last executing test programs: 3.51187899s ago: executing program 1 (id=220): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000700)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fddbdf252800000008000300", @ANYRES32=r3, @ANYBLOB="0500110008000000050010"], 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x80) 3.378091096s ago: executing program 0 (id=221): sendmsg$NL80211_CMD_GET_SURVEY(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000010}, 0x4040091) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$getregset(0x4204, r0, 0x202, &(0x7f0000000180)={0x0}) 3.339185437s ago: executing program 1 (id=223): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0xf, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) r1 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000000)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.062200744s ago: executing program 0 (id=224): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_raw(r0, &(0x7f0000000000)={0x1d, r1}, 0x10) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) bind$can_raw(r0, &(0x7f0000000080), 0x10) 2.88462701s ago: executing program 0 (id=226): set_mempolicy(0x5, &(0x7f0000000380)=0x3, 0x9) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}}}}}}, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000000)=ANY=[], 0xffc9) 2.63534544s ago: executing program 0 (id=228): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffff8]}, 0x8, 0x80000) r1 = syz_io_uring_setup(0xf0b, &(0x7f0000000400)={0x0, 0x8000595d, 0x1000, 0x20003, 0x1000051, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f0000000180)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x110a}, 0x1}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, 0x0) 2.620465057s ago: executing program 3 (id=229): r0 = socket(0x11, 0xa, 0x5) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0xe88, 0x4) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000040)={'ipvlan0\x00', {0x2, 0x4e20, @loopback}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendto$inet(r0, &(0x7f0000000000)="cf3a19d02404e49cf90a0a4363d1", 0xe, 0x4008080, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) 2.403153546s ago: executing program 0 (id=230): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3e616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000280), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.332255278s ago: executing program 3 (id=231): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text32={0x20, 0x0}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x40000073, 0x0, 0xffff}]}) 2.121831925s ago: executing program 2 (id=233): r0 = socket$kcm(0x2, 0x3, 0x106) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x4e21, @remote}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000600)="b9ed29d8fe490a060b483f2dd090fc6889ae6b84", 0xffeb}], 0x1}, 0x0) 1.873858254s ago: executing program 4 (id=235): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000180)=0x27b, 0x4) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast2, 0x8}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) write(r0, &(0x7f0000000200)="89", 0xffe3) 1.689862474s ago: executing program 2 (id=236): unshare(0xe060400) r0 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) syz_clone3(&(0x7f0000000340)={0x301800000, 0x0, 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0, 0x0, {r1}}, 0x58) 1.649483371s ago: executing program 1 (id=237): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x1, 0x4, 0x17fe2, 0x1, 0x1, 0xffffffffffffffff, 0xfff}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000640)={{r0, 0xffffffffffffffff}, &(0x7f0000000600), &(0x7f00000001c0)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.413318244s ago: executing program 2 (id=238): r0 = memfd_create(&(0x7f0000000500)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x1c\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\x83\x11\v}k+\xeb\xc3\xc0O\xae\xd2\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb901nEy\x82\x83\x80\xd3O\x00|hP\x00\x00\x00\x00\x00\x00\x00\x05\x86\xfe\xd9\xa5\xc6\nSy\xa3N\xba-]\'q\xc6\xfb\x02\x9a\xa9Z\xa8\x80Bx\xbd74\xcf\"\xa5\xea$\x95\xfd\x06T\xef\x89\xe4j\x06\xdc\x15\xe7\xc3\xb5H\xf7\xdc\xee\x182\xab\xe2?\"\xbewm\x9d\xd8x\xd92\xeeS/\xd2\xcd[\x9dcO1\xcb\x12lZ$\xa7\x9d\xf8b\xf6}\xc5``\xfe0\x8a\'v-\x99`?\x97\x8c\xdd\xd6\xfa\xa2\x06>\xf3\xe2uI\xe65C\xdb\x84\xe6eU\xe8RK\xd6=s\xcd\x9d\x1f#3\xc5\x16\xd0\xbbD\xc5\xde\xc8/\v\xa5W\xbep\x87\x15\x10\xcdm\xa7\x93\x01\x1c,9V8\xdc\xfd\xb7\xc0\xfc\x04\x00p\xad\x12\xb2\xbf\xfbFZ\x1a\f\x99\x05\xe4\x1eP\xed\x87\x89\xbeo\xfbv\xb6\x8a\xee\xf6Oc8\xaf\x11[\xc3\x98w-\xf0\xb2z\xc7\xaf;\x92\xad4\x1b\x92L\x97<\xbdh\x80\xf2\xc0\xd0n)K\xf2#Ncp\xe4\xb4\xfb\x94\x18\xc2-TWA\x13\xfe\xea\xad\v\xc4\xa5\x02\xf9\xed]\xf4\\\x01\xab\xdc\xb6\xcdP\x93\xf2\xc3\x96\xf2\xc0\xd6-x\xd5\xd6\xc7\x9d\xa5\x1f\xd2t\xd7\x8f}b\x9749\xd4a7\x18\xe0\x91KV7[\xb8\x8dL\xc8\xc8\x8f>sbE\xf5\xa7\xdb|\xb0m\x16c\x84\r\"\xf2\x92s\xeb\xaf\x1c\x00\xf4\x8dL\xa5\x10\x89FB\xfb8\xf9\x9d\xcbm\x1c\x91\xe9fd$5\xdc\xad\xec\xef\x90\xd9\xefX\xd2m\x9e\xec\x94w\xb3\xf9\xd9\x0eu-z\x81\xbb\xa6\xc0\x00\xa1\xd9\xcbI\xda\xa3\b\x9e@\xb8\xc8k\xdeQ/\xb8X\x9c\xff4Np~\xc4\xc1_\x1c#zX\a\xd41\x1c\x7fH\x91\xd9k\x05\x1f\n\b\b\x88\xd6\xcf4i\xa0B\xe7\x9c\x9c\xe6\xcax\xca\xa1E#6\xe9\xf31W\xd0\x1bY3/\x00I#\xfa\xb0\f\xd5!\x9fR[\x0e\xdb`\xdb\x82M\'k\x16(\xfa\xc2\xec\x96e\\Q\xe9\x19\xe1u\x86\xcb\xc3\xb0\xb8\x19\xb9l\x1fk!R\xb1P\x8b\xda\xffE\x89\x97\n\x17m\xd10\x1a\xe7Qz\xd8\bi\x8dRw+\xa1^N\xaf\x1b\x1dg\x8f$\xbe\x93\x8d\x8b\xfd\r\xee<\x84\x95\x82)TH\xcac9\x98\x13WW@;\xb4\xd5\x0f\xa1\xb3xX(\x80\xe8\x89\xed e.\xe04\xba\x9c=\xc6\x04\f\xbf\x06\xce5\xf99GD8@\xd2\r\xd0\xdf@\xe3\xbe\"qq#]\x86W\tA\xa7\x91\x85\xae\x9c\x8dO\xa6\xa3\xf9i\x83\xc5\xa8C\x164\xef\xa4\\\a\xaa%\x94!3k]\xd5\xbe\'U\xf17', 0x1) r1 = dup(r0) r2 = dup(r1) write$binfmt_elf64(r2, &(0x7f0000000040)={{0x7f, 0x45, 0x4c, 0x46, 0x6, 0xff, 0x78, 0xa3, 0x23e, 0x2, 0x3e, 0xcd, 0x3c9, 0x40, 0x2ea, 0x10000, 0x5, 0x38, 0x1, 0x6, 0x6b1, 0x400}, [{0x3, 0x81, 0xff, 0xff5, 0x5, 0x9, 0x7}]}, 0x78) execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 1.406601466s ago: executing program 4 (id=239): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x2) fchdir(r1) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x1) 1.191061374s ago: executing program 1 (id=240): symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r0 = landlock_create_ruleset(&(0x7f0000000240)={0x2001, 0x0, 0x2}, 0x30, 0x0) landlock_restrict_self(r0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 1.085367802s ago: executing program 3 (id=241): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001140)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) setxattr$system_posix_acl(&(0x7f0000000040)='./mnt\x00', &(0x7f00000002c0)='system.posix_acl_default\x00', &(0x7f00000010c0)={{}, {0x1, 0x1}, [{0x2, 0x4}], {}, [], {}, {0x20, 0x5}}, 0x2c, 0x2) 1.073900159s ago: executing program 2 (id=242): r0 = socket$inet_sctp(0x2, 0x5, 0x84) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84880) splice(r1, 0x0, r2, 0x0, 0x6, 0xc) close_range(r0, 0xffffffffffffffff, 0x0) 1.01592886s ago: executing program 4 (id=243): sched_setscheduler(0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f0000000140)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0) write(r0, &(0x7f0000000040)="3c5c413ecd45036a2762bb626c65640a", 0x10) 946.516479ms ago: executing program 1 (id=244): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0c0009800800014000000002080008400000000114000000110001"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) 884.288839ms ago: executing program 3 (id=245): r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000080)=0x2) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x46, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0xa, 0x5, 0x4, 0x0, 0x7, 0x7, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x2, 0x7, 0x205, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0x12, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0x6, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x20000000, 0x4, 0x1007, 0x0, 0x6, 0x400, 0x401, 0x6, 0x1, 0x20000ff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x48, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8003, 0x1, 0xfe000000, 0xffee, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000008, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x3, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x6, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x20000038, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0xeee, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x1, 0x7fff, 0xfffc, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x5, 0x5, 0xca, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x3, 0x226, 0x4, 0x5, 0x7, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 815.224443ms ago: executing program 4 (id=246): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x439, 0x0, 0xfffffffc, {0x0, 0x0, 0xe403, 0x0, 0x0, 0x2}}, 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/raw6\x00') r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002200"], 0x1c}], 0x1}, 0x0) 715.11645ms ago: executing program 2 (id=247): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./binfmt\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./binfmt\x00', &(0x7f0000000240)='binfmt_misc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./binfmt/status\x00', 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') read$FUSE(r0, 0x0, 0x0) 517.050843ms ago: executing program 1 (id=248): r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r1 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r1, 0x403c6f2b, &(0x7f00000000c0)={0x1006, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343d268ad11f422897300", "00080000000ba790173602a8507700"}, 0x3eaf, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0x80, 0x0, 0x1, 0xe}) 515.5391ms ago: executing program 4 (id=249): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='7', 0x1) memfd_create(&(0x7f0000000300)='/dev/loop#\x00\xee\b\xce\xde\xe9\x8d\xd2\xd59\xe8\xda\b\xd6\xb2\x15\xf6F\xb8\xb4{r.\xd2\xea\xec\xdbXe&J \xe9\x16\x82\xe8=\x83\x88sN\x83N`\xf9\xec\xe1\xb16\xfb*\xf5\xd5\\\xa7\xebe\xbe\x9d\xd7\xf5\xb9<\xb2\xc4\xf9:\xef\xc0g\xc3\xb5\x7f\xc0\xcck.5=\xcc\x10Y\xad^*\x10\x00\x00\x00\x00\x00\x00\x00\x0e%\x84\x95bXy\x81;o\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa9{b\xab\x91\x88\xba\xa5J\xfd\xd2\x96R\x06\xeeP\x0f\xb0\xad_\x0e\xf6\xe7k\xbf\x93)\x02yX\x91\xc0\xef\x10\xd2\xbd9\x87<[BKq\t*t\x9e\xf9\xa6\xb5\xda\tb\xcc%?\x14Y\x9b\x18nx\x19\x11\xb7\x9d~\xc5{O\xd0S\xbdi\xf8\"P>4\x05E|h?\x0f\xf5\xf8\x8c\xce\xebXN\xb7\xc0F\xbao\xf7\xab\xedO\x96\xa1(\n\x1e\xf9\xbe/\xe0\xe2^\xb0\xb6{\x1fdX\x100v\xab\xce\x05\x00i\x85\xf63\x05\b\xd8\xeb\xdf\x00\x00]N\xe1\x9di&\r\xd2pw\x85\vQ \x82v\x8a7\xb6\xf8\x1c\x8c\xf0\xaf\xfa\x17\xbeD\a\vM\x87\xc0Q\xd4\xd3\xc7I@Z\t\xa9\xf0\x9d4c\xb1^\xeeF\x96\xa1{OV\xe0\x1e#\xb3w\xc7\x87\xdd\'\xe1\xf7\'+s\x15\xeb\xb1D\x86\x93\x1e\xf9\xf1L\x0f\x9b7/\xd9D\x91\xc47hI\xbc\x13.@R\v\x00\x00\x00\x00\x00\x00\x00\xe2\xc8\xb2\x9bD\xb2P\xdc\xd4\xb1\xa50\x9f\x83~)\x9b7-\x80&r\xbc\xf60x0}) sendto$packet(r0, &(0x7f00000010c0)="14042bfdd3fc03fc0100", 0xa, 0x4, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 58.546727ms ago: executing program 0 (id=253): setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001200)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@private=0xa010101, 0x4e23, 0x0, 0x4e1d, 0x1003, 0x2, 0x20, 0x80, 0x11}, {0x80000000, 0x9, 0x8, 0x3, 0xf, 0x81, 0xff, 0x408}, {0x1, 0x4e, 0x3, 0x4}, 0x85, 0xfffffffc, 0x1, 0x0, 0x1, 0x1}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4d6, 0x3c}, 0x2, @in6=@mcast1, 0x0, 0x4, 0x0, 0x0, 0x4, 0x8, 0xc}}, 0xe8) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000001280), 0x6) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000580)={0x26, {{0x2, 0x4e21, @empty=0xe0009eff}}, {{0x2, 0x4e24, @remote}}}, 0x108) 0s ago: executing program 3 (id=254): unshare(0x22020600) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.55' (ED25519) to the list of known hosts. [ 80.222248][ T5580] cgroup: Unknown subsys name 'net' [ 80.464624][ T5580] cgroup: Unknown subsys name 'cpuset' [ 80.518643][ T5580] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 82.375958][ T5580] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 84.909841][ T5601] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 84.936495][ T5601] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 84.978172][ T5601] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.001987][ T5611] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 85.038964][ T5611] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 85.041183][ T5612] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.044229][ T5613] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.045061][ T5601] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 85.052988][ T5601] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 85.058009][ T5613] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 85.060916][ T5601] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.061189][ T5601] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.061928][ T5601] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 85.070200][ T5601] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 85.070819][ T5601] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.072204][ T5613] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.072728][ T5601] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 85.074275][ T5613] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.075010][ T5613] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 85.076858][ T5613] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.082910][ T4910] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.087901][ T5613] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 85.088985][ T5613] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 85.089785][ T5613] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.093491][ T5608] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.140361][ T5599] Bluetooth: hci1: command tx timeout [ 87.140920][ T5608] Bluetooth: hci4: command tx timeout [ 87.204252][ T9] cfg80211: failed to load regulatory.db [ 87.218011][ T5599] Bluetooth: hci0: command tx timeout [ 87.218571][ T5608] Bluetooth: hci2: command tx timeout [ 87.218589][ T59] Bluetooth: hci3: command tx timeout [ 87.657276][ T5592] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.659757][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.659995][ T5592] bridge_slave_0: entered allmulticast mode [ 87.663129][ T5592] bridge_slave_0: entered promiscuous mode [ 87.731532][ T5592] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.732013][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.733316][ T5592] bridge_slave_1: entered allmulticast mode [ 87.735999][ T5592] bridge_slave_1: entered promiscuous mode [ 87.752256][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.752375][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.752854][ T5593] bridge_slave_0: entered allmulticast mode [ 87.755510][ T5593] bridge_slave_0: entered promiscuous mode [ 87.826005][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.826243][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.826418][ T5593] bridge_slave_1: entered allmulticast mode [ 87.829973][ T5593] bridge_slave_1: entered promiscuous mode [ 87.833302][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.833411][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.833571][ T5594] bridge_slave_0: entered allmulticast mode [ 87.836301][ T5594] bridge_slave_0: entered promiscuous mode [ 87.910404][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.910614][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.910784][ T5594] bridge_slave_1: entered allmulticast mode [ 87.913273][ T5594] bridge_slave_1: entered promiscuous mode [ 87.942215][ T5592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.943572][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.943683][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.944180][ T5595] bridge_slave_0: entered allmulticast mode [ 87.946647][ T5595] bridge_slave_0: entered promiscuous mode [ 88.007427][ T5592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.008386][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.008503][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.009024][ T5595] bridge_slave_1: entered allmulticast mode [ 88.011494][ T5595] bridge_slave_1: entered promiscuous mode [ 88.021341][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.045350][ T5591] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.045479][ T5591] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.045641][ T5591] bridge_slave_0: entered allmulticast mode [ 88.050464][ T5591] bridge_slave_0: entered promiscuous mode [ 88.096984][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.101837][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.102084][ T5591] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.102273][ T5591] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.102413][ T5591] bridge_slave_1: entered allmulticast mode [ 88.105909][ T5591] bridge_slave_1: entered promiscuous mode [ 88.164357][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.185685][ T5592] team0: Port device team_slave_0 added [ 88.195327][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.238873][ T5592] team0: Port device team_slave_1 added [ 88.242082][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.249863][ T5593] team0: Port device team_slave_0 added [ 88.278755][ T5591] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.314363][ T5593] team0: Port device team_slave_1 added [ 88.317162][ T5594] team0: Port device team_slave_0 added [ 88.326338][ T5591] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.370398][ T5594] team0: Port device team_slave_1 added [ 88.392705][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.392785][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.392809][ T5592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.401540][ T5595] team0: Port device team_slave_0 added [ 88.481148][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.481345][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.481371][ T5592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.484779][ T5595] team0: Port device team_slave_1 added [ 88.485743][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.485757][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.485779][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.519774][ T5591] team0: Port device team_slave_0 added [ 88.556837][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.556858][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.556882][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.562049][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.562065][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.562087][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.569894][ T5591] team0: Port device team_slave_1 added [ 88.627240][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.627261][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.627285][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.656576][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.656599][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.656624][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.722646][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.722666][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.722690][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.734033][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.734051][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.734074][ T5591] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.803199][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.803221][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.803246][ T5591] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.816255][ T5592] hsr_slave_0: entered promiscuous mode [ 88.820643][ T5592] hsr_slave_1: entered promiscuous mode [ 88.907582][ T5593] hsr_slave_0: entered promiscuous mode [ 88.912131][ T5593] hsr_slave_1: entered promiscuous mode [ 88.913704][ T5593] debugfs: 'hsr0' already exists in 'hsr' [ 88.913825][ T5593] Cannot create hsr debugfs directory [ 88.964347][ T5594] hsr_slave_0: entered promiscuous mode [ 88.967110][ T5594] hsr_slave_1: entered promiscuous mode [ 88.969373][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 88.969403][ T5594] Cannot create hsr debugfs directory [ 89.218079][ T5599] Bluetooth: hci1: command tx timeout [ 89.218156][ T5608] Bluetooth: hci4: command tx timeout [ 89.298242][ T5599] Bluetooth: hci2: command tx timeout [ 89.298327][ T59] Bluetooth: hci3: command tx timeout [ 89.300096][ T5608] Bluetooth: hci0: command tx timeout [ 89.834412][ T5595] hsr_slave_0: entered promiscuous mode [ 89.835686][ T5595] hsr_slave_1: entered promiscuous mode [ 89.836526][ T5595] debugfs: 'hsr0' already exists in 'hsr' [ 89.836550][ T5595] Cannot create hsr debugfs directory [ 89.903047][ T5591] hsr_slave_0: entered promiscuous mode [ 89.905446][ T5591] hsr_slave_1: entered promiscuous mode [ 89.906261][ T5591] debugfs: 'hsr0' already exists in 'hsr' [ 89.906285][ T5591] Cannot create hsr debugfs directory [ 90.697668][ T5592] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 90.751137][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 90.757538][ T5592] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 