last executing test programs: 11.45942213s ago: executing program 1 (id=1049): syz_clone3(&(0x7f0000001ac0)={0x140200800, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, &(0x7f0000001a80)=[0xffffffffffffffff], 0x1}, 0x58) syz_emit_ethernet(0x8a, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaac1a1aaaaaa84bb08004504007c000000000806907864410101ac1414aa00004e24", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="ac0200ca9078100013080600000000000000a255d78e7f2cc93a03000522003c3d62b84e020401002297fe12f989079d22d6961c5af4c2cc061f4495fe09f9895d7d043804000000"], 0x0) syz_usb_connect(0x2, 0x303, &(0x7f00000001c0)={{0x12, 0x1, 0x300, 0x5c, 0x13, 0x8, 0x10, 0x86a, 0x102, 0x640e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2f1, 0x2, 0xc9, 0x5, 0x1d0, 0xc, "", [{{0x9, 0x4, 0x45, 0x0, 0xb, 0x11, 0x8b, 0x2a, 0x5, [@uac_control={{0xa, 0x24, 0x1, 0x51e7, 0x27}, [@input_terminal={0xc, 0x24, 0x2, 0x6, 0x201, 0x1, 0x2, 0x3, 0x2, 0x3}, @input_terminal={0xc, 0x24, 0x2, 0x1, 0x4, 0x4, 0x2f, 0x2f9, 0x3, 0x5}, @selector_unit={0x5, 0x24, 0x5, 0x6, 0x80}]}], [{{0x9, 0x5, 0x80, 0x0, 0x40, 0xbf, 0x3, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x6, 0x9}]}}, {{0x9, 0x5, 0x9, 0x2, 0x40, 0x4, 0x8, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x7, 0x9}]}}, {{0x9, 0x5, 0x8, 0x8, 0x400, 0x8, 0x2f, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x40, 0x2}]}}, {{0x9, 0x5, 0x7, 0xc, 0x3bf, 0x1, 0x1, 0xc, [@generic={0x69, 0x7, "4f681b325e18055f1b84c666a47d6c7e76b8344792c941d88aad0d9da9e8dba3587c24c1d2397c60e9291d0d3f2495b15d2c7b55857f644c17b052c4e19594054040c469d7b77f8442a5f514fcaa731f2b71ebfd91a49bb897b7f908a156bc7022a0a244388adf"}]}}, {{0x9, 0x5, 0x6, 0x10, 0xa7e90cf57f6b24, 0x2, 0xfd, 0x7f}}, {{0x9, 0x5, 0x5, 0x8, 0x8, 0x2, 0x4, 0x26, [@generic={0x89, 0x4, "f0a4611fbb06eab6eb284c048776703a9c2f2a3a1bd517a7b75e1d6ff3b7a8c8f323a704263740bbf9ed4bbfe1d37b227fc6dbe19daa5ff5ad0974e1f5b0583bfbfd3f835c1413edf1e6e98b675b8eab57756303dd613f445675f7c91de11d6cc5a0b40529e6ea96bba39ec73b09e7b61c27f103ceaf1458c2b420a7ccba998c4f82ff1d5aeb74"}]}}, {{0x9, 0x5, 0xe, 0x3, 0x20, 0x2, 0x8, 0x3}}, {{0x9, 0x5, 0x0, 0xc, 0x28, 0x3, 0x9, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x2, 0x5}]}}, {{0x9, 0x5, 0xb, 0x1, 0x40, 0x70, 0x6, 0x4}}, {{0x9, 0x5, 0xe, 0x0, 0x200, 0x6, 0x81, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x5fa}]}}, {{0x9, 0x5, 0x7, 0x4, 0x200, 0x1, 0x7, 0x9e}}]}}, {{0x9, 0x4, 0x13, 0xb, 0x4, 0xff, 0xff, 0xff, 0x34, [@generic={0x24, 0x24, "bb8dc4a87fe3b6029bfdb7d733a69e605f11beada540f153000992c359bf38915408"}], [{{0x9, 0x5, 0x80, 0x0, 0x1f7, 0x4, 0x8, 0x6}}, {{0x9, 0x5, 0xd, 0x10, 0x3ff, 0x2, 0x6, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0xa}]}}, {{0x9, 0x5, 0x6, 0x0, 0x200, 0x5, 0x10, 0x6, [@generic={0xe1, 0x5, "926d019eedc187565886e0540d63e3276574fee476720f6e23b225a4906d5ba2f221c8f035172b87a7914b81b776a8b37597a1e1ed3c4437ed35026cfca4747b8dfb884d7b17dc4a0b899862ff5df28be39246b3f5c4b4d8ba78f935d8fd5fcab615c54d0f7005533805a7c43b13e4d3f4482d9a9569eb204713e0964aa17e680a9f9fbced52e9df23372e15d099adeed8e05bc66aa8c0f0e1c9b2f03a1dfb791c9dab8e292e47fe54c2b7ac1a4f82d7e9df236a9cb37fbe517b985fbe9ebf1bfd8d63c392d4ae3c5f6fb3edf188aaba029308a9ee457a520ab0967ee1965e"}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0x5, 0x81}]}}, {{0x9, 0x5, 0x9, 0x8, 0x8, 0x8, 0xf, 0x60}}]}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x200, 0x7f, 0x4, 0xff, 0x40, 0xb}, 0x3f, &(0x7f0000000540)={0x5, 0xf, 0x3f, 0x6, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0xc, 0x18, 0x4, 0x0, 0x8, 0x10}, @wireless={0xb, 0x10, 0x1, 0xc, 0x10, 0x7, 0x8, 0xfffd, 0x9}, @wireless={0xb, 0x10, 0x1, 0xc, 0x1, 0xc, 0x5, 0x4a, 0xb6}, @wireless={0xb, 0x10, 0x1, 0x8, 0x8, 0x5, 0xa, 0xe, 0x2}, @wireless={0xb, 0x10, 0x1, 0x8, 0x6c, 0x0, 0x8, 0x1, 0x6}]}, 0x2, [{0xad, &(0x7f0000000580)=@string={0xad, 0x3, "cc8e93fa9c0adddc7a98fd5c2b3013de3fb89580019a271db97b14c8e9b1438da5d5b4c2ea9fbbd38e7be4cbbb48c0a288066d8f9101507b7bb2d39e5aef3e6ad16473a84174cdc5a0134bedc7b64417a09a156e3e4b19f1534f8186dbc37bd25a61e07d94ba239b47e815531a5386d77f0e83d940abc276eaac82620082079033416bf4bfe58cf07516e06e9723356439ecc9b6ebee5869d895dc133497c3ced276fefa8da84646199498"}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x843}}]}) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f0000000080)=@attr_riscv64=@attr_ctrl={0x0, 0x1, 0x1, &(0x7f0000000040)=0x8}) 8.656328811s ago: executing program 1 (id=1063): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000300)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000000feffff620af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000004d44000000000000620a00fe000000007133000000000000b5030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727de79be80fb4493a0ee2e85f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fd21e3587b9d9e878c86ba9b66c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffdbb}, 0x48) ioctl$KVM_CAP_X86_USER_SPACE_MSR(0xffffffffffffffff, 0x4068aea3, &(0x7f00000001c0)={0xbc, 0x0, 0x3}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x38, 0xfff, 0x3fffc, 0x180, 0x2, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x8, 0x0, 0x45, 0xfffffffffffffffd, 0xbdb], 0xdddd0000, 0x1c4217}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') ppoll(&(0x7f0000000240)=[{r4}], 0x1, 0x0, 0x0, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f0000001080)='.\x00', 0x8000, &(0x7f0000000140)={0x6, 0x8a, 0x20000, {r4}}, 0x20) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f00000000c0)={0x1, r0, 'id1\x00'}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000001000)={'syztnl0\x00', &(0x7f0000001880)={'gre0\x00', 0x0, 0x7800, 0x10, 0x8000, 0x3, {{0x17, 0x4, 0x3, 0x3, 0x5c, 0x64, 0x0, 0x0, 0x17, 0x0, @multicast2, @multicast2, {[@timestamp_addr={0x44, 0x34, 0x3b, 0x1, 0xa, [{@local, 0x200}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x6}, {@multicast2, 0x6}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xa}, {@empty}, {@loopback}]}, @generic={0x83, 0xd, "7125d621d50ff8ea5a7a3b"}, @noop, @ssrr={0x89, 0x3, 0x9a}]}}}}}) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000001040)={{0x1, 0x1, 0x18, r0, {0xffffffffffffff01}}, './file0\x00'}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001140)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000010c0), &(0x7f0000001100)='%pK \x00'}, 0x20) r9 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r10, &(0x7f0000000000)="180c4552", 0x4) write$binfmt_misc(r10, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r9, 0x4c0a, &(0x7f0000001680)={r10, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x5, 0x11, 0x14, "97ce03000000000000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "85be8b1c55080000000c547d03d8a0f4bd00", [0x3, 0x3]}}) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000001180)=@bloom_filter={0x1e, 0x7, 0x3f1, 0x2, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x4, 0x4, 0x2}, 0x50) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f00000013c0)={0x0, 0x0}, &(0x7f0000001400)=0xc) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r5, 0xc018937b, &(0x7f0000001440)={{0x1, 0x1, 0x18, r11, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000280), &(0x7f0000001380)='./file0\x00', 0x1f2ca39f894ee674, &(0x7f0000001480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000120000,user_id=', @ANYRESDEC=r12, @ANYBLOB="2c67726f75705f69b800", @ANYRESDEC=r13, @ANYBLOB=',default_permissions,blksize=0x0000000000000000,default_permissions,allow_other,blksize=0x0000000000000600,default_permissions,smackfsdef=^,\x00'], 0x1, 0x0, &(0x7f0000001580)="9ddeba8b06629f4acc212da6663a8f19e3b1d41ba224a24fbda5f81d2f5bee3c0b53d3e5972858a2c3db726dbb8e3e43f1ea7d841414f3a372e401adea60664dabf9f9ced52bcd2f14b75259c978c591b1a6e49a2707c7ace0f644bc2669a395dd2833aac2cbb858dbc0a1034855a83636e756faa77e3b4fb24ee8a76072e5d02503e46c17873cb3a93cf979d35723ad70c18fdb04bfcd45d132331ed35fc980b072b32f6b9bd4b7bfdc6acd1e4fbe11467eb5053a6fd26b3d7ce0ac272b07d2d71b62439333511f00ebc8530493138872d1b6bf3830fe25856685") r14 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001900)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\f\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000004000000000100000000000000000000000000000000000000be1f6be40c7d0bd7c9f8dc3848f22ce153d1b179c9307e7ea7970352f3578affff7434cbac6aaa3b19bf347b6ef6931cb3b6533467728b444f707455f6773621eabe01d2223ca878b7a83ca931dfea666c4cda2c56012e3081d2d35dac6400ae16fbeeb2a6ca2427e0938f84aa5e61181b109861d5d54d2918ab797ef9d5b9c7fa9a32e61f1187c90f0631e2d4aa36561380e6117c41efd49b8ffbb12cf1676734b91c4b07ba504d16e0dbb7b4a4b1053897df034d2c666d9ae4d4e8b72858b17b4576e466988b643842ad7b87696cf46e9f83fc1a457b121a7e03253ec9d215a0e49d12d86377847fe6d352016f049bc5ba31a5868772e44185ed2a808fc4"], 0x50) r15 = dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r15, 0x84, 0x6f, &(0x7f0000001080)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00', 0x4}]}, &(0x7f0000000180)=0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000012c0)=@bpf_ext={0x1c, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000003000000000000000500000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090095000000000000008520000003000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x8, 0xf2, &(0x7f0000000e40)=""/242, 0x41000, 0x24, '\x00', r6, 0x0, r7, 0x8, &(0x7f0000001080)={0x6, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x15117, r0, 0x0, &(0x7f0000001280)=[r8, r10, r11, r14, r15, 0xffffffffffffffff], 0x0, 0x10, 0x12da}, 0x94) 7.603729099s ago: executing program 1 (id=1070): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x80) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000040)={0x0, 0x10000}) (async) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) (async) r2 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f00000000c0)="122d5b8df894428d72e09e12fedb897f73df32fcdeb03481e55a07202f38c332f0c3b3a65603e81c0e0f6c1cc2ee672546613cef04cad7e154fd65d4") fcntl$lock(r0, 0x0, &(0x7f0000000100)={0x0, 0x2, 0x8, 0xfffffffffffffffa, r1}) ioctl$CEC_S_MODE(r2, 0x40046109, &(0x7f0000000140)=0xeb) (async) ioctl$TIOCL_PASTESEL(r2, 0x541c, &(0x7f0000000180)) (async) r3 = syz_open_dev$vivid(&(0x7f00000001c0), 0x3, 0x2) ioctl$FIONCLEX(r3, 0x5450) r4 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f0000000240)={0xa, 0x401, 0x100, 0x800}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000002c0)={@rand_addr, 0x0}, &(0x7f0000000300)=0x14) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000340)=@newtfilter={0x8c0, 0x2c, 0x200, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0xffff, 0x4}, {0x1, 0x10}, {0xfff2, 0xa}}, [@f_rsvp6={{0xa}, {0x890, 0x2, [@TCA_RSVP_POLICE={0x34, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0xc65c8d3}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7fff}, @TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}]}, @TCA_RSVP_POLICE={0x850, 0x5, [@TCA_POLICE_RESULT={0x8, 0x5, 0x7}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x400, 0x8, 0x4, 0x4, 0xffffffff, 0x7fffffff, 0x2, 0x72, 0xdd3, 0x0, 0x2, 0x7, 0x7f, 0x2, 0x5bd, 0xb, 0x2, 0xc74, 0x100000, 0x2, 0xfa9, 0x9, 0x42, 0x4, 0xf, 0xbeab30f0, 0x400, 0xfffffff9, 0x7ff, 0x2, 0x6, 0x8, 0xfffffffc, 0x6, 0x4, 0xde, 0x4, 0x4, 0x800, 0x10000, 0x1, 0x4, 0x8, 0x7, 0x2ebf5cf4, 0x40, 0x7ff, 0x0, 0xfffffff7, 0x0, 0x9f, 0x3, 0x59, 0x3, 0x2, 0x228a, 0x4, 0x9, 0xc09a, 0x6, 0x7, 0xfffffffa, 0x101, 0x3c, 0x6, 0x8, 0x2, 0x7ff, 0x7, 0x6, 0x9, 0x80000000, 0x6, 0x9, 0x1, 0x8, 0xfffff7c5, 0xfffff2ef, 0x0, 0x1, 0xd, 0x2162, 0x7fffffff, 0x7f, 0xb, 0x5, 0x7, 0x9, 0x8, 0x7, 0xef01, 0xba83, 0x101, 0x200, 0x1, 0x80, 0xffff, 0x7c6, 0x0, 0x5, 0x6d, 0x101, 0x103cb71d, 0x8, 0x510, 0xfffffff8, 0x401, 0x68, 0x2, 0x7, 0x10, 0x3, 0x7, 0xbe2d, 0x1, 0x1, 0x8, 0x3, 0x2, 0x9, 0xfffff800, 0x9, 0xf, 0x4, 0x6, 0x9, 0x800, 0xb, 0x7, 0x3, 0x2, 0x800, 0x0, 0x4a8d, 0x3, 0x2, 0xd853, 0x0, 0x1, 0x1, 0x2e, 0x2, 0x8, 0x7, 0x9, 0x3, 0xfffff000, 0x2, 0x9, 0x8d, 0x7, 0x18, 0xc00000, 0x67d62383, 0xfffffff7, 0x2, 0x2, 0x4a8, 0x6, 0x10, 0x3, 0x7fff, 0xbc000000, 0x5, 0x0, 0x7, 0xfffffff9, 0xfff, 0x9, 0x8, 0x8, 0x1, 0xc, 0x3d, 0xa, 0xfffffffb, 0x10001, 0x80000001, 0xd89, 0x8, 0x0, 0x81, 0xfff, 0x8000, 0x10, 0xae, 0x4, 0x8, 0xd, 0x9, 0xc17, 0x80, 0x0, 0x7fffffff, 0x9, 0x3, 0x3, 0xfffff000, 0x8, 0x6, 0x6af, 0x7, 0x3000000, 0x7ac2, 0x1, 0x800, 0x9, 0x4, 0x7f, 0x40, 0x18e, 0x8, 0x1, 0xd, 0x3, 0x7, 0x7ff, 0x6, 0x9, 0x2, 0x1, 0x0, 0x2, 0x35a, 0x246f, 0x3, 0x7f, 0x7, 0x40, 0x2, 0x4, 0x400, 0x6, 0x1, 0x6, 0xe545, 0x4f, 0x0, 0x8563, 0x7, 0x5, 0x200, 0x2, 0x5, 0x0, 0x5, 0x9, 0xb, 0x9, 0x8000, 0xffffffff, 0x10200, 0x0, 0x0, 0x40, 0x2]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x80}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9bfa, 0xc7c9, 0x5, 0xf, 0x100000, 0x0, 0x6, 0x1, 0x9, 0x2, 0x1000, 0x1, 0x9, 0xa, 0x3, 0x80000001, 0x4, 0x2, 0x2551, 0xffff8ded, 0xce, 0xfff, 0x3, 0x3, 0x3, 0xff, 0x9, 0x1800, 0x0, 0x1, 0x8, 0x4, 0x4, 0x7b68, 0xfffffffd, 0x1, 0x7, 0x8, 0x5, 0x6, 0x1, 0x7, 0x2, 0xff, 0x3, 0x6749, 0x7, 0xd, 0x9, 0x5f3b, 0x8, 0x6, 0x3, 0xfffffffa, 0x6, 0x9978, 0x397e, 0x5, 0x180, 0x9, 0x21d4c5a2, 0x6, 0x1, 0x1, 0x7f711ab, 0x2, 0x11, 0xb7, 0x9, 0x0, 0x1, 0x0, 0xfffffff0, 0x6, 0xf3b, 0x80, 0x5, 0x8, 0x5, 0x8d3, 0x1, 0x6, 0x101, 0x8, 0x7, 0x7fff, 0x40, 0x7, 0x4, 0x7, 0xd1b2, 0x3ff, 0x6, 0x6, 0x200, 0xadc5, 0x0, 0x2, 0xce29, 0x6, 0xa, 0x6, 0x10000, 0x8, 0xa, 0x80000000, 0x6, 0xa95c, 0x0, 0x8a40, 0x7f, 0x7, 0x9, 0x8, 0x272b, 0x81, 0x4, 0x5, 0x4, 0x0, 0x0, 0x101, 0x4, 0xfffffffe, 0x200, 0x4, 0x40000000, 0x1, 0xdfcf, 0x6, 0x2a, 0x3, 0x400, 0xffffffff, 0x8, 0xffff61e8, 0x800, 0x100, 0x9, 0x6, 0x7, 0x0, 0x9, 0x2, 0x40, 0x3, 0x4, 0x38e0, 0x1, 0x5, 0xffff1e9e, 0x4, 0x2f, 0x8, 0x8, 0x7fff, 0x9, 0x7, 0x9, 0x4, 0x2, 0xed3, 0x8, 0xffff, 0x37e3, 0x2, 0x800, 0x0, 0x7f, 0x16, 0x80000001, 0xcc, 0x6, 0x7ff, 0xf228, 0x0, 0x1, 0x7f, 0x0, 0x3, 0x75bccef, 0x58, 0x9, 0x1, 0x3, 0x9f13, 0x6e, 0x2, 0x9, 0x8, 0x8, 0x3, 0x3, 0x24000000, 0x0, 0x0, 0x2, 0x1, 0x31, 0x4, 0x401, 0x1, 0x3, 0x9, 0x81, 0x5, 0x1, 0x2b, 0xffffff00, 0x2, 0x1ff, 0x2, 0x6, 0x3, 0xa, 0x7, 0x10, 0x1, 0x8, 0x80000000, 0x4, 0x400, 0x0, 0x8ac, 0x5f2, 0x4, 0x2, 0xffff, 0x9, 0x1000, 0x9, 0x8, 0x200, 0x4, 0x9, 0x7, 0x7, 0x263fe0bb, 0xd, 0x1, 0x47e, 0x0, 0x15ae, 0xffff, 0xbce, 0xfffffffd, 0x3, 0x8001, 0x22cd, 0x0, 0xfa, 0x6, 0x0, 0x8, 0x8001, 0x4]}, @TCA_POLICE_RESULT={0x8, 0x5, 0xf}, @TCA_POLICE_PEAKRATE64={0xc}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7fffffff}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x1}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0xfff1, 0x5}}]}}]}, 0x8c0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) (async) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000c80)) (async) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000dc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x14, r6, 0x400, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x200040c0}, 0x10) (async) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000e00), 0x2, 0x0) (async) r8 = getpid() lstat(&(0x7f0000003140)='./file0\x00', &(0x7f0000003180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r10 = getuid() (async) fstat(r2, &(0x7f0000003280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000003440)={0x8, 0x7, {r1}, {0xffffffffffffffff}, 0x0, 0x4}) (async) fstat(r4, &(0x7f0000003480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000035c0)={{{@in6=@ipv4={""/10, ""/2, @broadcast}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@loopback}}, &(0x7f00000036c0)=0xe8) (async) statx(0xffffffffffffff9c, &(0x7f0000003800)='./file0\x00', 0x6000, 0x40, &(0x7f0000003840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r7, &(0x7f0000000e40)="e619b815b5abe732bbcc6917c74cc3f5341a80434715d10deb7a57e5d8e0309d9bee2cb25e4bc93dad6223490356db71e3de083f0b3b1ac4eb063265a0c9a16089f6637652dfd67f4f8ec34f2b144783d46b0a3a4f280ab5caa296a7e21f8aa00ff6ecf3e0a95c8d8b31e5580fc56eae52a04a1fe3a153657f2b7dcd240efbc38ca37a1e91e98b7a76de8e17097e68b322d7f22cd0f1d226912fc8cfb4ca92b98f1e0668e0a6c854936bd38baf8e4e35a417d7f977f58c85f02a1d02d65a50886efb3ff877721a131dfa7cbc82b5938c53ece98036d15cfb7cab57e7f523bb8d6bf30ab9b63d61a1cdcc84a6fdfbfdfb29623129e0b8906a8b16b1bce3584500b0ee9e316fd344a6cbd06811ec44aa798396164bd267c195c2628e2ab41472ac59029bfe381da9715614125ae455215a03b5b02febeebc81f34c97770f1d4350c0f0491ab6e17cefa47ca9bfc56a66465c0a6c060462130a077e3d8ade5e27a9ca770d835fb33e659f50f097eeca7b3553918f7f3d5766986c0fd9570b24ce1e9a0c9357b6f6947fa83f2e2f53129e05641d8f9887f7a90ecd7de16300828cb14ec0202ffa77f3a5e4d4655296f663f21608cfd547ec9a45998928c9df0bf561fb8180b0095e97b91e2df790afaaf4ebf803d4a2ebb89c70f1a3f2e809efe8e90f5c672bd277555011a3f1a842a79e5d4c3bb4a1efd53a5837f1ed22e7d62a62a17d6ff80d439c634df522df35daa9377615aa489f5db8e275b621745fe7e88cd3d3436675266e12bdc7a69208e49e676b134a015df97952393b03eb4f3c7b85ab5a82676adcddc24655c08f4f1a595430545a9466bdcd6afcbdac5ee63ab64d5f141f21b2ec95cfd6719505d7a1535bc34bba549931c029e0f736c9781f6717247f44eeca079514fa9059dcaee696b1fca24b9f93d1bb8086daa5cef8f57327fbc793e1775d76f99c90cd0c774805611c59fb6f58042dbd487a7c4771219773e803fcaf7ea37925767fe2388f4eba480245a164525dc317e59bfb1c9eab6e808e7322658c7632124f80bafc6671a30bc00189381da59ee680da73a673d4612e7b53a39547b72acdc30a7c9cb1360bce797877e7ee99c88d8d6bf7f83a85621733b50e22bbb971d6dcf172a42af2733c79bc537a37d121ebbe14ae9cb6c3710a5b76cd003fbe9b461ebde200e64d38a4e7dc846320fb4769d8f711a4e8941a0942ce85c968ab63993b65cf99a390b33ae47660f18973815732659c4a19494ead5e5e49f37243a2173ef3521a1e9a796bccd5ae2fdd87888861910768faf13757a246bc02810fc060fc309a6a395f3bcf3268ce98448b687e78da1bab6b9ff1cfd829dd5b23976acc0e39126a11ed57ea0578823907e53ce53550d6ed5d5d6c5455969d575ae6dc6c5613ca4e2e3db0d29e1e0ba95c3684ff9030e3bb7ef323f1cce03184af104a82bbe52c0a9dd7c777374a28eb81e2fdc457ecd45ca8a797074ffa2981458553e6ba85fba7a22e715b1b0758f9da58296379cfd97b9312db8399e0e826f28d22328eb0bdf1445421be450f17bcd67917d2380ce0c9d611afd92257d591a6bc5f945ffad7477e92cc911eed172527208dd84f5cda2e808c1d870e28dcd617f7863e1fd8f8a42eb8b1bac1a860a7edeb95db5341dea157991f24c54f3c190bba49cfde21205682534567abfcdb23bf4e79bd1da98e80a4f0ac9ae452898085d95b3eef0edff24dbffbb41a937e768ce4c04ac444028b8a79047b6a49664c419df936758e2c84d4f40f69f6a135302816676347fbe2c344a164ac9932008307d33020905d3d5b0483543f4bc7508a88ddce93fd372c9e2c344aaf7a33faa68ffa087343392563ab62ef9a4df05e7bde099c3881b5a19a5210af00cf3e6ce46f0d6b78e334cb40ed371e9c85231805cb9074a20d025630c6a5839c11e9a55f730046daddb4a992ffe2df2852993ec32a6e49ed0057f311cde0a900462d0fd2de98f76acac1000420f4c8964361a214a839e34453ce75ae68a0c20c308ea89f658832b4993641c4ee8f3d07004ab35d15522421c7efc508eb9d5c873631c643ce23e7b522ec433211582a9110454413f406318da48b58f93c9b6c59136486f0b92ffbfe3d165f202503e4d150197843d3c9265bc77df726750c4bb1afb3a3b640e8766493e1661b237f71971467ca440f6f51a8fbac08a8faf5532c6828237321f3aadccc10a23e8b831f4f28fd6c028ccbe03dc4192782c017b64530ea48b962bb75f34c4c04d0d703e24d1edbe8c91bf40dfba9c6f049331028ea7db7a7c816161230873a0df4078d1dbae739d5264271c59dc7b211513997e92f227b1b83497e550472fcfe953f3e3cc5079f26e92a08fc7139a33d9417fc7862762b8894a1ca6c71f510bfb903895e081c484a7f187c5b6ac07a0017d69d685f5ed6db591975e7831c9e36439ab82e7b754d56ee645cfc3611fc1bc4be2edf39b9ec1b5c0b7a4550669d2f87b1ed552e01740b73dc4f0a4f401bb7b6ba4528aa218d3384fe1d99047ce8d37a79bb73f7ae8bd76305baa6930d22610b0bcf1a56e99ee84f1e6aae41b6da9e5567f6aa6ebfe69eb057e23d6e21ce9c2db790fe8a988e4aae9f850256ccf09efb76d081ade6661b70cfc91fbcef2e1048723caf7c7f1e5ff09d4b149d58e722f4cd875074b2cd4130a6e4aa1067b4d83928513d98ede2e064214ae408d7ec15bcb42931362081f6fa8de5b6d7b9149651a6ee3e0b04748496f69581dfa504e42bcb3599fd858f315424166c79744b41865f862570f1c1a7be805f57391f690c00f9b6c6baf99c9906c86362e7db0faf042444b875a8842035875bc7c7f812003cb987c4239b5c00c395eebf981edb4b972773f986bcaa1371fc0e03a48581e0a646f74c29f4d4ea48d6233e60f441f1bf17d643aa2975cea687ec6fc8805154736336612a9b2db2dc5650f853cc0fd3dbf1d44fbed345d758df53e07b8480efc1319c614fa311d21e77c5e0cad3c3171407c18131618a1c5b59462db29e554a33c7e3d4c4e44a636e5feff30f4a61901dea21b4b99cd541622350c076210af363bc48a165955ae56c2f0288a922fe6ed6d46b6e6221693a58b502d90324bde46e55893c5ce7ec3e9f8a03902ba6964e183cf41f16b42d58476b3746f3b3813f48137d410da9c6e8ea3045fd1eeb31bb4597e3e6e8361520e2841e67d4e3d9a5ef42610ac014cf6e4a3d83cc016b36a6173831e93b4e23f0a28d0160b4a8de954f20867b16cf07292ced5879c31e8599b643af57aaffd02e04bdbea75afe2b858c774552b8f880633203842380c49b1513a1436f1a17b789bd569ba15ef0fc9685c847025032dfb9b3a7e9a221973b37a907594783dcd695d03b11ca5db2a63d91cf7bb930bc38ed2115ffd93bd500605603e13abd63cc9981d90e30aaeae8b6f813949073a03b85994561bee145bd38abf3bbd239f3df0885f232585499c1fae5a6561954c83cd90a21d4bfc832340557ab0405bb7b46dcdbeb9fa1e912c98a1ca08c68d2e4f65dfe2c1548aea88bbb689a50152ef08a2b0934154ed40b01ed706ec919076a2c0fadc83af520e97a2b4bde816d0f34996665e0bf6372064f61724dd22e6fcb807815b8fa7ad5ffe964f5d646f76dd777c6a98b4592982d2a85936d096a514798d6f76720a6826aae2faad12fbafa3d18b5ea8dca4b1c93c5d7ce9b66670a76177a1fac1633bf3a3c94bef9c2cdbffa4550b5c2ab8e28a277e27da153823b57c71f6cf37971be9fa46654681326e2a58ade750e85c75a8c2a73c48c640cd5eb15a8f0d1d261fdb9bec3a7cc625363b9779365ed26dc4262357f6947550b764ac6fd804bd3fc2b17b1d502a728877adee59732504f875d1d7c67cd3a7fc9ea05deb53ccadeafeb4aa3e6753d544505a72659814fec8b69b99bef78b13bb5ab89d5f65b0bbcbe70d37ad7c2dbdc2c3a70a485c5b0a13e19decde980d51add54fb7238f06971ea0a0855679d676ce8e39d23c7e34dfeed2e573f3278721754a034bf61f6ef88647ec9e86f1d7653f2a066687b5a15cff58a5b0f9e710bdcefcecaab62f36e5accb6523add10ff85a2b62e67ba08200ccadc9ecf8bb54574d89cc724713e0e3b6eacad3c2e262cf9fe820b86cbdd2a9bd470e92431de9abacb1e6209bde1f932068cf5a13d1508fc7f238d75d3ff8b723052fa4f438cefcfb38543722a3b4f8f47737e99df87c28ed8e84cdf9739911530afd25543a57d605844b3cc06ad322a8a5c5d7ed26baf753d2cb69f5f8f4afb889ad4019bf909cdc8e5402dbf9ee20dced127f146e3348475a98b915ae98d63105731ce5f7d18f531f47749afa79a6f6a704de4259485dad6599ad84e24900b5afcd393710729d03fccd9fa22f3f895ad95ba12a8cdc88846442b5fc8950b3d5d6f7fb758dee7905a5ccd761643940af0de04875a7cf279eb2468301042b2d1cdd205b3ad2ae22ef46d36a67d72029be1cac603c461fc3ce2af138ecdfd83a0d39cd633cf9b2f964a461be17d33fdd01d3e1e18cf020d54b4083617f34aac444e9952cd6fd87b6f07f63b08947f15bf326a8e8e0d3c4fbc8fadcb9428ece7ddb7e9eb601680da45ca30af6c4b8bb302d3cf5338aaabb8a342fece91411533fa841687d0435fcfbb4a28425f903161acf8425898a9675b5d31815cd492adc4bf503007a75a8d383ffabf6f8911a5bc898f280907d006a6a06f0fd90f7c00f621cd87edb5b25f144ec5dc374f1419023ff7a59fb909ae5c6fd5e6f3327b71e084ff6631aa8a5a087e33cf1a22bad452c9ae30e9567934ba13cbca01523bc6e5d323ceacee072f97d0cde797a1217ab49cdbd6276d501497cb119191fe8aca71f0c9380af87b367850dc166f7484bd85e71e9d85465045ef2236b1af963c9202f25a794ebc8adbdffd237fb4980a62a579faa0d32fde6f5d1d25355df610b58ce09cd13a194352b1275957d23dd23728558965251a864279d9c8d6b67a4976268772bdf48516446583c2a4078b733a4739867ab8c4e54b5b4fdfd89e155f1ca492fff2919c2498370ee275f48710e13c0b33cecae62e1d1c1127479f06c2a3bbec38617e4cac4e66fee422dbe0bdae2a807e2a06c02061d5517b7c7c97de5f148bdacba73bb2137c24541614b2d05e7faf562757778dbfde7d28be61750b47386221e0fe48d49229ec084213b1f9d5364f4371b2d1828d0a6e2967bfe6c5b1850e99af6999757ae5d698ea8cb4f282601e86844bb3c543bfbf950875380a90fae2579d55de2438d6497f0428c5dad19df2d05f00a8397c54ca228bb0c5dbbd33724b0054805ac09d528a5cdcda6813506daa62d4fe7b408e94d76de5a03a56d7fbf25f98f5b6b6d9c41fe3b834ad474743c691d6c38824981a8cf8bcfbd6207f96d2d947289d61bb63451be0329474dbd6fd8d809ed97455c7bcae091d74f7bef4f51f2fe0660962e741d6b3eb9175a68fbb8c9a28f764f2a8fdb2b41df5f0a8af9705fb491ff01d1f79bddb0cc83f0c0ccd326450a20e70aea6b1eaa75f941dcfe05dcfb105c6fed83d9748731bc7d0c78b2be7cf4e7a3299fbe2528fb1eff703d73027643096dcd04b61b7d4ffc8f17cb439687247d2e9bbbd8b1d0826d3075f84b72ed60dcec2f28eb02a2f0d5c5aa91340f4cf12de4ba1138056638cbfa4c0c07c4e08d8d14d21b2ba2cd13f8f590f48736ea595f18cafe41c5a66a5da031aa6b45b4f35f3916baa47