last executing test programs: 3m47.690053551s ago: executing program 0 (id=305): openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000280)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f00000002c0)=0x4}) openat$kvm(0xffffff9c, &(0x7f0000000300), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000340)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000580)={[0x43400078, 0x1000000000, 0x4000001d6, 0x8, 0x3000000, 0x3, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x8, 0x3, 0x3, 0x0, 0xfffffffffffff801], 0x10ff8, 0x100002}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000640)={{0x1000, 0x80a0000, 0x0, 0x10, 0x8, 0x0, 0x0, 0x8b, 0x0, 0xc, 0x6, 0x40}, {0x4, 0xeeef0000, 0x4, 0xff, 0xff, 0x0, 0x0, 0xc, 0x7, 0xff}, {0x1, 0x8080000, 0xc, 0x5, 0x4, 0xc4, 0x0, 0xf0, 0x6a, 0x3, 0x0, 0xfc}, {0x1, 0xeeee8000, 0x6, 0x0, 0x81, 0x0, 0x9, 0x0, 0x8, 0x2, 0x6}, {0x6000, 0xffff1000, 0x3, 0x0, 0x0, 0x4, 0x7, 0x0, 0x1, 0x3c, 0x57}, {0x100000, 0xc000, 0xf, 0x78, 0x5, 0x3c, 0x2, 0x0, 0x40, 0xfe, 0x5, 0x4}, {0x4, 0xa000, 0xd, 0x3, 0x3, 0x2, 0xa1, 0x20, 0x0, 0x3}, {0x10000, 0x54000, 0xc, 0x0, 0x0, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x2000, 0x3}, {0x30000, 0xfffe}, 0xddf8ffdb, 0x0, 0x0, 0x110, 0x0, 0x0, 0x8080000, [0x3, 0x0, 0x40000000001]}) ioctl$KVM_RUN(r2, 0xae80, 0x400000000000000) 3m47.451913263s ago: executing program 0 (id=308): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a310000000008000300000000050c"], 0x88}}, 0x0) 3m47.040220181s ago: executing program 0 (id=312): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x5, &(0x7f0000000040)=0xfffffff9, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f00000059c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000005a00)='./sys\x00', &(0x7f0000005a40)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000005a80)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r0, &(0x7f0000005ac0)='1:', 0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000005700)=[{{&(0x7f0000000200)=@phonet, 0x80, &(0x7f0000000640)=[{&(0x7f0000000280)=""/96, 0x60}, {&(0x7f0000000300)=""/4, 0x4}, {&(0x7f0000000340)=""/74, 0x4a}, {&(0x7f00000003c0)=""/197, 0xc5}, {&(0x7f00000004c0)=""/121, 0x79}, {&(0x7f0000000540)=""/129, 0x81}, {&(0x7f0000000600)=""/26, 0x1a}], 0x7, &(0x7f00000006c0)=""/214, 0xd6}, 0x6}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000007c0)=""/55, 0x37}, {&(0x7f0000000800)=""/129, 0x81}, {&(0x7f00000008c0)=""/74, 0x4a}, {&(0x7f0000000940)=""/60, 0x3c}, {&(0x7f0000000980)=""/35, 0x23}], 0x5, &(0x7f0000000a40)=""/216, 0xd8}, 0x4}, {{&(0x7f0000000b40)=@in6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000bc0)=""/38, 0x26}], 0x1, &(0x7f0000000c40)=""/220, 0xdc}, 0x1ff}, {{&(0x7f0000000d40)=@l2, 0x80, &(0x7f0000001100)=[{&(0x7f0000000dc0)=""/105, 0x69}, {&(0x7f0000000e40)=""/52, 0x34}, {&(0x7f0000000e80)=""/144, 0x90}, {&(0x7f0000000f40)=""/136, 0x88}, {&(0x7f0000001000)=""/224, 0xe0}], 0x5}, 0xf}, {{0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000001180)=""/110, 0x6e}, {&(0x7f0000001200)=""/89, 0x59}, {&(0x7f0000001280)=""/209, 0xd1}, {&(0x7f0000001380)=""/19, 0x13}], 0x4, &(0x7f0000001400)=""/182, 0xb6}, 0x9}, {{&(0x7f0000001540)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000001c80)=[{&(0x7f0000001640)=""/120, 0x78}, {&(0x7f00000016c0)=""/108, 0x6c}, {&(0x7f0000001740)=""/234, 0xea}, {&(0x7f0000001840)=""/226, 0xe2}, {&(0x7f0000001940)=""/110, 0x6e}, {&(0x7f00000019c0)=""/44, 0x2c}, {&(0x7f0000001a00)=""/248, 0xf8}, {&(0x7f0000001b00)=""/193, 0xc1}, {&(0x7f0000001c00)=""/98, 0x62}], 0x9, &(0x7f0000001d40)=""/247, 0xf7}}, {{&(0x7f0000001e40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000004240)=[{&(0x7f0000001ec0)=""/123, 0x7b}, {&(0x7f0000001f40)=""/4096, 0x1000}, {&(0x7f0000002f40)=""/4096, 0x1000}, {&(0x7f0000003f40)=""/112, 0x70}, {&(0x7f0000003fc0)=""/75, 0x4b}, {&(0x7f0000004040)=""/183, 0xb7}, {&(0x7f0000004100)=""/138, 0x8a}, {&(0x7f00000041c0)=""/72, 0x48}], 0x8, &(0x7f00000042c0)}, 0x5}, {{&(0x7f0000004300)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f00000045c0)=[{&(0x7f0000004380)=""/42, 0x2a}, {&(0x7f00000043c0)=""/88, 0x58}, {&(0x7f0000004440)=""/160, 0xa0}, {&(0x7f0000004500)=""/166, 0xa6}], 0x4, &(0x7f0000004600)}, 0x2}, {{0x0, 0x0, &(0x7f00000046c0)=[{&(0x7f0000004640)=""/36, 0x24}, {&(0x7f0000004680)=""/51, 0x33}], 0x2, &(0x7f0000004700)=""/4096, 0x1000}, 0x2}], 0x9, 0x1000, &(0x7f0000005940)) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r1, 0x8910, &(0x7f0000005980)={'veth0_vlan\x00', @ifru_ivalue=0x4}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c80)={&(0x7f0000005cc0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000005d40)={0x0, 0x0, &(0x7f0000005d80)={&(0x7f0000005dc0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x81}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) ioctl$sock_netdev_private(r1, 0x89f5, &(0x7f00000059c0)) mkdirat(0xffffffffffffff9c, &(0x7f00000014c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000015c0)='./proc\x00', &(0x7f00000042c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000004600)='./proc/mtrr\x00', 0x2, 0x0) write(r3, 0x0, 0x0) memfd_create(&(0x7f0000000000)='\x00', 0x4) getsockopt$inet6_buf(r0, 0x29, 0x2e, &(0x7f0000005b00)=""/209, &(0x7f0000005c00)=0xd1) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) fallocate(r4, 0x20, 0x11, 0x4000) getpeername$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @private1}, &(0x7f00000001c0)=0x1c) 3m46.616876459s ago: executing program 0 (id=316): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0xc01, 0x11) write(r0, &(0x7f00000001c0)="703a742d73742f6576656e7431202e2f66696c65303a307830205f7267323d5ca78c15bf92f2cb16bffa883f3f1a6b71a2ebd441fda9f8933a69341c5475bb26948a908c9ad8c52af3ed9f9e3159a3bf5b", 0x51) 3m46.438296074s ago: executing program 0 (id=318): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='md0', 0x3) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) rseq(&(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}, 0x68, 0x0, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) r2 = syz_clone(0xc0180980, &(0x7f0000000480)="8d5bf54d5abba54472ee62c02025c005683be6aee82bc2cbe1dccc7c5f074927e4a0da205198b24ca68cf9d5b8befc68303536d9985428385bf1e2f2a25a553f1a559652adab00068e355fee085723dcdacc72805033b37957eab464114c01f54358baf5d6b8aae3af70a8c26c359d77a3a7380022b5774c9127b9b7c2f373b520de1bab58dc89369a35424415ebc7ffe224a0c8f4f2c9f60a26b80f2d50b7319c0af244137300f89ab381cb7b0fc512c9308a8ef5a31abde313c8cfaa26ccd4506ef1f3a977873a409deea53dc2690d124d7a531a37a11c03c52a90a8cedb91", 0xe0, &(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)="6265528ac9488e8d18172891cad5d421b0833603591c0cdf674769a817db016f74f8606b9de74e90a226e56401a655e037bc5a3900e1584d1c34104f66d8280885ecd3657f1889032dc7bee857548e20be375dd699354de47eb38a68e87bf995aa110a9b215db2cdb52f48b42e4b8ab16b41a0d5e1beffa3aa6c9e4df2077bf9ae09a873d22b821ae759fe") sched_setparam(r2, &(0x7f00000006c0)=0x3) waitid(0x0, r1, 0x0, 0x4, &(0x7f0000000700)) ptrace$getregset(0x4205, r1, 0x202, &(0x7f00000003c0)={&(0x7f0000000400)=""/120, 0xffffffffffffff28}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x480480, 0x0) write(r3, &(0x7f00000002c0)='1:0\n', 0x4) 3m46.155872321s ago: executing program 0 (id=319): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x4c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SCAN_SSIDS={0x30, 0x2d, 0x0, 0x1, [{0x4}, {0xa, 0x0, @default_ibss_ssid}, {0x4}, {0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}]}]}, 0x4c}}, 0x44) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) write(r4, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db800000000000000000000000106001500070000001800160008000100010000000c000b0008000100020000000800040001000000", 0x58) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r5, &(0x7f0000000280)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read$FUSE(r5, &(0x7f0000006d80)={0x2020}, 0x2020) 3m31.097891924s ago: executing program 32 (id=319): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x4c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SCAN_SSIDS={0x30, 0x2d, 0x0, 0x1, [{0x4}, {0xa, 0x0, @default_ibss_ssid}, {0x4}, {0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}]}]}, 0x4c}}, 0x44) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) write(r4, &(0x7f0000000000)="580000001800050401000000000000000a800000fe040002000000001400010020010db800000000000000000000000106001500070000001800160008000100010000000c000b0008000100020000000800040001000000", 0x58) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r5, &(0x7f0000000280)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read$FUSE(r5, &(0x7f0000006d80)={0x2020}, 0x2020) 3m13.762384938s ago: executing program 2 (id=456): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='task\x00') getdents64(r0, &(0x7f0000000100)=""/78, 0x4e) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae03, 0x36) exit(0x1) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={0x0, 0xcfc}, 0x8) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r2, &(0x7f0000000340)='}', 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000003c0)=0x3b96, 0x4) sendto$inet(r2, &(0x7f0000000400)="ab", 0x34000, 0x0, &(0x7f0000000440)={0x2, 0x4e22, @local}, 0x10) getdents(r0, 0x0, 0x0) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="140100002000010000000000fcdbdf250101f2800f0018007d3a2e9c5bc85c23277d000014000200fc02000000000000000000000000000050bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc3580400e90000000096568fb4da3608dc136d689aa71a65a7b83cccd53e27d0822033fe92592db6fb67e1dfd9cf1abb6c680815ded3f3c0c71c3e70aa7630c184b57fb91b1221cb9fdc2193eac24a7f95ebb2647283593661ca0c7ba90d4d65a3313247f613cacc4e839909a1244b415ba420d8be40160ac8e22afc2a07d97c763fd8b404877bbc743bb140dc65a56030e4d86c572e881e1a6920765babbb7e70fb28e348715fb1249d43c93cc33d4867ea"], 0x114}], 0x1, 0x0, 0x0, 0x20008001}, 0x0) 3m12.688909797s ago: executing program 2 (id=461): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0x4000, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) close_range(r1, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x1fc7, &(0x7f0000000140)={0x0, 0x79b2, 0x3180, 0x1, 0x3b1}, 0x0, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x3f00000000000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) (async) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0x4000, 0x0) (async) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) (async) landlock_restrict_self(0xffffffffffffffff, 0xc) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) syz_io_uring_setup(0x1fc7, &(0x7f0000000140)={0x0, 0x79b2, 0x3180, 0x1, 0x3b1}, 0x0, 0x0, 0x0) (async) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x3f00000000000000) (async) 3m12.066281351s ago: executing program 2 (id=465): capset(0x0, &(0x7f0000000040)={0x200002, 0x200003, 0x803, 0x4, 0x7}) r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000a80)={0x14, 0x0, &(0x7f0000000a40)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) capset(&(0x7f0000000400)={0x20080522}, &(0x7f0000000440)={0x0, 0x0, 0xffffffff, 0x0, 0x3a5f, 0x8}) r1 = syz_open_dev$sg(&(0x7f0000000480), 0x0, 0x40000) ioctl$SG_IO(r1, 0x2285, &(0x7f00000004c0)={0x53, 0xfffffffffffffffc, 0x6, 0x6b, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000540)="5a7cef9c330e", 0x0, 0x0, 0x30520cf7f25f0c64, 0x0, 0x0}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_control_io(r0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/mdstat\x00', 0x0, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/fscaps', 0x2000, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') syz_open_dev$dvb_demux(&(0x7f00000003c0), 0x6e41, 0xc0) openat$binderfs_log(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder_logs/transactions\x00', 0x0, 0x0) mount$9p_fd(0x0, &(0x7f00000002c0)='.