last executing test programs: 42.992835129s ago: executing program 3 (id=1267): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, 0x0, 0x2b) r0 = syz_open_dev$sndctrl(&(0x7f0000000e00), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc1105511, &(0x7f00000000c0)={{0xc, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [0x0, 0x100, 0x7ffc, 0x0, 0x9, 0x100000000, 0x0, 0x4, 0x8, 0x0, 0xc3, 0x7f, 0x1, 0x0, 0x8000000, 0x0, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x100000000, 0xffffffffffffffff, 0x0, 0x5, 0x4, 0x4, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0xfffffffe, 0x0, 0x6, 0xfffffdfffffffffe, 0x4, 0x804000, 0x0, 0xffffffff, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x401, 0xb4e, 0xffffffff, 0x2000000, 0xfffffffc, 0x1, 0x0, 0x0, 0xd87, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xdf9cd8e, 0x8000200, 0x6, 0x5, 0x0, 0x0, 0x0, 0xbb, 0x200000, 0x0, 0x0, 0xfffffffe, 0x7, 0x7ffffffd, 0x3, 0x0, 0xffffffffffff2328, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8, 0x4, 0x0, 0x0, 0xb, 0x1, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff]}) (fail_nth: 5) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, 0x0) 42.654521353s ago: executing program 3 (id=1268): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e23, @loopback}}, 0x0, 0x0, 0xf, 0x0, "e83ae75240c2d6d8ec87bb53679fd0450078548cfee54414fab091000000000000000776aea5922406b64cddaeb9d339ba3c01c2c7d0df8e61740b9af2d4e499d58654a4cf0fa0ce1f830c3079cffcfd"}, 0xd8) connect$inet(r0, &(0x7f0000000000)={0x2, 0x5e20, @multicast2}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) 42.435447357s ago: executing program 3 (id=1270): syz_usb_connect(0x0, 0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300042e010203010902120001000000000904"], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x3216, 0x40100) syz_usb_disconnect(r0) syz_usb_connect$cdc_ecm(0x5, 0x4d, &(0x7f0000000080)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x4, 0x40, 0x2, "", [{{0x9, 0x4, 0x0, 0xfa, 0x2, 0x2, 0x6, 0x0, 0x7, {{0x5}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0x0, 0x6e9, 0x9}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x7df, 0x2, 0xf, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x1, 0x1, 0x6}}}}}]}}]}}, 0x0) ioctl$EVIOCRMFF(r0, 0x83c0550b, 0x0) 41.623896895s ago: executing program 2 (id=1276): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000001a40)={{0xffffffffffffffff, &(0x7f0000000000)='/proc/sys/net/ip]\x11tiox_control\x00'/42, 0x200, 0x0, 0x7ff, 0x0, 0x0}, 0x0, 0x0}) write$tun(r0, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) ioctl$KVM_GET_STATS_FD_vm(r2, 0xaece) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) 41.616834137s ago: executing program 2 (id=1277): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x6) fchdir(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000014c0)={&(0x7f0000565000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000340)=0x40) r3 = openat(r1, &(0x7f0000000000)='./file1\x00', 0x1012c2, 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x14b302, 0x8c) pwritev2(r4, &(0x7f0000000100)=[{&(0x7f0000000080)="7f", 0x1}], 0x1, 0x5412, 0x0, 0x0) sendfile(r3, r3, 0x0, 0x6fecb1) 41.516405338s ago: executing program 2 (id=1278): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x26e1, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)={0x1, 0x4, [@multicast, @broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x25}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}]}) close(r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000ec0)={'wpan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r1) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x2c, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SEC_KEY={0x10, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20004800}, 0x84) socket$inet6(0xa, 0x5, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_window_scaling\x00', 0x1, 0x0) sendfile(r5, r4, &(0x7f0000002080)=0x3b, 0x23e) ioctl$SIOCSIFHWADDR(r4, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00', @random="3f245a7249dd"}) 41.331421337s ago: executing program 2 (id=1279): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575b43f86dd6067", 0x14}, {&(0x7f00000001c0)="0100"/13, 0xd}, {&(0x7f0000000280)="37a0a6c482b23cba92ffffff3f7b42590e180c07f3c193b532f3080000008c", 0x1f}, {&(0x7f0000000380)="d422b8440c607d46a140ebfce60a67610dd2493961afc1684af41b1820085a974c353f2ff3843617008dee4bcac2e350814f190500"/65, 0x41}], 0x4) 40.891293382s ago: executing program 0 (id=1282): mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r2) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000ecffffffffff2000000005002000000000000c001f00706879", @ANYBLOB="3ba4a886b5"], 0x28}}, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, 0xfffffffffffffffd, 0x1, 0x0, 0x0, 0x20000000}, 0x20040004) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x80980, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP(r5, 0x3b86, &(0x7f0000000000)={0x18, r6, 0xffffffffffffffff, 0x84fa}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000000c0)=ANY=[@ANYBLOB="00000000d8218a504348086d09c761b5cd97175c367800292be910", @ANYRES16=r8, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="e63da99f2a2b6fa106a0677a70d26eb0637a6c8bbdfd023452640fb9ed4515c292e47f4e883d8c7ddb97519c5ec8a2f6864161c3a1aaf917eca7a654247739c63fa945e1e4da9eca0cbe482306558c4a8a04f182a39946"], 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 40.88619052s ago: executing program 3 (id=1283): socket(0x28, 0x5, 0x0) r0 = socket(0x1, 0x3, 0x0) bind$unix(r0, &(0x7f0000000840)=@abs={0x1, 0x0, 0x4e22}, 0x6e) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000080)={0x8f, 0x0, 0xa}) r3 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r3, 0x84, 0x21, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SIOCGETMIFCNT_IN6(r0, 0x89e0, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r6, 0x0, 0x20000023896) sendmsg$NFT_MSG_GETRULE(r6, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x7, 0xa, 0xa00, 0x0, 0x0, {0x2, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40000010) close_range(r5, 0xffffffffffffffff, 0x200000000000000) syz_usb_connect(0x0, 0x2d, &(0x7f0000000500)={{0x12, 0x1, 0x200, 0xb6, 0x34, 0x18, 0x20, 0x525, 0xa4a4, 0xd37e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x6, 0x4, 0xa0, 0xf3, "", [{{0x9, 0x4, 0x84, 0x6, 0x1, 0x2, 0x5, 0xb5, 0x4, [], [{{0x9, 0x5, 0xa, 0x1, 0x10, 0xf8, 0x6c, 0x5}}]}}]}}]}}, 0x0) r7 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x100, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000200), &(0x7f0000000240)=0x4) r10 = eventfd2(0x10001, 0x80800) r11 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) read(r11, 0x0, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r6, 0x0, 0x1, &(0x7f0000000180)=0x2, 0x4) ioctl$KVM_HYPERV_EVENTFD(r9, 0x4018aebd, &(0x7f0000000100)={0x2, r10}) ioctl$KVM_HYPERV_EVENTFD(r9, 0x4018aebd, &(0x7f0000000000)={0x2, r10, 0x1}) ioctl$SNDRV_PCM_IOCTL_UNLINK(r7, 0x40044160, 0x3) 40.807384255s ago: executing program 2 (id=1285): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)={0x1c, 0x0, 0x200, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x81) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendmmsg$inet(r3, &(0x7f0000001cc0)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000480)="0f", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000100)="96", 0x1}], 0x1, &(0x7f0000000240)=ANY=[], 0xd0}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000580)="a64b", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000049c0)='{', 0x1}], 0x1}}], 0x4, 0x448c0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) preadv2(r4, &(0x7f0000000200)=[{&(0x7f0000000500)=""/61, 0x3d}], 0x1, 0x40, 0x4, 0x0) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, &(0x7f0000000040)) 40.799358738s ago: executing program 0 (id=1286): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MFC(r0, 0x29, 0xcd, 0x0, 0xd9ee10b83e39f1bd) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000800)={0x0}, &(0x7f0000000840)=0xc) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000900)={'syztnl1\x00', &(0x7f0000000880)={'syztnl2\x00', 0x0, 0x40, 0x1, 0x1000, 0x19e6, {{0xa, 0x4, 0x3, 0x1, 0x28, 0x67, 0x0, 0x81, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, {[@generic={0x89, 0x11, "3e7734175e53497da011f8ef1fe55f"}]}}}}}) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) bind$can_j1939(r3, &(0x7f00000000c0)={0x1d, r4}, 0x18) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'macvlan0\x00', 0x0}) sendto$packet(r5, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x11, 0x88fb, r6, 0x1, 0x6, 0x6, @random="0ef997e9cedb"}, 0x14) sendmmsg$inet(r0, &(0x7f0000000d40)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="9aeea10b7cc38716fea6fd52caa34640ada475abc1d181d54fb15ba4ad4c9e2f38ac723dfdf15f9cd5662774a8b05e77fc8d7ffe051e32447eb705fc896703414f08ef1726936b909f7d851520d2e4a79b22c3fa90eec9fa3eb5bc02863e6db106863c7551be0bb21e18778f6f3f2f1b7370c34e6370b7c2a33adc783941bf71833afab42942cfb6a32fc4331fdc489eeca01bb683dac7c20cb79dd9d7bb24f25f7ac3f5571f61c533c84c99c701314ea4f47699a15e9f0e5cbfed48ce765874a0", 0xc1}], 0x1, &(0x7f0000000140)=[@ip_retopts={{0x68, 0x0, 0x7, {[@lsrr={0x83, 0xb, 0x51, [@multicast2, @broadcast]}, @ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0xf, 0xa4, [@remote, @multicast2, @multicast2]}, @lsrr={0x83, 0xf, 0xff, [@loopback, @local, @broadcast]}, @timestamp={0x44, 0x24, 0x61, 0x0, 0x7, [0xfffffffe, 0x81, 0xa37, 0xab88, 0x8, 0x136, 0x7fffffff, 0x564c]}, @ra={0x94, 0x4}, @noop]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xa}, @empty}}}], 0x88}}, {{&(0x7f0000000200)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000780)=[{&(0x7f0000000240)="5ba63ac3a4d47330749f98c8e742a8c44aa34da2f1e7a93e9ee21abc17a1efb32ebac964f97315775decfcf0a4d934118d63eb960f5c93b1ce241c66075831f95efb112d11b73bb2d2334215f857bf2f83602eccbed57977c4a96f4df21d9bb4972276aa5eb367a4f071cf683b160b7eb58063446058254b82c51e79d20f4ea84160ace7592d5a641c5809e482abcd9dcbdd3823219d0a4a", 0x98}, {&(0x7f0000000300)="45fcc8580906a09bae49c9a242b096f5fa8b7c3e3e154f92786436bf27022e212e3c2aa7f7029149b2c2ae681ab00d30ca5c3799c2a928b577200c3274dbe081f39c63626f07b1114c847f085e3f8b57c8614d32b308f05e3b6c1eda8935adebc3e421a68175cc76c0e729c052c8c7681002948ca63cd052fb9526aac3e1d04346148672e070bce04b9451847fa4c556c26c7518ec40aeb8ce832bb8932e63e88558a81a84197d7a122a7bed332f53393d38ebffcd1b", 0xb6}, {&(0x7f00000003c0)="1cdab17a678f35c9536609c6b5c0d5808bca8897903b38de8d21380f255b71da1a16760bdecdea09a9fa878fb8af358d862f0ec87b46f93d561aae3b495c1730c120ef661bba32e09fa79e2d188fd3904283623e13269c7e472e16fcfe7d393c0de8d7ff029edec470e3f1de3d437056c381410fddefbea4bdb404a3be2c462b586cdc0e6681f8735444ad6256ee1315509196464ada72432ed350def5124c4e07", 0xa1}, {&(0x7f0000000480)="0fd2480544fe0838e84d617bf40ffd69fcbeaace48ae3419416c96c39a3aed800c00d9b06d86d296558c828b5c804d95b71d1e98fe43ebae05f3a7aaa899bc0bea9bd5505e0cd9b4acd6467e6fdfcb4a5c3375ba6a3e3044ef5da11dbc7e9cb74975b2878931835a7356e59a76900a261900581d0bfc2a53690362c76834082679aaf74f7f7dd567c9efbf6a4d2f8dd4f8dbbd8fe2de0b15f2a34544e91ae1ddec98ad009587140c365a8a28e7fcd3c2995ecf2a385fd6228d465b91", 0xbc}, {&(0x7f0000000540)="27e782748e9be2e3ae1f742798f0758dc771d10619da7c62a65ea087d1aee8cdc3d4fb6991b40c5d45046b139f58b3d0f96670657b1f22e279408f1135b25bdc6f4900206e0b86dc577f90c19617aa376b5205cdd481823d1e877bc6c5b2b337ff971dede7f8efa537aa8b1f587102559e8e3ccb35e707497bbe0a03a3978ff428753910bbfc60b3f36016402b29b1f7fc974264369e91bfe1a40a11b29d4a6900f847f659db10bfa511661e89467cd0657eb185b41b16d8c02bc5527ac02053ecf75d466ca37ddd9b104a4ef619ecb3adecd06c63c59869151682bd439605c3bc37e0611538fd6225936cb56fc0d74d103026d6e6ec9554302e", 0xfa}, {&(0x7f0000000640)="0399773b51cf27239141258be263c7e65bee538b62206101b0d4f10909914e42ae66806b955bdaaf14620b1a55942e0d01bdb14809cd38bfac6247a6a21b9bd5c04719ecb398500523bd4ffa08132053b81599ef96e57f679d2282dbd4b9cccf7feea9390931c93eb873617a61f8d18a47f3c314ef56c2aa9bfc936463f0b678c54e10bc1f86b01f7a95699f6ad12054342ed53f03e87c3e8e4c3fa806ac654820e46d07cfe0", 0xa6}, {&(0x7f0000000700)="a6c9a82f068506c29ab465bea2153f0710290112a729b8c434fddd665862f33bedac2d4cae51affa0eb50b0916f645b08f2ce28fb7", 0x35}, {&(0x7f0000000740)}], 0x8, &(0x7f0000000940)=[@ip_retopts={{0xac, 0x0, 0x7, {[@cipso={0x86, 0x57, 0x3, [{0x7, 0xd, "1fefad9bcb546842518234"}, {0x5, 0xb, "e3ad601770f0c78713"}, {0x6, 0x8, "a9ec321fbc95"}, {0x5, 0x12, "5a70e17e853cbbf8c9fb9c723c3a7847"}, {0x7, 0xd, "be9bd91728e29a9ee1b6ce"}, {0x1, 0x3, 'D'}, {0x2, 0xf, "3d81710a731b4a80d1a24ffb51"}]}, @rr={0x7, 0x13, 0x94, [@remote, @private=0xa010101, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010100]}, @timestamp={0x44, 0x14, 0x21, 0x0, 0x7, [0x1, 0x2, 0xdb, 0x3]}, @generic={0x90, 0x12, "38bafa994c83ac890e2fac47d48d31ff"}, @end, @lsrr={0x83, 0xb, 0x83, [@private=0xa010100, @private=0xa010100]}]}}}, @ip_retopts={{0x80, 0x0, 0x7, {[@noop, @timestamp_prespec={0x44, 0x1c, 0x93, 0x3, 0x2, [{@private=0xa010102, 0x9}, {@broadcast, 0xa}, {@local, 0x82}]}, @rr={0x7, 0x7, 0x6a, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x7, 0x60, [@local]}, @generic={0x82, 0xe, "357ae89b523eb50c92a235f9"}, @rr={0x7, 0xf, 0x73, [@dev={0xac, 0x14, 0x14, 0xd}, @dev={0xac, 0x14, 0x14, 0x3d}, @rand_addr=0x64010100]}, @ssrr={0x89, 0x1b, 0x73, [@local, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @dev={0xac, 0x14, 0x14, 0x1a}, @remote, @broadcast]}, @generic={0x89, 0xd, "5449f6cb3d245dc0664917"}]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @loopback, @multicast2}}}, @ip_retopts={{0x74, 0x0, 0x7, {[@timestamp_addr={0x44, 0x1c, 0x8d, 0x1, 0x8, [{@loopback, 0x2}, {@private=0xa010102, 0x2}, {@multicast2, 0xffffff41}]}, @rr={0x7, 0x1b, 0xe9, [@initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010100, @empty, @broadcast, @rand_addr=0x64010101, @multicast1]}, @timestamp={0x44, 0x8, 0x41, 0x0, 0x4, [0x9]}, @ra={0x94, 0x4, 0x1}, @noop, @timestamp_prespec={0x44, 0x14, 0x5f, 0x3, 0x1, [{@dev={0xac, 0x14, 0x14, 0x10}, 0x8}, {@dev={0xac, 0x14, 0x14, 0xa}, 0x5}]}, @ssrr={0x89, 0xb, 0x41, [@rand_addr=0x64010102, @loopback]}]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @broadcast, @multicast2}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x15}}], 0x200}}, {{&(0x7f0000000b40)={0x2, 0x7b9, @dev={0xac, 0x14, 0x14, 0x22}}, 0x10, &(0x7f0000000bc0)=[{&(0x7f0000000b80)="1374f227e2151ee189bc0e1e4d5ae1", 0xf}], 0x1, &(0x7f0000000c00)=[@ip_retopts={{0x6c, 0x0, 0x7, {[@noop, @cipso={0x86, 0x1b, 0x3, [{0x7, 0x5, '3n^'}, {0x0, 0x10, "527dda0a5c54d69a3e25f183a12a"}]}, @rr={0x7, 0x13, 0x16, [@loopback, @multicast2, @multicast2, @loopback]}, @ra={0x94, 0x4, 0x1}, @noop, @ra={0x94, 0x4}, @timestamp={0x44, 0x24, 0x87, 0x0, 0x0, [0x1, 0x101, 0x5, 0x7fff, 0x8, 0x400, 0xc02, 0x5]}]}}}, @ip_ttl={{0x43, 0x0, 0x2, 0x9}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @multicast2, @multicast1}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}, @ip_retopts={{0x28, 0x0, 0x7, {[@rr={0x7, 0x17, 0x39, [@loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @dev={0xac, 0x14, 0x14, 0x33}, @empty]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}], 0x120}}], 0x3, 0x4840) 40.18606814s ago: executing program 0 (id=1288): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575b43f86dd6067", 0x14}, {&(0x7f00000001c0)="0100"/13, 0xd}, {&(0x7f0000000280)="37a0a6c482b23cba92ffffff3f7b42590e180c07f3c193b532f3080000008c19", 0x20}, {&(0x7f0000000380)="d422b8", 0x3}], 0x4) 39.542690065s ago: executing program 2 (id=1289): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f00000000c0)=@generic={0x0, 0x2, 0xdcd8}) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ef) lsetxattr$security_capability(&(0x7f0000000340)='./file1\x00', &(0x7f00000002c0), &(0x7f0000000300)=@v2={0x2000000, [{0x5, 0x400}, {0x9, 0xc8}]}, 0x14, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x24040040}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c8) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f00000001c0)='./file0/file1\x00', &(0x7f0000000000), 0x0, &(0x7f0000002480)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@uuid_off}, {@redirect_dir_off}, {@verity_require}, {@uuid_null}, {@index_on}], [{@obj_role={'obj_role', 0x3d, '/^'}}, {@subj_user={'subj_user', 0x3d, '#'}}], 0x2c}) truncate(&(0x7f0000000140)='./file0/file1\x00', 0xe2) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r3, 0x8982, &(0x7f0000000040)={0x7, 'vlan0\x00', {0x31b}, 0x200}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r4 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed, 0x7}]}) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000080)={0x7, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x39ea, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc591, 0x8, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8], 0xeeee8000, 0x839d0}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd07, 0x760, 0x0, 0xfffffffffffffd25) read$FUSE(r1, &(0x7f0000000440)={0x2020}, 0x2020) 35.294246809s ago: executing program 1 (id=1292): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x78, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x44, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x38, 0x6, 0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @local}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x70}]}, 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001d008104e00f80ecdb4cb9f207c804a00d000000880802fb0a0002000a0ada1b40d8088fc500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x100000000) ioctl$TIOCGSERIAL(r3, 0x541e, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/47}) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r4 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) write$tun(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="141bdf000010", @ANYRES64=r4], 0xb2) r5 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_VDPA_SET_VRING_ENABLE(r5, 0x4008af75, &(0x7f0000000080)={0x2, 0x7}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, './file0\x00'}}) bind$bt_l2cap(r0, &(0x7f0000002080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x0, 0x1}, 0xe) listen(r0, 0xa) 29.477116276s ago: executing program 1 (id=1293): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180), 0x404300, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002200)=[{{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000440)="f9", 0x1}], 0x1}}], 0x1, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000380)={0x0, @in={{0x2, 0x4e20, @empty}}, 0xad7, 0x2, 0x5, 0x3, 0x50, 0x1, 0x6}, &(0x7f0000000440)=0x9c) ioctl$FS_IOC_GETVERSION(r0, 0x460f, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r3 = openat$cgroup_devices(r2, &(0x7f0000000480)='devices.allow\x00', 0x2, 0x0) setresuid(0xee01, 0xee01, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) write$cgroup_devices(r3, &(0x7f0000001700)=ANY=[], 0x8) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f00000000c0)={0x7, 0x1, 0x2, 0xc2c4, 0x8, 0x0, 0xb7}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r4) sendfile(r0, r4, &(0x7f0000000080)=0x2, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) 27.916090633s ago: executing program 3 (id=1294): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575b43f86dd6067", 0x14}, {&(0x7f00000001c0)="0100"/13, 0xd}, {&(0x7f0000000280)="37a0a6c482b23cba92ffffff3f7b42590e180c07f3c193b532f3080000008c", 0x1f}, {&(0x7f0000000380)="d422b8440c607d46a140ebfce60a67610dd2493961afc1684af41b1820085a974c353f2ff3843617008dee4bcac2e350814f190500"/65, 0x41}], 0x4) 27.601956425s ago: executing program 0 (id=1295): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'vlan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c00070000000701fefffffffcdbdf250206000000000000000001801efb1363dcbdce4a77a664abff2b073f63169ac0592a5be9131dccc64a4cc05194e3a24b4efb1c4d9ec80da946b1b21067b964f3d83f6796bc7023cc984bafa804806bfa1b958d584ef49c9401d23dff6b08c9eb7184411d6aeffbfd8437da10ad5c057a8599f780b0375f1238e8d59c1a0a6f74384ee4ad356c6271c6e8722b3fe11db6fca5cba59d2d10090c48875142b32bb4a9bc"], 0x1c}}, 0xc000) dup2(r0, r2) sendto$packet(r0, &(0x7f00000000c0)="3f03fe7feee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 24.336651117s ago: executing program 32 (id=1289): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f00000000c0)=@generic={0x0, 0x2, 0xdcd8}) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ef) lsetxattr$security_capability(&(0x7f0000000340)='./file1\x00', &(0x7f00000002c0), &(0x7f0000000300)=@v2={0x2000000, [{0x5, 0x400}, {0x9, 0xc8}]}, 0x14, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x24040040}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c8) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f00000001c0)='./file0/file1\x00', &(0x7f0000000000), 0x0, &(0x7f0000002480)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@uuid_off}, {@redirect_dir_off}, {@verity_require}, {@uuid_null}, {@index_on}], [{@obj_role={'obj_role', 0x3d, '/^'}}, {@subj_user={'subj_user', 0x3d, '#'}}], 0x2c}) truncate(&(0x7f0000000140)='./file0/file1\x00', 0xe2) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r3, 0x8982, &(0x7f0000000040)={0x7, 'vlan0\x00', {0x31b}, 0x200}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r4 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed, 0x7}]}) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000080)={0x7, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x39ea, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc591, 0x8, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8], 0xeeee8000, 0x839d0}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd07, 0x760, 0x0, 0xfffffffffffffd25) read$FUSE(r1, &(0x7f0000000440)={0x2020}, 0x2020) 24.267737s ago: executing program 0 (id=1297): r0 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000001340)={{0x5, 0x0, 0x0, 0x7, 'syz0\x00', 0xb}, 0x3, 0x10, 0x8, 0x0, 0x1, 0x1, 'syz1\x00', &(0x7f0000000380)=['']}) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x84, 0x8}) r1 = syz_open_dev$sg(&(0x7f0000000180), 0x0, 0x80041) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000680)={{{@in6=@loopback, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@private1}}, &(0x7f0000000780)=0xe8) pread64(r0, &(0x7f00000008c0)=""/169, 0xa9, 0x20a) quotactl_fd$Q_GETINFO(r1, 0xffffffff80000500, r3, &(0x7f00000007c0)) ioctl$SG_IO(r1, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffd, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f00000000c0)="5b8e7ecf0140", 0x0, 0x3e6, 0x0, 0xfffffffc, 0x0}) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f0000000140), 