e26a5dbf3ef69977a5e93ba5d91076ce79f4c6af3aa2bc144e609f6722bb994191c75e7c997936a6092597fb7ee098a311f0e7205578a737a7c4f18b9baf1e8eebdc549c4d485a1b39b623e0e22abdf851fd62b8fd194cb011b16c5de8b44d053e28573d292f294fcae1957b3ffdf818d23b286dd10bfe5fcf89e9da1d52239a39fa899ca0509eaa43fdcf22d72620dc9e0a16d6b409290977941db57916bcd7c20f3ddb70762eddf048c606e8574cc7f896331353cb485b741b86c4f63ed1d13eed67a5825d86dc2fbc95eb4ceab1ef25357745bf7c891288c8613cca54e427315039c20ee732734dd195e340778971a0f183c59ef3bfb20ce31f7ac7249971d04ce905f98a9ef2672092f4b32673207fecfa58a29594ee55c92211ef58149e9453c563a20b02bcbd87ddf33245474a066d8492eee57a8b2763e6354e093c757d7a04388effda7b362204801f731c032f25322c983fa7f310f06dfda5020e762cff45a9fbc4aa227399d5057775ac09011548d6d3fc087177684250de8518d84b66b00443ce997ffea8fd3fa1da002cb7aef14791956fce8aaa07310919fdd3c8307fbc657095c3326ff90f5d77c970f4b8ffe68a077c29271039e425621528d4c1d6401f21feacac172af6729cf0bb789e82847562ba568e348294c48981f96340fd470d4ba771e2d74394d5c63636b7e33f31c6e6185ad87e6771b38bd841459fb97541532c272554b5093584b0b77af61ff0647e41cdc875ee54e741d79e4f8c495501b6d689be68a86db302d96b0220136924638850c496592a15e4ff731b46fddea23759e830bc5572e4322697dc2355075235b335ca6c1595ebc9baff6d8ce5712232b64ddd4b96460d1bd1876af3af7f4bb7d8f8821200f8c111b63dd15f91e2500aa312970f63c13177282ac83287057ceb064044ef3499eebf69ec090b4a3f90ebb0a984ae8be95cc7124ed12ae87dd6b220a6749fcce2c3ab7c08984cf62915b456460abc8c79e11e7ae763fc2ea84b1e80cd3596f14749963629b6023b22d5130cfe535d565abae46620047917b25036551f06ff8dbcab929ef945f5beb0a7f4c309a29f844fc8ff53d0d779b20d4089aea143ab19ac470656eea4e19ba24eeb5a70895e603a3e9831fcd4c7d208d28bc95f521fa573c2972a0bbb3ce3225157d7d5215a7a99a19f569f659f0b9bd161e966cc50371d977ea4f6e4c5284e91f1271b565d60c8bc5fe93aeb68e48807b7210c17ff5c859f22b965db3057518a4e7496806006333d085bbdaa55f17fc7ca95ca757d44b1cb6eeda6a4cc6b150457673c624970530c0bc398113b38e37e38dec19af1ab30ec6b3d3f4d16d3e34180d5943f4aa4435770b47d1de123ca261e25ceae4d0d6afefaf6c54e13017277e49e7e7632d593224ac3eed7a84accb845e197a95a8f6074b7b82e5183367d22e5fa878eff0feb33740293b245db49b7241deb19db83aab2de272792adb9d12f3f355bb86da18c4837c2cf8c276510040841e8a50cf225c4c092943dd10edf5379fcab3795b47b3af8cee1eefb6daa086ab1b05489cb2d257ae09c3e1f144ceffe880ebb82596da147351eec04b68dccd3bef09045b2480a93fd39c635bee63fdd40df75c06d0f88788dbc86ef9a7bb4129e382dda8a1b173d7c7603a83393b620b3c687cbf028e4f105c9c9f9d4bd4ab88c32a878df5b1dc70a3124f7ad5a153585bb0c3037b84cbef2a832fc961f9b1a7957a6404366540eae85ddaec374d4c930bcdd120e3ee22624bff8d6187e5d7d24e26eaacbc3538b36ccfa22e7dab869ef65453444ec27860689583a010c2f438c6f275be1d296b07c9bdfa86ef0fd0e6a28a8a65464c82cc68b24c05505f0af0d6bf1aab5ea227f6178d1c84a3b2411079546fc66ad092ae1960e54835f16a89902abc4525f0dd8f213d6adab159ecc74534fd9d9942d784ab715f12c55d69d9fccbad42ea174f836daff88a604792744484ef17ff1e13c90d200983d9071083d92ff1a342fa7b28448f86a11ecd38be8c093a7732cba6ddce1160e4305f4a0877f16bfe888a789e8e98ff14866ae72d4e38f09419cbb0601f699097fb51136429dbb69b5d6db0624ced9894d216e0fb1fab8ad73816eb0cb58dbcf2e8b3f6a94a63a21c4daaccfccc98c63eb1dd5c4ba872cdefed8cf1624480832066512972a8957f065315765c553a02c1e428d04d7cbbacb9e39434b2e9a7d0372940e22dc1975b510525ebef1149e2532ccea8e2e839dc73dd735e66e39201b94028006a8b0f0d55cda64c258331a44d1a64511302802baaf86d30f6ca458b1f66339bcb78e2fd3848b72559fdd65cfc35b940cf958395c6077d937c7c3016599ab0dbb10ea54411644b273d0cea30f77910a6eb47427b3956f287593724365141a57843b3d495ed598a69b091b002a5b33037daf42026f2d89d0dca7d5ee457f153a6d62642842514b30b940c72b58efbe935216b75e28783d4f68c2aabe740502340c48ded543c88bbeea27ce000f62e4acf2301c712a4aa9cbb29895c2602136d562f762ff0b3a1b9fd947483fb68d1b9b985336b98fa9b1ef4a0ef84f364cb95c075c7e0cfd31f347f1d10b484077475e3fdeb92b84f3f279837ee9ebb7a3904a0f719d2e698b91636bb3685b07f54d6b6f6cede535c184616a4bb16d1b5101e9d1805783e48d453650ab4b4cc7a2f371a4e45f3484374db738e0c39dbad5b30ba177eb02ee4783f73aaf998b4ca0bebc145056e6bbee206e930adf23276f8e3aa3715f387a12a2481a89691fef7bb2e6cbd88b1723f30210f1531f0d2d7f31d1a34969163011a28206b6a75d944af83c7eb6b056a8333288c08b416069e860c7d0e415d1925720efd3b1ba15d060d88e1ccddb85486f83f89bcc3ddc44145785337247dc59b3f132b49c27870bc7cfa8a945866c40a8f622a1cfe152be6b9f52dd360e9f6f6684b71318e7819d57bac90d02142b7f7ea0a4134aacda76ccb6b1f3e519dbf05f9fc2454c0a4dd6d4795504969d7b2c415aa887b3bb9b616d08e495f8c3dd4a6618ea27beebdd8c5edf05c09d3b23221ed09065ea284fbf5cb1164ebd5a1444d7960ca94d7fe8d087bf423a2515b240c67c6a6574d0b5204f21c464c5412c439553e2c7c72424f4cdb49f6acc731ae800e6b2b4bee21b1652b46f9e59075e9bae6658b0ceb8efd089143dcafb83c577a8ead94ac9b80cf73f57b34d680af16dece5a6598f2f51d8faf3ce7b450cc866027f958346f42029eab75cca5a173a5ae1161f02b7cd68377718d5347574b709e383ced9898a6d0620013d0a0e6dc9bd8bd8af6368fa39417dfef16894943618acb5ec79bed75b87a08bc611ecd757f40a3d8bcbe14bbc3d5b78a8e210564326992b515adb0f6a6e0da9db4c6695a9b648e133efd0f272287d08a038ccb25287fb5662f81f0e222a45bbe6623ea938551666c262703369c606bbf0f508e9df0837501a8a9339368c61d1cfb3d7547e3dd12ae71dced0d7ab6dba903051aa76edc8f7be2e79344076f6b78620c24f58a72d37365d000ba9bd09c45953fe8d8c96e8669e39736c73c48394b5b4b5fd720cfb9f2588e45404acb5fb6c04a44fc5e08d5a79b038b257c066359740db7d86da094a991eed66e39bdcd1833555713a2d5df2087222c4fbe76848bb1f9d8ca5c8ab65898581e71eb7ff5d80f3bb6416fcf013993ba4c96422a244cfd57d65278d399c899e34d3a7bc5f2ea894ed7120c77703d85808be8fd195e0ab1b2aecaff718cbdfed82631a323eb55321d3d3d551ac6a8203d122b1ddc7d0e6d6466c21b80bb36a7be0a1ab79e40fc8e9766a29b7f5ba790c0f4baa357cb7aed50ee3da3ea7fa966694e0100a05b6d565515380c09779b19bd9693245b3525089f32ff4dd06b21e7c1957c09e55fb77245be5727678be9c21864fca066e1f1216ae13d2632df50fecb85c3dfb84c5cfdbc9673e388865049958997553cd7a5f3145d0935b33702240d55ca7257506a063b3f66686c0bbfe5800097c35504c70dc3cb40de993b6a3d72a119484fca613b6a263034db284b0533d8dde5e0fb3abe9feadd102e2966c286bf5a15e1571c014e145cc290dce20cf9254fd9174bcf903ab27cc02dd9606902570f607e96a142090e1f6937ae6a56878f06a3b347bc0628f9c91612a5ccdebfe0a642fdcb8387a6b7d85ce6ef82c28523c284c05ab20b4c0ce5e34f481855a57cb8906ad259abe2c520a7369f9547275ff4e1db4e1033cfbfa09c9a2cb69828e4b91af4e548a1d3c46b6ef3469ab3d8a3c8106593c5db6ce943b88dd3a210d55f015d0c15f151a008d1b0ab3477fa325efe99ecc5379a62f48a40f637083d2693044e20e5eaab1dbbcbe5b52f29e9b7515d29ddcfc2662b30c9d94bef719fe63aac686faa9a06e69c94af64f32ef16439ed51819b25ac8b4146fffecd80d94a7423a94597bb74f38c38d5f5d5c47a5dac2b60894acb19c926820d573a7ed0d3676efda63f7f14f74e5542af5e609285420585f50a58ab2ad35a9a2f9036b264f96a86998b46f7cc7a5998175c39872b4622c0774ab8eb6e0920bbe6bf79660fcf9f8887aad3f0d26e095d638cdd98e19e79c1ee65841c4abdc49223f48e7d7d590318cd30703d610d14cb63324ce3ba53f29597f342bd1895dffc1a29ee48bdf36b565152225d420f74b314256463058ff2592886f3423fedaccc3044aad138335f9ee54a2b9caf9b0093c89150b5c3b9b76f8345fe89ee0cf9ac40e706eb8f236b4289953208248258316525a199f4d2db035a60cc04e823b2c78eb5f1fa773809959dee88d2430f24df864f171662d1c96080fb9acfd1fcb1ec1cf7f9d1c0282e72b0e340f6592f8efe09172ffee17b2ac4026d3d32e0382cfe8e098bd3439e9a55405635b2c15b0835c27a956a9b42ef5b71c439d6d2999a77c18e2ec036855c0427935bf70fcadbc188c8bc729b5fa8b6c4474b1ea35f3e2736d3e5dffff0fef8689fb79d1a6a16fc308e5b15fc840cb660894699273a13376120110cc450a6e0512b8ae964e0e2c6ebacfc737c70882bb1036d7e5a27e2c40b2c8b19efbe205d3b8222e6075094e36bd59bc2313d253add058dfb4c50379ab07f39799a7cd4bc44cbf7c24e597bfce2db9aef9f4733d0d64f70aee1683ad605174676e8f63fd7194bb27c1dc9d46e0bf6b0245965c1f66ad578fbc6dd502b068e8c4db9771ffa567b96b88bade2771b36d1b1331d51fc3273597c372308cadd8aa706398dd39a6eac6423df74e781e1acfaf00d20f02bf06602c104085b06f34343dfeecefc34e33d493d631b7f805d85f88c7c51e5e54ee2ad151d81c8230bf7a99fd9fa5d4ee6436c326d08a1dd7597667b220576e3f2b13ae26074f4468c7740c00f670a9641a771031370c22a83aaa74c42e7211e3b0a06f8f2959cd98665030c431c090fd694f44fec63854640d8c57ca859700ec2cf9e7d93cbe2b8d7ea53092b4455f26b5d32ef08611b9add0d62e3cd9d126cbf877900682e459626d12458d30aad953308acb2ae662b4f0b797a4c06eb5f686e1c9de269ca8614a2a6d7e867a904b73096622896d76118bc5744400760d6a34054f584c5754a235e122260e4ae5fdb81748b7dfe8f546df08f14abe904913dfb2ab15c47923c6647e3a7722816c69e0a794845c028e7d1461a69b6b1b83f7d208e0d2b3a25079c884757c8a49ac4a6c89fe906449c8fd14a2bf68b0b04ce5fbc23764c7a89f72fe6f17aaa19bc6ac73a38740c4d78aac6b111e1ec02feb", 0x2000, &(0x7f0000003a80)={&(0x7f0000002e40)={0x50, 0x0, 0x3ff, {0x7, 0x2d, 0x4, 0x14008000, 0x7, 0x40, 0x68, 0x200, 0x0, 0x0, 0x10, 0x7fffffff}}, &(0x7f0000002ec0)={0x18, 0x0, 0x529, {0x7}}, &(0x7f0000002f00)={0x18, 0xfffffffffffffff5, 0x9, {0x100}}, &(0x7f0000002f40)={0x18, 0x0, 0x8053, {0x8}}, &(0x7f0000002f80)={0x18, 0x0, 0x10, {0x5}}, &(0x7f0000002fc0)={0x28, 0x0, 0x68, {{0x8, 0x200, 0x1, r8}}}, &(0x7f0000003000)={0x60, 0x0, 0x7, {{0x2, 0x1, 0x3, 0x4, 0x8, 0x5, 0x0, 0x1}}}, &(0x7f0000003080)={0x18, 0x0, 0xb, {0x1}}, &(0x7f00000030c0)={0x1c, 0xffffffffffffffda, 0x3, {'/dev/video#\x00'}}, &(0x7f0000003100)={0x20, 0x0, 0x81, {0x0, 0x1f}}, &(0x7f0000003200)={0x78, 0x0, 0x7f, {0x5, 0x5, 0x0, {0x0, 0x3, 0xffffffffffffffff, 0x198e9d4b, 0x200, 0x1, 0x6, 0x9, 0x9, 0x6000, 0x1, 0xffffffffffffffff, r9, 0x4, 0x8}}}, &(0x7f0000003300)={0x90, 0xfffffffffffffffe, 0x2, {0x3, 0x2, 0x7, 0xee7d, 0x81, 0x9, {0x1, 0x511, 0x1, 0xffffffffffffffff, 0x1, 0x8000, 0x6, 0x3, 0xfffffff8, 0x1000, 0xd, r10, r11, 0x73d, 0x6}}}, &(0x7f00000033c0)={0x78, 0x0, 0x3c0, [{0x0, 0x7, 0x8, 0x1f7, '&-[/v[($'}, {0x4, 0x931f, 0x0, 0x7fffffff}, {0x5, 0x854c, 0x0, 0x1}, {0x5, 0x9, 0x0, 0x54b}]}, &(0x7f0000003500)={0xb8, 0x0, 0xffffffffffffffe1, [{{0x2, 0x1, 0x2, 0xffffffff, 0x33, 0x41f4, {0x6, 0xa, 0x0, 0xfffffffffffffffb, 0x9, 0x5, 0xa9, 0x10, 0x8846, 0x0, 0xeb4, r12, r13, 0x9, 0x6}}, {0x1, 0x9, 0xc, 0x1, '/dev/video#\x00'}}]}, &(0x7f0000003700)={0xa0, 0x0, 0x3, {{0x4, 0x0, 0xfc18, 0x5, 0x3, 0x1000, {0x2, 0xffffffffffffff8e, 0x3, 0x81, 0x0, 0x7ff, 0x3, 0x7, 0x5, 0xa000, 0x5f1, r14, 0xee00, 0xb, 0xffff}}, {0x0, 0x2}}}, &(0x7f00000037c0)={0x20, 0x0, 0x2, {0x250, 0x0, 0x7, 0xb}}, &(0x7f0000003940)={0x130, 0xfffffffffffffff5, 0x7f, {0x1, 0x1f, 0x0, '\x00', {0x1, 0x5, 0x401, 0x3ff, 0xee01, r15, 0x6000, '\x00', 0x6, 0x3, 0xffffffffffffffc0, 0x2, {0x2, 0x5}, {0xfff, 0x9}, {0x100000000, 0x3}, {0x7fffffff, 0x3}, 0x7, 0x1, 0x9, 0x9}}}}) (async) r16 = openat(0xffffffffffffffff, &(0x7f0000003b40)='./file0\x00', 0x4000, 0xc2) ioctl$DRM_IOCTL_GET_STATS(r16, 0x80f86406, &(0x7f0000003b80)=""/127) (async) write$FUSE_NOTIFY_INVAL_INODE(r16, &(0x7f0000003c00)={0x28, 0x2, 0x0, {0x2, 0x8, 0x8}}, 0x28) 7.305367394s ago: executing program 1 (id=1072): r0 = socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r1, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x7ffff000}], 0x1, 0x0) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000800000/0x800000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x15) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newlink={0x60, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x37c13, 0x51a23}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @loopback={0xff00000000000000, 0xfffffffffffffffe}}, @IFLA_GRE_LOCAL={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @remote}}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4048875}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRES16=r0], 0x24}}, 0x4000800) 7.027184974s ago: executing program 0 (id=1074): r0 = socket(0x10, 0x3, 0x0) (async, rerun: 32) r1 = socket(0x10, 0x803, 0x0) (rerun: 32) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a400000", @ANYRES32=r1, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c"], 0x48}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) (async) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f00000000c0)=0x83) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[], 0x50}}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000047, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 6.733086554s ago: executing program 1 (id=1077): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000086a82, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x28011, r1, 0x3554000) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x8}}, 0x20) fadvise64(r1, 0x3, 0x4000000005, 0x4) (fail_nth: 3) 6.050611751s ago: executing program 0 (id=1080): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fanotify_init(0x200, 0x48801) fanotify_mark(r6, 0x1, 0x1001, r4, 0x0) write$vhost_msg_v2(r5, &(0x7f0000002b00)={0x2, 0x0, {0x0, 0x0, 0x0, 0x1, 0x4}}, 0x48) syz_open_procfs$namespace(0x0, 0x0) r7 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r7, &(0x7f0000000680)={&(0x7f0000000140)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000180)='W', 0x1}], 0x1}, 0x0) r8 = socket$kcm(0x10, 0x2, 0x4) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x0, 0x81, 0xffffffff}) recvmsg$kcm(r8, &(0x7f0000002f80)={0x0, 0x0, 0x0}, 0x10000) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x7a, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, &(0x7f0000000540)) ioctl$KVM_RUN(r9, 0xae80, 0x0) syz_usb_disconnect(0xffffffffffffffff) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r5, &(0x7f0000000480)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000440)={&(0x7f0000000300)={0x1c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x20008000) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r4, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000380)={0x6c, 0x0, 0x30c, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x7f}]}, 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4c840) socket$nl_netfilter(0x10, 0x3, 0xc) 5.38658403s ago: executing program 4 (id=1084): r0 = shmget$private(0x0, 0x800000, 0x54003f00, &(0x7f0000800000/0x800000)=nil) shmat(r0, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, 0x0, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe000031f, 0x0, "ff00000058b274e6d845167fefe428970548fc3c7b00000000000000fcff00", 0xb2, 0xb, 0x6, 0x6}, 0x3c) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = userfaultfd(0x801) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0xc) fcntl$setown(r3, 0x8, r4) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) setns(r6, 0x24020000) r7 = syz_clone(0x102c8000, 0x0, 0xfffffffffffffef7, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace(0x8, r7) wait4(r7, 0x0, 0x2, 0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x300}) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) syz_clone(0x70044000, 0x0, 0x0, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x4000) r9 = socket$inet_smc(0x2b, 0x1, 0x0) splice(r9, 0x0, r8, 0x0, 0x7, 0x3) ioctl$BLKTRACESETUP(r8, 0xc0481273, &(0x7f00000000c0)={'\x00', 0x1, 0x90f2, 0xa3e9, 0x1, 0x9, r5}) 5.220012935s ago: executing program 2 (id=1086): r0 = socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000005000100070000000900020073797a30000000001400078008001200000000000500150004000000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_open_dev$dri(&(0x7f0000000140), 0x4, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000001080)={&(0x7f0000000f80)=[0x0, 0x0], &(0x7f0000000fc0)=[0x0], &(0x7f0000001000)=[0x0], &(0x7f0000001040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2, 0x1, 0x1, 0x8}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r7, 0xc05064a7, &(0x7f00000010c0)={&(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000cc0)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000ec0)=[0x0, 0x0, 0x0], &(0x7f0000000f00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x3, 0x4, 0x0, r8}) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0x340, 0x340, 0x0, 0x340, 0x270, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [0x0, 0x0, 0xff000000], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x270}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) sendmsg$kcm(r0, &(0x7f0000000c80)={&(0x7f0000000200)=@l2={0x1f, 0x400, @none, 0x1ff, 0x1}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000280)="87ee88c59562b5f4623ec5cc4a13bc6de50d26bf2907aada90d6034a9faa4dac42", 0x21}, {0x0}, {&(0x7f0000000500)="04dca1e6d7a1b3d6b11e09e185a3511b2595cbdb7f53d1a96d13f82d34fc82acdc03429850500db51a80a28e2c619ba76cf793ae3f5e30ec33885be8b1d4300bc6dd57a8fd97b58ffc25088157f170e377a3bd757523142a7a77078116e0ca2760e9de", 0x63}, {0x0}], 0x4, &(0x7f0000001140)=ANY=[@ANYBLOB="58000000000000000301000002000000d3782934a409ddcde44388227926ce131ef1b3716cddc573e249efae40200a34f44961f4834935744ba6f5b0f96571c11914cfd27e0cfe1ea1846e06e5340d06870000000010000000000000000801000004000000000000", @ANYRESHEX=r6, @ANYBLOB="d1e1dadf0c73f8d50d9a7b11d096eb8955570aa4ac1b5446701d001ff2e612c382d2f2a4eb3fbe1227e5e7fbeddbe5f97175f7f7ca0f1e77ebb1914031d97d2bc43a7346de2c431c8e0c839e69f93caff1334e00d46dbfa3e4c7179515137eb89d25c6fbbde6452214cfb56b987b3c585affda2538a6c206f2edc61112bd981ca7636aa7046e5d34728a900d0e934d666e106c96111a72b977eeec3be86cdca3c1ecd07b2225caff2035bb6fd9639983df21cc682d"], 0x68}, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) syz_open_dev$evdev(&(0x7f0000000300), 0x4, 0x40a200) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r11 = socket$netlink(0x10, 0x3, 0x0) socket(0x200000000000011, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000004a0001002bbd7000fddbdf250a008000", @ANYRES32=0x0, @ANYBLOB="0700000014000100ff"], 0x30}, 0x1, 0x0, 0x0, 0xc0}, 0x4000000) sendmsg$nl_route(r11, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32], 0x3c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r9, 0x84, 0x85, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f0000000840)={r10, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xd, 0x7, 0x4}, 0x9c) 3.147955776s ago: executing program 2 (id=1089): r0 = socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000005000100070000000900020073797a30000000001400078008001200000000000500150004000000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_open_dev$dri(&(0x7f0000000140), 0x4, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000001080)={&(0x7f0000000f80)=[0x0, 0x0], &(0x7f0000000fc0)=[0x0], &(0x7f0000001000)=[0x0], &(0x7f0000001040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2, 0x1, 0x1, 0x8}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r7, 0xc05064a7, &(0x7f00000010c0)={&(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000cc0)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000ec0)=[0x0, 0x0, 0x0], &(0x7f0000000f00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x3, 0x4, 0x0, r8}) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0x340, 0x340, 0x0, 0x340, 0x270, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [0x0, 0x0, 0xff000000], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x270}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) sendmsg$kcm(r0, &(0x7f0000000c80)={&(0x7f0000000200)=@l2={0x1f, 0x400, @none, 0x1ff, 0x1}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000280)="87ee88c59562b5f4623ec5cc4a13bc6de50d26bf2907aada90d6034a9faa4dac42", 0x21}, {&(0x7f0000000400)="71f6485a5da09b0cde83f4f9e1522c4d53d1db87057febbd7d24e1462ac9d3f5ceeabe9af81bee55cc636f2bba2d065be1544e73be6d675ef0ce7df253535f652977610cfd2f79c19a24d0749b181e1aa6a5d64fe669a0ec9206a2c016be765ce9132b5d6d84263e60ae421ed31de163a13672963feede0730617dd8f79c319ec4f6f7e1d1d85c49de85803a4965f0328ee175587c3516a623c8d6e50ad5d5425d094c951da0d56579b3f8735f075f9121261dbab9008cd75a9f26c596cfae00153a0e8f7d1a165902c3120102c02062b26da3c3b8f06bdb3f69adafcf23d8f4547ae8176ec2a9bd1acb67abb701deb6dee1eda68ac81a8f67", 0xf9}, {&(0x7f0000000500)="04dca1e6d7a1b3d6b11e09e185a3511b2595cbdb7f53d1a96d13f82d34fc82acdc03429850500db51a80a28e2c619ba76cf793ae3f5e30ec33885be8b1d4300bc6dd57a8fd97b58ffc25088157f170e377a3bd757523142a7a77078116e0ca2760e9de", 0x63}, {&(0x7f0000000580)}], 0x4, &(0x7f0000001140)=ANY=[@ANYBLOB="58000000000000000301000002000000d3782934a409ddcde44388227926ce131ef1b3716cddc573e249efae40200a34f44961f4834935744ba6f5b0f96571c11914cfd27e0cfe1ea1846e06e5340d06870000000010000000000000000801000004000000000000", @ANYRESHEX=r6, @ANYBLOB="d1e1dadf0c73f8d50d9a7b11d096eb8955570aa4ac1b5446701d001ff2e612c382d2f2a4eb3fbe1227e5e7fbeddbe5f97175f7f7ca0f1e77ebb1914031d97d2bc43a7346de2c431c8e0c839e69f93caff1334e00d46dbfa3e4c7179515137eb89d25c6fbbde6452214cfb56b987b3c585affda2538a6c206f2edc61112bd981ca7636aa7046e5d34728a900d0e934d666e106c96111a72b977eeec3be86cdca3c1ecd07b2225caff2035bb6fd9639983df21cc682d"], 0x68}, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) syz_open_dev$evdev(&(0x7f0000000300), 0x4, 0x40a200) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r11 = socket$netlink(0x10, 0x3, 0x0) socket(0x200000000000011, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000004a0001002bbd7000fddbdf250a008000", @ANYRES32=0x0, @ANYBLOB="0700000014000100ff"], 0x30}, 0x1, 0x0, 0x0, 0xc0}, 0x4000000) sendmsg$nl_route(r11, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a", @ANYRES32], 0x3c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r9, 0x84, 0x85, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f0000000840)={r10, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xd, 0x7, 0x4}, 0x9c) 3.044021325s ago: executing program 0 (id=1091): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000000c0)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="0503d6fcd3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 2.949996161s ago: executing program 0 (id=1093): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) 2.75140416s ago: executing program 0 (id=1094): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x8101, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000140)={&(0x7f0000000000)={0xa, 0x4e22, 0xfffffffb, @mcast2, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="280000000000000029000000040000002b0110000700010004"], 0x28}, 0x4004004) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0x2, 0x4, 0x4, 0x9}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x4, 0x4, 0x1000, 0x1, r4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r5}, &(0x7f0000000840), &(0x7f0000000880)=r4}, 0x20) close(0x3) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="c744240077dd0000c74424027fbe0000c7442406000000000f011c24b8010000000f01c1450f01ca470f01f8666bf80cb8e4f61882ef66bafc0c66b8795966ef40250000000066b8de000f00d02e0f005ffa0f01c92e640fc71f", 0x5a}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000003c0)) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000300)={[0x2, 0x4, 0x9, 0x2, 0x4, 0xffffffff7fffffff, 0x1003, 0x3, 0x9b9, 0xfff, 0xf, 0x3, 0x2b5f7546, 0xfffffffffffffc00, 0x400, 0xffff], 0x100000, 0x1feb97}) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0208000004000000040000000900060000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r5}, &(0x7f0000000180), &(0x7f00000002c0)=r4}, 0x20) r9 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f0000000a00)='cifs.idmap\x00', &(0x7f0000000a40)={'syz', 0x1}, &(0x7f0000000a80)="52bc83e5f87d55b6e5837b03acc4292a898d02a16852500768089c00597a4f5561", 0xfffff, r9) 2.373953697s ago: executing program 0 (id=1096): socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00220f000000b01b4550182185f57586b3"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) fcntl$lock(r2, 0x25, &(0x7f0000000040)={0x0, 0x4, 0x5, 0x9, 0xffffffffffffffff}) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r4, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r4, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) bind$tipc(r3, 0x0, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000c00)=[{&(0x7f0000000d40)="afae56bf1e411c41b3a35dfd00000000000800000000000000000000000000a673174e2d22bc3b74e18be610370c5453aedf68fa2de188bde5be6c7e", 0x3c}], 0x1, 0x2) r7 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r7, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) connect$inet(r7, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r5, 0x0, r7, 0x0, 0x8000, 0x0) r8 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x40) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) write$binfmt_misc(r10, &(0x7f0000000000), 