90.783647][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 90.795587][ T5592] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 90.824043][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 90.844196][ T5592] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 90.885415][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 90.991981][ T5593] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 91.030943][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 91.038253][ T5593] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 91.083027][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 91.086138][ T5593] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 91.139348][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 91.169764][ T5593] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 91.211416][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 91.298968][ T5599] Bluetooth: hci4: command tx timeout [ 91.300989][ T5599] Bluetooth: hci1: command tx timeout [ 91.374388][ T5594] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 91.377928][ T5608] Bluetooth: hci2: command tx timeout [ 91.377962][ T5608] Bluetooth: hci0: command tx timeout [ 91.387915][ T5599] Bluetooth: hci3: command tx timeout [ 91.403680][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 91.416800][ T5594] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 91.446074][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 91.464484][ T5594] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 91.502340][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 91.527530][ T5594] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 91.576194][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 91.727001][ T5595] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 91.762897][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 91.781874][ T5595] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 91.816121][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 91.833416][ T5592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.838139][ T5595] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 91.885912][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 91.909988][ T5595] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 91.952411][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.067557][ T5592] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.072531][ T5591] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 92.111881][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 92.132440][ T5591] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 92.170514][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.184931][ T5591] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 92.214296][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.225388][ T5591] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 92.276027][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.291871][ T1477] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.302393][ T1477] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.371376][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.380175][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.386023][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.526196][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.571878][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.574841][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.632765][ T1476] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.632946][ T1476] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.656345][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.823101][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.915193][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.931565][ T179] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.944663][ T179] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.015486][ T179] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.016046][ T179] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.077308][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.144654][ T5591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.175460][ T3416] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.175739][ T3416] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.256742][ T179] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.257031][ T179] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.378615][ T5608] Bluetooth: hci4: command tx timeout [ 93.378719][ T5599] Bluetooth: hci1: command tx timeout [ 93.385247][ T5591] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.455044][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.455275][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.458845][ T5608] Bluetooth: hci0: command tx timeout [ 93.458866][ T59] Bluetooth: hci2: command tx timeout [ 93.458900][ T5599] Bluetooth: hci3: command tx timeout [ 93.595636][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.598775][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.676941][ T5592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.068595][ T5592] veth0_vlan: entered promiscuous mode [ 94.204876][ T5592] veth1_vlan: entered promiscuous mode [ 94.263140][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.511795][ T5592] veth0_macvtap: entered promiscuous mode [ 94.568688][ T5592] veth1_macvtap: entered promiscuous mode [ 94.807926][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.871320][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.105662][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.130970][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.306694][ T5591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.604131][ T5593] veth0_vlan: entered promiscuous mode [ 95.684462][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.696370][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.768874][ T5593] veth1_vlan: entered promiscuous mode [ 95.805504][ T5594] veth0_vlan: entered promiscuous mode [ 95.862481][ T5595] veth0_vlan: entered promiscuous mode [ 95.876691][ T179] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.876777][ T179] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.894252][ T5591] veth0_vlan: entered promiscuous mode [ 95.904755][ T5594] veth1_vlan: entered promiscuous mode [ 95.932433][ T5595] veth1_vlan: entered promiscuous mode [ 95.992238][ T5591] veth1_vlan: entered promiscuous mode [ 96.066493][ T5593] veth0_macvtap: entered promiscuous mode [ 96.107246][ T5593] veth1_macvtap: entered promiscuous mode [ 96.157560][ T5594] veth0_macvtap: entered promiscuous mode [ 96.211514][ T5594] veth1_macvtap: entered promiscuous mode [ 96.220537][ T5595] veth0_macvtap: entered promiscuous mode [ 96.294651][ T5591] veth0_macvtap: entered promiscuous mode [ 96.305977][ T5595] veth1_macvtap: entered promiscuous mode [ 96.321278][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.375535][ T5591] veth1_macvtap: entered promiscuous mode [ 