\x00', &(0x7f0000000300), 0x40, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) syz_pidfd_open(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x4c, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x2}]}, 0x10) recvmmsg(r5, &(0x7f0000000140)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/61, 0x3d}}], 0x1, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8050}}], 0x1, 0x4000000) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x7, &(0x7f0000000040)=ANY=[]) 3m9.357257392s ago: executing program 2 (id=476): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) syz_clone(0x9ca86080, 0x0, 0xfffffffffffffcd8, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000140)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/filehandle\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='my', 0x2) modify_ldt$write(0x1, &(0x7f0000000000)={0x401, 0x1000, 0x4000, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1}, 0x10) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$setregs(0xd, r1, 0x5, &(0x7f0000000040)="84fff29ab187e0e7598238b73bb330b800b6a8dfb20858c411ff069d4e4b7617e77d2bee4113caeb90da3c5f72e6012834e060e9ec243030f1e204d17c2a46dd1276b2ce0d617a8b5ae78ad7ad44f03994a7d48c4988dcc38a59a9afc818413737f0f29bb6858832d56c17b21457381466e8ad258acbc4fdc2b0b9e941f37351ef0ab2bae2634b747f") ptrace$cont(0x21, r1, 0x80000001, 0x4) 3m9.04218888s ago: executing program 2 (id=477): socket$kcm(0x10, 0x7, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000001980)={0x0, 0x7810, 0x80, 0x2, 0x29d}, &(0x7f0000001a00)=0x0, &(0x7f0000001a40)=0x0, &(0x7f0000001a80)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000001ac0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x60, 0x0, r0, 0x0, 0x0, 0x0, 0x2122}) (async, rerun: 32) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000001b40)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x6, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001bc0)=@new_dev={0x2, 0x97, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x999f6200aab69968}}}, 0x0) (rerun: 32) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='cgroup2\x00', 0x0, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000380)={0x0, 0x0, "e907f8f9951e76c13f64323723e7eecdf40c050023eb3d259266ec9c37865c0000000034c07c3260049ea78d3ee0878ae95bc7f52300c468b257ffb3baf79cf1fc8f72566153c97ffdc11f30ea6b16b694bb4a6e4606c3fb19d1d2bc3c8c4e97da2213f9d5c3c4891f9150d608390666e817d61dcc3a633bb0b1250b5a293e3877adc1a1b44b99c93d57fd720a170e7f5670e419dc64febf7ddc73fd4a5a0b6c281e05c541471d8d2a58f5edac665f7f46c7084e17c809268103a2584ab40a68e528329d97afc3612e325c1eb4a3ab2e156a9744480000000000000000000000000000000000000000000000000000000000e80000000000000000e100", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c87738d9679d31ce0108dc556e597655ba11bacc032a16fbedc64776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc64e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8fffb58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141fa4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a3548371507000000b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb67c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20b4e4acf5bea0484084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835acdabd60da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc957844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d0615de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c846f6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc575341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328312671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f304f65ac03cfecce67027d579e1226bd7b73827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aebe4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374f000000000000000725e75c257834572026c511f57dce67153a4008f9e75e07edfd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014c4ad280944eae6f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) (async, rerun: 32) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async, rerun: 32) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r7, 0x0, 0x18, &(0x7f0000001380)=0x80000001, 0x2a) (async) bind$inet(r7, &(0x7f00000013c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x28}}, 0x10) (async, rerun: 32) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x0, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (rerun: 32) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r8, &(0x7f0000001540)=[{{&(0x7f0000001580)={0xa, 0xfffc, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c, &(0x7f00000015c0)=[{&(0x7f0000001600)="ad", 0x1}], 0x1}}], 0x1, 0x0) (async) r9 = socket$netlink(0x10, 0x3, 0x4) writev(r9, &(0x7f0000001940)=[{&(0x7f0000001680)="480000001400190d09004beafd0d36020a8447000b4e230f00034e20a2bc560119ca004f19dfb7f393d7359031033f817f0005c00e030002000000ffff0100"/72, 0x48}], 0x1) (async) r10 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0, 0xd5) r11 = openat2$dir(0xffffffffffffff9c, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)={0x0, 0x100, 0x4}, 0x18) file_setattr(r11, &(0x7f0000001480)='./file0\x00', &(0x7f00000014c0)={0x800000a1, 0x200, 0xd566, 0x1, 0x4}, 0x18, 0x1000) (async) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000001740), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r9, &(0x7f0000001900)={&(0x7f0000001700), 0xc, &(0x7f00000018c0)={&(0x7f0000001780)=ANY=[@ANYBLOB="aa7fbdee", @ANYRES16=r12, @ANYBLOB="100029bd7000fbdbdf2501000000080001007063690011000200303030303a30303a31302e30000000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080001007063690011000200303030303a30303a31302e30000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080001007063690011000200303030303a30303a31302e30000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x108}, 0x1, 0x0, 0x0, 0x40000}, 0xc058) r13 = openat$cgroup_ro(r10, &(0x7f0000000340)='cpu.stat\x00', 0xf000, 0x0) (async) syz_usb_connect(0x0, 0x4c, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000202000040d804820000010000000109023a00020100c0320904000001020201000524001001052406000107058103ffff0a09040100020a00000007050202ffff0007058202"], 0x0) r14 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r14, 0x10e, 0xc, &(0x7f00000000c0)={0x806, 0x0, 0x4, 0x7}, 0x10) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r13, 0xc018937e, &(0x7f0000000280)={{0x1, 0x1, 0x18, r13, {0x2}}, './file0\x00'}) sendmsg$nl_generic(r15, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001500)=ANY=[@ANYRES32=r6, @ANYRESOCT=r5], 0x20}, 0x1, 0x0, 0x0, 0xc004}, 0x0) 3m6.801941437s ago: executing program 2 (id=488): socket$nl_xfrm(0x10, 0x3, 0x6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) bind$packet(r0, &(0x7f0000000400)={0x11, 0x18, r2, 0x1, 0x81}, 0x14) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000440)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_dev$swradio(&(0x7f0000000380), 0x0, 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f00000007c0), 0x121403, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000500), 0x7b, 0xa004) fadvise64(r4, 0x4800000000, 0xfffffbf7, 0x0) open_by_handle_at(r3, &(0x7f00000004c0)=@FILEID_INO32_GEN={0x8, 0x1, {0x7fff, 0x4}}, 0x400) r5 = dup(0xffffffffffffffff) r6 = syz_ublk_setup_io_uring(0x34e5, &(0x7f0000000580)={0x0, 0x4, 0x80, 0x1, 0x5e5, 0x0, r5}, &(0x7f0000000640)=0x0, &(0x7f0000000680)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r7, r8, r9, &(0x7f00000002c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf6c4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x164}}}, &(0x7f0000000280)=0x0) syz_open_dev$sg(&(0x7f0000000340), 0xe6, 0x2602) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x121100) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_ublk_setup_queues(r6, r11, &(0x7f0000000200)={0x0, 0x1463, 0x10700, 0x2, 0xb2}, &(0x7f0000000d40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x10002, 0x401, 0x31c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8000, 0x1, 0x2000008, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8001, 0x10, 0x1, 0x902c4, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x20, 0x2, 0x40021a, 0x0, r6}}], 0x16, &(0x7f0000001540)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, r10, '\x00', {0x3, 0x48b, 0x0, 0x0}}, 0x0) 3m6.45931718s ago: executing program 33 (id=488): socket$nl_xfrm(0x10, 0x3, 0x6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) bind$packet(r0, &(0x7f0000000400)={0x11, 0x18, r2, 0x1, 0x81}, 0x14) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000440)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_dev$swradio(&(0x7f0000000380), 0x0, 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f00000007c0), 0x121403, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000500), 0x7b, 0xa004) fadvise64(r4, 0x4800000000, 0xfffffbf7, 0x0) open_by_handle_at(r3, &(0x7f00000004c0)=@FILEID_INO32_GEN={0x8, 0x1, {0x7fff, 0x4}}, 0x400) r5 = dup(0xffffffffffffffff) r6 = syz_ublk_setup_io_uring(0x34e5, &(0x7f0000000580)={0x0, 0x4, 0x80, 0x1, 0x5e5, 0x0, r5}, &(0x7f0000000640)=0x0, &(0x7f0000000680)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r7, r8, r9, &(0x7f00000002c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf6c4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x164}}}, &(0x7f0000000280)=0x0) syz_open_dev$sg(&(0x7f0000000340), 0xe6, 0x2602) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x121100) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_ublk_setup_queues(r6, r11, &(0x7f0000000200)={0x0, 0x1463, 0x10700, 0x2, 0xb2}, &(0x7f0000000d40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x10002, 0x401, 0x31c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8000, 0x1, 0x2000008, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8001, 0x10, 0x1, 0x902c4, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x20, 0x2, 0x40021a, 0x0, r6}}], 0x16, &(0x7f0000001540)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, r10, '\x00', {0x3, 0x48b, 0x0, 0x0}}, 0x0) 2m37.126078426s ago: executing program 5 (id=633): socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180)={0x0, 0x0, 0x10, 0x40002, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r1, r2, r3, &(0x7f00000002c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf6c4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x164}}}, &(0x7f0000000280)=0x0) syz_open_dev$sg(&(0x7f0000000340), 0xe6, 0x2602) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x121100) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='net\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) fstat(r6, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_ublk_setup_queues(r0, r5, &(0x7f0000000200)={0x0, 0x1463, 0x10700, 0x2, 0xb2}, &(0x7f0000000d40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x4000, 0x401, 0x31c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8000, 0x1, 0x2000008, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8001, 0x1, 0x1, 0x902c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x20, 0x2, 0x40021a, 0x0, r0}}], 0x16, &(0x7f0000001540)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, r4, '\x00', {0x3, 0x48b, 0x0, 0x0}}, 0x0) 2m35.811073607s ago: executing program 5 (id=638): r0 = syz_create_resource$futex(&(0x7f0000000340)=0x1) r1 = syz_create_resource$futex(&(0x7f0000000440)=0xfffffffc) futex(r0, 0xb, 0x1, 0x0, r1, 0x0) futex(r0, 0xc, 0x1, 0x0, r1, 0x1) (fail_nth: 4) 2m34.68690354s ago: executing program 5 (id=645): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000001f40)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0x5}}, 0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$P9_RLERROR(r1, &(0x7f0000000100)={0xb, 0x7, 