0xfffffecc) splice(r9, 0x0, r11, 0x0, 0x14, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r8, 0x40345410, &(0x7f0000000040)={{0x1, 0x1, 0x4}}) ioctl$SNDRV_TIMER_IOCTL_INFO(r8, 0x80e85411, &(0x7f0000019200)) 2.259542709s ago: executing program 3 (id=1097): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x48}, 0x1, 0x2000000000000000}, 0x0) 2.17054238s ago: executing program 4 (id=1098): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) (async, rerun: 32) r1 = eventfd(0x0) (async, rerun: 32) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) (async) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000780)={0x1, r1}) (async, rerun: 64) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) (async, rerun: 64) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) (async, rerun: 64) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) (async, rerun: 64) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x3fb, 0x7fff}) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a32000000007c000000060a010400000000000000000100000208000b400000000054000480340001800b000100657874686472000024000280080001400000000c0800034000000002080004400000002205000200070000001c0001800a000100696e6e65720000020c000280b0ff0240000000790900010073797a30"], 0xf0}, 0x1, 0x0, 0x0, 0x24040870}, 0x0) 2.098531641s ago: executing program 3 (id=1099): r0 = socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000005000100070000000900020073797a30000000001400078008001200000000000500150004000000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_open_dev$dri(&(0x7f0000000140), 0x4, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000001080)={&(0x7f0000000f80)=[0x0, 0x0], &(0x7f0000000fc0)=[0x0], &(0x7f0000001000)=[0x0], &(0x7f0000001040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2, 0x1, 0x1, 0x8}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r7, 0xc05064a7, &(0x7f00000010c0)={&(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000cc0)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000ec0)=[0x0, 0x0, 0x0], &(0x7f0000000f00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x3, 0x4, 0x0, r8}) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0x340, 0x340, 0x0, 0x340, 0x270, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [0x0, 0x0, 0xff000000], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x270}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) sendmsg$kcm(r0, &(0x7f0000000c80)={&(0x7f0000000200)=@l2={0x1f, 0x400, @none, 0x1ff, 0x1}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000280)="87ee88c59562b5f4623ec5cc4a13bc6de50d26bf2907aada90d6034a9faa4dac42", 0x21}, {0x0}, {&(0x7f0000000500)="04dca1e6d7a1b3d6b11e09e185a3511b2595cbdb7f53d1a96d13f82d34fc82acdc03429850500db51a80a28e2c619ba76cf793ae3f5e30ec33885be8b1d4300bc6dd57a8fd97b58ffc25088157f170e377a3bd757523142a7a77078116e0ca2760e9de", 0x63}, {0x0}], 0x4, &(0x7f0000001140)=ANY=[@ANYBLOB="58000000000000000301000002000000d3782934a409ddcde44388227926ce131ef1b3716cddc573e249efae40200a34f44961f4834935744ba6f5b0f96571c11914cfd27e0cfe1ea1846e06e5340d06870000000010000000000000000801000004000000000000", @ANYRESHEX=r6, @ANYBLOB="d1e1dadf0c73f8d50d9a7b11d096eb8955570aa4ac1b5446701d001ff2e612c382d2f2a4eb3fbe1227e5e7fbeddbe5f97175f7f7ca0f1e77ebb1914031d97d2bc43a7346de2c431c8e0c839e69f93caff1334e00d46dbfa3e4c7179515137eb89d25c6fbbde6452214cfb56b987b3c585affda2538a6c206f2edc61112bd981ca7636aa7046e5d34728a900d0e934d666e106c96111a72b977eeec3be86cdca3c1ecd07b2225caff2035bb6fd9639983df21cc682d"], 0x68}, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) syz_open_dev$evdev(&(0x7f0000000300), 0x4, 0x40a200) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r11 = socket$netlink(0x10, 0x3, 0x0) socket(0x200000000000011, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000004a0001002bbd7000fddbdf250a008000", @ANYRES32=0x0, @ANYBLOB="0700000014000100ff"], 0x30}, 0x1, 0x0, 0x0, 0xc0}, 0x4000000) sendmsg$nl_route(r11, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32], 0x3c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r9, 0x84, 0x85, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f0000000840)={r10, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xd, 0x7, 0x4}, 0x9c) 1.915623449s ago: executing program 4 (id=1100): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYRES32=r0, @ANYRES32=r0], 0x2c}}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYRES32=r0, @ANYRES32=r0], 0x2c}}, 0x80) (async) 1.709200352s ago: executing program 4 (id=1101): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@multicast1, @in=@private=0xa010101, 0x0, 0x0, 0x4e20, 0x0, 0x2}, {0x0, 0x0, 0x6}, {}, 0xb, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x1, 0x6c}, 0x0, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x9}}, 0xe8) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}, 0xfffd}, 0x1c) 1.51819161s ago: executing program 4 (id=1102): arch_prctl$ARCH_SET_CPUID(0x1012, 0x3) socket(0x1, 0x1, 0x0) r0 = inotify_init() memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c464a030403ff0700000000000002000300040000003e03000038000000d6000000977000007e03200007", @ANYRES16], 0x38) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r1 = syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = fsopen(&(0x7f0000000140)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40, 0x5) close_range(r0, 0xffffffffffffffff, 0x0) 1.50392476s ago: executing program 2 (id=1103): r0 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r0, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000000400)=[{&(0x7f0000001040)="5346f7f875528ef24043c68e04180a332e94ee4784fffee263c06f2d924e8699b6af71aa257b5a316af31628e5148c7012f4d55ce4c29fea9e5b0b61fdf0b2dc866fa81b4e775e235eaebe330e16114548f147b8a966bf1f1fc6c24b9d47d349c87c3f789d2ba608cd25b17b6c80a7f0ceb4a06ff270ff8c9f0d3a19133f1fdfd51b767b8cef1f36e5490c5df5fcb378a6fb6eb5d8aaf7791ce81f61a05e1ebdd1789eb70ac1f3dfed378f6f3e237120052113a75ab977796117f7e7b2d6ee499f51dc070c820d10a0eaef4fc94ddc648bafae070caf70c465267497b3de963df649e113e2060c82b057abfae0798d424c81aeb42796189eb0936a2c547a5c4d6351ed786c75beb926118fb7af49ecc00b545fe2563bd4294a982980afed3f9cf390f304611db4c6d7b64d64f38db5fde5cf7cadb29c697013b710e0218660671d0051ddd7fb7f5eb72a34f469b2e20600000091817eb5b952af43d1a40f4770e7220fcdfe25d3e9747e2af76ece5922724840afdba6f6f9e1d11db8561e8e836413ee04d6e084700ec1ac0e00569f0e4d4844f4710299aabbef615c33e276544669ce074528938ec0cc6d2af1ce7a47a64ad676f08507aa08d4210f979ef4aacfa4d524c9952d4743d65c3c527302942a8880116ce7ebc6c84778346f02c806bb466db7d313d7ebc7ea87823d4a8de0b697929fb3277012327827801f75ca3c5776d1a81acb160007f73148dfaf05ab7eed5a0e603ac468eb2bcd9de5f140758e74c20a9931187e0cbc857aa62a4cec8a62f7e31af3a78cdb8608551cdd68e83aebb3c9e05519184ff996c336553fa6bf16865cd6c4eacf1e360b029cdae41070f5fd183ea0eaae427505d56994ccfd0737aae3abbc45f56710d2e3f2662bf4514044f7fa03cde28fa1783970d3c676cb23cb1923a9feb233267ef663936ccf25f7597a2270724527bf468d22786d0548b25582180b72c51742c4e5c373a1008dd4cfba508e8f3f8ec35e6f1375a11b1fbe2dc09e9fe609e80112c8f5c895c922cd547def707b7252d7afa0030d008b1dd10fd4a56e30237a6e0229fb4562cb8df3d4e64b28e15c075e59554e9d61a6065d49c1e765a49195cf5d6b1e2b6192447817fedfe41fcdf9a4fc5af567906e4b6453da7b97eac255cc253d7bceba09f67da4815438583c6843366b76d9e9277558e48681e9cfa920b47aea0e5c46ef86ea7f1ef534cf7565b24b833ba2cbfe60e6271614850dd68f2a8a6be4f315b83abb8e2699ed8e2a4b3506f9dacbb180c4deeef7489f49faf34cdf4e91a402956564f854d71c892e4aada1c91647ce45d4834d000e8d5be1773ecae388e511228977a69d4cc67fbab60ee1555a219e41eebc31807a87d9cbe88a8b05959e1a988f6ea6ed73a6ac1ec2f3d74d73eaa91a39308e008b7fa1ecc2a020f495750f9936d9c07130d950a777c0d8d131416ef55a4ec041113df65ba4aea92fcb3e2268510f316bd17f04993b647333", 0x42c}, {&(0x7f0000000740)="0d113311d7af2c7d0a6b8bcc9ab77974b333be01b290ffa314fa9cb227694f5b326544c9c1d4563f937db955e0373639d6292234c292c5615d82c851b91585b7ad8748faf0d8e5d65994adbb137c7851edbb4a3485ffd64e1caf3117861898d4ba6e04c15a94496cc8c23793136c93ba88db52f098b37fcf3f6c16df2f500f5b2005def16d46d96544649249c26098820ed60c94032f6fc134664ae10a613d15d140a948b4b45471dea34c0f527fca192dfa77f262ec22b914476238014687f231fe251b57f7689e4850e2c1eaf49ad1773a1f971ba9d8a900e5e2121370ebf1a0c8af1eca3921046277767b7740008731fdcffcddbc2cb867ea2959a735c164e4c650454d43dd6034dd22e31d94df846ab6d1b1e7c2463e349ffda978a5e783bdda9e6fafb2ca73fb02ccc54ab9309988741fdfbef9000b605a2d3890468834f7d7f705f8da1905283343b78f30bc48c2c3c351e955823ca8e6e82f695252f0aecc64025cf1e26d4b", 0x169}], 0x2, &(0x7f0000000580)=[@ip_pktinfo={{0x1c, 0xa000000, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x14}, @local}}}], 0x20}, 0x0) 1.314989664s ago: executing program 2 (id=1104): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) 1.273843396s ago: executing program 2 (id=1105): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r0, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}], 0x1}}], 0x1, 0x41) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000340)={0x1d, r3, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r2, &(0x7f0000007480)=[{{0x0, 0x0, &(0x7f00000051c0)=[{&(0x7f0000000200)="14733f9daa4e98c0b3", 0x9}], 0x1}}], 0x1, 0xfeffffffffffff) 498.766074ms ago: executing program 3 (id=1106): syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x1, 0x9, 0x30, 0x66, 0x0, 0x5, 0x1, 0x0, @private=0xa010101, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x0, 0x2, 0x0, {0x5, 0x4, 0x0, 0x2f, 0x3b, 0x65, 0x7b98, 0x40, 0x6, 0x21c, @multicast1, @loopback}}}}}}, 0x0) 403.660849ms ago: executing program 3 (id=1107): sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x88, 0x2c, 0x6f14cf9ac61f9c9b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff8, 0xfff, 0x0, 0x5, 0xb}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x88}}, 0x24000000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0xfffffffc) 373.574189ms ago: executing program 2 (id=1108): mknodat$loop(0xffffffffffffffff, 0x0, 0x4, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000020dd25d2f337d2542d000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000740)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) r3 = syz_open_dev$hiddev(&(0x7f0000000000), 0x0, 0x880) ioctl$HIDIOCGUCODE(r3, 0xc018480d, &(0x7f0000000080)={0x3, 0x1, 0xc, 0x7, 0x6, 0x9e}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xfbffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x400) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000005c0)=@newtfilter={0x80, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r5, {0xffff, 0x5}, {}, {0x10, 0xffff}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x50, 0x2, [@TCA_CGROUP_POLICE={0x4c, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x2, 0x3, 0xffffff94, 0xfff, {0xb, 0x2, 0x89df, 0xfff, 0x2, 0x6}, {0x6, 0x2, 0x1ec, 0x9, 0x4, 0x9}, 0x100, 0xfffffffb, 0x6}}, @TCA_POLICE_RATE64={0xc, 0x8, 0x6}]}]}}]}, 0x80}}, 0x4800) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) getresuid(&(0x7f0000000b40), &(0x7f0000000040), &(0x7f00000000c0)) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r8, 0xc040aed5, &(0x7f0000000240)={0x0, 0x107000}) r9 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x44000, 0x0) mmap(&(0x7f00003c7000/0x1000)=nil, 0x1000, 0xb635773f06ebbeee, 0x8031, r9, 0x0) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) gettimeofday(&(0x7f0000000000), 0x0) mlock2(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0) mlock2(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x1) r10 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r10, 0x8010500c, &(0x7f0000000000)) mlock2(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0) 322.658345ms ago: executing program 3 (id=1109): socket$kcm(0x2b, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x40000, 0x73) getdents64(r0, &(0x7f0000000100)=""/134, 0x86) getdents64(r0, 0x0, 0x0) getdents64(r0, 0x0, 0x0) readlinkat(r0, &(0x7f0000000000)='./file0\x00', &(0x7f00000004c0)=""/199, 0xc7) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000130d00"/20, @ANYRES32=0x0, @ANYBLOB="d11101000000000008000500", @ANYRES32=r2, @ANYBLOB="140012800c0001006d6163766c616e"], 0x3c}, 0x1, 0x0, 0x0, 0x4004014}, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000540)={'bond0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0x301}, {0xfffffffd}]}}) mkdirat(r0, 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000040), 0x12, 0xa0881) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000080)={0x20, 0x1, 0x0, 0x8, 0x0, 0xfffffff7, 0x0}) 174.170254ms ago: executing program 1 (id=1110): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) capset(&(0x7f0000000100)={0x19980330}, &(0x7f0000000140)={0x4, 0xe, 0x4, 0x7fff, 0xf, 0xe}) mount_setattr(0xffffffffffffff9c, 0x0, 0x100, &(0x7f0000000180)={0x10001e, 0x100074, 0x40000}, 0x20) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000005c0), r4) sendmsg$ETHTOOL_MSG_COALESCE_GET(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)={0x2c, r5, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000800}, 0x8080) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r6 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000201c1b100c00000000000109022d0001000060000904008002030000000921060400012205000905810320000908070905020340"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_ep_read(r6, 0x2, 0x0, 0x0) r7 = syz_io_uring_complete(0x0, 0x0) ioctl$XFS_IOC_DIOINFO(r7, 0x800c581e, &(0x7f0000000040)) syz_usb_control_io(r6, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[], 0xc0}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) syz_usb_ep_write(r6, 0x81, 0x10, &(0x7f0000000080)="116b41319ef13386d7fd40ac5cf9181c") mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x10) 79.571474ms ago: executing program 3 (id=1111): r0 = timerfd_create(0x1, 0x0) timerfd_gettime(r0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xe8381, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x4048aec9, &(0x7f0000000980)={0x1, 0x0, @ioapic={0xfee00, 0x296a, 0x4, 0x3, 0x0, [{0x98, 0x37, 0x81, '\x00', 0x7f}, {0x41, 0x8, 0x30, '\x00', 0xf5}, {0xe9, 0x1, 0x9, '\x00', 0x11}, {0x7, 0x9, 0x3, '\x00', 0x8f}, {0x3, 0x7f, 0x92, '\x00', 0xa}, {0xf, 0xe3, 0x8, '\x00', 0xaa}, {0x6, 0x8, 0x6, '\x00', 0x8}, {0x1, 0x3, 0x8, '\x00', 0x67}, {0x80, 0xfc, 0xa, '\x00', 0x8}, {0x8, 0x2, 0x13, '\x00', 0x9f}, {0x8, 0xa, 0x6, '\x00', 0x3}, {0x2, 0xa, 0x3, '\x00', 0xa}, {0x1e, 0x6, 0x3, '\x00', 0xa6}, {0x8, 0x0, 0x8, '\x00', 0x9}, {0x2, 0x4c, 0xa2, '\x00', 0x1}, {0x8, 0x5e, 0x4, '\x00', 0x7}, {0x5, 0xa0, 0x47, '\x00', 0x4}, {0x7, 0x3, 0x2, '\x00', 0xa7}, {0x5, 0x0, 0xf, '\x00', 0x7}, {0x5e, 0xa, 0x8}, {0x7f, 0x6, 0x7, '\x00', 0x4}, {0x93, 0x44, 0x9, '\x00', 0x10}, {0x5, 0x8, 0x20, '\x00', 0xfc}, {0x6, 0xc, 0xc6, '\x00', 0x8}]}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mkdirat(0xffffffffffffff9c, &(0x7f0000000d40)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x2040c2, &(0x7f0000002140)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) 0s ago: executing program 4 (id=1112): socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000280)={0xaa, 0x541}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f00006c6000/0x400000)=nil, &(0x7f0000685000/0x4000)=nil, 0x400000, 0x0, 0x18100}) r1 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) pipe2$watch_queue(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r1, r2, 0xac) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1a000000d1020000008000000000000080000000", @ANYRES32], 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x103200, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, 0x0, 0x0) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = memfd_create(&(0x7f0000000180)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaaSc\xf3]WhI\xf4\x89\x85!mPl\x90\xa5\x93\x19\f\x9a\xae\xd5a\x9bU5\x1a\x86\x9d)5y\xef\x90\xea5\x81\xfeO;\xd4zh?\xbdW\xe0\x84\xe6\x9d\xcb\xcd\xb6\xad3\x7fWY\x02\xa2\x8baG\x00\x0e\x8e/\xc1\xaf\xd0\xbcH9\x04\x00\x00\x00z\x16\xdf\xf3hLpLaA\x89n]>,^M\x82\x8e\xe40\x97_\x809y)Z\xeb\x9d\xbawv\xe9\xc0\x16\xdc\xf5\xcb\xdb\x96\xd6\xba@\xa7\x1bl\xca\xe0\x1e3\x81\xc6S\x86\xf7\xf0\xba\x1b\x14N\xa2\x04\xdb\xb5X\xe4y\xef\xe8\xdb\xd5r\x11\xfb\xe4v\xbcV\xbb\x00\x96CR\xe0~5\x16=:A2\x9c\b\xd9\xa0CB\r\xe9\xb8$\xfe\x8d\xb1Gg\xa9\xac<\xbf\x10]\b9\xd9\x89\xaf\xa6\xd1\x10\x1fq\xba\x06_NW\xdb67Xv(\xa8\xce\x1b\xe6\xbd\x947\x8f)8\xe5\xb3\xac;\x7f+\xf67\xea\x1ei\x92w-)\xa1B/M\x0e7:9\xdb~V\xb7\xd5\x13^v\x14\xe6O\xea\x00\x87\x8dkG\xdf%\xebe\x83\xb97\x01| \xb3\xd8W\xe8o\x17\x97\xd9\x14o\x92\xb9\x9a\x8c\xd7\xcf\xa2\x11\xc3\xa5\xb3\xd2\xdeQ\xa7\x05\x7f\x99Lq(\xcd\\\xa2y\x14or\x1efn\xf2\x97\x96c\xda7\t,', 0x5) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000002, 0x4010012, r7, 0x0) syz_clone3(&(0x7f00000002c0)={0x801400, &(0x7f0000000040), 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x58) ftruncate(r7, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) r8 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0xfc, 0x2f, 0x62, 0x40, 0x9c4, 0x11, 0x638, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x72, 0x6, 0x10, 0x6, "", [{{0x9, 0x4, 0xf0, 0xe8, 0x2, 0xb5, 0x1c, 0x80, 0x3, [], [{{0x9, 0x5, 0x1, 0x2, 0x3ff, 0xff, 0x10, 0x3}}, {{0x9, 0x5, 0xeb3925d0f91dd4ca, 0x2, 0x10, 0x10, 0x2, 0x81}}]}}]}}]}}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$cdc_ncm(r8, &(0x7f00000005c0)={0x14, &(0x7f0000000180)=ANY=[@ANYBLOB='@#\f'], 0x0}, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) kernel console output (not intermixed with test programs): r (Elgato EyeTV Sat) [ 188.898036][ T5365] usb 2-1: media controller created [ 188.926291][ T5365] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 188.936913][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 188.952947][ T10] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 188.983520][ T10] usb 4-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 189.006545][ T10] usb 4-1: config 0 interface 0 has no altsetting 0 [ 189.023899][ T10] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 189.063789][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.083363][ T7987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 189.102224][ T10] usb 4-1: Product: syz [ 189.110923][ T10] usb 4-1: Manufacturer: syz [ 189.121609][ T7987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 189.129687][ T10] usb 4-1: SerialNumber: syz [ 189.143154][ T10] usb 4-1: config 0 descriptor?? [ 189.185677][ T5773] usb 3-1: USB disconnect, device number 25 [ 189.239940][ T8010] netlink: 16 bytes leftover after parsing attributes in process `syz.1.689'. [ 189.316167][ T5365] az6027: usb out operation failed. (-71) [ 189.350273][ T5365] az6027: usb out operation failed. (-71) [ 189.374216][ T5365] stb0899_attach: Driver disabled by Kconfig [ 189.388595][ T5365] az6027: no front-end attached [ 189.388595][ T5365] [ 189.402686][ T5365] az6027: usb out operation failed. (-71) [ 189.416274][ T5365] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 189.447226][ T5365] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input14 [ 189.484794][ T5365] dvb-usb: schedule remote query interval to 400 msecs. [ 189.499800][ T5365] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 189.544655][ T5365] usb 2-1: USB disconnect, device number 19 [ 189.562377][ T10] gs_usb 4-1:0.0: Configuring for 256 interfaces [ 189.579061][ T10] gs_usb 4-1:0.0: Driver cannot handle more that 255 CAN interfaces [ 189.590028][ T10] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -22 [ 189.697195][ T5365] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 189.800269][ T10] usb 4-1: USB disconnect, device number 29 [ 190.013902][ T8023] netlink: 40 bytes leftover after parsing attributes in process `syz.2.698'. [ 190.354291][ T24] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 190.559336][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 190.583623][ T24] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 190.603134][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.641352][ T8042] netlink: 'syz.2.703': attribute type 62 has an invalid length. [ 190.655080][ T24] usb 2-1: config 0 descriptor?? [ 190.841215][ T8048] netlink: 28 bytes leftover after parsing attributes in process `syz.2.703'. [ 190.883553][ T24] usbhid 2-1:0.0: can't add hid device: -71 [ 190.899823][ T24] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 190.932698][ T24] usb 2-1: USB disconnect, device number 20 [ 191.174452][ T5706] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 191.447656][ T24] usb 2-1: new full-speed USB device number 21 using dummy_hcd [ 191.631216][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 191.666117][ T24] usb 2-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice= 0.40 [ 191.697188][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.736181][ T24] usb 2-1: config 0 descriptor?? [ 191.786837][ T24] input: USB Pegasus Device 0e20:0101 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input15 [ 192.017918][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.027381][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.036888][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.044217][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.051581][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.058961][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.066416][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.073827][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.081188][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.089882][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.097309][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.104705][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.112194][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.119896][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.127308][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.134606][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.141930][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.149249][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.156569][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.163856][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.171166][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.178532][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.185879][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.193260][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.200539][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.207823][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.215171][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.223025][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.230518][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.237864][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.245280][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.252630][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.260165][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.267592][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.274970][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.282343][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.289717][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.294431][ T4984] usb 2-1: control msg error: -71 [ 192.297043][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.297258][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.297445][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.297631][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.297817][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.298008][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.298202][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.354622][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.362213][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.369587][ C1] usb 2-1: pegasus_irq - nonzero urb status received: -71 [ 192.376801][ C1] usb 2-1: pegasus_irq - usb_submit_urb failed with result -1 [ 192.402297][ T24] usb 2-1: USB disconnect, device number 21 [ 193.662725][ T8126] netlink: 48 bytes leftover after parsing attributes in process `syz.2.719'. [ 193.837934][ T8130] FAULT_INJECTION: forcing a failure. [ 193.837934][ T8130] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 193.874457][ T8130] CPU: 1 UID: 0 PID: 8130 Comm: syz.2.721 Not tainted syzkaller #0 PREEMPT(full) [ 193.874483][ T8130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 193.874492][ T8130] Call Trace: [ 193.874500][ T8130] [ 193.874507][ T8130] dump_stack_lvl+0xe8/0x150 [ 193.874532][ T8130] should_fail_ex+0x412/0x560 [ 193.874555][ T8130] _copy_from_user+0x2d/0xb0 [ 193.874576][ T8130] ___sys_sendmsg+0x1c6/0x360 [ 193.874592][ T8130] ? __lock_acquire+0x6b5/0x2cf0 [ 193.874613][ T8130] ? __pfx____sys_sendmsg+0x10/0x10 [ 193.874627][ T8130] ? __lock_acquire+0x6b5/0x2cf0 [ 193.874649][ T8130] ? kstrtouint+0x6e/0xe0 [ 193.874717][ T8130] __sys_sendmmsg+0x27c/0x4e0 [ 193.874739][ T8130] ? __pfx___sys_sendmmsg+0x10/0x10 [ 193.874753][ T8130] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 193.874794][ T8130] ? ksys_write+0x242/0x270 [ 193.874818][ T8130] ? __pfx_ksys_write+0x10/0x10 [ 193.874845][ T8130] __x64_sys_sendmmsg+0xa0/0xc0 [ 193.874862][ T8130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.874879][ T8130] do_syscall_64+0x174/0x580 [ 193.874895][ T8130] ? trace_irq_disable+0x3b/0x140 [ 193.874917][ T8130] ? clear_bhb_loop+0x40/0x90 [ 193.874936][ T8130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.874951][ T8130] RIP: 0033:0x7fccce19ce59 [ 193.874970][ T8130] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 193.874983][ T8130] RSP: 002b:00007fcccf015028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 193.875001][ T8130] RAX: ffffffffffffffda RBX: 00007fccce415fa0 RCX: 00007fccce19ce59 [ 193.875012][ T8130] RDX: 0000000000000002 RSI: 0000200000003600 RDI: 0000000000000003 [ 193.875022][ T8130] RBP: 00007fcccf015090 R08: 0000000000000000 R09: 0000000000000000 [ 193.875032][ T8130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 193.875041][ T8130] R13: 00007fccce416038 R14: 00007fccce415fa0 R15: 00007fccce53fa48 [ 193.875065][ T8130] [ 194.169027][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.178438][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.394294][ T5706] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 194.576686][ T5706] usb 5-1: config 0 has an invalid interface number: 88 but max is 0 [ 194.608149][ T5706] usb 5-1: config 0 has no interface number 0 [ 194.630946][ T5706] usb 5-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=49.83 [ 194.653081][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.675676][ T5365] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 194.688396][ T5706] usb 5-1: Product: syz [ 194.699623][ T5706] usb 5-1: Manufacturer: syz [ 194.713031][ T5706] usb 5-1: SerialNumber: syz [ 194.750179][ T5706] usb 5-1: config 0 descriptor?? [ 194.845471][ T5365] usb 2-1: Using ep0 maxpacket: 32 [ 194.854019][ T5365] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 194.870105][ T5365] usb 2-1: config 0 has no interface number 0 [ 194.877848][ T5365] usb 2-1: config 0 interface 12 has no altsetting 0 [ 194.892730][ T5365] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 194.902759][ T5365] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.911941][ T5365] usb 2-1: Product: syz [ 194.921195][ T5365] usb 2-1: Manufacturer: syz [ 194.927289][ T5365] usb 2-1: SerialNumber: syz [ 194.941221][ T5365] usb 2-1: config 0 descriptor?? [ 194.984616][ T5706] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 195.177383][ T8154] fuse: Bad value for 'user_id' [ 195.183245][ T8154] fuse: Bad value for 'user_id' [ 195.380788][ T8163] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 195.390024][ T8163] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 195.401092][ T8163] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 195.421205][ T8133] netlink: 524 bytes leftover after parsing attributes in process `syz.4.724'. [ 195.442181][ T5706] gspca_m5602: Failed to find a sensor [ 195.447939][ T5706] ALi m5602 5-1:0.88: ALi m5602 webcam failed [ 195.472152][ T5706] usb 5-1: USB disconnect, device number 19 [ 195.514701][ T5692] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 195.544258][ T24] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 195.669456][ T5692] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 195.678825][ T5692] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.689387][ T5692] usb 4-1: config 0 descriptor?? [ 195.706190][ T24] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 195.719705][ T24] usb 3-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice= 0.40 [ 195.728880][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.736997][ T24] usb 3-1: Product: syz [ 195.741184][ T24] usb 3-1: Manufacturer: syz [ 195.746835][ T24] usb 3-1: SerialNumber: syz [ 195.900280][ T5692] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 195.969337][ T24] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 196.287427][ T5692] [drm:udl_init] *ERROR* Selecting channel failed [ 196.372858][ T5692] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 196.387649][ T24] usb 3-1: unit 80 not found! [ 196.392813][ T5692] [drm] Initialized udl on minor 2 [ 196.462207][ T5692] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 196.506233][ T5692] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 196.538774][ T5692] usb 4-1: USB disconnect, device number 30 [ 196.553371][ T5707] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 196.584868][ T5707] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 196.993177][ T8141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 197.014797][ T8141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 197.100609][ T5365] f81534 2-1:0.12: f81534_set_register: reg: 1002 data: 0 failed: -71 [ 197.112784][ T5365] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 197.130250][ T5365] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 197.156831][ T5365] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 197.193167][ T5365] usb 2-1: USB disconnect, device number 22 [ 198.114627][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 198.176348][ T5707] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 198.352709][ T24] usb 3-1: USB disconnect, device number 26 [ 198.364453][ T5707] usb 4-1: Using ep0 maxpacket: 32 [ 198.380917][ T5707] usb 4-1: config 0 has no interfaces? [ 198.397694][ T5707] usb 4-1: New USB device found, idVendor=12d6, idProduct=0444, bcdDevice=c6.e0 [ 198.425470][ T5707] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.443729][ T5707] usb 4-1: Product: syz [ 198.455350][ T5707] usb 4-1: Manufacturer: syz [ 198.460031][ T5707] usb 4-1: SerialNumber: syz [ 198.485267][ T5707] usb 4-1: config 0 descriptor?? [ 198.633565][ T5866] udevd[5866]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 198.689951][ T8198] batadv_slave_0: Caught tx_queue_len zero misconfig [ 199.228698][ T5707] usb 4-1: USB disconnect, device number 31 [ 199.542136][ T5631] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 199.553542][ T5631] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 199.572829][ T5631] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 199.582900][ T5631] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 199.593059][ T5631] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 199.866313][ T8230] FAULT_INJECTION: forcing a failure. [ 199.866313][ T8230] name fail_futex, interval 1, probability 0, space 0, times 1 [ 199.907935][ T8230] CPU: 1 UID: 0 PID: 8230 Comm: syz.3.751 Not tainted syzkaller #0 PREEMPT(full) [ 199.907963][ T8230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 199.907973][ T8230] Call Trace: [ 199.907980][ T8230] [ 199.907987][ T8230] dump_stack_lvl+0xe8/0x150 [ 199.908010][ T8230] should_fail_ex+0x412/0x560 [ 199.908031][ T8230] get_futex_key+0x1b0/0x1590 [ 199.908058][ T8230] ? __pfx_get_futex_key+0x10/0x10 [ 199.908072][ T8230] ? get_futex_key+0x11cd/0x1590 [ 199.908096][ T8230] futex_wait_setup+0x4c/0x560 [ 199.908121][ T8230] futex_wait_requeue_pi+0x349/0x980 [ 199.908143][ T8230] ? __pfx_futex_wait_requeue_pi+0x10/0x10 [ 199.908169][ T8230] ? kstrtouint+0x6e/0xe0 [ 199.908222][ T8230] ? get_pid_task+0x20/0x1f0 [ 199.908238][ T8230] ? get_pid_task+0x20/0x1f0 [ 199.908260][ T8230] ? __pfx_futex_wake_mark+0x10/0x10 [ 199.908290][ T8230] ? ksys_write+0x1e6/0x270 [ 199.908314][ T8230] do_futex+0x181/0x420 [ 199.908331][ T8230] ? __pfx_vfs_write+0x10/0x10 [ 199.908353][ T8230] ? __pfx_do_futex+0x10/0x10 [ 199.908377][ T8230] __se_sys_futex+0x3a8/0x450 [ 199.908399][ T8230] ? ksys_write+0x242/0x270 [ 199.908418][ T8230] ? __pfx___se_sys_futex+0x10/0x10 [ 199.908435][ T8230] ? __pfx_ksys_write+0x10/0x10 [ 199.908459][ T8230] ? __x64_sys_futex+0x21/0xf0 [ 199.908477][ T8230] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.908494][ T8230] do_syscall_64+0x174/0x580 [ 199.908510][ T8230] ? trace_irq_disable+0x3b/0x140 [ 199.908530][ T8230] ? clear_bhb_loop+0x40/0x90 [ 199.908549][ T8230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.908563][ T8230] RIP: 0033:0x7fb09019ce59 [ 199.908579][ T8230] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.908593][ T8230] RSP: 002b:00007fb091029028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 199.908614][ T8230] RAX: ffffffffffffffda RBX: 00007fb090415fa0 RCX: 00007fb09019ce59 [ 199.908625][ T8230] RDX: 0000000000000000 RSI: 000000000000000b RDI: 000020000000cffc [ 199.908635][ T8230] RBP: 00007fb091029090 R08: 0000200000048000 R09: 0000000000000000 [ 199.908645][ T8230] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 199.908655][ T8230] R13: 00007fb090416038 R14: 00007fb090415fa0 R15: 00007fb09053fa48 [ 199.908682][ T8230] [ 200.920890][ T8218] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.934453][ T8218] bridge0: port 1(bridge_slave_0) entered disabled state [ 200.942127][ T8218] bridge_slave_0: entered allmulticast mode [ 200.950578][ T8218] bridge_slave_0: entered promiscuous mode [ 200.959962][ T8218] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.967933][ T8218] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.975292][ T8218] bridge_slave_1: entered allmulticast mode [ 200.983233][ T8218] bridge_slave_1: entered promiscuous mode [ 201.033644][ T8218] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 201.070887][ T8218] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 201.118904][ T8218] team0: Port device team_slave_0 added [ 201.128213][ T8218] team0: Port device team_slave_1 added [ 201.163040][ T8218] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 201.173546][ T8218] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 201.200977][ T8218] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 201.214319][ T8218] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 201.221314][ T8218] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 201.248615][ T8218] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 201.311388][ T8218] hsr_slave_0: entered promiscuous mode [ 201.321811][ T8218] hsr_slave_1: entered promiscuous mode [ 201.329321][ T8218] debugfs: 'hsr0' already exists in 'hsr' [ 201.335884][ T8218] Cannot create hsr debugfs directory [ 201.368408][ T50] Bluetooth: hci0: command 0x0406 tx timeout [ 201.368464][ T5647] Bluetooth: hci3: command 0x0406 tx timeout [ 201.374709][ T5631] Bluetooth: hci4: command 0x0406 tx timeout [ 201.392486][ T5646] Bluetooth: hci1: command 0x0406 tx timeout [ 201.664634][ T5638] Bluetooth: hci2: command tx timeout [ 201.690808][ T8218] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.776310][ T8218] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.867917][ T8218] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.919382][ T8218] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.107093][ T8218] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 202.117076][ T8218] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 202.125365][ T8218] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 202.136399][ T8218] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 202.144539][ T8218] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 202.158674][ T8218] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 202.166934][ T8218] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 202.179014][ T8218] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 202.205613][ T8284] unsupported nla_type 142 [ 202.309044][ T8218] 8021q: adding VLAN 0 to HW filter on device bond0 [ 202.369552][ T8218] 8021q: adding VLAN 0 to HW filter on device team0 [ 202.403273][ T6405] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.410476][ T6405] bridge0: port 1(bridge_slave_0) entered forwarding state [ 202.432307][ T1103] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.439531][ T1103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 202.602180][ T8298] netlink: ct family unspecified [ 202.607690][ T8298] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 202.669362][ T29] kauditd_printk_skb: 50 callbacks suppressed [ 202.669377][ T29] audit: type=1326 audit(1781194570.138:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8294 comm="syz.1.770" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 202.716017][ T29] audit: type=1326 audit(1781194570.138:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8294 comm="syz.1.770" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 202.749436][ T8293] mac80211_hwsim hwsim8 wlan0: left promiscuous mode [ 202.751089][ T8305] netlink: 12 bytes leftover after parsing attributes in process `syz.0.767'. [ 202.768783][ T8293] mac80211_hwsim hwsim8 wlan0: left allmulticast mode [ 202.777186][ T29] audit: type=1326 audit(1781194570.138:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8294 comm="syz.1.770" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 202.804305][ T29] audit: type=1326 audit(1781194570.138:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8294 comm="syz.1.770" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=449 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 202.843215][ T8293] bond1: left promiscuous mode [ 202.843239][ T8293] bond1: left allmulticast mode [ 202.843491][ T8293] 8021q: adding VLAN 0 to HW filter on device bond1 [ 202.851422][ T8302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.770'. [ 202.859842][ T29] audit: type=1326 audit(1781194570.138:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8294 comm="syz.1.770" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 202.859887][ T29] audit: type=1326 audit(1781194570.138:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8294 comm="syz.1.770" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 202.859923][ T29] audit: type=1326 audit(1781194570.138:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8294 comm="syz.1.770" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 202.859960][ T29] audit: type=1326 audit(1781194570.138:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8294 comm="syz.1.770" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 202.859999][ T29] audit: type=1326 audit(1781194570.138:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8294 comm="syz.1.770" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 202.860037][ T29] audit: type=1326 audit(1781194570.138:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8294 comm="syz.1.770" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 203.054994][ T8218] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 203.302711][ T8218] veth0_vlan: entered promiscuous mode [ 203.353720][ T8218] veth1_vlan: entered promiscuous mode [ 203.392330][ T8218] veth0_macvtap: entered promiscuous mode [ 203.423722][ T8218] veth1_macvtap: entered promiscuous mode [ 203.501525][ T8218] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 203.536386][ T8218] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 203.566260][ T1103] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.598183][ T1103] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.620829][ T1103] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.644566][ T1103] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.747958][ T5638] Bluetooth: hci2: command tx timeout [ 203.857339][ T758] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 203.885498][ T758] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 203.952305][ T1131] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 203.973556][ T1131] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 204.371378][ T8342] netlink: 'syz.2.783': attribute type 3 has an invalid length. [ 205.042846][ T8359] netlink: 8 bytes leftover after parsing attributes in process `syz.1.790'. [ 205.052477][ T8359] netlink: 8 bytes leftover after parsing attributes in process `syz.1.790'. [ 205.242076][ T8361] xt_CT: No such helper "pptp" [ 205.315448][ T5773] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 205.506407][ T5773] usb 2-1: config 0 has no interfaces? [ 205.517286][ T5773] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 205.531935][ T5773] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.555154][ T5773] usb 2-1: Product: syz [ 205.567324][ T5773] usb 2-1: Manufacturer: syz [ 205.572284][ T5773] usb 2-1: SerialNumber: syz [ 205.590082][ T5773] usb 2-1: config 0 descriptor?? [ 205.598555][ T8369] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 205.667822][ T8369] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 205.752400][ T8378] netlink: 8 bytes leftover after parsing attributes in process `syz.4.793'. [ 205.797595][ T8378] netlink: 8 bytes leftover after parsing attributes in process `syz.4.793'. [ 205.824493][ T5638] Bluetooth: hci2: command tx timeout [ 205.964469][ T8369] 8021q: adding VLAN 0 to HW filter on device bond1 [ 206.001292][ T8369] 8021q: adding VLAN 0 to HW filter on device bond2 [ 206.024878][ T5729] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 206.070387][ T10] usb 2-1: USB disconnect, device number 23 [ 206.186190][ T5729] usb 3-1: Using ep0 maxpacket: 32 [ 206.196370][ T5729] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 206.209973][ T5729] usb 3-1: config 0 has no interface number 0 [ 206.229640][ T5729] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 206.247000][ T5729] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.260125][ T5729] usb 3-1: Product: syz [ 206.266727][ T5729] usb 3-1: Manufacturer: syz [ 206.271730][ T5729] usb 3-1: SerialNumber: syz [ 206.282539][ T5729] usb 3-1: config 0 descriptor?? [ 206.534854][ T8401] bond2: entered allmulticast mode [ 206.575195][ T8401] bond2 (unregistering): Released all slaves [ 206.753544][ T5729] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 206.780566][ T5729] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 206.928806][ T8415] veth0_macvtap: Caught tx_queue_len zero misconfig [ 207.003637][ T5729] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 207.023366][ T5729] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 207.057694][ T5729] usb 3-1: USB disconnect, device number 27 [ 207.175851][ T10] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 207.316777][ T8426] FAULT_INJECTION: forcing a failure. [ 207.316777][ T8426] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 207.334765][ T8426] CPU: 1 UID: 0 PID: 8426 Comm: syz.1.808 Not tainted syzkaller #0 PREEMPT(full) [ 207.334788][ T8426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 207.334797][ T8426] Call Trace: [ 207.334804][ T8426] [ 207.334810][ T8426] dump_stack_lvl+0xe8/0x150 [ 207.334834][ T8426] should_fail_ex+0x412/0x560 [ 207.334856][ T8426] prepare_alloc_pages+0x22a/0x650 [ 207.334884][ T8426] __alloc_frozen_pages_noprof+0x12f/0x380 [ 207.334909][ T8426] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 207.334931][ T8426] ? __pfx_policy_nodemask+0x10/0x10 [ 207.334952][ T8426] alloc_pages_mpol+0x235/0x490 [ 207.334972][ T8426] folio_alloc_mpol_noprof+0x39/0x160 [ 207.334989][ T8426] shmem_alloc_and_add_folio+0x442/0xf80 [ 207.335008][ T8426] ? filemap_get_entry+0xcd/0x3f0 [ 207.335037][ T8426] ? __pfx_filemap_get_entry+0x10/0x10 [ 207.335056][ T8426] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 207.335077][ T8426] ? shmem_allowable_huge_orders+0x5ec/0x690 [ 207.335103][ T8426] shmem_get_folio_gfp+0x5a9/0x1670 [ 207.335134][ T8426] shmem_fault+0x179/0x390 [ 207.335159][ T8426] __do_fault+0x138/0x2a0 [ 207.335180][ T8426] ? do_pte_missing+0x125b/0x33f0 [ 207.335198][ T8426] do_pte_missing+0x2093/0x33f0 [ 207.335227][ T8426] ? handle_mm_fault+0xf1/0x3170 [ 207.335250][ T8426] handle_mm_fault+0x1bf2/0x3170 [ 207.335277][ T8426] ? handle_mm_fault+0xf1/0x3170 [ 207.335302][ T8426] ? __pfx_handle_mm_fault+0x10/0x10 [ 207.335321][ T8426] ? follow_page_pte+0x6cf/0xe60 [ 207.335346][ T8426] ? __pfx_follow_page_pte+0x10/0x10 [ 207.335372][ T8426] __get_user_pages+0x167f/0x2730 [ 207.335416][ T8426] populate_vma_page_range+0x2be/0x3c0 [ 207.335435][ T8426] ? __pfx_populate_vma_page_range+0x10/0x10 [ 207.335465][ T8426] ? down_read+0x270/0x2e0 [ 207.335482][ T8426] ? __mm_populate+0x173/0x390 [ 207.335502][ T8426] __mm_populate+0x25f/0x390 [ 207.335523][ T8426] ? __pfx___mm_populate+0x10/0x10 [ 207.335550][ T8426] vm_mmap_pgoff+0x3aa/0x4f0 [ 207.335574][ T8426] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 207.335589][ T8426] ? ksys_write+0x242/0x270 [ 207.335613][ T8426] ? __pfx_ksys_write+0x10/0x10 [ 207.335639][ T8426] ? ksys_mmap_pgoff+0xf3/0x760 [ 207.335659][ T8426] ? __x64_sys_mmap+0x7f/0x140 [ 207.335677][ T8426] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.335695][ T8426] do_syscall_64+0x174/0x580 [ 207.335710][ T8426] ? trace_irq_disable+0x3b/0x140 [ 207.335732][ T8426] ? clear_bhb_loop+0x40/0x90 [ 207.335751][ T8426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.335766][ T8426] RIP: 0033:0x7f0d0079ce59 [ 207.335781][ T8426] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 207.335794][ T8426] RSP: 002b:00007f0d01738028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 207.335812][ T8426] RAX: ffffffffffffffda RBX: 00007f0d00a15fa0 RCX: 00007f0d0079ce59 [ 207.335824][ T8426] RDX: 0000000000000003 RSI: 0000000000b36000 RDI: 0000200000000000 [ 207.335834][ T8426] RBP: 00007f0d01738090 R08: ffffffffffffffff R09: 0000000000000000 [ 207.335845][ T8426] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000002 [ 207.335854][ T8426] R13: 00007f0d00a16038 R14: 00007f0d00a15fa0 R15: 00007f0d00b3fa48 [ 207.335882][ T8426] [ 207.397798][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 207.827784][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 207.841311][ T10] usb 1-1: New USB device found, idVendor=054c, idProduct=024b, bcdDevice= 0.00 [ 207.852947][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.893042][ T10] usb 1-1: config 0 descriptor?? [ 207.904736][ T5638] Bluetooth: hci2: command tx timeout [ 207.968705][ T8435] netlink: 12 bytes leftover after parsing attributes in process `syz.2.811'. [ 207.987071][ T8435] bridge_slave_0: default FDB implementation only supports local addresses [ 208.243930][ T8440] netlink: 244 bytes leftover after parsing attributes in process `syz.3.814'. [ 208.284296][ T8440] gre0: entered promiscuous mode [ 208.301914][ T8440] gre0: entered allmulticast mode [ 208.586913][ T8455] netlink: 'syz.1.817': attribute type 1 has an invalid length. [ 208.592369][ T10] hid_parser_main: 21 callbacks suppressed [ 208.592392][ T10] sony 0003:054C:024B.0005: unknown main item tag 