0x10) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0x301080, 0x0) ioctl$MON_IOCX_GETX(r5, 0x4018920a, &(0x7f0000000500)={&(0x7f0000000400), &(0x7f0000000480)=""/65, 0x41}) sendmsg$can_bcm(r4, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000080)=ANY=[@ANYBLOB="05000000020800"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0xea60, @ANYBLOB="00000040010000000000000024000000f33d8e7b847ec8b36f1107e036dd98fc469107485e371bcf5c6b77db54f3d984795c49eca9b92241dc70c39f976ad52e581942d9fc2178681e6866aa6ef10d06"], 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x20000000) sendmsg$can_bcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x5, 0xe07, 0x4, {0x0, 0x2710}, {}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "645b6048a2e4931133f6d9919fd48557d76811cd874f3c107bbfc1c8831026d40798a2be4cc414e02216198977dc3d41ed0880c64c39e5f4059bae641ed15112"}}, 0x80}}, 0x4040055) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000980), r5) sendmsg$ETHTOOL_MSG_EEE_SET(r6, &(0x7f0000000b00)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x60, r7, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0x5}, @ETHTOOL_A_EEE_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x80040}, 0x44040) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r8, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000340)={0x54, r9, 0x201, 0x70bd29, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0xd}, {0xc, 0x90, 0x91f}}]}, 0x54}}, 0x40010) write(r0, &(0x7f0000000800)="390df4bcdeafbcc4b9915ae87a687eb86f4ac960292483b82e5b00026d66875016dba9b762369ec8fcd22ac5487c0247533ed194542f71ddde6153122123ce741c342c19c3e06eff849434ffbb5ff43decc174260bf06ee3084c3f3b7a987ce0e9b5fdf4959970b22182f9ff5c1de0a5e3e4e19cf118be8fac83296743525bb427f0087860dc7b54768da50df68279d62080e9ebb321c7", 0x97) r10 = socket$igmp(0x2, 0x3, 0x2) r11 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$PPPIOCGMRU(r11, 0x80047453, 0x0) setsockopt$MRT_ADD_VIF(r10, 0x0, 0xca, &(0x7f0000000040)={0x0, 0x0, 0x8, 0x6, @vifc_lcl_addr=@remote, @local}, 0x10) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000140)=0x4fe) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r8, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r9, 0x0, 0x70bd2a, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x44) ioctl$SIOCGETMIFCNT_IN6(r10, 0x89e0, &(0x7f0000000580)) 24.267184971s ago: executing program 1 (id=1298): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x1, 0x4, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20}, 0x4000) 24.115426876s ago: executing program 3 (id=1299): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="aaaaaaaaaa2986dd6d002008001011ff200100000000000000000001ff0200000000000000000000000000014f194e20001090788208000100000000"], 0x4a) 21.574794372s ago: executing program 1 (id=1300): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000000)=ANY=[@ANYBLOB="d4000000", @ANYRES16=r1, @ANYBLOB="01002abd7000ffdbdf250300000008000100000000000c0006000300"], 0xd4}, 0x1, 0x0, 0x0, 0x4000010}, 0x2048000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r2, &(0x7f0000002d40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002d00)={&(0x7f0000004ac0)={0x1d58, r3, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x7, 0x5b}}}}, [@NL80211_ATTR_NAN_FUNC={0x1e4, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_TYPE={0x5, 0x1, 0x2}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}, @NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x3}, @NL80211_NAN_FUNC_RX_MATCH_FILTER={0x168, 0xd, 0x0, 0x1, [{0x5e, 0x0, "fe658db99ac0938b7ca8ed2bcb1abfeb4c391830ebbd731aecfe81e56f8a238f49df59093dc1399e86a59d9087bfd9f1505f88d459ffe84b16c867c5fba8160c856bc76b9b0e33a82a1dbb683229f65e6d53294ccd7eb5dc6df1"}, {0xd4, 0x0, "abcbca265ba9821c35d3d36faba1dedbb2cb5005cd2f24657f603be11cc72b4e49b35d6a5f57a51069eda4676998fadc1adbe9a6b236cef864afd0e032ec6ed5bbc35a8850a1c878220805b8f03baeafaee1e6e9bd8ab4681764bbb056f7e246cbe3d94a25c25e8d23b45e3dd628fbbca41c3b732c2525e2a4a24a033e8d805e04a7a02e99403949337b668545ef9605531ee66aef1d6a79187ae712a14dd338bbe3f3a976560d00a654a6f27a274714d83a3651310d576264d173ba8d76be65c4189eed8d7b1021e937e8f335ca9689"}, {0x2f, 0x0, "3c979d2b1d7e3b1ebb944060a95c0fa619d58bf658c641d19ea1c5f8e34267a4445dc1cb5d62abc506d88f"}]}, @NL80211_NAN_FUNC_SERVICE_ID={0xa, 0x2, "c46e040783af"}, @NL80211_NAN_FUNC_SRF={0x4c, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_MAC_ADDRS={0x1c, 0x4, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}]}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x2}, @NL80211_NAN_SRF_INCLUDE={0x4}, @NL80211_NAN_SRF_MAC_ADDRS={0x1c, 0x4, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}]}, @NL80211_NAN_SRF_INCLUDE={0x4}]}, @NL80211_NAN_FUNC_FOLLOW_UP_ID={0x5, 0x6, 0x42}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}]}, @NL80211_ATTR_NAN_FUNC={0x1c, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_FOLLOW_UP_ID={0x5, 0x6, 0x5}, @NL80211_NAN_FUNC_PUBLISH_BCAST={0x4}, @NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE={0x4}, @NL80211_NAN_FUNC_PUBLISH_TYPE={0x5}]}, @NL80211_ATTR_NAN_FUNC={0x1ac, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_RX_MATCH_FILTER={0x1a8, 0xd, 0x0, 0x1, [{0x27, 0x0, "c4bc47f78ffbdc621500a6fa277331aaad59d8a9337ac24d0453e1ffe963f33bd356ec"}, {0x75, 0x0, "cfac756c17ef6d73c465c9beb692c8d9f631949d0a8d45823b6a8c0f0d485422fce42065f49f2a3061ea5b9d21405c154965fd054c61005d1608968ce6dc6c79a4610dd20821de3d079f9fbc1142aad61c011906c7018c1f28b66bd8228c4b3053245adc399c32e81db005d133e9cfc72a"}, {0xe7, 0x0, "95c4cc17ffeb13fbc45e70fb0264d8e93e734b8d77dfc5c3dc4f38d844e1a8ec3827dfaadd8f2a13f8f240b6552ee3ce19da4c481bd2b2fe2fc27f2c6570d4f70878bf03160faced1a0a9f7ce431db7d717c2762e862e8f7daf4f9132fdd02342bd9f6a93e141a8535872f6181a4e593a6a793705e26d242c72d68e32fcb5fa7d46d8bc92003f77c2e20b863ab860f535197a33ceee648f34d131881e244657c9f3d53f65137937155236247d25d152c964b3a2ca53bbfbb2a3a0cba6ed5ce0b04e6e1b7e23de4ec2435606f275c9370155e9aed3191488af9a7edd18632b4adc32941"}, {0x1a, 0x0, "ea4a04b6425350fa7df2a56da601dd75aa319a4341c5"}]}]}, @NL80211_ATTR_NAN_FUNC={0x188, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_SERVICE_INFO={0xd1, 0xb, "017481383cb7463e4600ec36fbb0a20859c73dbbb12ed804354489db7a3cc55455029223211a14747318abc709fb6cf2eccb0feb97156b03af1312a78bd225463bfbcb4fceb991a1b7d5a4d05d7143c142f3a7dbd427ec68c0f1fe17814e1c4801292a92ef47fbb1c2c32c6ce29f9b0cb1371a415e3ba6486b0635381f3ad8cfdbbd0fff1188f25f019996543e68da0b80cd6ebe4a4ddb2e8653eac3147477ce3b034d22df3be3402ca1507a5cfa84103031ea505b08822434379b1e403bb3b49548ffb5b13fb96116b8a63a28"}, @NL80211_NAN_FUNC_SERVICE_ID={0xa, 0x2, "e8b587590a03"}, @NL80211_NAN_FUNC_SERVICE_INFO={0xa2, 0xb, "222120878e0a04e3b1e3f0e07b99534ce0967db85c327cb34a3198a715baa9356480817804555c1f1a650416286ea5196275df4f444dd225236c65db5cbd74117aa67ac350cd951578ef60f87c56cc1b578eb24cd886ed970063db1b2d56482c88fef709481b3c3798e3d9d102c599221f908f1ce6b97db4b39903405873a8992b311b26629ecb2d84ce4d505a93fdf0ed6251729a258adcd5bc1fac98f4"}]}, @NL80211_ATTR_NAN_FUNC={0xd8, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID={0x5, 0x7, 0x5}, @NL80211_NAN_FUNC_SERVICE_INFO={0xc3, 0xb, "159f010ceeb4a0f3bb4d0ce7fe3feae5ac353d177e2ddfbc27a455d0702e2618897af85ab1d6d8a9bd7b28f5c3d792e3cb66a9f676fec886236a7e133c1c6d417a60bc5893e6c6f28b34c87e65111d4f25a36ea2fd5185154a36a7a41ac15e737ee0429855070652274ef7697977e1b8e4026d3b6e746ca461838f77416866622fe793410c3e9a658550cb398977d37a3c75df1bb01d1352ace3f028be3ecfbc097decb02c623965aebea91c16d48057b97e87cb0cab95765f6f1b9e7e9f18"}, @NL80211_NAN_FUNC_TTL={0x8, 0xa, 0xfffffffa}]}, @NL80211_ATTR_NAN_FUNC={0xf0, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_CLOSE_RANGE={0x4}, @NL80211_NAN_FUNC_SERVICE_INFO={0xd0, 0xb, "70d7e7e249ff66d410b760488915aee8008211836c860e98a2879dc51a188be095ff6be80af9ab068d0d11c1cadd92db436f23944150b757d6b1be1111377c8fff8fd91411d114f52f1595af2dd870a67ffb031e6e133a3cbc871db97744ca2c60100536cd8a14d2af2caf1d025ff2453c223c2ef533da6256efe7252fcd97b596ec235b6b2a542ac28dc065fa8c1872aaf13ca09a57bf0ce3e8cf6301d6377e2853c9d2ea3a0837a4d78cb5a7581619d877f71aa61c91fd4be8466723a6f3628bbf356088019680e38dace5"}, @NL80211_NAN_FUNC_SERVICE_ID={0xa, 0x2, "c65dc60e609e"}, @NL80211_NAN_FUNC_PUBLISH_TYPE={0x5, 0x3, 0xeb}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}]}, @NL80211_ATTR_NAN_FUNC={0x163c, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_RX_MATCH_FILTER={0x3d4, 0xd, 0x0, 0x1, [{0x6a, 0x0, "0fab2b7bcfb918e9298383a71194354a23ea06c5f1715773471652aa3317957c4cff1858c5e0e1c93f8e345d5cf374a6990663b8f37060b76993f675302635e39f71e7e3c49076b5fad4ff3f7aface6c0a70b4ff6985df16bb30aaff76b09d427afd62e509c0"}, {0x50, 0x0, "75b8939d161278a7ca516b0dbaacb10693de24040f3ce425676aa2a7961901aafb439535e6500a8fdae07dd97fb3d6d70908a0686ba8ef6c7d8d9fe2e8e2d918552914501abdbac078217dff"}, {0xb1, 0x0, "9d51e3ffaea2a013d812d72a56f4e4389406d9ea9132af39f2586f72c79ddd84852c70397e3413c1309e5d8f9cd4a852453d09a7b6a69b6e6903f76a8401944b71e0f672a0476a49b42ec080e7e985624805db67724e46910120855172a056fde3877350fa41fe5872d461803286e50eb4b00346a8ae397e078389fedf140f8c17da7b40b2449bd917638cfe3609ace83e771a7b0a051732569357845953a146a1a0fa4c0df50567e2cb5250ed"}, {0xe0, 0x0, "84adfada46ecfbb8a9d6e3a565b9fcc72c409eaf3ec1e2dd4ca2b9189a118c892b921c4ea6ef44fc7eeb063c95eb4cfaec0b970f1ba0125c0dd80e8ceae9db1c9697803e9f9956fd4562e3e6f7866864510ca2db7337bdeca9603e4736b338b223932c5ebfa272ca58134c9223da6c6f682fd97857df068a0e055febf948afda5632c63f990e4e48100780d87543aa0449ed8f850a9d45a1821fbe4ed37f867a189a492dfc12a1ca4898f8de032b7fd903264fb9b56a38f4831110a801dfff7a0757dea726650e5d5674ca114c43d5c311a2dac4f1ee7e088f13b173"}, {0x10, 0x0, "4d3e5796460a20080c1d3621"}, {0x2e, 0x0, "263681e7ec6e7d8007dcfab2dad7eb1e3613bbf7d8393e99663f4d450c9459d0ad13330bccdd81e86518"}, {0x71, 0x0, "c547016831324395b636b08ecb37c26dcb0304326a80bbb279c0057b10e61a67f77b4c0e8526f173c908b98c6099785f1195e323a95a2c5ed944305bb01a067a638449a5c5a3caa6561144da14d83dc1607851c6294519617114f78d676fa156b9396853375ce009c1dc36f401"}, {0x26, 0x0, "32bc27ad3131f3e1992d9e58fa1e07a750fe2c1a45cec420a3fb71d0697ac63de940"}, {0xa2, 0x0, "8ddc17983258c39458fef2a8c3a7674aaeee2c860b6fb3858bf26957046becf24972649181de6ac74876335bf27573131546be13cd0bbfac94a8a04a74cba1f0f5a29869cf0bcb50786cc7820871bfef215edade394e28e55f346c2dcb3aba701f4c4d01f60fda017fe6913a8f56db61fd74a41a9c27b1200ae2db7f95bf42cbbfe298cc42523d77d01b3688fed7400bcc614b1db0e06774ed81b3f15078"}]}, @NL80211_NAN_FUNC_RX_MATCH_FILTER={0x105c, 0xd, 0x0, 0x1, [{0x1004, 0x0, "ebdccf1f610303427faaea577846461813c20b88a2f06d5f6fac55679e03cfdeaf1e410a26c30567adaae2da625cadedc85509659469b8184ec61fd01d80afc63dc2cc1224f29315d9d9209603a907c0e31b87bb18c4a50c0b56573423f3fda625fc8cb29f7c8c4130b1b783079b879c0dafddf932d1adc636a737dc6162a279c52500b79f15736dcabeb60e96cbcbf94d521379fc74943262e9c5448ee6a609d990bb4215bc6499cef9ce1842d3311a092dd6ff778b82d098223ed95841a5068d869a7a8b21af84826c8f22c407b1b5c671d40f431e698dd59f62ba68a875ef77a028e59f9ecc6001e1adc830207c64ad520222f77b5848e8c61325f59bff9e87a8788c2b8f11a8a0b961ba2096efd36c1fe89cfce3ec685b826c97c8e50c8d1a7bf43ecc37a6a30ffd778c2a0bced2e2e189c1c6d83cc56d29bbc8f5c954293ad7da2f570733c1d2db27b8497d9145a9616b263f83ccd84634893a9c7d0d8b0988e02b86be1ab750e66b2f71e55475f8eb26d2cc01eea138be1827255d55c00460e73ad93c9389fc2ba820f3a661c4ac814cade9d1085406f85d0e09b4d273494c7e2dbecb39b4d55d5a95ae08ace3f31965dfbb095af176e591017005678a19fcd59aa6ded630bec4a94a480bc730f8f6dd9fe67714f8f7e6fe10002ecff92bfaccc785b7327fd393b330c627540a9718eb9db0418ec2029a4a7dd3fb70f4d174d40b94b66b79a7c2a44d741d815ed2f3d644c7e50031f4edba57cafb986eb9fe5a77f2d745e9dd009c09bf79061670f5fb89fd0f036686a8c9bade68829fee186a879807e40827b8476ba95c3d41aaedc82ba799689fdc806765d670d67d217980cc2a42c64b82308c0180e396204e1511831bf31e8a63a64e0a3240c303933af64d95d1699b4c1b987a84d24b1e160dc67ba49254e2501bfbc6a1a36d9e86799470a07de6e22d268e60b71075b58ed10796f164d7450b2c927e89abafd2e080cb055c484b8ba32e69999df7a2743af6f5086b54a50cd8f5a10aaceb858c55f9ae7db459e4dfb6adf594dbcc281d4c3e73c93c1ae9946899d841166c312e9b525b015914da5cbbd1b28d5005157a22a8734b961687039ce59bfd8f19230fe56d6e61667669829e84107f5f7cb05fe08e0e9d965c651a883fba05b134687eb799da9b27c96f04473471fada5bcd30f1f13b6103f14fcccf3bde3c07a9fac4e9227af3bab94208583d3b87fcc543439d0a167cb016ab21cdefc854e78d71b09c4353ddbbc2972e87db3279150113a6e41cfbbc26d297d6c507e48d44d8fb85f5f03d1d83d75326bd78d4454332e91700f2a0d3f46c552c17b7602bddc59c7f3e6ffd8e540c1c282c775b0364dd21a8bd075297064ae98449bb558ef6f2b8a7d52131cf44ffdea137801694b10db0320ea1a6984ebcaeebd713bbfe49ae3f7269ca6c329475cfbff2c32e874ac35025470032170bb40651424cd32293b8902e76f8421a2a6c4746c8462fe408564a1c06c20c54d87a6e60689c9511ae2f76dc5aad569354c8db38ae3b70802c063e0097a2368bdcb58b729e92b145f54b4f9ea4c6fccf186e6af68f748852598908cdb8bf6741d9bbea36f6139505829534fd41f7810854f5ff89216af887cdeea3e1a597cd50ecbe281ed6519511e198a101bf4ea494c30adbbf8e0c738ee98119a673be1ce4b7eb762fa724ddabb519b00b9180bfca16bab8d85da3b9e10e73e6ea944ff2188273967fcf7a818e4328e0b5e2b354e8696fe6359fe236d9614210ceb49b9dd56199e12fbd3346b7381fac37aba2124615349fdc116673730fbe64cd4471605d966cbbdaec8441b833fa9531a513058f5f5640a97fabe5701a352dca256c00ad6fcf791f3b6951dcd08ee39f15b53fc1aebd59240e5e3071ddd74cc21bcd7692ad3e5d43d1877d86ed5e35d953f2a3909fb7124743511f014a0ac57247181292e69f7207dc2a71186b7d98ed3b2620cdb8423d88bb0792f48133f4148c4f941765b91088c9dc6faabc366c5a7b8032f41a5cc26f52474b706caec892f2fab0a78513d7aafa6c497a37e44603c8eeb2d79df9f3ce6de2acd970f85d4d15a7fd6fe0c1db85c726f7a16e7f23822ee72daddb19a11e5a01f3979057cec5d2de707aba0145ac3d846f7ab15cc806bff1b920adb4c09ea791788aea2136ac294b7506b36b61b69372925139ab3da23c41ffb56ab295e7524887a69554a25238f7ab0cda49da8965d53adc62d2dc03ec563c45ad4d71b0a052fe03ea80c0f141bc4d8e7e5da83138ca5c7a201d49b58c87000b087cfd4f07000ec8493d837cda8609ae45a60854931773b2badb393c6a89333cff2de53a4e0c0f7a6eb5999eb0487bf94726a3a62551184123f7104ec1e3e3e9e040f2bec4395d9cb1fa3603fdb10b0eaaa6ce6101038d41bbbc4d6d59efcac815f00a661e83bfa3043fb1fec230308b928830eae202e82e6ea5f69e4496b05165e04afdf0bfadc58f1261c91afb381a6b03387770f013d53031598d147673348596c0d4b9b01259fccb023bc4dcd6700b23e467c3843c2da49a2dc72de8158bc16b43bf594d53a0c51f96d2f22f5a812901326462d3d6cbce760985058ce0157bc17f7a6b9bae9b1f72a1919e892c9dde8e7c2ee3e70a362297b76b94540362c21d39b997ac3d6b3884eb8e27ede59777c457e9d449b842c2de6e2890e0156905854f870079878de8e7a55fa96b37a30c784d21a39fe9e0085255af53f0092ab6a04bb10455c2f61870b92b1c387590273d84c44642bf4afbe6d489f6a142abc5bded12b22105d74c812e94866b82b16887f8e791909b2a209c2dec25e3fde8ced010ebf175f7696263ba83eed8ae150b756913da606969fbfc6ddc494df053762e738abfbb607f84f9c44b88c41df8475c40bb40022b4a3d42cecb2977b37369fff2524a6f5ead2601e7426f2a57f64d9df10ae551eec220e9a2c4ba1fdc359bca1f8d66556b67229c3bdb6376079b16c16dbcfedb1660f7e778618357aad9529e2c24c05b71f4585944e0b6095bb6cd24d3cd2b29fd7717762627cf27a34f490caba9315cef4e966531a7203becf0b3df0fb45c3a56ea60c5ea92b6e5b0e4f17e29ed74a2a2d360c944976ba07e87875ed1837b61d0e214622646b21c437e0d258d8bc4550a09887e63ae0f00508751ce12802926d4bfb385be991ebaa881df4dc246f3a00a0ae0ba3bdd34a1dc440e7176353c0ab61b6172b27b66d2c28e55fe342d4d37fc1b6431ff6a8e545b9bf9448f758e4cfc1c3bd1671d3b538c33e952c25f3effa52f89ef4191fb590246fb99e9d555329ecd521da02cd91f7cbdd6989be2ca93167ed582b2bdc0f33a4839d3418f7d792b9b987b2a4f52d6aa8d31d795266d1135122bfa223d3d5ac7b5fd3706efa8fd89158f852071c9cc951c2211e32d1a7fcac296ad49195729a8cc507c700d7d0827bdc4a0eb3734015068b1325a7b500bd5755d0257891ce2838e726dad0cd47ed9c56a1734d8eb6f0341a4c0186930b9cd0867fff04d3498b3ba43640f62d47d97cce8f7a7f38e2569550da15612fab1b4bca758e46704555db4fa2c6f66e5dd81135c36698fcd3dcc93e45a227a8bff00cf8b1b9ecfb4dc62eaccdac27b6f0c82f80138bbf50cd1ff2158e65642969324489d6a65ed88bd04f4bbe13953efd92ac6ccb7db6775f842d0160c84db4a4c9c00310ca08e058734883240ac754234fc127a425ffb0ab046b177ac5d014bdef8af945dc7b31370cff2e97292d629985b7255fac64cb4f1cd31b5f089515e07aaaf1777c8909c21c2e3b9141bc97e0942ebab39720339345f4496700ad663e86f4a5aff7c4ead3c9c67291fef5856676ccd5cd663dbe1c6bcd62d9f926d684672321eaff8ebe14725d165778d44932d30e47f8e26bf74d8e8fdc7ee0e40bec4cc2e32199ec82f7b151d351c55b34c509b148292eb9b4db53a4f33241ae30888b0e1dca1cdd5304bc553f1b6de9edc5be21431b16250ebf75b700f5a6687d07a150b7764e7caf55c5851f06a6680686a53d7ce5b0484a8303fe3427e272df4fae40b8007941008513d51428d41c1e50067fe73e3880660c7168a86676df9ad3f4f614479aded50654b3ff50621eb4e48fa3480fb7a0206a0a3b944acd1d1d6cfc8e561968bc1a6b738c9ca9ec5de84fcd4fdccb7a3a1af18de997b54f6e55c9587176d5ef632f6737c9817d80087508e8308c6854fcf2557c9ce3fbf465d698b7997c77f13a135a97bba0d348f3b6af15b01b83f20c1b8776348e349a5a8c35ef0c791c8a77ee91da4397a38fc8b49e68190cf1d50d3ca80e3c7508f97a6be22c6f816d91b077ed043adbde030ee61e14e1bf91179b944338c69140a200e57a964491421ff96e99fb29ed51ebc3b046747fd021e5876f05fb266f2467d61311c27fa30b3c309d906e5390fb1e40d0a750d4142ea96624ed4e522ab6508cdc1e6d0f31911b23ce3c3b1e36448e2dd062f37509aff6fb9be5087a4254c48b87f7391989fe6e903c00a955f9a7e00c1ab0195949c3dfd01bae9884ed54f790f2b20fd05096c45a829e3a011d927ca381a58a8015acc5a00e23c24f34475da4c66483e18658e38623ff549b340d1966ff6c5fecf928dccc89203da30ab9685ee4215a1727980cfbce27b5a1d5cfe1223b106499b0004cce0b249613ba9840f5f74b831dc904b6cfd0f66e70de640e8ee0d2aef23ce7ab4fccd3aa6714c4f4e9934d4136ccaf2fc5b006a05f2e1a24eb33c878de4d73be1736ed19d7a8ce35f7bffd0957917a1e787f1057ce88248f9c9b2cc31a98d1b4e10be1355195e2994ed96bb57eae210c0c6ae1328d7d88a03e429a4fb01a47b629e343e33c13dcbcfb2571b3aaeb581ca641617a1770f8ccdb122d24b60f4a36a9134ffeed7ddc2abf4bb8f0c169c314d0652f73acadc17115e10921e71e99273a66f406d27784721777769baec7b07baaa662e7b1afa66612995617dbf13e0913e03e3ae8e6011a36c3ebeaa5f661e4f737fcacca4cf707509eb17126d291c227ed5c114d67152e46eb8391db7f9f636c2532fe17914aa0c5feef8c1f761df1a9255d83427cd2c9d527987c2b6a2e21beaa648f5b4a5dc8ab98b90d6ccacebb3b4d364b3e83b864a12112c4f1fad7fb9cb91130a17b2896fa861816164976774b108d5cdcc7819eeb8eb78c54883a923cce002c012f98e18f6cfe4d750fb5bc905fa3b7c3de1f8985b8d8eee0f23a3124b3de7dc08dffa06d41a9e193dcd0df8bac4c97e93be8cedfecd49cd7b14b7ac44981a39fe89c2d0b66ac8d04f0133939bdb3819e52fe4e5d245e08638829ccf576a2123d26f5b2527a6afb954ecebc179fbedd3a167431ee09c27f91ca6fde351499843490c60d24e6dd453479d641f095c0719a2f44980a02ae91d1cda6fc44b6275d2eefe3b8afec7603b788454f719ff782226efeff672a82d10268699425a879f8c74f9639c9317785655446faaaded8079a04a2bcbccce2c034f4c7ba7962f2d810fe74daafc185bc74f23795f6b14f34fb49bc2e9e361925df1b003658418f0e3b40c6008fce2da9b94c237a5f00787730d6148284dcae351a243f7b7ca70002d5edf2facd4e31b72c64a0517801cda6169ec3e7505a4b01831dfb595eac040b100dcb7569fcbfff35a9762c76a58ed3397281eaf6772c1b2b25fc2f941ae040ff26f33c90e7740e22ab4e43a03959ee2619d3f0e7d43e15d6ed6b750d8919c65e22d34f440b3e787edbf118f18"}, {0x10, 0x0, "b8548ddd7aebf078ea6a7201"}, {0x9, 0x0, "a89133495a"}, {0x38, 0x0, "8bd09c4b361fb20267814db6803ffe5d477b931d8c50188cd325ec240717d8453d362eec869cd0db52c1d8bc7393e32978ba2548"}]}, @NL80211_NAN_FUNC_FOLLOW_UP_DEST={0xa}, @NL80211_NAN_FUNC_TX_MATCH_FILTER={0xe0, 0xe, 0x0, 0x1, [{0x8, 0x0, "f262ccbb"}, {0xd1, 0x0, "465a3bb39af66d635ea722d7db228abfd1cb96bb5d4c17b1e0aab28183a5913e76de224b39fd3b19eaec01b4dda1affd8df7ac8a2e23e968e52a41be00323b1f4503d1a89427f214f25be7d7860615af9854669dc08e0d2a1aca6f411890477604ba2fa86c19002d2640147e4b4912ae0e29c7f47c2b41f0eb088e579c654f05cec63078eb72a7c15ca313281c5c1e2b7bce7114a10f309dd60387171e392393a8fa0823d0da95e296799fbaa56b5527328a35f9e3dc6fbf56aec9ec230b8646aa1a7c01daa0d8ed71b981dca2"}]}, @NL80211_NAN_FUNC_TX_MATCH_FILTER={0x114, 0xe, 0x0, 0x1, [{0x4a, 0x0, "59b121d639a241b8f94b1a1cfa60aa31b4b3cc419221eb6921dd807f3a4d59ea3dafa6097520939c3f31915c199191605fa001fd759d30ba5df22a33022eeccb83c370ae9716"}, {0xc1, 0x0, "1c5c52551aca05ec49105813261d5be9c110147d3dcafadafad5ad208c0fccb29e8644b5b8cfe0e1f0fb79358ddcb7af32d0b68f265a1ac8815f98a46ee69ce3db8dd7dc3e4869e3f7c6b3fed87f8da4421a8a22c7521cb4250aaea9ab3730e02661754e8edf619deb55a5c5f337f4a989212097dd71720f2b990be6464d534cdc9300d1a9b8d8348dfee011b9325553100cdbc4bafec17ddcfafe6dd6ae1566215d189244e180096028ae1d4c344aba0cec34a3ae4f2d54e435c1dd82"}]}, @NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x207f}]}]}, 0x1d58}, 0x1, 0x0, 0x0, 0x4040800}, 0x4fb1154db5060ee7) 21.321691439s ago: executing program 1 (id=1301): setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0xfffa) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000580), 0x123101, 0x0) kexec_load(0x0, 0x1, &(0x7f0000000f00)=[{0x0, 0x0, 0x2, 0x81}], 0x1) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x3a) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000bd02c440560831ac1e93010203010902120081000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r3, &(0x7f0000004b40)={0x0, 0x0, &(0x7f0000004b00)={&(0x7f0000004ac0)={0x20, 0x140c, 0x4ff18dd1d69ce6eb, 0x70bd25, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x40814}, 0x2000c000) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000000)={0x0, 0xb, 0x2, "3db2"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000100)=0xfff9, 0x4) sendto$inet6(r1, &(0x7f0000000000)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}, 0xfffffff1}], 0x1, 0x14002, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) 17.001719864s ago: executing program 0 (id=1302): socket(0x28, 0x5, 0x0) r0 = socket(0x1, 0x3, 0x0) bind$unix(r0, &(0x7f0000000840)=@abs={0x1, 0x0, 0x4e22}, 0x6e) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000080)={0x8f, 0x0, 0xa}) r3 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r3, 0x84, 0x21, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SIOCGETMIFCNT_IN6(r0, 0x89e0, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r6, 0x0, 0x20000023896) sendmsg$NFT_MSG_GETRULE(r6, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x7, 0xa, 0xa00, 0x0, 0x0, {0x2, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40000010) close_range(r5, 0xffffffffffffffff, 0x200000000000000) syz_usb_connect(0x0, 0x2d, &(0x7f0000000500)={{0x12, 0x1, 0x200, 0xb6, 0x34, 0x18, 0x20, 0x525, 0xa4a4, 0xd37e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x6, 0x4, 0xa0, 0xf3, "", [{{0x9, 0x4, 0x84, 0x6, 0x1, 0x2, 0x5, 0xb5, 0x4, [], [{{0x9, 0x5, 0xa, 0x1, 0x10, 0xf8, 0x6c, 0x5}}]}}]}}]}}, 0x0) r7 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x100, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000200), &(0x7f0000000240)=0x4) r10 = eventfd2(0x10001, 0x80800) r11 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) read(r11, 0x0, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r6, 0x0, 0x1, &(0x7f0000000180)=0x2, 0x4) ioctl$KVM_HYPERV_EVENTFD(r9, 0x4018aebd, &(0x7f0000000100)={0x2, r10}) ioctl$KVM_HYPERV_EVENTFD(r9, 0x4018aebd, &(0x7f0000000000)={0x2, r10, 