0x1, {0x2, '!N'}}, 0xb) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000008c0)={0x1, 0x200, 0x99e, 0x8}, 0x10) sendmmsg$inet(r1, &(0x7f0000002380)=[{{&(0x7f0000000a00)={0x2, 0x4e24, @local}, 0x10, &(0x7f0000000e00)=[{&(0x7f0000000a40)='R', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000440)="d2", 0x1}], 0x1}}], 0x2, 0x4040040) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f00000003c0)=0x7f, 0x4) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) 2m33.073265202s ago: executing program 5 (id=657): r0 = syz_open_dev$usbfs(&(0x7f00000004c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x11, r0, 0x8f4bc000) r1 = memfd_create(&(0x7f0000000640)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\xeb\x01\x00\x00\x00\x00\x00\x00\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{\x88e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x98\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc5\x1d\xe7jDf\x87@\x8fg\x15RJw\x82\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7g\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\x00', 0x0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x2, 0x12, r1, 0xc0c13000) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000840)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000880)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f00000008c0)={{&(0x7f00003fe000/0x4000)=nil, 0x4000}}) r3 = socket(0x2, 0x3, 0x7) close_range(r3, 0xffffffffffffffff, 0x2) r4 = socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) pipe2(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r5, 0x0, r6, 0x0, 0x6, 0x3) setsockopt$inet_int(r4, 0x0, 0x32, &(0x7f0000000540)=0x1000000, 0x4) sendmmsg$inet(r4, &(0x7f0000000580)=[{{&(0x7f0000000900)={0x2, 0x4e21, @rand_addr=0x7}, 0x10, 0x0}}, {{&(0x7f0000000940)={0x2, 0x4e25, @broadcast}, 0x10, 0x0}}], 0x2, 0x24000040) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40041) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r7, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r7, 0x40bc5311, &(0x7f0000000340)={0x80, 0x1, 'client0\x00', 0xffffffff80000006, "c625cef6519179cf", "20e48560999fd132b6a542618005b0146ef0e74841003336f79c55ffff346f8f", 0x9, 0x8000}) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='dax\x00', 0x400, &(0x7f0000000480)='syztnl0\x00') r8 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x40) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000140)={'ip_vti0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x700, 0x8, 0x80000000, 0x6, {{0x22, 0x4, 0x0, 0x39, 0x88, 0x65, 0x0, 0x8, 0x2f, 0x0, @broadcast, @multicast1, {[@generic={0x88, 0x10, "7822911436bec014f21083df4210"}, @timestamp_prespec={0x44, 0x54, 0x68, 0x3, 0xc, [{@multicast2, 0x7fffffff}, {@initdev={0xac, 0x1e, 0x1, 0x0}}, {@broadcast, 0x6}, {@dev={0xac, 0x14, 0x14, 0x2b}, 0xfffffffb}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x484}, {@remote, 0x4}, {@broadcast, 0x7}, {@empty, 0x5}, {@rand_addr=0x64010102, 0x1}, {@multicast2, 0xd5000000}]}, @lsrr={0x83, 0xf, 0x45, [@private=0xa010102, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r8, 0x89f1, &(0x7f0000000200)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl0\x00', r9, 0x2f, 0xfd, 0x7, 0xfffffff7, 0x51, @remote, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x20, 0x700, 0x3ff, 0x4}}) write$sndseq(r7, &(0x7f0000000600)=[{0x5, 0xff, 0xf8, 0x0, @time, {0x2}, {0x0, 0x9}, @raw32={[0x3, 0xa, 0x40f4]}}], 0x1c) 2m31.561455342s ago: executing program 5 (id=665): ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = socket(0x840000000002, 0x3, 0xff) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000040), 0x8) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000140)="9745010000004000012c8cc5ffff", 0x5aa}], 0x1, &(0x7f0000000180)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x16}, @rand_addr=0x64010100}}}], 0x20}, 0x400c804) r3 = syz_open_dev$video(&(0x7f0000005500), 0x1, 0x2) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000001c0)={0x1, 0x2, 0x2, 0x0, 0x3}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x200000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) openat(0xffffffffffffff9c, &(0x7f0000001300)='./file1\x00', 0x105042, 0x1ff) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000001340)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f00000013c0)=0x0, &(0x7f0000001400)=0x0, &(0x7f0000001440)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000001480)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001500)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000001540)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000001580)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000001600)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x40000002, 0x15e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x200, 0x3, 0x0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x4000, 0x2, 0x1e9}}], 0x1, &(0x7f0000001880)={0x2e, 0x2, 0x0, r11, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff8, 0x8004, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000001900)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) r12 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r12, 0x7b1, &(0x7f00000012c0)={&(0x7f00000002c0)=[0xa88a, 0x1839, 0x3, 0x6, 0x9, 0x9, 0x5, 0x3, 0x0, 0xe, 0x200, 0xd, 0x3, 0x4, 0x80000000, 0xc, 0xffff95de, 0x6, 0xf3, 0x2, 0x0, 0xf, 0x9, 0xe67, 0xd, 0x1d19, 0xa, 0x7206f3fd, 0x2, 0x800, 0x1d, 0x7, 0x6, 0xe, 0x3ff, 0x1, 0x4, 0x7f, 0x8, 0x80000000, 0x10, 0x51, 0x4, 0xfff, 0x8, 0xfff, 0xc49, 0x8, 0x7, 0x1, 0x0, 0x6, 0x10000, 0x33cd, 0x40, 0x48b, 0xb5b, 0x101, 0xfffffffc, 0x6, 0x4, 0x2, 0x1, 0xf, 0x2, 0x4, 0x3, 0x8, 0xa, 0x101, 0xbbe, 0x2100, 0x3, 0x5, 0x401, 0xe, 0x1, 0x8, 0x3, 0x1, 0x8, 0x859b, 0xf, 0xb287, 0x9, 0x7, 0x5, 0xffffff8c, 0x8000, 0xfe6, 0x79, 0x4, 0x3800000, 0x40, 0xe7, 0x9, 0x7fff, 0x0, 0x6, 0x9, 0x0, 0x1, 0x5, 0xabb, 0x8, 0x10001, 0x865, 0x1, 0x1, 0xacb3, 0x0, 0x10000, 0x8, 0xe, 0xd, 0x8000, 0x2, 0x400, 0x923d, 0x3, 0x3, 0x8, 0xfffffffe, 0x43, 0x0, 0x1, 0x8, 0x1, 0xffffffff, 0x95a, 0xffff, 0x1, 0x9, 0x0, 0x7679, 0x9, 0x6, 0xc, 0x0, 0x6, 0x40, 0x9, 0x10001, 0x994, 0x6, 0x4, 0x0, 0x20000000, 0xfff, 0x3, 0x6, 0x98a2, 0x6eb, 0x3, 0x2, 0x1, 0xc4, 0x4, 0x7, 0x80000000, 0x0, 0x0, 0x1ff, 0x43269c2e, 0x2, 0x8, 0xc98, 0x2, 0xab3, 0x3, 0xffffffc0, 0x26b2a82c, 0x10000, 0x1, 0x2, 0x6, 0x2, 0x7, 0x2, 0x6, 0x4, 0xffff, 0x0, 0x9, 0x3, 0x9, 0x80000000, 0xfffffff5, 0x2, 0x5c, 0xa0, 0x9, 0x4, 0x401, 0x7, 0x3, 0x0, 0x96bc, 0x167, 0x7, 0x5aebd98f, 0x1, 0x528, 0x8000, 0x0, 0x6, 0x0, 0x5, 0x14000000, 0x10000, 0x1, 0x4, 0x7ff, 0x7, 0xa101, 0x4, 0x2, 0x8, 0x5bd9, 0x8, 0x2, 0x6, 0x67a, 0x3ff, 0x0, 0x0, 0x8, 0x271, 0x3, 0x81, 0xe25e, 0x7, 0xb, 0x5, 0x8, 0x6, 0x0, 0x7, 0x6, 0x9, 0x3, 0x9, 0x8, 0x2, 0x7, 0xb, 0x4, 0x8, 0x80, 0xfffffffa, 0xfff, 0x9, 0xfffffff9, 0x9, 0x0, 0x2, 0x7, 0x8, 0x0, 0x8, 0x7, 0xffff, 0x9, 0x40, 0x7, 0x15, 0xff, 0xfffff0ac, 0x200, 0x9, 0xfffffffb, 0x5, 0xdb8, 0x2, 0x1, 0xfffffffb, 0x7, 0xa, 0x1, 0xf27b, 0x7, 0xe0f, 0x80, 0x9, 0xbe2, 0x7, 0xf, 0x9, 0x7, 0xe9d, 0x7f, 0x0, 0x8080000, 0xc, 0x4, 0x3bb7, 0x10001, 0x6, 0x2, 0x9, 0x7, 0x7fff, 0x1, 0x7, 0x5, 0x9, 0x6, 0x7, 0x80000000, 0x100, 0x8, 0x1, 0x2, 0x4, 0x2, 0x7, 0x7f, 0xfffff084, 0x40, 0x5, 0x5, 0x1, 0x251, 0x3, 0xa86c, 0x7, 0x9, 0x4, 0x9, 0xffff9532, 0x5, 0xbb, 0xb, 0xafa, 0x76c, 0x9, 0x1, 0x1000, 0x0, 0x400, 0x9, 0xfffffffc, 0x9, 0x7, 0x6, 0x7, 0x3, 0x10, 0xffffffff, 0x4, 0x1, 0xc, 0x8, 0x2, 0x1, 0x4, 0x2, 0xfffffff7, 0x8, 0x9, 0x8, 0x8, 0x3, 0x7, 0x6, 0x5, 0x7, 0x2, 0xffffff4e, 0x8000, 0xb, 0x7, 0x0, 0x962b, 0xdc02, 0x8, 0x7, 0x0, 0x2, 0x8, 0x7fff, 0xaa7, 0x5, 0x2, 0x6, 0x4, 0x9, 0x5, 0x1, 0x3, 0x40, 0x6, 0x7f, 0x1, 0x6, 0x9, 0xb, 0x6e, 0x40, 0x3, 0x9, 0x2, 0x8, 0x5, 0x81, 0x400, 0x3, 0x6, 0x10001, 0x4, 0x1000, 0x200, 0x400, 0x3a, 0x6, 0x3a, 0x3, 0x2, 0x100, 0x0, 0x5, 0xaad, 0x2b000, 0x100, 0x7f, 0x9, 0x7, 0x6, 0x2, 0x0, 0xd8e, 0x1, 0x0, 0x0, 0x17b4, 0x2, 0x1, 0x1, 0xfff, 0xffffffff, 0x8, 0x2, 0x41bc, 0x1, 0x1, 0x80, 0x4b056e16, 0xf, 0x2f7, 0x2, 0x113, 0x40, 0x63c6, 0x7fffffff, 0xff, 0x2, 0x5bd6, 0xc65, 0x1, 0x7, 0x7, 0x100, 0x61, 0x200, 0xfffffffb, 0x2, 0x5, 0x9, 0x6, 0x9, 0x0, 0xfffffe00, 0x3, 0x0, 0x8, 0x9, 0x3, 0x2, 0x1, 0x5, 0x7fffffff, 0x6, 0x80, 0x6, 0x6, 0xfffffff9, 0x7, 0xa7db, 0x4, 0x9, 0x1, 0x2, 0x8, 0x10001, 0x3, 0x3, 0x1, 0xd, 0x4, 0x6, 0x2, 0xf2b, 0x4, 0x200, 0x8001, 0x4, 0x2, 0xb72, 0xc25, 0x4461084, 0x9, 0xc, 0x7, 0x5, 0xc8ea, 0x7, 0x3, 0x8, 0x2, 0xffffff7f, 0x9, 0x1, 0x7fffffff, 0x5, 0x4, 0x3, 0x2, 0x2, 0x3, 0x3, 0xe, 0x6, 0x80000001, 0x4, 0xa77, 0x9, 0x5, 0x36ff, 0x10001, 0x100, 0x8, 0x8, 0xfffffffb, 0x30d9, 0x8, 0x6, 0x9, 0x0, 0xf, 0x8000, 0x7, 0x9, 0x3, 0xca, 0x0, 0x5, 0x4, 0x1, 0x2, 0x660, 0x5, 0x5, 0x2, 0x9, 0x4, 0x40, 0x200, 0x0, 0x1, 0x7, 0x24, 0x4, 0x6, 0x3a2b, 0x30b3, 0x100, 0xdea, 0x8, 0x400, 0xfffffffb, 0x8, 0x5, 0x7, 0x40000000, 0x20, 0x0, 0x6, 0x3, 0x6, 0x1, 0x7d39, 0x200, 0x7, 0x8001, 0x100, 0x1000, 0x2, 0x7, 0x4, 0x5dc, 0x7, 0x6, 0x6, 0x8, 0x8, 0x2, 0x101, 0x5, 0x8, 0x6, 0xfffffffc, 0x9, 0x4, 0xa, 0x903a, 0x0, 0x4, 0x6, 0xa543, 0xf9ac, 0x8000, 0x1, 0xcd, 0x5, 0x6, 0x9, 0x81, 0x5, 0x5, 0x4, 0x7b, 0x8, 0x3, 0x36, 0x9, 0x515, 0x400, 0x6, 0x1000, 0x363, 0x6, 0xf, 0x6, 0x9f, 0x71, 0xbb7, 0x2, 0x4, 0x7, 0x6, 0x8000, 0x5, 0x200, 0x4db, 0x2, 0x2, 0x5, 0xe0000, 0x0, 0x6, 0x10000, 0xd, 0x0, 0xfffffffe, 0xfffffffa, 0xd, 0x10, 0x7, 0x16d742a9, 0xff, 0xf, 0x9, 0x6, 0x1cf, 0x6c31c136, 0x1, 0x9, 0x0, 0x8, 0x8da, 0x0, 0x2, 0x1, 0x3, 0x412, 0xc, 0x9, 0x0, 0x0, 0xd, 0x80000000, 0x8, 0x5, 0x7, 0x9, 0x49c8, 0xffff8001, 0x401, 0x3, 0x5, 0x3, 0x101, 0x1ff, 0x4, 0x5, 0x7, 0x4, 0x5, 0x1, 0x2, 0x6, 0x80, 0x5, 0xfffffffc, 0x6, 0x3, 0x7, 0x7, 0x4, 0x7, 0x1, 0x7fffffff, 0xe4, 0x5, 0xea, 0x2, 0x7, 0xffffffff, 0x87, 0x80000001, 0x4ab0, 0xfcaf, 0x0, 0xac57, 0x27af, 0x3, 0x8, 0x2, 0x8, 0x4, 0x2, 0x7, 0x4, 0x6, 0xff, 0xf487, 0x7, 0x6, 0x3, 0xb, 0x2, 0x9, 0xffffffff, 0x7eb, 0x4, 0x2, 0x3, 0x7, 0xa76, 0x10001, 0x7fffffff, 0x2, 0x8000, 0x0, 0x9, 0xffffffff, 0xffff, 0xfffffffd, 0x0, 0x1, 0x200, 0x164e, 0x4f2, 0xfffffffa, 0xfcd3, 0x8, 0x7, 0x0, 0x4dbb, 0x5, 0x6, 0xd9, 0x10000, 0x9, 0x2, 0x75a, 0x3, 0x80000000, 0x4, 0x1, 0x8, 0xfffffe01, 0x6, 0xd4a, 0x3, 0x8, 0x1f7, 0x3, 0x5, 0x9, 0x7, 0x26, 0xfffffffe, 0x8000, 0x50d, 0xff, 0x4, 0x40, 0x1, 0x0, 0x9, 0x0, 0xea0f, 0x0, 0x5, 0x800, 0xbd, 0xfff, 0xffffe4e7, 0x47e, 0xe, 0x8000, 0x6, 0x2, 0x3, 0x3, 0x80, 0x7, 0x1000, 0x4, 0x6, 0x7, 0x400, 0x9dac, 0x7fffffff, 0x4, 0x1, 0x7, 0x4, 0x0, 0x4, 0x2, 0x8, 0xffff, 0x3e, 0x3, 0x1, 0x1, 0x8, 0x9, 0x3, 0x101, 0x3, 0x9, 0xf2d, 0x0, 0xd8b, 0x0, 0x6, 0x9, 0x1, 0x1, 0xfffffff8, 0x1, 0xc6, 0x0, 0x40, 0x5, 0x1, 0x0, 0xb6e3, 0x8, 0x6, 0x80000000, 0x3ff, 0x2, 0x7, 0x3, 0xfffff52e, 0x6, 0x6, 0x2, 0x1000, 0x1, 0xe, 0x7eb1, 0xfffffff3, 0xff, 0x9, 0x7, 0xc, 0x3738, 0x5, 0x5, 0xfff, 0x1ff, 0x10, 0x4, 0x5, 0x2, 0x80000001, 0x6, 0x7, 0x2, 0x5, 0x80000001, 0x7, 0xfffffffd, 0x4, 0xe5, 0x4, 0x9, 0xffff, 0x0, 0x7, 0xfffffff0, 0x2, 0xe32, 0x4d87, 0x1, 0xfffffffc, 0x8, 0xcd, 0x3, 0x8, 0x5, 0xd97e, 0x4, 0x401, 0x2, 0x9, 0x813c, 0x7, 0x1ffd, 0x40, 0x1, 0x5, 0xc53, 0x9e8, 0x4, 0x0, 0x0, 0x5, 0x200, 0x0, 0x101, 0x6, 0x3, 0xa0000, 0x7, 0x7, 0x7, 0x1ff, 0xfffffffb, 0x787, 0x5, 0x80, 0x3, 0x40000000, 0x2, 0x8, 0x7fff, 0x8, 0x9, 0x1, 0x1, 0x2, 0x1, 0x9, 0x81, 0x9, 0x5, 0x5, 0x1, 0x28, 0x80, 0xc585, 0x8, 0x9, 0x5, 0x9, 0x69, 0x0, 0x5, 0xffffffff, 0x7fffffff, 0xc03, 0xc765, 0x2, 0x13, 0xfffffff8, 0x9, 0x0, 0xab, 0xca25, 0x7, 0x0, 0xfffffffa, 0x54, 0x1ff, 0x9, 0x0, 0x1ff, 0x8, 0xe475, 0x81, 0xd5f, 0xfffffffb, 0x2, 0x0, 0xe71, 0x3, 0x6, 0x0, 0x8, 0x1, 0x4, 0x91c, 0x710e83c8, 0x2, 0x129, 0x1, 0x101, 0x80000000], 0x1, 0x400, 0x6}) ptrace$PTRACE_SETSIGMASK(0x420b, r4, 0x8, &(0x7f0000000240)={[0x200]}) ptrace$poke(0x5, r4, &(0x7f0000000000), 0x7) ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000005580)=@userptr={0x0, 