96.391747][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.411773][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.465453][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.488764][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.535874][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.584867][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.652169][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.575997][ T179] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.583963][ T179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.895849][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.895942][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.909206][ T1476] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.910224][ T1476] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.910373][ T1476] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.056471][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.056558][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.060831][ T1398] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.060894][ T1398] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.060928][ T1398] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.060959][ T1398] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.060992][ T1398] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.061023][ T1398] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.061056][ T1398] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.061088][ T1398] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.061120][ T1398] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.061151][ T1398] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.338402][ T148] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.361079][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.361102][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.555417][ T1476] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.555491][ T1476] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.821781][ T3416] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.821865][ T3416] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.834456][ T68] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.982252][ T68] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.023074][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.023169][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.436177][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.436265][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.539824][ T1398] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.541602][ T1477] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.542217][ T1477] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.708138][ T5739] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 99.708172][ T1477] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.069367][ T5739] usb 4-1: Using ep0 maxpacket: 16 [ 100.105986][ T5739] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 100.253801][ T5739] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 100.266919][ T5739] usb 4-1: config 0 has no interface number 0 [ 100.266983][ T5739] usb 4-1: config 0 interface 2 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 100.267029][ T5739] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.463857][ T5739] usb 4-1: config 0 descriptor?? [ 101.796316][ T5739] mcp2221 0003:04D8:00DD.0001: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input2 [ 101.829084][ T5716] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 102.105199][ T5716] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 102.132585][ T5716] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.132668][ T5716] usb 5-1: Product: syz [ 102.132683][ T5716] usb 5-1: Manufacturer: syz [ 102.132697][ T5716] usb 5-1: SerialNumber: syz [ 102.232795][ T5836] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 102.951258][ T5739] usb 4-1: USB disconnect, device number 2 [ 103.191705][ T5716] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 103.202888][ T5716] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 103.202917][ T5716] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 103.257598][ T5846] Zero length message leads to an empty skb [ 103.277000][ T5716] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -32 [ 103.548443][ T5716] usb 5-1: USB disconnect, device number 2 [ 107.116588][ T5898] warning: `syz.4.40' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 107.767590][ T5904] gfs2: gfs2 mount does not exist [ 107.879892][ T5910] netlink: 'syz.1.44': attribute type 12 has an invalid length. [ 108.238291][ T5918] tap0: tun_chr_ioctl cmd 1074025680 [ 108.256128][ T5922] tap0: tun_chr_ioctl cmd 2147767520 [ 108.562699][ T5929] syz.1.52 uses obsolete (PF_INET,SOCK_PACKET) [ 109.727990][ T5602] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 109.898768][ T5602] usb 1-1: Using ep0 maxpacket: 32 [ 109.907680][ T5602] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 109.919702][ T5602] usb 1-1: config 0 has an invalid interface number: 85 but max is 0 [ 109.921340][ T5602] usb 1-1: config 0 has no interface number 0 [ 109.921395][ T5602] usb 1-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 109.921423][ T5602] usb 1-1: config 0 interface 85 has no altsetting 0 [ 109.974990][ T5602] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.981751][ T5602] usb 1-1: Product: syz [ 109.981777][ T5602] usb 1-1: Manufacturer: syz [ 109.981791][ T5602] usb 1-1: SerialNumber: syz [ 110.050903][ T5602] usb 1-1: config 0 descriptor?? [ 110.490366][ T5602] appletouch 1-1:0.85: Geyser mode initialized. [ 110.645451][ T5602] input: appletouch as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.85/input/input5 [ 110.735467][ C0] appletouch 1-1:0.85: appletouch: OVERFLOW with data length 64, actual length is 64 [ 110.971226][ T5602] usb 1-1: USB disconnect, device number 2 [ 111.349301][ T5791] udevd[5791]: setting mode of /dev/input/event4 to 020660 failed: No such file or directory [ 111.350666][ T5791] udevd[5791]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 111.466799][ T5602] appletouch 1-1:0.85: input: appletouch disconnected [ 112.189238][ T5986] loop9: detected capacity change from 0 to 7 [ 112.349998][ T5986] Dev loop9: unable to read RDB block 7 [ 112.367966][ T5986] loop9: unable to read partition table [ 112.368195][ T5986] loop9: partition table beyond EOD, truncated [ 112.368247][ T5986] loop_reread_partitions: partition scan of loop9 (þ被xü—ŸÑà– ) failed (rc=-5) [ 112.460027][ T5602] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 112.630570][ T5602] usb 4-1: Using ep0 maxpacket: 16 [ 112.651717][ T5602] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 112.681573][ T5602] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 112.689709][ T5602] usb 4-1: config 0 has no interface number 0 [ 112.725805][ T5602] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.733989][ T5602] usb 4-1: Product: syz [ 112.734014][ T5602] usb 4-1: Manufacturer: syz [ 112.734033][ T5602] usb 4-1: SerialNumber: syz [ 112.805772][ T5602] usb 4-1: config 0 descriptor?? [ 112.827048][ T5602] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 112.892136][ T5996] netlink: 'syz.2.75': attribute type 1 has an invalid length. [ 113.609706][ T6002] syz.0.78 (6002) used greatest stack depth: 18688 