0x1}) ioctl$SNDRV_PCM_IOCTL_UNLINK(r7, 0x40044160, 0x3) 17.00133437s ago: executing program 1 (id=1303): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575b43f86dd6067", 0x14}, {&(0x7f00000001c0)="0100"/13, 0xd}, {&(0x7f0000000280)="37a0a6c482b23cba92ffffff3f7b42590e180c07f3c193b532f3080000008c19", 0x20}, {&(0x7f0000000380)="d422", 0x2}], 0x4) 7.672961666s ago: executing program 33 (id=1299): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="aaaaaaaaaa2986dd6d002008001011ff200100000000000000000001ff0200000000000000000000000000014f194e20001090788208000100000000"], 0x4a) 1.087368934s ago: executing program 34 (id=1302): socket(0x28, 0x5, 0x0) r0 = socket(0x1, 0x3, 0x0) bind$unix(r0, &(0x7f0000000840)=@abs={0x1, 0x0, 0x4e22}, 0x6e) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000080)={0x8f, 0x0, 0xa}) r3 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r3, 0x84, 0x21, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SIOCGETMIFCNT_IN6(r0, 0x89e0, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r6, 0x0, 0x20000023896) sendmsg$NFT_MSG_GETRULE(r6, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x7, 0xa, 0xa00, 0x0, 0x0, {0x2, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40000010) close_range(r5, 0xffffffffffffffff, 0x200000000000000) syz_usb_connect(0x0, 0x2d, &(0x7f0000000500)={{0x12, 0x1, 0x200, 0xb6, 0x34, 0x18, 0x20, 0x525, 0xa4a4, 0xd37e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x6, 0x4, 0xa0, 0xf3, "", [{{0x9, 0x4, 0x84, 0x6, 0x1, 0x2, 0x5, 0xb5, 0x4, [], [{{0x9, 0x5, 0xa, 0x1, 0x10, 0xf8, 0x6c, 0x5}}]}}]}}]}}, 0x0) r7 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x100, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000200), &(0x7f0000000240)=0x4) r10 = eventfd2(0x10001, 0x80800) r11 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) read(r11, 0x0, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r6, 0x0, 0x1, &(0x7f0000000180)=0x2, 0x4) ioctl$KVM_HYPERV_EVENTFD(r9, 0x4018aebd, &(0x7f0000000100)={0x2, r10}) ioctl$KVM_HYPERV_EVENTFD(r9, 0x4018aebd, &(0x7f0000000000)={0x2, r10, 0x1}) ioctl$SNDRV_PCM_IOCTL_UNLINK(r7, 0x40044160, 0x3) 0s ago: executing program 35 (id=1303): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575b43f86dd6067", 0x14}, {&(0x7f00000001c0)="0100"/13, 0xd}, {&(0x7f0000000280)="37a0a6c482b23cba92ffffff3f7b42590e180c07f3c193b532f3080000008c19", 0x20}, {&(0x7f0000000380)="d422", 0x2}], 0x4) kernel console output (not intermixed with test programs): nk tx timeout [ 139.214197][ T4920] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 139.980797][ T4920] Bluetooth: hci2: link tx timeout [ 139.982592][ T4920] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 140.493497][ T7251] syzkaller1: entered promiscuous mode [ 140.493522][ T7251] syzkaller1: entered allmulticast mode [ 140.554770][ T7251] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 141.299534][ T4920] Bluetooth: hci1: command 0x0406 tx timeout [ 141.660762][ T5615] Bluetooth: hci0: link tx timeout [ 141.660922][ T5615] Bluetooth: hci0: killing stalled connection 10:aa:aa:aa:aa:aa [ 141.871504][ T7307] block nbd0: NBD_DISCONNECT [ 142.024204][ T4920] Bluetooth: hci2: command 0x0406 tx timeout [ 142.420737][ T5619] Bluetooth: to_multiplier 0 < 10 [ 142.484909][ T32] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 142.691684][ T32] usb 2-1: Using ep0 maxpacket: 8 [ 142.749720][ T32] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 142.749749][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.749768][ T32] usb 2-1: Product: syz [ 142.749782][ T32] usb 2-1: Manufacturer: syz [ 142.749795][ T32] usb 2-1: SerialNumber: syz [ 142.849900][ T32] usb 2-1: config 0 descriptor?? [ 143.092885][ T32] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 143.366273][ T7292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.373339][ T7292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.507510][ T32] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 143.605149][ T32] usb 2-1: USB disconnect, device number 2 [ 143.706774][ T5619] Bluetooth: hci0: command 0x0406 tx timeout [ 143.863611][ T7353] block nbd2: NBD_DISCONNECT [ 144.137903][ T32] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 144.298372][ T32] usb 1-1: Using ep0 maxpacket: 8 [ 144.303398][ T32] usb 1-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 144.303432][ T32] usb 1-1: config 0 interface 0 has no altsetting 0 [ 144.303465][ T32] usb 1-1: New USB device found, idVendor=044e, idProduct=1215, bcdDevice= 0.00 [ 144.303487][ T32] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.379704][ T32] usb 1-1: config 0 descriptor?? [ 145.044695][ T32] usbhid 1-1:0.0: can't add hid device: -71 [ 145.044786][ T32] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 145.051984][ T32] usb 1-1: USB disconnect, device number 2 [ 145.788052][ T5615] Bluetooth: hci0: command 0x0406 tx timeout [ 146.248637][ T5618] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 146.397898][ T5618] usb 2-1: Using ep0 maxpacket: 8 [ 146.455156][ T5618] usb 2-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 146.455191][ T5618] usb 2-1: config 0 interface 0 has no altsetting 0 [ 146.455224][ T5618] usb 2-1: New USB device found, idVendor=044e, idProduct=1215, bcdDevice= 0.00 [ 146.455246][ T5618] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.514766][ T5618] usb 2-1: config 0 descriptor?? [ 147.145613][ T5618] usbhid 2-1:0.0: can't add hid device: -71 [ 147.145720][ T5618] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 147.182695][ T5618] usb 2-1: USB disconnect, device number 3 [ 147.452937][ T5615] Bluetooth: hci3: link tx timeout [ 147.453210][ T5615] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 148.274409][ T7483] @ÿ: renamed from bond_slave_0 (while UP) [ 148.394509][ T7487] netlink: 'syz.2.746': attribute type 10 has an invalid length. [ 148.443716][ T7487] team0: Port device dummy0 added [ 148.851181][ T5615] Bluetooth: min 6 > max 0 [ 149.192924][ T7513] netlink: 132 bytes leftover after parsing attributes in process `syz.3.757'. [ 149.375940][ T5615] Bluetooth: min 6 > max 0 [ 149.538026][ T5615] Bluetooth: hci3: command 0x0406 tx timeout [ 150.048768][ T5618] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 150.208195][ T5618] usb 4-1: Using ep0 maxpacket: 16 [ 150.214692][ T5618] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 150.214720][ T5618] usb 4-1: config 0 has no interface number 0 [ 150.214764][ T5618] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 150.214789][ T5618] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 150.266787][ T5618] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 150.266815][ T5618] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.266833][ T5618] usb 4-1: Product: syz [ 150.266846][ T5618] usb 4-1: Manufacturer: syz [ 150.266861][ T5618] usb 4-1: SerialNumber: syz [ 150.333431][ T5618] usb 4-1: config 0 descriptor?? [ 150.334180][ T7529] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.334293][ T7529] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.348304][ T5619] Bluetooth: min 6 > max 0 [ 150.540237][ T7529] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.540351][ T7529] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 150.747287][ T5618] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 150.898275][ T5619] Bluetooth: hci1: command 0x0406 tx timeout [ 151.186010][ T5618] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 151.186037][ T5618] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 151.202413][ T5618] asix 4-1:0.34: probe with driver asix failed with error -71 [ 151.263152][ T5618] usb 4-1: USB disconnect, device number 2 [ 151.380465][ T5619] Bluetooth: hci0: command 0x0406 tx timeout [ 151.475531][ T5619] Bluetooth: min 6 > max 0 [ 152.346925][ T5722] kernel read not supported for file /rfkill (pid: 5722 comm: kworker/0:6) [ 152.417929][ T5619] Bluetooth: hci3: command 0x0406 tx timeout [ 152.533728][ T5619] Bluetooth: min 6 > max 0 [ 153.072241][ T5697] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 153.197092][ T7619] futex_wake_op: syz.3.798 tries to shift op by 144; fix this program [ 153.197894][ T5697] usb 3-1: device descriptor read/64, error -71 [ 153.199737][ T7619] futex_wake_op: syz.3.798 tries to shift op by 144; fix this program [ 153.450438][ T5722] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 153.453928][ T5697] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 153.598604][ T5697] usb 3-1: device descriptor read/64, error -71 [ 153.600228][ T5722] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 153.600266][ T5722] usb 4-1: config 1 interface 0 has no altsetting 0 [ 153.603223][ T5722] usb 4-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 153.603249][ T5722] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.603268][ T5722] usb 4-1: Product: syz [ 153.603283][ T5722] usb 4-1: Manufacturer: syz [ 153.603296][ T5722] usb 4-1: SerialNumber: syz [ 153.661026][ T5619] Bluetooth: min 6 > max 0 [ 153.724527][ T7634] netlink: 72 bytes leftover after parsing attributes in process `syz.1.802'. [ 153.733649][ T5697] usb usb3-port1: attempt power cycle [ 154.118222][ T5697] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 154.146924][ T5697] usb 3-1: device descriptor read/8, error -71 [ 154.377889][ T5722] usb 4-1: USB disconnect, device number 3 [ 154.408314][ T5697] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 154.431553][ T5697] usb 3-1: device descriptor read/8, error -71 [ 154.498342][ T5619] Bluetooth: hci3: command 0x0406 tx timeout [ 154.554969][ T5697] usb usb3-port1: unable to enumerate USB device [ 154.580313][ T5619] Bluetooth: hci2: command 0x0406 tx timeout [ 154.703576][ T5619] Bluetooth: min 6 > max 0 [ 155.407973][ T5782] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 155.557978][ T5782] usb 4-1: Using ep0 maxpacket: 16 [ 155.560783][ T5782] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 155.560809][ T5782] usb 4-1: config 0 has no interface number 0 [ 155.560850][ T5782] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 155.560864][ T5782] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 155.562989][ T5782] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 155.563016][ T5782] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.563035][ T5782] usb 4-1: Product: syz [ 155.563056][ T5782] usb 4-1: Manufacturer: syz [ 155.563063][ T5782] usb 4-1: SerialNumber: syz [ 155.568026][ T5782] usb 4-1: config 0 descriptor?? [ 155.583111][ T7666] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 155.583229][ T7666] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 155.699205][ T5619] Bluetooth: hci1: command 0x0406 tx timeout [ 155.801684][ T7666] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 155.801798][ T7666] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 156.002632][ T5782] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 156.084186][ T5619] Bluetooth: min 6 > max 0 [ 156.758885][ T5619] Bluetooth: hci3: command 0x0406 tx timeout [ 157.369603][ T7699] can: request_module (can-proto-0) failed. [ 157.383248][ T5697] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 157.421248][ T5619] Bluetooth: min 6 > max 0 [ 157.553416][ T5697] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 157.553446][ T5697] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.553465][ T5697] usb 3-1: Product: syz [ 157.553478][ T5697] usb 3-1: Manufacturer: syz [ 157.553492][ T5697] usb 3-1: SerialNumber: syz [ 157.601505][ T5697] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 157.701691][ T5717] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 158.179960][ T5619] Bluetooth: hci0: command 0x0406 tx timeout [ 158.487960][ T5697] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 158.669337][ T5697] usb 2-1: Using ep0 maxpacket: 8 [ 158.685783][ T5697] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 158.685889][ T5697] usb 2-1: can't read configurations, error -61 [ 158.751355][ T7714] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.835'. [ 158.980759][ T5717] usb 3-1: Service connection timeout for: 256 [ 158.980804][ T5717] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services [ 159.039734][ T5697] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 159.210171][ T32] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 159.252148][ T5717] ath9k_htc: Failed to initialize the device [ 159.294787][ T5697] usb 2-1: Using ep0 maxpacket: 8 [ 159.305353][ T5697] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 159.305389][ T5697] usb 2-1: can't read configurations, error -61 [ 159.355954][ T32] usb 1-1: device descriptor read/64, error -71 [ 159.357211][ T5782] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 159.357475][ T5782] asix 4-1:0.34: probe with driver asix failed with error -71 [ 159.360119][ T5697] usb usb2-port1: attempt power cycle [ 159.416507][ T5717] usb 3-1: ath9k_htc: USB layer deinitialized [ 159.455700][ T5782] usb 4-1: USB disconnect, device number 4 [ 159.472475][ T5619] Bluetooth: hci1: command 0x0406 tx timeout [ 159.610776][ T32] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 159.677551][ T38] usb 3-1: USB disconnect, device number 6 [ 159.708830][ T5697] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 159.729977][ T5697] usb 2-1: Using ep0 maxpacket: 8 [ 159.732176][ T5697] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 159.732209][ T5697] usb 2-1: can't read configurations, error -61 [ 159.767896][ T32] usb 1-1: device descriptor read/64, error -71 [ 159.901637][ T32] usb usb1-port1: attempt power cycle [ 159.908292][ T5697] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 159.934349][ T5697] usb 2-1: Using ep0 maxpacket: 8 [ 159.943188][ T5697] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 159.943222][ T5697] usb 2-1: can't read configurations, error -61 [ 159.943615][ T5697] usb usb2-port1: unable to enumerate USB device [ 160.267965][ T32] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 160.288486][ T32] usb 1-1: device descriptor read/8, error -71 [ 160.527936][ T32] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 160.548838][ T32] usb 1-1: device descriptor read/8, error -71 [ 160.660279][ T32] usb usb1-port1: unable to enumerate USB device [ 161.113655][ T7766] netdevsim netdevsim2: Direct firmware load for  failed with error -2 [ 161.113673][ T7766] netdevsim netdevsim2: Falling back to sysfs fallback for:  [ 162.371055][ T7792] cgroup: Name too long [ 165.767939][ T5697] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 165.918087][ T5697] usb 1-1: Using ep0 maxpacket: 8 [ 165.918498][ T7871] ALSA: mixer_oss: invalid OSS volume '' [ 165.934716][ T5697] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 165.934752][ T5697] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 165.934777][ T5697] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 165.934798][ T5697] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 165.934821][ T5697] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 165.934861][ T5697] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 165.934883][ T5697] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.030590][ T5697] usbtmc 1-1:16.0: probe with driver usbtmc failed with error -22 [ 166.262507][ T5697] usb 1-1: USB disconnect, device number 7 [ 166.512555][ T7911] FAULT_INJECTION: forcing a failure. [ 166.512555][ T7911] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 166.512605][ T7911] CPU: 1 UID: 0 PID: 7911 Comm: syz.1.890 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 166.512631][ T7911] Tainted: [L]=SOFTLOCKUP [ 166.512638][ T7911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 166.512655][ T7911] Call Trace: [ 166.512666][ T7911] [ 166.512675][ T7911] dump_stack_lvl+0xe8/0x150 [ 166.512705][ T7911] should_fail_ex+0x46b/0x600 [ 166.512737][ T7911] prepare_alloc_pages+0x22a/0x6b0 [ 166.512766][ T7911] __alloc_frozen_pages_noprof+0x12f/0x380 [ 166.512792][ T7911] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 166.512811][ T7911] ? __alloc_frozen_pages_noprof+0x1de/0x380 [ 166.512834][ T7911] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 166.512867][ T7911] ? __pfx_policy_nodemask+0x10/0x10 [ 166.512893][ T7911] __alloc_pages_noprof+0x10/0x100 [ 166.512916][ T7911] alloc_pages_bulk_noprof+0x67e/0x890 [ 166.512938][ T7911] ? alloc_pages_mpol+0x2ae/0x380 [ 166.512963][ T7911] ? alloc_pages_noprof+0x161/0x2f0 [ 166.512991][ T7911] __kasan_populate_vmalloc+0xc1/0x1d0 [ 166.513020][ T7911] ? rt_spin_unlock+0x160/0x200 [ 166.513042][ T7911] alloc_vmap_area+0xd47/0x1480 [ 166.513085][ T7911] ? __pfx_alloc_vmap_area+0x10/0x10 [ 166.513112][ T7911] ? __kmalloc_cache_node_noprof+0x2b3/0x710 [ 166.513133][ T7911] ? __get_vm_area_node+0x13f/0x300 [ 166.513159][ T7911] ? __get_vm_area_node+0x13f/0x300 [ 166.513188][ T7911] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 166.513214][ T7911] __get_vm_area_node+0x1f8/0x300 [ 166.513249][ T7911] __vmalloc_node_range_noprof+0x36a/0x1750 [ 166.513279][ T7911] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 166.513304][ T7911] ? lockdep_unlock+0x5d/0xd0 [ 166.513341][ T7911] ? do_raw_spin_lock+0x12b/0x2f0 [ 166.513369][ T7911] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 166.513399][ T7911] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 166.513422][ T7911] ? lockdep_hardirqs_on+0x7a/0x110 [ 166.513447][ T7911] ? rt_mutex_slowunlock+0x1cb/0x300 [ 166.513466][ T7911] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 166.513490][ T7911] vmalloc_noprof+0xb2/0xe0 [ 166.513508][ T7911] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 166.513533][ T7911] snd_dma_alloc_dir_pages+0x120/0x220 [ 166.513559][ T7911] do_alloc_pages+0x11a/0x260 [ 166.513588][ T7911] snd_pcm_lib_malloc_pages+0x33a/0x790 [ 166.513619][ T7911] snd_pcm_hw_params+0x8b4/0x1930 [ 166.513644][ T7911] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 166.513676][ T7911] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 166.513699][ T7911] ? __pfx_snd_pcm_hw_params+0x10/0x10 [ 166.513727][ T7911] ? rt_spin_unlock+0x160/0x200 [ 166.513750][ T7911] ? snd_pcm_drop+0xa5/0x5e0 [ 166.513772][ T7911] ? snd_pcm_kernel_ioctl+0x1e4/0xab0 [ 166.513801][ T7911] snd_pcm_oss_change_params_locked+0x201f/0x3e00 [ 166.513865][ T7911] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 166.513906][ T7911] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 166.513929][ T7911] ? lockdep_hardirqs_on+0x7a/0x110 [ 166.513951][ T7911] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 166.513974][ T7911] ? mutex_lock_interruptible_nested+0x152/0x1d0 [ 166.514003][ T7911] ? snd_pcm_oss_read+0x204/0x8e0 [ 166.514034][ T7911] snd_pcm_oss_read+0x276/0x8e0 [ 166.514073][ T7911] ? __pfx_snd_pcm_oss_read+0x10/0x10 [ 166.514103][ T7911] vfs_read+0x212/0xa80 [ 166.514134][ T7911] ? __pfx_vfs_read+0x10/0x10 [ 166.514158][ T7911] ? __fget_files+0x2a/0x420 [ 166.514180][ T7911] ? __fget_files+0x2a/0x420 [ 166.514198][ T7911] ? __fget_files+0x3a6/0x420 [ 166.514215][ T7911] ? __fget_files+0x2a/0x420 [ 166.514243][ T7911] ksys_read+0x156/0x270 [ 166.514267][ T7911] ? __pfx_ksys_read+0x10/0x10 [ 166.514298][ T7911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.514318][ T7911] do_syscall_64+0x174/0x580 [ 166.514339][ T7911] ? trace_irq_disable+0x3b/0x140 [ 166.514360][ T7911] ? clear_bhb_loop+0x40/0x90 [ 166.514382][ T7911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.514400][ T7911] RIP: 0033:0x7fc0a57cce59 [ 166.514424][ T7911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 166.514439][ T7911] RSP: 002b:00007fc0a3a26028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 166.514464][ T7911] RAX: ffffffffffffffda RBX: 00007fc0a5a45fa0 RCX: 00007fc0a57cce59 [ 166.514477][ T7911] RDX: 0000000000002020 RSI: 0000200000000200 RDI: 0000000000000003 [ 166.514488][ T7911] RBP: 00007fc0a3a26090 R08: 0000000000000000 R09: 0000000000000000 [ 166.514499][ T7911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 166.514510][ T7911] R13: 00007fc0a5a46038 R14: 00007fc0a5a45fa0 R15: 00007ffc69668968 [ 166.514537][ T7911] [ 166.514745][ T7911] syz.1.890: vmalloc error: size 2097152, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 166.515010][ T7911] CPU: 1 UID: 0 PID: 7911 Comm: syz.1.890 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 166.515035][ T7911] Tainted: [L]=SOFTLOCKUP [ 166.515041][ T7911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 166.515051][ T7911] Call Trace: [ 166.515058][ T7911] [ 166.515066][ T7911] dump_stack_lvl+0xe8/0x150 [ 166.515090][ T7911] warn_alloc+0x24c/0x270 [ 166.515108][ T7911] ? kasan_quarantine_put+0xbb/0x1f0 [ 166.515138][ T7911] ? __pfx_warn_alloc+0x10/0x10 [ 166.515156][ T7911] ? __get_vm_area_node+0x211/0x300 [ 166.515187][ T7911] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 166.515211][ T7911] ? __get_vm_area_node+0x211/0x300 [ 166.515244][ T7911] __vmalloc_node_range_noprof+0x38f/0x1750 [ 166.515274][ T7911] ? lockdep_unlock+0x5d/0xd0 [ 166.515308][ T7911] ? do_raw_spin_lock+0x12b/0x2f0 [ 166.515337][ T7911] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 166.515364][ T7911] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 166.515389][ T7911] ? lockdep_hardirqs_on+0x7a/0x110 [ 166.515414][ T7911] ? rt_mutex_slowunlock+0x1cb/0x300 [ 166.515433][ T7911] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 166.515455][ T7911] vmalloc_noprof+0xb2/0xe0 [ 166.515472][ T7911] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 166.515495][ T7911] snd_dma_alloc_dir_pages+0x120/0x220 [ 166.515520][ T7911] do_alloc_pages+0x11a/0x260 [ 166.515546][ T7911] snd_pcm_lib_malloc_pages+0x33a/0x790 [ 166.515573][ T7911] snd_pcm_hw_params+0x8b4/0x1930 [ 166.515596][ T7911] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 166.515626][ T7911] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 166.515648][ T7911] ? __pfx_snd_pcm_hw_params+0x10/0x10 [ 166.515676][ T7911] ? rt_spin_unlock+0x160/0x200 [ 166.515698][ T7911] ? snd_pcm_drop+0xa5/0x5e0 [ 166.515720][ T7911] ? snd_pcm_kernel_ioctl+0x1e4/0xab0 [ 166.515748][ T7911] snd_pcm_oss_change_params_locked+0x201f/0x3e00 [ 166.515805][ T7911] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 166.515845][ T7911] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 166.515874][ T7911] ? lockdep_hardirqs_on+0x7a/0x110 [ 166.515896][ T7911] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 166.515919][ T7911] ? mutex_lock_interruptible_nested+0x152/0x1d0 [ 166.515947][ T7911] ? snd_pcm_oss_read+0x204/0x8e0 [ 166.515977][ T7911] snd_pcm_oss_read+0x276/0x8e0 [ 166.516015][ T7911] ? __pfx_snd_pcm_oss_read+0x10/0x10 [ 166.516045][ T7911] vfs_read+0x212/0xa80 [ 166.516076][ T7911] ? __pfx_vfs_read+0x10/0x10 [ 166.516100][ T7911] ? __fget_files+0x2a/0x420 [ 166.516122][ T7911] ? __fget_files+0x2a/0x420 [ 166.516138][ T7911] ? __fget_files+0x3a6/0x420 [ 166.516156][ T7911] ? __fget_files+0x2a/0x420 [ 166.516182][ T7911] ksys_read+0x156/0x270 [ 166.516207][ T7911] ? __pfx_ksys_read+0x10/0x10 [ 166.516238][ T7911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.516259][ T7911] do_syscall_64+0x174/0x580 [ 166.516282][ T7911] ? trace_irq_disable+0x3b/0x140 [ 166.516305][ T7911] ? clear_bhb_loop+0x40/0x90 [ 166.516328][ T7911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.516347][ T7911] RIP: 0033:0x7fc0a57cce59 [ 166.516364][ T7911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 166.516379][ T7911] RSP: 002b:00007fc0a3a26028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 166.516397][ T7911] RAX: ffffffffffffffda RBX: 00007fc0a5a45fa0 RCX: 00007fc0a57cce59 [ 166.516410][ T7911] RDX: 0000000000002020 RSI: 0000200000000200 RDI: 0000000000000003 [ 166.516422][ T7911] RBP: 00007fc0a3a26090 R08: 0000000000000000 R09: 0000000000000000 [ 166.516433][ T7911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 166.516444][ T7911] R13: 00007fc0a5a46038 R14: 00007fc0a5a45fa0 R15: 00007ffc69668968 [ 166.516475][ T7911] [ 166.517349][ T7911] Mem-Info: [ 166.517363][ T7911] active_anon:7023 inactive_anon:0 isolated_anon:0 [ 166.517363][ T7911] active_file:0 inactive_file:42065 isolated_file:0 [ 166.517363][ T7911] unevictable:768 dirty:48 writeback:0 [ 166.517363][ T7911] slab_reclaimable:11228 slab_unreclaimable:95811 [ 166.517363][ T7911] mapped:24628 shmem:1308 pagetables:1764 [ 166.517363][ T7911] sec_pagetables:0 bounce:0 [ 166.517363][ T7911] kernel_misc_reclaimable:0 [ 166.517363][ T7911] free:1342417 free_pcp:5810 free_cma:0 [ 166.517414][ T7911] Node 0 active_anon:28092kB inactive_anon:0kB active_file:0kB inactive_file:168060kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:98512kB dirty:192kB writeback:0kB shmem:3696kB kernel_stack:13636kB pagetables:6916kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 166.517462][ T7911] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:64kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 166.517507][ T7911] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 166.517566][ T7911] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 166.517600][ T7911] Node 0 DMA32 free:1413276kB boost:0kB min:3908kB low:6428kB high:8948kB reserved_highatomic:0KB free_highatomic:0KB active_anon:28092kB inactive_anon:0kB active_file:0kB inactive_file:168060kB unevictable:1536kB writepending:192kB zspages:0kB present:3129332kB managed:2551612kB mlocked:0kB bounce:0kB free_pcp:23240kB local_pcp:4732kB free_cma:0kB [ 166.517657][ T7911] lowmem_reserve[]: 0 0 0 0 0 [ 166.517688][ T7911] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:596kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 166.567658][ T7911] lowmem_reserve[]: 0 0 0 0 0 [ 166.567698][ T7911] Node 1 Normal free:3941032kB boost:0kB min:6372kB low:10480kB high:14588kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111096kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 166.570015][ T7911] lowmem_reserve[]: 0 0 0 0 0 [ 166.570055][ T7911] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 166.570341][ T7911] Node 0 DMA32: 166*4kB (UME) 41*8kB (UME) 504*16kB (UME) 290*32kB (UM) 54*64kB (UE) 13*128kB (UE) 21*256kB (UME) 8*512kB (UME) 4*1024kB (ME) 4*2048kB (ME) 334*4096kB (UM) = 1413280kB [ 166.575459][ T7911] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 166.575550][ T7911] Node 1 Normal: 4*4kB (UM) 7*8kB (UM) 6*16kB (UM) 4*32kB (UM) 6*64kB (UM) 6*128kB (UM) 3*256kB (UM) 5*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 960*4096kB (M) = 3941032kB [ 166.575709][ T7911] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 166.575725][ T7911] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 166.575739][ T7911] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 166.575754][ T7911] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 166.575768][ T7911] 43369 total pagecache pages [ 166.575780][ T7911] 0 pages in swap cache [ 166.575786][ T7911] Free swap = 124996kB [ 166.575792][ T7911] Total swap = 124996kB [ 166.575799][ T7911] 2097051 pages RAM [ 166.575806][ T7911] 0 pages HighMem/MovableOnly [ 166.575812][ T7911] 427385 pages reserved [ 166.575818][ T7911] 0 pages cma reserved [ 168.267624][ T7950] FAULT_INJECTION: forcing a failure. [ 168.267624][ T7950] name failslab, interval 1, probability 0, space 0, times 1 [ 168.267659][ T7950] CPU: 1 UID: 0 PID: 7950 Comm: syz.1.904 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 168.267684][ T7950] Tainted: [L]=SOFTLOCKUP [ 168.267690][ T7950] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 168.267700][ T7950] Call Trace: [ 168.267707][ T7950] [ 168.267714][ T7950] dump_stack_lvl+0xe8/0x150 [ 168.267745][ T7950] should_fail_ex+0x46b/0x600 [ 168.267774][ T7950] should_failslab+0xa8/0x100 [ 168.267798][ T7950] __kvmalloc_node_noprof+0x181/0x910 [ 168.267822][ T7950] ? traverse+0xde/0x580 [ 168.267846][ T7950] ? traverse+0xde/0x580 [ 168.267874][ T7950] traverse+0xde/0x580 [ 168.267896][ T7950] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 168.267921][ T7950] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 168.267944][ T7950] ? seq_read_iter+0xb8/0xe20 [ 168.267970][ T7950] seq_read_iter+0xd09/0xe20 [ 168.267995][ T7950] ? alloc_pages_bulk_noprof+0x67e/0x890 [ 168.268022][ T7950] ? __asan_memset+0x22/0x50 [ 168.268053][ T7950] copy_splice_read+0x605/0xab0 [ 168.268081][ T7950] ? rcu_is_watching+0x15/0xb0 [ 168.268105][ T7950] ? __pfx_copy_splice_read+0x10/0x10 [ 168.268122][ T7950] ? trace_kmalloc+0x2a/0xf0 [ 168.268141][ T7950] ? look_up_lock_class+0x57/0x110 [ 168.268165][ T7950] ? register_lock_class+0x31/0x2e0 [ 168.268194][ T7950] ? alloc_pipe_info+0x373/0x4d0 [ 168.268218][ T7950] ? __pfx_copy_splice_read+0x10/0x10 [ 168.268237][ T7950] splice_direct_to_actor+0x483/0xc80 [ 168.268268][ T7950] ? __pfx_direct_splice_actor+0x10/0x10 [ 168.268294][ T7950] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 168.268333][ T7950] do_splice_direct+0x19b/0x2a0 [ 168.268356][ T7950] ? __pfx_do_splice_direct+0x10/0x10 [ 168.268376][ T7950] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 168.268403][ T7950] ? rw_verify_area+0x25b/0x4e0 [ 168.268426][ T7950] do_sendfile+0x547/0x7e0 [ 168.268459][ T7950] ? __pfx_do_sendfile+0x10/0x10 [ 168.268493][ T7950] __se_sys_sendfile64+0xdf/0x1a0 [ 168.268520][ T7950] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 168.268551][ T7950] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.268571][ T7950] do_syscall_64+0x174/0x580 [ 168.268590][ T7950] ? trace_irq_disable+0x3b/0x140 [ 168.268611][ T7950] ? clear_bhb_loop+0x40/0x90 [ 168.268633][ T7950] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.268652][ T7950] RIP: 0033:0x7fc0a57cce59 [ 168.268669][ T7950] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 168.268684][ T7950] RSP: 002b:00007fc0a3a05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 168.268704][ T7950] RAX: ffffffffffffffda RBX: 00007fc0a5a46090 RCX: 00007fc0a57cce59 [ 168.268717][ T7950] RDX: 0000200000000000 RSI: 0000000000000003 RDI: 0000000000000003 [ 168.268729][ T7950] RBP: 00007fc0a3a05090 R08: 0000000000000000 R09: 0000000000000000 [ 168.268740][ T7950] R10: 00000002000007ff R11: 0000000000000246 R12: 0000000000000001 [ 168.268752][ T7950] R13: 00007fc0a5a46128 R14: 00007fc0a5a46090 R15: 00007ffc69668968 [ 168.268780][ T7950] [ 168.765962][ T7960] FAULT_INJECTION: forcing a failure. [ 168.765962][ T7960] name failslab, interval 1, probability 0, space 0, times 0 [ 168.766122][ T7960] CPU: 1 UID: 0 PID: 7960 Comm: syz.3.908 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 168.766149][ T7960] Tainted: [L]=SOFTLOCKUP [ 168.766156][ T7960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 168.766166][ T7960] Call Trace: [ 168.766174][ T7960] [ 168.766181][ T7960] dump_stack_lvl+0xe8/0x150 [ 168.766208][ T7960] should_fail_ex+0x46b/0x600 [ 168.766240][ T7960] should_failslab+0xa8/0x100 [ 168.766271][ T7960] kmem_cache_alloc_noprof+0xa4/0x6c0 [ 168.766299][ T7960] ? _sctp_make_chunk+0x59/0x290 [ 168.766319][ T7960] ? sctp_chunkify+0x5a/0x260 [ 168.766338][ T7960] ? sctp_chunkify+0x5a/0x260 [ 168.766364][ T7960] sctp_chunkify+0x5a/0x260 [ 168.766387][ T7960] _sctp_make_chunk+0x122/0x290 [ 168.766411][ T7960] sctp_make_datafrag_empty+0x12a/0x240 [ 168.766434][ T7960] ? __pfx_sctp_make_datafrag_empty+0x10/0x10 [ 168.766457][ T7960] ? sctp_user_addto_chunk+0xa8/0x240 [ 168.766482][ T7960] sctp_datamsg_from_user+0x729/0xef0 [ 168.766515][ T7960] sctp_sendmsg_to_asoc+0x1416/0x1900 [ 168.766547][ T7960] ? sctp_assoc_add_peer+0xce1/0x13b0 [ 168.766580][ T7960] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 168.766604][ T7960] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 168.766629][ T7960] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 168.766652][ T7960] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 168.766672][ T7960] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 168.766696][ T7960] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 168.766717][ T7960] ? security_sctp_bind_connect+0x7e/0x2c0 [ 168.766745][ T7960] sctp_sendmsg+0x173c/0x29b0 [ 168.766779][ T7960] ? __pfx_sctp_sendmsg+0x10/0x10 [ 168.766812][ T7960] ? aa_sk_perm+0x703/0x950 [ 168.766849][ T7960] ? __pfx_aa_sk_perm+0x10/0x10 [ 168.766872][ T7960] ? sock_rps_record_flow+0x19/0x350 [ 168.766892][ T7960] ? inet_sendmsg+0x2f4/0x370 [ 168.766908][ T7960] ? aa_sock_msg_perm+0x122/0x200 [ 168.766928][ T7960] ? __pfx_inet_sendmsg+0x10/0x10 [ 168.766945][ T7960] sock_sendmsg_nosec+0x10e/0x180 [ 168.766976][ T7960] __sys_sendto+0x41a/0x5a0 [ 168.767000][ T7960] ? __pfx___sys_sendto+0x10/0x10 [ 168.767047][ T7960] ? __pfx_ksys_write+0x10/0x10 [ 168.767076][ T7960] __x64_sys_sendto+0xde/0x100 [ 168.767098][ T7960] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.767119][ T7960] do_syscall_64+0x174/0x580 [ 168.767142][ T7960] ? trace_irq_disable+0x3b/0x140 [ 168.767165][ T7960] ? clear_bhb_loop+0x40/0x90 [ 168.767188][ T7960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.767207][ T7960] RIP: 0033:0x7f7a7cafce59 [ 168.767224][ T7960] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 168.767240][ T7960] RSP: 002b:00007f7a7ad4e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 168.767267][ T7960] RAX: ffffffffffffffda RBX: 00007f7a7cd75fa0 RCX: 00007f7a7cafce59 [ 168.767281][ T7960] RDX: 0000000000034000 RSI: 0000200000847fff RDI: 0000000000000004 [ 168.767293][ T7960] RBP: 00007f7a7ad4e090 R08: 000020000005ffe4 R09: 000000000000001c [ 168.767305][ T7960] R10: 00000000000000e0 R11: 0000000000000246 R12: 0000000000000002 [ 168.767316][ T7960] R13: 00007f7a7cd76038 R14: 00007f7a7cd75fa0 R15: 00007fffbfd2cbe8 [ 168.767347][ T7960] [ 169.287938][ T5618] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 169.447884][ T5618] usb 4-1: Using ep0 maxpacket: 16 [ 169.452727][ T5618] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 169.452774][ T5618] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1c0c, bcdDevice= 0.00 [ 169.452796][ T5618] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.541523][ T5618] usb 4-1: config 0 descriptor?? [ 169.886415][ T7967] netlink: 'syz.3.913': attribute type 1 has an invalid length. [ 170.156693][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unknown main item tag 0x0 [ 170.156735][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unknown main item tag 0x0 [ 170.156761][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unknown main item tag 0x0 [ 170.156785][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unknown main item tag 0x0 [ 170.156810][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unknown main item tag 0x0 [ 170.156835][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unknown main item tag 0x0 [ 170.156859][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unknown main item tag 0x0 [ 170.156883][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unknown main item tag 0x0 [ 170.156909][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unknown main item tag 0x0 [ 170.156933][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unknown main item tag 0x0 [ 170.243273][ T5618] corsair-psu 0003:1B1C:1C0C.0001: hidraw0: USB HID v0.09 Device [HID 1b1c:1c0c] on usb-dummy_hcd.3-1/input0 [ 170.346082][ T5618] corsair-psu 0003:1B1C:1C0C.0001: unable to initialize device (-38) [ 170.384038][ T5618] corsair-psu 0003:1B1C:1C0C.0001: probe with driver corsair-psu failed with error -38 [ 170.417461][ T5618] usb 4-1: USB disconnect, device number 5 [ 170.532372][ T8003] comedi comedi0: 8255: I/O base address not correctly aligned [ 171.117955][ T5618] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 171.281788][ T5618] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 171.281818][ T5618] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 171.281837][ T5618] usb 2-1: Product: syz [ 171.281851][ T5618] usb 2-1: SerialNumber: syz [ 171.289187][ T5618] usb 2-1: config 0 descriptor?? [ 171.358106][ T8027] netlink: 4 bytes leftover after parsing attributes in process `syz.3.934'. [ 171.488616][ T5782] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 171.652011][ T5618] hso 2-1:0.0: Failed to find BULK eps [ 171.660936][ T5782] usb 4-1: Using ep0 maxpacket: 8 [ 171.664989][ T5782] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 171.665011][ T5782] usb 4-1: config 0 has no interfaces? [ 171.674698][ T5782] usb 4-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 171.674725][ T5782] usb 4-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 171.674743][ T5782] usb 4-1: Product: syz [ 171.674756][ T5782] usb 4-1: Manufacturer: syz [ 171.674769][ T5782] usb 4-1: SerialNumber: syz [ 171.706113][ T5782] usb 4-1: config 0 descriptor?? [ 171.756271][ T5618] usb 2-1: USB disconnect, device number 8 [ 171.861877][ T5697] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 171.916078][ T5619] Bluetooth: hci2: hcon ffff888044ba4000 sent 7 < count 9 [ 171.916254][ T5619] Bluetooth: hci2: hcon ffff888044ba4000 sent 0 < count 4 [ 171.916284][ T5619] Bluetooth: hci2: hcon ffff888044ba4000 sent 0 < count 63507 [ 171.979795][ T8027] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 171.984498][ T8027] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 172.074584][ T5618] usb 4-1: USB disconnect, device number 6 [ 172.115455][ T5619] Bluetooth: hci2: hcon ffff888044ba4000 sent 0 < count 1025 [ 172.208027][ T5697] usb 3-1: Using ep0 maxpacket: 32 [ 172.211103][ T5697] usb 3-1: config 1 interface 0 altsetting 3 bulk endpoint 0x82 has invalid maxpacket 1024 [ 172.211133][ T5697] usb 3-1: config 1 interface 0 altsetting 3 bulk endpoint 0x3 has invalid maxpacket 8 [ 172.211154][ T5697] usb 3-1: config 1 interface 0 has no altsetting 0 [ 172.213337][ T5697] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 172.213365][ T5697] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.213384][ T5697] usb 3-1: Product: ㊷ã«ã „牷쨊嚂祟紋潛垥웆舂葭鋀äŠë’巗⸻ì‚åˆä€»æ¨ªâ˜µá€ˆã»˜å†ºè¦¦è¤•ïµžì¸¾î²ãµºë–Žì–‰â­¾åªì™“뇶쵪ê²ã¤“ì閜傡ç¿âš¸æžšê¾Û‚㖕婆쟂㦞ç»èŠ¼ß¤é˜¸ã’°âŒì§Ù ä£ˆêŠ¿ïŠì©’ﳤí•â²³æ¥¯ã”©î¶°Ó·ç¾¨ížìŠ«é£™î‰ïš‡ìª¦ì§–ᢄㅜ쯊鎇螘柺à¡é¶…歚﵃ì•é‘±ê‹šì²€éŠ”䨩瀉驂뎄î¿ê¾’狶ⰱ熽ꩼꚕá‘┽ã—í—½ [ 172.213409][ T5697] usb 3-1: Manufacturer: 扭䭗䚅æ¶ã‘¶ã›®ç†ê»™Ï¶ï—°é•‹â“—觰ศ콩久㬫寓磦ì†â³®â„Žß›êª¥ê†­çŠ”嘫궫ᕀëˆæ««ç¾Ÿèª¸éŽ‡ê²½â·Œì­€å¹†è—¬æ‚‹ï»°é‹šà§ á²éŒ¬í€¡áœ¼ä¶ì­…⒉撜葛çƒïª…섦ဲ驩ꇜ쳔î»ê¥¨ã–´Äƒï¿°ã¹­ì™â›šíˆ—齶ู䬳싯㣄븩혚蔲탤ྶ廤◡汤᥼垰袞휙覶ê½ì¡”㓺逿ሺä…é·¤æ¯æ¹µ [ 172.213424][ T5697] usb 3-1: SerialNumber: ㉠[ 172.217351][ T8036] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 172.217462][ T8036] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 172.681870][ T8036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 172.683949][ T8036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 172.708070][ T8036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 172.708617][ T8036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 172.790439][ T8054] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 172.791087][ T8054] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 173.262092][ T5697] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 173.275271][ T5697] usb 3-1: USB disconnect, device number 7 [ 174.377447][ T8106] cgroup: none used incorrectly [ 174.909687][ T8132] netlink: 'syz.2.976': attribute type 45 has an invalid length. [ 175.062527][ T8138] FAULT_INJECTION: forcing a failure. [ 175.062527][ T8138] name failslab, interval 1, probability 0, space 0, times 0 [ 175.062561][ T8138] CPU: 1 UID: 0 PID: 8138 Comm: syz.0.978 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 175.062587][ T8138] Tainted: [L]=SOFTLOCKUP [ 175.062593][ T8138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 175.062604][ T8138] Call Trace: [ 175.062611][ T8138] [ 175.062618][ T8138] dump_stack_lvl+0xe8/0x150 [ 175.062643][ T8138] should_fail_ex+0x46b/0x600 [ 175.062674][ T8138] should_failslab+0xa8/0x100 [ 175.062696][ T8138] kmem_cache_alloc_noprof+0xa4/0x6c0 [ 175.062725][ T8138] ? skb_clone+0x212/0x3a0 [ 175.062747][ T8138] ? skb_clone+0x212/0x3a0 [ 175.062773][ T8138] skb_clone+0x212/0x3a0 [ 175.062798][ T8138] __netlink_deliver_tap+0x424/0x8b0 [ 175.062831][ T8138] ? netlink_deliver_tap+0x2e/0x1b0 [ 175.062855][ T8138] netlink_deliver_tap+0x19c/0x1b0 [ 175.062880][ T8138] netlink_unicast+0x754/0x920 [ 175.062911][ T8138] netlink_sendmsg+0x813/0xb40 [ 175.062944][ T8138] ? __pfx_netlink_sendmsg+0x10/0x10 [ 175.062970][ T8138] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 175.062997][ T8138] ? get_pid_task+0x20/0x1f0 [ 175.063016][ T8138] ? aa_sock_msg_perm+0x122/0x200 [ 175.063037][ T8138] ? __pfx_netlink_sendmsg+0x10/0x10 [ 175.063060][ T8138] sock_sendmsg_nosec+0x13a/0x180 [ 175.063090][ T8138] sock_write_iter+0x2e4/0x3f0 [ 175.063119][ T8138] ? __pfx_sock_write_iter+0x10/0x10 [ 175.063172][ T8138] vfs_write+0x629/0xba0 [ 175.063204][ T8138] ? __pfx_vfs_write+0x10/0x10 [ 175.063237][ T8138] ? __fget_files+0x2a/0x420 [ 175.063268][ T8138] ksys_write+0x156/0x270 [ 175.063293][ T8138] ? __pfx_ksys_write+0x10/0x10 [ 175.063324][ T8138] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.063344][ T8138] do_syscall_64+0x174/0x580 [ 175.063368][ T8138] ? trace_irq_disable+0x3b/0x140 [ 175.063391][ T8138] ? clear_bhb_loop+0x40/0x90 [ 175.063414][ T8138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.063433][ T8138] RIP: 0033:0x7fac61e4ce59 [ 175.063450][ T8138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 175.063465][ T8138] RSP: 002b:00007fac6009e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 175.063484][ T8138] RAX: ffffffffffffffda RBX: 00007fac620c5fa0 RCX: 00007fac61e4ce59 [ 175.063498][ T8138] RDX: 0000000000000024 RSI: 0000200000000040 RDI: 0000000000000003 [ 175.063510][ T8138] RBP: 00007fac6009e090 R08: 0000000000000000 R09: 0000000000000000 [ 175.063522][ T8138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 175.063533][ T8138] R13: 00007fac620c6038 R14: 00007fac620c5fa0 R15: 00007ffdf6210168 [ 175.063563][ T8138] [ 175.441274][ T8144] netlink: 64 bytes leftover after parsing attributes in process `syz.1.981'. [ 175.725049][ T8155] Invalid logical block size (301989888) [ 175.730064][ T8157] netlink: 44 bytes leftover after parsing attributes in process `syz.3.986'. [ 175.881246][ T5717] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 176.029050][ T5717] usb 1-1: too many configurations: 70, using maximum allowed: 8 [ 176.030980][ T5717] usb 1-1: config index 0 descriptor too short (expected 65505, got 72) [ 176.041574][ T5717] usb 1-1: config index 1 descriptor too short (expected 65505, got 72) [ 176.042975][ T5717] usb 1-1: config index 2 descriptor too short (expected 65505, got 72) [ 176.046963][ T5717] usb 1-1: config index 3 descriptor too short (expected 65505, got 72) [ 176.050250][ T5717] usb 1-1: config index 4 descriptor too short (expected 65505, got 72) [ 176.051790][ T5717] usb 1-1: config index 5 descriptor too short (expected 65505, got 72) [ 176.053280][ T5717] usb 1-1: config index 6 descriptor too short (expected 65505, got 72) [ 176.066473][ T5717] usb 1-1: config index 7 descriptor too short (expected 65505, got 72) [ 176.073098][ T5717] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 176.073127][ T5717] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.073145][ T5717] usb 1-1: Product: syz [ 176.073159][ T5717] usb 1-1: Manufacturer: syz [ 176.073172][ T5717] usb 1-1: SerialNumber: syz [ 176.119503][ T5717] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 176.247609][ T38] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 176.745516][ T5618] usb 1-1: USB disconnect, device number 8 [ 176.989066][ T8177] warning: `syz.3.993' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 177.228134][ T8185] trusted_key: syz.2.995 sent an empty control message without MSG_MORE. [ 177.420538][ T5619] Bluetooth: min 6 > max 0 [ 177.430433][ T8189] netlink: 16 bytes leftover after parsing attributes in process `syz.0.998'. [ 177.460784][ T38] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 177.491728][ T8189] netlink: 'syz.0.998': attribute type 1 has an invalid length. [ 177.491750][ T8189] netlink: 16 bytes leftover after parsing attributes in process `syz.0.998'. [ 177.535115][ T38] ath9k_htc: Failed to initialize the device [ 177.536967][ T5618] usb 1-1: ath9k_htc: USB layer deinitialized [ 178.966463][ T5619] Bluetooth: min 6 > max 0 [ 179.315138][ T8246] netlink: 'syz.0.1016': attribute type 10 has an invalid length. [ 179.458287][ T5619] Bluetooth: hci2: command 0x0406 tx timeout [ 180.052571][ T5619] Bluetooth: min 6 > max 0 [ 180.127879][ T5618] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 180.281896][ T5618] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 180.281927][ T5618] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 180.281949][ T5618] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 180.281971][ T5618] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 180.284472][ T5618] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 180.284499][ T5618] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.284518][ T5618] usb 1-1: Product: syz [ 180.284532][ T5618] usb 1-1: Manufacturer: syz [ 180.284543][ T5618] usb 1-1: SerialNumber: syz [ 180.287656][ T5618] usb 1-1: config 0 descriptor?? [ 