115/0x350 [ 292.118826][ T5757] ? rcu_is_watching+0x16/0xb0 [ 292.118856][ T5757] ? process_scheduled_works+0x97a/0x1630 [ 292.118884][ T5757] process_scheduled_works+0xc3d/0x1630 [ 292.118943][ T5757] ? __pfx_process_scheduled_works+0x10/0x10 [ 292.118975][ T5757] ? assign_work+0x3cf/0x5d0 [ 292.119005][ T5757] worker_thread+0xa47/0xfb0 [ 292.119063][ T5757] kthread+0x38b/0x480 [ 292.119088][ T5757] ? __pfx_worker_thread+0x10/0x10 [ 292.119116][ T5757] ? __pfx_kthread+0x10/0x10 [ 292.119139][ T5757] ret_from_fork+0x514/0xb70 [ 292.119160][ T5757] ? __pfx_ret_from_fork+0x10/0x10 [ 292.119177][ T5757] ? __switch_to+0xc78/0x1410 [ 292.119203][ T5757] ? __pfx_kthread+0x10/0x10 [ 292.119223][ T5757] ret_from_fork_asm+0x1a/0x30 [ 292.119263][ T5757] [ 292.120862][ T5757] wiimote 0005:057E:0330.001C: cannot register battery device [ 292.131333][T10019] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1302'. [ 292.536071][T10029] Config c/1 of g1 needs at least one function. [ 292.536331][T10029] udc dummy_udc.0: failed to start g1: -22 [ 292.536356][T10029] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 292.569083][T10029] UDC core: g1: couldn't find an available UDC or it's busy [ 292.880356][T10020] wiimote 0005:057E:0330.001C: Device removed [ 293.539036][T10071] Config c/1 of g1 needs at least one function. [ 293.539165][T10071] udc dummy_udc.0: failed to start g1: -22 [ 293.539188][T10071] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 293.540087][T10071] UDC core: g1: couldn't find an available UDC or it's busy [ 294.019413][T10086] kvm_intel: kvm [10085]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x7 [ 294.550426][T10112] Config c/1 of g1 needs at least one function. [ 294.550562][T10112] udc dummy_udc.0: failed to start g1: -22 [ 294.550584][T10112] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 294.554523][T10112] UDC core: g1: couldn't find an available UDC or it's busy [ 295.197618][T10140] md: check of RAID array md0 [ 295.272900][T10140] md: md0: check done. [ 295.420304][T10152] Config c/1 of g1 needs at least one function. [ 295.420511][T10152] udc dummy_udc.0: failed to start g1: -22 [ 295.420533][T10152] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 295.423779][T10152] UDC core: g1: couldn't find an available UDC or it's busy [ 296.110794][T10177] FAULT_INJECTION: forcing a failure. [ 296.110794][T10177] name failslab, interval 1, probability 0, space 0, times 0 [ 296.110834][T10177] CPU: 0 UID: 0 PID: 10177 Comm: syz.2.1348 Tainted: G Y syzkaller #0 PREEMPT(full) [ 296.110866][T10177] Tainted: [Y]=FORCED_BIND [ 296.110875][T10177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 296.110889][T10177] Call Trace: [ 296.110899][T10177] [ 296.110909][T10177] dump_stack_lvl+0xe8/0x150 [ 296.110948][T10177] should_fail_ex+0x3eb/0x540 [ 296.110985][T10177] should_failslab+0xa8/0x100 [ 296.111014][T10177] ? alloc_vfsmnt+0x23/0x410 [ 296.111044][T10177] kmem_cache_alloc_noprof+0x9c/0x600 [ 296.111079][T10177] ? __pfx___mutex_lock+0x10/0x10 [ 296.111113][T10177] ? alloc_vfsmnt+0x23/0x410 [ 296.111149][T10177] alloc_vfsmnt+0x23/0x410 [ 296.111182][T10177] vfs_create_mount+0x68/0x310 [ 296.111215][T10177] __se_sys_fsmount+0x5e3/0xbf0 [ 296.111248][T10177] ? __pfx___se_sys_fsmount+0x10/0x10 [ 296.111285][T10177] do_syscall_64+0x166/0x520 [ 