0x0 [ 208.652934][ T10] sony 0003:054C:024B.0005: unknown main item tag 0x0 [ 208.682181][ T10] sony 0003:054C:024B.0005: unknown main item tag 0x0 [ 208.700380][ T8457] bond2: Unable to set up delay as MII monitoring is disabled [ 208.721548][ T10] sony 0003:054C:024B.0005: unknown main item tag 0x0 [ 208.752686][ T10] sony 0003:054C:024B.0005: unknown main item tag 0x0 [ 208.765994][ T8457] bond2 (unregistering): Released all slaves [ 208.799898][ T10] sony 0003:054C:024B.0005: unknown main item tag 0x0 [ 208.838870][ T10] sony 0003:054C:024B.0005: unknown main item tag 0x0 [ 208.863117][ T10] sony 0003:054C:024B.0005: unknown main item tag 0x0 [ 208.889339][ T10] sony 0003:054C:024B.0005: unknown main item tag 0x0 [ 208.907484][ T10] sony 0003:054C:024B.0005: unknown main item tag 0x0 [ 209.134789][ T8468] FAULT_INJECTION: forcing a failure. [ 209.134789][ T8468] name failslab, interval 1, probability 0, space 0, times 0 [ 209.184571][ T10] sony 0003:054C:024B.0005: hiddev0,hidraw0: USB HID v0.08 Device [HID 054c:024b] on usb-dummy_hcd.0-1/input0 [ 209.260388][ T8468] CPU: 0 UID: 0 PID: 8468 Comm: syz.1.820 Not tainted syzkaller #0 PREEMPT(full) [ 209.260412][ T8468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 209.260422][ T8468] Call Trace: [ 209.260429][ T8468] [ 209.260436][ T8468] dump_stack_lvl+0xe8/0x150 [ 209.260460][ T8468] should_fail_ex+0x412/0x560 [ 209.260483][ T8468] should_failslab+0xa8/0x100 [ 209.260501][ T8468] __kmalloc_noprof+0xe8/0x760 [ 209.260523][ T8468] ? tomoyo_encode+0x28b/0x550 [ 209.260544][ T8468] tomoyo_encode+0x28b/0x550 [ 209.260565][ T8468] tomoyo_realpath_from_path+0x58d/0x5d0 [ 209.260583][ T8468] ? tomoyo_domain+0xd7/0x130 [ 209.260607][ T8468] ? tomoyo_path_number_perm+0x219/0x630 [ 209.260628][ T8468] tomoyo_path_number_perm+0x246/0x630 [ 209.260651][ T8468] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 209.260670][ T8468] ? __lock_acquire+0x6b5/0x2cf0 [ 209.260701][ T8468] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 209.260738][ T8468] ? __fget_files+0x2a/0x420 [ 209.260760][ T8468] ? __fget_files+0x2a/0x420 [ 209.260777][ T8468] ? __fget_files+0x3a0/0x420 [ 209.260793][ T8468] ? __fget_files+0x2a/0x420 [ 209.260815][ T8468] security_file_ioctl+0xc3/0x2a0 [ 209.260837][ T8468] __se_sys_ioctl+0x47/0x170 [ 209.260859][ T8468] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.260877][ T8468] do_syscall_64+0x174/0x580 [ 209.260893][ T8468] ? trace_irq_disable+0x3b/0x140 [ 209.260915][ T8468] ? clear_bhb_loop+0x40/0x90 [ 209.260934][ T8468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.260950][ T8468] RIP: 0033:0x7f0d0079ce59 [ 209.260967][ T8468] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.260979][ T8468] RSP: 002b:00007f0d01738028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 209.260996][ T8468] RAX: ffffffffffffffda RBX: 00007f0d00a15fa0 RCX: 00007f0d0079ce59 [ 209.261007][ T8468] RDX: 0000200000000200 RSI: 000000004068aea3 RDI: 0000000000000005 [ 209.261017][ T8468] RBP: 00007f0d01738090 R08: 0000000000000000 R09: 0000000000000000 [ 209.261027][ T8468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 209.261036][ T8468] R13: 00007f0d00a16038 R14: 00007f0d00a15fa0 R15: 00007f0d00b3fa48 [ 209.261069][ T8468] [ 209.261104][ T8468] ERROR: Out of memory at tomoyo_realpath_from_path. [ 209.513694][ T10] sony 0003:054C:024B.0005: failed to claim input [ 209.620934][ T10] usb 1-1: USB disconnect, device number 28 [ 209.878461][ T8477] netlink: 12 bytes leftover after parsing attributes in process `syz.1.823'. [ 209.928222][ T8478] netlink: 4 bytes leftover after parsing attributes in process `syz.1.823'. [ 210.034421][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 210.109643][ T8477] netlink: 12 bytes leftover after parsing attributes in process `syz.1.823'. [ 210.212852][ T8480] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 210.329665][ T8477] netlink: 12 bytes leftover after parsing attributes in process `syz.1.823'. [ 210.508649][ T57] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.541169][ T57] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.577323][ T57] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.609815][ T57] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.734272][ T10] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 210.907275][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 210.928958][ T10] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 210.967412][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 211.003695][ T10] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 211.033140][ T10] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 211.062693][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.096406][ T10] usb 2-1: config 0 descriptor?? [ 211.326674][ T10] hdpvr 2-1:0.0: firmware version 0x50 dated [ 211.355765][ T10] hdpvr 2-1:0.0: untested firmware, the driver might not work. [ 211.766897][ T8522] FAULT_INJECTION: forcing a failure. [ 211.766897][ T8522] name failslab, interval 1, probability 0, space 0, times 0 [ 211.780354][ T8522] CPU: 0 UID: 0 PID: 8522 Comm: syz.3.837 Not tainted syzkaller #0 PREEMPT(full) [ 211.780377][ T8522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 211.780387][ T8522] Call Trace: [ 211.780397][ T8522] [ 211.780405][ T8522] dump_stack_lvl+0xe8/0x150 [ 211.780430][ T8522] should_fail_ex+0x412/0x560 [ 211.780454][ T8522] should_failslab+0xa8/0x100 [ 211.780471][ T8522] __kmalloc_noprof+0xe8/0x760 [ 211.780493][ T8522] ? tomoyo_encode+0x28b/0x550 [ 211.780513][ T8522] tomoyo_encode+0x28b/0x550 [ 211.780534][ T8522] tomoyo_realpath_from_path+0x58d/0x5d0 [ 211.780559][ T8522] ? tomoyo_path_number_perm+0x219/0x630 [ 211.780578][ T8522] tomoyo_path_number_perm+0x246/0x630 [ 211.780600][ T8522] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 211.780615][ T8522] ? __lock_acquire+0x6b5/0x2cf0 [ 211.780643][ T8522] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 211.780679][ T8522] ? __fget_files+0x2a/0x420 [ 211.780701][ T8522] ? __fget_files+0x2a/0x420 [ 211.780717][ T8522] ? __fget_files+0x3a0/0x420 [ 211.780734][ T8522] ? __fget_files+0x2a/0x420 [ 211.780756][ T8522] security_file_ioctl+0xc3/0x2a0 [ 211.780776][ T8522] __se_sys_ioctl+0x47/0x170 [ 211.780797][ T8522] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.780815][ T8522] do_syscall_64+0x174/0x580 [ 211.780831][ T8522] ? trace_irq_disable+0x3b/0x140 [ 211.780852][ T8522] ? clear_bhb_loop+0x40/0x90 [ 211.780871][ T8522] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.780886][ T8522] RIP: 0033:0x7fb09019ce59 [ 211.780902][ T8522] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.780915][ T8522] RSP: 002b:00007fb091029028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 211.780932][ T8522] RAX: ffffffffffffffda RBX: 00007fb090415fa0 RCX: 00007fb09019ce59 [ 211.780943][ T8522] RDX: 0000200000000040 RSI: 000000004040534e RDI: 0000000000000003 [ 211.780953][ T8522] RBP: 00007fb091029090 R08: 0000000000000000 R09: 0000000000000000 [ 211.780963][ T8522] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 211.780972][ T8522] R13: 00007fb090416038 R14: 00007fb090415fa0 R15: 00007fb09053fa48 [ 211.780997][ T8522] [ 211.781602][ T8522] ERROR: Out of memory at tomoyo_realpath_from_path. [ 212.121994][ T10] hdpvr 2-1:0.0: Could not setup controls [ 212.152138][ T10] hdpvr 2-1:0.0: registering videodev failed [ 212.220677][ T10] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -71 [ 212.255221][ T10] usb 2-1: USB disconnect, device number 24 [ 213.235428][ T29] kauditd_printk_skb: 54 callbacks suppressed [ 213.235443][ T29] audit: type=1326 audit(1781194580.698:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8565 comm="syz.1.848" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 213.323769][ T29] audit: type=1326 audit(1781194580.698:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8565 comm="syz.1.848" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 213.405922][ T29] audit: type=1326 audit(1781194580.738:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8565 comm="syz.1.848" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 213.461933][ T29] audit: type=1326 audit(1781194580.738:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8565 comm="syz.1.848" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 213.523867][ T29] audit: type=1326 audit(1781194580.738:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8565 comm="syz.1.848" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 213.596592][ T29] audit: type=1326 audit(1781194580.748:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8565 comm="syz.1.848" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 213.682110][ T29] audit: type=1326 audit(1781194580.748:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8565 comm="syz.1.848" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 213.749678][ T8577] veth0_macvtap: Caught tx_queue_len zero misconfig [ 213.787165][ T29] audit: type=1326 audit(1781194580.748:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8565 comm="syz.1.848" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=284 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 213.884285][ T24] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 213.884302][ T29] audit: type=1326 audit(1781194580.748:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8565 comm="syz.1.848" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d0079ce59 code=0x7ffc0000 [ 214.167975][ T24] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 214.207974][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.241896][ T24] usb 5-1: Product: syz [ 214.253582][ T24] usb 5-1: Manufacturer: syz [ 214.273882][ T24] usb 5-1: SerialNumber: syz [ 214.532955][ T29] audit: type=1800 audit(1781194581.998:328): pid=8586 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.852" name="bus" dev="ramfs" ino=26704 res=0 errno=0 [ 214.801241][ T24] cdc_ncm 5-1:1.0: bind() failure [ 214.840278][ T24] cdc_ncm 5-1:1.1: probe with driver cdc_ncm failed with error -71 [ 214.873813][ T24] cdc_mbim 5-1:1.1: probe with driver cdc_mbim failed with error -71 [ 214.897332][ T24] usbtest 5-1:1.1: probe with driver usbtest failed with error -71 [ 214.939981][ T24] usb 5-1: USB disconnect, device number 20 [ 215.043738][ T8605] netlink: 16 bytes leftover after parsing attributes in process `syz.3.855'. [ 215.412610][ T8615] netlink: 'syz.4.858': attribute type 10 has an invalid length. [ 215.511748][ T8619] FAULT_INJECTION: forcing a failure. [ 215.511748][ T8619] name failslab, interval 1, probability 0, space 0, times 0 [ 215.534904][ T8619] CPU: 0 UID: 0 PID: 8619 Comm: syz.3.857 Not tainted syzkaller #0 PREEMPT(full) [ 215.534927][ T8619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 215.534935][ T8619] Call Trace: [ 215.534942][ T8619] [ 215.534950][ T8619] dump_stack_lvl+0xe8/0x150 [ 215.534973][ T8619] should_fail_ex+0x412/0x560 [ 215.534994][ T8619] should_failslab+0xa8/0x100 [ 215.535011][ T8619] __kmalloc_noprof+0xe8/0x760 [ 215.535037][ T8619] ? sock_kmalloc+0xd6/0x160 [ 215.535051][ T8619] ? __kmalloc_noprof+0x1b8/0x760 [ 215.535074][ T8619] sock_kmalloc+0xd6/0x160 [ 215.535094][ T8619] af_alg_get_rsgl+0x2a8/0x8e0 [ 215.535127][ T8619] skcipher_recvmsg+0x392/0x1140 [ 215.535161][ T8619] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 215.535178][ T8619] ? __lock_acquire+0x6b5/0x2cf0 [ 215.535194][ T8619] ? aa_sock_msg_perm+0xf1/0x1b0 [ 215.535217][ T8619] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 215.535237][ T8619] ? security_socket_recvmsg+0x7e/0x2c0 [ 215.535254][ T8619] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 215.535273][ T8619] sock_recvmsg+0x172/0x1b0 [ 215.535296][ T8619] ____sys_recvmsg+0x1e6/0x4a0 [ 215.535321][ T8619] ? __pfx_____sys_recvmsg+0x10/0x10 [ 215.535351][ T8619] ? import_iovec+0x73/0xa0 [ 215.535373][ T8619] ___sys_recvmsg+0x215/0x590 [ 215.535388][ T8619] ? get_pid_task+0x20/0x1f0 [ 215.535412][ T8619] ? __pfx____sys_recvmsg+0x10/0x10 [ 215.535432][ T8619] ? __fget_files+0x2a/0x420 [ 215.535468][ T8619] ? __fget_files+0x3a0/0x420 [ 215.535495][ T8619] __x64_sys_recvmsg+0x1ba/0x2a0 [ 215.535514][ T8619] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 215.535540][ T8619] ? __pfx_ksys_write+0x10/0x10 [ 215.535569][ T8619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.535587][ T8619] do_syscall_64+0x174/0x580 [ 215.535603][ T8619] ? trace_irq_disable+0x3b/0x140 [ 215.535624][ T8619] ? clear_bhb_loop+0x40/0x90 [ 215.535644][ T8619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.535659][ T8619] RIP: 0033:0x7fb09019ce59 [ 215.535675][ T8619] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 215.535687][ T8619] RSP: 002b:00007fb091008028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 215.535705][ T8619] RAX: ffffffffffffffda RBX: 00007fb090416090 RCX: 00007fb09019ce59 [ 215.535716][ T8619] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 215.535726][ T8619] RBP: 00007fb091008090 R08: 0000000000000000 R09: 0000000000000000 [ 215.535736][ T8619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 215.535745][ T8619] R13: 00007fb090416128 R14: 00007fb090416090 R15: 00007fb09053fa48 [ 215.535771][ T8619] [ 217.190053][ T8685] FAULT_INJECTION: forcing a failure. [ 217.190053][ T8685] name failslab, interval 1, probability 0, space 0, times 0 [ 217.238443][ T8685] CPU: 0 UID: 0 PID: 8685 Comm: syz.1.873 Not tainted syzkaller #0 PREEMPT(full) [ 217.238468][ T8685] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 217.238477][ T8685] Call Trace: [ 217.238485][ T8685] [ 217.238492][ T8685] dump_stack_lvl+0xe8/0x150 [ 217.238515][ T8685] should_fail_ex+0x412/0x560 [ 217.238539][ T8685] should_failslab+0xa8/0x100 [ 217.238558][ T8685] __kmalloc_cache_noprof+0x88/0x660 [ 217.238579][ T8685] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 217.238596][ T8685] ? sctp_add_bind_addr+0x8c/0x370 [ 217.238618][ T8685] sctp_add_bind_addr+0x8c/0x370 [ 217.238640][ T8685] sctp_copy_local_addr_list+0x314/0x4f0 [ 217.238658][ T8685] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 217.238675][ T8685] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 217.238699][ T8685] ? sctp_v4_is_any+0x35/0x60 [ 217.238716][ T8685] ? sctp_copy_one_addr+0x93/0x360 [ 217.238736][ T8685] sctp_bind_addr_copy+0xb3/0x3c0 [ 217.238754][ T8685] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 217.238777][ T8685] sctp_connect_new_asoc+0x2ff/0x6b0 [ 217.238801][ T8685] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 217.238821][ T8685] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 217.238841][ T8685] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 217.238859][ T8685] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 217.238879][ T8685] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 217.238900][ T8685] ? security_sctp_bind_connect+0x7e/0x2c0 [ 217.238922][ T8685] sctp_sendmsg+0x1576/0x2c50 [ 217.238956][ T8685] ? __pfx_sctp_sendmsg+0x10/0x10 [ 217.238979][ T8685] ? aa_sk_perm+0x6d5/0x900 [ 217.238999][ T8685] ? __might_fault+0xaf/0x130 [ 217.239025][ T8685] ? __pfx_aa_sk_perm+0x10/0x10 [ 217.239049][ T8685] ? sock_rps_record_flow+0x19/0x350 [ 217.239066][ T8685] ? __pfx_inet_sendmsg+0x10/0x10 [ 217.239085][ T8685] ? inet_sendmsg+0x2f4/0x370 [ 217.239101][ T8685] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 217.239120][ T8685] ? __pfx_inet_sendmsg+0x10/0x10 [ 217.239137][ T8685] __sys_sendto+0x5de/0x710 [ 217.239278][ T8685] ? __pfx___sys_sendto+0x10/0x10 [ 217.239303][ T8685] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 217.239331][ T8685] ? __fget_files+0x3a0/0x420 [ 217.239360][ T8685] ? ksys_write+0x242/0x270 [ 217.239384][ T8685] ? __pfx_ksys_write+0x10/0x10 [ 217.239409][ T8685] __x64_sys_sendto+0xde/0x100 [ 217.239432][ T8685] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.239450][ T8685] do_syscall_64+0x174/0x580 [ 217.239466][ T8685] ? trace_irq_disable+0x3b/0x140 [ 217.239488][ T8685] ? clear_bhb_loop+0x40/0x90 [ 217.239508][ T8685] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.239523][ T8685] RIP: 0033:0x7f0d0079ce59 [ 217.239541][ T8685] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.239554][ T8685] RSP: 002b:00007f0d01738028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 217.239573][ T8685] RAX: ffffffffffffffda RBX: 00007f0d00a15fa0 RCX: 00007f0d0079ce59 [ 217.239584][ T8685] RDX: 0000000000000001 RSI: 0000200000000200 RDI: 0000000000000003 [ 217.239592][ T8685] RBP: 00007f0d01738090 R08: 0000200000000000 R09: 0000000000000010 [ 217.239600][ T8685] R10: e61e2840a154f0c4 R11: 0000000000000246 R12: 0000000000000002 [ 217.239611][ T8685] R13: 00007f0d00a16038 R14: 00007f0d00a15fa0 R15: 00007f0d00b3fa48 [ 217.239638][ T8685] [ 217.777664][ T8698] netlink: 24 bytes leftover after parsing attributes in process `syz.4.876'. [ 217.854258][ T5692] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 218.004593][ T5692] usb 1-1: Using ep0 maxpacket: 16 [ 218.006218][ T5692] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 218.040161][ T5692] usb 1-1: config 0 has no interface number 0 [ 218.070350][ T8710] FAULT_INJECTION: forcing a failure. [ 218.070350][ T8710] name failslab, interval 1, probability 0, space 0, times 0 [ 218.095997][ T5692] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 218.100297][ T8710] CPU: 0 UID: 0 PID: 8710 Comm: syz.4.881 Not tainted syzkaller #0 PREEMPT(full) [ 218.100321][ T8710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 218.100330][ T8710] Call Trace: [ 218.100337][ T8710] [ 218.100344][ T8710] dump_stack_lvl+0xe8/0x150 [ 218.100368][ T8710] should_fail_ex+0x412/0x560 [ 218.100392][ T8710] should_failslab+0xa8/0x100 [ 218.100410][ T8710] __kmalloc_cache_noprof+0x88/0x660 [ 218.100432][ T8710] ? sctp_add_bind_addr+0x8c/0x370 [ 218.100453][ T8710] sctp_add_bind_addr+0x8c/0x370 [ 218.100473][ T8710] sctp_copy_local_addr_list+0x314/0x4f0 [ 218.100493][ T8710] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 218.100510][ T8710] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 218.100525][ T8710] ? sctp_association_new+0x1894/0x25e0 [ 218.100545][ T8710] ? sctp_v6_is_any+0x64/0x80 [ 218.100564][ T8710] ? sctp_copy_one_addr+0x93/0x360 [ 218.100583][ T8710] sctp_bind_addr_copy+0xb3/0x3c0 [ 218.100600][ T8710] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 218.100625][ T8710] sctp_connect_new_asoc+0x2ff/0x6b0 [ 218.100647][ T8710] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 218.100671][ T8710] ? sctp_get_af_specific+0x29/0x80 [ 218.100686][ T8710] ? sctp_inet6_send_verify+0x80/0x300 [ 218.100701][ T8710] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 218.100723][ T8710] __sctp_connect+0x5cb/0xdc0 [ 218.100756][ T8710] ? __pfx___sctp_connect+0x10/0x10 [ 218.100772][ T8710] ? sctp_setsockopt+0x21c/0x12c0 [ 218.100789][ T8710] ? security_sctp_bind_connect+0x7e/0x2c0 [ 218.100811][ T8710] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 218.100829][ T8710] sctp_setsockopt+0x708/0x12c0 [ 218.100846][ T8710] ? sock_common_setsockopt+0x36/0xc0 [ 218.100866][ T8710] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 218.100887][ T8710] do_sock_setsockopt+0x17c/0x1b0 [ 218.100913][ T8710] __x64_sys_setsockopt+0x13d/0x1b0 [ 218.100938][ T8710] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.100955][ T8710] do_syscall_64+0x174/0x580 [ 218.100972][ T8710] ? trace_irq_disable+0x3b/0x140 [ 218.100992][ T8710] ? clear_bhb_loop+0x40/0x90 [ 218.101011][ T8710] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.101026][ T8710] RIP: 0033:0x7f5ed259ce59 [ 218.101041][ T8710] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 218.101060][ T8710] RSP: 002b:00007f5ed34a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 218.101077][ T8710] RAX: ffffffffffffffda RBX: 00007f5ed2815fa0 RCX: 00007f5ed259ce59 [ 218.101088][ T8710] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 218.101097][ T8710] RBP: 00007f5ed34a2090 R08: 0000000000000010 R09: 0000000000000000 [ 218.101106][ T8710] R10: 0000200000000580 R11: 0000000000000246 R12: 0000000000000002 [ 218.101116][ T8710] R13: 00007f5ed2816038 R14: 00007f5ed2815fa0 R15: 00007f5ed293fa48 [ 218.101143][ T8710] [ 218.352643][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 218.352660][ T29] audit: type=1800 audit(1781194585.828:330): pid=8712 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.879" name="/" dev="fuse" ino=1 res=0 errno=0 [ 218.440931][ T8704] netlink: 388 bytes leftover after parsing attributes in process `syz.3.872'. [ 218.491068][ T5692] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 218.507970][ T5692] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 218.518011][ T5692] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.526762][ T5692] usb 1-1: Product: syz [ 218.531357][ T5692] usb 1-1: Manufacturer: syz [ 218.536831][ T5692] usb 1-1: SerialNumber: syz [ 218.547086][ T5692] usb 1-1: config 0 descriptor?? [ 218.553269][ T8690] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 218.649985][ T8690] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 218.875936][ T8690] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 218.898639][ T8690] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 219.128703][ T5692] asix 1-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 219.331538][ T5692] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 219.365141][ T5692] asix 1-1:0.34 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 219.386150][ T5692] asix 1-1:0.34: probe with driver asix failed with error -61 [ 219.516968][ T8749] netlink: 12 bytes leftover after parsing attributes in process `syz.2.889'. [ 219.842395][ T8765] netlink: 12 bytes leftover after parsing attributes in process `syz.1.895'. [ 219.859624][ T8765] FAULT_INJECTION: forcing a failure. [ 219.859624][ T8765] name failslab, interval 1, probability 0, space 0, times 0 [ 219.877185][ T8765] CPU: 0 UID: 0 PID: 8765 Comm: syz.1.895 Not tainted syzkaller #0 PREEMPT(full) [ 219.877208][ T8765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 219.877218][ T8765] Call Trace: [ 219.877225][ T8765] [ 219.877232][ T8765] dump_stack_lvl+0xe8/0x150 [ 219.877258][ T8765] should_fail_ex+0x412/0x560 [ 219.877281][ T8765] should_failslab+0xa8/0x100 [ 219.877304][ T8765] __kmalloc_cache_noprof+0x88/0x660 [ 219.877326][ T8765] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 219.877344][ T8765] ? sctp_v6_cmp_addr+0x15/0xd0 [ 219.877360][ T8765] ? sctp_add_bind_addr+0x8c/0x370 [ 219.877382][ T8765] sctp_add_bind_addr+0x8c/0x370 [ 219.877403][ T8765] sctp_copy_local_addr_list+0x314/0x4f0 [ 219.877425][ T8765] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 219.877442][ T8765] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 219.877461][ T8765] ? sctp_v6_is_any+0x64/0x80 [ 219.877479][ T8765] ? sctp_copy_one_addr+0x93/0x360 [ 219.877499][ T8765] sctp_bind_addr_copy+0xb3/0x3c0 [ 219.877518][ T8765] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 219.877544][ T8765] sctp_connect_new_asoc+0x2ff/0x6b0 [ 219.877567][ T8765] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 219.877592][ T8765] ? __local_bh_enable_ip+0xd0/0x130 [ 219.877608][ T8765] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 219.877629][ T8765] ? security_sctp_bind_connect+0x7e/0x2c0 [ 219.877653][ T8765] sctp_sendmsg+0x1576/0x2c50 [ 219.877670][ T8765] ? unwind_next_frame+0xa6/0x2550 [ 219.877704][ T8765] ? __pfx_sctp_sendmsg+0x10/0x10 [ 219.877726][ T8765] ? aa_sk_perm+0x6d5/0x900 [ 219.877753][ T8765] ? __pfx_aa_sk_perm+0x10/0x10 [ 219.877777][ T8765] ? sock_rps_record_flow+0x19/0x350 [ 219.877808][ T8765] ? inet_sendmsg+0x2f4/0x370 [ 219.877834][ T8765] ____sys_sendmsg+0x80a/0x9f0 [ 219.877857][ T8765] ? __pfx_____sys_sendmsg+0x10/0x10 [ 219.877881][ T8765] ? import_iovec+0x73/0xa0 [ 219.877901][ T8765] ___sys_sendmsg+0x2a5/0x360 [ 219.877914][ T8765] ? __lock_acquire+0x6b5/0x2cf0 [ 219.877933][ T8765] ? __pfx____sys_sendmsg+0x10/0x10 [ 219.877985][ T8765] ? __fget_files+0x2a/0x420 [ 219.878003][ T8765] ? __fget_files+0x3a0/0x420 [ 219.878031][ T8765] __x64_sys_sendmsg+0x1bd/0x2a0 [ 219.878051][ T8765] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 219.878077][ T8765] ? __pfx_ksys_write+0x10/0x10 [ 219.878107][ T8765] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.878125][ T8765] do_syscall_64+0x174/0x580 [ 219.878141][ T8765] ? trace_irq_disable+0x3b/0x140 [ 219.878163][ T8765] ? clear_bhb_loop+0x40/0x90 [ 219.878183][ T8765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.878199][ T8765] RIP: 0033:0x7f0d0079ce59 [ 219.878215][ T8765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 219.878229][ T8765] RSP: 002b:00007f0d01738028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 219.878247][ T8765] RAX: ffffffffffffffda RBX: 00007f0d00a15fa0 RCX: 00007f0d0079ce59 [ 219.878258][ T8765] RDX: 0000000000040040 RSI: 00002000000003c0 RDI: 0000000000000005 [ 219.878268][ T8765] RBP: 00007f0d01738090 R08: 0000000000000000 R09: 0000000000000000 [ 219.878278][ T8765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 219.878288][ T8765] R13: 00007f0d00a16038 R14: 00007f0d00a15fa0 R15: 00007f0d00b3fa48 [ 219.878315][ T8765] [ 220.319847][ T29] audit: type=1800 audit(1781194587.788:331): pid=8763 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.894" name="/" dev="fuse" ino=1 res=0 errno=0 [ 220.356850][ T8778] FAULT_INJECTION: forcing a failure. [ 220.356850][ T8778] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 220.372511][ T5707] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 220.394795][ T8778] CPU: 1 UID: 0 PID: 8778 Comm: syz.1.898 Not tainted syzkaller #0 PREEMPT(full) [ 220.394818][ T8778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 220.394831][ T8778] Call Trace: [ 220.394838][ T8778] [ 220.394845][ T8778] dump_stack_lvl+0xe8/0x150 [ 220.394868][ T8778] should_fail_ex+0x412/0x560 [ 220.394890][ T8778] _copy_from_iter+0x1d3/0x1670 [ 220.394908][ T8778] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 220.394935][ T8778] ? __pfx__copy_from_iter+0x10/0x10 [ 220.394955][ T8778] ? dev_get_by_index+0x22/0x2e0 [ 220.394973][ T8778] ? dev_get_by_index+0x22/0x2e0 [ 220.394996][ T8778] packet_sendmsg+0x2e19/0x4fb0 [ 220.395028][ T8778] ? __lock_acquire+0x6b5/0x2cf0 [ 220.395055][ T8778] ? __lock_acquire+0x6b5/0x2cf0 [ 220.395089][ T8778] ? __pfx_packet_sendmsg+0x10/0x10 [ 220.395107][ T8778] ? aa_sk_perm+0x6d5/0x900 [ 220.395136][ T8778] ? __pfx_aa_sk_perm+0x10/0x10 [ 220.395154][ T8778] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 220.395182][ T8778] ? aa_sock_msg_perm+0xf1/0x1b0 [ 220.395209][ T8778] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 220.395233][ T8778] ? __pfx_packet_sendmsg+0x10/0x10 [ 220.395254][ T8778] __sys_sendto+0x672/0x710 [ 220.395278][ T8778] ? __pfx___sys_sendto+0x10/0x10 [ 220.395297][ T8778] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 220.395327][ T8778] ? __fget_files+0x3a0/0x420 [ 220.395355][ T8778] ? ksys_write+0x242/0x270 [ 220.395379][ T8778] ? __pfx_ksys_write+0x10/0x10 [ 220.395404][ T8778] __x64_sys_sendto+0xde/0x100 [ 220.395426][ T8778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.395444][ T8778] do_syscall_64+0x174/0x580 [ 220.395466][ T8778] ? trace_irq_disable+0x3b/0x140 [ 220.395488][ T8778] ? clear_bhb_loop+0x40/0x90 [ 220.395507][ T8778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.395523][ T8778] RIP: 0033:0x7f0d0079ce59 [ 220.395537][ T8778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 220.395549][ T8778] RSP: 002b:00007f0d01738028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 220.395566][ T8778] RAX: ffffffffffffffda RBX: 00007f0d00a15fa0 RCX: 00007f0d0079ce59 [ 220.395576][ T8778] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000003 [ 220.395586][ T8778] RBP: 00007f0d01738090 R08: 0000200000000140 R09: 0000000000000014 [ 220.395596][ T8778] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 220.395605][ T8778] R13: 00007f0d00a16038 R14: 00007f0d00a15fa0 R15: 00007f0d00b3fa48 [ 220.395632][ T8778] [ 220.717647][ T24] usb 1-1: USB disconnect, device number 29 [ 220.806647][ T5707] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 220.820456][ T5707] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 220.831160][ T5707] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 220.840297][ T5707] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 220.848425][ T5707] usb 5-1: SerialNumber: syz [ 220.854897][ T5692] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 221.006028][ T5692] usb 4-1: Using ep0 maxpacket: 8 [ 221.012973][ T5692] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 221.027837][ T5692] usb 4-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 221.037102][ T5692] usb 4-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 221.050194][ T5692] usb 4-1: Product: syz [ 221.058060][ T5692] usb 4-1: Manufacturer: syz [ 221.065342][ T5692] usb 4-1: SerialNumber: syz [ 221.089367][ T5707] usb 5-1: 0:2 : does not exist [ 221.154501][ T24] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 221.233241][ T5707] usb 5-1: USB disconnect, device number 21 [ 221.301110][ T5692] usb 4-1: palm_os_3_probe - error -71 getting connection information [ 221.318440][ T5866] udevd[5866]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 221.341609][ T5692] visor 4-1:1.0: probe with driver visor failed with error -71 [ 221.352795][ T5692] usb 4-1: USB disconnect, device number 32 [ 221.363366][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 221.394310][ T24] usb 1-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 221.431685][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.449516][ T24] usb 1-1: config 0 descriptor?? [ 221.461889][ T8794] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 221.923390][ T8819] fuse: Bad value for 'rootmode' [ 222.063489][ T24] hid_parser_main: 18 callbacks suppressed [ 222.063505][ T24] logitech-djreceiver 0003:046D:C71F.0006: unknown main item tag 0x0 [ 222.115255][ T24] logitech-djreceiver 0003:046D:C71F.0006: unknown main item tag 0x0 [ 222.123616][ T8827] netlink: 12 bytes leftover after parsing attributes in process `syz.2.910'. [ 222.142548][ T24] logitech-djreceiver 0003:046D:C71F.0006: unknown main item tag 0x0 [ 222.170519][ T24] logitech-djreceiver 0003:046D:C71F.0006: unknown main item tag 0x0 [ 222.199004][ T24] logitech-djreceiver 0003:046D:C71F.0006: unknown main item tag 0x0 [ 222.242885][ T24] logitech-djreceiver 0003:046D:C71F.0006: unknown main item tag 0x0 [ 222.261265][ T8827] 8021q: adding VLAN 0 to HW filter on device bond1 [ 222.285975][ T29] audit: type=1800 audit(1781194589.758:332): pid=8830 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.909" name="/" dev="fuse" ino=1 res=0 errno=0 [ 222.310597][ T24] logitech-djreceiver 0003:046D:C71F.0006: unknown main item tag 0x0 [ 222.345833][ T24] logitech-djreceiver 0003:046D:C71F.0006: unknown main item tag 0x0 [ 222.367860][ T24] logitech-djreceiver 0003:046D:C71F.0006: unknown main item tag 0x0 [ 222.398900][ T24] logitech-djreceiver 0003:046D:C71F.0006: unknown main item tag 0x0 [ 222.442786][ T24] logitech-djreceiver 0003:046D:C71F.0006: unbalanced collection at end of report description [ 222.475590][ T24] logitech-djreceiver 0003:046D:C71F.0006: logi_dj_probe: parse failed [ 222.500591][ T24] logitech-djreceiver 0003:046D:C71F.0006: probe with driver logitech-djreceiver failed with error -22 [ 222.714661][ T8847] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 223.024042][ T8853] input: syz0 as /devices/virtual/input/input17 [ 223.790836][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805a229c00: rx timeout, send abort [ 223.836271][ T24] usb 1-1: USB disconnect, device number 30 [ 224.290923][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805a22a000: rx timeout, send abort [ 224.301544][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805a229c00: abort rx timeout. Force session deactivation [ 224.584699][ T10] usb 3-1: new full-speed USB device number 28 using dummy_hcd [ 224.748596][ T10] usb 3-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 224.766336][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.783874][ T10] usb 3-1: Product: syz [ 224.796826][ T10] usb 3-1: Manufacturer: syz [ 224.799241][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805a22a000: abort rx timeout. Force session deactivation [ 224.806561][ T10] usb 3-1: SerialNumber: syz [ 224.822627][ T8882] dvmrp0: entered allmulticast mode [ 224.849551][ T10] usb 3-1: config 0 descriptor?? [ 224.888941][ T10] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 224.977368][ T8887] IPv6: NLM_F_CREATE should be specified when creating new route [ 225.466628][ T8912] netlink: 'syz.0.933': attribute type 15 has an invalid length. [ 225.477059][ T8912] netlink: 4 bytes leftover after parsing attributes in process `syz.0.933'. [ 225.497945][ T6405] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 2816 - 0 [ 225.498049][ T8912] netlink: 'syz.0.933': attribute type 15 has an invalid length. [ 225.526554][ T5707] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 225.535248][ T8912] netlink: 4 bytes leftover after parsing attributes in process `syz.0.933'. [ 225.544240][ T6405] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 2816 - 0 [ 225.564688][ T6405] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 2816 - 0 [ 225.584206][ T6405] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 2816 - 0 [ 225.724311][ T5707] usb 2-1: Using ep0 maxpacket: 8 [ 225.731818][ T5707] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 225.746957][ T5707] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 225.761672][ T5707] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 225.771823][ T5707] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 225.782629][ T5707] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 225.796000][ T5707] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 225.805245][ T5707] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.821140][ T8924] netlink: 8 bytes leftover after parsing attributes in process `syz.3.934'. [ 225.833409][ T8924] netlink: 8 bytes leftover after parsing attributes in process `syz.3.934'. [ 226.033151][ T5707] usb 2-1: GET_CAPABILITIES returned 0 [ 226.040757][ T5707] usbtmc 2-1:16.0: can't read capabilities [ 226.102958][ T8930] netlink: 8 bytes leftover after parsing attributes in process `syz.0.937'. [ 226.112576][ T8930] netlink: 4 bytes leftover after parsing attributes in process `syz.0.937'. [ 226.241815][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.251309][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.260504][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.269697][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.278788][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.287843][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.307368][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.316524][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.325823][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.336115][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.419781][ C1] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.428926][ C1] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.438010][ C1] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.447098][ C1] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.456193][ C1] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.522590][ C1] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 226.553940][ T5692] usb 2-1: USB disconnect, device number 26 [ 226.720565][ T8937] tipc: Cannot configure node identity twice [ 227.164802][ T8944] netlink: 8 bytes leftover after parsing attributes in process `syz.3.941'. [ 227.183014][ T8944] netlink: 4 bytes leftover after parsing attributes in process `syz.3.941'. [ 227.550324][ T10] gspca_stk1135: reg_w 0x350 err -71 [ 227.558170][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 227.573115][ T10] gspca_stk1135: Sensor write failed [ 227.579561][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 227.588688][ T10] gspca_stk1135: Sensor write failed [ 227.595254][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 227.601868][ T10] gspca_stk1135: Sensor read failed [ 227.607785][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 227.616345][ T10] gspca_stk1135: Sensor read failed [ 227.621909][ T10] gspca_stk1135: Detected sensor type unknown (0x0) [ 227.629766][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 227.637132][ T10] gspca_stk1135: Sensor read failed [ 227.642591][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 227.650581][ T10] gspca_stk1135: Sensor read failed [ 227.656948][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 227.663774][ T10] gspca_stk1135: Sensor write failed [ 227.670237][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 227.703320][ T10] gspca_stk1135: Sensor write failed [ 227.723682][ T10] stk1135 3-1:0.0: probe with driver stk1135 failed with error -71 [ 227.764951][ T10] usb 3-1: USB disconnect, device number 28 [ 227.774698][ T9] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 227.934244][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 227.941978][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 227.953242][ T9] usb 2-1: config 7 has an invalid interface number: 187 but max is 0 [ 227.984910][ T9] usb 2-1: config 7 has no interface number 0 [ 227.991249][ T9] usb 2-1: config 7 interface 187 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 32 [ 228.003166][ T9] usb 2-1: config 7 interface 187 has no altsetting 0 [ 228.015320][ T9] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 228.053492][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.086250][ T9] usb 2-1: Product: syz [ 228.090708][ T9] usb 2-1: Manufacturer: syz [ 228.096254][ T9] usb 2-1: SerialNumber: syz [ 228.103741][ T8956] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 228.364948][ T9] usb 2-1: Unknown endpoint type found, address 0x07 [ 228.390113][ T9] usb 2-1: Not enough endpoints found in device, aborting! [ 228.467528][ T8966] FAULT_INJECTION: forcing a failure. [ 228.467528][ T8966] name failslab, interval 1, probability 0, space 0, times 0 [ 228.484305][ T8966] CPU: 1 UID: 0 PID: 8966 Comm: syz.3.950 Not tainted syzkaller #0 PREEMPT(full) [ 228.484330][ T8966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 228.484340][ T8966] Call Trace: [ 228.484423][ T8966] [ 228.484491][ T8966] dump_stack_lvl+0xe8/0x150 [ 228.484649][ T8966] should_fail_ex+0x412/0x560 [ 228.484740][ T8966] should_failslab+0xa8/0x100 [ 228.484784][ T8966] __kmalloc_noprof+0xe8/0x760 [ 228.484807][ T8966] ? __keyctl_dh_compute+0x664/0xd10 [ 228.484901][ T8966] __keyctl_dh_compute+0x664/0xd10 [ 228.484922][ T8966] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 228.484955][ T8966] ? get_pid_task+0x20/0x1f0 [ 228.484990][ T8966] ? get_pid_task+0x20/0x1f0 [ 228.485006][ T8966] keyctl_dh_compute+0x124/0x180 [ 228.485020][ T8966] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 228.485044][ T8966] __se_sys_keyctl+0x44c/0x9e0 [ 228.485084][ T8966] ? __pfx___se_sys_keyctl+0x10/0x10 [ 228.485101][ T8966] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 228.485176][ T8966] ? __fget_files+0x3a0/0x420 [ 228.485218][ T8966] ? fput+0xa0/0xd0 [ 228.485237][ T8966] ? ksys_write+0x242/0x270 [ 228.485256][ T8966] ? __pfx_ksys_write+0x10/0x10 [ 228.485276][ T8966] ? __x64_sys_keyctl+0x20/0xc0 [ 228.485290][ T8966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.485315][ T8966] do_syscall_64+0x174/0x580 [ 228.485355][ T8966] ? trace_irq_disable+0x3b/0x140 [ 228.485385][ T8966] ? clear_bhb_loop+0x40/0x90 [ 228.485403][ T8966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.485416][ T8966] RIP: 0033:0x7fb09019ce59 [ 228.485459][ T8966] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 228.485498][ T8966] RSP: 002b:00007fb091029028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 228.485548][ T8966] RAX: ffffffffffffffda RBX: 00007fb090415fa0 RCX: 00007fb09019ce59 [ 228.485557][ T8966] RDX: 0000200000003380 RSI: 00002000000000c0 RDI: 0000000000000017 [ 228.485565][ T8966] RBP: 00007fb091029090 R08: 0000000000000000 R09: 0000000000000000 [ 228.485573][ T8966] R10: 0000000000000ffe R11: 0000000000000246 R12: 0000000000000002 [ 228.485580][ T8966] R13: 00007fb090416038 R14: 00007fb090415fa0 R15: 00007fb09053fa48 [ 228.485600][ T8966] [ 228.722053][ T5365] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 228.731489][ T8965] netlink: 12 bytes leftover after parsing attributes in process `syz.2.949'. [ 228.750264][ T5692] usb 2-1: USB disconnect, device number 27 [ 228.885414][ T5365] usb 5-1: device descriptor read/64, error -71 [ 229.124691][ T5365] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 229.274683][ T5365] usb 5-1: device descriptor read/64, error -71 [ 229.394743][ T5365] usb usb5-port1: attempt power cycle [ 229.694328][ T24] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 229.754733][ T5365] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 229.796653][ T5365] usb 5-1: device descriptor read/8, error -71 [ 229.878261][ T24] usb 3-1: config 0 has an invalid interface number: 172 but max is 0 [ 229.895855][ T24] usb 3-1: config 0 has no interface number 0 [ 229.913960][ T24] usb 3-1: too many endpoints for config 0 interface 172 altsetting 118: 97, using maximum allowed: 30 [ 229.938585][ T24] usb 3-1: config 0 interface 172 altsetting 118 has 0 endpoint descriptors, different from the interface descriptor's value: 97 [ 229.993198][ T24] usb 3-1: config 0 interface 172 has no altsetting 0 [ 230.015883][ T24] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 230.034090][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.044759][ T5365] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 230.055352][ T24] usb 3-1: Product: syz [ 230.063250][ T24] usb 3-1: Manufacturer: syz [ 230.077043][ T24] usb 3-1: SerialNumber: syz [ 230.098783][ T5365] usb 5-1: device descriptor read/8, error -71 [ 230.099831][ T24] usb 3-1: config 0 descriptor?? [ 230.236539][ T5365] usb usb5-port1: unable to enumerate USB device [ 230.373350][ T24] usb 3-1: USB disconnect, device number 29 [ 231.236772][ T9001] netlink: 8 bytes leftover after parsing attributes in process `syz.2.962'. [ 231.714731][ T9] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 231.871153][ T9] usb 5-1: config 0 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 231.895542][ T9] usb 5-1: config 0 interface 0 altsetting 7 endpoint 0x81 has invalid wMaxPacketSize 0 [ 231.921944][ T9] usb 5-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 231.922028][ T24] usb 1-1: new full-speed USB device number 31 using dummy_hcd [ 231.945191][ T9] usb 5-1: config 0 interface 0 has no altsetting 0 [ 231.961230][ T9] usb 5-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 232.000371][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.033033][ T9] usb 5-1: config 0 descriptor?? [ 232.126409][ T24] usb 1-1: config 0 has an invalid interface number: 88 but max is 0 [ 232.152028][ T24] usb 1-1: config 0 has no interface number 0 [ 232.171329][ T24] usb 1-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=49.83 [ 232.200587][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.229472][ T24] usb 1-1: Product: syz [ 232.239548][ T24] usb 1-1: Manufacturer: syz [ 232.250260][ T24] usb 1-1: SerialNumber: syz [ 232.311593][ T9] holtek 0003:1241:5015.0007: ignoring exceeding usage max [ 232.312155][ T24] usb 1-1: config 0 descriptor?? [ 232.351068][ T9] holtek 0003:1241:5015.0007: hidraw0: USB HID v0.00 Device [HID 1241:5015] on usb-dummy_hcd.4-1/input0 [ 232.407031][ T9] holtek 0003:1241:5015.0007: no inputs found [ 232.479810][ T9] usb 5-1: USB disconnect, device number 26 [ 232.590991][ T24] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 232.986090][ T9011] netlink: 524 bytes leftover after parsing attributes in process `syz.0.966'. [ 233.034047][ T24] gspca_m5602: Failed to find a sensor [ 233.052502][ T24] ALi m5602 1-1:0.88: ALi m5602 webcam failed [ 233.081098][ T24] usb 1-1: USB disconnect, device number 31 [ 234.106389][ T9054] netlink: 8 bytes leftover after parsing attributes in process `syz.1.978'. [ 234.292622][ T9054] loop2: detected capacity change from 0 to 7 [ 234.328598][ T9054] Dev loop2: unable to read RDB block 7 [ 234.341135][ T9054] loop2: AHDI p1 p2 p3 [ 234.349383][ T9054] loop2: partition table partially beyond EOD, truncated [ 234.373277][ T9054] loop2: p1 start 1601398130 is beyond EOD, truncated [ 234.382359][ T9054] loop2: p2 start 1702059890 is beyond EOD, truncated [ 235.424963][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 235.832792][ T9095] netlink: 8 bytes leftover after parsing attributes in process `syz.2.988'. [ 235.944655][ T9] usb 5-1: new full-speed USB device number 27 using dummy_hcd [ 236.088394][ T9106] netlink: 'syz.3.994': attribute type 1 has an invalid length. [ 236.123103][ T9] usb 5-1: not running at top speed; connect to a high speed hub [ 236.168966][ T9] usb 5-1: New USB device found, idVendor=04b4, idProduct=9320, bcdDevice= 0.40 [ 236.183660][ T9112] netlink: 4 bytes leftover after parsing attributes in process `syz.3.994'. [ 236.217703][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.257637][ T9] usb 5-1: Product: syz [ 236.278821][ T9] usb 5-1: Manufacturer: syz [ 236.317466][ T9] usb 5-1: SerialNumber: syz [ 236.330962][ T9106] 8021q: adding VLAN 0 to HW filter on device bond2 [ 236.565833][ T9113] vlan0: entered allmulticast mode [ 236.596218][ T9113] bond2: entered allmulticast mode [ 236.738286][ T9116] bond2: (slave geneve2): making interface the new active one [ 236.781025][ T9116] geneve2: entered allmulticast mode [ 236.841268][ T9116] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 237.482870][ T29] audit: type=1326 audit(1781194604.948:333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9126 comm="syz.3.997" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb09019ce59 code=0x0 [ 238.725815][ T9] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 238.763977][ T9] usb 5-1: MIDIStreaming interface descriptor not found [ 238.940466][ T9] usb 5-1: USB disconnect, device number 27 [ 239.775716][ T9153] geneve0: Caught tx_queue_len zero misconfig [ 240.229564][ T5692] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 240.395012][ T5692] usb 3-1: Using ep0 maxpacket: 32 [ 240.410200][ T5692] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 240.436507][ T9172] netlink: 'syz.3.1011': attribute type 1 has an invalid length. [ 240.438209][ T5692] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 240.514236][ T5692] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 240.517221][ T9172] netlink: 'syz.3.1011': attribute type 2 has an invalid length. [ 240.538453][ T5692] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 240.553841][ T9174] openvswitch: netlink: ct_state flags 2c1414ac unsupported [ 240.575203][ T5692] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 240.585685][ T5692] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.598086][ T5692] usb 3-1: Product: syz [ 240.603543][ T9173] bridge_slave_0: left allmulticast mode [ 240.604398][ T5692] usb 3-1: Manufacturer: syz [ 240.618683][ T5692] usb 3-1: SerialNumber: syz [ 240.630282][ T5692] usb 3-1: config 0 descriptor?? [ 240.636460][ T9174] netlink: 'syz.3.1011': attribute type 1 has an invalid length. [ 240.640824][ T9173] bridge_slave_0: left promiscuous mode [ 240.646304][ T9174] netlink: 'syz.3.1011': attribute type 2 has an invalid length. [ 240.670506][ T5692] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input22 [ 240.701250][ T9173] bridge0: port 1(bridge_slave_0) entered disabled state [ 240.725462][ T4984] xpad 3-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 240.757384][ T9173] bridge_slave_1: left allmulticast mode [ 240.776727][ T9173] bridge0: port 2(bridge_slave_1) entered disabled state [ 240.839701][ T4984] xpad 3-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 240.909480][ T9173] bond0: (slave bond_slave_0): Releasing backup interface [ 240.921765][ T4984] xpad 3-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.007220][ T4984] xpad 3-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.018401][ T9173] bond0: (slave bond_slave_1): Releasing backup interface [ 241.103731][ T4984] xpad 3-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.137873][ T9173] team_slave_0: left promiscuous mode [ 241.149495][ T9167] xpad 3-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.182063][ C1] xpad 3-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 241.191985][ T5636] xpad 3-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.205510][ T9173] team0: Port device team_slave_0 removed [ 241.216954][ T995] usb 3-1: USB disconnect, device number 30 [ 241.216994][ C1] xpad 3-1:0.0: xpad_irq_in - usb_submit_urb failed with result -19 [ 241.268334][ T9173] team_slave_1: left promiscuous mode [ 241.338365][ T9173] team0: Port device team_slave_1 removed [ 241.362665][ T9173] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 241.387526][ T9173] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 241.426000][ T9173] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 241.454074][ T9173] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 241.468098][ T9173] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 241.530363][ T9177] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1013'. [ 241.567101][ T1173] bond0: (slave bond_slave_1): interface is now down [ 241.582131][ T9183] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1013'. [ 241.736096][ T1173] bond0: (slave bond_slave_1): interface is now down [ 241.772330][ T9185] bond3: option primary_reselect: invalid value (21) [ 241.810621][ T9185] bond3 (unregistering): Released all slaves [ 241.927385][ T758] bond0: (slave bond_slave_1): interface is now down [ 242.097001][ T758] bond0: (slave bond_slave_1): interface is now down [ 242.265561][ T6405] bond0: (slave bond_slave_1): interface is now down [ 242.425520][ T1173] bond0: (slave bond_slave_1): interface is now down [ 242.488328][ T29] audit: type=1326 audit(1781194609.958:334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9208 comm="syz.0.