180.709036][ T5697] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 180.825458][ T8293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.828398][ T8293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.870651][ T5697] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 180.870679][ T5697] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 180.896112][ T5697] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 180.896141][ T5697] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 180.896160][ T5697] usb 4-1: Product: syz [ 180.896174][ T5697] usb 4-1: Manufacturer: syz [ 180.896187][ T5697] usb 4-1: SerialNumber: syz [ 180.979869][ T5619] Bluetooth: hci0: command 0x0406 tx timeout [ 180.984929][ T5618] adutux 1-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 181.199936][ T5619] Bluetooth: min 6 > max 0 [ 181.797882][ T5618] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 181.953940][ T5618] usb 2-1: Using ep0 maxpacket: 16 [ 181.969625][ T5618] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.969651][ T5618] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 181.984094][ T5618] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 181.984124][ T5618] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.984142][ T5618] usb 2-1: Product: syz [ 181.984156][ T5618] usb 2-1: Manufacturer: syz [ 181.984169][ T5618] usb 2-1: SerialNumber: syz [ 182.107909][ T5619] Bluetooth: hci2: command 0x0406 tx timeout [ 182.140543][ T5618] usb 2-1: 0:2 : does not exist [ 182.140655][ T5618] usb 2-1: unit 6 not found! [ 182.862848][ T5618] usb 2-1: USB disconnect, device number 9 [ 182.929986][ T5716] usb 1-1: USB disconnect, device number 9 [ 183.134649][ T5619] Bluetooth: min 6 > max 0 [ 183.219861][ T5619] Bluetooth: hci1: command 0x0406 tx timeout [ 183.506795][ T5618] usb 4-1: USB disconnect, device number 7 [ 183.517876][ T5716] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 183.670623][ T5716] usb 1-1: Using ep0 maxpacket: 32 [ 183.673002][ T5716] usb 1-1: unable to get BOS descriptor or descriptor too short [ 183.675326][ T5716] usb 1-1: config 7 has an invalid interface number: 187 but max is 0 [ 183.675349][ T5716] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 183.676363][ T5716] usb 1-1: config 7 has no interface number 0 [ 183.698856][ T5716] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 183.698884][ T5716] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.698902][ T5716] usb 1-1: Product: syz [ 183.698915][ T5716] usb 1-1: Manufacturer: syz [ 183.698927][ T5716] usb 1-1: SerialNumber: syz [ 183.992201][ T5716] usb 1-1: Not enough endpoints found in device, aborting! [ 184.124072][ T5619] Bluetooth: min 6 > max 0 [ 184.183883][ T38] usb 1-1: USB disconnect, device number 10 [ 184.651322][ T5619] Bluetooth: min 6 > max 0 [ 184.888026][ T38] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 185.038000][ T38] usb 4-1: Using ep0 maxpacket: 16 [ 185.039791][ T38] usb 4-1: config 0 has an invalid descriptor of length 55, skipping remainder of the config [ 185.039836][ T38] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 185.039851][ T38] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 185.039864][ T38] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 185.041996][ T38] usb 4-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 185.042023][ T38] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.042041][ T38] usb 4-1: Product: syz [ 185.042055][ T38] usb 4-1: Manufacturer: syz [ 185.042068][ T38] usb 4-1: SerialNumber: syz [ 185.045149][ T38] usb 4-1: config 0 descriptor?? [ 185.148085][ T5619] Bluetooth: hci3: command 0x0406 tx timeout [ 185.265835][ T38] appledisplay 4-1:0.0: Error while getting initial brightness: -71 [ 185.282521][ T38] appledisplay 4-1:0.0: probe with driver appledisplay failed with error -71 [ 185.311382][ T38] usb 4-1: USB disconnect, device number 8 [ 185.492063][ T5619] Bluetooth: min 6 > max 0 [ 185.759970][ T8404] FAULT_INJECTION: forcing a failure. [ 185.759970][ T8404] name failslab, interval 1, probability 0, space 0, times 0 [ 185.760005][ T8404] CPU: 0 UID: 0 PID: 8404 Comm: syz.0.1071 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 185.760021][ T8404] Tainted: [L]=SOFTLOCKUP [ 185.760024][ T8404] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 185.760030][ T8404] Call Trace: [ 185.760035][ T8404] [ 185.760040][ T8404] dump_stack_lvl+0xe8/0x150 [ 185.760056][ T8404] should_fail_ex+0x46b/0x600 [ 185.760074][ T8404] should_failslab+0xa8/0x100 [ 185.760087][ T8404] __kmalloc_noprof+0xfe/0x7e0 [ 185.760101][ T8404] ? nl80211_trigger_scan+0x50e/0x2030 [ 185.760113][ T8404] ? nl80211_trigger_scan+0x50e/0x2030 [ 185.760127][ T8404] nl80211_trigger_scan+0x50e/0x2030 [ 185.760145][ T8404] genl_family_rcv_msg_doit+0x22a/0x330 [ 185.760164][ T8404] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 185.760187][ T8404] ? bpf_lsm_capable+0x9/0x20 [ 185.760199][ T8404] ? security_capable+0x7e/0x2c0 [ 185.760219][ T8404] genl_rcv_msg+0x61c/0x7a0 [ 185.760238][ T8404] ? __pfx_genl_rcv_msg+0x10/0x10 [ 185.760252][ T8404] ? ref_tracker_free+0x673/0x820 [ 185.760266][ T8404] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 185.760280][ T8404] ? __pfx_nl80211_trigger_scan+0x10/0x10 [ 185.760290][ T8404] ? __pfx_nl80211_post_doit+0x10/0x10 [ 185.760305][ T8404] ? ____sys_sendmsg+0x55c/0x870 [ 185.760316][ T8404] ? ___sys_sendmsg+0x2a5/0x360 [ 185.760327][ T8404] ? __x64_sys_sendmsg+0x1b7/0x290 [ 185.760339][ T8404] ? do_syscall_64+0x174/0x580 [ 185.760351][ T8404] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.760365][ T8404] netlink_rcv_skb+0x232/0x4b0 [ 185.760378][ T8404] ? __pfx_genl_rcv_msg+0x10/0x10 [ 185.760394][ T8404] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 185.760413][ T8404] ? netlink_deliver_tap+0x2e/0x1b0 [ 185.760426][ T8404] ? netlink_deliver_tap+0x2e/0x1b0 [ 185.760440][ T8404] genl_rcv+0x28/0x40 [ 185.760454][ T8404] netlink_unicast+0x780/0x920 [ 185.760471][ T8404] netlink_sendmsg+0x813/0xb40 [ 185.760489][ T8404] ? __pfx_netlink_sendmsg+0x10/0x10 [ 185.760503][ T8404] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 185.760518][ T8404] ? aa_sock_msg_perm+0x122/0x200 [ 185.760530][ T8404] ? __pfx_netlink_sendmsg+0x10/0x10 [ 185.760542][ T8404] sock_sendmsg_nosec+0x13a/0x180 [ 185.760568][ T8404] ____sys_sendmsg+0x55c/0x870 [ 185.760602][ T8404] ? __pfx_____sys_sendmsg+0x10/0x10 [ 185.760633][ T8404] ? import_iovec+0x73/0xa0 [ 185.760655][ T8404] ___sys_sendmsg+0x2a5/0x360 [ 185.760668][ T8404] ? __lock_acquire+0x6b5/0x2d10 [ 185.760683][ T8404] ? __pfx____sys_sendmsg+0x10/0x10 [ 185.760713][ T8404] ? __fget_files+0x2a/0x420 [ 185.760723][ T8404] ? __fget_files+0x3a6/0x420 [ 185.760738][ T8404] __x64_sys_sendmsg+0x1b7/0x290 [ 185.760752][ T8404] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 185.760776][ T8404] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.760787][ T8404] do_syscall_64+0x174/0x580 [ 185.760799][ T8404] ? trace_irq_disable+0x3b/0x140 [ 185.760812][ T8404] ? clear_bhb_loop+0x40/0x90 [ 185.760825][ T8404] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.760835][ T8404] RIP: 0033:0x7fac61e4ce59 [ 185.760846][ T8404] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 185.760854][ T8404] RSP: 002b:00007fac6009e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 185.760867][ T8404] RAX: ffffffffffffffda RBX: 00007fac620c5fa0 RCX: 00007fac61e4ce59 [ 185.760874][ T8404] RDX: 0000000000028000 RSI: 0000200000006000 RDI: 0000000000000003 [ 185.760881][ T8404] RBP: 00007fac6009e090 R08: 0000000000000000 R09: 0000000000000000 [ 185.760887][ T8404] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 185.760893][ T8404] R13: 00007fac620c6038 R14: 00007fac620c5fa0 R15: 00007ffdf6210168 [ 185.760909][ T8404] [ 186.075971][ T8408] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1073'. [ 186.181922][ T5619] Bluetooth: hci0: command 0x0406 tx timeout [ 186.408001][ T10] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 186.571781][ T10] usb 2-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 186.571816][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 186.571835][ T10] usb 2-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 186.571850][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.602890][ T10] usb 2-1: config 0 descriptor?? [ 186.948783][ T5782] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 186.976836][ T8432] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 187.075895][ T8412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 187.090085][ T8412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.098182][ T5782] usb 1-1: Using ep0 maxpacket: 16 [ 187.133268][ T5782] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 187.133333][ T5782] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 187.133346][ T5782] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 187.133359][ T5782] usb 1-1: config 0 interface 0 has no altsetting 0 [ 187.133378][ T5782] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 187.133390][ T5782] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.217679][ T5782] usb 1-1: config 0 descriptor?? [ 187.853568][ T8426] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 187.854196][ T8426] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.858428][ T5782] usbhid 1-1:0.0: can't add hid device: -71 [ 187.858589][ T5782] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 187.931788][ T5782] usb 1-1: USB disconnect, device number 11 [ 188.070022][ T8444] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1085'. [ 188.153890][ T8446] fuse: Bad value for 'fd' [ 188.258084][ T5619] Bluetooth: hci0: command 0x0406 tx timeout [ 189.270237][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 189.270354][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 189.300488][ T10] usb 2-1: USB disconnect, device number 10 [ 189.378251][ T5782] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 189.421279][ T5619] Bluetooth: hci1: unexpected event for opcode 0x2010 [ 189.513506][ T8470] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1095'. [ 189.570792][ T5782] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 189.583089][ T5782] usb 4-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 189.583119][ T5782] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.583139][ T5782] usb 4-1: Product: syz [ 189.583153][ T5782] usb 4-1: Manufacturer: syz [ 189.583167][ T5782] usb 4-1: SerialNumber: syz [ 189.653780][ T5782] usb 4-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 190.038721][ T10] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 190.232319][ T10] usb 2-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 190.232349][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.232423][ T10] usb 2-1: Product: syz [ 190.232438][ T10] usb 2-1: Manufacturer: syz [ 190.232453][ T10] usb 2-1: SerialNumber: syz [ 190.316073][ T10] usb 2-1: config 0 descriptor?? [ 190.338889][ T5619] Bluetooth: hci0: command 0x0406 tx timeout [ 190.343841][ T10] hub 2-1:0.0: bad descriptor, ignoring hub [ 190.349952][ T10] hub 2-1:0.0: probe with driver hub failed with error -5 [ 190.543748][ T10] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 190.713015][ T8488] Process accounting resumed [ 190.827675][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 190.834109][ T10] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 190.834277][ T10] usb 2-1: media controller created [ 190.927550][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 191.005151][ T8499] netlink: 'syz.2.1108': attribute type 2 has an invalid length. [ 191.174748][ T8502] netlink: 'syz.1.1098': attribute type 1 has an invalid length. [ 191.265843][ T10] DVB: Unable to find symbol dib7000p_attach() [ 191.265855][ T10] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 191.391283][ T10] rc_core: IR keymap rc-dib0700-rc5 not found [ 191.391300][ T10] Registered IR keymap rc-empty [ 191.410770][ T10] dvb-usb: could not initialize remote control. [ 191.410782][ T10] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 191.571902][ T10] usb 2-1: USB disconnect, device number 11 [ 191.737952][ T5697] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 191.852297][ T10] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 191.869526][ T5697] usb 1-1: device descriptor read/64, error -71 [ 192.106606][ T5782] usb 4-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 192.108086][ T5697] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 192.185345][ T5782] usb 4-1: USB disconnect, device number 9 [ 192.244377][ T8523] FAULT_INJECTION: forcing a failure. [ 192.244377][ T8523] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 192.244407][ T8523] CPU: 0 UID: 0 PID: 8523 Comm: syz.3.1117 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 192.244427][ T8523] Tainted: [L]=SOFTLOCKUP [ 192.244432][ T8523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 192.244440][ T8523] Call Trace: [ 192.244446][ T8523] [ 192.244452][ T8523] dump_stack_lvl+0xe8/0x150 [ 192.244472][ T8523] should_fail_ex+0x46b/0x600 [ 192.244497][ T8523] _copy_to_user+0x31/0xb0 [ 192.244515][ T8523] simple_read_from_buffer+0xe1/0x170 [ 192.244535][ T8523] proc_fail_nth_read+0x1be/0x230 [ 192.244553][ T8523] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 192.244570][ T8523] ? rw_verify_area+0x2ac/0x4e0 [ 192.244588][ T8523] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 192.244604][ T8523] vfs_read+0x212/0xa80 [ 192.244630][ T8523] ? __pfx_vfs_read+0x10/0x10 [ 192.244653][ T8523] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 192.244671][ T8523] ? lockdep_hardirqs_on+0x7a/0x110 [ 192.244688][ T8523] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 192.244704][ T8523] ? mutex_lock_nested+0x152/0x1d0 [ 192.244723][ T8523] ? fdget_pos+0x252/0x320 [ 192.244744][ T8523] ksys_read+0x156/0x270 [ 192.244762][ T8523] ? __pfx_ksys_read+0x10/0x10 [ 192.244784][ T8523] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.244799][ T8523] do_syscall_64+0x174/0x580 [ 192.244816][ T8523] ? trace_irq_disable+0x3b/0x140 [ 192.244833][ T8523] ? clear_bhb_loop+0x40/0x90 [ 192.244849][ T8523] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.244863][ T8523] RIP: 0033:0x7f7a7cabd68e [ 192.244877][ T8523] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 192.244889][ T8523] RSP: 002b:00007f7a7ad4dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 192.244906][ T8523] RAX: ffffffffffffffda RBX: 00007f7a7ad4e6c0 RCX: 00007f7a7cabd68e [ 192.244917][ T8523] RDX: 000000000000000f RSI: 00007f7a7ad4e0a0 RDI: 0000000000000004 [ 192.244926][ T8523] RBP: 00007f7a7ad4e090 R08: 0000000000000000 R09: 0000000000000000 [ 192.244935][ T8523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 192.244944][ T8523] R13: 00007f7a7cd76038 R14: 00007f7a7cd75fa0 R15: 00007fffbfd2cbe8 [ 192.244980][ T8523] [ 192.257935][ T5697] usb 1-1: device descriptor read/64, error -71 [ 192.457871][ T5697] usb usb1-port1: attempt power cycle [ 192.605561][ T8532] capability: warning: `syz.1.1120' uses 32-bit capabilities (legacy support in use) [ 192.787131][ T8539] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1123'. [ 192.828061][ T5697] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 192.848520][ T5697] usb 1-1: device descriptor read/8, error -71 [ 192.887892][ T5782] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 193.047958][ T5782] usb 2-1: Using ep0 maxpacket: 16 [ 193.050876][ T5782] usb 2-1: unable to get BOS descriptor or descriptor too short [ 193.051966][ T5782] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 193.051987][ T5782] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 193.052035][ T5782] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 193.054192][ T5782] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 193.054281][ T5782] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.054302][ T5782] usb 2-1: Product: syz [ 193.054315][ T5782] usb 2-1: Manufacturer: syz [ 193.054326][ T5782] usb 2-1: SerialNumber: syz [ 193.097813][ T5697] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 193.127894][ T5722] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 193.137918][ T5697] usb 1-1: device descriptor read/8, error -71 [ 193.249759][ T5697] usb usb1-port1: unable to enumerate USB device [ 193.295683][ T5722] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 193.295714][ T5722] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.295888][ T5722] usb 3-1: Product: syz [ 193.295953][ T5722] usb 3-1: Manufacturer: syz [ 193.295969][ T5722] usb 3-1: SerialNumber: syz [ 193.344626][ T5782] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 193.344674][ T5782] cdc_ncm 2-1:1.0: bind() failure [ 193.376515][ T5722] usb 3-1: config 0 descriptor?? [ 193.388011][ T5722] hub 3-1:0.0: bad descriptor, ignoring hub [ 193.388047][ T5722] hub 3-1:0.0: probe with driver hub failed with error -5 [ 193.433214][ T5782] usb 2-1: USB disconnect, device number 12 [ 193.588324][ T5722] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 193.593581][ T5722] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 193.594115][ T5722] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 193.594147][ T5722] usb 3-1: media controller created [ 193.607898][ T5697] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 193.610430][ T5722] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 193.669783][ T5722] DVB: Unable to find symbol dib7000p_attach() [ 193.669794][ T5722] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 193.739199][ T5722] rc_core: IR keymap rc-dib0700-rc5 not found [ 193.739213][ T5722] Registered IR keymap rc-empty [ 193.739743][ T5722] dvb-usb: could not initialize remote control. [ 193.739748][ T5722] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 193.791227][ T5697] usb 4-1: config 0 has an invalid interface number: 50 but max is 0 [ 193.791253][ T5697] usb 4-1: config 0 has no interface number 0 [ 193.791287][ T5697] usb 4-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 193.794607][ T5697] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 193.794636][ T5697] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.794654][ T5697] usb 4-1: Product: syz [ 193.794668][ T5697] usb 4-1: Manufacturer: syz [ 193.794682][ T5697] usb 4-1: SerialNumber: syz [ 193.868337][ T5697] usb 4-1: config 0 descriptor?? [ 193.905091][ T5697] yurex 4-1:0.50: USB YUREX device now attached to Yurex #0 [ 194.058273][ T8550] netlink: 'syz.2.1125': attribute type 1 has an invalid length. [ 194.163507][ T8555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.163988][ T8555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.266589][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.266691][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.461452][ T8555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.463216][ T8555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.487309][ T8555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.498073][ T8555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.814905][ T8564] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1133'. [ 194.970081][ T8568] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1134'. [ 195.165083][ T8572] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1136'. [ 195.667897][ T10] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 195.828824][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 195.831803][ T10] usb 2-1: config index 0 descriptor too short (expected 2305, got 36) [ 195.831829][ T10] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 195.831859][ T10] usb 2-1: can't read configurations, error -22 [ 195.926688][ T8584] process 'syz.0.1140' launched '/dev/fd/7' with NULL argv: empty string added [ 195.957960][ T10] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 196.112646][ T8588] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1142'. [ 196.118463][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 196.120716][ T10] usb 2-1: config index 0 descriptor too short (expected 2305, got 36) [ 196.120741][ T10] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 196.120771][ T10] usb 2-1: can't read configurations, error -22 [ 196.123513][ T10] usb usb2-port1: attempt power cycle [ 196.321292][ T8591] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 196.469672][ T10] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 196.494834][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 196.496610][ T10] usb 2-1: config index 0 descriptor too short (expected 2305, got 36) [ 196.496636][ T10] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 196.496665][ T10] usb 2-1: can't read configurations, error -22 [ 196.588717][ T5782] usb 4-1: USB disconnect, device number 10 [ 196.632909][ T5782] yurex 4-1:0.50: USB YUREX #0 now disconnected [ 196.637947][ T10] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 196.663570][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 196.685633][ T10] usb 2-1: config index 0 descriptor too short (expected 2305, got 36) [ 196.685661][ T10] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 196.685692][ T10] usb 2-1: can't read configurations, error -22 [ 196.690363][ T10] usb usb2-port1: unable to enumerate USB device [ 196.732584][ T8594] Bluetooth: MGMT ver 1.23 [ 196.741365][ T8594] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1145'. [ 196.849298][ T37] audit: type=1326 audit(1782112204.880:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8595 comm="syz.3.1146" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7a7cafce59 code=0x0 [ 196.952910][ T8598] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1146'. [ 197.586045][ T8611] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1151'. [ 198.308248][ T10] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 198.457946][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 198.473882][ T10] usb 1-1: too many configurations: 17, using maximum allowed: 8 [ 198.475812][ T10] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 198.475837][ T10] usb 1-1: config 0 has no interface number 0 [ 198.507123][ T10] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 198.507149][ T10] usb 1-1: config 0 has no interface number 0 [ 198.516293][ T10] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 198.516318][ T10] usb 1-1: config 0 has no interface number 0 [ 198.526053][ T10] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 198.526078][ T10] usb 1-1: config 0 has no interface number 0 [ 198.530664][ T10] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 