bytes left [ 113.622461][ T6008] FAULT_INJECTION: forcing a failure. [ 113.622461][ T6008] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 113.625019][ T6008] CPU: 0 UID: 0 PID: 6008 Comm: syz.4.81 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 113.625047][ T6008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 113.625067][ T6008] Call Trace: [ 113.625076][ T6008] [ 113.625090][ T6008] dump_stack_lvl+0xe8/0x150 [ 113.625132][ T6008] should_fail_ex+0x46b/0x600 [ 113.625160][ T6008] strncpy_from_user+0x36/0x2c0 [ 113.625185][ T6008] __se_sys_request_key+0xb8/0x350 [ 113.625227][ T6008] ? __pfx___se_sys_request_key+0x10/0x10 [ 113.625275][ T6008] do_syscall_64+0x166/0x520 [ 113.625297][ T6008] ? trace_irq_disable+0x3b/0x140 [ 113.625321][ T6008] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.625340][ T6008] ? clear_bhb_loop+0x70/0xc0 [ 113.625362][ T6008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.625381][ T6008] RIP: 0033:0x7fb28ae1e159 [ 113.625404][ T6008] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 113.625419][ T6008] RSP: 002b:00007fb289076028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 113.625441][ T6008] RAX: ffffffffffffffda RBX: 00007fb28b0a5fa0 RCX: 00007fb28ae1e159 [ 113.625455][ T6008] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 113.625467][ T6008] RBP: 00007fb28aeb5024 R08: 0000000000000000 R09: 0000000000000000 [ 113.625480][ T6008] R10: fffffffffffffff9 R11: 0000000000000246 R12: 0000000000000000 [ 113.625492][ T6008] R13: 00007fb28b0a6038 R14: 00007fb28b0a5fa0 R15: 00007fff5a1b98e8 [ 113.625520][ T6008] [ 114.025258][ T6015] gadgetfs: bound to dummy_udc driver [ 114.063424][ T5602] gspca_spca1528: reg_w err -71 [ 114.068831][ T5602] spca1528 4-1:0.1: probe with driver spca1528 failed with error -71 [ 114.146993][ T5602] usb 4-1: USB disconnect, device number 3 [ 114.402037][ T6013] gadgetfs: suspended from state 2 [ 114.459425][ T5847] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 116.897674][ T6078] mmap: syz.0.106 (6078) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 119.091051][ T6111] process 'syz.1.119' launched './file0' with NULL argv: empty string added [ 119.375290][ T6118] FAULT_INJECTION: forcing a failure. [ 119.375290][ T6118] name fail_futex, interval 1, probability 0, space 0, times 1 [ 119.375389][ T6118] CPU: 1 UID: 0 PID: 6118 Comm: syz.2.121 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 119.375412][ T6118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 119.375422][ T6118] Call Trace: [ 119.375430][ T6118] [ 119.375439][ T6118] dump_stack_lvl+0xe8/0x150 [ 119.375477][ T6118] should_fail_ex+0x46b/0x600 [ 119.375505][ T6118] get_futex_key+0x8e2/0x1580 [ 119.375545][ T6118] ? __pfx_get_futex_key+0x10/0x10 [ 119.375571][ T6118] ? __kmalloc_cache_noprof+0x3d5/0x680 [ 119.375596][ T6118] ? futex_lock_pi+0x9a6/0xac0 [ 119.375615][ T6118] ? futex_lock_pi+0x9a6/0xac0 [ 119.375641][ T6118] futex_lock_pi+0x25f/0xac0 [ 119.375673][ T6118] ? __pfx_futex_lock_pi+0x10/0x10 [ 119.375722][ T6118] ? __pfx_futex_wake_mark+0x10/0x10 [ 119.375750][ T6118] ? do_raw_spin_lock+0x12b/0x2f0 [ 119.375782][ T6118] do_futex+0x3b0/0x4e0 [ 119.375815][ T6118] ? __pfx_do_futex+0x10/0x10 [ 119.375840][ T6118] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 119.375873][ T6118] __se_sys_futex+0x3a8/0x450 [ 119.375905][ T6118] ? __pfx___se_sys_futex+0x10/0x10 [ 119.375927][ T6118] ? rcu_is_watching+0x16/0xb0 [ 119.375954][ T6118] ? __x64_sys_futex+0x21/0xf0 [ 119.375982][ T6118] do_syscall_64+0x166/0x520 [ 119.376000][ T6118] ? trace_irq_disable+0x3b/0x140 [ 119.376020][ T6118] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.376038][ T6118] ? clear_bhb_loop+0x70/0xc0 [ 119.376069][ T6118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.376088][ T6118] RIP: 0033:0x7f04b874e159 [ 119.376106][ T6118] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.376121][ T6118] RSP: 002b:00007f04b69a6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 119.376143][ T6118] RAX: ffffffffffffffda RBX: 00007f04b89d5fa0 RCX: 00007f04b874e159 [ 119.376157][ T6118] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000200 [ 119.376168][ T6118] RBP: 00007f04b87e5024 R08: 0000000000000000 R09: 0000000034fffffd [ 119.376180][ T6118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.376191][ T6118] R13: 00007f04b89d6038 R14: 00007f04b89d5fa0 R15: 00007ffde58ced78 [ 119.376220][ T6118] [ 119.385179][ T6117] input: syz0 as /devices/virtual/input/input6 [ 120.297888][ T5847] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 120.378135][ T5598] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 120.429118][ T6145] netlink: 16 bytes leftover after parsing attributes in process `syz.1.132'. [ 120.474791][ T5847] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 120.486219][ T5847] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.486287][ T5847] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 120.486308][ T5847] usb 4-1: config 1 has no interface number 0 [ 120.486352][ T5847] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 120.486377][ T5847] usb 4-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 120.486405][ T5847] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 120.490632][ T5847] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.490660][ T5847] usb 4-1: Product: syz [ 120.490674][ T5847] usb 4-1: Manufacturer: syz [ 120.490687][ T5847] usb 4-1: SerialNumber: syz [ 120.580550][ T5598] usb 1-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 120.599372][ T5598] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.602483][ T5598] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 120.602509][ T5598] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 120.602531][ T5598] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 120.602574][ T5598] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.451271][ T5847] cdc_ncm 4-1:1.1: bind() failure [ 121.577946][ T5598] gud 1-1:1.0: Failed to get connectors (error=-5) [ 121.584806][ T5598] gud 1-1:1.0: probe with driver gud failed with error -5 [ 121.689946][ T5729] usb 4-1: USB disconnect, device number 4 [ 121.794303][ T5598] usb 1-1: USB disconnect, device number 4 [ 121.888138][ T5847] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 122.039662][ T5847] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 122.043321][ T5847] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 122.043373][ T5847] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 122.043397][ T5847] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 122.043421][ T5847] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 122.043441][ T5847] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 122.050175][ T5847] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 122.050202][ T5847] usb 2-1: Product: syz [ 122.050216][ T5847] usb 2-1: Manufacturer: syz [ 122.050229][ T5847] usb 2-1: SerialNumber: syz [ 122.085967][ T5847] usb 2-1: config 0 descriptor?? [ 122.301731][ T5847] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 122.301922][ T5847] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 122.518337][ T5847] radio-si470x 2-1:0.0: software version 