0x2, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x2, {&(0x7f0000005600)}, 0x400000}) 2m31.238912059s ago: executing program 5 (id=668): r0 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0xe3) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) ioctl$AUTOFS_IOC_SETTIMEOUT(r1, 0x80049367, &(0x7f00000001c0)=0x7) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x82307201, &(0x7f0000000200)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci\x00', 0x0, 0x0) r3 = openat(r2, &(0x7f0000000140)='drivers_probe\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000440)={0xaa, 0x234}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000480)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) write(r3, &(0x7f0000000180)='0000:00:01.0\x00', 0xd) ioctl$NBD_DO_IT(r0, 0xab03) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000a40)={0x1, &(0x7f0000000a80)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r5, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 2m16.082616448s ago: executing program 34 (id=668): r0 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0xe3) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) ioctl$AUTOFS_IOC_SETTIMEOUT(r1, 0x80049367, &(0x7f00000001c0)=0x7) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x82307201, &(0x7f0000000200)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci\x00', 0x0, 0x0) r3 = openat(r2, &(0x7f0000000140)='drivers_probe\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000440)={0xaa, 0x234}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000480)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) write(r3, &(0x7f0000000180)='0000:00:01.0\x00', 0xd) ioctl$NBD_DO_IT(r0, 0xab03) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000a40)={0x1, &(0x7f0000000a80)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r5, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 1m58.755205809s ago: executing program 4 (id=829): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$FOU_CMD_DEL(r0, 0x0, 0x4040080) 1m58.484085895s ago: executing program 4 (id=830): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dev\x00', 0x1cd) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x2, 0x0) (fail_nth: 3) 1m57.938064598s ago: executing program 4 (id=831): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000140)=@name={0x1e, 0x2, 0x1, {{0x41}, 0x3}}, 0x10) listen(r0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000180)={&(0x7f00000001c0)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0}, 0x4) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000200)={0x1, &(0x7f0000000240)=[{0x6}]}) close_range(r2, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./dev\x00', 0x4c27e, 0x130) fallocate(r3, 0x0, 0x0, 0x1000f4) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280), 0x4000000004882, 0x0) io_setup(0x1, &(0x7f00000002c0)=0x0) io_submit(r5, 0x4d, &(0x7f0000000300)=[&(0x7f0000000340)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, r4, &(0x7f0000000380)="9880378312a63e112602d9670ab688dbd0d40a0f4d8b9cb3af17658e2e4f8be7a2f40caf8cadd95b1c97eda546798277b267dc15abe1a12eaf2f0ce524588df014e8d7e56e49bf5e852f0b98aa", 0x3e8000072a, 0x7000000, 0x0, 0x10}]) r6 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x150a, 0x1201, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x82, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x11, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0xfc, 0x0, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1014de29c198c0508950129309102c0"], 0x0}, 0x0) ftruncate(r3, 0x1) read$FUSE(r3, &(0x7f0000000e40)={0x2020}, 0x2020) r7 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e7cc6120c4108a81ad7d0102030109021b00010000c005090423000103"], 0x0) syz_usb_control_io$cdc_ncm(r7, 0x0, &(0x7f0000000dc0)={0x44, &(0x7f0000000bc0)={0x0, 0x15, 0x3, "c39242"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1m54.529601174s ago: executing program 4 (id=861): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000780)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000800)='X', 0xfee4, 0x0, &(0x7f0000000840)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (fail_nth: 3) 1m54.426239318s ago: executing program 4 (id=863): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1f6) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x23, &(0x7f0000000040)=""/24, &(0x7f0000000080)=0x18) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x40042, 0x1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x8c, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) mount(0x0, &(0x7f0000000200)='./sys/kernel/tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) 1m54.396382805s ago: executing program 4 (id=865): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000040)={0xa, 0x4e20, 0x6, @mcast1}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000001140)={0x20, 0x11, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0x0, 0x0, 0x0, @binary="2cc2ecdb28f85230"}]}]}, 0x20}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendto$inet6(r1, &(0x7f0000000080)='\r\n', 0x2, 0x6d91fb6102d8910c, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x10, 0x0, 0x0) recvfrom(r1, &(0x7f00000000c0)=""/4043, 0xfcb, 0x3, 0x0, 0x0) connect$inet(r0, &(0x7f0000008940)={0x2, 0x4e22, @local}, 0x10) 1m39.32528014s ago: executing program 35 (id=865): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000040)={0xa, 0x4e20, 0x6, @mcast1}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000001140)={0x20, 0x11, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0x0, 0x0, 0x0, @binary="2cc2ecdb28f85230"}]}]}, 0x20}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendto$inet6(r1, &(0x7f0000000080)='\r\n', 0x2, 0x6d91fb6102d8910c, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x10, 0x0, 0x0) recvfrom(r1, &(0x7f00000000c0)=""/4043, 0xfcb, 0x3, 0x0, 0x0) connect$inet(r0, &(0x7f0000008940)={0x2, 0x4e22, @local}, 0x10) 54.110956753s ago: executing program 3 (id=1151): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./dev\x00', 0x1bf) mount(0x0, &(0x7f0000000280)='./dev\x00', &(0x7f00000002c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x24) mount(&(0x7f0000000340)=@filename='./dev/sda1\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f00000003c0)='ext4\x00', 0x8410, 0x0) r0 = open$dir(&(0x7f0000000400)='./mnt\x00', 0x0, 0x2) r1 = add_key$fscrypt_provisioning(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, &(0x7f0000000680)=ANY=[@ANYBLOB="01"], 0x29, 0xfffffffffffffffb) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000500)={@desc={0x1, 0x0, @auto="f43d8a86c1dcf6a0"}, 0x0, r1}) (fail_nth: 1) 53.747481835s ago: executing program 3 (id=1152): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="141bdf000060", @ANYRES64=r0], 0xb2) openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r2, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8b18, &(0x7f0000000280)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x24, r5, 0x1, 0x0, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}}, 0x0) 53.443556965s ago: executing program 3 (id=1155): r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000640)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000700)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000ffff00000000000000bd0000000000000000000000e4ec01000000004000000000fc00000000000000000000000000013da51fd47aa2e2f700000000000000000000000000000000000000000000000000000000000000060000000000000000050000000a004e200e8a34c38f36f0c7eb2700d609bcf41076d88144448ebe7994dd1b33d7c8787734cc315672f62261ceeede940774fd94d2767288cfb3a20882449d601ff878eedd3d57c9eb3a723b62102bd534c8a304a975d752e82cc8d5f969771c94a1d69cfd8694e29b9468fca5df65ece31ed7c209325604001fcd06adc3ac391f60a3523d6d0b4a8a41d39b78"], 0x310) (fail_nth: 3) 52.992003316s ago: executing program 3 (id=1158): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000007780), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f00000077c0)={0x0, 0x0, &(0x7f0000007800)={&(0x7f00000078c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010025bd7000000000001000000018000180140002006e657464657673696d300000000b000005000b00020000001c5e17e7c2897fbf008a8e214e2f20099625ebdd99ccd744695ed301bed7da0555b96d645f94973879fda5a71dd9eccf2d4273de055837caae9b0d001a66207c786a474ea9d9467089b5ac393b81cdddb220755c151142b8041f983e35938ac3bca56d374ec60b71a759a3d23f29aa2ab917c67e82fa48ef6e7ef75b3241c7b16ba1aa8c7baccb297039dc1386d94ca72e0f34da731caeff56a146bfc30020a17b769efb2c306883ff31ea7567246308f2587923cbe8959e270fe32f8cd4b77f8f"], 0x34}}, 0x4000000) mkdir(&(0x7f0000005640)='dir0\x00', 0x80) mount(0x0, &(0x7f0000007680)='dir0\x00', &(0x7f00000076c0)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000007700)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0) read(r3, &(0x7f0000007740)=""/9, 0xffffff7a) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000680)={0x8000, r0, 'id1\x00'}) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000700)) memfd_create(&(0x7f00000001c0)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000a00)=ANY=[@ANYBLOB="08248c236c64d1e4606bd0a9753a4126764201cb14493503af3341adf8a6f6dfa7cd3c5a4261917084952ab80a2fb0bb40042e720af08c88f482362ab55f3ffd811ee30f8e8243c55d3a56b1449801ae98a856102b9904699a85619c8f5f188277da534b603e98bff78bae54e116632043eb148ed568f6077b2048f17b57f84ce20c6a00d8fee82930dba88cdea45fffda1bb2e2d350cd0af54e12d844d2a0104f4a5c1fc5dc762c6d31040b7f76c595", @ANYRESOCT=r0, @ANYBLOB="e4ca8ecd4f03e014d07945d36ccb076f110bbda7794835cfcf9cf75f21a0b3f23fe56c1fe598b04bb34468d8a413c5cbf692d82597c3286fba114c554d12e76f30c92923ea42e549b04eb2dc607a01165fb8021ad11f54dca3ff59d346a384d3704616662b6b154b4b2a119bf68fca09af7160a209dbfbc8822ba7c8eba575e1de1450faa4374d6968bc0a8d2a526af2b93fdd8d3fa74f6e1c5a51f03e4983a478ef557260ed464a3336a2ddb1ee88813b36a6583b7d51124dcacb70f09ecfe28f67", @ANYRES32=r5], 0x0) syz_open_dev$usbmon(&(0x7f00000004c0), 0x8002, 0xa2000) r6 = syz_open_dev$audion(&(0x7f0000000500), 0x3, 0x1) write$P9_RVERSION(r6, &(0x7f0000000540)=ANY=[], 0xfffffcd9) close_range(r0, 0xffffffffffffffff, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006ad36c080a113011a3b3010203010902240001020010030904f10202048f4500090509020002022000090582", @ANYBLOB="4e81de"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x42, 0x85) mount$fuse(0x0, &(0x7f0000000540)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0xb6408, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000740)={0x0, 0x10, &(0x7f0000000780)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f00000007c0)=0x10) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r7, 0x84, 0x76, &(0x7f0000000800)={r8, 0x3}, 0x8) recvmmsg(r7, &(0x7f0000007480)=[{{&(0x7f0000000840)=@l2tp={0x2, 0x0, @private}, 0x80, &(0x7f0000000cc0)=[{&(0x7f00000008c0)=""/65, 0x41}, {&(0x7f0000000940)=""/44, 0x2c}, {&(0x7f0000000980)=""/121, 0x79}, {&(0x7f0000000bc0)=""/247, 0xf7}], 0x4, &(0x7f0000000d00)=""/199, 0xc7}, 0xfff}, {{0x0, 0x0, &(0x7f0000002f40)=[{&(0x7f0000000e00)=""/4096, 0x1000}, {&(0x7f0000001e00)=""/28, 0x1c}, {&(0x7f0000001e40)=""/4096, 0x1000}, {&(0x7f0000002e40)=""/41, 0x29}, {&(0x7f0000002e80)=""/190, 0xbe}], 0x5, &(0x7f0000002fc0)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000003fc0)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000005240)=[{&(0x7f0000004040)=""/4096, 0x1000}, {&(0x7f0000005040)=""/3, 0x3}, {&(0x7f0000005080)=""/93, 0x5d}, {&(0x7f0000005100)=""/31, 0x1f}, {&(0x7f0000005140)=""/211, 0xd3}], 0x5, &(0x7f00000052c0)=""/221, 0xdd}, 0x2}, {{0x0, 0x0, &(0x7f0000005680)=[{&(0x7f00000053c0)=""/94, 0x5e}, {&(0x7f0000005440)=""/41, 0x29}, {&(0x7f0000005480)=""/86, 0x56}, {&(0x7f0000005500)=""/172, 0xac}, {&(0x7f00000055c0)=""/58, 0x3a}, {&(0x7f0000005600)=""/38, 