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40ad99ce59 code=0x7ffc0000 [ 242.567436][ T29] audit: type=1326 audit(1781194609.958:335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9208 comm="syz.0.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40ad99ce59 code=0x7ffc0000 [ 242.595130][ T6405] bond0: (slave bond_slave_1): interface is now down [ 242.637853][ T29] audit: type=1326 audit(1781194609.988:336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9208 comm="syz.0.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=48 compat=0 ip=0x7f40ad99ce59 code=0x7ffc0000 [ 242.682720][ T29] audit: type=1326 audit(1781194609.988:337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9208 comm="syz.0.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40ad99ce59 code=0x7ffc0000 [ 242.737364][ T29] audit: type=1326 audit(1781194609.988:338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9208 comm="syz.0.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40ad99ce59 code=0x7ffc0000 [ 242.774748][ T6405] bond0: (slave bond_slave_1): interface is now down [ 242.778872][ T29] audit: type=1326 audit(1781194609.988:339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9208 comm="syz.0.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f40ad99ce59 code=0x7ffc0000 [ 242.847041][ T29] audit: type=1326 audit(1781194609.988:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9208 comm="syz.0.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40ad99ce59 code=0x7ffc0000 [ 242.871418][ T24] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 242.910006][ T29] audit: type=1326 audit(1781194609.988:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9208 comm="syz.0.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40ad99ce59 code=0x7ffc0000 [ 242.924777][ T9] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 242.965521][ T6405] bond0: (slave bond_slave_1): interface is now down [ 242.975680][ T29] audit: type=1326 audit(1781194609.988:342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9208 comm="syz.0.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=193 compat=0 ip=0x7f40ad99ce59 code=0x7ffc0000 [ 243.047621][ T24] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 243.065546][ T29] audit: type=1326 audit(1781194609.988:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9208 comm="syz.0.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40ad99ce59 code=0x7ffc0000 [ 243.100038][ T24] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 243.117274][ T6405] bond0: now running without any active interface! [ 243.120919][ T24] usb 1-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 243.146683][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.156672][ T24] usb 1-1: Product: syz [ 243.160952][ T24] usb 1-1: Manufacturer: syz [ 243.168666][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 243.168674][ T24] usb 1-1: SerialNumber: syz [ 243.186428][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 243.207373][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.232264][ T9] usb 3-1: Product: syz [ 243.248785][ T9] usb 3-1: Manufacturer: syz [ 243.265060][ T9] usb 3-1: SerialNumber: syz [ 243.406373][ T9209] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1021'. [ 243.430686][ T24] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 243.482810][ T24] usb 1-1: unit 6 not found! [ 243.607608][ T24] usb 1-1: USB disconnect, device number 32 [ 243.716413][ T5365] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 243.874603][ T5365] usb 5-1: Using ep0 maxpacket: 32 [ 243.881890][ T5365] usb 5-1: unable to get BOS descriptor or descriptor too short [ 243.891164][ T5365] usb 5-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x95, changing to 0x85 [ 243.910216][ T5365] usb 5-1: New USB device found, idVendor=249c, idProduct=931c, bcdDevice= 0.40 [ 243.920534][ T5365] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.929093][ T5365] usb 5-1: Product: syz [ 243.933766][ T5365] usb 5-1: Manufacturer: syz [ 243.939217][ T5365] usb 5-1: SerialNumber: syz [ 244.044977][ T995] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 244.166097][ T5365] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 244.173575][ T5365] usb 5-1: MIDIStreaming interface descriptor not found [ 244.205930][ T995] usb 4-1: Using ep0 maxpacket: 32 [ 244.224081][ T995] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 64, changing to 10 [ 244.245087][ T24] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 244.250058][ T995] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 49791, setting to 1024 [ 244.282638][ T995] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 244.302817][ T995] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 244.312479][ T9] cdc_ncm 3-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 244.324799][ T995] usb 4-1: Product: syz [ 244.330267][ T9] cdc_ncm 3-1:1.0: setting rx_max = 16384 [ 244.340237][ T995] usb 4-1: Manufacturer: syz [ 244.353165][ T5365] usb 5-1: USB disconnect, device number 28 [ 244.416270][ T24] usb 1-1: config 0 has an invalid interface number: 172 but max is 0 [ 244.427150][ T24] usb 1-1: config 0 has no interface number 0 [ 244.433463][ T24] usb 1-1: too many endpoints for config 0 interface 172 altsetting 118: 97, using maximum allowed: 30 [ 244.456226][ T995] hub 4-1:4.0: USB hub found [ 244.465467][ T24] usb 1-1: config 0 interface 172 altsetting 118 has 0 endpoint descriptors, different from the interface descriptor's value: 97 [ 244.482280][ T24] usb 1-1: config 0 interface 172 has no altsetting 0 [ 244.491440][ T5868] udevd[5868]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 244.512171][ T24] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 244.525319][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.525800][ T9] cdc_ncm 3-1:1.0: setting tx_max = 88 [ 244.533444][ T24] usb 1-1: Product: syz [ 244.533463][ T24] usb 1-1: Manufacturer: syz [ 244.533474][ T24] usb 1-1: SerialNumber: syz [ 244.602390][ T24] usb 1-1: config 0 descriptor?? [ 244.621679][ T9] cdc_ncm 3-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.2-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 244.635384][ T995] hub 4-1:4.0: config failed, hub has too many ports! (err -19) [ 244.706480][ T9] usb 3-1: USB disconnect, device number 31 [ 244.739983][ T9] cdc_ncm 3-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.2-1, CDC NCM (NO ZLP) [ 244.876906][ T24] usb 1-1: USB disconnect, device number 33 [ 244.895389][ T995] IPVS: starting estimator thread 0... [ 244.935988][ T808] usb 4-1: USB disconnect, device number 33 [ 245.045491][ T9248] IPVS: using max 36 ests per chain, 86400 per kthread [ 245.085650][ T9251] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1034'. [ 245.137871][ T9251] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1034'. [ 245.182671][ T9258] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1034'. [ 245.343411][ T9251] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1034'. [ 245.524697][ T9] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 245.697749][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 245.712932][ T9] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 245.755216][ T9] usb 4-1: config 0 has no interface number 0 [ 245.771180][ T9] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 245.814648][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.824735][ T9] usb 4-1: Product: syz [ 245.824848][ T808] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 245.833813][ T9] usb 4-1: Manufacturer: syz [ 245.853579][ T9] usb 4-1: SerialNumber: syz [ 245.928370][ T9] usb 4-1: config 0 descriptor?? [ 245.956777][ T9] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 246.035474][ T808] usb 2-1: Using ep0 maxpacket: 8 [ 246.049221][ T808] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 246.083240][ T808] usb 2-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 246.123147][ T808] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.152301][ T808] usb 2-1: config 0 descriptor?? [ 246.172424][ T9] usb 4-1: qt2_attach - failed to power on unit: -71 [ 246.197893][ T808] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 246.219758][ T9] quatech2 4-1:0.51: probe with driver quatech2 failed with error -71 [ 246.288936][ T9] usb 4-1: USB disconnect, device number 34 [ 246.298120][ T9299] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1043'. [ 246.389715][ T9290] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 246.571484][ T9290] netlink: 'syz.0.1040': attribute type 10 has an invalid length. [ 246.735350][ T5365] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 246.904691][ T5365] usb 5-1: Using ep0 maxpacket: 8 [ 246.922757][ T5365] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 246.969000][ T5365] usb 5-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 246.998715][ T808] gspca_vc032x: reg_w err -71 [ 247.017894][ T5365] usb 5-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 247.019638][ T808] vc032x 2-1:0.0: probe with driver vc032x failed with error -71 [ 247.080505][ T5365] usb 5-1: config 0 interface 0 has no altsetting 0 [ 247.118311][ T5365] usb 5-1: New USB device found, idVendor=045e, idProduct=009d, bcdDevice= 0.00 [ 247.134736][ T808] usb 2-1: USB disconnect, device number 28 [ 247.159888][ T5365] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.200169][ T5365] usb 5-1: config 0 descriptor?? [ 247.629531][ T9324] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1048'. [ 247.688371][ T5365] hid_parser_main: 432 callbacks suppressed [ 247.688419][ T5365] microsoft 0003:045E:009D.0008: unknown main item tag 0x0 [ 247.717459][ T5365] microsoft 0003:045E:009D.0008: unknown main item tag 0x0 [ 247.760012][ T5365] microsoft 0003:045E:009D.0008: unknown main item tag 0x0 [ 247.783348][ T5365] microsoft 0003:045E:009D.0008: unknown main item tag 0x0 [ 247.812506][ T5365] microsoft 0003:045E:009D.0008: unknown main item tag 0x0 [ 247.848753][ T5365] microsoft 0003:045E:009D.0008: unknown main item tag 0x0 [ 247.884824][ T5365] microsoft 0003:045E:009D.0008: unbalanced collection at end of report description [ 247.896070][ T9329] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1045'. [ 247.941209][ T5365] microsoft 0003:045E:009D.0008: parse failed [ 247.969522][ T5365] microsoft 0003:045E:009D.0008: probe with driver microsoft failed with error -22 [ 247.984585][ T9] usb 2-1: new full-speed USB device number 29 using dummy_hcd [ 248.068432][ T5365] usb 5-1: USB disconnect, device number 29 [ 248.113143][ T9334] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1051'. [ 248.161911][ T9334] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1051'. Stopping sshd: [ 248.195536][ T9] usb 2-1: not running at top speed; connect to a high speed hub [ 248.212651][ T9] usb 2-1: config 201 has an invalid interface number: 69 but max is 1 [ 248.238400][ T9] usb 2-1: config 201 has an invalid interface number: 240 but max is 1 [ 248.301175][ T9] usb 2-1: config 201 has an invalid interface number: 19 but max is 1 [ 248.341980][ T9] usb 2-1: config 201 has 3 interfaces, different from the descriptor's value: 2 [ 248.383963][ T9] usb 2-1: config 201 has no interface number 0 [ 248.415463][ T9] usb 2-1: config 201 has no interface number 1 [ 248.450542][ T9] usb 2-1: config 201 has no interface number 2 [ 248.481535][ T9] usb 2-1: config 201 interface 69 altsetting 0 has an invalid descriptor for endpoint zero, skipping stopped /usr/sbin/sshd (pid 5389) OK [ 248.560973][ T9] usb 2-1: config 201 interface 69 altsetting 0 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 248.627822][ T9] usb 2-1: config 201 interface 69 altsetting 0 endpoint 0x7 has invalid maxpacket 959, setting to 64 [ 248.671886][ T9] usb 2-1: config 201 interface 69 altsetting 0 endpoint 0x6 has invalid maxpacket 27428, setting to 64 [ 248.715206][ T9] usb 2-1: config 201 interface 69 altsetting 0 has 6 endpoint descriptors, different from the interface descriptor's value: 11 [ 248.776522][ T9] usb 2-1: too many endpoints for config 201 interface 240 altsetting 164: 97, using maximum allowed: 30 [ 248.827765][ T9] usb 2-1: config 201 interface 240 altsetting 164 has an invalid descriptor for endpoint zero, skipping Stopping crond: [ 248.881997][ T9] usb 2-1: config 201 interface 240 altsetting 164 endpoint 0xB has an invalid bInterval 112, changing to 4 [ 248.952317][ T9] usb 2-1: config 201 interface 240 altsetting 164 has a duplicate endpoint with address 0xE, skipping [ 249.019687][ T9] usb 2-1: config 201 interface 240 altsetting 164 has a duplicate endpoint with address 0x7, skipping stopped /usr/sbin/crond (pid 5369) [ 249.086260][ T9] usb 2-1: config 201 interface 240 altsetting 164 has 5 endpoint descriptors, different from the interface descriptor's value: 97 OK [ 249.140069][ T9] usb 2-1: config 201 interface 19 altsetting 11 has an invalid descriptor for endpoint zero, skipping [ 249.176849][ T9] usb 2-1: config 201 interface 19 altsetting 11 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 249.266068][ T9] usb 2-1: config 201 interface 19 altsetting 11 has a duplicate endpoint with address 0x6, skipping [ 249.291028][ T9] usb 2-1: config 201 interface 19 altsetting 11 has an endpoint descriptor with address 0x92, changing to 0x82 [ 249.335786][ T9] usb 2-1: config 201 interface 19 altsetting 11 endpoint 0x82 has an invalid bInterval 237, changing to 4 [ 249.362514][ T9] usb 2-1: config 201 interface 19 altsetting 11 endpoint 0x82 has invalid maxpacket 40449, setting to 1023 [ 249.398925][ T9] usb 2-1: config 201 interface 19 altsetting 11 has a duplicate endpoint with address 0x9, skipping [ 249.421645][ T9] usb 2-1: config 201 interface 19 altsetting 11 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 249.449775][ T9] usb 2-1: config 201 interface 240 has no altsetting 0 [ 249.473658][ T9] usb 2-1: config 201 interface 19 has no altsetting 0 [ 249.494841][ T9] usb 2-1: New USB device found, idVendor=086a, idProduct=0102, bcdDevice=64.0e [ 249.520342][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.542183][ T9] usb 2-1: Product: syz [ 249.552464][ T9] usb 2-1: Manufacturer: ࡃ [ 249.567167][ T9] usb 2-1: SerialNumber: syz Stopping dhcpcd... stopped /sbin/dhcpcd (pid 5293) [ 249.819048][ T9] emi26 - firmware loader 2-1:201.69: emi26_probe start [ 249.877231][ T9] usb 2-1: Direct firmware load for emi26/loader.fw failed with error -2 [ 249.931753][ T9] usb 2-1: Falling back to sysfs fallback for: emi26/loader.fw [ 249.939893][ T29] kauditd_printk_skb: 7 callbacks suppressed [ 249.939990][ T29] audit: type=1326 audit(1781194617.398:351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9367 comm="syz.3.1059" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb09019ce59 code=0x0 [ 250.178120][ T9376] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) Stopping network: [ 250.484668][ T995] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 250.645778][ T995] usb 5-1: Using ep0 maxpacket: 8 [ 250.658977][ T995] usb 5-1: unable to get BOS descriptor or descriptor too short [ 250.671863][ T995] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 250.697886][ T995] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 250.737206][ T995] usb 5-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 250.757389][ T995] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.774074][ T995] usb 5-1: Product: syz [ 250.790264][ T995] usb 5-1: Manufacturer: syz [ 250.807220][ T995] usb 5-1: SerialNumber: syz [ 250.828659][ T9398] tipc: Started in network mode [ 250.839786][ T9398] tipc: Node identity e201f98174c7, cluster identity 4711 [ 250.874039][ T9398] tipc: Enabled bearer , priority 0 [ 250.910416][ T9398] syzkaller0: entered promiscuous mode [ 250.929946][ T9398] syzkaller0: entered allmulticast mode [ 251.025899][ T24] usb 4-1: new full-speed USB device number 35 using dummy_hcd [ 251.041325][ T995] usb 5-1: failed waiting for Axe-Fx III to boot: -71 [ 251.052880][ T9398] tipc: Resetting bearer [ 251.084395][ T995] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 251.134812][ T995] usb 5-1: USB disconnect, device number 30 [ 251.212266][ T24] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 251.225152][ T9408] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 251.250772][ T9408] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1068'. [ 251.257308][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 251.302100][ T24] usb 4-1: config 0 has no interface number 0 [ 251.393020][ T24] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 251.428214][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.465561][ T24] usb 4-1: Product: syz [ 251.486471][ T24] usb 4-1: Manufacturer: syz [ 251.504301][ T24] usb 4-1: SerialNumber: syz [ 251.531674][ T24] usb 4-1: config 0 descriptor?? OK [ 251.570564][ T24] hub 4-1:0.31: bad descriptor, ignoring hub [ 251.584575][ T24] hub 4-1:0.31: probe with driver hub failed with error -5 [ 251.599376][ T24] uvcvideo 4-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 251.624705][ T24] uvcvideo 4-1:0.31: Entity type for entity Output 32774 was not initialized! [ 251.635816][ T9397] tipc: Resetting bearer [ 251.668095][ T24] uvcvideo 4-1:0.31: Failed to create links for entity 32774 [ 251.695472][ T24] uvcvideo 4-1:0.31: Failed to register entities (-22). [ 251.715870][ T9397] tipc: Disabling bearer Stopping iptables: [ 251.935318][ T808] usb 4-1: USB disconnect, device number 35 OK [ 252.060799][ T9428] FAULT_INJECTION: forcing a failure. [ 252.060799][ T9428] name failslab, interval 1, probability 0, space 0, times 0 [ 252.127877][ T9428] CPU: 0 UID: 0 PID: 9428 Comm: syz.4.1073 Not tainted syzkaller #0 PREEMPT(full) [ 252.127901][ T9428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 252.127926][ T9428] Call Trace: [ 252.127934][ T9428] [ 252.127941][ T9428] dump_stack_lvl+0xe8/0x150 [ 252.127966][ T9428] should_fail_ex+0x412/0x560 [ 252.127988][ T9428] should_failslab+0xa8/0x100 [ 252.128006][ T9428] __kmalloc_cache_noprof+0x88/0x660 [ 252.128029][ T9428] ? sctp_add_bind_addr+0x8c/0x370 [ 252.128150][ T9428] sctp_add_bind_addr+0x8c/0x370 [ 252.128171][ T9428] sctp_copy_local_addr_list+0x314/0x4f0 [ 252.128218][ T9428] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 252.128236][ T9428] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 252.128255][ T9428] ? sctp_v6_is_any+0x64/0x80 [ 252.128370][ T9428] ? sctp_copy_one_addr+0x93/0x360 [ 252.128390][ T9428] sctp_bind_addr_copy+0xb3/0x3c0 [ 252.128408][ T9428] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 252.128457][ T9428] sctp_connect_new_asoc+0x2ff/0x6b0 [ 252.128515][ T9428] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 252.128541][ T9428] ? __local_bh_enable_ip+0xd0/0x130 [ 252.128564][ T9428] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 252.128599][ T9428] ? security_sctp_bind_connect+0x7e/0x2c0 [ 252.128662][ T9428] sctp_sendmsg+0x1576/0x2c50 [ 252.128697][ T9428] ? __pfx_sctp_sendmsg+0x10/0x10 [ 252.128719][ T9428] ? aa_sk_perm+0x6d5/0x900 [ 252.128791][ T9428] ? __might_fault+0xaf/0x130 [ 252.128823][ T9428] ? __pfx_aa_sk_perm+0x10/0x10 [ 252.128847][ T9428] ? sock_rps_record_flow+0x19/0x350 [ 252.128927][ T9428] ? __pfx_inet_sendmsg+0x10/0x10 [ 252.128945][ T9428] ? inet_sendmsg+0x2f4/0x370 [ 252.128963][ T9428] ? __pfx_inet_sendmsg+0x10/0x10 [ 252.128981][ T9428] __sys_sendto+0x5de/0x710 [ 252.129086][ T9428] ? __pfx___sys_sendto+0x10/0x10 [ 252.129105][ T9428] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 252.129135][ T9428] ? __fget_files+0x3a0/0x420 [ 252.129165][ T9428] ? ksys_write+0x242/0x270 [ 252.129189][ T9428] ? __pfx_ksys_write+0x10/0x10 [ 252.129215][ T9428] __x64_sys_sendto+0xde/0x100 [ 252.129237][ T9428] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.129255][ T9428] do_syscall_64+0x174/0x580 [ 252.129270][ T9428] ? trace_irq_disable+0x3b/0x140 [ 252.129292][ T9428] ? clear_bhb_loop+0x40/0x90 [ 252.129311][ T9428] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.129326][ T9428] RIP: 0033:0x7f5ed259ce59 [ 252.129341][ T9428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.129353][ T9428] RSP: 002b:00007f5ed34a2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 252.129369][ T9428] RAX: ffffffffffffffda RBX: 00007f5ed2815fa0 RCX: 00007f5ed259ce59 [ 252.129380][ T9428] RDX: 000000000000fee4 RSI: 0000200000847fff RDI: 0000000000000005 [ 252.129389][ T9428] RBP: 00007f5ed34a2090 R08: 000020000005ffe4 R09: 000000000000001c [ 252.129398][ T9428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 252.129407][ T9428] R13: 00007f5ed2816038 R14: 00007f5ed2815fa0 R15: 00007f5ed293fa48 [ 252.129434][ T9428] [ 252.184601][ T9433] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1074'. [ 252.379003][ T9432] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1074'. [ 252.543083][ T9441] FAULT_INJECTION: forcing a failure. [ 252.543083][ T9441] name (null), interval 