last executing test programs:

3m55.138858619s ago: executing program 3 (id=633):
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000810087406d040e0a759400000001090212000100000000090400200003"], 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x1418, 0x1}, 0x10}}, 0x0)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
shutdown(r1, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f000001f580)={0x0, 0x10, &(0x7f000001f540)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000180)=0x10)
r2 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f00000000c0)=0x17)
read$dsp(r2, &(0x7f00000003c0)=""/134, 0x86)
prctl$PR_GET_THP_DISABLE(0x2a)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, &(0x7f0000000100)={0x14, &(0x7f0000000000)={0x40, 0x22, 0x5e, {0x5e, 0x6, "2ed38a22ff90c2ca6c57763bdb8b9e9d9c6e5509368a12b967582d55d54a0eb1c6ef18c888dd0b3afd781df27b0198d039209eaacd4ce4189611b1284b37c1e0f18a694d7d82def5cfd1c620024a1633211655d63b516c0b2cb4cdea"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4}}}, &(0x7f00000003c0)={0x2c, &(0x7f0000000600)=ANY=[@ANYBLOB="0034ba0000009c50388ee43bcf110b4cef8a74e5add1b66032994d49f8d547a8c6f7f9719332019941b7534842f9382bc419722702d7ef058406f525b25c51d9d9759deab10587cee43ca589d569d6a6449ed16483d28a15aa290f10f37d47b7da8556f73bdeaaf76bbf18656349ba90e287fdc414bcdbffd7fc94d812b3d3c253a5b928e45f85004bb0e86530dd990c775a0aaf22bee79ec4fda822e6f97f70d38e497461000008000000000000000000000000000000000000000000000000def8e8ce17754302021079c2c0005319eaccd25c85db13dc2d0b9cd33c98158fdbb75e4f8f8d12ea714b0a4222c44e2bb3e173b734bca1e0ab5a56f717e4501631f6a961724b3d110a0ef4a9f792c2e6ce1548bd9eb959763288488792578bad171ac146c4b45c0dda109ae9edf69c7e917e5c7e4e6056893471966682eed0902d7b123a7360f77d0e020000005802e03d9dbc42f6c53922b21212e13b6665ace74a0a8fcece4909857de2be69822919f60e0bcefec95bc8ecdfc6cfb68de6d9b375d5bb8713a945ba806d65e8cc242236315cac32e56905d7fd7285cdd778beff12cd2f3b73d17734038e413eeb373246ef138de55c3301b548767ad533c6780ee0021b6874c27c51e2da17aee18e3885b30f71061e4fa6fea16db12dcc51a334473bfa23a2895d0150797f7cc043ba0d87f52cc4c059cec2e4df60c7491f54a03aca4996a1ca38abe6ac8ed1d00fb48eac77f47383de606fe6d8b3bd1d601435c8454235239e4650e4b850a1e157d3987b0d0f9b3f7c8e0d75a458b1d6b330a9e858d721c664806c4a6c8d54c5e689d27eedf78a516f28b75461b0b9115a32ac088c"], &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x32}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000340)={0xc0, 0x5, 0x1, "eb"}, &(0x7f0000000380)={0x40, 0x5, 0x2, "eeb6"}})
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
syz_usb_control_io$cdc_ecm(r0, &(0x7f00000004c0)={0x14, &(0x7f0000000400)={0x0, 0x22, 0x64, {0x64, 0x30, "a2429942656a069199e96d32d60c96d7b67c91291594f4aa13d16c755d9b76975e471fcacd258f58f847317e170b3fd3c8ebab854b706806a8130fe97d08bcc97c3ecff5cad4ae12d441888f505685fdc6c29a8db447d480d3cec27396a9fe8771ba"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000005c0)={0x1c, &(0x7f0000000500)={0x0, 0x16, 0x27, "1198ccc9e75cc0c1d52981b301f5e6543b848c4d97fb228d798edb7d819e0e456310dc1e9e2f3b"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0x8}})
mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="6d706f6c3d62690bbe608ae7a8e257d632a80e6e643a302d4e3a", @ANYRESDEC])
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
close(r3)

3m52.929089346s ago: executing program 3 (id=649):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched_retired(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newtaction={0x18, 0x32, 0x1, 0x70bd29, 0x25dfdbfb, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x8080}, 0x9080)
syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff)
r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001340), 0x204000, 0x0)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000013c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000001640)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x10002}, 0xc, &(0x7f0000001600)={&(0x7f0000001480)={0x15c, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x1, 0x77}}}}, [@NL80211_ATTR_TX_RATES={0xe0, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x3c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x2, 0x401, 0x2, 0x8, 0x8, 0x4b49]}}, @NL80211_TXRATE_HT={0x1a, 0x2, [{0x1, 0x6}, {0x1}, {0x1, 0x3}, {0x6, 0x4}, {0x3, 0x4}, {0x2, 0x4}, {0x4, 0x6}, {0x4, 0x4}, {0x5, 0x8}, {0x0, 0x3}, {0x0, 0x8}, {0x4}, {0x3, 0x5}, {0x5, 0x4}, {0x7, 0x2}, {0x6, 0x2}, {0x2, 0xa}, {0x4, 0x4}, {0x2, 0x3}, {0x0, 0xa}, {0x2}, {0x5, 0x4}]}]}, @NL80211_BAND_60GHZ={0x84, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4a, 0x2, [{0x3, 0x3}, {0x1, 0x4}, {0x7, 0x3}, {0x1, 0x3}, {0x6, 0x3}, {0x0, 0x14}, {0x0, 0xa}, {0x5, 0x4}, {0x7, 0x9}, {0x4}, {}, {0x3, 0x3}, {0x0, 0x2}, {0x2, 0x9}, {0x7, 0x7}, {0x0, 0x9}, {0x7, 0x4}, {0x2, 0x9}, {0x2, 0xa}, {0x6}, {0x2, 0x2}, {}, {0x1, 0x7}, {0x0, 0x4}, {0x1, 0x8}, {0x3, 0x2}, {0x3, 0x7}, {0x7, 0x9}, {0x7, 0x9}, {0x1, 0xa}, {0x4, 0x5}, {0x7, 0x6}, {0x0, 0x4}, {0x6, 0x1}, {0x4, 0x6}, {0x0, 0x1}, {0x5}, {0x5, 0x6}, {0x1, 0x6}, {0x0, 0x3}, {0x6, 0x8}, {0x6, 0x9}, {0x7, 0x1}, {0x1, 0x3}, {0x0, 0x1}, {0x0, 0x1}, {0x1, 0x7}, {0x1, 0x6}, {0x2, 0x5}, {0x3, 0xa}, {0x2, 0x9}, {0x2, 0x8}, {0x7, 0x7}, {0x3, 0x8}, {0x3, 0x3}, {0x4, 0x1}, {0x1, 0x2}, {0x1}, {0x0, 0x3}, {0x1, 0x5}, {}, {0x0, 0xa}, {0x3, 0x3}, {0x0, 0x5}, {0x7, 0x4}, {0x6, 0x4}, {0x7, 0x8}, {0x7, 0x9}, {0x0, 0x3}, {0x1, 0xa}]}, @NL80211_TXRATE_HT={0x1d, 0x2, [{0x7, 0x3}, {}, {0x0, 0x5}, {0x1, 0x9}, {0x0, 0x6}, {0x7, 0x5}, {0x6, 0xa}, {0x0, 0x3}, {0x6}, {0x0, 0x9}, {0x5, 0x8}, {0x7, 0x9}, {0x2, 0x8}, {0x2, 0x5}, {0x4, 0xa}, {0x5, 0x5}, {0x6, 0x2}, {0x3}, {0x6}, {0x5, 0x5}, {0x0, 0x6}, {0x4, 0x3}, {0x4, 0x8}, {0x1, 0x4}, {0x1, 0x5}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x49, 0x9, 0x9, 0xb, 0x80, 0x2, 0xd]}}]}, @NL80211_BAND_5GHZ={0x1c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x8, 0x1, [0x48, 0x60, 0xb, 0x16]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x18, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x14, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x44, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x40, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x16, 0x1, [0x3, 0xb, 0x60, 0x2, 0x9, 0x0, 0x60, 0x6, 0x1, 0x24, 0x0, 0x1b, 0xb, 0x2, 0x18, 0x18, 0x1, 0x4]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xc, 0xfffa, 0x4, 0x1c00, 0x7, 0x7f, 0x6]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}]}]}, 0x15c}, 0x1, 0x0, 0x0, 0x4000041}, 0x4064000)
r3 = openat$random(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
preadv(r3, &(0x7f0000001440)=[{&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/36, 0x24}], 0x2, 0x0, 0x0)
mq_open(&(0x7f0000000000)='.:\x00', 0x800, 0xd, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
getsockname(r4, &(0x7f0000000180)=@xdp, &(0x7f0000000200)=0x80)
r5 = open(&(0x7f0000000100)='./file0\x00', 0x100, 0x32)
ioctl$sock_TIOCINQ(r4, 0x541b, &(0x7f0000001400))
prctl$PR_MCE_KILL(0x48, 0x0, 0x0)
ioctl$VIDIOC_ENUM_FREQ_BANDS(r5, 0xc0405665, &(0x7f0000000140)={0x0, 0x3, 0x0, 0x40, 0x4, 0x2})
r6 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="350400004100054cc6a119e30c80a843015a35400c0002000200002037153e370c04018006041a004500ac377653c6de2a7c31f4a918505e7a19ff6dc6a3cb9708b9469405009c8e000000800000516c006c154938456646efee34b951a078932502bdbcf6c6b8d226dc64f5b1a0718d687ed8934d4780bae8ba0a55a6c130214043ff8ad5084a642a4d4aac02e408ff3af4be00"/159, 0x9f}, {&(0x7f0000000a40)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc2261c238a5159ea98db9c00aeef644ae98a8cb8da3ff3b7ba14d7971910b559623af829524d83bf19f18628464076329140e0203fc75859185ccd019302afb784e41e16cf2d31db7aba83d0f500ce25fc2d7f524a04cfaa0015ea8a297477a5517f8a4ac167083a321c78070974afc897fb738fbcfeac369844fd7fc11fff502c02b7607007ead2007a18006a6ca8dc2d0119f01d7083c2ab5760ac7b24d7bf26b9030cf455a08385f9e662cbe0c3ca6e6fd4ac0c8566c0fca986c68ef7016a11d3e44253b6f2d07d53505ed58b8ad410f89425046321b4a9b27b5e767bdfa0ebf7abf3d91b319129c48853d8e5cbc4a2c5c560b007eafe03e3332f6017f3164c7f602180aad23dfe5e770fe8855f45925e342b7dfd7ddaa68b65065465cdf4d5b8d995d6e6a7042ebea3d139c6a616232eb4efd1a50d0e6db3188a8e98375fda2a7ebd4cd59b9ea626c13685b05e6cf4d484e32869fd7c7167dbfa48b1529e5dd5f5a02673ccc7dbedfd75e34f3f9eb3c7833734a59acada6dd2ff364475e03f2219deedb5d0c941f2177a23167adcc5a15f4e5441ed537f26a1620df057aeb55b2ad3a00a77e23d304ed6034dd5ec9b2cfe777ca21ec4f48abdafa0d66a78d653068ef871bdc6598fd32edcba60c675a1e8f4e81e83f73414c179bfb7f329d71fe6e291fb2eaa59b9636cb6a74d0deb46a18c77f37abf0894a7083e0e4c237ff7c24872668ac40e307569a975b2765af8d3268d11b473d5d7544edd1ed0e507c319e128daf7e75c349c9b3de603580d52a6c118acf924216130364bfab8d59969e4dbee0a9208adb7bfa855556be06a666334a0612e4ff3fc6f4ddb9a0c209301081f34824496480d688ae9bd0c3c28ea8ecfe01a2b86dcb3750686a89891d9abf0d584c854b", 0x396}], 0x2}, 0x10049014)
sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a70000000060a010400000000000000000a0004010900010073797a310000000044000480400001800e000100627974656f726465720000002c000280080005400000009908000440000000550800034000000021080001400000000108000240000000130900020073797a32"], 0x98}, 0x1, 0x0, 0x0, 0x4000015}, 0x24000000)
syz_usb_connect(0x0, 0x3d, &(0x7f0000000240)={{0x12, 0x1, 0x200, 0xc1, 0xc8, 0xbc, 0x40, 0xeb1a, 0xe310, 0x34b6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2b, 0x1, 0x9, 0x8, 0x20, 0x6, "", [{{0x9, 0x4, 0xb5, 0x2c, 0x2, 0xff, 0x1, 0x1, 0x78, [], [{{0x9, 0x5, 0xc, 0x3, 0x3ff, 0x7, 0x9, 0x3, [@generic={0x7, 0x5, "bd8eb688e3"}]}}, {{0x9, 0x5, 0xa, 0x10, 0x10, 0x9, 0x81, 0xe}}]}}]}}]}}, 0x0)

3m51.441534936s ago: executing program 3 (id=668):
r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1})
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x0, 0x2000, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '|^b!'}, 0x0, 0x1, {0x0}})
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)=@mmap={0x0, 0x2, 0x4, 0xe000, 0x0, {0x77359400}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "186856f3"}}) (fail_nth: 5)

3m50.95549239s ago: executing program 3 (id=669):
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x800000000, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x1b, 0x2, 0x0, "61363a69ed0a34c7f115699ff7aca14ac3343cafd05d94f5c690227414a9ee4b"})
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0)
r2 = accept4(r1, 0x0, 0x0, 0x800)
sendmmsg$alg(r2, &(0x7f0000000180)=[{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000400)="ebe3a0e9796cfd166ce77b9f25c779ee8a47e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e005a15e914ba33aefdae350ed7283dfc26d4bc243df5effc75019034382a42626f9babac59540a23e310192ee", 0x5a}, {&(0x7f0000000280)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456", 0x36}], 0x2}], 0x1, 0x44811)
recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_COMPAT_GET(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x30, 0x0, 0xb, 0x801, 0x0, 0x0, {0x1}, [@NFTA_COMPAT_NAME={0x9, 0x1, 'syz2\x00'}, @NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x10)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901)
move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
chroot(&(0x7f0000000440)='./file0/../file0/../file0/../file0\x00')
r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0)
pivot_root(&(0x7f0000000240)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000080)='./file0\x00')

3m50.888885543s ago: executing program 3 (id=670):
sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={&(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000039c0)=[{&(0x7f0000000600)="447df50ce4033a7b5ad00b83244c00b711803e7cca2504a2600da98efff9e7d67f87b17ffd582b04d632ebd866f28678899ae0d6306cd39420b7b7f78deaaf2908c2a5726f2c50c9eb720e93d3e5b49fae5ab325f9ef326cf8bad0db853cbb8235", 0x61}, {&(0x7f0000000780)="4274aa814c8f6ea8d8db43178dd2f41ef596a3ca465412910e05cba0f5d97e67886d55be18cac95a1aa093479596c3613670aaf2a3b1edc465bedfdb5156035719c0baa8bb8b", 0x46}], 0x2, &(0x7f00000008c0)=ANY=[@ANYBLOB="ac1414bb0000000000000000140000000000000000000000020000000600000000000000d8000000000000000000000007000000072b52000000000a0101020a010100ac14141b640101020a010102ac1414bbac14143ee000000200000000071731ac14143cac1e"], 0x1a0}, 0x41)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58)
syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="040e33050910"], 0xd)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5)
r3 = accept4(r2, 0x0, 0x0, 0x800)
sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0)
ioctl$KVM_RUN(r4, 0xae80, 0x0)

3m49.819523741s ago: executing program 3 (id=677):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000280)=0x4)
ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)=0x3)
ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)=0x2000004)
pwritev(r1, &(0x7f00000005c0)=[{&(0x7f00000001c0)="0021dd", 0x3}], 0x1, 0x280b, 0x800)
sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a32000000002c0003800800014000000000180003801400010076657468315f00005f626f6e64000000080002400000000064000000160a0101000b000000000000010000000900020073797a32000000000900010073797a3000000000300003802c0003801400010067656e657665300000000000000000001400010076657468315f"], 0x104}}, 0x0)

3m49.645186038s ago: executing program 32 (id=677):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000280)=0x4)
ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)=0x3)
ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)=0x2000004)
pwritev(r1, &(0x7f00000005c0)=[{&(0x7f00000001c0)="0021dd", 0x3}], 0x1, 0x280b, 0x800)
sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a32000000002c0003800800014000000000180003801400010076657468315f00005f626f6e64000000080002400000000064000000160a0101000b000000000000010000000900020073797a32000000000900010073797a3000000000300003802c0003801400010067656e657665300000000000000000001400010076657468315f"], 0x104}}, 0x0)

4.524161101s ago: executing program 1 (id=2072):
sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={&(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000039c0)=[{&(0x7f0000000600)="447df50ce4033a7b5ad00b83244c00b711803e7cca2504a2600da98efff9e7d67f87b17ffd582b04d632ebd866f28678899ae0d6306cd39420b7b7f78deaaf2908c2a5726f2c50c9eb720e93d3e5b49fae5ab325f9ef326cf8bad0db853cbb8235b0c803", 0x64}, {&(0x7f0000000780)="4274aa814c8f6ea8d8db43178dd2f41ef596a3ca465412910e05cba0f5d97e67886d55be18cac95a1aa093479596c3613670aaf2a3b1edc465bedfdb5156035719c0baa8bb8b", 0x46}], 0x2, &(0x7f00000008c0)=ANY=[@ANYBLOB="ac1414bb0000000000000000140000000000000000000000020000000600000000000000d8000000000000000000000007000000072b52000000000a0101020a010100ac14141b640101020a010102ac1414bbac14143ee000000200000000071731ac14143cac1e"], 0x1a0}, 0x41)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58)
syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="040e33050910"], 0xd)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5)
r3 = accept4(r2, 0x0, 0x0, 0x800)
sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46", 0xb5}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0)
ioctl$KVM_RUN(r4, 0xae80, 0x0)

4.299952459s ago: executing program 2 (id=2075):
fcntl$lock(0xffffffffffffffff, 0x24, 0x0)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000009, 0x200000005c832, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0xec776000)
r0 = userfaultfd(0x801)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x700})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x4100})

4.211384451s ago: executing program 2 (id=2076):
r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000840)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000040), 0x0, 0x2)
ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000000)={0xf0f045})
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x1000, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100))
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8d, 0x0, &(0x7f0000000540)=[@request_death={0x400c630e, 0x1}, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000680)={@ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/149, 0x0, 0x0, 0x1e}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/233, 0xe9, 0x0, 0x18}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/207, 0xfffffffffffffddc, 0x1, 0x5}}, &(0x7f0000000480)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0})
ioctl$XFS_IOC_INUMBERS(r3, 0x80405880, &(0x7f00000009c0)={{0x4, 0x2, 0x4, 0x4, 0x8}, [{0x276d, 0x6, 0x8, 0x12}]})
r4 = dup3(r0, r2, 0x0)
r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000880), r0)
sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x18, r5, 0x10, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x24000000)
setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c})
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x14b041, 0x2)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r7, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000000700)=ANY=[@ANYBLOB="240000000408010400000000000000000500000206000240886c0000050003002f000000600f8f7fb51e1dbf46e8e914932684360d4f3dc5b26d5e4c056732304633bb92a162c904834cfc7c2ba0fdbe01412f7d669cefde8f04f88cc30225a3bbc00ab391df61474e5cbbd95f51a81d6f1823e406000000242178976a8171362c43c877e6353b34b04a05cd5042636e9f52eaa65808a207ff9ed055067053910b8888890bb2e5937ea9580b8e0f08db8ebfed9e998a2dcd78d2848d3efb889d9af33b0a7cbced3c9842e160486e9baf0e11de5b4810395f5555c6b533e2fa57992f8eea50677f2e9a9998f6102f"], 0x24}}, 0x4040000)
fadvise64(r6, 0x1, 0xffff, 0x2)
r8 = syz_open_dev$radio(&(0x7f0000000080), 0x1, 0x2)
ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000440)=<r9=>0x0)
sched_setscheduler(r9, 0x0, &(0x7f00000004c0))
ioctl$VIDIOC_S_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x9b0906, 0x7fff, '\x00', @p_u8=&(0x7f0000000980)=0x6}})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x20, 0x0, &(0x7f00000001c0)=[@request_death, @clear_death], 0x0, 0x0, 0x0})
lseek(r0, 0x851, 0x0)

4.024587555s ago: executing program 2 (id=2078):
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="04050400c8"], 0x7)
r1 = geteuid()
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3)
sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2)
getrlimit(0x4, 0x0)
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000001a40)=""/102392, 0x18ff8)
r3 = add_key$fscrypt_v1(&(0x7f0000000180), 0x0, &(0x7f0000000100)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff)
keyctl$chown(0x4, r3, r1, 0x0)
keyctl$instantiate(0xc, r3, 0x0, 0x0, 0x0)
pipe(0x0)
read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, <r4=>0x0}, 0x2020)
write$FUSE_INIT(r0, &(0x7f0000004200)={0x50, 0x0, r4}, 0x50)
r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0)
syz_fuse_handle_req(r0, &(0x7f00000042c0), 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
getdents64(r5, 0x0, 0x0)
syz_fuse_handle_req(r0, &(0x7f00000067c0), 0x2000, &(0x7f00000087c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mlock(&(0x7f000036b000/0x1000)=nil, 0x1000)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default user:syz 00000000000000004093 '], 0x2a, 0x0)
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc)
syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000280)=ANY=[@ANYBLOB="120110030000001082057d00400001020301090260000301f140020904"], &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0})