0x26}, {&(0x7f0000005640)}], 0x7, &(0x7f0000005700)=""/114, 0x72}, 0x4}, {{&(0x7f0000005780)=@qipcrtr, 0x80, &(0x7f0000005980)=[{&(0x7f0000005800)=""/126, 0x7e}, {&(0x7f0000005880)=""/243, 0xf3}], 0x2, &(0x7f00000059c0)=""/179, 0xb3}, 0x8}, {{0x0, 0x0, &(0x7f0000005e80)=[{&(0x7f0000005a80)=""/198, 0xc6}, {&(0x7f0000005b80)=""/217, 0xd9}, {&(0x7f0000005c80)=""/224, 0xe0}, {&(0x7f0000005d80)=""/81, 0x51}, {&(0x7f0000005e00)=""/85, 0x55}], 0x5, &(0x7f0000005f00)=""/16, 0x10}, 0x10}, {{0x0, 0x0, &(0x7f0000007240)=[{&(0x7f0000005f40)=""/4096, 0x1000}, {&(0x7f0000006f40)=""/100, 0x64}, {&(0x7f0000006fc0)=""/170, 0xaa}, {&(0x7f0000007080)=""/2, 0x2}, {&(0x7f00000070c0)=""/203, 0xcb}, {&(0x7f00000071c0)=""/1, 0x1}, {&(0x7f0000007200)=""/19, 0x13}], 0x7}, 0x5}, {{&(0x7f00000072c0)=@pptp={0x18, 0x2, {0x0, @empty}}, 0x80, &(0x7f0000007400)=[{&(0x7f0000007340)=""/133, 0x85}], 0x1, &(0x7f0000007440)=""/27, 0x1b}, 0x1}], 0x8, 0x0, 0x0) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x3) r10 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000007880), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r10, 0xc100565c, &(0x7f0000000580)={0x800, 0x7fffffff, 0x1, {0x9, @pix_mp={0x4, 0x6, 0x31364d4e, 0x3, 0x6, [{0x3, 0x400}, {0x3, 0xb4}, {0x2, 0x8001}, {0x9eb9, 0x80000001}, {0x2, 0x2}, {0x9, 0x10000}, {0x7, 0x6}, {0x2, 0x80000000}], 0x1d, 0xd9, 0x4, 0x2, 0x5}}, 0x10000}) read$char_usb(r9, &(0x7f0000000040)=""/218, 0xda) 49.873662981s ago: executing program 3 (id=1169): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8b20, &(0x7f00000000c0)={'wlan1\x00', @random="000000803e00"}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r2, 0x11, 0x67, 0x0, &(0x7f0000000040)) sendmsg$NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYRES16=r2, @ANYRESHEX=r0, @ANYRES64=r1], 0x12c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8845) unshare(0x20000000) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x1) syz_clone3(&(0x7f0000000400)={0x6200, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, &(0x7f0000000480)=[r3], 0x1}, 0x58) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_FP_MODE(0x42, 0x0) syz_clone(0xa0100411, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f00000004c0), 0x0, 0x88840) r4 = syz_io_uring_setup(0xd3a, &(0x7f0000000380)={0x0, 0x87cd, 0x3011, 0x3, 0x3}, &(0x7f0000000140)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000180)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f00000002c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x1, 0xad0, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff, 0x0, 0x8}}}, 0x0) 49.554939935s ago: executing program 3 (id=1170): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x4000000004002, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) sync() r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000003c0)=[@text64={0x40, 0x0}], 0x1, 0x60, 0x0, 0x0) (fail_nth: 1) 41.439638097s ago: executing program 6 (id=1217): mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000540)='./proc\x00', &(0x7f0000000580)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc/thread-self/fail-nth\x00', 0x2, 0xc0) write(r0, &(0x7f0000000600)='27', 0x2) mount(0x0, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', &(0x7f0000000080)='devpts\x00', 0x0, 0x0) 41.187818222s ago: executing program 6 (id=1218): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x300000d) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000100)={{0x80, 0x9}, 'port0\x00', 0x89, 0x90010, 0x3, 0x2, 0x0, 0x0, 0x200000}) (async) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_VDPA_GET_VQS_COUNT(r2, 0x8004af80, &(0x7f0000000040)) (async) pipe2$watch_queue(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000580)={0x0, 0x3}, 0x10) (async) getsockopt$inet6_opts(r0, 0x29, 0x1d, 0xffffffffffffffff, &(0x7f00000000c0)) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r1, {0x9}}, './file0\x00'}) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000340)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000380)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x6, &(0x7f00000003c0)={r6, @in6={{0xa, 0x4e20, 0x3, @private1, 0xcda}}}, &(0x7f0000000480)=0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f00000004c0)={r7, 0x8000, 0x5}, &(0x7f0000000500)=0x8) (async) read$alg(r4, &(0x7f0000000200)=""/238, 0xee) 40.987031166s ago: executing program 6 (id=1219): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x10800, 0x0) write(r0, &(0x7f0000000140)='27', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000008c0)='sys\x00', &(0x7f0000000900)='sysfs\x00', 0x0, 0x0) 40.973727717s ago: executing program 6 (id=1220): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8b20, &(0x7f00000000c0)={'wlan1\x00', @random="000000803e00"}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r2, 0x11, 0x67, 0x0, &(0x7f0000000040)) sendmsg$NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYRES16=r2, @ANYRESHEX=r0, @ANYRES64=r1], 0x12c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8845) unshare(0x20000000) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000280), 0x0, 0x1) syz_clone3(&(0x7f0000000400)={0x6200, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, &(0x7f0000000480)=[r3], 0x1}, 0x58) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_usb_disconnect(0xffffffffffffffff) r4 = syz_io_uring_setup(0xd3a, &(0x7f0000000380)={0x0, 0x87cd, 0x3011, 0x3, 0x3}, &(0x7f0000000140)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000180)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f00000002c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x1, 0xad0, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff, 0x0, 0x8}}}, 0x0) 40.126835378s ago: executing program 6 (id=1222): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000001c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000340)={{0xffff0000, 0xeeee8000, 0xf000, 0x7, 0x7, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81}, {0x1, 0xddccb000, 0xf, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1}, {0x1ffc, 0xdddd8000, 0x18, 0x1e, 0x0, 0x4, 0x81, 0x0, 0x3, 0xe, 0x3, 0x6}, {0xdddd0000, 0x2000, 0xc, 0xfd, 0x5, 0x0, 0x3}, {0x2, 0x25000, 0xd, 0x7, 0x70, 0x81, 0x0, 0x0, 0xfd, 0x1c, 0x7, 0xa8}, {0x100026fff, 0x80a0000, 0x8, 0x4, 0x1, 0x8, 0x0, 0x0, 0x6, 0xfc, 0x86, 0xfe}, {0xeeee8000, 0x26000, 0xf, 0x6, 0x5, 0x0, 0x0, 0x81, 0x0, 0x4}, {0xd000, 0x41000, 0x8, 0x82, 0xfc, 0x10, 0x0, 0xe, 0x0, 0x2}, {0x4000, 0x800}, {0x1ff8, 0xfffe}, 0x40040011, 0x0, 0x0, 0x10, 0x1000010000000001, 0x0, 0x900, [0x0, 0x400000000000, 0x6, 0x5]}) ioctl$KVM_SET_MSRS(r4, 0x4140aecd, &(0x7f0000000480)) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000240)={&(0x7f0000000280)=""/59, 0x312000, 0x800, 0x0, 0x2}, 0x20) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f00000002c0)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r6, 0x0, 0x60, &(0x7f0000000100)={'filter\x00', 0x4, [{}, {0x0, 0x100000000000000}]}, 0x68) write(r0, &(0x7f0000000180)='7', 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x8031, 0xffffffffffffffff, 0x0) 39.897273573s ago: executing program 6 (id=1223): r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x40042, 0x5) lsetxattr$security_ima(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240), &(0x7f0000000280)=@v2={0x5, 0x0, 0x5, 0xe}, 0x9, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect_ath9k(0x3, 0x56, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x38e38e38e38e70d, [{{0x9, 0x2, 0xfffffffffffffe0b}}]}}, 0x7fe782539b0b) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat(0xffffffffffffffff, &(0x7f0000000140)='./file0/file0\x00', 0x202200, 0x101) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x15) openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0), 0x400, 0x0) ioctl(r1, 0x404c4701, &(0x7f0000000100)="0100000001000000010000000000000001000000000000000000000040000000400000000000000001") unlinkat(r0, &(0x7f0000000300)='./file0\x00', 0x200) 34.445077038s ago: executing program 36 (id=1170): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x4000000004002, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) sync() r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000003c0)=[@text64={0x40, 0x0}], 0x1, 0x60, 0x0, 0x0) (fail_nth: 1) 24.860589993s ago: executing program 37 (id=1223): r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x40042, 0x5) lsetxattr$security_ima(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240), &(0x7f0000000280)=@v2={0x5, 0x0, 0x5, 0xe}, 0x9, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect_ath9k(0x3, 0x56, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x38e38e38e38e70d, [{{0x9, 0x2, 0xfffffffffffffe0b}}]}}, 0x7fe782539b0b) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat(0xffffffffffffffff, &(0x7f0000000140)='./file0/file0\x00', 0x202200, 0x101) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x15) openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0), 0x400, 0x0) ioctl(r1, 0x404c4701, &(0x7f0000000100)="0100000001000000010000000000000001000000000000000000000040000000400000000000000001") unlinkat(r0, &(0x7f0000000300)='./file0\x00', 0x200) 11.598858618s ago: executing program 9 (id=1331): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002980), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000029c0)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000002a00)=[@text32={0x20, &(0x7f0000002880)="0f013b0f019b1f0000000f20d835200000000f22d80f78bb002000000fc7b5dd000000f00fc1bf0000000066baf80c652e0fc71c7bef66bafc0ced3467660ff82a66baf80cb8761e328845efefbafc0cb027eec4c1edc25a164f", 0x5a}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x900) 11.199979768s ago: executing program 9 (id=1332): socket$inet_mptcp(0x2, 0x1, 0x106) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/diskstats\x00', 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="ad5a97"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000001c0)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="ac184d"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000e00)={0x2c, &(0x7f0000000b40)={0x0, 0x8, 0xb8, {0xb8, 0xa, "a348b526b7fa008b18287f868a2ccf9652a4994ad51cca039d03c8d8bba6cbc3d366fc3bb51ed602c1cc2a6b85381045f1ce7be1756549bca8e5ffe856ebf53b9ce6e3ffac1f590aae059bd26d7340a48e3b48d75ab0dfa84d7005e378d846fb9d7c063861bfd881e280047011eb1585db98ddeeda39eaad122b53125c2e0238b698c835a5f5bf581a31ea564d3362434bde016d223a8b4007fbd254f69545ebf6c365b1d0b182b1189de4a8c1b409c8f90fcb487c1a"}}, &(0x7f0000000c00)={0x0, 0x3, 0xda, @string={0xda, 0x3, "4c517de484c39236036b13ffc46dea07cf836a3b9dd03349e00c71456a0e44539beae9c676bf8095ea4d8fb85fe259462cb26028d04cd23efa0e910819894a6a761c4baed3e542a2964d3f9d806af7f865f0486d6a03b97db83651954fd8600500d1d1fda93800e0722003efa3526277e3402405a0954cf2ac8e2988f2437052637e7fb56850d30fc9f083dc931125c2ce696a8153ab80a0bbfee367474dfedc7531de1ef837e3f80733f6f0bc552bf370a02a56f745ad2b4723c7c9d9e223e26cb58e46fe687b5d94a34e36e8bcb74bb82187703545388a"}}, &(0x7f0000000d00)={0x0, 0xf, 0x4b, {0x5, 0xf, 0x4b, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x8, "f037d5faf832fbf02efcb73768eebd88"}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x8, 0xa, 0x82}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "3545874423448cd8f309846f6fc9ff04"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xc, 0xca, 0x2, 0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x7, 0x7f, 0x80, 0x6}]}}, &(0x7f0000000d80)={0x20, 0x29, 0xf, {0xf, 0x29, 0x40, 0x80, 0x4, 0x8, "80dee5d6", "c1e8e8ef"}}, &(0x7f0000000dc0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x50, 0x0, 0x5, 0xf9, 0x0, 0xbc, 0x5}}}, &(0x7f0000001280)={0x84, &(0x7f0000000e40)={0x40, 0x2, 