0, hardware version 0 [ 122.518412][ T5847] radio-si470x 2-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 122.518442][ T5847] radio-si470x 2-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 122.720306][ T5847] radio-si470x 2-1:0.0: submitting int urb failed (-90) [ 123.133137][ T5847] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 123.134523][ T5847] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -22 [ 123.385530][ T5847] usb 2-1: USB disconnect, device number 2 [ 123.586497][ T6196] netlink: 'syz.3.146': attribute type 1 has an invalid length. [ 125.222089][ T6216] kAFS: unable to lookup cell '(G' [ 125.230020][ T6215] kAFS: unable to lookup cell '(G' [ 125.575307][ T6229] Invalid argument reading file caps for ./file0 [ 126.258278][ T5739] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 126.408864][ T5739] usb 5-1: Using ep0 maxpacket: 8 [ 126.415157][ T5739] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 126.443409][ T5739] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 126.445737][ T5739] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 126.445774][ T5739] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 126.445796][ T5739] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 126.445849][ T5739] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.792301][ T5739] usb 5-1: GET_CAPABILITIES returned 0 [ 126.798266][ T5739] usbtmc 5-1:16.0: can't read capabilities [ 127.076348][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.117330][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.117433][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.117514][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.118154][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.118228][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.118295][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.156185][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.157742][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.174563][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.174644][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.174711][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.235347][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.235450][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.235520][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.265905][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 127.386483][ T5709] usb 5-1: USB disconnect, device number 3 [ 129.202579][ T6308] Invalid argument reading file caps for ./file0 [ 129.472339][ T6316] FAULT_INJECTION: forcing a failure. [ 129.472339][ T6316] name failslab, interval 1, probability 0, space 0, times 0 [ 129.496060][ T6316] CPU: 0 UID: 0 PID: 6316 Comm: syz.2.196 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 129.496092][ T6316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 129.496104][ T6316] Call Trace: [ 129.496113][ T6316] [ 129.496121][ T6316] dump_stack_lvl+0xe8/0x150 [ 129.496160][ T6316] should_fail_ex+0x46b/0x600 [ 129.496189][ T6316] should_failslab+0xa8/0x100 [ 129.496220][ T6316] __kmalloc_noprof+0xfb/0x790 [ 129.496249][ T6316] ? security_sb_alloc+0x48/0x310 [ 129.496271][ T6316] ? security_sb_alloc+0x48/0x310 [ 129.496300][ T6316] security_sb_alloc+0x48/0x310 [ 129.496333][ T6316] sget_fc+0x984/0x1a60 [ 129.496363][ T6316] ? __pfx_set_anon_super_fc+0x10/0x10 [ 129.496388][ T6316] ? __pfx_sget_fc+0x10/0x10 [ 129.496407][ T6316] ? __pfx_refcount_dec_not_one+0x10/0x10 [ 129.496427][ T6316] ? __kmalloc_cache_noprof+0x3d5/0x680 [ 129.496463][ T6316] ? __pfx_mqueue_fill_super+0x10/0x10 [ 129.496485][ T6316] get_tree_nodev+0x2a/0x150 [ 129.496508][ T6316] vfs_get_tree+0x92/0x2a0 [ 129.496532][ T6316] fc_mount_longterm+0x1c/0x100 [ 129.496558][ T6316] mq_init_ns+0x508/0x770 [ 129.496581][ T6316] copy_ipcs+0x45c/0x6c0 [ 129.496606][ T6316] create_new_namespaces+0x210/0x6b0 [ 129.496635][ T6316] ? security_capable+0x7e/0x2c0 [ 129.496663][ T6316] unshare_nsproxy_namespaces+0x149/0x190 [ 129.496690][ T6316] ksys_unshare+0x5a7/0x950 [ 129.496721][ T6316] ? __pfx_ksys_unshare+0x10/0x10 [ 129.496744][ T6316] ? rcu_is_watching+0x16/0xb0 [ 129.496778][ T6316] __x64_sys_unshare+0x38/0x50 [ 129.496801][ T6316] do_syscall_64+0x166/0x520 [ 129.496824][ T6316] ? trace_irq_disable+0x3b/0x140 [ 129.496848][ T6316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.496867][ T6316] ? clear_bhb_loop+0x70/0xc0 [ 129.496889][ T6316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.496914][ T6316] RIP: 0033:0x7f04b874e159 [ 129.496938][ T6316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.496961][ T6316] RSP: 002b:00007f04b69a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 129.496988][ T6316] RAX: ffffffffffffffda RBX: 00007f04b89d5fa0 RCX: 00007f04b874e159 [ 129.497007][ T6316] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000 [ 129.497023][ T6316] RBP: 00007f04b87e5024 R08: 0000000000000000 R09: 0000000000000000 [ 129.497040][ T6316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 129.497055][ T6316] R13: 00007f04b89d6038 R14: 00007f04b89d5fa0 R15: 00007ffde58ced78 [ 129.497091][ T6316] [ 130.021886][ T6328] loop8: detected capacity change from 0 to 8 [ 130.119567][ T6328] Dev loop8: unable to read RDB block 8 [ 130.125417][ T6328] loop8: unable to read partition table [ 130.125654][ T6328] loop8: partition table beyond EOD, truncated [ 130.125692][ T6328] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 130.759371][ T5847] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 130.793689][ T6348] ======================================================= [ 130.793689][ T6348] WARNING: The mand mount option has been deprecated and [ 130.793689][ T6348] and is ignored by this kernel. Remove the mand [ 130.793689][ T6348] option from the mount to silence this warning. [ 130.793689][ T6348] ======================================================= [ 130.930532][ T5847] usb 3-1: Using ep0 maxpacket: 8 [ 130.931409][ T5847] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 130.932683][ T5847] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 130.932745][ T5847] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 130.932773][ T5847] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 130.932803][ T5847] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 130.932832][ T5847] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 130.932878][ T5847] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.877317][ T6375] usbtmc 3-1:16.0: simple usb_control_msg returned 0 [ 132.104587][ T5739] usb 3-1: USB disconnect, device number 2 [ 132.267884][ T5598] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 132.429009][ T5598] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 132.444605][ T5598] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.444639][ T5598] usb 2-1: Product: syz [ 132.444656][ T5598] usb 2-1: Manufacturer: syz [ 132.444674][ T5598] usb 2-1: SerialNumber: syz [ 132.783655][ T5598] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 132.796347][ T5598] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 132.796376][ T5598] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 132.844445][ T5598] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -32 [ 132.882930][ T5598] usb 2-1: USB disconnect, device number 3 [ 132.970921][ T6400] syz_tun: entered allmulticast mode [ 133.087825][ T5602] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 133.251653][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.256170][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.257829][ T5602] usb 1-1: Using ep0 maxpacket: 8 [ 133.258790][ T5602] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 133.283371][ T5602] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.293811][ T5602] usb 1-1: Product: syz [ 133.293827][ T5602] usb 1-1: Manufacturer: syz [ 133.293836][ T5602] usb 1-1: SerialNumber: syz [ 133.338866][ T5602] usb 1-1: config 0 descriptor?? [ 133.391448][ T5602] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 134.470404][ T5602] usb 1-1: USB disconnect, device number 5 [ 134.757546][ T6438] FAULT_INJECTION: forcing a failure. [ 134.757546][ T6438] name failslab, interval 1, probability 0, space 0, times 0 [ 134.757844][ T6438] CPU: 0 UID: 0 PID: 6438 Comm: syz.4.249 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 134.757868][ T6438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 134.757880][ T6438] Call Trace: [ 134.757888][ T6438] [ 134.757897][ T6438] dump_stack_lvl+0xe8/0x150 [ 134.757934][ T6438] should_fail_ex+0x46b/0x600 [ 134.757958][ T6438] ? hugetlbfs_alloc_inode+0xef/0x130 [ 134.757979][ T6438] should_failslab+0xa8/0x100 [ 134.758011][ T6438] kmem_cache_alloc_lru_noprof+0xa2/0x680 [ 134.758039][ T6438] ? hugetlbfs_alloc_inode+0xef/0x130 [ 134.758065][ T6438] hugetlbfs_alloc_inode+0xef/0x130 [ 134.758087][ T6438] ? __pfx_hugetlbfs_alloc_inode+0x10/0x10 [ 134.758104][ T6438] alloc_inode+0x6a/0x1b0 [ 134.758131][ T6438] new_inode+0x1f/0x170 [ 134.758152][ T6438] hugetlbfs_get_inode+0x73/0x660 [ 134.758183][ T6438] hugetlb_file_setup+0x21d/0x630 [ 134.758211][ T6438] memfd_alloc_file+0xbb/0x570 [ 134.758236][ T6438] ? rt_spin_unlock+0x165/0x200 [ 134.758263][ T6438] ? __pfx_memfd_alloc_file+0x10/0x10 [ 134.758286][ T6438] ? alloc_fd+0x654/0x6d0 [ 134.758320][ T6438] __se_sys_memfd_create+0x329/0x420 [ 134.758349][ T6438] do_syscall_64+0x166/0x520 [ 134.758379][ T6438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.758399][ T6438] ? clear_bhb_loop+0x70/0xc0 [ 134.758422][ T6438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.758439][ T6438] RIP: 0033:0x7fb28ae1e159 [ 134.758457][ T6438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.758471][ T6438] RSP: 002b:00007fb289076028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 134.758493][ T6438] RAX: ffffffffffffffda RBX: 00007fb28b0a5fa0 RCX: 00007fb28ae1e159 [ 134.758518][ T6438] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000200000000300 [ 134.758531][ T6438] RBP: 00007fb28aeb5024 R08: 0000000000000000 R09: 0000000000000000 [ 134.758543][ T6438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.758554][ T6438] R13: 00007fb28b0a6038 R14: 00007fb28b0a5fa0 R15: 00007fff5a1b98e8 [ 134.758584][ T6438] [ 135.110687][ T6449] Bluetooth: MGMT ver 1.23 [ 135.297102][ T6439] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI [ 135.309196][ T6439] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 135.318468][ T6439] CPU: 0 UID: 0 PID: 6439 Comm: syz.1.248 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 135.329446][ T6439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 135.339602][ T6439] RIP: 0010:dvb_dmxdev_filter_stop+0x19f/0x700 [ 135.345859][ T6439] Code: 00 00 49 8d 5c 24 f8 48 89 d8 48 c1 e8 03 80 3c 28 00 74 08 48 89 df e8 ef 4c a5 fa 48 8b 1b 48 8d 7b 28 48 89 f8 48 c1 e8 03 <80> 3c 28 00 74 05 e8 d6 4c a5 fa 4c 8b 5b 28 48 89 df 2e 2e 2e 41 [ 135.366688][ T6439] RSP: 0018:ffffc90006e67c70 EFLAGS: 00010206 [ 135.372769][ T6439] RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000005 [ 135.380835][ T6439] RDX: ffffffff878cdb3a RSI: ffffffff8f0c10f0 RDI: 0000000000000028 [ 135.388807][ T6439] RBP: dffffc0000000000 R08: ffff888035db8000 R09: 0000000000000002 [ 135.397878][ T6439] R10: 0000000000000100 R11: 0000000000000002 R12: ffff88802be5fb90 [ 135.405946][ T6439] R13: 1ffff92000fdb80c R14: ffffc90007edc054 R15: ffffc90007edc008 [ 135.414017][ T6439] FS: 000055557bd66500(0000) GS:ffff888125bd6000(0000) knlGS:0000000000000000 [ 135.423224][ T6439] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.429891][ T6439] CR2: 00007fd2b3595690 CR3: 0000000031a3c000 CR4: 00000000003526f0 [ 135.437953][ T6439] Call Trace: [ 135.441349][ T6439] [ 135.444289][ T6439] ? dvb_demux_release+0x93/0x6b0 [ 135.449773][ T6439] dvb_demux_release+0x9b/0x6b0 [ 135.455431][ T6439] ? __pfx_dvb_demux_release+0x10/0x10 [ 135.461511][ T6439] __fput+0x42a/0xa80 [ 135.465811][ T6439] task_work_run+0x1d9/0x270 [ 135.470947][ T6439] ? __pfx_task_work_run+0x10/0x10 [ 135.476148][ T6439] exit_to_user_mode_loop+0x204/0x770 [ 135.482361][ T6439] ? rcu_is_watching+0x16/0xb0 [ 135.487164][ T6439] do_syscall_64+0x328/0x520 [ 135.491967][ T6439] ? trace_irq_disable+0x3b/0x140 [ 135.498428][ T6439] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.505081][ T6439] ? clear_bhb_loop+0x70/0xc0 [ 135.510598][ T6439] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.517287][ T6439] RIP: 0033:0x7f432b08e159 [ 135.522557][ T6439] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.545072][ T6439] RSP: 002b:00007ffe1f2da618 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 135.553594][ T6439] RAX: 0000000000000000 RBX: 00007f432b317da0 RCX: 00007f432b08e159 [ 135.562713][ T6439] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 135.570693][ T6439] RBP: 00007f432b317da0 R08: 00007f432b316218 R09: 0000000000000000 [ 135.578659][ T6439] R10: 00000000005f6dc4 R11: 0000000000000246 R12: 00000000000210f4 [ 135.586626][ T6439] R13: 00007f432b31618c R14: 0000000000020e82 R15: 00007ffe1f2da720 [ 135.594686][ T6439] [ 135.597707][ T6439] Modules linked in: [ 135.602179][ T6439] ---[ end trace 0000000000000000 ]--- [ 135.625027][ T6439] RIP: 0010:dvb_dmxdev_filter_stop+0x19f/0x700 [ 135.631527][ T6439] Code: 00 00 49 8d 5c 24 f8 48 89 d8 48 c1 e8 03 80 3c 28 00 74 08 48 89 df e8 ef 4c a5 fa 48 8b 1b 48 8d 7b 28 48 89 f8 48 c1 e8 03 <80> 3c 28 00 74 05 e8 d6 4c a5 fa 4c 8b 5b 28 48 89 df 2e 2e 2e 41 [ 135.652063][ T6439] RSP: 0018:ffffc90006e67c70 EFLAGS: 00010206 [ 135.652088][ T6439] RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000005 [ 135.652099][ T6439] RDX: ffffffff878cdb3a RSI: ffffffff8f0c10f0 RDI: 0000000000000028 [ 135.652110][ T6439] RBP: dffffc0000000000 R08: ffff888035db8000 R09: 0000000000000002 [ 135.652121][ T6439] R10: 0000000000000100 R11: 0000000000000002 R12: ffff88802be5fb90 [ 135.652133][ T6439] R13: 1ffff92000fdb80c R14: ffffc90007edc054 R15: ffffc90007edc008 [ 135.652146][ T6439] FS: 000055557bd66500(0000) GS:ffff888125bd6000(0000) knlGS:0000000000000000 [ 135.652161][ T6439] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.652172][ T6439] CR2: 00007fd2b3595690 CR3: 0000000031a3c000 CR4: 00000000003526f0 [ 135.652191][ T6439] Kernel panic - not syncing: Fatal exception [ 135.729432][ T6439] Kernel Offset: disabled [ 135.733777][ T6439] Rebooting in 86400 seconds..