3.99694706s ago: executing program 4 (id=2079):
syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2"], 0x0)
syz_usb_connect$uac2(0x0, 0xe1, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x2a39, 0x3f8c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcf, 0x3, 0x1, 0xd5, 0x80, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x2, 0x20, 0xb}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0xc, 0x27, 0xf4}, [@mixer_unit={0x6, 0x24, 0x4, 0x1, 0xfe, "ae"}, @source_unit={0x8, 0x24, 0xa, 0x7, 0x0, 0x3, 0x7, 0x4}, @input_terminal={0x10, 0x24, 0x2, 0x4, 0x201, 0x4, 0x7, 0x0, 0x7f, 0x1, 0xb, 0x5}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x0, 0x1, 0x3, {0x8, 0x25, 0x1, 0x1, 0x33, 0x7f, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x6, 0x7f, 0xe, 0x3, 0x1d}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x200, 0xdc21, 0x2, "19"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x6, 0x2, 0x7, 0x2, 0xc}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0xde, 0x4, 0x6, 0x5, 'u\t', 'A['}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x4, 0x8000, 0x1, "7fe834803fccc2"}, @as_header={0x10, 0x24, 0x1, 0x1, 0x2, 0x0, 0x3, 0xd, 0x6, 0x9}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x81, 0x40, 0x0, {0x8, 0x25, 0x1, 0x1, 0x33, 0x9, 0xb22}}}}}}}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x6, 0x5, 0x1, 0x8, 0x3}, 0x4a, &(0x7f0000000140)={0x5, 0xf, 0x4a, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0x4, "9d5ba79b623ce8a82a7493797d91f61c"}, @ssp_cap={0x1c, 0x10, 0xa, 0x0, 0x4, 0xe77, 0xf, 0xc, [0xffc030, 0x0, 0xa2430cbc21fc8c01, 0xffffaf]}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0xc, 0x2, 0x7ff}, @wireless={0xb, 0x10, 0x1, 0xc, 0x4, 0x9, 0x8, 0x2, 0x8}]}, 0x9, [{0x1a, &(0x7f00000002c0)=@string={0x1a, 0x3, "9313888efc5e1f2f1d8fda40ff504644a2803d120598d223"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x140c}}, {0xfb, &(0x7f0000000400)=@string={0xfb, 0x3, "e55832fa02a4f69646507b4a3b69248e680e1ecc98b3c834bef7fade6b3db2a878bdfa099fc2543afffc2f11741171f9a892716fce1003042fdcaa124d1004eb2c6fc5620c5132e830cafc87678d31d2352734f2f1c596bbe6154501ad10340858c3008c1613edd04d653822250442f0807cf879f5a8446dcbb64179e57202c9e8862880a5e923c6d410659777fab180b23f765c57924fdfce69af5a275b4afb2a143f7e2c41b653cc2c88c3634c15134d1f18b1cd57800ec049b80e7255a2e748c7728f6b0664f2eda0adfc9f80a43cae76a56dfe0e1ea416960c08af7c06338da4003b76b007330da7624fd522ac03ac7a164eb54e7d3b13"}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x426}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0xc07}}, {0x7c, &(0x7f0000000580)=@string={0x7c, 0x3, "970e24af5092fbbbfdadeecc0fae65610fe6019a909a0cd4f4ff9a1c023e3bd0283953511c9ceb3af4674d7b856bed96a47915f855f9fd6bc2ce44d21ab7a62a7031d93c907167eecc3b5019c733784074ee332322c5e6bdb5315011f4b34bc1564452f355d78995d60524e9379be4a9c5bf8e86a20a6e6725ed"}}, {0x1c, &(0x7f0000000600)=@string={0x1c, 0x3, "d978b31020a95dd117665a2b63421a67af94df56870e59425f5b"}}, {0xef, &(0x7f0000000640)=@string={0xef, 0x3, "76044d5f479d57bf32f727e9dd3c1069104eebb72f93e232fa2af89eca1843dedb223c7c00c78f1393409bd43ce8a82754cfd2e1d3a0df56df60f34299383f54025cd79d6156e6ce88cb9bf328427ab5582723c9d56cee1e4bbf10cdff44253d6547c8cf306f9356eeb73832dcd75f73cbbf52121bfe59703acc7218e55776e133a5e469ba999fd9f810eb6f0557aa2a4462de29f1b12d7cd6cb58d26ff494312bc9a3df3d970d909dd4642ec14c062ebbc2d31af4446b76ca99e9cedf46af0e84f38bb05758b18bd4058a4ee51945b2ab469fc182049bcd95849e75c77824369813ba3ad100804b9ddfd6f3fd"}}, {0x2d, &(0x7f0000000740)=@string={0x2d, 0x3, "ebc6c4150cd6cc977973ac5d4b72e46436fc6d8859448077524d3099c74b77bc06fb707ca6af8332833efc"}}]})

2.583098747s ago: executing program 4 (id=2080):
syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_user_passkey_req={{0x34, 0x6}, {@none}}}, 0x9)
syz_emit_vhci(&(0x7f0000000040)=@HCI_VENDOR_PKT={0xff, 0x80}, 0x2)
r0 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x6, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x3}, 0xe)
writev(r0, &(0x7f0000000380)=[{&(0x7f00000000c0)="9679f529067d154001cbfb32024a", 0xe}, {&(0x7f0000000100)="f823f237714219f35c80afff", 0xc}, {&(0x7f0000000140)="2c1c44b65e5da4ea19b383d6d58886685c839de0b3a32742efb7136b9c2b929c85b5050d061baec4786b9f1b3efd418ac531c9e02849a53239a03c35bf56434fb34abb72fab21c7bbd2b6886b7ab54511c8e63bd6dec62259b6b1b667cda2e10d725c9370ca26338872688b3e5d034e4dd4e9cd614e5bd4876c09963bd2b1681", 0x80}, {&(0x7f0000000480)="af77be2fdebe0ba749d7759d77bbec0438ad7ed962c844d53bbf8668bc69579dd80585a380cd7df923f10a8907a115fc788da689a26155dbdb7d10818b4b550bf336481158fc8c2fce3e04d8a735842d9de658c79c6d8afdca602a05b691a31a1085ce365b00d3873cb9e7774038fed54048e42787ba9a1e8ec104d10c400197180924a7c471d331fa00e9", 0x8b}, {&(0x7f0000000280)="e1420ac76e4031b19e2f712bf9b9d49eb7ae2891bc7843c87180fc4bb96c6690577981909b113d7cbd4c1107663453896da2aa505e13f02c2fa8f1834da2959a3169e9741d00b5962100ac63b0f000aa5de6f7113c073dc3a7d9ce3a0f7e6efc2a81fc2d92f3af281e473bda66a4367d2df05462d5b3ad86571c62085fc5a90c868c916f28ce0d9d4fa98a389671705b2ccb6138660dda9f042a1a7dfcee9565dc46084e2d19b1252750f2487772748ffab7a79d3bbe1c32bd66b66b133aee1a0ac6", 0xc2}], 0x5)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff)
sendmsg$NL80211_CMD_START_AP(r0, 0x0, 0x0)
syz_genetlink_get_family_id$nl80211(0x0, r0)
sendmsg$NL80211_CMD_GET_STATION(r0, 0x0, 0x4000010)
syz_genetlink_get_family_id$nl80211(0x0, r0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000740)={'wlan0\x00', <r1=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, 0x0, 0x8001)
r2 = syz_open_dev$hidraw(0x0, 0x7, 0x242940)
ioctl$OCFS2_IOC_RESVSP64(r2, 0x4030582a, 0x0)
sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(0xffffffffffffffff, &(0x7f0000002480)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000002440)={0x0}, 0x1, 0x0, 0x0, 0x2}, 0x20061080)
preadv(r0, 0x0, 0x0, 0x1, 0x3)
bind$bt_l2cap(0xffffffffffffffff, 0x0, 0xffffff14)
ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0)
setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0)
r3 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000201c1b100c00000000000109022d00010000600009040080020300000009210604000122050009058103"], 0x0)
syz_usb_control_io(r3, 0x0, 0x0)
syz_usb_control_io(r3, &(0x7f0000000640)={0x2c, &(0x7f0000000240)={0x20, 0x6, 0x96, {0x96, 0x5, "bca2d51210c25c15382ae7a4e8ba1788a6ca0ab9ec445236ba66a090a33c2e61557161978b03d71091e69b3c9a4eb9d62618b9aa0835ac0e1d5bb04f7c5a905ebae533483284684c65fc4cec4320c0373593dc21f0a1b2418a16de9f4f67bc91cccd6eb3dcf442ae4ea163a7d8a6ebf32ac711ff5a3ad71f474e5dbab4c29893159bc254e0ac4a69d9cd8db21a154310fc473946"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_START_AP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)={0x48, r5, 0x8, 0xfffffffd, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_HE_BSS_COLOR={0x4}, @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}]]}, 0x48}}, 0x0)
r7 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000004080), 0x1, 0x0)
mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2, 0x50, r7, 0x88df2000)
socket$inet6(0xa, 0x80000, 0x4)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000043c0)={&(0x7f00000040c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000400)={&(0x7f00000005c0)=ANY=[@ANYRES16=r1, @ANYRES8=r5, @ANYBLOB='\x00'/14, @ANYBLOB="cbd8a3b76d1aee0b99446cb5f4492ed0cafebcd578e2", @ANYRESOCT=r3, @ANYRES64=r2], 0x14}}, 0xc040)

2.4802381s ago: executing program 1 (id=2083):
syz_open_dev$tty1(0xc, 0x4, 0x1)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a91010000060a0b0400000000000000000200000064010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6070000004e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af555f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f52766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d04a8e3e29360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f5000000000900010073797a30000000000900020073797a3200"], 0x1b8}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) (async)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x13, r1, 0x0) (async)
write$UHID_INPUT(r1, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5d090932f70e0dd038e7ff7fc6e5539b326d078b089b3431076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b35310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006)

2.243604878s ago: executing program 1 (id=2084):
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r0 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00')
lseek(r0, 0xbb2, 0x1)
getdents64(r0, 0xffffffffffffffff, 0x18)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r1, 0x0, 0x20000800)
sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x8c, r2, 0x5, 0x4, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x3f, 0xe, {{{}, {}, @device_b, @broadcast, @from_mac}, 0x0, @random=0x4, 0xa, @val={0x0, 0x6, @default_ibss_ssid}, @void, @void, @void, @void, @void, @void, @void, @val={0x3c, 0x4, {0x1, 0x7, 0x3c, 0x2}}, @void, @void, @val={0x71, 0x7, {0x1, 0x1, 0x0, 0x1, 0x1, 0xf0, 0x8}}, @void}}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @crypto_settings=[@NL80211_ATTR_CIPHER_SUITE_GROUP={0x8, 0x4a, 0xfac09}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0xa00}, @NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x9300}]]}, 0x8c}}, 0x0)

1.873286929s ago: executing program 1 (id=2087):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000100)={&(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xa, 0x800, 0x0, <r2=>0xffffffffffffffff})
r3 = syz_genetlink_get_family_id$fou(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x38, r3, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @private2}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e21}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x38}, 0x1, 0x0, 0x0, 0x40001}, 0x10)
r4 = socket$igmp6(0xa, 0x3, 0x2)
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}})
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000400)={0xc, 0x0, <r6=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000080)={0x28, 0x2, r6, 0x0, &(0x7f00004f9000/0x3000)=nil, 0x3000, 0xaa5})
ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f00000001c0)={0x28, 0x7, r6, 0x0, &(0x7f000009f000/0x2000)=nil, 0x2000, 0x2})
write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x22f0}, @void, @eth={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @val={@val, {0x8100, 0x0, 0x0, 0x20}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, {0x0, 0x17c1, 0x10, 0x0, @gue={{0x2, 0x1, 0x3, 0x4, 0x100}}}}}}}}, 0x3e)

1.826241268s ago: executing program 0 (id=2088):
syz_io_uring_setup(0x1ec3, &(0x7f0000000080)={0x0, 0x6a63, 0x0, 0x1, 0x386}, &(0x7f0000000000), &(0x7f0000000140), 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0)
ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0)
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0})
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001500))
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000400)=""/185, &(0x7f0000000140)=""/79, 0x9000})
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1)
ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1})
r1 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10)
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0)
ioctl$VHOST_VDPA_GET_AS_NUM(r2, 0x8004af7a, &(0x7f0000000380))
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000000500)=""/4092})
r3 = eventfd2(0x1, 0x80001)
eventfd2(0xe5c, 0x80000)
eventfd(0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f0000000080)={{0x1009, 0x0, 0x0, 0x80, 'syz0\x00', 0x8}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0})
ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000240)={0x0, r3})
r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0)
fcntl$lock(r4, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r4, 0xa9525000)
fsetxattr$trusted_overlay_upper(r4, &(0x7f0000000080), 0x0, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000001240)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_TID_CONFIG(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)={0x2c, r5, 0x1, 0x71bd25, 0x3, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xc0}]}]}]}, 0x2c}}, 0x0)
sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r4, &(0x7f0000001580)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001540)={&(0x7f00000004c0)={0x14, r5, 0x400, 0x70bd2a, 0x25dfdbff, {{}, {@void, @void}}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24040080}, 0x80)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1)

1.733616425s ago: executing program 4 (id=2089):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0)
ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000280)={0x0, 0x19, 0x0, <r2=>0x0})
ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000040)={r2, 0x5, 0x0, 0x0, 0x1, [<r3=>0x0], [0x6, 0xb83, 0x3, 0x17], [0x2, 0x3, 0xfffffffd], [0x4, 0x4, 0x6, 0x7]})
ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f00000000c0)={r3, 0x80000})
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)={0x48, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}}, 0x0)

1.663478588s ago: executing program 4 (id=2090):
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', <r2=>0x0}) (async)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000000c0)={[0x3, 0x5, 0x4, 0x9, 0xfffffffffffffffd, 0x2, 0x8, 0x9, 0x8, 0x3, 0x7, 0x56, 0x3, 0x80000000, 0x5, 0x8000], 0x2000, 0x2001}) (async)
r4 = syz_open_dev$video4linux(&(0x7f0000001140), 0x92e2, 0x1810c0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000000)={0x3, {{0xa, 0x4e21, 0x80, @mcast2}}, {{0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) (async)
writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000080)="580000001400add40500000000000000", 0x10}], 0x1) (async)
r6 = socket(0x1e, 0x5, 0x0)
ioctl$SIOCGETVIFCNT(r6, 0x89e0, &(0x7f0000000080)) (async)
mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4)
getsockopt$inet6_buf(r5, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xf9) (async)
socket(0x10, 0x2, 0x0)
setresuid(0x0, 0x0, 0x0)
statx(r3, &(0x7f0000000240)='./file1\x00', 0x2000, 0x2, &(0x7f0000000480)) (async)
mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x2010080, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYRES8, @ANYRES64, @ANYBLOB="2c666f846e65723e", @ANYRESDEC=0x0, @ANYBLOB=',measure,\x00'])
r7 = openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0)
r8 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$MRT_PIM(r6, 0x0, 0xcf, &(0x7f00000006c0)=0x2, 0x4) (async, rerun: 32)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) (rerun: 32)
sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f00000001c0)={0xa, 0x4e20, 0x80000, @dev={0xfe, 0x80, '\x00', 0x31}, 0xfffffffe}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@flowinfo={{0x14, 0x29, 0xb, 0xff}}], 0x18}, 0x40040c0) (async, rerun: 64)
ioctl$AUTOFS_IOC_EXPIRE(r7, 0x810c9365, &(0x7f0000000300)={{0x1, 0x168}, 0x100, './file0\x00'}) (async, rerun: 64)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r4, 0xc040564a, &(0x7f0000000000)={0x0, 0x0, 0x3012})
r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r9, 0x29, 0xcf, &(0x7f00000000c0)=0x7, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async)
file_setattr(0xffffffffffffff9c, 0x0, &(0x7f0000000340)={0x0, 0x0, 0x800, 0xfffffe01, 0x1ff}, 0x18, 0x1000) (async)
sendto$packet(r0, &(0x7f0000000440)="d21db6d0ea8f22c8593796c23fdfeeaf282e0bb59cc0b843f8080996f37d4d904aca", 0x22, 0x8814, &(0x7f00000002c0)={0x11, 0x88f7, r2, 0x1, 0x0, 0x6, @remote}, 0x14) (async)
syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="121200010304009209044a070048997db600"/27], 0x0)

1.33315658s ago: executing program 1 (id=2091):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000140)={{0xffff1000, 0xeeee8000, 0x4, 0xf6, 0x2, 0xf3, 0xd7, 0x8, 0x7, 0x1, 0x9, 0x5}, {0x50000, 0xc0a0c0f0f5000ded, 0xd, 0x5, 0x3, 0x8, 0x5, 0x0, 0x80, 0xfc, 0xfc, 0x4}, {0x200000, 0x4000, 0xb, 0x6, 0xff, 0x3, 0x0, 0x5, 0xef, 0x24, 0xd5, 0x2}, {0x4000, 0xdddd0000, 0x9, 0x9, 0x8f, 0x4, 0x87, 0xfc, 0xb, 0x1, 0x9, 0x3}, {0xffffffff, 0x0, 0x3, 0x2, 0x6, 0x1, 0x9, 0x2, 0x3, 0x3, 0x0, 0xe4}, {0x200000, 0xffff1002, 0xf, 0x0, 0x3, 0x0, 0xde, 0x9, 0x3, 0x0, 0x4, 0x30}, {0xdddd0000, 0x9000, 0xc, 0x1, 0x8, 0x3, 0x2, 0x6, 0x91, 0x8, 0x9, 0x88}, {0x8000000, 0xeeee0000, 0x10, 0x6, 0xc2, 0x8, 0x6, 0x10, 0x5, 0x3, 0x80, 0x87}, {0x6000, 0x8320}, {0xe9eb89d253be8b8b, 0x9}, 0x50000, 0x0, 0x0, 0x400408, 0x6, 0x8000, 0xeeef0000, [0x6, 0x5, 0x5, 0xe]})
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x5, 0x0, 0x10, 0x0, 0x0, 0x80, 0xc, 0x0, 0x0, 0x7, 0xb, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x1})
ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0xf000, 0x9, 0x9, 0xfffffffe, 0xc0, [{0x2, 0x2, 0x87, '\x00', 0x8}, {0x9, 0x9, 0x2, '\x00', 0xa}, {0x1, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf5, '\x00', 0xf}, {0x9, 0x89, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x3, 0xfe, 0x1, '\x00', 0x8}, {0x7b, 0x5, 0x5, '\x00', 0x8}, {0xd7, 0xd, 0x44, '\x00', 0xa}, {0x0, 0x28, 0x7, '\x00', 0xdc}, {0x40, 0x1, 0x5, '\x00', 0x2}, {0xfe, 0x3, 0x26}, {0xd3, 0xf2, 0xb, '\x00', 0x5}, {0xf, 0x6, 0x10, '\x00', 0x10}, {0x39, 0x2, 0x6, '\x00', 0x8}, {0x89, 0x6, 0xfe, '\x00', 0x4}, {0x5, 0x7, 0x5, '\x00', 0xd}, {0x6, 0x1, 0x3}, {0x0, 0x80, 0x1, '\x00', 0x81}, {0x1, 0xa, 0x80, '\x00', 0x7f}, {0x10, 0x0, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x8}]}})

1.284753094s ago: executing program 2 (id=2092):
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c)
setsockopt$inet6_int(r0, 0x29, 0x3e, &(0x7f0000000040)=0x3, 0x4)
write$binfmt_misc(r0, &(0x7f0000000040), 0xfe46)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0)
sendfile(r2, r3, 0x0, 0x20000023896)
ioctl$TCSBRKP(r2, 0x5425, 0x1)
ioctl$TCSETSW(r1, 0x5435, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)=ANY=[@ANYBLOB="4400000004060104000000000000000007000005050001"], 0x44}, 0x1, 0x0, 0x0, 0xc080}, 0xe821651e0a1b45fc)
ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{0x7fff, 0x2}, {0xa5, 0x4d}, {0xfffd, 0x1}]})
ioctl$F2FS_IOC_DECOMPRESS_FILE(r0, 0xf517, 0x0)
r5 = syz_init_net_socket$llc(0x1a, 0x801, 0x0)
setsockopt$llc_int(r5, 0x10c, 0x8, &(0x7f0000000080), 0x4)
ioctl$KVM_SET_SIGNAL_MASK(r3, 0x4004ae8b, &(0x7f0000000100)={0xa0, "c42544ed994095b92d3f2e5c51c08fc9189b797e440969ffb88f22b09ae78213df7743a7ef37bfb4fb8e690a40371ac6cbb9519ccbee46c2392d3cd554997bb9570a9cc8674913135842461010136877313920ad7b55d950da5a162589ec2a7837e2c05d17eaebcdea51f2144dc3ea015ba68c8d9a3ba9ccc7ce546c794802475c840f3ac4a83292e56d44b97d1137860cb9f943c246e45169fd36e6a41f258a"})

1.023516205s ago: executing program 4 (id=2093):
r0 = add_key$keyring(&(0x7f0000000180), &(0x7f0000000200)={'syz', 0x2}, 0x0, 0x0, 0x0)
add_key(&(0x7f00000000c0)='cifs.spnego\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0xfffffffffffffdfb, r0)
r1 = socket$alg(0x26, 0x5, 0x0)
r2 = syz_open_dev$swradio(&(0x7f0000000500), 0x0, 0x2)
ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f00000000c0)={0xf0f044, 0x7ff})
preadv(r2, &(0x7f0000000600)=[{&(0x7f0000000100)=""/179, 0xb3}], 0x1, 0x9, 0xe000000)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="28000000030605000000000000000000000000050500010007000000090002"], 0x28}, 0x1, 0xfffffff5, 0x0, 0x4000800}, 0x20044052)
bind$alg(r1, &(0x7f0000000500)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(twofish)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="08000000000000000000c6fcacc56f503917a59f000000000000", 0x1a)
r4 = socket$inet6(0xa, 0x3, 0x8000000003c)
bind$inet6(r4, 0x0, 0x0)
read(0xffffffffffffffff, 0x0, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_SET_PMK(r5, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x64, 0x0, 0x408, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x67}}}}, [@NL80211_ATTR_PMK={0x14, 0xfe, "1c5a9d2f483554c01590376a230abfcb"}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x64}, 0x1, 0x0, 0x0, 0x841}, 0x4040010)
r6 = accept$alg(r1, 0x0, 0x0)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000020c0)=ANY=[@ANYBLOB="240000001a000100210000c8067896250200fc003a2a5c247b00000008001b8011"], 0x24}], 0x1}, 0x0)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0)
r8 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x10680)
ioctl$VFAT_IOCTL_READDIR_SHORT(r8, 0x82307202, &(0x7f0000000580)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}])
r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$KVM_GET_SUPPORTED_CPUID(r9, 0x4018aee2, &(0x7f00000000c0)={0x1, 0x0, [{0x40000000, 0x5, 0xc, 0xdb, 0x9, 0x7, 0xfff}]})
setreuid(0x0, 0xee00)
madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x67)
ioprio_get$uid(0x3, 0xee01)
r10 = syz_init_net_socket$llc(0x1a, 0x801, 0x0)
sendmmsg(r10, &(0x7f000000a0c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000)
sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001bc0), 0x0, 0x24041410)
recvmsg(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000340)=""/71, 0x47}], 0x1}, 0x2000)

1.003997295s ago: executing program 4 (id=2094):
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/pm_trace', 0x48182, 0x12c)
write$binfmt_format(r0, &(0x7f0000000200)='-1\x00', 0x2)
syz_usb_connect$uac1(0x0, 0xaa, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902980003010000000904000000010100000a2401000000020102132406040006030000000000000000000000000924030000010000ff0924050000f8431cfd0924030604030204001b24040402", @ANYBLOB="06c9a276"], 0x0)
r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$VIDIOC_S_CROP(r1, 0x4014563c, &(0x7f0000000040)={0xa})
r2 = syz_open_procfs(0x0, &(0x7f0000000200)='projid_map\x00')
fsetxattr$trusted_overlay_opaque(r2, &(0x7f00000001c0), &(0x7f0000000240), 0x2, 0x1)
r3 = syz_pidfd_open(0x0, 0x0)
syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64=r2], 0x0)
fstatfs(r3, &(0x7f0000000280)=""/2)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000440)={0x24, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000640)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="40120000000097e8d69c94bda6275897b85c26c11798adf99509cb86"], 0x0, 0x0, 0x0, 0x0})
r4 = syz_open_dev$swradio(&(0x7f0000000080), 0x1, 0x2)
write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f00000002c0)={0x1, 0x2}, 0x2)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='oom_adj\x00')
r6 = socket$kcm(0xa, 0x1, 0x106)
setuid(0xee00)
r7 = socket$unix(0x1, 0x1, 0x0)
io_setup(0x7, &(0x7f0000000100)=<r8=>0x0)
r9 = eventfd(0x5a21)
io_submit(r8, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x7, 0x3899, r7, 0x0, 0x0, 0x4, 0x0, 0x3, r9}])
sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011)
sendmsg$kcm(r6, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0xfffe, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca)
r10 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r10, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="d80000001c0081064e81f782db44b9040a1d08040000000000000aa1180002000607002603600e12080b0f0000810401a8001605200001400200000803604e0cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee422fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef5d2defd5ccae8d3fb7c27a1059ae31c60e2234d732", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0)
exit(0x0)
readv(r5, &(0x7f0000000040)=[{&(0x7f0000000100)=""/222, 0xde}], 0x1)
msgrcv(0x0, 0x0, 0x4c, 0x3, 0xcf91c1a272fb5b80)
ioctl$VIDIOC_G_FBUF(r4, 0x8030560a, &(0x7f0000000180)={0x30, 0x2, &(0x7f00000000c0)="c3a4135fcd3fd63f0e4964b67f975d35a4da274fc3fad9a9051610a49e05f4e42c6dcd35ff54ccc9e0", {0x7, 0x6a, 0x38414761, 0x0, 0x927f, 0x0, 0x9, 0x2a4119f5}})