0x65, "c98aa50d8f67a4c6d337cde45cd3faed0bdecdbba0a1a417c30c1c2838363454f1695956350c412a95c51042d08dabd0d74a283d4b6695cebd11cb32bcfbe7c6d9fba6f36697c3ec93675f754bbb2d66e7467666e81cc3837b15a10c7945b607d8aeef4d60"}, &(0x7f0000000ec0)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000f00)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000f40)={0x20, 0x0, 0x4, {0x0, 0x3}}, &(0x7f0000000f80)={0x20, 0x0, 0x4, {0x2e1, 0x4}}, &(0x7f0000000fc0)={0x40, 0x7, 0x2, 0x8}, &(0x7f0000001000)={0x40, 0x9, 0x1, 0x8}, &(0x7f0000001040)={0x40, 0xb, 0x2, "d155"}, &(0x7f0000001080)={0x40, 0xf, 0x2, 0x9}, &(0x7f00000010c0)={0x40, 0x13, 0x6, @remote}, &(0x7f0000001100)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x42}}, &(0x7f0000001140)={0x40, 0x19, 0x2, "65f6"}, &(0x7f0000001180)={0x40, 0x1a, 0x2, 0xd}, &(0x7f00000011c0)={0x40, 0x1c, 0x1, 0x10}, &(0x7f0000001200)={0x40, 0x1e, 0x1}, &(0x7f0000001240)={0x40, 0x21, 0x1, 0x5}}) 8.017743389s ago: executing program 9 (id=1343): kexec_load(0x0, 0x1, &(0x7f0000000040)=[{0x0, 0x11, 0x1000000, 0x80000000}], 0x0) kexec_load(0x4e, 0x0, 0x0, 0x3e0000000000) 6.576156667s ago: executing program 9 (id=1350): r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000700)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x2, 0x0) sendfile(r0, r0, 0x0, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./bus\x00', 0x140) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000780)='./debug\x00', &(0x7f00000007c0)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x0) lseek(r1, 0x0, 0x0) add_key(0x0, &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x20004450) sendmsg$NFT_BATCH(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000060a1f0400000000000000000a0000030900010073797a31000000001800048014000180090001006861736800000000040002800900020073797a12d6f9aa6563f53a83a440493200000000140000001100010000000000000000000000000abff29c942bcac656690500000000000000746336365683c557806c89c95162a3e1a6fcb274ca7ce681aa1612dae463d5c1a73cb954a99d73947e670500027d372f6dc2c5b99ee970111ac6700395c9fe4bf3aa135b3d69c67f66bffa061c12f2406e843a5aa355503870986ae5c0bd81fdfc2c31ba57000030a5b7fa7a8d55672d54ff5e01000000000000a2ccdcdde29daff97f5a3a433291c732d494a1aa45f5060ff544312fb4b37c5f9a9cf8ad40b1e93ca36bae3fc2cc38cc6730a4a6a7fd2da6d50743b829f5be5c1f8a6335fe433e0bb5d92ab969d2daf147e97b059af8d0d237ec448537ec25a6f2cf6defabab16d5a79485abe4e90ad9721b3ad21ab4"], 0x6c}, 0x1, 0x0, 0x0, 0x14040001}, 0x24000840) preadv(r2, &(0x7f0000000140)=[{&(0x7f0000000180)=""/124, 0xffffff23}], 0x18, 0x8, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c825800000105050000000000000000060000002d0002"], 0x2c}, 0x1, 0x0, 0x0, 0x4040081}, 0x40c0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f00000002c0)={0x0, 0x49, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d01"], 0x64}, 0x1, 0x0, 0x0, 0x44805}, 0x0) r5 = syz_usb_connect(0x2, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) shutdown(r6, 0x0) mount$overlay(0x0, &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f00000005c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000000600)='./bus\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) 5.014200758s ago: executing program 8 (id=1354): unshare(0x20000000) syz_usb_disconnect(0xffffffffffffffff) r0 = syz_io_uring_setup(0xd3a, &(0x7f0000000380)={0x0, 0x87cd, 0x3011, 0x3, 0x3}, 0x0, &(0x7f0000000000)=0x0, &(0x7f0000000180)=0x0) syz_ublk_add_dev(r0, 0x0, r1, r2, &(0x7f00000002c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x1, 0xad0, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff, 0x0, 0x8}}}, 0x0) 4.946402023s ago: executing program 9 (id=1355): setns(0xc9, 0x0) r0 = socket$netlink(0x10, 0x3, 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./dev\x00', &(0x7f0000000300)='ecryptfs\x00', 0x40000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./mnt\x00', 0x1ff) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)="5c00000011006bcc9e3be3e1a517aa31076b866c1d0000007ea60864160af3653c001a0038006635000000000000010009000300eab556a705251e618a94ff0251f60a84a7f4d4938037e786a6d0001000000e4509c5bbe372c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x48020) mount(&(0x7f0000000380)=@filename='./dev/sda1\x00', &(0x7f00000003c0)='./mnt\x00', &(0x7f0000000400)='ext4\x00', 0x8410, 0x0) setxattr$system_posix_acl(&(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='system.posix_acl_access\x00', &(0x7f00000004c0)={{}, {0x1, 0x1}, [], {}, [], {0x10, 0x4}, {0x20, 0x5}}, 0x24, 0x1) r2 = dup(r0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_OPEN(r2, 0x4010e501, &(0x7f0000000040)={r3}) r4 = open(&(0x7f0000000200)='./file1\x00', 0x109cc2, 0x20) ftruncate(r4, 0x200004) ioctl$SYNC_IOC_MERGE(r0, 0xc0303e03, &(0x7f0000000080)={"ccac9dea3df1f345c543cb81f2cba3cdf5ee5684b5241b76b67ae2682ca0dfdc", r2, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r2, 0xc0383e04, &(0x7f0000000240)={""/32, 0x0, 0x0, 0x4, 0x0, &(0x7f00000000c0)=[{}, {}, {}, {}]}) sendfile(r2, r5, 0x0, 0x401) 4.848222637s ago: executing program 9 (id=1356): mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000580)='./proc\x00', &(0x7f00000005c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r1, &(0x7f0000000040)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r1, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x74, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0xf7, 0xd0, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "a9443e0977ba"}, {0x5, 0x24, 0x0, 0x3}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6c, 0xde, 0x5}, {0x6, 0x24, 0x1a, 0x1, 0x28}}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0xff, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3f7, 0x7, 0x2, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0xf, 0x4}}}}}}}]}}, &(0x7f0000000380)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x1, 0x5, 0x8, 0x10, 0x6}, 0x26, &(0x7f0000000200)={0x5, 0xf, 0x26, 0x5, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0xd6, 0xc, 0x7}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xa, 0x9, 0x2, 0xfffe}, @ext_cap={0x7, 0x10, 0x2, 0x16, 0x2, 0x0, 0x5}]}, 0x2, [{0x4, &(0x7f0000000240)=@lang_id={0xfffffffffffffdff, 0x3, 0x418}}, {0xdb, &(0x7f0000000280)=@string={0xdb, 0x3, "41dd151cf089e57126297f684d2685608bf319770b72c0060110231a1bdb295f5be4cda93649bd3dbb234f67baecea20e198b61c9bb0cd898bef975b325ea37a96ec1bc1b341627202aec2d6c7a0a775754e84511da0dd1e3a8fe7ac1cc93c3a065508bfb38aad20a802dbeddf3c1e7d456b92a1e5b48b44662b7dc963d8334cbc03fc67489f33abc06524e61c7f29c6c97792f9850913fa00abd3fcd812656ca95cd727efa27057fe528ba8fa8eb0b5950fcd2f844eb7fb02075b676179d40860e557a7070d8389cf9cecfeb945257838ee27137845d169e8"}}]}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0xb, 0x60443) ioctl$DRM_IOCTL_MODE_ADDFB(r2, 0xc01c64ae, &(0x7f0000000100)={0x0, 0x6, 0x3, 0x7, 0x2, 0x4, 0xfffffc00}) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00000003c0)={'veth0\x00', @multicast}) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, r3, 0x0, 0x2, 0xfffffffffffffffe) write(r0, &(0x7f0000000640)='3', 0x4e) 4.285294773s ago: executing program 8 (id=1357): munmap(&(0x7f0000ff3000/0xb000)=nil, 0xb000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001400)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) brk(0x200000ffc000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000001580)={0x1f, 0xffff, 0x3}, 0x6) ioctl$KVM_GET_FPU(0xffffffffffffffff, 0x81a0ae8c, &(0x7f00000003c0)) write(r2, &(0x7f00000015c0)="3300000008001400000000000000", 0xe) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000001c0)={'syzkaller1\x00', 0x5001}) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000240)={'syzkaller1\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x0, 0x1}}}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001500)='westwood', 0x8) mmap(&(0x7f00009e1000/0x2000)=nil, 0x2000, 0x200000b, 0x110, 0xffffffffffffffff, 0xc55dd000) r5 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000001600), 0x2, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000001640)={0x0, 0x0, 0x100}, &(0x7f00000016c0)=0x0, &(0x7f0000001700)=0x0, &(0x7f0000001740)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000001780)={0x2e, 0x0, 0x0, r5, 0xc0207512, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001800)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, &(0x7f0000001840)) write$binfmt_script(r4, &(0x7f0000001540)={'#! ', './file0'}, 0xb) write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x36) getsockopt$inet_buf(r3, 0x0, 0x24, &(0x7f0000000280)=""/34, &(0x7f00000013c0)=0x22) preadv2(r0, &(0x7f0000000380)=[{&(0x7f0000001880)=""/4101, 0x1028}, {&(0x7f00000002c0)=""/150}], 0x1, 0xa4d, 0x1000004, 0x9) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000001480), 0x2, 0x0) r10 = syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120123000000002003041d600000000000010902240001000000000904000001010000000921000000f93201937fdb6a4b1b42f4bf87b0b15f6881039fac8df3b362392aaf84e2ad2795de6477cd"], 0x0) syz_usb_control_io(r10, 0x0, 0x0) 3.325984321s ago: executing program 7 (id=1361): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYRES64=r0], 0xb2) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000280)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x24, r3, 0x1, 0x0, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}}, 0x0) 3.160980747s ago: executing program 7 (id=1363): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000600)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c) connect$inet6(r0, &(0x7f0000000640)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = getpid() fcntl$setownex(r1, 0xf, &(0x7f0000000680)={0x1, r2}) ioctl$int_in(r1, 0x5452, &(0x7f0000000e40)=0x1) fcntl$setsig(r1, 0xa, 0x2d) sendmsg$NL80211_CMD_GET_KEY(r1, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000f00)={0x14, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}}, 0x14}, 0x1, 0x241, 0x0, 0x20000090}, 0x41) 3.0659036s ago: executing program 7 (id=1364): r0 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000740)='./proc\x00', &(0x7f0000000780)='bpf\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) unshare(0x40400) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f0000000000)=0x3, 0x4) write(r1, &(0x7f0000000a00)='7', 0x1) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000240)={0x0, 0x0, 0x100, 0xfffffffe, 0x1e5}, &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000380)=@IORING_OP_MKDIRAT={0x25, 0x1, 0x0, r3, 0x0, 0x0, 0x100, 0x0, 0x1}) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000400)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000480)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f00000004c0)) r7 = socket$inet(0x2, 0xa, 0x2) r8 = fcntl$dupfd(r7, 0x406, r7) fanotify_mark(r8, 0x1, 0x1001, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) keyctl$read(0xb, 0x0, 0x0, 0x0) r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r9) ptrace$setregs(0xd, r9, 0x0, &(0x7f0000000080)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r9, 0x1, &(0x7f0000000180)={&(0x7f00000001c0)=""/120, 0x78}) r10 = syz_open_procfs(r9, &(0x7f0000000040)='clear_refs\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) lseek(r10, 0x289e0cb5, 0x0) fsmount(r0, 0x0, 0x0) 3.008364911s ago: executing program 1 (id=1365): r0 = syz_open_dev$vim2m(&(0x7f0000000200), 0x800c, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000240)={0x6, 0x34524742, 0x3, @stepwise={0xe, 0x9, 0x4, 0x0, 0x7, 0x1}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r2 = creat(&(0x7f0000000300)='./bus\x00', 0x182) r3 = open(&(0x7f0000000340)='./bus\x00', 0x4c27e, 0x48) fallocate(r3, 0x0, 0x4, 0x1000f4) lseek(r2, 0x7, 0x4) ioctl$FS_IOC_GETFSLABEL(r1, 0x800452d3, &(0x7f0000000100)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f00000003c0)={0x0, 0x4100, &(0x7f0000000400)=[{&(0x7f0000000440)='>', 0x33fe0}], 