296.111317][T10177] ? trace_irq_disable+0x3b/0x140 [ 296.111346][T10177] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.111370][T10177] ? clear_bhb_loop+0x70/0xc0 [ 296.111398][T10177] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.111421][T10177] RIP: 0033:0x7f930f59e159 [ 296.111442][T10177] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 296.111463][T10177] RSP: 002b:00007f93104ed028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b0 [ 296.111488][T10177] RAX: ffffffffffffffda RBX: 00007f930f825fa0 RCX: 00007f930f59e159 [ 296.111506][T10177] RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000003 [ 296.111520][T10177] RBP: 00007f930f63506b R08: 0000000000000000 R09: 0000000000000000 [ 296.111534][T10177] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 296.111548][T10177] R13: 00007f930f826038 R14: 00007f930f825fa0 R15: 00007fff9b540288 [ 296.111586][T10177] [ 296.388079][ T7338] wiimote 0005:057E:0330.001D: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 296.390222][ T7338] wiimote 0005:057E:0330.001D: New device registered [ 296.603695][T10191] ip_tables: iptables: counters copy to user failed while replacing table [ 296.735913][T10193] Config c/1 of g1 needs at least one function. [ 296.754980][T10193] udc dummy_udc.0: failed to start g1: -22 [ 296.755984][T10193] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 296.789989][T10193] UDC core: g1: couldn't find an available UDC or it's busy [ 296.841655][T10181] wiimote 0005:057E:0330.001D: Device removed [ 297.006329][ T1224] wiimote 0005:057E:0330.001E: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 297.051580][ T1224] wiimote 0005:057E:0330.001E: New device registered [ 297.363620][T10205] wiimote 0005:057E:0330.001E: Device removed [ 297.412653][T10228] md: check of RAID array md0 [ 297.445513][T10228] md: md0: check done. [ 297.470679][ T7338] wiimote 0005:057E:0330.001D: detected device: Nintendo Wii Remote Plus (Gen 2) [ 297.499929][ T7338] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.001D/input/input97 [ 297.511936][ T7338] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.001D/input/input98 [ 297.570133][ T7338] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.001D/input/input96 [ 297.934351][T10242] loop1: detected capacity change from 0 to 512 [ 297.954565][T10245] FAULT_INJECTION: forcing a failure. [ 297.954565][T10245] name failslab, interval 1, probability 0, space 0, times 0 [ 297.954602][T10245] CPU: 1 UID: 0 PID: 10245 Comm: syz.6.1364 Tainted: G Y syzkaller #0 PREEMPT(full) [ 297.954632][T10245] Tainted: [Y]=FORCED_BIND [ 297.954641][T10245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 297.954654][T10245] Call Trace: [ 297.954663][T10245] [ 297.954672][T10245] dump_stack_lvl+0xe8/0x150 [ 297.954711][T10245] should_fail_ex+0x3eb/0x540 [ 297.954746][T10245] should_failslab+0xa8/0x100 [ 297.954774][T10245] ? vm_area_alloc+0x24/0x140 [ 297.954807][T10245] kmem_cache_alloc_noprof+0x9c/0x600 [ 297.954844][T10245] ? vm_area_alloc+0x24/0x140 [ 297.954874][T10245] vm_area_alloc+0x24/0x140 [ 297.954899][T10245] mmap_region+0x1827/0x2c60 [ 297.954928][T10245] ? __lock_acquire+0x747/0x2de0 [ 297.954957][T10245] ? __pfx_mmap_region+0x10/0x10 [ 297.954979][T10245] ? do_raw_spin_lock+0x12b/0x2f0 [ 297.955004][T10245] ? rcu_is_watching+0x16/0xb0 [ 297.955029][T10245] ? trace_hrtimer_start+0x82/0x200 [ 297.955053][T10245] ? hrtimer_start_range_ns_common+0x7cd/0xb60 [ 297.955082][T10245] ? finish_task_switch+0x40e/0xc60 [ 297.955154][T10245] ? arch_get_unmapped_area_topdown+0x269/0xb50 [ 297.955201][T10245] ? shmem_get_unmapped_area+0x2cf/0x8f0 [ 297.955223][T10245] ? cap_mmap_addr+0xaa/0xf0 [ 297.955245][T10245] ? bpf_lsm_mmap_addr+0x9/0x50 [ 297.955273][T10245] ? security_mmap_addr+0x71/0x240 [ 297.955302][T10245] do_mmap+0xe0a/0x1300 [ 297.955352][T10245] ? __pfx_do_mmap+0x10/0x10 [ 297.955385][T10245] ? vm_mmap_pgoff+0x1dd/0x4e0 [ 297.955403][T10245] ? down_write_killable+0x179/0x230 [ 297.955426][T10245] ? __pfx_down_write_killable+0x10/0x10 [ 297.955445][T10245] ? apparmor_mmap_file+0x1cc/0x390 [ 297.955465][T10245] ? security_mmap_file+0x4df/0xa20 [ 297.955498][T10245] vm_mmap_pgoff+0x272/0x4e0 [ 297.955524][T10245] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 297.955546][T10245] ? rcu_is_watching+0x16/0xb0 [ 297.955577][T10245] ? ksys_mmap_pgoff+0xf3/0x760 [ 297.955600][T10245] ? __x64_sys_mmap+0x7f/0x140 [ 297.955623][T10245] do_syscall_64+0x166/0x520 [ 297.955650][T10245] ? trace_irq_disable+0x3b/0x140 [ 297.955673][T10245] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 297.955691][T10245] ? clear_bhb_loop+0x70/0xc0 [ 297.955715][T10245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 297.955735][T10245] RIP: 0033:0x7f705e79e159 [ 297.955754][T10245] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 297.955772][T10245] RSP: 002b:00007f705f583028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 297.955795][T10245] RAX: ffffffffffffffda RBX: 00007f705ea25fa0 RCX: 00007f705e79e159 [ 297.955810][T10245] RDX: fffffffffffffffe RSI: 0000000000e7e000 RDI: 0000200000000000 [ 297.955825][T10245] RBP: 00007f705e83506b R08: ffffffffffffffff R09: 000000007542d000 [ 297.955839][T10245] R10: 0000000000004031 R11: 0000000000000246 R12: 0000000000000000 [ 297.955852][T10245] R13: 00007f705ea26038 R14: 00007f705ea25fa0 R15: 00007ffe73aa3468 [ 297.955884][T10245] [ 298.122283][ T5742] wiimote 0005:057E:0330.001E: detected device: Nintendo Wii Remote Plus (Gen 2) [ 298.123389][ T5742] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 298.123413][ T5742] CPU: 0 UID: 0 PID: 5742 Comm: kworker/0:7 Tainted: G Y syzkaller #0 PREEMPT(full) [ 298.123443][ T5742] Tainted: [Y]=FORCED_BIND [ 298.123468][ T5742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 298.123503][ T5742] Workqueue: events wiimote_init_worker [ 298.123593][ T5742] Call Trace: [ 298.123621][ T5742] [ 298.123650][ T5742] dump_stack_lvl+0xe8/0x150 [ 298.123739][ T5742] sysfs_warn_dup+0x8e/0xa0 [ 298.123801][ T5742] sysfs_do_create_link_sd+0xc0/0x110 [ 298.123874][ T5742] device_add_class_symlinks+0x1cf/0x240 [ 298.123959][ T5742] device_add+0x467/0xb80 [ 298.124086][ T5742] __power_supply_register+0xb88/0xf60 [ 298.124178][ T5742] ? __pfx___power_supply_register+0x10/0x10 [ 298.124252][ T5742] ? trace_kmalloc+0x2a/0xf0 [ 298.124324][ T5742] wiimod_battery_probe+0x202/0x3a0 [ 298.124415][ T5742] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 298.124513][ T5742] ? input_ff_create_memless+0x2e4/0x600 [ 298.124597][ T5742] wiimote_init_worker+0x20c9/0x2f00 [ 298.124691][ T5742] ? __pfx_wiimote_init_worker+0x10/0x10 [ 298.124772][ T5742] ? do_raw_spin_lock+0x12b/0x2f0 [ 298.124851][ T5742] ? lock_acquire+0x115/0x350 [ 298.124950][ T5742] ? rcu_is_watching+0x16/0xb0 [ 298.125064][ T5742] ? process_scheduled_works+0x97a/0x1630 [ 298.125146][ T5742] process_scheduled_works+0xc3d/0x1630 [ 298.125327][ T5742] ? __pfx_process_scheduled_works+0x10/0x10 [ 298.125425][ T5742] ? assign_work+0x3cf/0x5d0 [ 298.125538][ T5742] worker_thread+0xa47/0xfb0 [ 298.125664][ T5742] ? __kthread_parkme+0x71/0x1f0 [ 298.125783][ T5742] kthread+0x38b/0x480 [ 298.125851][ T5742] ? __pfx_worker_thread+0x10/0x10 [ 298.125934][ T5742] ? __pfx_kthread+0x10/0x10 [ 298.126010][ T5742] ret_from_fork+0x514/0xb70 [ 298.126081][ T5742] ? __pfx_ret_from_fork+0x10/0x10 [ 298.126135][ T5742] ? __switch_to+0xc78/0x1410 [ 298.126228][ T5742] ? __pfx_kthread+0x10/0x10 [ 298.126301][ T5742] ret_from_fork_asm+0x1a/0x30 [ 298.126456][ T5742] [ 298.415511][ T33] audit: type=1800 audit(1790124471.613:4): pid=10242 uid=60929 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1363" name="file1" dev="loop1" ino=94 res=0 errno=0 [ 298.545070][ T5742] wiimote 0005:057E:0330.001E: cannot register battery device [ 298.937149][T10260] Config c/1 of g1 needs at least one function. [ 298.937976][T10260] udc dummy_udc.0: failed to start g1: -22 [ 298.938002][T10260] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 298.945333][T10260] UDC core: g1: couldn't find an available UDC or it's busy [ 299.070840][ T5610] Bluetooth: hci5: command 0x0406 tx timeout [ 299.182575][T10269] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1370'. [ 299.502626][T10278] bridge0: port 2(bridge_slave_1) entered disabled state [ 299.505730][T10278] bridge0: port 2(bridge_slave_1) entered disabled state [ 299.720153][T10297] md: check of RAID array md0 [ 299.745223][T10297] md: md0: check done. [ 300.494444][T10324] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1376'. [ 300.758785][T10334] Config c/1 of g1 needs at least one function. [ 300.758910][T10334] udc dummy_udc.0: failed to start g1: -22 [ 300.758931][T10334] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 300.759723][T10334] UDC core: g1: couldn't find an available UDC or it's busy [ 301.099257][T10347] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1382'. [ 301.416818][T10362] md: couldn't update array info. -22 [ 301.465434][T10367] md: check of RAID array md0 [ 301.465611][T10362] md: could not open device unknown-block(7,0). [ 301.465670][T10362] md: md_import_device returned -16 [ 301.529617][T10367] md: md0: check done. [ 301.633884][T10372] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1390'. [ 302.335681][T10400] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1396'. [ 302.697790][T10414] md: couldn't update array info. -22 [ 302.723061][T10419] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1403'. [ 302.779146][T10414] md: could not open device unknown-block(7,0). [ 302.779212][T10414] md: md_import_device returned -16 [ 302.888716][T10414] syz.4.1401: attempt to access beyond end of device [ 302.888716][T10414] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 302.888817][T10414] syz.4.1401: attempt to access beyond end of device [ 302.888817][T10414] loop0: rw=2048, sector=65544, nr_sectors = 1 limit=65536 [ 302.888845][T10414] md: md0: failed to read bitmap from any device [ 303.168524][T10439] md: check of RAID array md0 [ 