969.746213ms ago: executing program 1 (id=2095):
syz_usb_connect$cdc_ecm(0x2, 0x56, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000020000082505a5a4400000000101090244000101000000090400000302060000052406800005240000000d240f0100000000000000000009458103200000000009058202080000000009050302"], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$kcm(0x2, 0x3, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast})
write$tun(r0, &(0x7f0000000240)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x3, 0x2, 0x14}, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x3c, 0x28, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x2200, 0x4e21, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0x1}}}}, 0x36)

623.651697ms ago: executing program 2 (id=2096):
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = dup(r0)
r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
ioctl$int_in(r2, 0x40000000af01, 0x0)
ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000240)={0x1, 0x1, 0x0, &(0x7f0000000200)=""/51, 0x0})
ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000340))
r3 = dup(r0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x14, 0x3c, 0x107, 0x0, 0x0, {0x1, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0xc000)
r4 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt(r4, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = socket$inet_udp(0x2, 0x2, 0x0)
r8 = dup3(r6, r7, 0x80000)
ioctl$SIOCGSTAMPNS(r8, 0x8907, 0x0)
write$cgroup_subtree(r5, &(0x7f0000000080)=ANY=[], 0x10448)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0)
getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000080), &(0x7f0000000100)=0x8)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000000)={0x1, r3})
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f00000003c0)={0x1, r1})

573.782533ms ago: executing program 0 (id=2097):
socket$nl_generic(0x10, 0x3, 0x10)
r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000240)={0x0, "150100000080000000040000000000000000000018d68586ca430e911500000e"})
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000080), 0x8100, 0x0)
ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, <r3=>r1})
sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)={0x20, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_SERVICE={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x8001}, 0x850)
ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00')
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)

464.705757ms ago: executing program 0 (id=2098):
r0 = socket$tipc(0x1e, 0x2, 0x0) (async)
r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async)
fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r1, 0xa9525000) (async)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r2=>0x0)
fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000080), 0x0, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) (async)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async)
timer_settime(r2, 0x1, &(0x7f0000000040), 0x0) (async)
bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x3}, 0x10) (async)
r3 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10)
sendmsg$tipc(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) (async)
r4 = dup3(r0, r3, 0x0) (async)
sendmsg$tipc(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
setsockopt$TIPC_GROUP_LEAVE(r4, 0x10f, 0x88)
socket$inet6_tcp(0xa, 0x1, 0x0)

457.425003ms ago: executing program 2 (id=2099):
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0)
r1 = userfaultfd(0x1)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x3})
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000140)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}})
socket$netlink(0x10, 0x3, 0x0)
syz_usb_connect$uac2(0x5, 0xb7, &(0x7f00000002c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0x2a39, 0x3f8c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa5, 0x3, 0x1, 0x4, 0x100, 0x7f, {0x8, 0xb, 0x1, 0x1, 0x1, 0xa, 0x20, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x7, 0x6, 0x35, 0xb2}, [@extension_unit={0x7, 0x24, 0x9, 0x4, 0xa8cf, 0xa}, @effect_unit={0x9, 0x24, 0x7, 0x5, 0x3, 0x1, [0x3]}, @output_terminal={0xc, 0x24, 0x3, 0x1, 0x304, 0x83, 0x5, 0x0, 0x15, 0x22}, @input_terminal={0x10, 0x24, 0x2, 0x1, 0x401, 0x9, 0x7, 0x93, 0x6f, 0x3, 0x7, 0x1}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@as_header={0x10, 0x24, 0x1, 0x5, 0x5, 0x0, 0x4, 0x5, 0x5, 0x44}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x6, 0x99, 0x80, {0x8, 0x25, 0x1, 0x1, 0x18, 0x1c}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0xe, 0x4, 0x52, {0x8, 0x25, 0x1, 0x4, 0xf, 0x43, 0x3ce}}}}}}}}]}}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0})
r2 = socket$can_bcm(0x1d, 0x2, 0x2)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan1\x00', <r3=>0x0})
connect$can_bcm(r2, &(0x7f0000000280)={0x1d, r3}, 0x10)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
preadv2(r4, &(0x7f0000000a40)=[{&(0x7f0000000080)=""/220, 0xdc}], 0x1, 0x102, 0xe0b, 0x3b)
getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, &(0x7f0000000000), &(0x7f00000001c0)=0x4)
sendmsg$can_bcm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05"], 0x48}}, 0x805)
sendmsg$can_bcm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="06"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x2004c800)

193.794649ms ago: executing program 0 (id=2100):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0)
prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0)
open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
r2 = eventfd(0x227f)
r3 = eventfd(0xd)
ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000180)={0x1, r3})
ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2})
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', <r4=>0x0})
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x34, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_CQM={0x18, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0xc, 0x1, [0xffffffbd, 0xd]}, @NL80211_ATTR_CQM_RSSI_HYST={0x8}]}]}, 0x34}}, 0x4000810)
syz_clone(0x53000500, 0x0, 0x0, 0x0, 0x0, 0x0)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4)

75.661351ms ago: executing program 0 (id=2101):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x1, 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x8528c000)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
read(r4, 0x0, 0x0)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
write$FUSE_NOTIFY_INVAL_ENTRY(r5, &(0x7f0000000f40)={0x123, 0x3, 0x0, {0x6, 0x102, 0x0, 'kfree\x00\ns\xbc\x83L\xca\xc2>\xfd\xb25\x058\xe1\x96\x8dMx\xff\xf0p\xc96\x9e\x8a\x8c\xd9\xf7\xd7\xd8v\x9c\xfd\xc9\x8f0|\xa9\xeaW\x91\x9f\xe7b\x98id\xb1\v\xce0\xd3\xe2\'7\xab\va\xc0\x89\xdf\x99\xa0x\xfc\xfel\x1cu\xb4e\x8f\x9eA[\xb4\x11\x93Y@z\xf39\xff\xa4\xc8EW\xfd\xa2\xeb\xb0@\xe6kD\xab$H\xe0`{n)G5\xa9z\vN5\x1at\xd1\x14f\xa3\xf6\'\xdb\":\xe7g\n\n\xc2\\V\x8f\xa7oRe\x12x/\xdaf\xd1\xcaj\xd3\xdc}\xf0C~\xc6)\x82a\x99\xb0\xaf\x15lO\x9f\'\xe3\xee\x90\"\x95\b\t]\xe9\xd2\xear\x9b\x1b\xa6\x0fG\x16[_\xfa\x81\xfb\x98}R\xdf7\xbd!\v\xb2\x0e\x19\xdfs\x87QJd9\xab\x8dE9U}SFS\a-\xd3\xca$\xdd\xfd\xd3\x1e\xbdgZ\x8b\x90\xec\xe5`\xb2H\xb5\xc2\x94\x8f\x94\xae\xadb|a&\xdc\x95\x8d;\x96\x8f)\x1d-v5\xf6'}}, 0x123)
r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0)
ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x19)
ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000040)=0x33)
ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0x40000071, 0x0, 0x2}]})

0s ago: executing program 0 (id=2102):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100))
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x800, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000001000)={0x73622a85, 0x10b, 0xffffffffffffffff})
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)="5c00000011006b906fdfe1ef704ad931c605876c1d0000007ea60864160af365040012000a002e00000000009ee5179da5a02b9e9171452bc520ae8cc4044ed34445bc24eaba56a705251e6182949afc422e41ebfc50b887934fcbd3", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x200000c0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x60, 0x0, &(0x7f00000003c0)=[@increfs_done={0x40106308, 0x1}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffda0, 0x0, &(0x7f0000000200)={0x91, 0x30, 0x30}}, 0x40}], 0x0, 0x0, 0x0})

kernel console output (not intermixed with test programs):