0x1}, 0x3) close(r4) r6 = socket$kcm(0x10, 0x400000002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000004c0)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0) write(r7, &(0x7f0000000580)='wwnn=0x2000000010000001,wwpn=0x2000000010000002,lpwwnn=0x', 0x39) r8 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0xd7a10da4a7122766, 0x0) pwrite64(r8, 0x0, 0x0, 0x9000) sendmsg$inet(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="5c00000013006bcc9e3be35c6e17aa31076b876c1c0000007ea60864160af36514001ac0080002008100030006a101c00364683b9dad7aa21240d69a6a818cf6c551ae60fc91b169edb1b175732b9f597fe3b6c5a3d77cc766307de2", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4044) write(r0, &(0x7f0000000280)="7d2e02575964", 0x6) 3.005024623s ago: executing program 8 (id=1366): r0 = syz_open_dev$vbi(&(0x7f00000000c0), 0x1, 0x2) ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000100)={0x5, @sliced={0x0, [0x2, 0xa, 0x0, 0x8, 0x7, 0xf, 0x9, 0xf, 0x7, 0x8, 0x7, 0x1728, 0x7, 0xe, 0xee, 0x3, 0x5, 0x2, 0x1, 0x8ce, 0x2fd, 0xffff, 0x2, 0xb, 0x8001, 0xde1, 0x7, 0x2ff, 0xb58b, 0x9, 0xfff, 0x2, 0x5, 0x0, 0x5, 0x2, 0x3, 0x5, 0x3, 0xa20, 0x6, 0x8e, 0x7fff, 0xa030, 0x2, 0xedb4, 0x4, 0x200], 0x6ee}}) (fail_nth: 4) 2.892943647s ago: executing program 7 (id=1367): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x181900, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000001c0)={0x4, 0xffffffffffffffff}) r3 = ioctl$KVM_CREATE_VM(r2, 0x400454e2, 0x110c230004) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_dev$swradio(&(0x7f0000000380), 0x0, 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f00000007c0), 0x121403, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0) r7 = dup(r6) write$6lowpan_enable(r7, 0x0, 0x0) r8 = syz_ublk_setup_io_uring(0x34e5, &(0x7f0000000580)={0x0, 0x4, 0x80, 0x1, 0x5e5, 0x0, r7}, &(0x7f0000000640)=0x0, &(0x7f0000000680)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r9, r10, r11, &(0x7f00000002c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf6c4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x164}}}, &(0x7f0000000280)=0x0) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000003c0)={r4, 0x2, 0x5, 0xffff}) r16 = mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r7, 0x3d) r17 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000400), 0x200000, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r3, 0xc038586a, &(0x7f0000000540)={r8, &(0x7f0000000440)='/dev/nullb0\x00', 0x2800, &(0x7f0000000480)={@_ha_fsid={[0xb, 0x400]}, {0x6, 0x5, 0x9, 0x6}}, 0xd34, &(0x7f00000004c0), &(0x7f0000000500)=0x52}) r19 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x39) r20 = accept4$tipc(r7, 0x0, &(0x7f00000006c0), 0x80800) r21 = socket$alg(0x26, 0x5, 0x0) ioctl$BINDER_WRITE_READ(r15, 0xc0306201, &(0x7f00000008c0)={0x80, 0x0, &(0x7f0000000840)=[@increfs_done={0x40106308, 0x0, 0x3}, @exit_looper, @free_buffer={0x40086303, r16}, @reply={0x40406301, {0x3, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0xca, 0x18, &(0x7f0000000740)={@ptr={0x70742a85, 0x0, &(0x7f0000000600)=[r6, r1, r5, r3, r17, r5, r8, r12, r18], 0x24}, @fd={0x66642a85, 0x0, r19, 0x0, 0x3}, @child_ptr={0x70742a85, 0x1, &(0x7f0000000700)=[r2, r21, r2, r7, r20], 0x14, 0x1}}, &(0x7f0000000800)={0x0, 0x28, 0x40}}}, @increfs={0x40046304, 0x1}, @clear_death={0x400c630f, 0x3, 0x3}]}) syz_open_dev$sg(&(0x7f0000000340), 0xe6, 0x2602) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x121100) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_ublk_setup_queues(r8, r14, &(0x7f0000000200)={0x0, 0x1463, 0x10700, 0x2, 0xb2}, &(0x7f0000000d40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x10002, 0x401, 0x31c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8000, 0x1, 0x2000008, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8001, 0x10, 0x1, 0x902c4, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x8000, 0x2, 0x40021a, 0x0, r8}}], 0x16, &(0x7f0000001540)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, r13, '\x00', {0x3, 0x48b, 0x0, 0x0}}, 0x0) 2.685148228s ago: executing program 8 (id=1368): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000480)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x44, r1, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3b}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x44084) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x400, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x13, &(0x7f0000000180)=0x885, 0x4) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r4, 0x6, 0x22, &(0x7f0000000140)=0x1, 0x4) bind$inet(r4, &(0x7f0000000240)={0x2, 0x4e24, @loopback}, 0x10) shutdown(r4, 0x1) sendmmsg$inet(r4, &(0x7f00000002c0)=[{{&(0x7f0000000300)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000380)="b9", 0x1}], 0x1}}], 0x1, 0x20008080) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000800)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x9, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x0, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x3, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff4, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x1000, 0x31, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0xd, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x4a, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xfff, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x15, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x80140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000c80), 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000cc0), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000d00)=[{&(0x7f0000000d40)="aefdda9d24100100", 0x8}, {&(0x7f0000000d80)}], 0x2) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000e00)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000ec0), 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r10 = dup(r9) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000f00)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000f40)=[@text32={0x20, &(0x7f0000000f80)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r9, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000fc0)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) 2.5925082s ago: executing program 1 (id=1369): r0 = socket$kcm(0xa, 0x3, 0x73) sendmsg$sock(r0, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0xd8ff}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[@timestamping={{0x14, 0x1, 0x25, 0x3}}, @mark={{0x14, 0x1, 0x24, 0x7fffffff}}], 0x30}, 0x80804) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20040, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x80102, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000140)=@generic={0x2, 0x6, 0x80}) write$FUSE_NOTIFY_DELETE(r1, &(0x7f0000000180)={0x32, 0x6, 0x0, {0x5, 0x0, 0x9, 0x0, '/dev/kvm\x00'}}, 0x32) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='cmdline\x00') preadv(r3, &(0x7f0000000300)=[{&(0x7f0000000f80)=""/4097, 0x1001}], 0x1, 0x300, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bfe000/0x400000)=nil) r4 = syz_open_dev$loop(&(0x7f00000001c0), 0x75d, 0x8e080) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000200)={0x0, {}, 0x0, {}, 0x7, 0x0, 0x2, 0x19, "d1c759b1ddcf3514fa3800000000000000014f61f48731346a6f2d7105a86cd451fe2b4a3afa7976be1d5d4162fdab4c3e8855be083a28e69730a021d43cead9", "b4397d7b6efb5ba32db6d5f4812d1ee6c1267b7370d8aac083d947837bac641e", [0x5, 0x9]}) mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440), 0x8008, 0x0) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000f00)={r6, 0x7, 0x2, r6}) r7 = eventfd2(0xe5c, 0x80000) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000380)=@add_del={0x2, &(0x7f0000000340)='caif0\x00'}) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000f40)={r7, 0x7, 0x2, r6}) 2.310432925s ago: executing program 1 (id=1370): socket$inet_mptcp(0x2, 0x1, 0x106) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/diskstats\x00', 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="200103"], 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000001c0)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="ac184d"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000e00)={0x2c, &(0x7f0000000b40)={0x0, 0x8, 0xb8, {0xb8, 0xa, "a348b526b7fa008b18287f868a2ccf9652a4994ad51cca039d03c8d8bba6cbc3d366fc3bb51ed602c1cc2a6b85381045f1ce7be1756549bca8e5ffe856ebf53b9ce6e3ffac1f590aae059bd26d7340a48e3b48d75ab0dfa84d7005e378d846fb9d7c063861bfd881e280047011eb1585db98ddeeda39eaad122b53125c2e0238b698c835a5f5bf581a31ea564d3362434bde016d223a8b4007fbd254f69545ebf6c365b1d0b182b1189de4a8c1b409c8f90fcb487c1a"}}, &(0x7f0000000c00)={0x0, 0x3, 0xda, @string={0xda, 0x3, "4c517de484c39236036b13ffc46dea07cf836a3b9dd03349e00c71456a0e44539beae9c676bf8095ea4d8fb85fe259462cb26028d04cd23efa0e910819894a6a761c4baed3e542a2964d3f9d806af7f865f0486d6a03b97db83651954fd8600500d1d1fda93800e0722003efa3526277e3402405a0954cf2ac8e2988f2437052637e7fb56850d30fc9f083dc931125c2ce696a8153ab80a0bbfee367474dfedc7531de1ef837e3f80733f6f0bc552bf370a02a56f745ad2b4723c7c9d9e223e26cb58e46fe687b5d94a34e36e8bcb74bb82187703545388a"}}, &(0x7f0000000d00)={0x0, 0xf, 0x4b, {0x5, 0xf, 0x4b, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x8, "f037d5faf832fbf02efcb73768eebd88"}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x8, 0xa, 0x82}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "3545874423448cd8f309846f6fc9ff04"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xc, 0xca, 0x2, 0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x7, 0x7f, 0x80, 0x6}]}}, &(0x7f0000000d80)={0x20, 0x29, 0xf, {0xf, 0x29, 0x40, 0x80, 0x4, 0x8, "80dee5d6", "c1e8e8ef"}}, &(0x7f0000000dc0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x50, 0x0, 0x5, 0xf9, 0x0, 0xbc, 0x5}}}, &(0x7f0000001280)={0x84, &(0x7f0000000e40)={0x40, 0x2, 0x65, "c98aa50d8f67a4c6d337cde45cd3faed0bdecdbba0a1a417c30c1c2838363454f1695956350c412a95c51042d08dabd0d74a283d4b6695cebd11cb32bcfbe7c6d9fba6f36697c3ec93675f754bbb2d66e7467666e81cc3837b15a10c7945b607d8aeef4d60"}, &(0x7f0000000ec0)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000f00)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000f40)={0x20, 0x0, 0x4, {0x0, 0x3}}, &(0x7f0000000f80)={0x20, 0x0, 0x4, {0x2e1, 0x4}}, &(0x7f0000000fc0)={0x40, 0x7, 0x2, 0x8}, &(0x7f0000001000)={0x40, 0x9, 0x1, 0x8}, &(0x7f0000001040)={0x40, 0xb, 0x2, "d155"}, &(0x7f0000001080)={0x40, 0xf, 0x2, 0x9}, &(0x7f00000010c0)={0x40, 0x13, 0x6, @remote}, &(0x7f0000001100)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x42}}, &(0x7f0000001140)={0x40, 0x19, 0x2, "65f6"}, &(0x7f0000001180)={0x40, 0x1a, 0x2, 0xd}, &(0x7f00000011c0)={0x40, 0x1c, 0x1, 0x10}, &(0x7f0000001200)={0x40, 0x1e, 0x1}, &(0x7f0000001240)={0x40, 0x21, 0x1, 0x5}}) 1.289336393s ago: executing program 7 (id=1371): capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0xffffffff, 0xfffffffd}) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000500)={0x6, 0x9, 0x2, 0x1fe, 0x15}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x180840, 0x0) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000540)=0x8001) openat$ttyS3(0xffffff9c, &(0x7f0000000600), 0x105200, 0x0) 1.224812588s ago: executing program 7 (id=1372): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xc201}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./nfsd\x00', &(0x7f0000000280)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd/max_block_size\x00', 0x1, 0x0) write$cgroup_devices(r1, &(0x7f0000000300)=ANY=[], 0x9) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000180)={@val={0x2c00, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "ec9700", 0x48, 0x2c, 0x0, @local, @mcast2, {[@fragment={0x3a}], @pkt_toobig={0x2, 0x0, 0x0, 0x800, {0xf, 0x6, "010380", 0x3ff, 0x0, 