303.235454][T10439] md: md0: check done. [ 303.391288][ T34] INFO: task syz.3.553:7406 blocked for more than 143 seconds. [ 303.391318][ T34] Tainted: G Y syzkaller #0 [ 303.391330][ T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 303.391361][ T34] task:syz.3.553 state:D stack:28232 pid:7406 tgid:7399 ppid:5605 task_flags:0x400040 flags:0x00080002 [ 303.391434][ T34] Call Trace: [ 303.391442][ T34] [ 303.391461][ T34] __schedule+0x1b47/0x5c60 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 303.391515][ T34] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 303.391552][ T34] ? __pfx___schedule+0x10/0x10 [ 303.391597][ T34] ? schedule+0x90/0x2b0 [ 303.391630][ T34] schedule+0x164/0x2b0 [ 303.391685][ T34] schedule_preempt_disabled+0x13/0x30 [ 303.391715][ T34] __mutex_lock+0x7c4/0x15a0 [ 303.391751][ T34] ? __mutex_lock+0x5cd/0x15a0 [ 303.391787][ T34] ? write_threads+0x3b1/0x610 [ 303.391842][ T34] ? __pfx___mutex_lock+0x10/0x10 [ 303.391874][ T34] ? simple_strntoull+0x114/0x190 [ 303.391909][ T34] ? qword_get+0x5ad/0x650 [ 303.391939][ T34] write_threads+0x3b1/0x610 [ 303.391962][ T34] ? __pfx_write_threads+0x10/0x10 [ 303.392001][ T34] ? _copy_from_user+0x94/0xb0 [ 303.392035][ T34] ? simple_transaction_get+0x12d/0x160 [ 303.392060][ T34] nfsctl_transaction_write+0x10f/0x160 [ 303.392096][ T34] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 303.392141][ T34] vfs_write+0x296/0xba0 [ 303.392171][ T34] ? __pfx_vfs_write+0x10/0 ** replaying previous printk message ** [ 303.392171][ T34] ? __pfx_vfs_write+0x10/0x10 [ 303.392195][ T34] ? __fget_files+0x2a/0x420 [ 303.392214][ T34] ? __fget_files+0x3a2/0x420 [ 303.392233][ T34] ? __fget_files+0x2a/0x420 [ 303.392257][ T34] ? fdget+0x1ac/0x250 [ 303.392283][ T34] ksys_write+0x150/0x270 [ 303.392308][ T34] ? __pfx_ksys_write+0x10/0x10 [ 303.392341][ T34] do_syscall_64+0x166/0x520 [ 303.392371][ T34] ? trace_irq_disable+0x3b/0x140 [ 303.392397][ T34] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.392418][ T34] ? clear_bhb_loop+0x70/0xc0 [ 303.392462][ T34] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.392482][ T34] RIP: 0033:0x7fbaee39e159 [ 303.392502][ T34] RSP: 002b:00007fbaec5f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 303.392524][ T34] RAX: ffffffffffffffda RBX: 00007fbaee626090 RCX: 00007fbaee39e159 [ 303.392541][ T34] RDX: 0000000000000002 RSI: 0000200000000800 RDI: 0000000000000003 [ 303.392554][ T34] RBP: 00007fbaee43506b R08: 0000000000000000 R09: 0000000000000000 [ 303.392576][ T34] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 303.392590][ T34] R13: 00007fbaee626128 R14: 00007fbaee626090 R15: 00007fff6e57d768 [ 303.392623][ T34] [ 303.392696][ T34] [ 303.392696][ T34] Showing all locks held in the system: [ 303.392709][ T34] locks held by khungtaskd/34: 1, last CPU#0: [ 303.392725][ T34] #0: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 303.392802][ T34] locks held by kworker/0:2/1224: 2, on CPU#0: [ 303.392818][ T34] #0: ffff88801b069d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 303.392884][ T34] #1: ffffc9000577fc40 ((work_completion)(&(&psy->deferred_register_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 303.392962][ T34] locks held by acpid/4961: 3, on CPU#1: [ 303.392977][ T34] #0: ffff88806936a110 (&evdev->mutex){+.+.