_acquire+0x6b5/0x2d10
[  593.687901][T10299]  ? __pfx____sys_sendmsg+0x10/0x10
[  593.687936][T10299]  ? __fget_files+0x2a/0x420
[  593.687950][T10299]  ? __fget_files+0x3a6/0x420
[  593.687969][T10299]  __x64_sys_sendmsg+0x1c3/0x2a0
[  593.687988][T10299]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  593.688013][T10299]  ? __pfx_ksys_write+0x10/0x10
[  593.688034][T10299]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  593.688052][T10299]  do_syscall_64+0x15f/0xf80
[  593.688072][T10299]  ? trace_irq_disable+0x3b/0x140
[  593.688097][T10299]  ? clear_bhb_loop+0x40/0x90
[  593.688123][T10299]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  593.688144][T10299] RIP: 0033:0x7fadfc98cdd9
[  593.688164][T10299] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  593.688183][T10299] RSP: 002b:00007fadfabe6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  593.688198][T10299] RAX: ffffffffffffffda RBX: 00007fadfcc05fa0 RCX: 00007fadfc98cdd9
[  593.688207][T10299] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005
[  593.688216][T10299] RBP: 00007fadfabe6090 R08: 0000000000000000 R09: 0000000000000000
[  593.688224][T10299] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  593.688232][T10299] R13: 00007fadfcc06038 R14: 00007fadfcc05fa0 R15: 00007ffffbc7c9d8
[  593.688250][T10299]  </TASK>
[  593.755093][T10301] netlink: 'syz.1.1357': attribute type 10 has an invalid length.
[  593.812975][T10302] netlink: 'syz.1.1357': attribute type 10 has an invalid length.
[  593.845584][T10301] team0: Port device dummy0 added
[  593.865408][T10301] netlink: 'syz.1.1357': attribute type 10 has an invalid length.
[  593.867246][T10303] netlink: 'syz.1.1357': attribute type 10 has an invalid length.
[  593.895029][T10302] team0: Port device dummy0 removed
[  593.916863][T10302] bond0: (slave dummy0): Enslaving as an active interface with an up link
[  593.979132][T10301] bond0: (slave dummy0): Releasing backup interface
[  594.048681][ T5670] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0
[  594.049210][ T5670] Bluetooth: hci3: Injecting HCI hardware error event
[  594.052870][ T5667] Bluetooth: hci3: hardware error 0x00
[  594.055757][T10301] team0: Port device dummy0 added
[  594.183442][T10303] team0: Port device dummy0 removed
[  594.262368][T10303] bond0: (slave dummy0): Enslaving as an active interface with an up link
[  594.387265][T10307] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  594.582930][T10312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  594.583503][T10312] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  594.678696][T10316] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1363'.
[  594.718690][T10316] sctp: [Deprecated]: syz.0.1363 (pid 10316) Use of struct sctp_assoc_value in delayed_ack socket option.
[  594.718690][T10316] Use struct sctp_sack_info instead
[  594.719056][T10316] sctp: [Deprecated]: syz.0.1363 (pid 10316) Use of struct sctp_assoc_value in delayed_ack socket option.
[  594.719056][T10316] Use struct sctp_sack_info instead
[  594.882492][T10318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  594.894059][T10318] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  596.091109][T10327] FAULT_INJECTION: forcing a failure.
[  596.091109][T10327] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  596.091145][T10327] CPU: 0 UID: 0 PID: 10327 Comm: syz.0.1366 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  596.091169][T10327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  596.091181][T10327] Call Trace:
[  596.091190][T10327]  <TASK>
[  596.091199][T10327]  dump_stack_lvl+0xe8/0x150
[  596.091228][T10327]  should_fail_ex+0x46b/0x600
[  596.091257][T10327]  _copy_from_user+0x2d/0xb0
[  596.091287][T10327]  xfrm_user_policy+0x2e7/0x970
[  596.091319][T10327]  ? __pfx_xfrm_user_policy+0x10/0x10
[  596.091347][T10327]  ? apparmor_capable+0x126/0x170
[  596.091371][T10327]  ? bpf_lsm_capable+0x9/0x20
[  596.091394][T10327]  ? security_capable+0x7e/0x2c0
[  596.091429][T10327]  do_ip_setsockopt+0x1aab/0x2ea0
[  596.091466][T10327]  ? __pfx_do_ip_setsockopt+0x10/0x10
[  596.091490][T10327]  ? aa_sk_perm+0x703/0x950
[  596.091516][T10327]  ? __fget_files+0x2a/0x420
[  596.091544][T10327]  ? __pfx_aa_sk_perm+0x10/0x10
[  596.091573][T10327]  ? aa_sock_opt_perm+0x131/0x1f0
[  596.091606][T10327]  ip_setsockopt+0x66/0x110
[  596.091628][T10327]  ? __pfx_sock_common_setsockopt+0x10/0x10
[  596.091655][T10327]  do_sock_setsockopt+0x17c/0x1b0
[  596.091686][T10327]  __x64_sys_setsockopt+0x143/0x1b0
[  596.091716][T10327]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  596.091741][T10327]  do_syscall_64+0x15f/0xf80
[  596.091761][T10327]  ? trace_irq_disable+0x3b/0x140
[  596.091790][T10327]  ? clear_bhb_loop+0x40/0x90
[  596.091816][T10327]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  596.091837][T10327] RIP: 0033:0x7fa9090fcdd9
[  596.091856][T10327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  596.091876][T10327] RSP: 002b:00007fa90734e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  596.091905][T10327] RAX: ffffffffffffffda RBX: 00007fa909375fa0 RCX: 00007fa9090fcdd9
[  596.091921][T10327] RDX: 0008008000000010 RSI: 0000000000000000 RDI: 0000000000000004
[  596.091935][T10327] RBP: 00007fa90734e090 R08: 00000000000000b8 R09: 0000000000000000
[  596.091949][T10327] R10: 0000200000005e40 R11: 0000000000000246 R12: 0000000000000001
[  596.091963][T10327] R13: 00007fa909376038 R14: 00007fa909375fa0 R15: 00007ffc3df65f88
[  596.091992][T10327]  </TASK>
[  596.271695][ T5667] Bluetooth: hci3: Opcode 0x0c03 failed: -110
[  596.280479][T10331] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1367'.
[  596.280501][T10331] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1367'.
[  596.280520][T10331] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1367'.
[  596.379611][ T5764] usb 3-1: USB disconnect, device number 60
[  597.249162][T10352] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1374'.
[  598.184004][T10361] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1378'.
[  599.758738][T10385] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1384'.
[  599.795810][T10385] Invalid argument reading file caps for ./file0
[  599.796508][T10385] netlink: 'syz.0.1384': attribute type 21 has an invalid length.
[  599.796529][T10385] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1384'.
[  599.796611][T10385] netlink: 'syz.0.1384': attribute type 4 has an invalid length.
[  599.796622][T10385] netlink: 'syz.0.1384': attribute type 5 has an invalid length.
[  599.796630][T10385] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1384'.
[  599.873050][T10388] afs: Unknown parameter '��'
[  599.905496][T10388] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[  600.652014][T10395] comedi comedi1: pcm3724: I/O base address not correctly aligned
[  601.379859][T10361] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  601.548533][T10406] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1393'.
[  601.713967][T10412] tmpfs: User quota block hardlimit too large.
[  601.808780][T10414] IPVS: Error connecting to the multicast addr
[  602.018429][T10418] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1398'.
[  602.276906][T10425] overlayfs: failed to clone lowerpath
[  602.277328][T10426] overlayfs: failed to clone lowerpath
[  602.324507][T10426] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1401'.
[  602.324536][T10426] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1401'.
[  603.670347][T10432] Bluetooth: hci3: Opcode 0x0401 failed: -4
[  603.780532][ T5664] usb 3-1: new full-speed USB device number 61 using dummy_hcd
[  603.837547][T10449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  603.838116][T10449] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  603.891316][ T5670] Bluetooth: hci2: command 0x0406 tx timeout
[  603.948016][ T5664] usb 3-1: config 0 has an invalid interface number: 115 but max is 0
[  603.948048][ T5664] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  603.948070][ T5664] usb 3-1: config 0 has no interface number 0
[  603.948101][ T5664] usb 3-1: too many endpoints for config 0 interface 115 altsetting 116: 101, using maximum allowed: 30
[  603.948141][ T5664] usb 3-1: config 0 interface 115 altsetting 116 has 0 endpoint descriptors, different from the interface descriptor's value: 101
[  603.948169][ T5664] usb 3-1: config 0 interface 115 has no altsetting 0
[  604.032185][ T5664] usb 3-1: New USB device found, idVendor=0547, idProduct=2720, bcdDevice=af.55
[  604.032219][ T5664] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  604.032240][ T5664] usb 3-1: Product: syz
[  604.032255][ T5664] usb 3-1: Manufacturer: syz
[  604.032270][ T5664] usb 3-1: SerialNumber: syz
[  604.072578][ T5664] usb 3-1: config 0 descriptor??
[  604.293388][ T5664] cdc_subset 3-1:0.115: probe with driver cdc_subset failed with error -22
[  604.683805][ T5664] usb 3-1: USB disconnect, device number 61
[  604.965561][T10474] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1419'.
[  605.728295][T10480] kvm: requested 1676 ns i8254 timer period limited to 200000 ns
[  605.792714][T10486] FAULT_INJECTION: forcing a failure.
[  605.792714][T10486] name failslab, interval 1, probability 0, space 0, times 0
[  605.792812][T10486] CPU: 1 UID: 0 PID: 10486 Comm: syz.1.1421 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  605.792837][T10486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  605.792850][T10486] Call Trace:
[  605.792859][T10486]  <TASK>
[  605.792868][T10486]  dump_stack_lvl+0xe8/0x150
[  605.792899][T10486]  should_fail_ex+0x46b/0x600
[  605.792931][T10486]  should_failslab+0xa8/0x100
[  605.792962][T10486]  __kmalloc_cache_noprof+0x84/0x690
[  605.792990][T10486]  ? vhost_task_create+0x123/0x380
[  605.793026][T10486]  vhost_task_create+0x123/0x380
[  605.793049][T10486]  ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10
[  605.793078][T10486]  ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10
[  605.793106][T10486]  ? __pfx_vhost_task_create+0x10/0x10
[  605.793136][T10486]  ? __pfx_vhost_task_fn+0x10/0x10
[  605.793162][T10486]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  605.793194][T10486]  ? lockdep_hardirqs_on+0x7a/0x110
[  605.793225][T10486]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  605.793255][T10486]  ? mutex_lock_nested+0x152/0x1d0
[  605.793278][T10486]  ? kvm_mmu_post_init_vm+0x8f/0x2d0
[  605.793312][T10486]  kvm_mmu_post_init_vm+0x147/0x2d0
[  605.793346][T10486]  kvm_arch_vcpu_ioctl_run+0x106/0x20d0
[  605.793384][T10486]  ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10
[  605.793410][T10486]  ? do_raw_spin_lock+0x12b/0x2f0
[  605.793450][T10486]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  605.793476][T10486]  ? lockdep_hardirqs_on+0x7a/0x110
[  605.793505][T10486]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  605.793534][T10486]  ? rt_mutex_slowunlock+0x4a7/0x8b0
[  605.793565][T10486]  ? __pfx_rt_mutex_slowunlock+0x10/0x10
[  605.793596][T10486]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  605.793626][T10486]  ? lockdep_hardirqs_on+0x7a/0x110
[  605.793656][T10486]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  605.793686][T10486]  ? rt_write_unlock+0x190/0x230
[  605.793715][T10486]  kvm_vcpu_ioctl+0xa65/0xfe0
[  605.793750][T10486]  ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[  605.793798][T10486]  ? __fget_files+0x2a/0x420
[  605.793826][T10486]  ? __fget_files+0x2a/0x420
[  605.793849][T10486]  ? __fget_files+0x3a6/0x420
[  605.793871][T10486]  ? __fget_files+0x2a/0x420
[  605.793897][T10486]  ? bpf_lsm_file_ioctl+0x9/0x20
[  605.793921][T10486]  ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[  605.793950][T10486]  __se_sys_ioctl+0xff/0x170
[  605.793992][T10486]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  605.794023][T10486]  do_syscall_64+0x15f/0xf80
[  605.794042][T10486]  ? trace_irq_disable+0x3b/0x140
[  605.794071][T10486]  ? clear_bhb_loop+0x40/0x90
[  605.794097][T10486]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  605.794118][T10486] RIP: 0033:0x7fadfc98cdd9
[  605.794138][T10486] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  605.794157][T10486] RSP: 002b:00007fadfabc5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  605.794181][T10486] RAX: ffffffffffffffda RBX: 00007fadfcc06090 RCX: 00007fadfc98cdd9
[  605.794197][T10486] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
[  605.794211][T10486] RBP: 00007fadfabc5090 R08: 0000000000000000 R09: 0000000000000000
[  605.794225][T10486] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  605.794237][T10486] R13: 00007fadfcc06128 R14: 00007fadfcc06090 R15: 00007ffffbc7c9d8
[  605.794267][T10486]  </TASK>
[  606.063347][   T37] audit: type=1326 audit(1778427806.837:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10489 comm="syz.0.1424" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa9090fcdd9 code=0x0
[  606.119732][T10491] FAULT_INJECTION: forcing a failure.
[  606.119732][T10491] name failslab, interval 1, probability 0, space 0, times 0
[  606.119768][T10491] CPU: 1 UID: 0 PID: 10491 Comm: syz.0.1424 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  606.119792][T10491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  606.119805][T10491] Call Trace:
[  606.119814][T10491]  <TASK>
[  606.119822][T10491]  dump_stack_lvl+0xe8/0x150
[  606.119852][T10491]  should_fail_ex+0x46b/0x600
[  606.119882][T10491]  should_failslab+0xa8/0x100
[  606.119913][T10491]  kmem_cache_alloc_noprof+0x87/0x680
[  606.119939][T10491]  ? do_getname+0x2e/0x250
[  606.119964][T10491]  do_getname+0x2e/0x250
[  606.119985][T10491]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  606.120008][T10491]  __se_sys_rename+0x3a/0x2c0
[  606.120029][T10491]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  606.120051][T10491]  do_syscall_64+0x15f/0xf80
[  606.120071][T10491]  ? trace_irq_disable+0x3b/0x140
[  606.120099][T10491]  ? clear_bhb_loop+0x40/0x90
[  606.120123][T10491]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  606.120143][T10491] RIP: 0033:0x7fa9090fcdd9
[  606.120163][T10491] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  606.120185][T10491] RSP: 002b:00007fa90732d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
[  606.120207][T10491] RAX: ffffffffffffffda RBX: 00007fa909376090 RCX: 00007fa9090fcdd9
[  606.120223][T10491] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000200000000480
[  606.120237][T10491] RBP: 00007fa90732d090 R08: 0000000000000000 R09: 0000000000000000
[  606.120250][T10491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  606.120263][T10491] R13: 00007fa909376128 R14: 00007fa909376090 R15: 00007ffc3df65f88
[  606.120299][T10491]  </TASK>
[  606.274938][T10493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  606.275658][T10493] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  606.285495][T10493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  606.301081][T10493] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  606.457571][T10499] overlayfs: failed to clone upperpath
[  606.580986][ T5667] Bluetooth: hci0: unexpected event for opcode 0x1009
[  606.811767][T10509] 9p: Bad value for 'rfdno'
[  607.042117][ T5667] Bluetooth: hci2: unexpected event for opcode 0x1009
[  607.606093][ T5667] Bluetooth: hci0: unexpected event for opcode 0x1009
[  608.349313][T10537] syzkaller1: entered promiscuous mode
[  608.349342][T10537] syzkaller1: entered allmulticast mode
[  608.504988][ T5632] usb 3-1: new low-speed USB device number 62 using dummy_hcd
[  608.702925][ T5632] usb 3-1: unable to get BOS descriptor or descriptor too short
[  608.704101][ T5632] usb 3-1: config 1 interface 0 altsetting 241 endpoint 0x81 has invalid maxpacket 64, setting to 8
[  608.704144][ T5632] usb 3-1: config 1 interface 0 altsetting 241 endpoint 0x82 is Bulk; changing to Interrupt
[  608.704169][ T5632] usb 3-1: config 1 interface 0 altsetting 241 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[  608.704197][ T5632] usb 3-1: config 1 interface 0 has no altsetting 0
[  608.707507][ T5632] usb 3-1: string descriptor 0 read error: -22
[  608.707603][ T5632] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  608.707618][ T5632] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  608.812731][T10535] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  608.812874][T10535] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  608.813036][T10535] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  608.852428][ T5632] cdc_ether 3-1:1.0: missing cdc ether descriptor
[  609.046920][ T5632] usb 3-1: USB disconnect, device number 62
[  609.677205][ T5667] Bluetooth: hci0: unexpected event for opcode 0x1009
[  610.163796][T10557] input: syz0 as /devices/virtual/input/input33
[  610.840920][T10569] overlay: ./bus is not a directory
[  610.872206][T10571] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1452'.
[  610.930659][T10573] fuse: Bad value for 'fd'
[  610.958806][T10550] syz.1.1446 (10550): drop_caches: 2
[  611.050144][T10577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  611.052181][T10577] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  611.053221][ T5667] Bluetooth: hci0: unexpected event for opcode 0x1009
[  611.217698][T10589] fuse: fd is not a fuse device
[  611.218031][T10589] fuse: fd is not a fuse device
[  611.218336][T10589] fuse: fd is not a fuse device
[  611.218530][T10589] fuse: fd is not a fuse device
[  611.218702][T10589] fuse: fd is not a fuse device
[  611.218846][T10589] fuse: fd is not a fuse device
[  611.221662][T10589] fuse: fd is not a fuse device
[  611.221944][T10589] fuse: fd is not a fuse device
[  611.223992][T10589] fuse: fd is not a fuse device
[  611.224272][T10589] fuse: fd is not a fuse device
[  611.224560][T10589] fuse: fd is not a fuse device
[  611.225322][T10589] fuse: fd is not a fuse device
[  611.225620][T10589] fuse: fd is not a fuse device
[  611.225872][T10589] fuse: fd is not a fuse device
[  611.226288][T10589] fuse: fd is not a fuse device
[  611.226560][T10589] fuse: fd is not a fuse device
[  611.226871][T10589] fuse: fd is not a fuse device
[  611.227128][T10589] fuse: fd is not a fuse device
[  611.227409][T10589] fuse: fd is not a fuse device
[  611.227661][T10589] fuse: fd is not a fuse device
[  611.228012][T10589] fuse: fd is not a fuse device
[  611.228264][T10589] fuse: fd is not a fuse device
[  611.228546][T10589] fuse: fd is not a fuse device
[  611.228794][T10589] fuse: fd is not a fuse device
[  611.229079][T10589] fuse: fd is not a fuse device
[  611.229327][T10589] fuse: fd is not a fuse device
[  611.229620][T10589] fuse: fd is not a fuse device
[  611.229867][T10589] fuse: fd is not a fuse device
[  611.230199][T10589] fuse: fd is not a fuse device
[  611.230456][T10589] fuse: fd is not a fuse device
[  611.234364][T10589] fuse: fd is not a fuse device
[  611.236159][T10589] fuse: fd is not a fuse device
[  611.236414][T10589] fuse: fd is not a fuse device
[  611.238065][T10589] fuse: fd is not a fuse device
[  611.238335][T10589] fuse: fd is not a fuse device
[  611.238674][T10589] fuse: fd is not a fuse device
[  611.238900][T10589] fuse: fd is not a fuse device
[  611.239124][T10589] fuse: fd is not a fuse device
[  611.239364][T10589] fuse: fd is not a fuse device
[  611.239728][T10589] fuse: fd is not a fuse device
[  611.240103][T10589] fuse: fd is not a fuse device
[  611.240365][T10589] fuse: fd is not a fuse device
[  611.240626][T10589] fuse: fd is not a fuse device
[  611.240993][T10589] fuse: fd is not a fuse device
[  611.241322][T10589] fuse: fd is not a fuse device
[  611.241669][T10589] fuse: fd is not a fuse device
[  611.242756][T10589] fuse: fd is not a fuse device
[  611.243597][T10589] fuse: fd is not a fuse device
[  611.243883][T10589] fuse: fd is not a fuse device
[  611.244143][T10589] fuse: fd is not a fuse device
[  611.245394][T10589] fuse: fd is not a fuse device
[  611.245656][T10589] fuse: fd is not a fuse device
[  611.246016][T10589] fuse: fd is not a fuse device
[  611.246271][T10589] fuse: fd is not a fuse device
[  611.246541][T10589] fuse: fd is not a fuse device
[  611.246792][T10589] fuse: fd is not a fuse device
[  611.247214][T10589] fuse: fd is not a fuse device
[  611.247493][T10589] fuse: fd is not a fuse device
[  611.247749][T10589] fuse: fd is not a fuse device
[  611.248006][T10589] fuse: fd is not a fuse device
[  611.248466][T10589] fuse: fd is not a fuse device
[  611.248718][T10589] fuse: fd is not a fuse device
[  611.248993][T10589] fuse: fd is not a fuse device
[  611.249241][T10589] fuse: fd is not a fuse device
[  611.249596][T10589] fuse: fd is not a fuse device
[  611.821164][T10591] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1462'.
[  611.997189][T10599] fuse: fd is not a fuse device
[  612.031278][ T5667] Bluetooth: hci0: unexpected event for opcode 0x1009
[  612.105074][T10605] fuse: fd is not a fuse device
[  612.324007][T10616] fuse: fd is not a fuse device
[  612.375579][   T37] audit: type=1326 audit(1778427812.740:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10617 comm="syz.1.1475" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fadfc98cdd9 code=0x0
[  613.271304][ T5667] Bluetooth: hci2: unexpected event for opcode 0x1009
[  613.862258][T10659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  613.862893][T10659] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  613.894718][T10659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  613.895949][T10659] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  614.114923][T10659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  614.126604][T10659] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  614.181796][T10659] netlink: 822 bytes leftover after parsing attributes in process `syz.1.1485'.
[  614.185835][T10659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  614.186183][T10659] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  614.435117][T10669] vxcan0: tx address claim with dest, not broadcast
[  614.435534][T10669] fuse: fd is not a fuse device
[  614.809136][T10672] 9p: Bad value for 'rfdno'
[  615.342252][T10691] Failed to enqueue queue_pair DETACH event datagram for context (ID=0x0)
[  615.435400][ T5667] Bluetooth: hci0: unexpected event for opcode 0x1009
[  615.536403][T10689] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[  615.882398][T10715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  615.882981][T10715] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  615.886412][T10715] ucma_write: process 884 (syz.1.1508) changed security contexts after opening file descriptor, this is not allowed.
[  616.116629][ T5744] usb 3-1: new high-speed USB device number 63 using dummy_hcd
[  616.288037][ T5744] usb 3-1: Using ep0 maxpacket: 16
[  616.292934][ T5744] usb 3-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4
[  616.292966][ T5744] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  616.292979][ T5744] usb 3-1: Product: syz
[  616.292988][ T5744] usb 3-1: Manufacturer: syz
[  616.292997][ T5744] usb 3-1: SerialNumber: syz
[  616.296623][ T5744] usb 3-1: config 0 descriptor??
[  616.311254][ T5744] gspca_main: spca508-2.14.0 probing 041e:4018
[  616.516425][ T5744] gspca_spca508: reg_read err -32
[  616.517233][ T5744] gspca_spca508: reg_read err -32
[  616.517999][ T5744] gspca_spca508: reg_read err -32
[  616.518578][ T5744] gspca_spca508: reg_read err -32
[  616.736666][T10713] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1507'.
[  616.771278][ T5744] gspca_spca508: reg write: error -71
[  616.771378][ T5744] spca508 3-1:0.0: probe with driver spca508 failed with error -71
[  616.785051][ T5744] usb 3-1: USB disconnect, device number 63
[  617.594213][T10737] overlay: Unknown parameter 'appraise'
[  617.740483][T10746] fuse: fd is not a fuse device
[  617.955364][ T5744] usb 3-1: new high-speed USB device number 64 using dummy_hcd
[  618.104941][ T5744] usb 3-1: Using ep0 maxpacket: 16
[  618.107391][ T5744] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  618.107463][ T5744] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  618.107503][ T5744] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  618.107526][ T5744] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  618.107552][ T5744] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  618.109244][ T5744] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  618.109274][ T5744] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  618.109296][ T5744] usb 3-1: Manufacturer: syz
[  618.125449][ T5744] usb 3-1: config 0 descriptor??
[  618.232384][T10765] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1528'.
[  618.281657][T10767] FAULT_INJECTION: forcing a failure.
[  618.281657][T10767] name failslab, interval 1, probability 0, space 0, times 0
[  618.281695][T10767] CPU: 0 UID: 0 PID: 10767 Comm: syz.1.1529 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  618.281719][T10767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  618.281733][T10767] Call Trace:
[  618.281741][T10767]  <TASK>
[  618.281751][T10767]  dump_stack_lvl+0xe8/0x150
[  618.281779][T10767]  should_fail_ex+0x46b/0x600
[  618.281798][T10767]  should_failslab+0xa8/0x100
[  618.281816][T10767]  __kmalloc_cache_noprof+0x84/0x690
[  618.281842][T10767]  ? alloc_fs_context+0x64/0xd50
[  618.281874][T10767]  alloc_fs_context+0x64/0xd50
[  618.281905][T10767]  ? get_fs_type+0x407/0x480
[  618.281936][T10767]  do_new_mount+0x187/0xd30
[  618.281952][T10767]  ? apparmor_capable+0x126/0x170
[  618.281967][T10767]  ? security_capable+0x7e/0x2c0
[  618.281984][T10767]  ? __pfx_do_new_mount+0x10/0x10
[  618.282002][T10767]  ? ns_capable+0x89/0xe0
[  618.282030][T10767]  ? path_mount+0x690/0x10e0
[  618.282052][T10767]  ? user_path_at+0xd4/0x160
[  618.282082][T10767]  ? user_path_at+0xd4/0x160
[  618.282109][T10767]  __se_sys_mount+0x31d/0x420
[  618.282126][T10767]  ? __pfx___se_sys_mount+0x10/0x10
[  618.282143][T10767]  ? __x64_sys_mount+0x20/0xc0
[  618.282156][T10767]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  618.282178][T10767]  do_syscall_64+0x15f/0xf80
[  618.282198][T10767]  ? trace_irq_disable+0x3b/0x140
[  618.282236][T10767]  ? clear_bhb_loop+0x40/0x90
[  618.282262][T10767]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  618.282280][T10767] RIP: 0033:0x7fadfc98cdd9