1, probability 0, space 0, times 1 Stopping system message bus: [ 252.606775][ T9441] CPU: 0 UID: 0 PID: 9441 Comm: syz.1.1077 Not tainted syzkaller #0 PREEMPT(full) [ 252.606799][ T9441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 252.606809][ T9441] Call Trace: [ 252.606816][ T9441] [ 252.606824][ T9441] dump_stack_lvl+0xe8/0x150 [ 252.606850][ T9441] should_fail_ex+0x412/0x560 [ 252.606875][ T9441] null_queue_rq+0x244/0xe30 [ 252.607003][ T9441] ? folios_put_refs+0xa06/0xb40 [ 252.607041][ T9441] null_queue_rqs+0x123/0x270 [ 252.607067][ T9441] ? blk_mq_dispatch_queue_requests+0x11a/0x800 [ 252.607155][ T9441] blk_mq_dispatch_queue_requests+0x417/0x800 [ 252.607181][ T9441] blk_mq_flush_plug_list+0x456/0x570 [ 252.607200][ T9441] ? filemap_get_folios_tag+0x118/0x720 [ 252.607220][ T9441] ? filemap_get_folios_tag+0x61c/0x720 [ 252.607245][ T9441] ? __pfx_blk_mq_flush_plug_list+0x10/0x10 [ 252.607264][ T9441] ? __pfx_filemap_get_folios_tag+0x10/0x10 [ 252.607292][ T9441] __blk_flush_plug+0x3ed/0x4d0 [ 252.607366][ T9441] ? __pfx___blk_flush_plug+0x10/0x10 [ 252.607394][ T9441] blk_finish_plug+0x5d/0x80 [ 252.607414][ T9441] blkdev_writepages+0x12c/0x1b0 [ 252.607458][ T9441] ? __pfx_blkdev_writepages+0x10/0x10 [ 252.607490][ T9441] ? __pfx_blkdev_writepages+0x10/0x10 [ 252.607510][ T9441] do_writepages+0x32e/0x550 [ 252.607537][ T9441] ? do_raw_spin_unlock+0xf5/0x210 [ 252.607575][ T9441] filemap_flush_range+0x1e7/0x2f0 [ 252.607590][ T9441] ? get_pid_task+0x20/0x1f0 [ 252.607608][ T9441] ? __pfx_filemap_flush_range+0x10/0x10 [ 252.607653][ T9441] ? ksys_write+0x1e6/0x270 [ 252.607676][ T9441] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 252.607691][ T9441] ? __pfx_vfs_write+0x10/0x10 [ 252.607713][ T9441] generic_fadvise+0x540/0x770 [ 252.607740][ T9441] ? __pfx_generic_fadvise+0x10/0x10 [ 252.607768][ T9441] ? __fget_files+0x2a/0x420 [ 252.607788][ T9441] ? __fget_files+0x2a/0x420 [ 252.607805][ T9441] ? __fget_files+0x3a0/0x420 [ 252.607819][ T9441] ? __fget_files+0x2a/0x420 [ 252.607844][ T9441] __x64_sys_fadvise64+0x143/0x190 [ 252.607864][ T9441] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.607881][ T9441] do_syscall_64+0x174/0x580 [ 252.607896][ T9441] ? trace_irq_disable+0x3b/0x140 [ 252.607918][ T9441] ? clear_bhb_loop+0x40/0x90 [ 252.607935][ T9441] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.607951][ T9441] RIP: 0033:0x7f0d0079ce59 [ 252.607966][ T9441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.607977][ T9441] RSP: 002b:00007f0d01717028 EFLAGS: 00000246 ORIG_RAX: 00000000000000dd [ 252.607996][ T9441] RAX: ffffffffffffffda RBX: 00007f0d00a16090 RCX: 00007f0d0079ce59 [ 252.608007][ T9441] RDX: 0000004000000005 RSI: 0000000000000003 RDI: 0000000000000004 [ 252.608016][ T9441] RBP: 00007f0d01717090 R08: 0000000000000000 R09: 0000000000000000 [ 252.608026][ T9441] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 252.608035][ T9441] R13: 00007f0d00a16128 R14: 00007f0d00a16090 R15: 00007f0d00b3fa48 [ 252.608060][ T9441] done killall: can't kill pid 5640: No such process Stopping klogd: OK [ 254.964545][ T9488] macvtap0: entered promiscuous mode [ 255.014049][ T9488] macvtap0: left promiscuous mode Stopping acpid: [ 255.319373][ T9495] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1088'. [ 255.391601][ T9495] FAULT_INJECTION: forcing a failure. [ 255.391601][ T9495] name failslab, interval 1, probability 0, space 0, times 0 [ 255.434255][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: syz.3.1088 Not tainted syzkaller #0 PREEMPT(full) [ 255.434279][ T9495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 255.434289][ T9495] Call Trace: [ 255.434296][ T9495] [ 255.434305][ T9495] dump_stack_lvl+0xe8/0x150 [ 255.434331][ T9495] should_fail_ex+0x412/0x560 [ 255.434355][ T9495] should_failslab+0xa8/0x100 [ 255.434374][ T9495] __kmalloc_cache_noprof+0x88/0x660 [ 255.434396][ T9495] ? sctp_add_bind_addr+0x8c/0x370 [ 255.434420][ T9495] sctp_add_bind_addr+0x8c/0x370 [ 255.434441][ T9495] sctp_copy_local_addr_list+0x314/0x4f0 [ 255.434463][ T9495] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 255.434480][ T9495] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 255.434499][ T9495] ? sctp_v6_is_any+0x64/0x80 [ 255.434518][ T9495] ? sctp_copy_one_addr+0x93/0x360 [ 255.434537][ T9495] sctp_bind_addr_copy+0xb3/0x3c0 [ 255.434556][ T9495] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 255.434581][ T9495] sctp_connect_new_asoc+0x2ff/0x6b0 [ 255.434603][ T9495] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 255.434629][ T9495] ? __local_bh_enable_ip+0xd0/0x130 [ 255.434643][ T9495] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 255.434662][ T9495] ? security_sctp_bind_connect+0x7e/0x2c0 [ 255.434684][ T9495] sctp_sendmsg+0x1576/0x2c50 [ 255.434701][ T9495] ? unwind_next_frame+0xa6/0x2550 [ 255.434752][ T9495] ? __pfx_sctp_sendmsg+0x10/0x10 [ 255.434766][ T9495] ? aa_sk_perm+0x6d5/0x900 [ 255.434783][ T9495] ? __pfx_aa_sk_perm+0x10/0x10 [ 255.434798][ T9495] ? sock_rps_record_flow+0x19/0x350 [ 255.434812][ T9495] ? inet_sendmsg+0x2f4/0x370 [ 255.434824][ T9495] ____sys_sendmsg+0x80a/0x9f0 [ 255.434839][ T9495] ? __pfx_____sys_sendmsg+0x10/0x10 [ 255.434853][ T9495] ? import_iovec+0x73/0xa0 [ 255.434927][ T9495] ___sys_sendmsg+0x2a5/0x360 [ 255.434936][ T9495] ? __lock_acquire+0x6b5/0x2cf0 [ 255.434949][ T9495] ? __pfx____sys_sendmsg+0x10/0x10 [ 255.434976][ T9495] ? __fget_files+0x2a/0x420 [ 255.434988][ T9495] ? __fget_files+0x3a0/0x420 [ 255.435005][ T9495] __x64_sys_sendmsg+0x1bd/0x2a0 [ 255.435016][ T9495] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 255.435037][ T9495] ? __pfx_ksys_write+0x10/0x10 [ 255.435055][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.435065][ T9495] do_syscall_64+0x174/0x580 [ 255.435076][ T9495] ? trace_irq_disable+0x3b/0x140 [ 255.435091][ T9495] ? clear_bhb_loop+0x40/0x90 [ 255.435106][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.435115][ T9495] RIP: 0033:0x7fb09019ce59 [ 255.435126][ T9495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 255.435134][ T9495] RSP: 002b:00007fb091029028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 255.435145][ T9495] RAX: ffffffffffffffda RBX: 00007fb090415fa0 RCX: 00007fb09019ce59 [ 255.435152][ T9495] RDX: 0000000000040040 RSI: 00002000000003c0 RDI: 0000000000000005 [ 255.435158][ T9495] RBP: 00007fb091029090 R08: 0000000000000000 R09: 0000000000000000 [ 255.435163][ T9495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 255.435169][ T9495] R13: 00007fb090416038 R14: 00007fb090415fa0 R15: 00007fb09053fa48 [ 255.435184][ T9495] [ 255.765540][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.771896][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.359127][ T29] audit: type=1800 audit(1781194623.828:352): pid=9510 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1092" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 OK Stopping syslogd: stopped /sbin/syslogd (pid 4981) OK [ 257.034817][ T5729] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 257.197265][ T5729] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 257.229431][ T5729] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 umount: can't remount debugfs read-only umount:[ 257.271473][ T5729] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 tmpfs busy - remounted read-only [ 257.307575][ T5729] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 257.345069][ T5729] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.382533][ T5729] usb 1-1: config 0 descriptor?? [ 257.861218][ T5729] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 257.911650][ T5692] usb 5-1: new full-speed USB device number 31 using dummy_hcd [ 258.116050][ T5692] usb 5-1: config 0 has an invalid interface number: 172 but max is 0 [ 258.135872][ T5692] usb 5-1: config 0 has no interface number 0 [ 258.142605][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802b608400: rx timeout, send abort [ 258.154595][ T5692] usb 5-1: too many endpoints for config 0 interface 172 altsetting 118: 97, using maximum allowed: 30 [ 258.180274][ T5692] usb 5-1: config 0 interface 172 altsetting 118 has 0 endpoint descriptors, different from the interface descriptor's value: 97 [ 258.193735][ T5692] usb 5-1: config 0 interface 172 has no altsetting 0 [ 258.204773][ T5692] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 258.214273][ T5692] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.222300][ T5692] usb 5-1: Product: syz [ 258.226671][ T5692] usb 5-1: Manufacturer: syz [ 258.231305][ T5692] usb 5-1: SerialNumber: syz [ 258.240167][ T5692] usb 5-1: config 0 descriptor?? [ 258.472359][ T5692] usb 5-1: USB disconnect, device number 31 [ 258.642670][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802b609400: rx timeout, send abort [ 258.651033][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802b608400: abort rx timeout. Force session deactivation [ 258.770801][ T9567] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1109'. [ 258.790108][ T4964] null_blk: rq ffff888027711980 timed out [ 258.799698][ T4964] timeout error, dev nullb0, sector 109216 op 0x1:(WRITE) flags 0x0 phys_seg 1 prio class 2 [ 258.811079][ T4964] buffer_io_error: 11 callbacks suppressed [ 258.811169][ T4964] Buffer I/O error on dev nullb0, logical block 13652, lost async page write [ 258.852129][ T9567] macvlan0: entered promiscuous mode [ 258.876346][ T9567] bond0: entered promiscuous mode [ 258.876367][ T9567] bond_slave_0: entered promiscuous mode [ 258.876574][ T9567] bond_slave_1: entered promiscuous mode [ 258.878414][ T9567] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 258.881597][ T9567] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 258.964676][ T5692] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 259.124324][ T5692] usb 3-1: Using ep0 maxpacket: 32 [ 259.135982][ T5692] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 259.138493][ C0] plantronics 0003:047F:FFFF.0009: usb_submit_urb(ctrl) failed: -1 [ 259.150979][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802b609400: abort rx timeout. Force session deactivation [ 259.165310][ T5692] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 259.225697][ T5692] usb 3-1: New USB device found, idVendor=25dd, idProduct=f3d2, bcdDevice=d2.37 [ 259.244906][ T5692] usb 3-1: New USB device strings: Mfr=84, Product=45, SerialNumber=0 [ 259.259498][ T5692] usb 3-1: Product: syz [ 259.268163][ T5692] usb 3-1: Manufacturer: syz [ 259.285622][ T5365] usb 1-1: reset high-speed USB device number 34 using dummy_hcd [ 259.315487][ T5692] usb 3-1: config 0 descriptor?? umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! [ 259.478658][ T4999] udevd[4999]: could not touch /run/udev/queue: Read-only file system Sent SIGTERM to all processes [ 259.519996][ T5365] usb 1-1: device descriptor read/64, error -32 [ 259.593945][ T5692] usbhid 3-1:0.0: can't add hid device: -71 [ 259.613072][ T5692] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 Connection to 10.128.0.175 closed by remote host. [ 259.681957][ T5692] usb 3-1: USB disconnect, device number 32 [ 260.541265][ T5649] syz_tun (unregistering): left allmulticast mode [ 260.558573][ T5729] usb 1-1: USB disconnect, device number 34 Sent SIGKILL to all processes Requesting system poweroff [ 260.946652][ T6405] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.049240][ T6405] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.147256][ T6405] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.242884][ T6405] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.358915][ T6405] bridge_slave_1: left allmulticast mode [ 261.364849][ T6405] bridge_slave_1: left promiscuous mode [ 261.373057][ T6405] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.385628][ T6405] bridge_slave_0: left allmulticast mode [ 261.392054][ T6405] bridge_slave_0: left promiscuous mode [ 261.398268][ T6405] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.592793][ T6405] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 261.603555][ T6405] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 261.613423][ T6405] bond0 (unregistering): Released all slaves [ 261.623865][ T6405] bond1 (unregistering): Released all slaves [ 261.708831][ T6405] tipc: Left network mode [ 261.821847][ T9579] smc: removing smcd device lo [ 261.823012][ T9] usb 2-1: emi26_load_firmware - request_firmware() failed [ 261.836619][ T9] usb 2-1: emi26_load_firmware - error loading firmware: error = -2 [ 261.845278][ T9] emi26 - firmware loader 2-1:201.69: probe with driver emi26 - firmware loader failed with error -5 [ 261.864856][ T9] emi26 - firmware loader 2-1:201.240: emi26_probe start [ 261.872925][ T9] usb 2-1: Direct firmware load for emi26/loader.fw failed with error -2 [ 261.881912][ T9] usb 2-1: Falling back to sysfs fallback for: emi26/loader.fw [ 261.890047][ T9] ------------[ cut here ]------------ [ 261.895945][ T9] ret [ 261.895966][ T9] WARNING: drivers/base/firmware_loader/fallback.c:148 at firmware_fallback_sysfs+0x746/0xa30, CPU#0: kworker/0:0/9 [ 261.911245][ T9] Modules linked in: [ 261.915726][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 261.925160][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 261.935468][ T9] Workqueue: usb_hub_wq hub_event [ 261.940586][ T9] RIP: 0010:firmware_fallback_sysfs+0x746/0xa30 [ 261.947164][ T9] Code: bb fb e9 5d fc ff ff e8 68 ac bb fb c6 05 6f 3d 10 0a 01 48 c7 c7 80 08 54 8c e8 45 a1 1d fb e9 85 fc ff ff e8 4b ac bb fb 90 <0f> 0b 90 4c 89 f7 48 c7 c6 80 09 54 8c 4c 89 e2 e8 b5 41 22 fb e9 [ 261.967044][ T9] RSP: 0018:ffffc900000e6a90 EFLAGS: 00010283 [ 261.973099][ T9] RAX: ffffffff860a0b55 RBX: dffffc0000000000 RCX: 0000000000100000 [ 261.981346][ T9] RDX: ffffc9001b366000 RSI: 00000000000d139c RDI: 00000000000d139d [ 261.991066][ T9] RBP: 0000000000000001 R08: ffffffff903037f7 R09: 1ffffffff20606fe [ 261.999590][ T9] R10: dffffc0000000000 R11: fffffbfff20606ff R12: ffffffff8c8c5e60 [ 262.007832][ T9] R13: 0000000000001770 R14: ffff8880336330b0 R15: 00000000fffffff5 [ 262.016068][ T9] FS: 0000000000000000(0000) GS:ffff8881252a0000(0000) knlGS:0000000000000000 [ 262.025498][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 262.032082][ T9] CR2: 00007fabc11f84c0 CR3: 00000000335e2000 CR4: 00000000003526f0 [ 262.040332][ T9] Call Trace: [ 262.043598][ T9] [ 262.046770][ T9] ? kfree+0x1c5/0x640 [ 262.050830][ T9] ? _request_firmware+0xf11/0x1780 [ 262.056042][ T9] ? __kmalloc_cache_noprof+0x15b/0x660 [ 262.061578][ T9] _request_firmware+0x1052/0x1780 [ 262.066821][ T9] ? __pfx__request_firmware+0x10/0x10 [ 262.072282][ T9] ? __kmalloc_cache_noprof+0x31c/0x660 [ 262.078090][ T9] ? do_raw_spin_lock+0x12b/0x2f0 [ 262.083106][ T9] request_firmware+0x36/0x50 [ 262.088032][ T9] emi26_probe+0x16a/0x1690 [ 262.092540][ T9] ? __pfx_emi26_probe+0x10/0x10 [ 262.097787][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 262.103599][ T9] usb_probe_interface+0x659/0xc70 [ 262.109064][ T9] ? __pfx_usb_probe_interface+0x10/0x10 [ 262.115190][ T9] really_probe+0x267/0xaf0 [ 262.119792][ T9] __driver_probe_device+0x1ef/0x380 [ 262.125353][ T9] driver_probe_device+0x4f/0x240 [ 262.130372][ T9] __device_attach_driver+0x279/0x430 [ 262.135997][ T9] bus_for_each_drv+0x258/0x2f0 [ 262.140901][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 262.147341][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 262.152730][ T9] ? lockdep_hardirqs_on+0x7a/0x110 [ 262.158348][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 262.164516][ T9] __device_attach+0x2c5/0x450 [ 262.169278][ T9] ? __pfx___device_attach+0x10/0x10 [ 262.174835][ T9] ? _raw_spin_unlock+0x28/0x50 [ 262.179675][ T9] device_initial_probe+0xa1/0xd0 [ 262.184958][ T9] bus_probe_device+0x12a/0x220 [ 262.189801][ T9] device_add+0x7e9/0xbb0 [ 262.194608][ T9] usb_set_configuration+0x1a87/0x2110 [ 262.200077][ T9] usb_generic_driver_probe+0x8d/0x150 [ 262.205889][ T9] usb_probe_device+0x1c4/0x3b0 [ 262.210726][ T9] ? __pfx_usb_probe_device+0x10/0x10 [ 262.216370][ T9] really_probe+0x267/0xaf0 [ 262.220864][ T9] __driver_probe_device+0x1ef/0x380 [ 262.226408][ T9] driver_probe_device+0x4f/0x240 [ 262.231421][ T9] __device_attach_driver+0x279/0x430 [ 262.237050][ T9] bus_for_each_drv+0x258/0x2f0 [ 262.241891][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 262.248029][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 262.253386][ T9] ? lockdep_hardirqs_on+0x7a/0x110 [ 262.258848][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 262.264911][ T9] __device_attach+0x2c5/0x450 [ 262.269667][ T9] ? __pfx___device_attach+0x10/0x10 [ 262.275219][ T9] ? _raw_spin_unlock+0x28/0x50 [ 262.280061][ T9] device_initial_probe+0xa1/0xd0 [ 262.285342][ T9] bus_probe_device+0x12a/0x220 [ 262.290184][ T9] device_add+0x7e9/0xbb0 [ 262.294783][ T9] usb_new_device+0xa08/0x16f0 [ 262.299554][ T9] ? __pfx_usb_new_device+0x10/0x10 [ 262.305033][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 262.310304][ T9] hub_event+0x2a1c/0x4f30 [ 262.315188][ T9] ? do_raw_spin_unlock+0xf5/0x210 [ 262.320342][ T9] ? __pfx_hub_event+0x10/0x10 [ 262.325371][ T9] ? process_scheduled_works+0xa70/0x1860 [ 262.331077][ T9] ? process_scheduled_works+0xa70/0x1860 [ 262.337056][ T9] ? process_scheduled_works+0xa70/0x1860 [ 262.342774][ T9] process_scheduled_works+0xb5d/0x1860 [ 262.348599][ T9] ? __pfx_process_scheduled_works+0x10/0x10 [ 262.354831][ T9] ? assign_work+0x3d5/0x5e0 [ 262.359418][ T9] worker_thread+0xa53/0xfc0 [ 262.364037][ T9] kthread+0x389/0x470 [ 262.368356][ T9] ? __pfx_worker_thread+0x10/0x10 [ 262.373454][ T9] ? __pfx_kthread+0x10/0x10 [ 262.378060][ T9] ret_from_fork+0x514/0xb70 [ 262.382661][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 262.388563][ T9] ? __switch_to+0xc79/0x1410 [ 262.393257][ T9] ? __pfx_kthread+0x10/0x10 [ 262.398123][ T9] ret_from_fork_asm+0x1a/0x30 [ 262.402896][ T9] [ 262.406314][ T9] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 262.413581][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 262.422674][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 262.432726][ T9] Workqueue: usb_hub_wq hub_event [ 262.437750][ T9] Call Trace: [ 262.441014][ T9] [ 262.443929][ T9] vpanic+0x56c/0xa60 [ 262.447911][ T9] ? __pfx__printk+0x10/0x10 [ 262.452506][ T9] ? __pfx_vpanic+0x10/0x10 [ 262.457001][ T9] ? is_bpf_text_address+0x292/0x2b0 [ 262.462278][ T9] ? is_bpf_text_address+0x26/0x2b0 [ 262.467480][ T9] panic+0xc5/0xd0 [ 262.471214][ T9] ? __pfx_panic+0x10/0x10 [ 262.475651][ T9] ? ret_from_fork_asm+0x1a/0x30 [ 262.480612][ T9] __warn+0x315/0x4c0 [ 262.484598][ T9] ? firmware_fallback_sysfs+0x746/0xa30 [ 262.490216][ T9] ? firmware_fallback_sysfs+0x746/0xa30 [ 262.495828][ T9] __report_bug+0x29a/0x540 [ 262.500468][ T9] ? firmware_fallback_sysfs+0x746/0xa30 [ 262.506084][ T9] ? __pfx___report_bug+0x10/0x10 [ 262.511083][ T9] ? __up_read+0x291/0x6b0 [ 262.515490][ T9] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 262.521285][ T9] ? firmware_fallback_sysfs+0x746/0xa30 [ 262.526907][ T9] report_bug+0x16a/0x220 [ 262.531248][ T9] ? firmware_fallback_sysfs+0x746/0xa30 [ 262.536864][ T9] ? firmware_fallback_sysfs+0x748/0xa30 [ 262.542481][ T9] handle_bug+0x9c/0x200 [ 262.546703][ T9] exc_invalid_op+0x1a/0x50 [ 262.551218][ T9] asm_exc_invalid_op+0x1a/0x20 [ 262.556047][ T9] RIP: 0010:firmware_fallback_sysfs+0x746/0xa30 [ 262.562269][ T9] Code: bb fb e9 5d fc ff ff e8 68 ac bb fb c6 05 6f 3d 10 0a 01 48 c7 c7 80 08 54 8c e8 45 a1 1d fb e9 85 fc ff ff e8 4b ac bb fb 90 <0f> 0b 90 4c 89 f7 48 c7 c6 80 09 54 8c 4c 89 e2 e8 b5 41 22 fb e9 [ 262.581857][ T9] RSP: 0018:ffffc900000e6a90 EFLAGS: 00010283 [ 262.587922][ T9] RAX: ffffffff860a0b55 RBX: dffffc0000000000 RCX: 0000000000100000 [ 262.595875][ T9] RDX: ffffc9001b366000 RSI: 00000000000d139c RDI: 00000000000d139d [ 262.603841][ T9] RBP: 0000000000000001 R08: ffffffff903037f7 R09: 1ffffffff20606fe [ 262.611790][ T9] R10: dffffc0000000000 R11: fffffbfff20606ff R12: ffffffff8c8c5e60 [ 262.619743][ T9] R13: 0000000000001770 R14: ffff8880336330b0 R15: 00000000fffffff5 [ 262.627705][ T9] ? firmware_fallback_sysfs+0x745/0xa30 [ 262.633331][ T9] ? kfree+0x1c5/0x640 [ 262.637405][ T9] ? _request_firmware+0xf11/0x1780 [ 262.642581][ T9] ? __kmalloc_cache_noprof+0x15b/0x660 [ 262.648112][ T9] _request_firmware+0x1052/0x1780 [ 262.653218][ T9] ? __pfx__request_firmware+0x10/0x10 [ 262.658659][ T9] ? __kmalloc_cache_noprof+0x31c/0x660 [ 262.664188][ T9] ? do_raw_spin_lock+0x12b/0x2f0 [ 262.669215][ T9] request_firmware+0x36/0x50 [ 262.673881][ T9] emi26_probe+0x16a/0x1690 [ 262.678377][ T9] ? __pfx_emi26_probe+0x10/0x10 [ 262.683299][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 262.689091][ T9] usb_probe_interface+0x659/0xc70 [ 262.694190][ T9] ? __pfx_usb_probe_interface+0x10/0x10 [ 262.699795][ T9] really_probe+0x267/0xaf0 [ 262.704278][ T9] __driver_probe_device+0x1ef/0x380 [ 262.709545][ T9] driver_probe_device+0x4f/0x240 [ 262.714556][ T9] __device_attach_driver+0x279/0x430 [ 262.719928][ T9] bus_for_each_drv+0x258/0x2f0 [ 262.724764][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 262.730632][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 262.735984][ T9] ? lockdep_hardirqs_on+0x7a/0x110 [ 262.741161][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 262.746950][ T9] __device_attach+0x2c5/0x450 [ 262.751691][ T9] ? __pfx___device_attach+0x10/0x10 [ 262.756953][ T9] ? _raw_spin_unlock+0x28/0x50 [ 262.761784][ T9] device_initial_probe+0xa1/0xd0 [ 262.766798][ T9] bus_probe_device+0x12a/0x220 [ 262.771657][ T9] device_add+0x7e9/0xbb0 [ 262.775986][ T9] usb_set_configuration+0x1a87/0x2110 [ 262.781435][ T9] usb_generic_driver_probe+0x8d/0x150 [ 262.786875][ T9] usb_probe_device+0x1c4/0x3b0 [ 262.791704][ T9] ? __pfx_usb_probe_device+0x10/0x10 [ 262.797051][ T9] really_probe+0x267/0xaf0 [ 262.801535][ T9] __driver_probe_device+0x1ef/0x380 [ 262.806797][ T9] driver_probe_device+0x4f/0x240 [ 262.811797][ T9] __device_attach_driver+0x279/0x430 [ 262.817151][ T9] bus_for_each_drv+0x258/0x2f0 [ 262.821985][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 262.827872][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 262.833224][ T9] ? lockdep_hardirqs_on+0x7a/0x110 [ 262.838396][ T9] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 262.844193][ T9] __device_attach+0x2c5/0x450 [ 262.848933][ T9] ? __pfx___device_attach+0x10/0x10 [ 262.854195][ T9] ? _raw_spin_unlock+0x28/0x50 [ 262.859028][ T9] device_initial_probe+0xa1/0xd0 [ 262.864031][ T9] bus_probe_device+0x12a/0x220 [ 262.868872][ T9] device_add+0x7e9/0xbb0 [ 262.873185][ T9] usb_new_device+0xa08/0x16f0 [ 262.877936][ T9] ? __pfx_usb_new_device+0x10/0x10 [ 262.883115][ T9] ? _raw_spin_unlock_irq+0x23/0x50 [ 262.888295][ T9] hub_event+0x2a1c/0x4f30 [ 262.892693][ T9] ? do_raw_spin_unlock+0xf5/0x210 [ 262.897808][ T9] ? __pfx_hub_event+0x10/0x10 [ 262.902552][ T9] ? process_scheduled_works+0xa70/0x1860 [ 262.908251][ T9] ? process_scheduled_works+0xa70/0x1860 [ 262.913949][ T9] ? process_scheduled_works+0xa70/0x1860 [ 262.919649][ T9] process_scheduled_works+0xb5d/0x1860 [ 262.925195][ T9] ? __pfx_process_scheduled_works+0x10/0x10 [ 262.931157][ T9] ? assign_work+0x3d5/0x5e0 [ 262.935724][ T9] worker_thread+0xa53/0xfc0 [ 262.940306][ T9] kthread+0x389/0x470 [ 262.944357][ T9] ? __pfx_worker_thread+0x10/0x10 [ 262.949445][ T9] ? __pfx_kthread+0x10/0x10 [ 262.954014][ T9] ret_from_fork+0x514/0xb70 [ 262.958584][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 262.963671][ T9] ? __switch_to+0xc79/0x1410 [ 262.968331][ T9] ? __pfx_kthread+0x10/0x10 [ 262.972905][ T9] ret_from_fork_asm+0x1a/0x30 [ 262.977659][ T9] [ 262.980940][ T9] Kernel Offset: disabled [ 262.985251][ T9] Rebooting in 86400 seconds..