}-{4:4}, at: evdev_open+0x2da/0x5d0 [ 303.393029][ T34] #1: ffff88802335c2b8 (&dev->mutex#2){+.+.}-{4:4}, at: input_open_device+0x4f/0x560 [ 303.393093][ T34] #2: ffff888048980390 (&wdata->state.sync){+.+.}-{4:4}, at: wiimod_ir_change+0x150/0x850 [ 303.393159][ T34] locks held by getty/5363: 2, on CPU#0: [ 303.393174][ T34] #0: ffff888035e540a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 303.393231][ T34] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 303.393300][ T34] locks held by udevd/6116: 1, on CPU#0: [ 303.393316][ T34] #0: ffff88806936a110 (&evdev->mutex){+.+.}-{4:4}, at: evdev_open+0x2da/0x5d0 [ 303.393368][ T34] locks held by syz-executor/6361: 2, on CPU#0: [ 303.393383][ T34] #0: ffff88802bfc00e8 (&type->s_umount_key#56){+.+.}-{4:4}, at: deactivate_super+0xac/0xe0 [ 303.393453][ T34] #1: ffffffff8f0a0c80 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x4e/0xd0 [ 303.399375][ T34] locks held by kworker/0:11/7338: 3, last CPU#0: [ 303.399426][ T34] #0: ffff88801b06ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 303.399635][ T34] #1: ffffc900036e7c40 ((work_completion)(&(&group->avgs_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 303.399857][ T34] #2: ffffffff8ec1fcd0 (&group->avgs_lock){+.+.}-{4:4}, at: psi_avgs_work+0x4c/0x170 [ 303.400016][ T34] locks held by syz.3.553/7401: 3, on CPU#0: [ 303.400052][ T34] #0: ffff8880790d37b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 303.400176][ T34] #1: ffff8880768ee460 (sb_writers#13){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 303.400320][ T34] #2: ffffffff8f0a0c80 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xb5/0xd10 [ 303.400472][ T34] locks held by syz.3.553/7406: 3, on CPU#0: [ 303.400505][ T34] #0: ffff8880790d0470 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 303.400639][ T34] #1: ffff8880768ee460 (sb_writers#13){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 303.400783][ T34] #2: ffffffff8f0a0c80 (nfsd_mutex){+.+.}-{4:4}, at: write_threads+0x3b1/0x610 [ 303.427733][ T34] locks held by syz-executor/7606: 4, last CPU#0: [ 303.427788][ T34] #0: ffffffff8ee39210 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x470 [ 303.509599][ T34] #1: ffff88801b1203b8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 303.509764][ T34] #2: ffff888033ac1d38 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 303.509941][ T34] #3: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 303.510083][ T34] locks held by syz-executor/7777: 2, on CPU#1: [ 303.510123][ T34] #0: ffff88801df7a0e8 (&type->s_umount_key#56){+.+.}-{4:4}, at: deactivate_super+0xac/0xe0 [ 303.510295][ T34] #1: ffffffff8f0a0c80 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x4e/0xd0 [ 303.513636][ T34] locks held by syz-executor/8349: 2, on CPU#1: [ 303.513686][ T34] #0: ffff888021eb20e8 (&type->s_umount_key#56){+.+.}-{4:4}, at: deactivate_super+0xac/0xe0 [ 303.518063][ T34] #1: ffffffff8f0a0c80 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x4e/0xd0 [ 303.518228][ T34] locks held by syz.0.1091/9044: 3, on CPU#0: [ 303.518268][ T34] #0: ffff88807aace0f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 303.518411][ T34] #1: ffff88807d84c460 (sb_writers#13){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 303.518561][ T34] #2: ffffffff8f0a0c80 (nfsd_mutex){+.+.