[  618.282293][T10767] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  618.282305][T10767] RSP: 002b:00007fadfabe6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  618.282318][T10767] RAX: ffffffffffffffda RBX: 00007fadfcc05fa0 RCX: 00007fadfc98cdd9
[  618.282331][T10767] RDX: 0000200000000080 RSI: 00002000000000c0 RDI: 0000000000000000
[  618.282345][T10767] RBP: 00007fadfabe6090 R08: 0000200000000280 R09: 0000000000000000
[  618.282359][T10767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  618.282373][T10767] R13: 00007fadfcc06038 R14: 00007fadfcc05fa0 R15: 00007ffffbc7c9d8
[  618.282405][T10767]  </TASK>
[  618.425660][ T5744] rc_core: IR keymap rc-hauppauge not found
[  618.425680][ T5744] Registered IR keymap rc-empty
[  618.426553][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.447791][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.481319][ T5744] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0
[  618.485077][ T5744] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input34
[  618.504016][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.532765][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.556622][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.577576][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.596926][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.629078][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.658531][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.673685][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.703889][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.725214][ T5744] mceusb 3-1:0.0: Error: mce write submit urb error = -90
[  618.787399][ T5744] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  618.787504][ T5744] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  618.832370][T10771] FAULT_INJECTION: forcing a failure.
[  618.832370][T10771] name failslab, interval 1, probability 0, space 0, times 0
[  618.832401][T10771] CPU: 0 UID: 0 PID: 10771 Comm: syz.1.1530 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  618.832420][T10771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  618.832430][T10771] Call Trace:
[  618.832436][T10771]  <TASK>
[  618.832444][T10771]  dump_stack_lvl+0xe8/0x150
[  618.832471][T10771]  should_fail_ex+0x46b/0x600
[  618.832497][T10771]  should_failslab+0xa8/0x100
[  618.832521][T10771]  __kmalloc_cache_noprof+0x84/0x690
[  618.832544][T10771]  ? mutex_lock_nested+0x152/0x1d0
[  618.832563][T10771]  ? md_alloc+0x9c/0xf30
[  618.832586][T10771]  ? md_alloc+0x40/0xf30
[  618.832611][T10771]  md_alloc+0x9c/0xf30
[  618.832633][T10771]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  618.832656][T10771]  ? __pfx_md_probe+0x10/0x10
[  618.832675][T10771]  md_alloc_and_put+0x1a/0x1f0
[  618.832694][T10771]  blk_request_module+0x27d/0x2a0
[  618.832721][T10771]  blkdev_get_no_open+0x3f/0xe0
[  618.832743][T10771]  bdev_file_open_by_dev+0xa0/0x240
[  618.832765][T10771]  swsusp_check+0x56/0x490
[  618.832783][T10771]  software_resume+0x51/0x4c0
[  618.832807][T10771]  resume_store+0x333/0x4f0
[  618.832826][T10771]  ? sysfs_file_kobj+0x1a/0x230
[  618.832845][T10771]  ? __pfx_resume_store+0x10/0x10
[  618.832870][T10771]  ? sysfs_file_kobj+0x1a/0x230
[  618.832888][T10771]  ? sysfs_file_kobj+0x1e4/0x230
[  618.832904][T10771]  ? sysfs_kf_write+0x166/0x260
[  618.832924][T10771]  ? __pfx_sysfs_kf_write+0x10/0x10
[  618.832945][T10771]  kernfs_fop_write_iter+0x3b0/0x540
[  618.832983][T10771]  vfs_write+0x629/0xba0
[  618.833019][T10771]  ? __pfx_vfs_write+0x10/0x10
[  618.833047][T10771]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  618.833077][T10771]  ? lockdep_hardirqs_on+0x7a/0x110
[  618.833107][T10771]  ? mutex_lock_nested+0x152/0x1d0
[  618.833129][T10771]  ? fdget_pos+0x252/0x320
[  618.833163][T10771]  ksys_write+0x156/0x270
[  618.833219][T10771]  ? __pfx_ksys_write+0x10/0x10
[  618.833257][T10771]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  618.833279][T10771]  do_syscall_64+0x15f/0xf80
[  618.833297][T10771]  ? trace_irq_disable+0x3b/0x140
[  618.833329][T10771]  ? clear_bhb_loop+0x40/0x90
[  618.833355][T10771]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  618.833376][T10771] RIP: 0033:0x7fadfc98cdd9
[  618.833397][T10771] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  618.833414][T10771] RSP: 002b:00007fadfabe6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  618.833435][T10771] RAX: ffffffffffffffda RBX: 00007fadfcc05fa0 RCX: 00007fadfc98cdd9
[  618.833449][T10771] RDX: 0000000000000012 RSI: 0000200000000180 RDI: 0000000000000003
[  618.833462][T10771] RBP: 00007fadfabe6090 R08: 0000000000000000 R09: 0000000000000000
[  618.833475][T10771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  618.833488][T10771] R13: 00007fadfcc06038 R14: 00007fadfcc05fa0 R15: 00007ffffbc7c9d8
[  618.833522][T10771]  </TASK>
[  618.833545][T10771] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[  618.842348][ T5744] usb 3-1: USB disconnect, device number 64
[  619.171307][T10775] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  619.171861][T10775] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  619.777962][T10788] syzkaller1: entered promiscuous mode
[  619.777981][T10788] syzkaller1: entered allmulticast mode
[  619.858279][ T5632] usb 3-1: new high-speed USB device number 65 using dummy_hcd
[  620.020212][ T5632] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  620.020249][ T5632] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  620.020283][ T5632] usb 3-1: New USB device found, idVendor=18d1, idProduct=9400, bcdDevice= 0.ba
[  620.020297][ T5632] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  620.023070][ T5632] usb 3-1: config 0 descriptor??
[  620.108630][T10790] input: syz0 as /devices/virtual/input/input35
[  620.124826][T10790] IPv6: Can't replace route, no match found
[  620.252491][T10777] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1533'.
[  620.290704][T10792] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1537'.
[  620.292789][T10792] netlink: 'syz.1.1537': attribute type 4 has an invalid length.
[  620.292806][T10792] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.1537'.
[  620.535727][ T5632] stadia 0003:18D1:9400.000E: unknown main item tag 0x0
[  620.535768][ T5632] stadia 0003:18D1:9400.000E: unknown main item tag 0x0
[  620.535798][ T5632] stadia 0003:18D1:9400.000E: unknown main item tag 0x0
[  620.535826][ T5632] stadia 0003:18D1:9400.000E: unknown main item tag 0x0
[  620.535855][ T5632] stadia 0003:18D1:9400.000E: unknown main item tag 0x0
[  620.539765][ T5632] stadia 0003:18D1:9400.000E: hidraw0: USB HID v0.00 Device [HID 18d1:9400] on usb-dummy_hcd.2-1/input0
[  620.539799][ T5632] stadia 0003:18D1:9400.000E: no inputs found
[  620.539815][ T5632] stadia 0003:18D1:9400.000E: force feedback init failed
[  620.748259][ T5744] usb 3-1: USB disconnect, device number 65
[  621.342368][T10806] fuse: Bad value for 'group_id'
[  621.342383][T10806] fuse: Bad value for 'group_id'
[  623.826179][T10838] 9p: Bad value for 'rfdno'
[  624.654684][T10813] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  624.881291][T10855] FAULT_INJECTION: forcing a failure.
[  624.881291][T10855] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  624.881317][T10855] CPU: 1 UID: 0 PID: 10855 Comm: syz.2.1557 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  624.881331][T10855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  624.881339][T10855] Call Trace:
[  624.881344][T10855]  <TASK>
[  624.881350][T10855]  dump_stack_lvl+0xe8/0x150
[  624.881370][T10855]  should_fail_ex+0x46b/0x600
[  624.881389][T10855]  _copy_from_user+0x2d/0xb0
[  624.881409][T10855]  quota_setquota+0x153/0x590
[  624.881430][T10855]  ? __pfx_quota_setquota+0x10/0x10
[  624.881459][T10855]  ? do_quotactl+0x732/0x860
[  624.881480][T10855]  __se_sys_quotactl_fd+0x278/0x410
[  624.881499][T10855]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  624.881513][T10855]  do_syscall_64+0x15f/0xf80
[  624.881525][T10855]  ? trace_irq_disable+0x3b/0x140
[  624.881543][T10855]  ? clear_bhb_loop+0x40/0x90
[  624.881558][T10855]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  624.881570][T10855] RIP: 0033:0x7f5aa532cdd9
[  624.881583][T10855] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  624.881594][T10855] RSP: 002b:00007f5aa3586028 EFLAGS: 00000246 ORIG_RAX: 00000000000001bb
[  624.881608][T10855] RAX: ffffffffffffffda RBX: 00007f5aa55a5fa0 RCX: 00007f5aa532cdd9
[  624.881617][T10855] RDX: 0000000000000000 RSI: ffffffff80000800 RDI: 0000000000000003
[  624.881626][T10855] RBP: 00007f5aa3586090 R08: 0000000000000000 R09: 0000000000000000
[  624.881634][T10855] R10: 00002000000003c0 R11: 0000000000000246 R12: 0000000000000001
[  624.881642][T10855] R13: 00007f5aa55a6038 R14: 00007f5aa55a5fa0 R15: 00007fff527315f8
[  624.881660][T10855]  </TASK>
[  625.174723][T10860] netlink: 'syz.1.1559': attribute type 6 has an invalid length.
[  625.581228][T10872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  625.581814][T10872] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  626.063810][T10876] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1565'.
[  626.501398][ T5844] usb 3-1: new high-speed USB device number 66 using dummy_hcd
[  626.529373][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.529389][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.529484][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.529494][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.529589][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.529599][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.529690][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.529699][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.529788][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.529797][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.529890][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.529899][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.530007][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.530016][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.531696][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.531709][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.531811][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.531820][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.531924][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.531934][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.532040][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.532050][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.532144][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.532153][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.532246][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.532255][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.534035][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.534048][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.534153][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.534162][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.534251][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.534260][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.534350][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.534359][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.534458][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.534466][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.534554][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.534563][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.534651][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.534659][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.534744][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.534753][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.534850][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.534859][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.534948][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.534964][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.535054][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.535062][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.535150][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.535159][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.535250][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.535259][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.535346][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.535355][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.535444][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.535453][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.535558][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.535567][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.537322][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.537334][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.537426][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.537436][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.537528][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.537537][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.537628][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.537637][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.537732][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.537741][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.537828][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.537837][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.537926][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.537935][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.538029][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.538039][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.538152][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.538161][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.538253][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.538263][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.538354][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.538363][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.538453][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.538462][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.538560][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.538569][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.538660][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.538669][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.538774][T10884] binder: BINDER_SET_CONTEXT_MGR already set
[  626.686762][T10889] FAULT_INJECTION: forcing a failure.
[  626.686762][T10889] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  626.686805][T10889] CPU: 1 UID: 0 PID: 10889 Comm: syz.0.1569 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  626.686829][T10889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  626.686842][T10889] Call Trace:
[  626.686851][T10889]  <TASK>
[  626.686859][T10889]  dump_stack_lvl+0xe8/0x150
[  626.686887][T10889]  should_fail_ex+0x46b/0x600
[  626.686917][T10889]  _copy_from_iter+0x1d3/0x1670
[  626.686952][T10889]  ? trace_kmem_cache_alloc+0x29/0xe0
[  626.686979][T10889]  ? __alloc_skb+0x27d/0x7d0
[  626.687003][T10889]  ? __pfx__copy_from_iter+0x10/0x10
[  626.687028][T10889]  ? kmem_cache_alloc_node_noprof+0x27c/0x6e0
[  626.687054][T10889]  ? __alloc_skb+0x27d/0x7d0
[  626.687084][T10889]  ? netlink_sendmsg+0x650/0xb40
[  626.687110][T10889]  ? skb_put+0x11b/0x210
[  626.687139][T10889]  netlink_sendmsg+0x6c0/0xb40
[  626.687174][T10889]  ? __pfx_netlink_sendmsg+0x10/0x10
[  626.687202][T10889]  ? tomoyo_socket_sendmsg_permission+0x1e0/0x300
[  626.687238][T10889]  ? aa_sock_msg_perm+0x122/0x200
[  626.687268][T10889]  ? __pfx_netlink_sendmsg+0x10/0x10
[  626.687294][T10889]  sock_sendmsg_nosec+0x112/0x150
[  626.687319][T10889]  ____sys_sendmsg+0x55c/0x870
[  626.687352][T10889]  ? __pfx_____sys_sendmsg+0x10/0x10
[  626.687388][T10889]  ? import_iovec+0x73/0xa0
[  626.687420][T10889]  ___sys_sendmsg+0x2a5/0x360
[  626.687446][T10889]  ? __lock_acquire+0x6b5/0x2d10
[  626.687471][T10889]  ? __pfx____sys_sendmsg+0x10/0x10
[  626.687530][T10889]  ? __fget_files+0x2a/0x420
[  626.687553][T10889]  ? __fget_files+0x3a6/0x420
[  626.687584][T10889]  __x64_sys_sendmsg+0x1c3/0x2a0
[  626.687615][T10889]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  626.687652][T10889]  ? __pfx_ksys_write+0x10/0x10
[  626.687686][T10889]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  626.687708][T10889]  do_syscall_64+0x15f/0xf80
[  626.687727][T10889]  ? trace_irq_disable+0x3b/0x140
[  626.687755][T10889]  ? clear_bhb_loop+0x40/0x90
[  626.687784][T10889]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  626.687804][T10889] RIP: 0033:0x7fa9090fcdd9
[  626.687823][T10889] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  626.687841][T10889] RSP: 002b:00007fa90734e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  626.687865][T10889] RAX: ffffffffffffffda RBX: 00007fa909375fa0 RCX: 00007fa9090fcdd9
[  626.687880][T10889] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003
[  626.687893][T10889] RBP: 00007fa90734e090 R08: 0000000000000000 R09: 0000000000000000
[  626.687906][T10889] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  626.687919][T10889] R13: 00007fa909376038 R14: 00007fa909375fa0 R15: 00007ffc3df65f88
[  626.687950][T10889]  </TASK>
[  626.783871][T10891] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1570'.
[  626.810698][T10884] binder: 10883:10884 ioctl 4018620d 200000000100 returned -16
[  626.990541][ T5844] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  626.990572][ T5844] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3
[  627.040900][ T5844] usb 3-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40
[  627.040932][ T5844] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  627.040953][ T5844] usb 3-1: Product: syz
[  627.040973][ T5844] usb 3-1: Manufacturer: syz
[  627.040990][ T5844] usb 3-1: SerialNumber: syz
[  627.065194][T10895] x_tables: ip_tables: DNAT.0 target: invalid size 24 (kernel) != (user) 32
[  627.111165][T10897] macvlan0: entered promiscuous mode
[  627.978680][ T5844] usb 3-1: 0:1 : does not exist
[  627.978756][ T5844] usb 3-1: unit 6 not found!
[  627.978773][ T5844] usb 3-1: unit 2 not found!
[  628.047649][ T5844] usb 3-1: USB disconnect, device number 66
[  628.533089][T10909] FAULT_INJECTION: forcing a failure.
[  628.533089][T10909] name failslab, interval 1, probability 0, space 0, times 0
[  628.533124][T10909] CPU: 1 UID: 0 PID: 10909 Comm: syz.2.1577 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  628.533148][T10909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  628.533161][T10909] Call Trace:
[  628.533169][T10909]  <TASK>
[  628.533179][T10909]  dump_stack_lvl+0xe8/0x150
[  628.533209][T10909]  should_fail_ex+0x46b/0x600
[  628.533244][T10909]  should_failslab+0xa8/0x100
[  628.533276][T10909]  kmem_cache_alloc_noprof+0x87/0x680
[  628.533304][T10909]  ? __kvm_mmu_topup_memory_cache+0x1b4/0x610
[  628.533335][T10909]  __kvm_mmu_topup_memory_cache+0x1b4/0x610
[  628.533370][T10909]  mmu_topup_memory_caches+0x21/0x170
[  628.533399][T10909]  kvm_mmu_load+0x9d/0x2320
[  628.533424][T10909]  ? kvm_msr_allowed+0x9a/0x490
[  628.533452][T10909]  ? kvm_msr_allowed+0x9a/0x490
[  628.533488][T10909]  ? vmx_get_rflags+0x280/0x4b0
[  628.533511][T10909]  ? kvm_apic_accept_pic_intr+0x8d/0x130
[  628.533544][T10909]  ? kvm_cpu_has_extint+0xaf/0x340
[  628.533574][T10909]  vcpu_run+0x5c84/0x7860
[  628.533671][T10909]  ? __pfx_vcpu_run+0x10/0x10
[  628.533692][T10909]  ? kvm_arch_vcpu_ioctl_run+0x2e8/0x20d0
[  628.533715][T10909]  ? kvm_arch_vcpu_ioctl_run+0x2e8/0x20d0
[  628.533752][T10909]  kvm_arch_vcpu_ioctl_run+0x11e6/0x20d0
[  628.533788][T10909]  ? kvm_arch_vcpu_ioctl_run+0x2e8/0x20d0
[  628.533810][T10909]  ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10
[  628.533836][T10909]  ? do_raw_spin_lock+0x12b/0x2f0
[  628.533877][T10909]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  628.533910][T10909]  ? lockdep_hardirqs_on+0x7a/0x110
[  628.533941][T10909]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  628.533972][T10909]  ? rt_mutex_slowunlock+0x4a7/0x8b0
[  628.534004][T10909]  ? __pfx_rt_mutex_slowunlock+0x10/0x10
[  628.534031][T10909]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  628.534062][T10909]  ? lockdep_hardirqs_on+0x7a/0x110
[  628.534093][T10909]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  628.534123][T10909]  ? rt_write_unlock+0x190/0x230
[  628.534152][T10909]  kvm_vcpu_ioctl+0xa65/0xfe0
[  628.534188][T10909]  ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[  628.534238][T10909]  ? __fget_files+0x2a/0x420
[  628.534265][T10909]  ? __fget_files+0x2a/0x420
[  628.534289][T10909]  ? __fget_files+0x3a6/0x420
[  628.534311][T10909]  ? __fget_files+0x2a/0x420
[  628.534339][T10909]  ? bpf_lsm_file_ioctl+0x9/0x20
[  628.534362][T10909]  ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[  628.534391][T10909]  __se_sys_ioctl+0xff/0x170
[  628.534420][T10909]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  628.534444][T10909]  do_syscall_64+0x15f/0xf80
[  628.534463][T10909]  ? trace_irq_disable+0x3b/0x140
[  628.534492][T10909]  ? clear_bhb_loop+0x40/0x90
[  628.534517][T10909]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  628.534538][T10909] RIP: 0033:0x7f5aa532cdd9
[  628.534558][T10909] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  628.534577][T10909] RSP: 002b:00007f5aa3586028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  628.534599][T10909] RAX: ffffffffffffffda RBX: 00007f5aa55a5fa0 RCX: 00007f5aa532cdd9
[  628.534615][T10909] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
[  628.534634][T10909] RBP: 00007f5aa3586090 R08: 0000000000000000 R09: 0000000000000000
[  628.534648][T10909] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  628.534661][T10909] R13: 00007f5aa55a6038 R14: 00007f5aa55a5fa0 R15: 00007fff527315f8
[  628.534694][T10909]  </TASK>
[  629.220473][T10928] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1583'.
[  629.335577][T10931] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  629.336214][T10931] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  629.480389][ T5744] usb 3-1: new high-speed USB device number 67 using dummy_hcd
[  629.664001][ T5744] usb 3-1: config 0 has an invalid interface number: 50 but max is 0
[  629.664034][ T5744] usb 3-1: config 0 has no interface number 0
[  629.664065][ T5744] usb 3-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  629.666143][ T5744] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc
[  629.666172][ T5744] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  629.666184][ T5744] usb 3-1: Product: syz
[  629.666193][ T5744] usb 3-1: Manufacturer: syz
[  629.666202][ T5744] usb 3-1: SerialNumber: syz
[  629.669468][ T5744] usb 3-1: config 0 descriptor??
[  629.698230][ T5744] yurex 3-1:0.50: USB YUREX device now attached to Yurex #0
[  630.330901][T10944] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1590'.
[  630.691442][ T5765] IPVS: starting estimator thread 0...
[  630.736728][T10952] IPVS: rr: FWM 3 0x00000003 - no destination available
[  630.784187][T10951] IPVS: using max 12 ests per chain, 28800 per kthread
[  631.198938][ T5664] usb 3-1: USB disconnect, device number 67
[  631.278397][ T5664] yurex 3-1:0.50: USB YUREX #0 now disconnected
[  631.484661][T10968] fuse: fd is not a fuse device
[  631.910245][ T5667] Bluetooth: hci2: unexpected event for opcode 0x1009
[  632.615782][T10987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  632.619530][T10987] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  633.088728][T11002] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1609'.
[  633.160087][T10995] overlayfs: failed to clone upperpath
[  633.207242][T11005] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1610'.
[  633.442042][T11010] IPVS: rr: FWM 3 0x00000003 - no destination available
[  634.221277][ T5816] usb 3-1: new high-speed USB device number 68 using dummy_hcd
[  634.392347][ T5816] usb 3-1: config 0 has an invalid interface number: 116 but max is 0
[  634.392380][ T5816] usb 3-1: config 0 has no interface number 0
[  634.392432][ T5816] usb 3-1: too many endpoints for config 0 interface 116 altsetting 99: 112, using maximum allowed: 30
[  634.392475][ T5816] usb 3-1: config 0 interface 116 altsetting 99 has 0 endpoint descriptors, different from the interface descriptor's value: 112
[  634.392505][ T5816] usb 3-1: config 0 interface 116 has no altsetting 0
[  634.392540][ T5816] usb 3-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d
[  634.392565][ T5816] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  634.458537][T11036] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1619'.
[  634.512101][ T5816] usb 3-1: config 0 descriptor??
[  634.527285][ T1336] ieee802154 phy0 wpan0: encryption failed: -22
[  634.527363][ T1336] ieee802154 phy1 wpan1: encryption failed: -22
[  634.962397][ T5816] hackrf 3-1:0.116: Board ID: 00
[  634.962414][ T5816] hackrf 3-1:0.116: Firmware version: 
[  634.995592][ T5816] hackrf 3-1:0.116: Registered as swradio24
[  634.995630][ T5816] videodev: could not get a free minor
[  634.997824][ T5816] hackrf 3-1:0.116: Failed to register as video device (-23)
[  635.138218][ T5816] hackrf 3-1:0.116: probe with driver hackrf failed with error -23
[  635.186971][   T37] audit: type=1326 audit(1778427834.076:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11028 comm="syz.2.1618" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5aa532cdd9 code=0x0
[  635.396593][T11042] gfs2: not a GFS2 filesystem
[  637.218247][ T5816] usb 3-1: USB disconnect, device number 68
[  637.684240][T11068] dvmrp1: entered allmulticast mode
[  637.687957][T11068] dvmrp1: left allmulticast mode
[  637.825617][T11070] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1627'.
[  637.840898][T11070] usb usb5: Requested nonsensical USBDEVFS_URB_ZERO_PACKET.
[  637.997228][T11076] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input36
[  638.449219][ T5816] usb 3-1: new full-speed USB device number 69 using dummy_hcd
[  638.581820][T11088] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1633'.
[  638.595964][ T5816] usb 3-1: device descriptor read/64, error -71
[  638.844820][ T5816] usb 3-1: new full-speed USB device number 70 using dummy_hcd