198.530690][ T10] usb 1-1: config 0 has no interface number 0 [ 198.534075][ T10] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 198.534099][ T10] usb 1-1: config 0 has no interface number 0 [ 198.535910][ T10] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 198.535933][ T10] usb 1-1: config 0 has no interface number 0 [ 198.557537][ T10] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 198.557565][ T10] usb 1-1: config 0 has no interface number 0 [ 198.561462][ T10] usb 1-1: New USB device found, idVendor=108c, idProduct=0168, bcdDevice=84.b2 [ 198.561490][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.561509][ T10] usb 1-1: Product: syz [ 198.561523][ T10] usb 1-1: Manufacturer: syz [ 198.561536][ T10] usb 1-1: SerialNumber: syz [ 198.576292][ T10] usb 1-1: config 0 descriptor?? [ 198.580682][ T10] etas_es58x 1-1:0.2: Starting syz syz (Serial Number syz) [ 198.786721][ T10] etas_es58x 1-1:0.2: could not parse product info: '424242424242' [ 199.115757][ T8636] FAULT_INJECTION: forcing a failure. [ 199.115757][ T8636] name failslab, interval 1, probability 0, space 0, times 0 [ 199.115781][ T8636] CPU: 0 UID: 0 PID: 8636 Comm: syz.3.1161 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 199.115803][ T8636] Tainted: [L]=SOFTLOCKUP [ 199.115806][ T8636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 199.115813][ T8636] Call Trace: [ 199.115817][ T8636] [ 199.115821][ T8636] dump_stack_lvl+0xe8/0x150 [ 199.115836][ T8636] should_fail_ex+0x46b/0x600 [ 199.115854][ T8636] should_failslab+0xa8/0x100 [ 199.115867][ T8636] kmem_cache_alloc_noprof+0xa4/0x6c0 [ 199.115883][ T8636] ? skb_clone+0x212/0x3a0 [ 199.115896][ T8636] ? skb_clone+0x212/0x3a0 [ 199.115911][ T8636] skb_clone+0x212/0x3a0 [ 199.115925][ T8636] __netlink_deliver_tap+0x424/0x8b0 [ 199.115944][ T8636] ? netlink_deliver_tap+0x2e/0x1b0 [ 199.115957][ T8636] netlink_deliver_tap+0x19c/0x1b0 [ 199.115970][ T8636] netlink_sendskb+0x68/0x140 [ 199.115983][ T8636] netlink_rcv_skb+0x2b6/0x4b0 [ 199.115995][ T8636] ? __pfx_sock_diag_rcv_msg+0x10/0x10 [ 199.116007][ T8636] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 199.116026][ T8636] ? netlink_deliver_tap+0x2e/0x1b0 [ 199.116038][ T8636] ? netlink_deliver_tap+0x2e/0x1b0 [ 199.116053][ T8636] netlink_unicast+0x780/0x920 [ 199.116069][ T8636] netlink_sendmsg+0x813/0xb40 [ 199.116086][ T8636] ? __pfx_netlink_sendmsg+0x10/0x10 [ 199.116100][ T8636] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 199.116115][ T8636] ? aa_sock_msg_perm+0x122/0x200 [ 199.116126][ T8636] ? __pfx_netlink_sendmsg+0x10/0x10 [ 199.116138][ T8636] sock_sendmsg_nosec+0x13a/0x180 [ 199.116154][ T8636] __sys_sendto+0x41a/0x5a0 [ 199.116167][ T8636] ? __pfx___sys_sendto+0x10/0x10 [ 199.116192][ T8636] ? do_user_addr_fault+0xc6f/0x1340 [ 199.116206][ T8636] __x64_sys_sendto+0xde/0x100 [ 199.116218][ T8636] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.116229][ T8636] do_syscall_64+0x174/0x580 [ 199.116241][ T8636] ? trace_irq_disable+0x3b/0x140 [ 199.116255][ T8636] ? clear_bhb_loop+0x40/0x90 [ 199.116267][ T8636] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.116277][ T8636] RIP: 0033:0x7f7a7cabd68e [ 199.116287][ T8636] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 199.116298][ T8636] RSP: 002b:00007f7a7ad4ce88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 199.116310][ T8636] RAX: ffffffffffffffda RBX: 00007f7a7ad4e6c0 RCX: 00007f7a7cabd68e [ 199.116317][ T8636] RDX: 0000000000000024 RSI: 00007f7a7ad4d000 RDI: 000000000000000a [ 199.116324][ T8636] RBP: 0000000000000000 R08: 00007f7a7ad4cf04 R09: 000000000000000c [ 199.116330][ T8636] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000a [ 199.116336][ T8636] R13: 00007f7a7ad4cf58 R14: 00007f7a7ad4d000 R15: 0000000000000000 [ 199.116351][ T8636] [ 199.201037][ T5782] usb 3-1: USB disconnect, device number 8 [ 199.641321][ T5782] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 199.683950][ T8649] Invalid logical block size (33554432) [ 200.010211][ T5782] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 200.163441][ C0] etas_es58x 1-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x015D. [ 200.163542][ C0] etas_es58x 1-1:0.2: es58x_check_crc: Bad CRC, urb_len: 9 [ 200.163591][ C0] etas_es58x 1-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 200.163600][ C0] etas_es58x 1-1:0.2: es58x_split_urb() returned error -EBADMSG [ 200.163828][ C0] etas_es58x 1-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x0300. [ 200.163867][ C0] etas_es58x 1-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 200.163887][ C0] etas_es58x 1-1:0.2: es58x_split_urb() returned error -EBADMSG [ 200.164117][ C0] etas_es58x 1-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x0000. [ 200.164156][ C0] etas_es58x 1-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 200.164173][ C0] etas_es58x 1-1:0.2: es58x_split_urb() returned error -EBADMSG [ 200.164256][ C0] etas_es58x 1-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x0000. [ 200.164293][ C0] etas_es58x 1-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 200.164308][ C0] etas_es58x 1-1:0.2: es58x_split_urb() returned error -EBADMSG [ 200.164406][ C0] etas_es58x 1-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x0000. [ 200.164445][ C0] etas_es58x 1-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 200.164460][ C0] etas_es58x 1-1:0.2: es58x_split_urb() returned error -EBADMSG [ 200.164549][ C0] etas_es58x 1-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x0000. [ 200.164586][ C0] etas_es58x 1-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 200.164600][ C0] etas_es58x 1-1:0.2: es58x_split_urb() returned error -EBADMSG [ 200.164690][ C0] etas_es58x 1-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x0000. [ 200.164728][ C0] etas_es58x 1-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 200.164743][ C0] etas_es58x 1-1:0.2: es58x_split_urb() returned error -EBADMSG [ 200.164838][ C0] etas_es58x 1-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x0000. [ 200.164876][ C0] etas_es58x 1-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 200.164890][ C0] etas_es58x 1-1:0.2: es58x_split_urb() returned error -EBADMSG [ 200.165483][ T5266] etas_es58x 1-1:0.2 can1: bit-timing not yet defined [ 200.195831][ T5782] usb 3-1: config 100 has an invalid interface number: 124 but max is 0 [ 200.195856][ T5782] usb 3-1: config 100 has no interface number 0 [ 200.195958][ T5782] usb 3-1: config 100 interface 124 has no altsetting 0 [ 200.212766][ T38] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 200.217932][ T5782] usb 3-1: New USB device found, idVendor=0681, idProduct=0010, bcdDevice=52.5e [ 200.218180][ T5782] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.218200][ T5782] usb 3-1: Product: syz [ 200.218213][ T5782] usb 3-1: Manufacturer: syz [ 200.218227][ T5782] usb 3-1: SerialNumber: syz [ 200.367083][ C0] etas_es58x 1-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 200.367172][ C0] etas_es58x 1-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 200.367242][ C0] etas_es58x 1-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 200.367311][ C0] etas_es58x 1-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 200.367380][ C0] etas_es58x 1-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 200.367679][ C0] etas_es58x 1-1:0.2 can0: es58x_write_bulk_callback: error -EPROTO [ 200.401413][ T5722] usb 1-1: USB disconnect, device number 16 [ 200.455497][ T5266] etas_es58x 1-1:0.2 can1: es58x_open: Could not open the network device: -EINVAL [ 200.463070][ T5722] etas_es58x 1-1:0.2: Disconnecting syz syz [ 200.509311][ T38] usb 4-1: Using ep0 maxpacket: 16 [ 200.549510][ T38] usb 4-1: unable to get BOS descriptor or descriptor too short [ 200.550513][ T38] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 200.550545][ T38] usb 4-1: can't read configurations, error -71 [ 201.242304][ T5782] idmouse 3-1:100.124: Unable to find bulk-in endpoint. [ 201.331927][ T5782] usb 3-1: USB disconnect, device number 9 [ 201.599944][ T5595] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 201.707927][ T38] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 201.747909][ T5595] usb 1-1: Using ep0 maxpacket: 16 [ 201.752327][ T5595] usb 1-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 201.752357][ T5595] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.752377][ T5595] usb 1-1: Product: syz [ 201.752389][ T5595] usb 1-1: Manufacturer: syz [ 201.752397][ T5595] usb 1-1: SerialNumber: syz [ 201.755885][ T5595] usb 1-1: config 0 descriptor?? [ 201.765425][ T5595] visor 1-1:0.0: Sony Clie 3.5 converter detected [ 201.787937][ T5619] Bluetooth: hci1: command 0x0406 tx timeout [ 201.857993][ T5782] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 201.881956][ T38] usb 4-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 201.881985][ T38] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.882005][ T38] usb 4-1: Product: syz [ 201.882018][ T38] usb 4-1: Manufacturer: syz [ 201.882032][ T38] usb 4-1: SerialNumber: syz [ 201.887002][ T38] usb 4-1: config 0 descriptor?? [ 201.938776][ T38] hub 4-1:0.0: bad descriptor, ignoring hub [ 201.938807][ T38] hub 4-1:0.0: probe with driver hub failed with error -5 [ 202.035592][ T5782] usb 2-1: unable to get BOS descriptor or descriptor too short [ 202.070416][ T5782] usb 2-1: config 0 has an invalid interface number: 86 but max is 0 [ 202.070443][ T5782] usb 2-1: config 0 has no interface number 0 [ 202.070538][ T5782] usb 2-1: config 0 interface 86 altsetting 4 bulk endpoint 0xE has invalid maxpacket 8 [ 202.070564][ T5782] usb 2-1: config 0 interface 86 altsetting 4 bulk endpoint 0xC has invalid maxpacket 32 [ 202.070584][ T5782] usb 2-1: config 0 interface 86 has no altsetting 0 [ 202.073356][ T5782] usb 2-1: New USB device found, idVendor=0586, idProduct=1000, bcdDevice=aa.5e [ 202.073384][ T5782] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.073402][ T5782] usb 2-1: Product: syz [ 202.073416][ T5782] usb 2-1: Manufacturer: syz [ 202.073430][ T5782] usb 2-1: SerialNumber: syz [ 202.112002][ T5782] usb 2-1: config 0 descriptor?? [ 202.141062][ T8693] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 202.141551][ T8693] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 202.168826][ T38] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 202.177336][ T38] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 202.187928][ T10] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 202.204303][ T38] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 202.204357][ T38] usb 4-1: media controller created [ 202.216126][ T5595] usb 1-1: clie_3_5_startup: get interface number failed: -71 [ 202.216345][ T5595] visor 1-1:0.0: probe with driver visor failed with error -71 [ 202.251180][ T38] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 202.288801][ T5595] usb 1-1: USB disconnect, device number 17 [ 202.338730][ T38] DVB: Unable to find symbol dib7000p_attach() [ 202.338745][ T38] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 202.360412][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 202.405601][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 202.406752][ T10] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 202.406788][ T10] usb 3-1: can't read configurations, error -71 [ 202.497878][ T38] rc_core: IR keymap rc-dib0700-rc5 not found [ 202.497897][ T38] Registered IR keymap rc-empty [ 202.498273][ T38] dvb-usb: could not initialize remote control. [ 202.498279][ T38] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 202.725375][ T8684] netlink: 'syz.3.1172': attribute type 1 has an invalid length. [ 203.030549][ T5782] omninet 2-1:0.86: ZyXEL - omni.net usb converter detected [ 203.337873][ T5782] usb 2-1: ZyXEL - omni.net usb converter now attached to ttyUSB0 [ 203.368195][ T5782] usb 2-1: USB disconnect, device number 17 [ 203.492515][ T8713] ======================================================= [ 203.492515][ T8713] WARNING: The mand mount option has been deprecated and [ 203.492515][ T8713] and is ignored by this kernel. Remove the mand [ 203.492515][ T8713] option from the mount to silence this warning. [ 203.492515][ T8713] ======================================================= [ 203.749948][ T5782] omninet ttyUSB0: ZyXEL - omni.net usb converter now disconnected from ttyUSB0 [ 203.751298][ T5782] omninet 2-1:0.86: device disconnected [ 204.033209][ T8720] batadv_slave_1: entered promiscuous mode [ 204.127962][ T5782] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 204.299487][ T5782] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 204.299517][ T5782] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.299535][ T5782] usb 2-1: Product: syz [ 204.299549][ T5782] usb 2-1: Manufacturer: syz [ 204.299563][ T5782] usb 2-1: SerialNumber: syz [ 204.388168][ T8719] batadv_slave_1: left promiscuous mode [ 204.823475][ T8734] loop9: detected capacity change from 0 to 255852543 [ 204.876973][ T5782] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 204.877011][ T5782] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 204.905923][ T5782] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 204.905996][ T8736] Invalid logical block size (4) [ 204.906364][ T5782] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 204.989284][ T5619] Bluetooth: hci3: command 0x0406 tx timeout [ 205.124341][ T5782] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 205.217686][ T5782] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -32 [ 205.373708][ T38] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 205.540413][ T38] usb 1-1: Using ep0 maxpacket: 16 [ 205.572813][ T38] usb 1-1: unable to get BOS descriptor or descriptor too short [ 205.573763][ T38] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 205.573796][ T38] usb 1-1: can't read configurations, error -71 [ 205.713605][ T8743] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 205.719169][ T8743] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 205.738697][ T8745] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1191'. [ 206.173927][ T8749] netlink: 'syz.0.1193': attribute type 1 has an invalid length. [ 206.173942][ T8749] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1193'. [ 206.361074][ T8755] binder: BINDER_SET_CONTEXT_MGR already set [ 206.361095][ T8755] binder: 8754:8755 ioctl 4018620d 200000000440 returned -16 [ 206.647908][ T38] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 206.801150][ T38] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x31, changing to 0x1 [ 206.801183][ T38] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 13364, setting to 64 [ 206.803896][ T38] usb 1-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 206.803924][ T38] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.803943][ T38] usb 1-1: Product: syz [ 206.803957][ T38] usb 1-1: Manufacturer: syz [ 206.803970][ T38] usb 1-1: SerialNumber: syz [ 206.867691][ T38] usb 1-1: config 0 descriptor?? [ 206.905562][ T38] streamzap 1-1:0.0: streamzap_probe: endpoint doesn't match input device 0201 [ 206.916496][ T5697] usb 2-1: USB disconnect, device number 18 [ 207.027703][ T8764] netlink: 112 bytes leftover after parsing attributes in process `syz.1.1200'. [ 207.027857][ T8764] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1200'. [ 207.091631][ T38] usb 1-1: USB disconnect, device number 19 [ 207.669313][ T38] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 207.756918][ T5782] usb 4-1: USB disconnect, device number 13 [ 207.817898][ T38] usb 3-1: Using ep0 maxpacket: 8 [ 207.831863][ T38] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 207.831892][ T38] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.831997][ T38] usb 3-1: Product: syz [ 207.832012][ T38] usb 3-1: Manufacturer: syz [ 207.832027][ T38] usb 3-1: SerialNumber: syz [ 207.882236][ T38] usb 3-1: config 0 descriptor?? [ 208.053621][ T5782] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 208.361737][ T8769] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.362252][ T8769] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.365945][ T38] dvb_usb_rtl28xxu 3-1:0.0: chip type detection failed -71 [ 208.366040][ T38] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 208.405107][ T38] usb 3-1: USB disconnect, device number 12 [ 208.673415][ T8788] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 208.771232][ T10] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 208.917979][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 208.920197][ T10] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 208.920220][ T10] usb 1-1: config 0 has no interface number 0 [ 208.920262][ T10] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 208.920276][ T10] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 208.922098][ T10] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 208.922125][ T10] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 208.922136][ T10] usb 1-1: Product: syz [ 208.922143][ T10] usb 1-1: SerialNumber: syz [ 208.928861][ T5782] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 208.948919][ T10] usb 1-1: config 0 descriptor?? [ 209.011395][ T10] cm109 1-1:0.8: invalid payload size 0, expected 4 [ 209.023441][ T10] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input8 [ 209.093175][ T5782] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 209.093279][ T5782] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 209.093303][ T5782] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.194223][ T5782] usb 2-1: config 0 descriptor?? [ 209.213885][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 209.219278][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 209.219503][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 209.219724][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 209.219945][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 209.220162][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 209.220380][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 209.220597][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 209.220821][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 209.221040][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 209.415963][ T5782] usbhid 2-1:0.0: can't add hid device: -71 [ 209.416109][ T5782] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 209.437919][ T38] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 209.528881][ T5782] usb 2-1: USB disconnect, device number 19 [ 209.587951][ T38] usb 3-1: Using ep0 maxpacket: 16 [ 209.595426][ T38] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 209.595489][ T38] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 140, changing to 11 [ 209.639039][ T38] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 209.639070][ T38] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.639090][ T38] usb 3-1: Product: syz [ 209.639102][ T38] usb 3-1: Manufacturer: syz [ 209.639115][ T38] usb 3-1: SerialNumber: syz [ 209.707472][ T38] usb 3-1: selecting invalid altsetting 1 [ 209.824158][ T10] usb 1-1: USB disconnect, device number 20 [ 209.824234][ C0] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 210.043283][ T10] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 210.071781][ T38] cdc_ncm 3-1:1.0: failed GET_NTB_PARAMETERS [ 210.071936][ T38] cdc_ncm 3-1:1.0: bind() failure [ 210.119166][ T5782] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 210.226474][ T8801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.226816][ T8801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.249010][ T5782] usb 2-1: device descriptor read/64, error -71 [ 210.284695][ T8801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.285015][ T8801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.290423][ T8801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.291051][ T8801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.295796][ T8801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.296327][ T8801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.353182][ T5595] usb 3-1: USB disconnect, device number 13 [ 210.457954][ T38] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 210.487999][ T5782] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 210.537915][ T10] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 210.617832][ T5782] usb 2-1: device descriptor read/64, error -71 [ 210.619511][ T38] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 210.619541][ T38] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 210.648401][ T38] usb 4-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 210.648429][ T38] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.648444][ T38] usb 4-1: Product: syz [ 210.648452][ T38] usb 4-1: Manufacturer: syz [ 210.648459][ T38] usb 4-1: SerialNumber: syz [ 210.651918][ T38] usb 4-1: config 0 descriptor?? [ 210.652689][ T8803] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 210.653441][ T8803] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 210.692969][ T10] usb 1-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 210.692996][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.693014][ T10] usb 1-1: Product: syz [ 210.693028][ T10] usb 1-1: Manufacturer: syz [ 210.693041][ T10] usb 1-1: SerialNumber: syz [ 210.711670][ T10] usb 1-1: config 0 descriptor?? [ 210.725402][ T10] hub 1-1:0.0: bad descriptor, ignoring hub [ 210.725437][ T10] hub 1-1:0.0: probe with driver hub failed with error -5 [ 210.728666][ T5782] usb usb2-port1: attempt power cycle [ 210.863092][ T8803] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 210.863277][ T8803] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 210.919646][ T10] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 210.931127][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 210.932169][ T10] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 210.932219][ T10] usb 1-1: media controller created [ 210.946729][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 211.005121][ T10] DVB: Unable to find symbol dib7000p_attach() [ 211.005136][ T10] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 211.077984][ T10] rc_core: IR keymap rc-dib0700-rc5 not found [ 211.078005][ T10] Registered IR keymap rc-empty [ 211.078265][ T10] dvb-usb: could not initialize remote control. [ 211.078271][ T10] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 211.107903][ T5782] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 211.129017][ T5782] usb 2-1: device descriptor read/8, error -71 [ 