}-{4:4}, at: write_versions+0x95/0xe30 [ 303.518683][ T34] locks held by syz-executor/9336: 2, on CPU#1: [ 303.518722][ T34] #0: ffff8880786380e8 (&type->s_umount_key#56){+.+.}-{4:4}, at: deactivate_super+0xac/0xe0 [ 303.518897][ T34] #1: ffffffff8f0a0c80 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x4e/0xd0 [ 303.518961][ T34] locks held by syz.3.1350/10181: 2, on CPU#1: [ 303.518977][ T34] #0: ffff8880800eda58 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 303.519031][ T34] #1: ffff88802335c2b8 (&dev->mutex#2){+.+.}-{4:4}, at: __input_unregister_device+0x31/0x650 [ 303.519098][ T34] locks held by syz.2.1405/10433: 2, last CPU#0: [ 303.519137][ T34] #0: ffff8880333eb6b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 303.519320][ T34] #1: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 303.519457][ T34] locks held by cmp/10447: 1, last CPU#1: [ 303.519493][ T34] #0: ffff8880778cf678 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 [ 303.530895][ T34] [ 303.530906][ T34] ============================================= [ 303.530906][ T34] [ 303.530916][ T34] NMI backtrace for cpu 0 [ 303.530959][ T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Tainted: G Y syzkaller #0 PREEMPT(full) [ 303.530989][ T34] Tainted: [Y]=FORCED_BIND [ 303.530996][ T34] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 303.531010][ T34] Call Trace: [ 303.531018][ T34] [ 303.531027][ T34] dump_stack_lvl+0xe8/0x150 [ 303.531063][ T34] nmi_cpu_backtrace+0x274/0x2d0 [ 303.531089][ T34] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 303.531112][ T34] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 303.531142][ T34] sys_info+0x135/0x170 [ 303.531164][ T34] watchdog+0x1058/0x10d0 [ 303.531201][ T34] ? watchdog+0x209/0x10d0 [ 303.531253][ T34] kthread+0x38b/0x480 [ 303.531279][ T34] ? __pfx_watchdog+0x10/0x10 [ 303.531305][ T34] ? __pfx_kthread+0x10/0x10 [ 303.531344][ T34] ret_from_fork+0x514/0xb70 [ 303.531368][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 303.531408][ T34] ? __switch_to+0xc78/0x1410 [ 303.531442][ T34] ? __pfx_kthread+0x10/0x10 [ 303.531471][ T34] ret_from_fork_asm+0x1a/0x30 [ 303.531522][ T34] [ 303.531542][ T34] Sending NMI from CPU 0 to CPUs 1: [ 303.531585][ C1] NMI backtrace for cpu 1 [ 303.531600][ C1] CPU: 1 UID: 0 PID: 26 Comm: ksoftirqd/1 Tainted: G Y syzkaller #0 PREEMPT(full) [ 303.531626][ C1] Tainted: [Y]=FORCED_BIND [ 303.531633][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 303.531643][ C1] RIP: 0010:filter_irq_stacks+0x26/0xa0 [ 303.531669][ C1] Code: 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 85 f6 74 70 49 89 fe 41 89 f4 31 db 49 bd 00 00 00 00 00 fc ff df 49 89 ff <4c> 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 04 99 86 00 [ 303.531687][ C1] RSP: 0018:ffffc90000a0f7c8 EFLAGS: 00000202 [ 303.531703][ C1] RAX: ffffffff81926901 RBX: 000000000000000a RCX: 0000000000000001 [ 303.531721][ C1] RDX: 0000000000000000 RSI: 000000000000000c RDI: ffffc90000a0f850 [ 303.531734][ C1] RBP: ffffc90000a0fa80 R08: 000000000000001e R09: 0000000000000000 [ 303.531747][ C1] R10: ffffc90000a0f758 R11: ffffffff81b38b00 R12: 000000000000000c [ 303.531760][ C1] R13: dffffc0000000000 R14: ffffc90000a0f850 R15: ffffc90000a0f8a0 [ 303.531774][ C1] FS: 0000000000000000(0000) GS:ffff888124daf000(0000) knlGS:0000000000000000 [ 303.531790][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 