[  638.904039][T11096] IPVS: rr: FWM 3 0x00000003 - no destination available
[  638.985405][ T5816] usb 3-1: device descriptor read/64, error -71
[  638.990155][T11098] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1636'.
[  639.070989][T11100] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  639.072147][T11100] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  639.077341][T11100] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  639.079062][T11100] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  639.104602][ T5816] usb usb3-port1: attempt power cycle
[  639.475552][ T5816] usb 3-1: new full-speed USB device number 71 using dummy_hcd
[  639.498154][ T5816] usb 3-1: device descriptor read/8, error -71
[  639.753452][ T5816] usb 3-1: new full-speed USB device number 72 using dummy_hcd
[  639.776598][ T5816] usb 3-1: device descriptor read/8, error -71
[  639.893947][ T5816] usb usb3-port1: unable to enumerate USB device
[  640.815967][T11141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  640.816533][T11141] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  641.161378][T11145] hpfs: Bad magic ... probably not HPFS
[  641.376865][T11152] sctp: [Deprecated]: syz.0.1655 (pid 11152) Use of int in maxseg socket option.
[  641.376865][T11152] Use struct sctp_assoc_value instead
[  641.378141][T11150] tipc: Can't bind to reserved service type 1
[  641.516545][T11156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  641.533178][T11156] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  641.800473][T11160] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1659'.
[  641.804621][ T5667] Bluetooth: hci0: unexpected event for opcode 0x1009
[  642.427852][ T5278] veth0_macvtap: left promiscuous mode
[  643.206046][T11154] syz.2.1658 (11154): drop_caches: 2
[  644.061805][ T5816] usb 3-1: new full-speed USB device number 73 using dummy_hcd
[  644.224033][ T5816] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  644.224069][ T5816] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  644.224112][ T5816] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  644.224137][ T5816] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  644.454908][ T5816] usb 3-1: usb_control_msg returned -32
[  644.454952][ T5816] usbtmc 3-1:16.0: can't read capabilities
[  644.572824][T11239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  644.573442][T11239] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  644.836466][ T5667] Bluetooth: hci2: SCO packet for unknown connection handle 200
[  644.924564][T11249] fuse: fd is not a fuse device
[  645.280937][T11258] FAULT_INJECTION: forcing a failure.
[  645.280937][T11258] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  645.281086][T11258] CPU: 0 UID: 0 PID: 11258 Comm: syz.0.1683 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  645.281111][T11258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  645.281124][T11258] Call Trace:
[  645.281133][T11258]  <TASK>
[  645.281142][T11258]  dump_stack_lvl+0xe8/0x150
[  645.281172][T11258]  should_fail_ex+0x46b/0x600
[  645.281204][T11258]  _copy_from_iter+0x1d3/0x1670
[  645.281239][T11258]  ? trace_kmem_cache_alloc+0x29/0xe0
[  645.281264][T11258]  ? __alloc_skb+0x27d/0x7d0
[  645.281289][T11258]  ? __pfx__copy_from_iter+0x10/0x10
[  645.281313][T11258]  ? kmem_cache_alloc_node_noprof+0x27c/0x6e0
[  645.281338][T11258]  ? __alloc_skb+0x27d/0x7d0
[  645.281368][T11258]  ? netlink_sendmsg+0x650/0xb40
[  645.281396][T11258]  ? skb_put+0x11b/0x210
[  645.281425][T11258]  netlink_sendmsg+0x6c0/0xb40
[  645.281462][T11258]  ? __pfx_netlink_sendmsg+0x10/0x10
[  645.281492][T11258]  ? tomoyo_socket_sendmsg_permission+0x1e0/0x300
[  645.281530][T11258]  ? aa_sock_msg_perm+0x122/0x200
[  645.281561][T11258]  ? __pfx_netlink_sendmsg+0x10/0x10
[  645.281586][T11258]  sock_sendmsg_nosec+0x112/0x150
[  645.281613][T11258]  ____sys_sendmsg+0x55c/0x870
[  645.281648][T11258]  ? __pfx_____sys_sendmsg+0x10/0x10
[  645.281686][T11258]  ? import_iovec+0x73/0xa0
[  645.281719][T11258]  ___sys_sendmsg+0x2a5/0x360
[  645.281747][T11258]  ? __lock_acquire+0x6b5/0x2d10
[  645.281772][T11258]  ? __pfx____sys_sendmsg+0x10/0x10
[  645.281846][T11258]  ? __fget_files+0x2a/0x420
[  645.281871][T11258]  ? __fget_files+0x3a6/0x420
[  645.281903][T11258]  __x64_sys_sendmsg+0x1c3/0x2a0
[  645.281936][T11258]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  645.281974][T11258]  ? __pfx_ksys_write+0x10/0x10
[  645.282014][T11258]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  645.282037][T11258]  do_syscall_64+0x15f/0xf80
[  645.282057][T11258]  ? trace_irq_disable+0x3b/0x140
[  645.282086][T11258]  ? clear_bhb_loop+0x40/0x90
[  645.282111][T11258]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  645.282133][T11258] RIP: 0033:0x7fa9090fcdd9
[  645.282153][T11258] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  645.282171][T11258] RSP: 002b:00007fa90734e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  645.282193][T11258] RAX: ffffffffffffffda RBX: 00007fa909375fa0 RCX: 00007fa9090fcdd9
[  645.282208][T11258] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003
[  645.282222][T11258] RBP: 00007fa90734e090 R08: 0000000000000000 R09: 0000000000000000
[  645.282236][T11258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  645.282249][T11258] R13: 00007fa909376038 R14: 00007fa909375fa0 R15: 00007ffc3df65f88
[  645.282280][T11258]  </TASK>
[  645.805057][ T5667] Bluetooth: hci0: unexpected event for opcode 0x1009
[  646.658311][T11268] syz.0.1687 (11268): drop_caches: 2
[  647.081999][ T5816] usb 3-1: USB disconnect, device number 73
[  647.592235][T11297] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1693'.
[  648.102246][T11307] netlink: 'syz.4.1697': attribute type 4 has an invalid length.
[  648.149894][T11307] netlink: 'syz.4.1697': attribute type 4 has an invalid length.
[  650.812726][T11340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  650.836566][T11340] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  652.024340][T11349] (syz.1.1704,11349,1):ocfs2_get_sector:1714 ERROR: status = -5
[  652.045106][T11349] (syz.1.1704,11349,1):ocfs2_sb_probe:753 ERROR: status = -5
[  652.045139][T11349] (syz.1.1704,11349,1):ocfs2_fill_super:989 ERROR: superblock probe failed!
[  652.045161][T11349] (syz.1.1704,11349,1):ocfs2_fill_super:1177 ERROR: status = -5
[  652.149897][T11358] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1705'.
[  652.976546][T11366] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1709'.
[  652.986950][ T1102] usb 3-1: new high-speed USB device number 74 using dummy_hcd
[  653.149097][ T1102] usb 3-1: Using ep0 maxpacket: 32
[  653.150929][ T1102] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0
[  653.153082][ T1102] usb 3-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=bf.99
[  653.153110][ T1102] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3
[  653.153129][ T1102] usb 3-1: Product: syz
[  653.153138][ T1102] usb 3-1: SerialNumber: syz
[  653.156151][ T1102] usb 3-1: config 0 descriptor??
[  653.266141][T11374] netlink: 176 bytes leftover after parsing attributes in process `syz.4.1711'.
[  653.268740][T11374] netlink: 176 bytes leftover after parsing attributes in process `syz.4.1711'.
[  653.378761][T11364] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  653.379364][T11364] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  653.395876][T11364] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1708'.
[  653.398580][T11364] IPVS: set_ctl: invalid protocol: 51 224.0.0.2:20000
[  653.460166][ T5816] usb 3-1: USB disconnect, device number 74
[  654.079863][T11391] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1715'.
[  654.156416][T11397] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1717'.
[  654.157315][ T5667] Bluetooth: hci0: unexpected event for opcode 0x1009
[  654.378282][ T5844] usb 3-1: new high-speed USB device number 75 using dummy_hcd
[  654.513498][T11403] 9pnet: p9_errstr2errno: server reported unknown error 0x00000000
[  654.517281][ T5844] usb 3-1: device descriptor read/64, error -71
[  654.779455][ T5844] usb 3-1: new high-speed USB device number 76 using dummy_hcd
[  654.918668][ T5844] usb 3-1: device descriptor read/64, error -71
[  655.038300][ T5844] usb usb3-port1: attempt power cycle
[  655.393854][ T5844] usb 3-1: new high-speed USB device number 77 using dummy_hcd
[  655.416204][ T5844] usb 3-1: device descriptor read/8, error -71
[  655.673113][ T5844] usb 3-1: new high-speed USB device number 78 using dummy_hcd
[  655.696837][ T5844] usb 3-1: device descriptor read/8, error -71
[  655.813555][ T5844] usb usb3-port1: unable to enumerate USB device
[  655.877243][T11447] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1728'.
[  655.997688][T11452] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1730'.
[  656.857645][T11480] netlink: 'syz.4.1737': attribute type 4 has an invalid length.
[  657.400923][T11496] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  657.404704][T11496] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  657.405015][T11495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  657.405552][T11495] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  657.604104][T11502] netlink: 'syz.1.1746': attribute type 3 has an invalid length.
[  657.644156][T11504] use of bytesused == 0 is deprecated and will be removed in the future,
[  657.644174][T11504] use the actual size instead.
[  657.657801][T11504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  657.658634][T11504] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  657.767235][ T5765] usb 3-1: new full-speed USB device number 79 using dummy_hcd
[  657.811211][T11506] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  657.943337][ T5765] usb 3-1: New USB device found, idVendor=0582, idProduct=0102, bcdDevice= 0.40
[  657.943415][ T5765] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  657.943437][ T5765] usb 3-1: Product: ,
[  657.943454][ T5765] usb 3-1: Manufacturer: 얱뷡ꋴ뎍쐞서앓斷⼷ₛ뉥囸ร폢齤☬拉팞⏃탴翇Ḹ앦섢✤䇤㩉̉ዣ汒੯⽙鵒眗庛䮼芛捆꧚폔㵍ႆᯞ庅痬섿Č멚✊竦ି䂿ꥵᔯ眚鏌鬲諅䕶鿉❡蹻㒪硽臬ಉ醏ꙻ長ᶋ鈉ꥼ젱뢺ꒃ縶ｖ裹ѧᦖ춇䂚瑷樥噑Ἂ錦㫻ꌢ뼋ﲬ㔿檸쎤煦卄柆肚櫓隦य辪墤묝ᯢ㏂삽艵
[  657.943482][ T5765] usb 3-1: SerialNumber: 톪쇓묢ꠓ죏ꚜ濡ﯚ滇秣龫ở㿸⳻迮䓞
[  657.963675][ T5765] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found
[  658.165421][ T5765] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found
[  658.263143][ T5765] usb 3-1: USB disconnect, device number 79
[  658.491799][T11517] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  658.492411][T11517] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  659.271593][T11533] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1759'.
[  659.506558][T11544] netlink: 'syz.2.1760': attribute type 3 has an invalid length.
[  659.834401][T11551] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  659.950526][ T5667] Bluetooth: hci0: unexpected event for opcode 0x0009
[  660.042906][ T5667] Bluetooth: hci0: unexpected event for opcode 0x1009
[  660.194098][ T5765] usb 3-1: new high-speed USB device number 80 using dummy_hcd
[  660.381454][ T5765] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  660.381509][ T5765] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df
[  660.381524][ T5765] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  660.405804][ T5765] usb 3-1: config 0 descriptor??
[  660.436069][ T5765] pwc: Askey VC010 type 2 USB webcam detected.
[  660.642282][ T5765] pwc: send_video_command error -71
[  660.642302][ T5765] pwc: Failed to set video mode CIF@30 fps; return code = -71
[  660.642432][ T5765] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71
[  660.719348][ T5765] usb 3-1: USB disconnect, device number 80
[  660.961228][T11585] sg_write: data in/out 401372/72 bytes for SCSI command 0x58-- guessing data in;
[  660.961228][T11585]    program syz.1.1777 not setting count and/or reply_len properly
[  661.291278][T11595] ieee802154 phy0 wpan0: encryption failed: -22
[  661.316948][ T5667] Bluetooth: hci2: unexpected event for opcode 0x1009
[  661.495970][T11608] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  661.496515][T11608] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  661.535172][T11610] fuse: fd is not a fuse device
[  661.539422][T11610] netlink: 156 bytes leftover after parsing attributes in process `syz.4.1785'.
[  661.738138][T11608] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  661.738729][T11608] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  662.765909][ T5816] usb 3-1: new high-speed USB device number 81 using dummy_hcd
[  662.943503][ T5816] usb 3-1: Using ep0 maxpacket: 16
[  662.955643][ T5816] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0
[  662.974865][ T5816] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  662.974899][ T5816] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  662.974920][ T5816] usb 3-1: Product: syz
[  662.974937][ T5816] usb 3-1: Manufacturer: syz
[  662.974950][ T5816] usb 3-1: SerialNumber: syz
[  663.021607][ T5816] usb 3-1: config 0 descriptor??
[  663.046088][   T37] audit: type=1326 audit(1778427860.137:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11636 comm="syz.4.1795" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc63a8bcdd9 code=0x0
[  663.073372][ T5816] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  663.073409][ T5816] em28xx 3-1:0.0: DVB interface 0 found: bulk
[  663.261072][T11640] binder: 11639:11640 ioctl c0306201 200000000640 returned -22
[  663.698175][ T5816] em28xx 3-1:0.0: unknown em28xx chip ID (0)
[  663.699546][T11624] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  663.702304][T11624] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  663.994609][   T37] audit: type=1326 audit(1778427861.026:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11648 comm="syz.4.1799" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc63a8bcdd9 code=0x0
[  664.098146][ T5667] Bluetooth: hci0: command 0x0406 tx timeout
[  664.232579][ T5816] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5)
[  664.232614][ T5816] em28xx 3-1:0.0: board has no eeprom
[  664.306177][T11656] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  664.306842][T11656] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  664.587042][ T5816] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94)
[  664.587063][ T5816] em28xx 3-1:0.0: dvb set to bulk mode.
[  664.588124][ T5844] em28xx 3-1:0.0: Binding DVB extension
[  664.994035][T11658] IPv6: NLM_F_CREATE should be specified when creating new route
[  665.089174][T11663] netlink: 'syz.4.1803': attribute type 1 has an invalid length.
[  665.089200][T11663] netlink: 'syz.4.1803': attribute type 4 has an invalid length.
[  665.089215][T11663] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.1803'.
[  665.352599][T11674] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  665.354779][T11674] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  665.434565][T11674] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  665.725757][T11624] em28xx 3-1:0.0: reading from i2c device at 0xe failed (error=-5)
[  665.738936][ T1102] usb 3-1: USB disconnect, device number 81
[  665.750705][ T1102] em28xx 3-1:0.0: Disconnecting em28xx
[  665.767587][ T5844] em28xx 3-1:0.0: Registering input extension
[  665.767759][ T1102] em28xx 3-1:0.0: Closing input extension
[  665.805254][ T1102] em28xx 3-1:0.0: Freeing device
[  666.063668][T11679] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  666.064228][T11679] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  666.345121][ T5670] Bluetooth: hci2: unexpected event for opcode 0x1009
[  666.857213][T11697] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1812'.
[  667.226657][T11709] overlayfs: failed to resolve './file1': -2
[  667.261577][T11709] IPVS: rr: FWM 3 0x00000003 - no destination available
[  667.330365][    C0] IPv4: Oversized IP packet from 172.20.20.24
[  667.353797][ T5670] Bluetooth: hci0: unexpected event for opcode 0x1009
[  667.524776][T11716] trusted_key: syz.2.1819 sent an empty control message without MSG_MORE.
[  668.090118][T11722] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  668.090717][T11722] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  668.099837][T11722] fuse: Bad value for 'user_id'
[  668.099856][T11722] fuse: Bad value for 'user_id'
[  668.339889][T11728] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1822'.
[  668.339908][T11728] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1822'.
[  668.377553][T11716] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  668.545649][T11730] netlink: 5 bytes leftover after parsing attributes in process `syz.2.1823'.
[  668.683578][ T5670] Bluetooth: hci2: unexpected event for opcode 0x1009
[  668.751511][T11735] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1825'.
[  668.751538][T11735] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1825'.
[  669.197164][ T8860] nci: nci_ntf_packet: unknown ntf opcode 0x101
[  669.410610][T11751] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  669.411217][T11751] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  669.416751][ T5664] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0
[  669.416790][ T5664] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0
[  669.416816][ T5664] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0
[  669.416843][ T5664] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0
[  669.416871][ T5664] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0
[  669.416899][ T5664] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0
[  669.416925][ T5664] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0
[  669.416951][ T5664] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0
[  669.416977][ T5664] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0
[  669.417004][ T5664] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0
[  669.430728][ T5664] hid-generic 0000:0000:0000.000F: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[  669.705439][T11755] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1832'.
[  669.705720][T11755] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0'
[  669.924445][T11759] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1833'.
[  669.925450][T11762] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0
[  670.054328][T11766] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  670.054874][T11766] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  670.258621][T11769] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.
[  670.542253][T11779] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  670.571619][T11779] syzkaller1: entered promiscuous mode
[  670.571644][T11779] syzkaller1: entered allmulticast mode
[  670.837129][T11787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  670.837720][T11787] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  671.306538][T11803] syzkaller1: entered allmulticast mode
[  671.545375][T11819] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1855'.
[  671.785525][T11825] FAULT_INJECTION: forcing a failure.
[  671.785525][T11825] name failslab, interval 1, probability 0, space 0, times 0
[  671.785549][T11825] CPU: 0 UID: 0 PID: 11825 Comm: syz.1.1858 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  671.785564][T11825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  671.785571][T11825] Call Trace:
[  671.785576][T11825]  <TASK>
[  671.785582][T11825]  dump_stack_lvl+0xe8/0x150
[  671.785602][T11825]  should_fail_ex+0x46b/0x600
[  671.785623][T11825]  should_failslab+0xa8/0x100
[  671.785651][T11825]  kmem_cache_alloc_noprof+0x87/0x680
[  671.785677][T11825]  ? __kernfs_new_node+0xea/0x980
[  671.785707][T11825]  __kernfs_new_node+0xea/0x980
[  671.785733][T11825]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  671.785759][T11825]  ? lockdep_hardirqs_on+0x7a/0x110
[  671.785780][T11825]  ? __pfx___kernfs_new_node+0x10/0x10
[  671.785795][T11825]  ? kernfs_root+0x1c/0x230
[  671.785812][T11825]  ? kernfs_root+0x1c/0x230
[  671.785826][T11825]  ? kernfs_root+0x1c/0x230
[  671.785839][T11825]  ? kernfs_root+0x1c/0x230
[  671.785856][T11825]  kernfs_new_node+0x102/0x210
[  671.785873][T11825]  __kernfs_create_file+0x4b/0x2e0
[  671.785892][T11825]  sysfs_add_file_mode_ns+0x238/0x300
[  671.785909][T11825]  internal_create_group+0x673/0x1180
[  671.785933][T11825]  ? __pfx_internal_create_group+0x10/0x10
[  671.785951][T11825]  ? loop_update_dio+0x134/0x3a0
[  671.785966][T11825]  loop_configure+0x97a/0xdf0
[  671.785985][T11825]  ? __pfx_loop_configure+0x10/0x10
[  671.786012][T11825]  lo_ioctl+0xaaf/0x1fc0
[  671.786026][T11825]  ? __lock_acquire+0x6b5/0x2d10
[  671.786040][T11825]  ? __pfx_lo_ioctl+0x10/0x10
[  671.786051][T11825]  ? do_raw_spin_lock+0x12b/0x2f0
[  671.786072][T11825]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  671.786091][T11825]  ? __lock_acquire+0x6b5/0x2d10
[  671.786104][T11825]  ? __lock_acquire+0x6b5/0x2d10
[  671.786119][T11825]  ? __lock_acquire+0x6b5/0x2d10
[  671.786132][T11825]  ? __lock_acquire+0x6b5/0x2d10
[  671.786147][T11825]  ? __lock_acquire+0x6b5/0x2d10
[  671.786160][T11825]  ? __lock_acquire+0x6b5/0x2d10
[  671.786176][T11825]  ? unwind_next_frame+0xa6/0x2550
[  671.786201][T11825]  ? unwind_next_frame+0xa6/0x2550
[  671.786217][T11825]  ? is_bpf_text_address+0x26/0x2b0
[  671.786235][T11825]  ? is_bpf_text_address+0x26/0x2b0
[  671.786249][T11825]  ? is_bpf_text_address+0x292/0x2b0
[  671.786261][T11825]  ? is_bpf_text_address+0x26/0x2b0
[  671.786274][T11825]  ? kernel_text_address+0xa5/0xe0
[  671.786288][T11825]  ? __kernel_text_address+0xd/0x30
[  671.786301][T11825]  ? unwind_get_return_address+0x4d/0x90
[  671.786316][T11825]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  671.786333][T11825]  ? arch_stack_walk+0xfb/0x150
[  671.786355][T11825]  ? stack_trace_save+0xa9/0x100
[  671.786371][T11825]  ? __pfx_stack_trace_save+0x10/0x10
[  671.786386][T11825]  ? kasan_save_free_info+0x46/0x50
[  671.786400][T11825]  ? stack_depot_save_flags+0x33/0x810
[  671.786418][T11825]  ? kasan_save_track+0x4f/0x80
[  671.786432][T11825]  ? kasan_save_track+0x3e/0x80
[  671.786445][T11825]  ? kasan_save_free_info+0x46/0x50
[  671.786456][T11825]  ? __kasan_slab_free+0x5c/0x80
[  671.786471][T11825]  ? kfree+0x1c5/0x6c0
[  671.786484][T11825]  ? tomoyo_path_number_perm+0x501/0x630
[  671.786499][T11825]  ? security_file_ioctl+0xc3/0x2a0
[  671.786513][T11825]  ? __se_sys_ioctl+0x47/0x170
[  671.786529][T11825]  ? do_syscall_64+0x15f/0xf80
[  671.786539][T11825]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  671.786554][T11825]  ? __asan_memset+0x22/0x50
[  671.786567][T11825]  ? blk_get_meta_cap+0x16d/0x7a0
[  671.786584][T11825]  ? __pfx_blk_get_meta_cap+0x10/0x10
[  671.786603][T11825]  ? blkdev_common_ioctl+0x14b7/0x3240
[  671.786623][T11825]  ? __pfx_blkdev_common_ioctl+0x10/0x10
[  671.786640][T11825]  ? kasan_quarantine_put+0xbb/0x1f0
[  671.786658][T11825]  ? tomoyo_path_number_perm+0x219/0x630
[  671.786674][T11825]  ? tomoyo_path_number_perm+0x219/0x630
[  671.786691][T11825]  ? do_vfs_ioctl+0x117b/0x1540
[  671.786726][T11825]  ? __pfx_lo_ioctl+0x10/0x10
[  671.786738][T11825]  blkdev_ioctl+0x5e6/0x750
[  671.786756][T11825]  ? __pfx_blkdev_ioctl+0x10/0x10
[  671.786770][T11825]  ? __fget_files+0x2a/0x420
[  671.786795][T11825]  ? bpf_lsm_file_ioctl+0x9/0x20
[  671.786817][T11825]  ? __pfx_blkdev_ioctl+0x10/0x10
[  671.786844][T11825]  __se_sys_ioctl+0xff/0x170
[  671.786872][T11825]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  671.786886][T11825]  do_syscall_64+0x15f/0xf80
[  671.786897][T11825]  ? trace_irq_disable+0x3b/0x140
[  671.786913][T11825]  ? clear_bhb_loop+0x40/0x90
[  671.786928][T11825]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  671.786942][T11825] RIP: 0033:0x7fadfc98cdd9
[  671.786956][T11825] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  671.786967][T11825] RSP: 002b:00007fadfabe6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  671.786981][T11825] RAX: ffffffffffffffda RBX: 00007fadfcc05fa0 RCX: 00007fadfc98cdd9
[  671.786991][T11825] RDX: 0000200000000400 RSI: 0000000000004c0a RDI: 0000000000000004
[  671.786998][T11825] RBP: 00007fadfabe6090 R08: 0000000000000000 R09: 0000000000000000
[  671.787006][T11825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  671.787014][T11825] R13: 00007fadfcc06038 R14: 00007fadfcc05fa0 R15: 00007ffffbc7c9d8
[  671.787031][T11825]  </TASK>
[  671.787842][T11825] loop5: detected capacity change from 0 to 7
[  671.812080][T11327] lo_rw_aio(loop5) starting read with raw_refcnt=0x1, refcnt=2
[  671.812384][T11825] Dev loop5: unable to read RDB block 7
[  671.812425][T11825]  loop5: unable to read partition table
[  671.812637][T11825] loop5: partition table beyond EOD, truncated
[  671.812655][T11825] loop_reread_partitions: partition scan of loop5 (�被x������ ) failed (rc=-5)
[  671.816339][T11824] __loop_clr_fd(loop5) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1
[  672.240615][ T1102] usb 3-1: new high-speed USB device number 82 using dummy_hcd
[  672.455101][ T1102] usb 3-1: Using ep0 maxpacket: 8
[  672.455446][T11830] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  672.456373][T11830] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  672.460343][ T1102] usb 3-1: config 0 has an invalid interface number: 186 but max is 0
[  672.460372][ T1102] usb 3-1: config 0 has no interface number 0
[  672.460417][ T1102] usb 3-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[  672.460440][ T1102] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x1 has an invalid bInterval 18, changing to 8
[  672.460470][ T1102] usb 3-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A
[  672.460496][ T1102] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7
[  672.460521][ T1102] usb 3-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3
[  672.501381][ T1102] usb 3-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5
[  672.501418][ T1102] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  672.501440][ T1102] usb 3-1: Product: syz
[  672.501456][ T1102] usb 3-1: Manufacturer: syz
[  672.501472][ T1102] usb 3-1: SerialNumber: syz
[  672.601603][ T1102] usb 3-1: config 0 descriptor??
[  672.872494][ T1102] iowarrior 3-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0
[  673.055925][T11840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  673.056473][T11840] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  674.142635][T11859] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1867'.