211.265298][ T38] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 211.367884][ T5782] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 211.388564][ T5782] usb 2-1: device descriptor read/8, error -71 [ 211.395964][ T8806] netlink: 'syz.0.1211': attribute type 1 has an invalid length. [ 211.506487][ T5782] usb usb2-port1: unable to enumerate USB device [ 211.917395][ T37] audit: type=1326 audit(1782112219.960:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8807 comm="syz.1.1213" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc0a57cce59 code=0x0 [ 212.114563][ T38] dm9601 4-1:0.0 (unnamed net_device) (uninitialized): MDIO read error: -71 [ 212.160810][ T38] dm9601 4-1:0.0 eth1: register 'dm9601' at usb-dummy_hcd.3-1, Davicom DM96xx USB 10/100 Ethernet, ca:80:d7:cb:84:71 [ 212.176969][ T38] usb 4-1: USB disconnect, device number 14 [ 212.187274][ T38] dm9601 4-1:0.0 eth1: unregister 'dm9601' usb-dummy_hcd.3-1, Davicom DM96xx USB 10/100 Ethernet [ 212.567845][ T5782] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 212.732469][ T5782] usb 3-1: Using ep0 maxpacket: 32 [ 212.757221][ T5782] usb 3-1: config 6 has an invalid interface number: 132 but max is 0 [ 212.757249][ T5782] usb 3-1: config 6 has no interface number 0 [ 212.757344][ T5782] usb 3-1: config 6 interface 132 altsetting 6 endpoint 0xA has an invalid bInterval 248, changing to 7 [ 212.757360][ T5782] usb 3-1: config 6 interface 132 has no altsetting 0 [ 212.794314][ T5782] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a4, bcdDevice=d3.7e [ 212.794343][ T5782] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.794361][ T5782] usb 3-1: Product: syz [ 212.794376][ T5782] usb 3-1: Manufacturer: syz [ 212.794388][ T5782] usb 3-1: SerialNumber: syz [ 213.367872][ T38] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 213.517861][ T38] usb 4-1: Using ep0 maxpacket: 8 [ 213.522787][ T38] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 213.522816][ T38] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.522835][ T38] usb 4-1: Product: syz [ 213.522848][ T38] usb 4-1: Manufacturer: syz [ 213.522863][ T38] usb 4-1: SerialNumber: syz [ 213.563863][ T38] usb 4-1: config 0 descriptor?? [ 213.824712][ T5782] usbtest 3-1:6.132: couldn't get endpoints, -22 [ 213.825035][ T5782] usbtest 3-1:6.132: probe with driver usbtest failed with error -22 [ 213.844526][ T5782] usb 3-1: USB disconnect, device number 14 [ 214.009955][ T8822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 214.012017][ T8822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 214.025525][ T38] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -71 [ 214.025622][ T38] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 214.058573][ T38] usb 4-1: USB disconnect, device number 15 [ 214.196269][ T37] audit: type=1326 audit(1782112222.240:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8826 comm="syz.2.1220" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd6130bce59 code=0x0 [ 215.619484][ T8841] netlink: 120 bytes leftover after parsing attributes in process `syz.3.1226'. [ 215.619509][ T8841] tipc: Enabling of bearer rejected, media not registered [ 216.030542][ T38] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 216.189755][ T38] usb 3-1: Using ep0 maxpacket: 8 [ 216.226149][ T38] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 216.226179][ T38] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.226198][ T38] usb 3-1: Product: syz [ 216.226212][ T38] usb 3-1: Manufacturer: syz [ 216.226226][ T38] usb 3-1: SerialNumber: syz [ 216.267004][ T38] usb 3-1: config 0 descriptor?? [ 216.465484][ T5717] usb 1-1: USB disconnect, device number 21 [ 216.715008][ T8853] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 216.753351][ T8853] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 216.760748][ T38] dvb_usb_rtl28xxu 3-1:0.0: chip type detection failed -71 [ 216.760840][ T38] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 216.807104][ T5717] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 216.825129][ T38] usb 3-1: USB disconnect, device number 15 [ 217.621778][ T8904] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1246'. [ 217.881592][ T8911] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1248'. [ 217.895812][ T8899] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 217.895966][ T8899] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 218.020587][ T8899] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 218.020618][ T8899] FAULT_INJECTION: forcing a failure. [ 218.020618][ T8899] name failslab, interval 1, probability 0, space 0, times 0 [ 218.020646][ T8899] CPU: 1 UID: 0 PID: 8899 Comm: syz.2.1243 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 218.020672][ T8899] Tainted: [L]=SOFTLOCKUP [ 218.020679][ T8899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 218.020689][ T8899] Call Trace: [ 218.020696][ T8899] [ 218.020705][ T8899] dump_stack_lvl+0xe8/0x150 [ 218.020733][ T8899] should_fail_ex+0x46b/0x600 [ 218.020765][ T8899] should_failslab+0xa8/0x100 [ 218.020789][ T8899] kmem_cache_alloc_node_noprof+0xae/0x710 [ 218.020821][ T8899] ? __alloc_skb+0x1d0/0x7d0 [ 218.020838][ T8899] ? __alloc_skb+0x1d0/0x7d0 [ 218.020861][ T8899] __alloc_skb+0x1d0/0x7d0 [ 218.020893][ T8899] mgmt_send_event+0x46/0x190 [ 218.020919][ T8899] ? lockdep_hardirqs_on+0x7a/0x110 [ 218.020946][ T8899] mgmt_suspending+0x98/0xe0 [ 218.020967][ T8899] ? __pfx_mgmt_suspending+0x10/0x10 [ 218.020997][ T8899] hci_suspend_dev+0x35e/0x540 [ 218.021018][ T8899] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 218.021044][ T8899] ? __pfx_hci_suspend_dev+0x10/0x10 [ 218.021078][ T8899] hci_suspend_notifier+0xf2/0x2f0 [ 218.021104][ T8899] notifier_call_chain+0x1ad/0x3d0 [ 218.021134][ T8899] blocking_notifier_call_chain_robust+0x85/0x100 [ 218.021161][ T8899] pm_notifier_call_chain_robust+0x2c/0x60 [ 218.021188][ T8899] snapshot_open+0x1a2/0x290 [ 218.021213][ T8899] ? __pfx_snapshot_open+0x10/0x10 [ 218.021236][ T8899] misc_open+0x2de/0x350 [ 218.021258][ T8899] chrdev_open+0x4d0/0x5f0 [ 218.021291][ T8899] ? __pfx_chrdev_open+0x10/0x10 [ 218.021318][ T8899] ? fsnotify_open_perm_and_set_mode+0x13b/0x6e0 [ 218.021348][ T8899] ? __pfx_chrdev_open+0x10/0x10 [ 218.021374][ T8899] do_dentry_open+0x83d/0x13e0 [ 218.021420][ T8899] vfs_open+0x3b/0x350 [ 218.021446][ T8899] ? path_openat+0x2e04/0x37e0 [ 218.021472][ T8899] path_openat+0x2e24/0x37e0 [ 218.021499][ T8899] ? __lock_acquire+0x6b5/0x2d10 [ 218.021526][ T8899] ? kmem_cache_alloc_noprof+0x354/0x6c0 [ 218.021554][ T8899] ? do_sys_openat2+0xcc/0x200 [ 218.021595][ T8899] do_file_open+0x23e/0x4a0 [ 218.021617][ T8899] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 218.021645][ T8899] ? __pfx_do_file_open+0x10/0x10 [ 218.021666][ T8899] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 218.021709][ T8899] ? alloc_fd+0x679/0x6f0 [ 218.021739][ T8899] do_sys_openat2+0x115/0x200 [ 218.021761][ T8899] ? __pfx_do_sys_openat2+0x10/0x10 [ 218.021781][ T8899] ? ksys_write+0x248/0x270 [ 218.021807][ T8899] ? __pfx_ksys_write+0x10/0x10 [ 218.021833][ T8899] __x64_sys_openat+0x138/0x170 [ 218.021856][ T8899] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.021876][ T8899] do_syscall_64+0x174/0x580 [ 218.021908][ T8899] ? clear_bhb_loop+0x40/0x90 [ 218.021932][ T8899] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.021951][ T8899] RIP: 0033:0x7fd6130bce59 [ 218.021970][ T8899] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 218.021987][ T8899] RSP: 002b:00007fd6112ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 218.022007][ T8899] RAX: ffffffffffffffda RBX: 00007fd613336090 RCX: 00007fd6130bce59 [ 218.022021][ T8899] RDX: 0000000000086500 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 218.022036][ T8899] RBP: 00007fd6112ed090 R08: 0000000000000000 R09: 0000000000000000 [ 218.022048][ T8899] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 218.022059][ T8899] R13: 00007fd613336128 R14: 00007fd613336090 R15: 00007ffe82a1e758 [ 218.022092][ T8899] [ 218.022217][ T8899] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 218.022303][ T8899] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 218.083575][ T8916] fuse: Bad value for 'fd' [ 218.183746][ T8919] nfs: Unknown parameter 'Audit' [ 218.199321][ T8899] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 218.199400][ T8899] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 218.762166][ T5722] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 218.928194][ T5722] usb 4-1: Using ep0 maxpacket: 8 [ 218.933289][ T5722] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 218.933320][ T5722] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.933340][ T5722] usb 4-1: Product: syz [ 218.933354][ T5722] usb 4-1: Manufacturer: syz [ 218.933369][ T5722] usb 4-1: SerialNumber: syz [ 218.952434][ T5722] usb 4-1: config 0 descriptor?? [ 219.388258][ T8918] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.395800][ T8918] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.419470][ T5722] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -71 [ 219.419563][ T5722] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 219.433328][ T5722] usb 4-1: USB disconnect, device number 16 [ 219.525516][ T8936] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1257'. [ 219.884149][ T38] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 219.941563][ T5615] Bluetooth: hci0: command 0x0406 tx timeout [ 220.037907][ T38] usb 3-1: Using ep0 maxpacket: 32 [ 220.043650][ T38] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 220.043669][ T38] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 220.043681][ T38] usb 3-1: config 0 interface 0 has no altsetting 0 [ 220.046119][ T38] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 220.046149][ T38] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.046167][ T38] usb 3-1: Product: syz [ 220.046175][ T38] usb 3-1: Manufacturer: syz [ 220.046183][ T38] usb 3-1: SerialNumber: syz [ 220.097921][ T5615] Bluetooth: hci1: command 0x0406 tx timeout [ 220.098161][ T5615] Bluetooth: hci3: command 0x0c1a tx timeout [ 220.129043][ T38] usb 3-1: config 0 descriptor?? [ 220.249021][ T5697] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 220.258235][ T5615] Bluetooth: hci2: command 0x0406 tx timeout [ 220.409090][ T5697] usb 2-1: Using ep0 maxpacket: 8 [ 220.413534][ T5697] usb 2-1: unable to get BOS descriptor or descriptor too short [ 220.416959][ T5697] usb 2-1: New USB device found, idVendor=0547, idProduct=7303, bcdDevice=ff.1a [ 220.416986][ T5697] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.416997][ T5697] usb 2-1: Product: syz [ 220.417004][ T5697] usb 2-1: Manufacturer: syz [ 220.417047][ T5697] usb 2-1: SerialNumber: syz [ 220.537897][ T5717] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 220.545208][ T38] gs_usb 3-1:0.0: Configuring for 1 interfaces [ 220.716857][ T5697] gspca_main: dtcs033-2.14.0 probing 0547:7303 [ 220.726855][ T5717] usb 1-1: unable to get BOS descriptor or descriptor too short [ 220.728332][ T5717] usb 1-1: config 3 has an invalid interface number: 249 but max is 0 [ 220.728357][ T5717] usb 1-1: config 3 has no interface number 0 [ 220.728438][ T5717] usb 1-1: config 3 interface 249 has no altsetting 0 [ 220.748458][ T8954] fuse: Unknown parameter 'grou00000000000000000000' [ 220.789941][ T5717] usb 1-1: New USB device found, idVendor=0c45, idProduct=800a, bcdDevice=5a.9d [ 220.789959][ T5717] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.789970][ T5717] usb 1-1: Product: syz [ 220.789977][ T5717] usb 1-1: Manufacturer: syz [ 220.789985][ T5717] usb 1-1: SerialNumber: syz [ 220.908593][ T8956] FAULT_INJECTION: forcing a failure. [ 220.908593][ T8956] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 220.908631][ T8956] CPU: 0 UID: 0 PID: 8956 Comm: syz.3.1267 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 220.908652][ T8956] Tainted: [L]=SOFTLOCKUP [ 220.908657][ T8956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 220.908666][ T8956] Call Trace: [ 220.908672][ T8956] [ 220.908679][ T8956] dump_stack_lvl+0xe8/0x150 [ 220.908705][ T8956] should_fail_ex+0x46b/0x600 [ 220.908730][ T8956] _copy_from_user+0x2d/0xb0 [ 220.908751][ T8956] kstrtouint_from_user+0xd6/0x180 [ 220.908782][ T8956] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 220.908816][ T8956] proc_fail_nth_write+0x8e/0x210 [ 220.908832][ T8956] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 220.908851][ T8956] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 220.908866][ T8956] vfs_write+0x2a3/0xba0 [ 220.908889][ T8956] ? __pfx_vfs_write+0x10/0x10 [ 220.908912][ T8956] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 220.908938][ T8956] ? lockdep_hardirqs_on+0x7a/0x110 [ 220.908957][ T8956] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 220.908974][ T8956] ? mutex_lock_nested+0x152/0x1d0 [ 220.908995][ T8956] ? fdget_pos+0x252/0x320 [ 220.909015][ T8956] ksys_write+0x156/0x270 [ 220.909035][ T8956] ? __pfx_ksys_write+0x10/0x10 [ 220.909059][ T8956] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.909081][ T8956] do_syscall_64+0x174/0x580 [ 220.909104][ T8956] ? trace_irq_disable+0x3b/0x140 [ 220.909121][ T8956] ? clear_bhb_loop+0x40/0x90 [ 220.909141][ T8956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.909156][ T8956] RIP: 0033:0x7f7a7cabd68e [ 220.909171][ T8956] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 220.909183][ T8956] RSP: 002b:00007f7a7ad4dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 220.909210][ T8956] RAX: ffffffffffffffda RBX: 00007f7a7ad4e6c0 RCX: 00007f7a7cabd68e [ 220.909228][ T8956] RDX: 0000000000000001 RSI: 00007f7a7ad4e0a0 RDI: 0000000000000004 [ 220.909240][ T8956] RBP: 00007f7a7ad4e090 R08: 0000000000000000 R09: 0000000000000000 [ 220.909252][ T8956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 220.909263][ T8956] R13: 00007f7a7cd76038 R14: 00007f7a7cd75fa0 R15: 00007fffbfd2cbe8 [ 220.909285][ T8956] [ 221.088581][ T8940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.089481][ T8940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.296445][ T5717] gspca_main: sn9c2028-2.14.0 probing 0c45:800a [ 221.296695][ T38] gs_usb 3-1:0.0: Couldn't register candev for channel 0 (-EINVAL) [ 221.306346][ T5717] gspca_sn9c2028: read1 error -71 [ 221.307117][ T5717] gspca_sn9c2028: read1 error -71 [ 221.312764][ T5717] gspca_sn9c2028: read1 error -71 [ 221.312851][ T5717] sn9c2028 1-1:3.249: probe with driver sn9c2028 failed with error -71 [ 221.429566][ T38] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -22 [ 221.432309][ T5717] usb 1-1: USB disconnect, device number 22 [ 221.440606][ T5697] usb 2-1: USB disconnect, device number 24 [ 221.502650][ T38] usb 3-1: USB disconnect, device number 16 [ 221.787903][ T32] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 221.907962][ T5697] usb 2-1: new low-speed USB device number 25 using dummy_hcd [ 221.938062][ T32] usb 4-1: Using ep0 maxpacket: 8 [ 221.952169][ T32] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 221.952199][ T32] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.952219][ T32] usb 4-1: Product: syz [ 221.952233][ T32] usb 4-1: Manufacturer: syz [ 221.952248][ T32] usb 4-1: SerialNumber: syz [ 221.968055][ T32] usb 4-1: config 0 descriptor?? [ 222.018052][ T5615] Bluetooth: hci0: command 0x0406 tx timeout [ 222.066305][ T5697] usb 2-1: config 0 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1056, setting to 8 [ 222.066367][ T5697] usb 2-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 222.066381][ T5697] usb 2-1: config 0 interface 0 has no altsetting 0 [ 222.066401][ T5697] usb 2-1: New USB device found, idVendor=0079, idProduct=1844, bcdDevice= 0.00 [ 222.066414][ T5697] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.095493][ T5697] usb 2-1: config 0 descriptor?? [ 222.115841][ T8960] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 222.187999][ T5615] Bluetooth: hci1: command 0x0406 tx timeout [ 222.207425][ T8975] fuse: Unknown parameter 'grou00000000000000000000' [ 222.357889][ T5615] Bluetooth: hci2: command 0x0406 tx timeout [ 222.430386][ T8964] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 222.434351][ T8964] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.435952][ T32] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -71 [ 222.436113][ T32] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 222.453507][ T32] usb 4-1: USB disconnect, device number 17 [ 222.534778][ T5697] usbhid 2-1:0.0: can't add hid device: -71 [ 222.534908][ T5697] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 222.550819][ T5697] usb 2-1: USB disconnect, device number 25 [ 223.120719][ T8997] fuse: Unknown parameter 'group_i00000000000000000000' [ 223.587898][ T38] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 223.749805][ T38] usb 4-1: Using ep0 maxpacket: 32 [ 223.753736][ T38] usb 4-1: config 6 has an invalid interface number: 132 but max is 0 [ 223.753851][ T38] usb 4-1: config 6 has no interface number 0 [ 223.753912][ T38] usb 4-1: config 6 interface 132 altsetting 6 endpoint 0xA has an invalid bInterval 248, changing to 7 [ 223.753941][ T38] usb 4-1: config 6 interface 132 has no altsetting 0 [ 223.757616][ T38] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a4, bcdDevice=d3.7e [ 223.757646][ T38] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 223.757667][ T38] usb 4-1: Product: syz [ 223.757680][ T38] usb 4-1: Manufacturer: syz [ 223.757695][ T38] usb 4-1: SerialNumber: syz [ 227.409277][ T5722] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 227.577872][ T5722] usb 2-1: Using ep0 maxpacket: 16 [ 227.625675][ T5722] usb 2-1: unable to get BOS descriptor or descriptor too short [ 227.644058][ T5722] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 227.644096][ T5722] usb 2-1: can't read configurations, error -71 [ 228.713502][ T9029] sg_write: data in/out 593884/136 bytes for SCSI command 0x0-- guessing data in; [ 228.713502][ T9029] program syz.1.1292 not setting count and/or reply_len properly [ 228.792756][ T9029] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 228.792785][ T9029] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 231.221087][ T38] usbtest 4-1:6.132: couldn't get endpoints, -22 [ 231.221186][ T38] usbtest 4-1:6.132: probe with driver usbtest failed with error -22 [ 232.179762][ T38] usb 4-1: USB disconnect, device number 18 [ 234.282118][ T9028] netlink: 822 bytes leftover after parsing attributes in process `syz.1.1292'. [ 241.811204][ T9052] capability: warning: `syz.0.1297' uses deprecated v2 capabilities in a way that may be insecure [ 242.418327][ T9055] netlink: 172 bytes leftover after parsing attributes in process `syz.1.1300'. [ 242.418380][ T9055] block nbd0: not configured, cannot reconfigure [ 242.732456][ T5619] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 242.775722][ T5619] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 242.777539][ T5619] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 242.795332][ T5619] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 242.796454][ T5619] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 243.207900][ T32] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 243.372116][ T32] usb 2-1: config 0 has too many interfaces: 129, using maximum allowed: 32 [ 243.372145][ T32] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 129 [ 243.407449][ T32] usb 2-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 243.407490][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.407510][ T32] usb 2-1: Product: syz [ 243.407525][ T32] usb 2-1: Manufacturer: syz [ 243.407538][ T32] usb 2-1: SerialNumber: syz [ 243.463605][ T32] usb 2-1: config 0 descriptor?? [ 248.834888][ T5615] Bluetooth: hci4: command tx timeout [ 248.836157][ T32] mos7840 2-1:0.0: required endpoints missing [ 249.869925][ T32] usb 2-1: USB disconnect, device number 28 [ 250.826058][ T8957] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 254.028860][ T5615] Bluetooth: hci4: command tx timeout [ 256.098001][ T5619] Bluetooth: hci4: command tx timeout [ 256.299862][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.299981][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.456832][ T5619] Bluetooth: hci4: command tx timeout [ 261.587036][ T5615] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 261.631392][ T5615] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 261.634142][ T5615] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 261.719262][ T5615] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 261.723404][ T5615] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 263.952202][ T5615] Bluetooth: hci0: command tx timeout [ 264.247039][ T5619] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 264.330851][ T5619] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 264.462497][ T5619] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 264.826674][ T5619] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 264.828177][ T5619] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 266.221118][ T5615] Bluetooth: hci0: command tx timeout [ 269.576570][ T5619] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 269.624499][ T5619] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 269.648325][ T5619] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 269.685061][ T5619] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 269.686124][ T5619] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 270.915950][ T5615] Bluetooth: hci0: command tx timeout [ 271.540672][ T5615] Bluetooth: hci5: command tx timeout [ 271.857991][ T5615] Bluetooth: hci6: command tx timeout [ 273.548826][ T5615] Bluetooth: hci0: command tx timeout [ 273.619081][ T5615] Bluetooth: hci5: command tx timeout [ 273.938102][ T5619] Bluetooth: hci6: command tx timeout [ 275.821711][ T5619] Bluetooth: hci5: command tx timeout [ 276.050725][ T5619] Bluetooth: hci6: command tx timeout [ 277.935469][ T5619] Bluetooth: hci5: command tx timeout [ 278.097878][ T5619] Bluetooth: hci6: command tx timeout [ 305.646599][ T5615] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 305.696947][ T5615] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 305.714079][ T5615] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 305.748728][ T5615] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 305.750916][ T5615] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 308.067891][ T5619] Bluetooth: hci3: command tx timeout [ 310.108409][ T5619] Bluetooth: hci3: command tx timeout [ 312.477160][ T5619] Bluetooth: hci3: command tx timeout [ 315.902308][ T5619] Bluetooth: hci3: command tx timeout [ 317.382375][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.382478][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 319.119385][ T5615] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 319.126401][ T5615] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 319.165237][ T5615] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 319.166453][ T5615] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 319.229373][ T5615] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 321.379990][ T5619] Bluetooth: hci7: command tx timeout [ 323.497449][ T5619] Bluetooth: hci7: command tx timeout [ 325.783344][ T5619] Bluetooth: hci7: command tx timeout [ 327.502137][ T5615] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 327.548623][ T5615] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 327.554079][ T5615] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 327.590161][ T5615] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 327.592578][ T5615] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 328.097880][ T5615] Bluetooth: hci7: command tx timeout [ 329.778632][ T5615] Bluetooth: hci8: command tx timeout [ 329.967388][ T5619] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 330.031065][ T5619] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 330.062272][ T5619] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 330.069616][ T5619] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 330.085932][ T5619] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 331.874299][ T5619] Bluetooth: hci8: command tx timeout [ 332.202615][ T5619] Bluetooth: hci9: command tx timeout [ 333.977862][ T5619] Bluetooth: hci8: command tx timeout [ 335.453068][ T5619] Bluetooth: hci9: command tx timeout [ 336.238166][ T5615] Bluetooth: hci8: command tx timeout [ 337.905725][ T5615] Bluetooth: hci9: command tx timeout [ 339.940355][ T5615] Bluetooth: hci9: command tx timeout [ 360.524446][ C1] sched: DL replenish lagged too much [ 376.624855][ T5615] Bluetooth: hci4: command 0x0406 tx timeout [ 378.824945][ T5615] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 378.882482][ T5615] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 378.885371][ T5615] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 378.907864][ T5615] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 378.908918][ T5615] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 379.133778][ T5611] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 379.177196][ T5611] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 379.182201][ T5611] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 379.214925][ T5611] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 379.217381][ T5611] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 379.890023][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.890133][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.522237][ T5611] Bluetooth: hci1: command tx timeout [ 382.498093][ T5619] Bluetooth: hci2: command tx timeout [ 383.538297][ T5619] Bluetooth: hci1: command tx timeout [ 384.578235][ T5619] Bluetooth: hci2: command tx timeout [ 385.618566][ T5619] Bluetooth: hci1: command tx timeout [ 385.795747][ T5619] Bluetooth: hci0: command 0x0406 tx timeout [ 386.947628][ T5619] Bluetooth: hci2: command tx timeout [ 387.887851][ T5619] Bluetooth: hci1: command tx timeout [ 388.436728][ T5615] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 388.866387][ T9215] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 388.916773][ T9215] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 388.933227][ T9215] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 388.951666][ T9215] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 388.952473][ T9215] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 388.992721][ T9215] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 390.016655][ T5615] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 390.033590][ T5615] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 390.034464][ T5615] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 390.103946][ T5615] Bluetooth: hci2: command tx timeout [ 391.067967][ T5619] Bluetooth: hci6: command tx timeout [ 392.417806][ T5619] Bluetooth: hci5: command tx timeout [ 393.139328][ T5619] Bluetooth: hci6: command tx timeout [ 394.507831][ T5619] Bluetooth: hci5: command tx timeout [ 395.592626][ T5619] Bluetooth: hci6: command tx timeout [ 396.587850][ T5619] Bluetooth: hci5: command tx timeout [ 397.701970][ T5619] Bluetooth: hci6: command tx timeout [ 398.658125][ T5619] Bluetooth: hci5: command tx timeout [ 439.902516][ T5615] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 439.959203][ T5615] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 439.964437][ T5615] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 440.010976][ T5615] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 440.015381][ T5615] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 440.674776][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.674877][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 444.073275][ T5615] Bluetooth: hci3: command tx timeout [ 445.510041][ T5619] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 445.562352][ T5619] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 445.566496][ T5619] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 445.604701][ T5619] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 445.605614][ T5619] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 446.108085][ T5619] Bluetooth: hci3: command tx timeout [ 446.418183][ T39] INFO: task syz.0.342:6584 blocked for more than 143 seconds. [ 446.418209][ T39] Tainted: G L syzkaller #0 [ 446.418221][ T39] Blocked by coredump. [ 446.418226][ T39] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 446.418253][ T39] task:syz.0.342 state:D stack:21792 pid:6584 tgid:6584 ppid:5607 task_flags:0x40044c flags:0x00080003 [ 446.418316][ T39] Call Trace: [ 446.418327][ T39] [ 446.418340][ T39] __schedule+0x172b/0x5550 [ 446.418498][ T39] ? __lock_acquire+0x6b5/0x2d10 [ 446.418587][ T39] ? clockevents_program_event+0x491/0x630 [ 446.418648][ T39] ? __pfx___schedule+0x10/0x10 [ 446.418685][ T39] rt_mutex_schedule+0x76/0xf0 [ 446.418721][ T39] rt_mutex_slowlock_block+0x505/0x670 [ 446.418766][ T39] rt_mutex_slowlock+0x2dc/0x780 [ 446.418821][ T39] ? rt_mutex_slowlock+0x1fd/0x780 [ 446.418840][ T39] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 446.418870][ T39] ? rcu_barrier+0x4c/0x580 [ 446.418893][ T39] ? rcu_barrier+0x4c/0x580 [ 446.418917][ T39] ? rcu_barrier+0x4c/0x580 [ 446.418934][ T39] mutex_lock_nested+0x168/0x1d0 [ 446.418962][ T39] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 446.418986][ T39] rcu_barrier+0x4c/0x580 [ 446.419014][ T39] netdev_run_todo+0x2ff/0x12c0 [ 446.419044][ T39] ? rtnl_is_locked+0x9/0x20 [ 446.419074][ T39] ? __pfx_netdev_run_todo+0x10/0x10 [ 446.419101][ T39] ? kasan_quarantine_put+0xbb/0x1f0 [ 446.419152][ T39] ? lockdep_hardirqs_on+0x7a/0x110 [ 446.419184][ T39] ? netdev_state_change+0x1ca/0x220 [ 446.419207][ T39] ? __pfx_tun_chr_close+0x10/0x10 [ 446.419229][ T39] tun_chr_close+0x13f/0x1c0 [ 446.419249][ T39] __fput+0x461/0xa70 [ 446.419281][ T39] task_work_run+0x1d9/0x270 [ 446.419308][ T39] ? __pfx_task_work_run+0x10/0x10 [ 446.419332][ T39] ? do_exit+0x70a/0x22c0 [ 446.419352][ T39] ? kmem_cache_free+0x187/0x6c0 [ 446.419380][ T39] ? put_net+0x191/0x260 [ 446.419405][ T39] ? do_exit+0x70a/0x22c0 [ 446.419462][ T39] do_exit+0x70f/0x22c0 [ 446.419488][ T39] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 446.419515][ T39] ? __pfx_do_exit+0x10/0x10 [ 446.419534][ T39] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 446.419554][ T39] ? reacquire_held_locks+0x104/0x190 [ 446.419582][ T39] ? rt_spin_lock+0x1e0/0x400 [ 446.419612][ T39] do_group_exit+0x21b/0x2d0 [ 446.419635][ T39] ? rt_spin_unlock+0x160/0x200 [ 446.419665][ T39] get_signal+0x1284/0x1330 [ 446.419712][ T39] arch_do_signal_or_restart+0xbc/0x840 [ 446.419733][ T39] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 446.419757][ T39] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 446.419785][ T39] ? __se_sys_clock_nanosleep+0x35b/0x3b0 [ 446.419815][ T39] exit_to_user_mode_loop+0x104/0x710 [ 446.419840][ T39] ? rcu_is_watching+0x15/0xb0 [ 446.419869][ T39] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.419892][ T39] do_syscall_64+0x353/0x580 [ 446.419917][ T39] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.419938][ T39] ? clear_bhb_loop+0x40/0x90 [ 446.419961][ T39] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.419982][ T39] RIP: 0033:0x7fac61e0d68e [ 446.420000][ T39] RSP: 002b:00007fac6009df58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 446.420036][ T39] RAX: fffffffffffffdfc RBX: 00007fac6009e6c0 RCX: 00007fac61e0d68e [ 446.420050][ T39] RDX: 00007fac6009dfb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 446.420063][ T39] RBP: 00007fac61ee2e6f R08: 0000000000000000 R09: 0000000000000000 [ 446.420076][ T39] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 446.420088][ T39] R13: 00007fac620c6038 R14: 00007fac620c5fa0 R15: 00007ffdf6210168 [ 446.420120][ T39] [ 446.420167][ T39] [ 446.420167][ T39] Showing all locks held in the system: [ 446.420176][ T39] 6 locks held by ksoftirqd/0/15: [ 446.420227][ T39] #0: ffffffff8e261520 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 446.420291][ T39] #1: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 446.420344][ T39] #2: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x271/0xc60 [ 446.420390][ T39] #3: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 [ 446.420507][ T39] #4: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5b/0x450 [ 446.420561][ T39] #5: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3c2/0x10b0 [ 446.420607][ T39] 3 locks held by rcuc/1/29: [ 446.420617][ T39] #0: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 446.420679][ T39] #1: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x271/0xc60 [ 446.420722][ T39] #2: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 [ 446.420771][ T39] 1 lock held by khungtaskd/39: [ 446.420781][ T39] #0: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 446.420870][ T39] 2 locks held by getty/5355: [ 446.420881][ T39] #0: ffff888036c750a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 446.420992][ T39] #1: ffffc90003cc62e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x465/0x1490 [ 446.421098][ T39] 2 locks held by kworker/0:6/5722: [ 446.421109][ T39] #0: ffff88813fe57938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 446.421161][ T39] #1: ffffc9000519fc40 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 446.421212][ T39] 1 lock held by syz.0.342/6584: [ 446.421223][ T39] #0: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.421267][ T39] 2 locks held by kworker/u8:16/7730: [ 446.421278][ T39] #0: ffff88801ae94138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 446.421331][ T39] #1: ffffc90006097c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 446.421386][ T39] 2 locks held by kworker/u8:28/7742: [ 446.421396][ T39] #0: ffff88801ae94138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 446.421448][ T39] #1: ffffc90006157c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 446.421501][ T39] 2 locks held by kworker/u8:29/7743: [ 446.421512][ T39] #0: ffff88801ae94138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 446.421562][ T39] #1: ffffc90006167c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 446.421614][ T39] 1 lock held by syz.2.1031/8291: [ 446.421624][ T39] #0: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.421679][ T39] 1 lock held by syz.3.1299/9043: [ 446.421689][ T39] #0: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.421733][ T39] 2 locks held by syz-executor/9058: [ 446.421744][ T39] #0: ffffffff8f7a1620 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 446.421789][ T39] #1: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.421833][ T39] 1 lock held by syz.1.1303/9075: [ 446.421843][ T39] #0: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.421886][ T39] 2 locks held by syz-executor/9089: [ 446.421897][ T39] #0: ffffffff8f7a1620 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 446.421941][ T39] #1: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.421985][ T39] 1 lock held by syz-executor/9094: [ 446.421995][ T39] #0: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.422038][ T39] 1 lock held by syz-executor/9097: [ 446.422048][ T39] #0: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.422091][ T39] 1 lock held by syz-executor/9125: [ 446.422101][ T39] #0: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.422143][ T39] 1 lock held by syz-executor/9145: [ 446.422153][ T39] #0: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.422213][ T39] 1 lock held by syz-executor/9158: [ 446.422224][ T39] #0: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.422268][ T39] 2 locks held by syz-executor/9164: [ 446.422278][ T39] #0: ffffffff8f7a1620 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 446.422322][ T39] #1: ffffffff8e3d1470 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 446.422366][ T39] 1 lock held by syz-executor/9199: [ 446.422376][ T39] #0: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa6/0x2550 [ 446.422446][ T39] 3 locks held by syz-executor/9214: [ 446.422458][ T39] #0: ffffffff8f7a1620 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 446.422500][ T39] #1: ffffffff8f7b0bb8 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d5/0x850 [ 446.422543][ T39] #2: ffff88801c2f3238 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x2ae/0x5d0 [ 446.422609][ T39] 1 lock held by dhcpcd/9265: [ 446.422619][ T39] #0: ffff888033d3a478 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x89/0x250 [ 446.422685][ T39] 1 lock held by modprobe/9278: [ 446.422696][ T39] #0: ffff888029b491b0 (&mm->mmap_lock){++++}-{4:4}, at: do_mprotect_pkey+0x25b/0xd20 [ 446.422752][ T39] 1 lock held by modprobe/9279: [ 446.422763][ T39] #0: ffff88802aa09088 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 [ 446.422808][ T39] 1 lock held by modprobe/9280: [ 446.422818][ T39] #0: ffffffff8e3cb2a0 (rcu_read_lock){....}-{1:3}, at: path_init+0x12d/0x14d0 [ 446.422863][ T39] [ 446.422867][ T39] ============================================= [ 446.422867][ T39] [ 446.422888][ T39] NMI backtrace for cpu 0 [ 446.422908][ T39] CPU: 0 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 446.422934][ T39] Tainted: [L]=SOFTLOCKUP [ 446.422941][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 446.422952][ T39] Call Trace: [ 446.422960][ T39] [ 446.422968][ T39] dump_stack_lvl+0xe8/0x150 [ 446.422992][ T39] nmi_cpu_backtrace+0x274/0x2d0 [ 446.423051][ T39] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 446.423075][ T39] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 446.423098][ T39] sys_info+0x135/0x170 [ 446.423125][ T39] watchdog+0xfd3/0x1030 [ 446.423169][ T39] ? watchdog+0x1c9/0x1030 [ 446.423197][ T39] kthread+0x388/0x470 [ 446.423219][ T39] ? __pfx_watchdog+0x10/0x10 [ 446.423239][ T39] ? __pfx_kthread+0x10/0x10 [ 446.423261][ T39] ret_from_fork+0x514/0xb70 [ 446.423286][ T39] ? __pfx_ret_from_fork+0x10/0x10 [ 446.423308][ T39] ? __switch_to+0xc79/0x1410 [ 446.423329][ T39] ? __pfx_kthread+0x10/0x10 [ 446.423351][ T39] ret_from_fork_asm+0x1a/0x30 [ 446.423391][ T39] [ 446.423399][ T39] Sending NMI from CPU 0 to CPUs 1: [ 446.423434][ C1] NMI backtrace for cpu 1 [ 446.423451][ C1] CPU: 1 UID: 0 PID: 29 Comm: rcuc/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 446.423472][ C1] Tainted: [L]=SOFTLOCKUP [ 446.423478][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 446.423487][ C1] RIP: 0010:its_return_thunk+0x0/0x10 [ 446.423562][ C1] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e9 2b 62 f1 f5 cc [ 446.423575][ C1] RSP: 0018:ffffc90000a3ed98 EFLAGS: 00000246 [ 446.423589][ C1] RAX: ffffffff89173a79 RBX: ffffffff9a982400 RCX: ffff88801e68be00 [ 446.423601][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 446.423611][ C1] RBP: ffffc90000a3ef38 R08: 0000000000000000 R09: 0000000000000100 [ 446.423621][ C1] R10: ffffc90000a3ed00 R11: fffff52000147da4 R12: e00000000cacfb7f [ 446.423632][ C1] R13: e00000000cacfb7e R14: 1ffffffff3530480 R15: e00000000cacfb7e [ 446.423643][ C1] FS: 0000000000000000(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 [ 446.423657][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 446.423667][ C1] CR2: 00007f8ea4b62b45 CR3: 000000000e1b8000 CR4: 00000000003526f0 [ 446.423682][ C1] Call Trace: [ 446.423688][ C1] [ 446.423694][ C1] save_dst_trace_buffer+0x1a9/0x5b0 [ 446.423718][ C1] ? __pfx_save_dst_trace_buffer+0x10/0x10 [ 446.423738][ C1] ? dst_release+0x28/0x1b0 [ 446.423756][ C1] ? skb_release_head_state+0x71/0x360 [ 446.423829][ C1] ? __kfree_skb+0x24/0x210 [ 446.423843][ C1] ? nft_synproxy_eval_v4+0x352/0x4e0 [ 446.423915][ C1] ? nft_synproxy_do_eval+0x305/0x580 [ 446.423935][ C1] ? nft_do_chain+0x48d/0x1ae0 [ 446.423977][ C1] ? nft_do_chain_inet+0x360/0x4b0 [ 446.424035][ C1] ? nf_hook_slow+0xc5/0x220 [ 446.424097][ C1] ? NF_HOOK+0x21f/0x3c0 [ 446.424114][ C1] ? NF_HOOK+0x336/0x3c0 [ 446.424131][ C1] ? process_backlog+0x569/0xc60 [ 446.424152][ C1] ? __napi_poll+0xab/0x550 [ 446.424172][ C1] ? net_rx_action+0x696/0xe00 [ 446.424185][ C1] ? handle_softirqs+0x1de/0x6d0 [ 446.424206][ C1] ? __local_bh_enable_ip+0x170/0x2b0 [ 446.424225][ C1] ? rcu_cpu_kthread+0x9e8/0x1470 [ 446.424244][ C1] ? smpboot_thread_fn+0x541/0xa50 [ 446.424258][ C1] ? kthread+0x388/0x470 [ 446.424273][ C1] ? ret_from_fork+0x514/0xb70 [ 446.424288][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 446.424307][ C1] ? synproxy_send_client_synack+0x8c1/0xe30 [ 446.424355][ C1] dst_release+0x28/0x1b0 [ 446.424376][ C1] skb_release_head_state+0x71/0x360 [ 446.424394][ C1] __kfree_skb+0x24/0x210 [ 446.424411][ C1] nft_synproxy_eval_v4+0x352/0x4e0 [ 446.424435][ C1] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 446.424457][ C1] ? nf_ip_checksum+0x13c/0x510 [ 446.424475][ C1] nft_synproxy_do_eval+0x305/0x580 [ 446.424498][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 446.424523][ C1] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 446.424543][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 446.424563][ C1] nft_do_chain+0x48d/0x1ae0 [ 446.424579][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 446.424597][ C1] ? stack_depot_save_flags+0x33/0x810 [ 446.424677][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 446.424690][ C1] ? __lock_acquire+0x6b5/0x2d10 [ 446.424711][ C1] ? __lock_acquire+0x6b5/0x2d10 [ 446.424735][ C1] ? __lock_acquire+0x6b5/0x2d10 [ 446.424755][ C1] nft_do_chain_inet+0x360/0x4b0 [ 446.424771][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 446.424788][ C1] ? NF_HOOK+0x9e/0x3c0 [ 446.424806][ C1] ? NF_HOOK+0x9e/0x3c0 [ 446.424823][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 446.424838][ C1] nf_hook_slow+0xc5/0x220 [ 446.424859][ C1] NF_HOOK+0x21f/0x3c0 [ 446.424876][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 446.424894][ C1] ? NF_HOOK+0x9e/0x3c0 [ 446.424911][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 446.424927][ C1] ? ip_rcv_finish_core+0xda3/0x1c00 [ 446.424947][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 446.424967][ C1] ? ip_local_deliver+0x12a/0x1b0 [ 446.424987][ C1] NF_HOOK+0x336/0x3c0 [ 446.425003][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 446.425022][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 446.425039][ C1] ? NF_HOOK+0x9e/0x3c0 [ 446.425055][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 446.425073][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 446.425093][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 446.425110][ C1] ? process_backlog+0x271/0xc60 [ 446.425123][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 446.425146][ C1] process_backlog+0x569/0xc60 [ 446.425161][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 446.425183][ C1] __napi_poll+0xab/0x550 [ 446.425204][ C1] net_rx_action+0x696/0xe00 [ 446.425225][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 446.425238][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 446.425258][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 446.425284][ C1] handle_softirqs+0x1de/0x6d0 [ 446.425309][ C1] __local_bh_enable_ip+0x170/0x2b0 [ 446.425331][ C1] ? rcu_cpu_kthread+0x205/0x1470 [ 446.425349][ C1] rcu_cpu_kthread+0x9e8/0x1470 [ 446.425371][ C1] ? rcu_cpu_kthread+0x205/0x1470 [ 446.425394][ C1] ? __pfx_rcu_cpu_kthread+0x10/0x10 [ 446.425413][ C1] ? schedule+0x90/0x360 [ 446.425432][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 446.425446][ C1] smpboot_thread_fn+0x541/0xa50 [ 446.425461][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 446.425479][ C1] kthread+0x388/0x470 [ 446.425495][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 446.425508][ C1] ? __pfx_kthread+0x10/0x10 [ 446.425525][ C1] ret_from_fork+0x514/0xb70 [ 446.425543][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 446.425559][ C1] ? __switch_to+0xc79/0x1410 [ 446.425574][ C1] ? __pfx_kthread+0x10/0x10 [ 446.425591][ C1] ret_from_fork_asm+0x1a/0x30 [ 446.425615][ C1] [ 446.426446][ T39] Kernel panic - not syncing: hung_task: blocked tasks [ 446.426465][ T39] CPU: 0 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 446.426492][ T39] Tainted: [L]=SOFTLOCKUP [ 446.426500][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 446.426511][ T39] Call Trace: [ 446.426519][ T39] [ 446.426527][ T39] vpanic+0x56c/0xa60 [ 446.426560][ T39] ? __pfx_vpanic+0x10/0x10 [ 446.426595][ T39] panic+0xc5/0xd0 [ 446.426620][ T39] ? __pfx_panic+0x10/0x10 [ 446.426654][ T39] ? __x2apic_send_IPI_mask+0x158/0x190 [ 446.426688][ T39] ? wq_watchdog_touch+0xf9/0x160 [ 446.426715][ T39] ? nmi_trigger_cpumask_backtrace+0x247/0x380 [ 446.426740][ T39] watchdog+0x102c/0x1030 [ 446.426770][ T39] ? watchdog+0x1c9/0x1030 [ 446.426798][ T39] kthread+0x388/0x470 [ 446.426820][ T39] ? __pfx_watchdog+0x10/0x10 [ 446.426840][ T39] ? __pfx_kthread+0x10/0x10 [ 446.426861][ T39] ret_from_fork+0x514/0xb70 [ 446.426887][ T39] ? __pfx_ret_from_fork+0x10/0x10 [ 446.426910][ T39] ? __switch_to+0xc79/0x1410 [ 446.426931][ T39] ? __pfx_kthread+0x10/0x10 [ 446.426954][ T39] ret_from_fork_asm+0x1a/0x30 [ 446.426993][ T39] [ 446.427287][ T39] Kernel Offset: disabled