303.531803][ C1] CR2: 00007f246c027dac CR3: 000000007fabc000 CR4: 00000000003526f0 [ 303.531820][ C1] Call Trace: [ 303.531826][ C1] [ 303.531835][ C1] stack_depot_save_flags+0x33/0x7f0 [ 303.531863][ C1] ? __lock_acquire+0x747/0x2de0 [ 303.531887][ C1] kasan_save_track+0x4f/0x80 [ 303.531907][ C1] ? kasan_save_track+0x3e/0x80 [ 303.531925][ C1] ? kasan_save_free_info+0x40/0x50 [ 303.531957][ C1] ? __kasan_slab_free+0x5c/0x80 [ 303.531977][ C1] ? kfree+0x1c5/0x650 [ 303.532002][ C1] ? slab_free_after_rcu_debug+0x62/0x220 [ 303.532025][ C1] ? rcu_core+0x926/0x1260 [ 303.532049][ C1] ? handle_softirqs+0x223/0x840 [ 303.532080][ C1] ? run_ksoftirqd+0x36/0x60 [ 303.532107][ C1] ? smpboot_thread_fn+0x565/0xa70 [ 303.532125][ C1] ? kthread+0x38b/0x480 [ 303.532145][ C1] ? ret_from_fork+0x514/0xb70 [ 303.532161][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 303.532213][ C1] kasan_save_free_info+0x40/0x50 [ 303.532239][ C1] __kasan_slab_free+0x5c/0x80 [ 303.532260][ C1] kfree+0x1c5/0x650 [ 303.532285][ C1] ? slab_free_after_rcu_debug+0x62/0x220 [ 303.532326][ C1] slab_free_after_rcu_debug+0x62/0x220 [ 303.532349][ C1] ? __pfx_slab_free_after_rcu_debug+0x10/0x10 [ 303.532372][ C1] ? rcu_core+0x8a8/0x1260 [ 303.532395][ C1] rcu_core+0x926/0x1260 [ 303.532425][ C1] ? __pfx_rcu_core+0x10/0x10 [ 303.532458][ C1] handle_softirqs+0x223/0x840 [ 303.532483][ C1] ? run_ksoftirqd+0x36/0x60 [ 303.532513][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 303.532531][ C1] run_ksoftirqd+0x36/0x60 [ 303.532557][ C1] smpboot_thread_fn+0x565/0xa70 [ 303.532577][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 303.532600][ C1] kthread+0x38b/0x480 [ 303.532620][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 303.532638][ C1] ? __pfx_kthread+0x10/0x10 [ 303.532659][ C1] ret_from_fork+0x514/0xb70 [ 303.532677][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 303.532694][ C1] ? __switch_to+0xc78/0x1410 [ 303.532719][ C1] ? __pfx_kthread+0x10/0x10 [ 303.532741][ C1] ret_from_fork_asm+0x1a/0x30 [ 303.532777][ C1] [ 303.547156][ T34] Kernel panic - not syncing: hung_task: blocked tasks [ 304.598182][ T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Tainted: G Y syzkaller #0 PREEMPT(full) [ 304.608963][ T34] Tainted: [Y]=FORCED_BIND [ 304.613385][ T34] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 304.623456][ T34] Call Trace: [ 304.626750][ T34] [ 304.629692][ T34] vpanic+0x26f/0x710 [ 304.633708][ T34] panic+0xc5/0xd0 [ 304.637475][ T34] ? __pfx_panic+0x10/0x10 [ 304.641913][ T34] ? preempt_schedule_common+0x7f/0xd0 [ 304.647390][ T34] ? preempt_schedule_thunk+0x16/0x40 [ 304.652784][ T34] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 304.658978][ T34] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 304.665151][ T34] watchdog+0x10cc/0x10d0 [ 304.669517][ T34] ? watchdog+0x209/0x10d0 [ 304.673969][ T34] kthread+0x38b/0x480 [ 304.678055][ T34] ? __pfx_watchdog+0x10/0x10 [ 304.682747][ T34] ? __pfx_kthread+0x10/0x10 [ 304.687360][ T34] ret_from_fork+0x514/0xb70 [ 304.691974][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 304.697105][ T34] ? __switch_to+0xc78/0x1410 [ 304.701815][ T34] ? __pfx_kthread+0x10/0x10 [ 304.706431][ T34] ret_from_fork_asm+0x1a/0x30 [ 304.711247][ T34] [ 304.714457][ T34] Kernel Offset: disabled [ 304.718811][ T34] Rebooting in 86400 seconds..