[  674.154353][T11859] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1867'.
[  674.156151][T11859] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1867'.
[  674.156709][T11859] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1867'.
[  674.157381][T11859] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1867'.
[  674.157918][T11859] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1867'.
[  674.212747][T11859] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1867'.
[  674.213353][T11859] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1867'.
[  674.236346][T11859] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1867'.
[  674.370724][T11861] vxfs: unable to read disk superblock at 1
[  674.404430][T11861] vxfs: unable to read disk superblock at 8
[  674.404448][T11861] vxfs: can't find superblock.
[  674.548603][T11865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  674.552570][T11865] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  674.702268][T11865] MINIX-fs: unable to read superblock
[  674.984656][ T1102] usb 3-1: USB disconnect, device number 82
[  675.426317][ T1102] usb 3-1: new high-speed USB device number 83 using dummy_hcd
[  675.597077][ T1102] usb 3-1: Using ep0 maxpacket: 8
[  675.599792][ T1102] usb 3-1: config 0 has an invalid interface number: 186 but max is 0
[  675.599820][ T1102] usb 3-1: config 0 has no interface number 0
[  675.599865][ T1102] usb 3-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[  675.599889][ T1102] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x1 has an invalid bInterval 18, changing to 8
[  675.599918][ T1102] usb 3-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A
[  675.599944][ T1102] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7
[  675.599970][ T1102] usb 3-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3
[  675.603449][ T1102] usb 3-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5
[  675.603479][ T1102] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  675.603501][ T1102] usb 3-1: Product: syz
[  675.603518][ T1102] usb 3-1: Manufacturer: syz
[  675.603533][ T1102] usb 3-1: SerialNumber: syz
[  675.761161][ T1102] usb 3-1: config 0 descriptor??
[  676.012978][ T1102] iowarrior 3-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0
[  676.338378][ T5765] usb 3-1: USB disconnect, device number 83
[  676.522098][T11879] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  676.522814][T11879] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  677.292413][T11887] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  677.307921][T11898] FAULT_INJECTION: forcing a failure.
[  677.307921][T11898] name failslab, interval 1, probability 0, space 0, times 0
[  677.307944][T11898] CPU: 1 UID: 0 PID: 11898 Comm: syz.1.1879 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  677.307959][T11898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  677.307966][T11898] Call Trace:
[  677.307972][T11898]  <TASK>
[  677.307977][T11898]  dump_stack_lvl+0xe8/0x150
[  677.307997][T11898]  should_fail_ex+0x46b/0x600
[  677.308016][T11898]  should_failslab+0xa8/0x100
[  677.308034][T11898]  __kmalloc_node_track_caller_noprof+0xe2/0x7e0
[  677.308052][T11898]  ? __kasan_kmalloc+0x93/0xb0
[  677.308068][T11898]  ? __request_module+0x2ec/0x630
[  677.308084][T11898]  kstrdup+0x42/0x100
[  677.308099][T11898]  __request_module+0x2ec/0x630
[  677.308116][T11898]  ? __pfx___request_module+0x10/0x10
[  677.308130][T11898]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  677.308149][T11898]  ? rt_mutex_slowunlock+0x1cb/0x300
[  677.308169][T11898]  ? blk_request_module+0x125/0x2a0
[  677.308190][T11898]  blk_request_module+0x142/0x2a0
[  677.308209][T11898]  blkdev_get_no_open+0x3f/0xe0
[  677.308225][T11898]  bdev_file_open_by_dev+0xa0/0x240
[  677.308242][T11898]  swsusp_check+0x56/0x490
[  677.308255][T11898]  software_resume+0x51/0x4c0
[  677.308271][T11898]  resume_store+0x333/0x4f0
[  677.308286][T11898]  ? sysfs_file_kobj+0x1a/0x230
[  677.308300][T11898]  ? __pfx_resume_store+0x10/0x10
[  677.308318][T11898]  ? sysfs_file_kobj+0x1a/0x230
[  677.308336][T11898]  ? sysfs_file_kobj+0x1e4/0x230
[  677.308357][T11898]  ? sysfs_kf_write+0x166/0x260
[  677.308382][T11898]  ? __pfx_sysfs_kf_write+0x10/0x10
[  677.308403][T11898]  kernfs_fop_write_iter+0x3b0/0x540
[  677.308438][T11898]  vfs_write+0x629/0xba0
[  677.308466][T11898]  ? __pfx_vfs_write+0x10/0x10
[  677.308484][T11898]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  677.308502][T11898]  ? lockdep_hardirqs_on+0x7a/0x110
[  677.308522][T11898]  ? mutex_lock_nested+0x152/0x1d0
[  677.308535][T11898]  ? fdget_pos+0x252/0x320
[  677.308555][T11898]  ksys_write+0x156/0x270
[  677.308572][T11898]  ? __pfx_ksys_write+0x10/0x10
[  677.308593][T11898]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  677.308613][T11898]  do_syscall_64+0x15f/0xf80
[  677.308624][T11898]  ? trace_irq_disable+0x3b/0x140
[  677.308641][T11898]  ? clear_bhb_loop+0x40/0x90
[  677.308657][T11898]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  677.308669][T11898] RIP: 0033:0x7fadfc98cdd9
[  677.308682][T11898] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  677.308692][T11898] RSP: 002b:00007fadfabe6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  677.308705][T11898] RAX: ffffffffffffffda RBX: 00007fadfcc05fa0 RCX: 00007fadfc98cdd9
[  677.308714][T11898] RDX: 0000000000000012 RSI: 0000200000000180 RDI: 0000000000000003
[  677.308722][T11898] RBP: 00007fadfabe6090 R08: 0000000000000000 R09: 0000000000000000
[  677.308730][T11898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  677.308741][T11898] R13: 00007fadfcc06038 R14: 00007fadfcc05fa0 R15: 00007ffffbc7c9d8
[  677.308759][T11898]  </TASK>
[  677.377655][T11900] netlink: 'syz.1.1881': attribute type 21 has an invalid length.
[  677.377692][T11900] __nla_validate_parse: 56 callbacks suppressed
[  677.377705][T11900] netlink: 164 bytes leftover after parsing attributes in process `syz.1.1881'.
[  677.381165][T11900] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  677.385575][T11900] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  677.467656][ T5632] usb 3-1: new high-speed USB device number 84 using dummy_hcd
[  677.630469][ T5632] usb 3-1: Using ep0 maxpacket: 32
[  677.632565][ T5632] usb 3-1: config 0 has an invalid interface number: 245 but max is 0
[  677.632590][ T5632] usb 3-1: config 0 has no interface number 0
[  677.632632][ T5632] usb 3-1: config 0 interface 245 altsetting 169 has 0 endpoint descriptors, different from the interface descriptor's value: 10
[  677.632661][ T5632] usb 3-1: config 0 interface 245 has no altsetting 0
[  677.632693][ T5632] usb 3-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7
[  677.632718][ T5632] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  677.638306][ T5632] usb 3-1: config 0 descriptor??
[  678.332506][ T5632] usb 3-1: string descriptor 0 read error: -71
[  678.349161][ T5632] gspca_main: sunplus-2.14.0 probing 041e:400b
[  678.349699][ T5632] gspca_sunplus: reg_w_riv err -71
[  678.349794][ T5632] sunplus 3-1:0.245: probe with driver sunplus failed with error -71
[  678.404949][ T5632] usb 3-1: USB disconnect, device number 84
[  679.754499][T11961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  679.763873][T11961] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  680.922029][T11988] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  680.922825][T11988] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  680.959193][T11988] netlink: 92 bytes leftover after parsing attributes in process `syz.1.1910'.
[  680.965834][T11987] input: syz1 as /devices/virtual/input/input38
[  681.138652][T11996] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1914'.
[  681.257173][T12001] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input39
[  681.465498][ T1102] usb 3-1: new high-speed USB device number 85 using dummy_hcd
[  681.657819][ T1102] usb 3-1: Using ep0 maxpacket: 16
[  681.659511][ T1102] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0
[  681.662001][ T1102] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  681.662030][ T1102] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  681.662051][ T1102] usb 3-1: Product: syz
[  681.662066][ T1102] usb 3-1: Manufacturer: syz
[  681.662075][ T1102] usb 3-1: SerialNumber: syz
[  681.665628][ T1102] usb 3-1: config 0 descriptor??
[  681.673247][ T1102] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  681.673281][ T1102] em28xx 3-1:0.0: DVB interface 0 found: bulk
[  682.310911][ T1102] em28xx 3-1:0.0: unknown em28xx chip ID (0)
[  682.693258][T12016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  682.693848][T12016] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  682.729948][T12016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  682.730698][T12016] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  682.820743][ T1102] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5)
[  682.820776][ T1102] em28xx 3-1:0.0: board has no eeprom
[  683.887344][T12027] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  683.889094][T12027] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  683.925844][T11999] em28xx 3-1:0.0: reading from i2c device at 0x0 failed (error=-5)
[  683.925893][T11999] FAULT_INJECTION: forcing a failure.
[  683.925893][T11999] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  683.925911][T11999] CPU: 1 UID: 0 PID: 11999 Comm: syz.2.1915 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  683.925926][T11999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  683.925934][T11999] Call Trace:
[  683.925938][T11999]  <TASK>
[  683.925944][T11999]  dump_stack_lvl+0xe8/0x150
[  683.925963][T11999]  should_fail_ex+0x46b/0x600
[  683.925982][T11999]  _copy_to_user+0x31/0xb0
[  683.926001][T11999]  simple_read_from_buffer+0xe1/0x170
[  683.926019][T11999]  proc_fail_nth_read+0x1be/0x230
[  683.926036][T11999]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  683.926052][T11999]  ? rw_verify_area+0x2ac/0x4e0
[  683.926068][T11999]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  683.926084][T11999]  vfs_read+0x212/0xa80
[  683.926103][T11999]  ? __pfx_vfs_read+0x10/0x10
[  683.926121][T11999]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  683.926139][T11999]  ? lockdep_hardirqs_on+0x7a/0x110
[  683.926157][T11999]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  683.926175][T11999]  ? mutex_lock_nested+0x152/0x1d0
[  683.926188][T11999]  ? fdget_pos+0x252/0x320
[  683.926207][T11999]  ksys_read+0x156/0x270
[  683.926224][T11999]  ? __pfx_ksys_read+0x10/0x10
[  683.926243][T11999]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  683.926256][T11999]  do_syscall_64+0x15f/0xf80
[  683.926268][T11999]  ? trace_irq_disable+0x3b/0x140
[  683.926284][T11999]  ? clear_bhb_loop+0x40/0x90
[  683.926299][T11999]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  683.926311][T11999] RIP: 0033:0x7f5aa52ed60e
[  683.926324][T11999] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[  683.926334][T11999] RSP: 002b:00007f5aa3585fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  683.926347][T11999] RAX: ffffffffffffffda RBX: 00007f5aa35866c0 RCX: 00007f5aa52ed60e
[  683.926356][T11999] RDX: 000000000000000f RSI: 00007f5aa35860a0 RDI: 0000000000000005
[  683.926364][T11999] RBP: 00007f5aa3586090 R08: 0000000000000000 R09: 0000000000000000
[  683.926373][T11999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  683.926380][T11999] R13: 00007f5aa55a6038 R14: 00007f5aa55a5fa0 R15: 00007fff527315f8
[  683.926397][T11999]  </TASK>
[  683.989907][ T1102] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94)
[  683.989936][ T1102] em28xx 3-1:0.0: dvb set to bulk mode.
[  684.003118][ T5765] em28xx 3-1:0.0: Binding DVB extension
[  684.012989][ T1102] usb 3-1: USB disconnect, device number 85
[  684.023637][ T1102] em28xx 3-1:0.0: Disconnecting em28xx
[  684.310214][ T5670] Bluetooth: hci0: unexpected event for opcode 0x1009
[  684.393864][ T5765] em28xx 3-1:0.0: Registering input extension
[  684.399271][ T1102] em28xx 3-1:0.0: Closing input extension
[  684.439088][   T37] audit: type=1800 audit(1778427880.148:138): pid=12042 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1929" name="bus" dev="tmpfs" ino=1778 res=0 errno=0
[  684.524785][ T1102] em28xx 3-1:0.0: Freeing device
[  684.953926][T12048] tipc: Started in network mode
[  684.953938][T12048] tipc: Node identity , cluster identity 4711
[  684.953990][T12048] tipc: Failed to obtain node identity
[  684.954004][T12048] tipc: Enabling of bearer <eth:gre0> rejected, failed to enable media
[  684.996693][T12048] IPVS: Error connecting to the multicast addr
[  685.075732][T12054] netlink: 'syz.1.1932': attribute type 46 has an invalid length.
[  685.075749][T12054] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1932'.
[  685.077439][T12054] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  685.077980][T12054] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  685.151069][T12057] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'.
[  685.185860][T12057] fuse: fd is not a fuse device
[  685.270769][ T1102] usb 3-1: new full-speed USB device number 86 using dummy_hcd
[  685.433366][ T1102] usb 3-1: unable to read config index 0 descriptor/start: -61
[  685.433404][ T1102] usb 3-1: can't read configurations, error -61
[  685.580753][ T1102] usb 3-1: new full-speed USB device number 87 using dummy_hcd
[  685.753971][ T1102] usb 3-1: unable to read config index 0 descriptor/start: -61
[  685.754012][ T1102] usb 3-1: can't read configurations, error -61
[  685.761368][ T1102] usb usb3-port1: attempt power cycle
[  685.925831][T12068] netlink: 'syz.4.1937': attribute type 6 has an invalid length.
[  685.925849][T12068] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1937'.
[  686.034119][T12074] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1939'.
[  686.062823][ T5670] Bluetooth: hci0: unexpected event for opcode 0x1804
[  686.136581][ T1102] usb 3-1: new full-speed USB device number 88 using dummy_hcd
[  686.161801][ T1102] usb 3-1: unable to read config index 0 descriptor/start: -61
[  686.161841][ T1102] usb 3-1: can't read configurations, error -61
[  686.328986][ T1102] usb 3-1: new full-speed USB device number 89 using dummy_hcd
[  686.364412][ T1102] usb 3-1: unable to read config index 0 descriptor/start: -61
[  686.364455][ T1102] usb 3-1: can't read configurations, error -61
[  686.364811][ T1102] usb usb3-port1: unable to enumerate USB device
[  686.884386][T12080] vxcan0: tx address claim with different name
[  687.417950][T12091] 9p: Bad value for 'rfdno'
[  687.620211][T12098] tmpfs: Unknown parameter 'ncks�p'
[  687.622109][T12099] tmpfs: Unknown parameter '18446744073709551615'
[  688.018694][T12104] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1952'.
[  688.468877][T12119] netlink: 'syz.4.1958': attribute type 46 has an invalid length.
[  688.652386][T12123] netlink: 'syz.1.1959': attribute type 21 has an invalid length.
[  688.652403][T12123] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1959'.
[  688.684662][T12123] binder: 12122:12123 ioctl c018620c 200000000140 returned -22
[  688.698959][ T1102] usb 3-1: new full-speed USB device number 90 using dummy_hcd
[  688.744468][T12127] fuse: Unknown parameter '>c����mgj�s��t���;��H��'
[  688.809114][   T37] audit: type=1326 audit(1778427884.245:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12131 comm="syz.4.1963" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc63a8bcdd9 code=0x0
[  688.883388][T12137] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  688.886390][T12137] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  688.889747][ T1102] usb 3-1: New USB device found, idVendor=0582, idProduct=0102, bcdDevice= 0.40
[  688.889776][ T1102] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  688.889797][ T1102] usb 3-1: Product: ,
[  688.889812][ T1102] usb 3-1: Manufacturer: 얱뷡ꋴ뎍쐞서앓斷⼷ₛ뉥囸ร폢齤☬拉팞⏃탴翇Ḹ앦섢✤䇤㩉̉ዣ汒੯⽙鵒眗庛䮼芛捆꧚폔㵍ႆᯞ庅痬섿Č멚✊竦ି䂿ꥵᔯ眚鏌鬲諅䕶鿉❡蹻㒪硽臬ಉ醏ꙻ長ᶋ鈉ꥼ젱뢺ꒃ縶ｖ裹ѧᦖ춇䂚瑷樥噑Ἂ錦㫻ꌢ뼋ﲬ㔿檸쎤煦卄柆肚櫓隦य辪墤묝ᯢ㏂삽艵
[  688.889850][ T1102] usb 3-1: SerialNumber: 톪쇓묢ꠓ죏ꚜ濡ﯚ滇秣龫ở㿸⳻迮䓞
[  688.989660][ T1102] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found
[  689.199622][ T1102] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found
[  689.281666][ T1102] usb 3-1: USB disconnect, device number 90
[  689.641854][T12143] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  689.643550][T12143] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  689.668180][T12143] loop5: detected capacity change from 0 to 7
[  689.673574][ T8860] lo_rw_aio(loop5) starting read with raw_refcnt=0x1, refcnt=2
[  689.673833][T12143] Dev loop5: unable to read RDB block 7
[  689.673860][T12143]  loop5: AHDI p1 p2 p3 p4
[  689.673889][T12143] loop5: partition table partially beyond EOD, truncated
[  689.674170][T12143] loop5: p1 start 5913328 is beyond EOD, truncated
[  689.674190][T12143] loop5: p2 start 600744595 is beyond EOD, truncated
[  689.674208][T12143] loop5: p3 start 2529214231 is beyond EOD, truncated
[  689.681626][T12141] __loop_clr_fd(loop5) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1
[  689.858253][ T5670] Bluetooth: hci2: unexpected event for opcode 0x1009
[  689.896707][ T5670] Bluetooth: hci0: unexpected event for opcode 0x1009
[  690.020038][ T5670] Bluetooth: hci0: unexpected event for opcode 0x2035
[  690.291249][T12164] FAULT_INJECTION: forcing a failure.
[  690.291249][T12164] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  690.291273][T12164] CPU: 0 UID: 0 PID: 12164 Comm: syz.1.1975 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  690.291288][T12164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  690.291296][T12164] Call Trace:
[  690.291301][T12164]  <TASK>
[  690.291307][T12164]  dump_stack_lvl+0xe8/0x150
[  690.291326][T12164]  should_fail_ex+0x46b/0x600
[  690.291345][T12164]  _copy_to_user+0x31/0xb0
[  690.291364][T12164]  simple_read_from_buffer+0xe1/0x170
[  690.291382][T12164]  proc_fail_nth_read+0x1be/0x230
[  690.291399][T12164]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  690.291416][T12164]  ? rw_verify_area+0x2ac/0x4e0
[  690.291432][T12164]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  690.291447][T12164]  vfs_read+0x212/0xa80
[  690.291467][T12164]  ? __pfx_vfs_read+0x10/0x10
[  690.291484][T12164]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  690.291503][T12164]  ? lockdep_hardirqs_on+0x7a/0x110
[  690.291522][T12164]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  690.291539][T12164]  ? mutex_lock_nested+0x152/0x1d0
[  690.291553][T12164]  ? fdget_pos+0x252/0x320
[  690.291572][T12164]  ksys_read+0x156/0x270
[  690.291596][T12164]  ? __pfx_ksys_read+0x10/0x10
[  690.291629][T12164]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  690.291651][T12164]  do_syscall_64+0x15f/0xf80
[  690.291670][T12164]  ? trace_irq_disable+0x3b/0x140
[  690.291698][T12164]  ? clear_bhb_loop+0x40/0x90
[  690.291714][T12164]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  690.291727][T12164] RIP: 0033:0x7fadfc94d60e
[  690.291740][T12164] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[  690.291752][T12164] RSP: 002b:00007fadfabe5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  690.291766][T12164] RAX: ffffffffffffffda RBX: 00007fadfabe66c0 RCX: 00007fadfc94d60e
[  690.291775][T12164] RDX: 000000000000000f RSI: 00007fadfabe60a0 RDI: 0000000000000008
[  690.291784][T12164] RBP: 00007fadfabe6090 R08: 0000000000000000 R09: 0000000000000000
[  690.291791][T12164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  690.291799][T12164] R13: 00007fadfcc06038 R14: 00007fadfcc05fa0 R15: 00007ffffbc7c9d8
[  690.291816][T12164]  </TASK>
[  690.558573][T12166] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  690.559130][T12166] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  690.613309][T12169] netlink: 'syz.4.1977': attribute type 2 has an invalid length.
[  690.613332][T12169] netlink: 'syz.4.1977': attribute type 8 has an invalid length.
[  690.613347][T12169] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1977'.
[  691.122983][T12175] FAULT_INJECTION: forcing a failure.
[  691.122983][T12175] name failslab, interval 1, probability 0, space 0, times 0
[  691.123007][T12175] CPU: 1 UID: 0 PID: 12175 Comm: syz.2.1979 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
[  691.123028][T12175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  691.123036][T12175] Call Trace:
[  691.123041][T12175]  <TASK>
[  691.123046][T12175]  dump_stack_lvl+0xe8/0x150
[  691.123067][T12175]  should_fail_ex+0x46b/0x600
[  691.123085][T12175]  should_failslab+0xa8/0x100
[  691.123104][T12175]  kmem_cache_alloc_node_noprof+0x8f/0x6e0
[  691.123120][T12175]  ? __pfx_rt_mutex_slowunlock+0x10/0x10
[  691.123136][T12175]  ? dup_task_struct+0x52/0x840
[  691.123156][T12175]  dup_task_struct+0x52/0x840
[  691.123172][T12175]  ? rt_spin_unlock+0x160/0x200
[  691.123189][T12175]  copy_process+0x89b/0x4450
[  691.123219][T12175]  ? __pfx_copy_process+0x10/0x10
[  691.123242][T12175]  vhost_task_create+0x1f9/0x380
[  691.123256][T12175]  ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10
[  691.123273][T12175]  ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10
[  691.123290][T12175]  ? __pfx_vhost_task_create+0x10/0x10
[  691.123307][T12175]  ? __pfx_vhost_task_fn+0x10/0x10
[  691.123322][T12175]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  691.123340][T12175]  ? lockdep_hardirqs_on+0x7a/0x110
[  691.123358][T12175]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  691.123376][T12175]  ? mutex_lock_nested+0x152/0x1d0
[  691.123390][T12175]  ? kvm_mmu_post_init_vm+0x8f/0x2d0
[  691.123410][T12175]  kvm_mmu_post_init_vm+0x147/0x2d0
[  691.123429][T12175]  kvm_arch_vcpu_ioctl_run+0x106/0x20d0
[  691.123450][T12175]  ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10
[  691.123465][T12175]  ? do_raw_spin_lock+0x12b/0x2f0
[  691.123487][T12175]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  691.123505][T12175]  ? lockdep_hardirqs_on+0x7a/0x110
[  691.123522][T12175]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  691.123540][T12175]  ? rt_mutex_slowunlock+0x4a7/0x8b0
[  691.123560][T12175]  ? __pfx_rt_mutex_slowunlock+0x10/0x10
[  691.123576][T12175]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  691.123594][T12175]  ? lockdep_hardirqs_on+0x7a/0x110
[  691.123611][T12175]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  691.123629][T12175]  ? rt_write_unlock+0x190/0x230
[  691.123646][T12175]  kvm_vcpu_ioctl+0xa65/0xfe0
[  691.123666][T12175]  ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[  691.123692][T12175]  ? __fget_files+0x2a/0x420
[  691.123708][T12175]  ? __fget_files+0x2a/0x420
[  691.123721][T12175]  ? __fget_files+0x3a6/0x420
[  691.123734][T12175]  ? __fget_files+0x2a/0x420
[  691.123749][T12175]  ? bpf_lsm_file_ioctl+0x9/0x20
[  691.123765][T12175]  ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[  691.123782][T12175]  __se_sys_ioctl+0xff/0x170
[  691.123799][T12175]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  691.123812][T12175]  do_syscall_64+0x15f/0xf80
[  691.123824][T12175]  ? trace_irq_disable+0x3b/0x140
[  691.123841][T12175]  ? clear_bhb_loop+0x40/0x90
[  691.123855][T12175]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  691.123868][T12175] RIP: 0033:0x7f5aa532cdd9
[  691.123880][T12175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  691.123892][T12175] RSP: 002b:00007f5aa3586028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  691.123906][T12175] RAX: ffffffffffffffda RBX: 00007f5aa55a5fa0 RCX: 00007f5aa532cdd9
[  691.123915][T12175] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006
[  691.123923][T12175] RBP: 00007f5aa3586090 R08: 0000000000000000 R09: 0000000000000000
[  691.123932][T12175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  691.123939][T12175] R13: 00007f5aa55a6038 R14: 00007f5aa55a5fa0 R15: 00007fff527315f8
[  691.123957][T12175]  </TASK>
[  691.287823][ T5670] Bluetooth: hci0: unexpected event for opcode 0x1009
[  691.561677][T12182] /dev/nullb0: Can't open blockdev
[  691.594478][T12183] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1982'.
[  691.659385][T12187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  691.659917][T12187] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  691.663677][T12187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  691.664232][T12187] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  692.189147][ T5670] Bluetooth: hci0: unexpected event for opcode 0x1009
[  692.707055][T12210] syzkaller1: entered promiscuous mode
[  692.707073][T12210] syzkaller1: entered allmulticast mode
[  692.734074][T12210] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  692.734680][T12210] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  693.269962][ T5670] Bluetooth: hci2: unexpected event for opcode 0x1009
[  693.679018][T12226] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2000'.
[  694.331471][T12240] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  694.333006][T12240] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  694.862152][ T5670] Bluetooth: hci0: unexpected event for opcode 0x1009
[  694.973905][T12266] binder: 12265:12266 ioctl 89f1 200000000540 returned -22
[  696.376871][ T5632] usb 3-1: new high-speed USB device number 91 using dummy_hcd
[  696.537211][ T5632] usb 3-1: Using ep0 maxpacket: 8
[  696.540394][ T5632] usb 3-1: config 7 has an invalid interface number: 200 but max is 1
[  696.540421][ T5632] usb 3-1: config 7 contains an unexpected descriptor of type 0x2, skipping
[  696.540441][ T5632] usb 3-1: config 7 contains an unexpected descriptor of type 0x2, skipping
[  696.540470][ T5632] usb 3-1: config 7 has 1 interface, different from the descriptor's value: 2
[  696.540483][ T5632] usb 3-1: config 7 has no interface number 0
[  696.540511][ T5632] usb 3-1: config 7 interface 200 altsetting 128 endpoint 0x1 has invalid maxpacket 1023, setting to 64
[  696.540527][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has an invalid descriptor for endpoint zero, skipping
[  696.540540][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0x5, skipping
[  696.540554][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0x5, skipping
[  696.540567][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has an invalid descriptor for endpoint zero, skipping
[  696.540579][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0x5, skipping
[  696.540594][ T5632] usb 3-1: config 7 interface 200 altsetting 128 endpoint 0x87 has an invalid bInterval 149, changing to 7
[  696.540609][ T5632] usb 3-1: config 7 interface 200 altsetting 128 endpoint 0x87 has invalid maxpacket 41372, setting to 1024
[  696.540624][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0x7, skipping
[  696.540637][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0x4, skipping
[  696.540650][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0x5, skipping
[  696.540663][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0x5, skipping
[  696.540676][ T5632] usb 3-1: config 7 interface 200 altsetting 128 endpoint 0xA has invalid maxpacket 512, setting to 64
[  696.540691][ T5632] usb 3-1: config 7 interface 200 altsetting 128 endpoint 0xE has invalid maxpacket 30361, setting to 64
[  696.540706][ T5632] usb 3-1: config 7 interface 200 altsetting 128 endpoint 0x3 has an invalid bInterval 247, changing to 11
[  696.540724][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0xA, skipping
[  696.540737][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0x4, skipping
[  696.540750][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0xE, skipping
[  696.540763][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0xE, skipping
[  696.540775][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0x9, skipping
[  696.540788][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has a duplicate endpoint with address 0xD, skipping
[  696.540801][ T5632] usb 3-1: config 7 interface 200 altsetting 128 has 24 endpoint descriptors, different from the interface descriptor's value: 12
[  696.540816][ T5632] usb 3-1: config 7 interface 200 has no altsetting 0
[  696.543110][ T5632] usb 3-1: New USB device found, idVendor=05ac, idProduct=9236, bcdDevice=d5.69
[  696.543133][ T5632] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  696.543145][ T5632] usb 3-1: Product: 圧✆ⴢ鮢캌ힴ㉁ä쾁沋✮䄌璞哹䪣؍쾁獜풪㽲賎
[  696.543156][ T5632] usb 3-1: Manufacturer: Г
[  696.543165][ T5632] usb 3-1: SerialNumber: ꄒ۹碓鵖캧澼ꬬ謿َ拹廾쐓⿀ᖸ᯸ﱋ慄⬀활磺묩ꈺ鰵ᚵͻ砟䐏⾖⹭앣ꩈ总ꓽຫ֧⤼ꕄ⸑⃞ᆔ瞊摿㠺됾㽳渎熫䈖⑞媝녔斞
[  696.546558][ T5632] usb 3-1: rejected 1 configuration due to insufficient available bus power
[  696.546573][ T5632] usb 3-1: no configuration chosen from 1 choice
[  697.129244][T12289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  697.129965][T12289] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  697.133298][T12289] netlink: 'syz.1.2021': attribute type 1 has an invalid length.
[  697.133318][T12289] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2021'.
[  697.935638][T12293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  697.936203][T12293] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  698.052301][T12295] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.
[  698.052318][T12295] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET.
[  699.043476][T12311] fuse: fd is not a fuse device
[  699.044215][T12311] fuse: fd is not a fuse device
[  699.091389][T12313] netlink: 'syz.4.2031': attribute type 10 has an invalid length.
[  699.091407][T12313] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2031'.
[  699.092807][T12313] A link change request failed with some changes committed already. Interface macvlan0 may have been left with an inconsistent configuration, please check.
[  699.256726][T12315] FAULT_INJECTION: forcing a failure.
[  699.256726][T12315] name failslab, interval 1, probability 0, space 0, times 0
[  699.256752][T12315] CPU: 1 UID: 0 PID: 12315 Comm: syz.1.2032 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
[  699.256769][T12315] Tainted: [L]=SOFTLOCKUP
[  699.256774][T12315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  699.256782][T12315] Call Trace:
[  699.256786][T12315]  <TASK>
[  699.256792][T12315]  dump_stack_lvl+0xe8/0x150
[  699.256812][T12315]  should_fail_ex+0x46b/0x600
[  699.256831][T12315]  should_failslab+0xa8/0x100
[  699.256849][T12315]  __kmalloc_cache_noprof+0x84/0x690
[  699.256870][T12315]  ? vhost_task_create+0x123/0x380
[  699.256886][T12315]  vhost_task_create+0x123/0x380
[  699.256899][T12315]  ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10
[  699.256916][T12315]  ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10
[  699.256933][T12315]  ? __pfx_vhost_task_create+0x10/0x10
[  699.256950][T12315]  ? __pfx_vhost_task_fn+0x10/0x10
[  699.256970][T12315]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  699.256989][T12315]  ? lockdep_hardirqs_on+0x7a/0x110
[  699.257007][T12315]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  699.257025][T12315]  ? mutex_lock_nested+0x152/0x1d0
[  699.257039][T12315]  ? kvm_mmu_post_init_vm+0x8f/0x2d0
[  699.257059][T12315]  kvm_mmu_post_init_vm+0x147/0x2d0
[  699.257078][T12315]  kvm_arch_vcpu_ioctl_run+0x106/0x20d0
[  699.257099][T12315]  ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10
[  699.257114][T12315]  ? do_raw_spin_lock+0x12b/0x2f0
[  699.257136][T12315]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  699.257154][T12315]  ? lockdep_hardirqs_on+0x7a/0x110
[  699.257171][T12315]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  699.257188][T12315]  ? rt_mutex_slowunlock+0x4a7/0x8b0
[  699.257206][T12315]  ? __pfx_rt_mutex_slowunlock+0x10/0x10
[  699.257222][T12315]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  699.257239][T12315]  ? lockdep_hardirqs_on+0x7a/0x110
[  699.257256][T12315]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  699.257275][T12315]  ? rt_write_unlock+0x190/0x230
[  699.257292][T12315]  kvm_vcpu_ioctl+0xa65/0xfe0
[  699.257312][T12315]  ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[  699.257338][T12315]  ? __fget_files+0x2a/0x420
[  699.257354][T12315]  ? __fget_files+0x2a/0x420
[  699.257367][T12315]  ? __fget_files+0x3a6/0x420
[  699.257380][T12315]  ? __fget_files+0x2a/0x420
[  699.257395][T12315]  ? bpf_lsm_file_ioctl+0x9/0x20
[  699.257409][T12315]  ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[  699.257426][T12315]  __se_sys_ioctl+0xff/0x170
[  699.257443][T12315]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  699.257456][T12315]  do_syscall_64+0x15f/0xf80
[  699.257467][T12315]  ? trace_irq_disable+0x3b/0x140
[  699.257484][T12315]  ? clear_bhb_loop+0x40/0x90
[  699.257498][T12315]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  699.257510][T12315] RIP: 0033:0x7fadfc98cdd9
[  699.257529][T12315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  699.257541][T12315] RSP: 002b:00007fadfabe6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  699.257554][T12315] RAX: ffffffffffffffda RBX: 00007fadfcc05fa0 RCX: 00007fadfc98cdd9
[  699.257563][T12315] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
[  699.257571][T12315] RBP: 00007fadfabe6090 R08: 0000000000000000 R09: 0000000000000000
[  699.257579][T12315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  699.257586][T12315] R13: 00007fadfcc06038 R14: 00007fadfcc05fa0 R15: 00007ffffbc7c9d8
[  699.257604][T12315]  </TASK>
[  699.343561][ T5844] usb 3-1: USB disconnect, device number 91
[  699.483327][T12317] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  699.494757][T12317] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  700.157788][T12326] comedi comedi0: comedi_config --init_data is deprecated
[  700.174042][ T1336] ieee802154 phy0 wpan0: encryption failed: -22
[  700.174135][ T1336] ieee802154 phy1 wpan1: encryption failed: -22
[  700.264444][T12328] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only
[  700.264473][T12328] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[  700.264654][T12328] overlayfs: failed to get uuid (355/file1, err=-13); falling back to uuid=null.
[  700.309883][T12330] autofs: Unknown parameter '� DJ��}��$�����D]�����ш��
[  700.309883][T12330] ����M~t��z���#��i�R��V����>�(������w��0�e�{'
[  700.313727][T12330] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2038'.
[  700.320529][T12330] fuse: blksize only supported for fuseblk
[  700.507142][T12341] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2039'.
[  700.507236][T12341] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2039'.
[  701.737336][T12375] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0.
[  701.853748][T12385] kvm: kvm [12383]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0x11e) = 0x60000000200
[  702.159053][T12394] netlink: 1008 bytes leftover after parsing attributes in process `syz.2.2058'.
[  702.390192][ T5670] Bluetooth: hci0: unexpected event for opcode 0x1009
[  702.454628][T12408] FAULT_INJECTION: forcing a failure.
[  702.454628][T12408] name failslab, interval 1, probability 0, space 0, times 0
[  702.454666][T12408] CPU: 0 UID: 0 PID: 12408 Comm: syz.2.2061 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
[  702.454695][T12408] Tainted: [L]=SOFTLOCKUP
[  702.454703][T12408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  702.454715][T12408] Call Trace:
[  702.454723][T12408]  <TASK>
[  702.454732][T12408]  dump_stack_lvl+0xe8/0x150
[  702.454761][T12408]  should_fail_ex+0x46b/0x600
[  702.454792][T12408]  should_failslab+0xa8/0x100
[  702.454822][T12408]  __kmalloc_noprof+0xdf/0x7b0
[  702.454848][T12408]  ? kfree+0x4d/0x6c0
[  702.454871][T12408]  ? tomoyo_realpath_from_path+0xe3/0x5d0
[  702.454907][T12408]  tomoyo_realpath_from_path+0xe3/0x5d0
[  702.454938][T12408]  ? tomoyo_domain+0xd7/0x130
[  702.454964][T12408]  ? tomoyo_path_number_perm+0x219/0x630
[  702.454990][T12408]  tomoyo_path_number_perm+0x246/0x630
[  702.455020][T12408]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  702.455046][T12408]  ? __lock_acquire+0x6b5/0x2d10
[  702.455070][T12408]  ? do_raw_spin_lock+0x12b/0x2f0
[  702.455136][T12408]  ? __fget_files+0x2a/0x420
[  702.455164][T12408]  ? __fget_files+0x2a/0x420
[  702.455186][T12408]  ? __fget_files+0x3a6/0x420
[  702.455209][T12408]  ? __fget_files+0x2a/0x420
[  702.455237][T12408]  security_file_ioctl+0xc3/0x2a0
[  702.455264][T12408]  __se_sys_ioctl+0x47/0x170
[  702.455293][T12408]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  702.455316][T12408]  do_syscall_64+0x15f/0xf80
[  702.455335][T12408]  ? trace_irq_disable+0x3b/0x140
[  702.455363][T12408]  ? clear_bhb_loop+0x40/0x90
[  702.455388][T12408]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  702.455412][T12408] RIP: 0033:0x7f5aa532cdd9
[  702.455435][T12408] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  702.455452][T12408] RSP: 002b:00007f5aa3586028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  702.455476][T12408] RAX: ffffffffffffffda RBX: 00007f5aa55a5fa0 RCX: 00007f5aa532cdd9
[  702.455494][T12408] RDX: 0000200000000140 RSI: 00000000c0d05605 RDI: 0000000000000003
[  702.455507][T12408] RBP: 00007f5aa3586090 R08: 0000000000000000 R09: 0000000000000000
[  702.455519][T12408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  702.455532][T12408] R13: 00007f5aa55a6038 R14: 00007f5aa55a5fa0 R15: 00007fff527315f8
[  702.455560][T12408]  </TASK>
[  702.455581][T12408] ERROR: Out of memory at tomoyo_realpath_from_path.
[  702.778770][T12417] netdevsim netdevsim2 ������: renamed from netdevsim0 (while UP)
[  702.922728][T12420] netlink: 220 bytes leftover after parsing attributes in process `syz.2.2068'.
[  702.922940][T12420] unsupported nla_type 224
[  703.532826][T12447] binder: 12446:12447 ioctl 80405880 2000000009c0 returned -22
[  703.623468][T12449] fuse: fd is not a fuse device
[  703.631673][T12449] overlay: Unknown parameter 'euid<00000000000000000007'
[  703.658260][T12449] netlink: 88 bytes leftover after parsing attributes in process `syz.4.2077'.
[  704.355834][T12457] trusted_key: encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false
[  705.142087][ T5664] usb 3-1: new high-speed USB device number 92 using dummy_hcd
[  705.267450][T12467] netlink: 'syz.0.2082': attribute type 5 has an invalid length.
[  705.303290][ T5664] usb 3-1: Using ep0 maxpacket: 16
[  705.306405][ T5664] usb 3-1: unable to get BOS descriptor or descriptor too short
[  705.308411][ T5664] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  705.308438][ T5664] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3
[  705.350657][ T5664] usb 3-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40
[  705.350692][ T5664] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  705.350714][ T5664] usb 3-1: Product: syz
[  705.350729][ T5664] usb 3-1: Manufacturer: syz
[  705.350744][ T5664] usb 3-1: SerialNumber: syz
[  705.839163][ T5664] usb 3-1: interface 1 not found
[  705.868139][ T5664] usb 3-1: USB disconnect, device number 92
[  706.497732][T12502] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2092'.
[  706.644342][T12504] netlink: 'syz.4.2093': attribute type 27 has an invalid length.
[  706.739861][T12508] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  706.740454][T12508] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  706.778381][T12508] syzkaller1: entered promiscuous mode
[  706.778397][T12508] syzkaller1: entered allmulticast mode
[  707.537038][ T5765] usb 3-1: new high-speed USB device number 93 using dummy_hcd
[  707.696898][   T38] INFO: task kworker/0:2:821 blocked for more than 143 seconds.
[  707.696926][   T38]       Tainted: G             L      syzkaller #0
[  707.696937][   T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  707.696947][   T38] task:kworker/0:2     state:D stack:21304 pid:821   tgid:821   ppid:2      task_flags:0x4208060 flags:0x00080000
[  707.697103][   T38] Workqueue: usb_hub_wq hub_event
[  707.697132][   T38] Call Trace:
[  707.697140][   T38]  <TASK>
[  707.697153][   T38]  __schedule+0x16f9/0x5500
[  707.697197][   T38]  ? __lock_acquire+0x6b5/0x2d10
[  707.697219][   T38]  ? __bfs+0x153/0x290
[  707.697254][   T38]  ? __pfx___schedule+0x10/0x10
[  707.697292][   T38]  ? schedule+0x90/0x360
[  707.697322][   T38]  schedule+0x164/0x360
[  707.697352][   T38]  schedule_timeout+0xc3/0x2c0
[  707.697383][   T38]  ? __pfx_schedule_timeout+0x10/0x10
[  707.697411][   T38]  ? do_raw_spin_lock+0x12b/0x2f0
[  707.697450][   T38]  ? _raw_spin_unlock_irq+0x23/0x50
[  707.697479][   T38]  ? wait_for_completion+0x274/0x5e0
[  707.697511][   T38]  wait_for_completion+0x2cc/0x5e0
[  707.697554][   T38]  ? __pfx_wait_for_completion+0x10/0x10
[  707.697598][   T38]  i2c_del_adapter+0x5c0/0x790
[  707.697640][   T38]  ? __pfx_i2c_del_adapter+0x10/0x10
[  707.697670][   T38]  ? kfree+0x4d/0x6c0
[  707.697705][   T38]  dvb_usb_i2c_exit+0x64/0xb0
[  707.697732][   T38]  dvb_usb_device_exit+0x1cb/0x360
[  707.697759][   T38]  ? __pfx_dvb_usb_device_exit+0x10/0x10
[  707.697789][   T38]  ? __pfx_rt_mutex_slowunlock+0x10/0x10
[  707.697818][   T38]  ? rt_spin_unlock+0x14f/0x200
[  707.697846][   T38]  cxusb_probe+0x60f/0x710
[  707.697873][   T38]  ? rt_spin_unlock+0x160/0x200
[  707.697900][   T38]  ? __pfx_cxusb_probe+0x10/0x10
[  707.697935][   T38]  usb_probe_interface+0x659/0xc70
[  707.697976][   T38]  ? __pfx_usb_probe_interface+0x10/0x10
[  707.698002][   T38]  really_probe+0x267/0xaf0
[  707.698041][   T38]  __driver_probe_device+0x1e2/0x350
[  707.698074][   T38]  driver_probe_device+0x4f/0x240
[  707.698114][   T38]  __device_attach_driver+0x270/0x410
[  707.698150][   T38]  bus_for_each_drv+0x25b/0x2f0
[  707.698176][   T38]  ? __pfx___device_attach_driver+0x10/0x10
[  707.698207][   T38]  ? __pfx_bus_for_each_drv+0x10/0x10
[  707.698232][   T38]  ? rt_spin_unlock+0x160/0x200
[  707.698277][   T38]  __device_attach+0x2c8/0x450
[  707.698310][   T38]  ? __pfx___device_attach+0x10/0x10
[  707.698340][   T38]  ? rt_spin_unlock+0x160/0x200
[  707.698371][   T38]  device_initial_probe+0xa1/0xd0
[  707.698399][   T38]  bus_probe_device+0x12d/0x220
[  707.698449][   T38]  device_add+0x7ec/0xb90
[  707.698482][   T38]  usb_set_configuration+0x1a87/0x2110
[  707.698535][   T38]  usb_generic_driver_probe+0x8d/0x150
[  707.698564][   T38]  usb_probe_device+0x1c4/0x3b0
[  707.698595][   T38]  ? __pfx_usb_probe_device+0x10/0x10
[  707.698621][   T38]  really_probe+0x267/0xaf0
[  707.698659][   T38]  __driver_probe_device+0x1e2/0x350
[  707.698691][   T38]  driver_probe_device+0x4f/0x240
[  707.698725][   T38]  __device_attach_driver+0x270/0x410
[  707.698761][   T38]  bus_for_each_drv+0x25b/0x2f0
[  707.698787][   T38]  ? __pfx___device_attach_driver+0x10/0x10
[  707.698819][   T38]  ? __pfx_bus_for_each_drv+0x10/0x10
[  707.698844][   T38]  ? rt_spin_unlock+0x160/0x200
[  707.698877][   T38]  __device_attach+0x2c8/0x450
[  707.698909][   T38]  ? __pfx___device_attach+0x10/0x10
[  707.698939][   T38]  ? rt_spin_unlock+0x160/0x200
[  707.698973][   T38]  device_initial_probe+0xa1/0xd0
[  707.699005][   T38]  bus_probe_device+0x12d/0x220
[  707.699034][   T38]  device_add+0x7ec/0xb90
[  707.699066][   T38]  usb_new_device+0x9f8/0x16e0
[  707.699106][   T38]  ? __pfx_usb_new_device+0x10/0x10
[  707.699139][   T38]  hub_event+0x2a49/0x4f60
[  707.699212][   T38]  ? __pfx_hub_event+0x10/0x10
[  707.699238][   T38]  ? process_one_work+0x8be/0x1630
[  707.699278][   T38]  ? process_one_work+0x8be/0x1630
[  707.699303][   T38]  process_one_work+0x98b/0x1630
[  707.699352][   T38]  ? __pfx_process_one_work+0x10/0x10
[  707.699377][   T38]  ? do_raw_spin_lock+0x12b/0x2f0
[  707.699423][   T38]  worker_thread+0xb49/0x1140
[  707.699475][   T38]  kthread+0x388/0x470
[  707.699498][   T38]  ? __pfx_worker_thread+0x10/0x10
[  707.699524][   T38]  ? __pfx_kthread+0x10/0x10
[  707.699548][   T38]  ret_from_fork+0x514/0xb70
[  707.699575][   T38]  ? __pfx_ret_from_fork+0x10/0x10
[  707.699598][   T38]  ? __switch_to+0xc79/0x1410
[  707.699630][   T38]  ? __pfx_kthread+0x10/0x10
[  707.699651][   T38]  ret_from_fork_asm+0x1a/0x30
[  707.699691][   T38]  </TASK>
[  707.699853][   T38] 
[  707.699853][   T38] Showing all locks held in the system:
[  707.699866][   T38] 1 lock held by khungtaskd/38:
[  707.699878][   T38]  #0: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
[  707.699934][   T38] 5 locks held by kworker/0:2/821:
[  707.699947][   T38]  #0: ffff88801ab3a938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x897/0x1630
[  707.699999][   T38]  #1: ffffc9000594fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630
[  707.700052][   T38]  #2: ffff88802a37e210 (&dev->mutex){....}-{4:4}, at: hub_event+0x17c/0x4f60
[  707.700108][   T38]  #3: ffff88805b5a4210 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
[  707.700161][   T38]  #4: ffff88803f2ec1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
[  707.700230][   T38] 2 locks held by getty/5370:
[  707.700242][   T38]  #0: ffff8880366700a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
[  707.700296][   T38]  #1: ffffc90003cd32e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13a0
[  707.700349][   T38] 5 locks held by kworker/1:6/5765:
[  707.700361][   T38]  #0: ffff88801ab3a938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x897/0x1630
[  707.700412][   T38]  #1: ffffc90005defc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630
[  707.700466][   T38]  #2: ffff88802a48a210 (&dev->mutex){....}-{4:4}, at: hub_event+0x17c/0x4f60
[  707.700515][   T38]  #3: ffff88802a2ed658 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21b0/0x4f60
[  707.700569][   T38]  #4: ffff888026da1e58 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21e0/0x4f60
[  707.700619][   T38] 4 locks held by udevd/5900:
[  707.700631][   T38]  #0: ffff888028631ec8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb8/0xe20
[  707.700686][   T38]  #1: ffff88805d27f478 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420
[  707.700738][   T38]  #2: ffff8880346fa2d8 (kn->active#25){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420
[  707.700788][   T38]  #3: ffff88805b5a4210 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0
[  707.700839][   T38] 10 locks held by syz-executor/9818:
[  707.700851][   T38]  #0: ffffffff8e2996d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x130/0x4a0
[  707.700904][   T38]  #1: ffff88802a74b7b0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x181/0x1d50
[  707.700960][   T38]  #2: ffff88804161c4b0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x26f/0x1d50
[  707.701019][   T38]  #3: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200
[  707.701069][   T38]  #4: ffff888042192298 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210
[  707.701132][   T38]  #5: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400
[  707.701184][   T38]  #6: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200
[  707.701235][   T38]  #7: ffff88802a99c658 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x5ae/0x5550
[  707.701299][   T38]  #8: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock_nested+0x1de/0x3f0
[  707.701352][   T38]  #9: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: page_table_check_set+0x126/0x510
[  707.701408][   T38] 2 locks held by kworker/u8:17/11335:
[  707.701420][   T38]  #0: ffff8880312c4938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630
[  707.701474][   T38]  #1: ffffc9000735fc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630
[  707.701529][   T38] 
[  707.701535][   T38] =============================================
[  707.701535][   T38] 
[  707.701550][   T38] NMI backtrace for cpu 0
[  707.701567][   T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
[  707.701594][   T38] Tainted: [L]=SOFTLOCKUP
[  707.701602][   T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  707.701614][   T38] Call Trace:
[  707.701622][   T38]  <TASK>
[  707.701631][   T38]  dump_stack_lvl+0xe8/0x150
[  707.701657][   T38]  nmi_cpu_backtrace+0x274/0x2d0
[  707.701684][   T38]  ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10
[  707.701710][   T38]  nmi_trigger_cpumask_backtrace+0x17a/0x300
[  707.701740][   T38]  sys_info+0x135/0x170
[  707.701763][   T38]  watchdog+0xfd3/0x1030
[  707.701799][   T38]  ? watchdog+0x1c9/0x1030
[  707.701831][   T38]  kthread+0x388/0x470
[  707.701853][   T38]  ? __pfx_watchdog+0x10/0x10
[  707.701879][   T38]  ? __pfx_kthread+0x10/0x10
[  707.701901][   T38]  ret_from_fork+0x514/0xb70
[  707.701928][   T38]  ? __pfx_ret_from_fork+0x10/0x10
[  707.701950][   T38]  ? __switch_to+0xc79/0x1410
[  707.701982][   T38]  ? __pfx_kthread+0x10/0x10
[  707.702004][   T38]  ret_from_fork_asm+0x1a/0x30
[  707.702044][   T38]  </TASK>
[  707.702053][   T38] Sending NMI from CPU 0 to CPUs 1:
[  707.702082][    C1] NMI backtrace for cpu 1
[  707.702099][    C1] CPU: 1 UID: 0 PID: 11335 Comm: kworker/u8:17 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
[  707.702122][    C1] Tainted: [L]=SOFTLOCKUP
[  707.702129][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  707.702139][    C1] Workqueue: bat_events batadv_tt_purge
[  707.702163][    C1] RIP: 0010:lock_acquire+0x58/0x350
[  707.702181][    C1] Code: 8b 05 ac da f4 10 48 89 44 24 58 0f 1f 44 00 00 65 8b 05 af da f4 10 83 f8 08 0f 83 83 01 00 00 89 c0 48 0f a3 05 58 1e 0c 0e <73> 0d e8 11 3d 09 00 84 c0 0f 84 ca 01 00 00 83 3d 52 31 0c 0e 00
[  707.702194][    C1] RSP: 0018:ffffc9000735f928 EFLAGS: 00000297
[  707.702208][    C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000002
[  707.702219][    C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e1c8240
[  707.702230][    C1] RBP: ffffffff8188232c R08: 0000000000000000 R09: 0000000000000000
[  707.702241][    C1] R10: dffffc0000000000 R11: fffffbfff1f59a7f R12: 0000000000000002
[  707.702253][    C1] R13: ffffffff8e1c8240 R14: 0000000000000000 R15: 0000000000000000
[  707.702264][    C1] FS:  0000000000000000(0000) GS:ffff888125dc7000(0000) knlGS:0000000000000000
[  707.702277][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  707.702289][    C1] CR2: 0000200000001062 CR3: 000000003f2f8000 CR4: 00000000003526f0
[  707.702304][    C1] DR0: 0000000000000000 DR1: 000000000000930e DR2: 0000000000000000
[  707.702314][    C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  707.702325][    C1] Call Trace:
[  707.702332][    C1]  <TASK>
[  707.702341][    C1]  ? __local_bh_enable+0x1e1/0x2f0
[  707.702363][    C1]  ? __local_bh_disable_ip+0x3c/0x420
[  707.702384][    C1]  __local_bh_disable_ip+0x205/0x420
[  707.702407][    C1]  ? __local_bh_disable_ip+0x3c/0x420
[  707.702427][    C1]  ? batadv_tt_local_purge+0x98/0x380
[  707.702449][    C1]  batadv_tt_local_purge+0x136/0x380
[  707.702470][    C1]  ? batadv_tt_local_purge+0x98/0x380
[  707.702493][    C1]  ? process_one_work+0x8be/0x1630
[  707.702512][    C1]  batadv_tt_purge+0x35/0xa10
[  707.702537][    C1]  ? process_one_work+0x8be/0x1630
[  707.702555][    C1]  process_one_work+0x98b/0x1630
[  707.702585][    C1]  ? __pfx_process_one_work+0x10/0x10
[  707.702604][    C1]  ? do_raw_spin_lock+0x12b/0x2f0
[  707.702631][    C1]  worker_thread+0xb49/0x1140
[  707.702656][    C1]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  707.702684][    C1]  kthread+0x388/0x470
[  707.702705][    C1]  ? __pfx_worker_thread+0x10/0x10
[  707.702724][    C1]  ? __pfx_kthread+0x10/0x10
[  707.702741][    C1]  ret_from_fork+0x514/0xb70
[  707.702759][    C1]  ? __pfx_ret_from_fork+0x10/0x10
[  707.702777][    C1]  ? __switch_to+0xc79/0x1410
[  707.702800][    C1]  ? __pfx_kthread+0x10/0x10
[  707.702816][    C1]  ret_from_fork_asm+0x1a/0x30
[  707.702849][    C1]  </TASK>
[  707.703091][   T38] Kernel panic - not syncing: hung_task: blocked tasks
[  707.703108][   T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
[  707.703135][   T38] Tainted: [L]=SOFTLOCKUP
[  707.703143][   T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[  707.703154][   T38] Call Trace:
[  707.703162][   T38]  <TASK>
[  707.703171][   T38]  vpanic+0x56c/0xa60
[  707.703201][   T38]  ? __pfx_vpanic+0x10/0x10
[  707.703236][   T38]  panic+0xc5/0xd0
[  707.703263][   T38]  ? __pfx_panic+0x10/0x10
[  707.703300][   T38]  ? nmi_trigger_cpumask_backtrace+0x234/0x300
[  707.703331][   T38]  watchdog+0x102c/0x1030
[  707.703367][   T38]  ? watchdog+0x1c9/0x1030
[  707.703401][   T38]  kthread+0x388/0x470
[  707.703422][   T38]  ? __pfx_watchdog+0x10/0x10
[  707.703448][   T38]  ? __pfx_kthread+0x10/0x10
[  707.703470][   T38]  ret_from_fork+0x514/0xb70
[  707.703497][   T38]  ? __pfx_ret_from_fork+0x10/0x10
[  707.703519][   T38]  ? __switch_to+0xc79/0x1410
[  707.703551][   T38]  ? __pfx_kthread+0x10/0x10
[  707.703574][   T38]  ret_from_fork_asm+0x1a/0x30
[  707.703615][   T38]  </TASK>
[  707.703921][   T38] Kernel Offset: disabled