0x1, @loopback, @loopback, [@routing={0x2f, 0x0, 0x0, 0xa3}, @srh={0x88, 0x0, 0x4, 0x0, 0x3, 0x0, 0x2}]}}}}}}, 0x7e) r3 = syz_open_dev$video4linux(&(0x7f0000000040), 0x1, 0xc0000) ioctl$VIDIOC_LOG_STATUS(r3, 0x5646, 0x0) ioctl$COMEDI_INSNLIST(0xffffffffffffffff, 0x8010640b, &(0x7f00000ab980)={0x0, &(0x7f00000ab880)}) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f"], 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0xc2882, 0x0) mmap(&(0x7f000051f000/0x3000)=nil, 0x3000, 0x2, 0x10, 0xffffffffffffffff, 0x0) close(r4) 862.216787ms ago: executing program 8 (id=1373): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./mnt\x00', 0x101000, 0x0) ioctl$int_in(r0, 0x40086610, &(0x7f0000000080)=0x1000001) (fail_nth: 9) write(r0, 0x0, 0x0) 676.891738ms ago: executing program 8 (id=1374): syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x1a}, @hci_ev_le_ext_adv_report={{}, {0x1, [{0x1b, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xb, 0x4, 0x9, 0x81, 0x8, 0xd, 0x1}]}}}}, 0x1d) r0 = syz_open_dev$loop(&(0x7f0000000180), 0xffffffffffffff4a, 0x280) ioctl$BLKCRYPTOGENERATEKEY(r0, 0xc030128a, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1219ab00c4b20710200e01015a7a0102030109020700010080c400090441ef04000000000000000000ff6f4992e193bfa8b16816aa9e4ec58adb5504", @ANYBLOB="1467d5a615ea71c232ac19eae468699c15c42f476bb6c3e57b889d6e0a5247b87705bbacd921b9f5c81f68fc260c1201ac590ca581fad9d6aa5cdee9b9309fa0630e1109c29b13bbbd0a9c2e8953c5183267684b4bc021ad3b476c683b95da99afd8022c8fdf16890f66ec97beea386970321f6884179312b6d16821af1fcffec293d54f3ef0f7a7d899a08c5cd93b82742b0401529050275aed226c644e1b92c59ebe753e76a3faa9fd323edf24c9baa3e18489ad06f4b55e824ca0bc1d1679b7ce6b7bcc97ed56bbbeced1c1ccadc271720486a67642b57f4092163d98635f9d1a82281928d2336575192631889b76cc508619", @ANYRES8=0x0], 0x0) 653.648169ms ago: executing program 1 (id=1375): munmap(&(0x7f0000ff3000/0xb000)=nil, 0xb000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001400)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) brk(0x200000ffc000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000001580)={0x1f, 0xffff, 0x3}, 0x6) ioctl$KVM_GET_FPU(0xffffffffffffffff, 0x81a0ae8c, &(0x7f00000003c0)) write(r1, &(0x7f00000015c0)="3300000008001400000000000000", 0xe) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller1\x00', 0x5001}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000240)={'syzkaller1\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x0, 0x1}}}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000001500)='westwood', 0x8) 111.274868ms ago: executing program 1 (id=1376): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0800034000000007640700000c0a01020000000000000000010000000900020073797a3200000000380703803407008004000180080003400000000124070b80200001800a0001006c696d6974000000100002800c00024000000000000000055c0601800a00010072616e67650000004c060280c8000480c4000100287960f0af5e03647ca02e87a48d8cdb831ad9d40ca7c219d0d212aa65d623ef7603d551e913a7f7c326ffde733046f0846a000bd8ebf772fee0be25a9ea0657790c4d5e08811c6e76c56965f1953d5cf27acb61484a952bfd001526caa54540c745fa406d477ff40fca64e8e49754368f2d456b1a14c8e2a9639ee057d5f5f9bfb91b838e14cc439e936e9033cba188e64ac380e19c968e55fc86d0e3eaf3e73da29b98566033698faac4683728d6852a48c7c4b6d0ad4c9f2a4f229f2a72a5dc010380400002800900020073797a3100000000080003400000000308000340000000030900020073797a300000000008000340000000030900020073797a30000000002c000280080003400000000308000180fffffffd08000180fffffffc080003400000000108000180fffffffdc0000100df7d4931262a53e5a40e8af004515f48d7cb057a775235d8f65fa0e856f7ffe1d06134429ba0ffc0af7b188f05515ef8a7944c74365179ffea38535cf300954a392056a085b5185870ed420b6af61ac2e8807a446c0b8f8935e7e86c417c456df673f956ce0afa67a0b732e4392b90b8bd1cf999497a644d68a2127a1e5ed505c8c4ebbd830a90bd938052781efc89b4190137d5cda85b11a6754d2129dee5e834b8326d1c3ca5e4f35fd3f5d8d168823f6b5defb0e9a372d8d65f46770001002c70451443738472e5d465234a105d8c5459ffd9158312c0b97d27357c8a82ba7c8e6b2d3eb74050fb5789375716f856292107206dbec7800867002a37ceb606563875d7155c563a51b3798b912100274793e1171d46afe5bc8672b696ffd6c52e78663ac064981fd900d8055503454d0262c900340002800900020073797a310000000008000180fffffffd08000180fffffffc08000340000000030900020073797a3000000000080002400000000058010380df0001006d3863bbbf9f38c39332fe46817525e4ba1c0ec01320a98e2fe70cbb8ba655fad88f4fa668a2e4f323ad98e439105296c364d5b5247e510b652e68a5b8f2b12cd34ba0fe5008466ddaaa9676ba6eff109467e4c094d497591578fbdef4cd2183b21df1d87d3c1af8afbbac991cf4f75cfcb6a37b9e0388294f98228d7f2623a910963d0d41f5d1ec95f861f8a7e169beeb85d0078e9f4f402c63de7487c61064497683d14058e983ce82adb22a50e41058d9d2d37ea4d08ed341990cfe507658c13d689b844cf3c71912d8128e04a6a52eb01c2bfc99f83f2a615c0074000100e9279274c938dafde386c78e98f3ba8b2e6d7fd2de8a6dd3e45c95768bb9de3a62d88b9feeecf580974b2cca2ccfc310afd403ba7f4eb4dc22374fa47a1dba302e535f39130ae1e18cdb0d51d6df7550781505bec012d2362e178efffbf9d21007d1e045aeb339f3d170e5ea25e92425a80103802c0002800900020073797a320000000008000180fffffffc08000340000000040900020073797a31000000002c00028008000180fffffffc08000180fffffffc08000180fffffffb080003400000000108000180fffffffe95000100b9bc9715b6dc5c68a3e7d1fc3bad7064b1d8abe802b790475068cf8888d231d54fa995da3b8c44c3709b0f69a5fcfdcf4fb83c98bb617947916186187191bafaa85ffea8d120732cb15c1259af991b021e0f849c198e70295a56132b76627e0cb3c8124c04870cce80705082cd711cc573791531461b814ace874848c58c95208e4eef87d7026b1c0b3ab7218e17dcbca60000004c0002800900020073797a30000000000900020073797a300000000008000340000000040900020073797a3100000000080003400000000408000180fffffffc0900020073797a30000000006800028008000340000000020900020073797a320000000008000340000000020900020073797a30000000000900020073797a32000000000900020073797a31000000000900020073797a31000000000900020073797a32000000000900020073797a3200000000080001400000000e840003801800028008000180fffffffb0900020073797a32000000000b0001002969dde8f5ac3200500002800900020073797a30000000000900020073797a30000000000800034000000004080003400000000208000180000000020900020073797a320000000008000180fffffffb08000340000000020c000280080003400000000308000240000000010800024000000001140001800e000100696d6d656469617465000000140001800d00010073796e70726f7879000000001800018007000100727400000c0002800800014000000027100001800b00010072656a656374000044000180090001006d65746100000000340002800800034000000010080002400000001e0800014000000000080003400000000e080001400000000d0800024000000014100001800b00010072656a65637400000900010073797a30"], 0x7f0}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x3, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}}, 0x40000) r2 = openat$md_sysfs(0xffffff9c, &(0x7f00000000c0)={'/sys/block/md', @num=0x0, '/md/', @array='level\x00'}, 0x1, 0x0) write$md_sysfs(r2, &(0x7f0000000100)=@num=0x23, 0x14) 0s ago: executing program 1 (id=1377): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='27', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x7, 0x180862) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/mem_sleep', 0x80802, 0xcd) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000180)={r2, 0x0, {0x0, 0x0, 0x0, 0x7, 0x4010000000000ffd, 0x0, 0x0, 0x19, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0x6]}}) sendfile(r1, r2, 0x0, 0x7fffffff) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f00000004c0)='27', 0x2) ioctl$OCFS2_IOC_GROUP_EXTEND(r3, 0x40046f01, &(0x7f0000000500)=0x4000000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x5, 0x2d, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201100395e341203c41c2814bc90102030109021b00020e06d003090408d8008effff080904000500ff"], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="680000000206050000000000000000000000fffd0e0003006269746d61703a697000000005000400000000000900020073797a310000000020000780050003001f0000000c00018008040040ffffffff0800064000006d2305000500020000000500010006"], 0x68}, 0x1, 0x0, 0x0, 0x20000041}, 0x0) r5 = epoll_create1(0x0) r6 = epoll_create1(0x80000) ioctl$BTRFS_IOC_INO_PATHS(r6, 0xc0389423, &(0x7f0000000580)={0x3b, 0x8, [0xa, 0x35, 0x8, 0x6], &(0x7f0000000540)=[0x0]}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000840)={0x20000002}) kernel console output (not intermixed with test programs): 00 00 00 4c 8d ac 24 20 07 00 00 48 89 b4 24 a0 00 [ 586.489106][ T9973] RSP: 002b:00007f2ad0f914b0 EFLAGS: 00010202 [ 586.489125][ T9973] RAX: 00007f2ad2c5d600 RBX: 00007f2ad3026270 RCX: 00002000000003c0 [ 586.489140][ T9973] RDX: 0000200000000000 RSI: ffffffffffffffff RDI: ffffffffffffffff [ 586.489156][ T9973] RBP: 00007f2ad0f93090 R08: 0000000000000001 R09: 0000000000000060 [ 586.489170][ T9973] R10: ffffffffffffffff R11: 0000200000000000 R12: 00000000fec00000 [ 586.489186][ T9973] R13: 00007f2ad3026308 R14: 00007f2ad3026270 R15: 0000000000000000 [ 586.489219][ T9973] [ 586.502843][ T9973] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 586.645425][ T996] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 586.780742][ T9975] FAULT_INJECTION: forcing a failure. [ 586.780742][ T9975] name failslab, interval 1, probability 0, space 0, times 0 [ 586.780774][ T9975] CPU: 0 UID: 0 PID: 9975 Comm: syz.7.1172 Tainted: G L syzkaller #0 PREEMPT(full) [ 586.780802][ T9975] Tainted: [L]=SOFTLOCKUP [ 586.780810][ T9975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 586.780822][ T9975] Call Trace: [ 586.780831][ T9975] [ 586.780839][ T9975] dump_stack_lvl+0xe8/0x150 [ 586.780881][ T9975] should_fail_ex+0x3eb/0x540 [ 586.780917][ T9975] should_failslab+0xa8/0x100 [ 586.780948][ T9975] __kmalloc_cache_noprof+0x9e/0x600 [ 586.780974][ T9975] ? tipc_conn_alloc+0x57/0x4a0 [ 586.780999][ T9975] ? tipc_conn_alloc+0x57/0x4a0 [ 586.781033][ T9975] tipc_conn_alloc+0x57/0x4a0 [ 586.781066][ T9975] tipc_topsrv_kern_subscr+0xf8/0x250 [ 586.781095][ T9975] ? tipc_own_addr+0x45/0x2a0 [ 586.781125][ T9975] ? __pfx_tipc_topsrv_kern_subscr+0x10/0x10 [ 586.781156][ T9975] ? tipc_own_addr+0x45/0x2a0 [ 586.781188][ T9975] ? __asan_memset+0x22/0x50 [ 586.781212][ T9975] tipc_group_create+0x35b/0x4f0 [ 586.781249][ T9975] tipc_sk_join+0x25d/0x6a0 [ 586.781281][ T9975] ? __pfx_tipc_sk_join+0x10/0x10 [ 586.781306][ T9975] ? tipc_setsockopt+0x731/0x9a0 [ 586.781332][ T9975] ? __local_bh_enable_ip+0xd6/0x140 [ 586.781364][ T9975] tipc_setsockopt+0x73e/0x9a0 [ 586.781394][ T9975] ? __pfx_tipc_setsockopt+0x10/0x10 [ 586.781420][ T9975] ? aa_sock_opt_perm+0x142/0x1e0 [ 586.781454][ T9975] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 586.781479][ T9975] ? __pfx_tipc_setsockopt+0x10/0x10 [ 586.781506][ T9975] do_sock_setsockopt+0x17c/0x1b0 [ 586.781536][ T9975] __x64_sys_setsockopt+0x13d/0x1b0 [ 586.781568][ T9975] do_syscall_64+0x166/0x520 [ 586.781596][ T9975] ? trace_irq_disable+0x3b/0x140 [ 586.781623][ T9975] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 586.781646][ T9975] ? clear_bhb_loop+0x70/0xc0 [ 586.781676][ T9975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 586.781697][ T9975] RIP: 0033:0x7f548db9f559 [ 586.781716][ T9975] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 586.781735][ T9975] RSP: 002b:00007f548ea36028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 586.781757][ T9975] RAX: ffffffffffffffda RBX: 00007f548de25fa0 RCX: 00007f548db9f559 [ 586.781773][ T9975] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000003 [ 586.781786][ T9975] RBP: 00007f548ea36090 R08: 0000000000000010 R09: 0000000000000000 [ 586.781799][ T9975] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 586.781814][ T9975] R13: 00007f548de26038 R14: 00007f548de25fa0 R15: 00007ffd313a6498 [ 586.781847][ T9975] [ 586.843569][ T996] usb 7-1: New USB device found: idVendor=13b1, idProduct=003e, bcdDevice=aa.10 [ 586.887840][ T996] usb 7-1: config 1 has an invalid interface number: 6 but max is 0 [ 586.887877][ T996] usb 7-1: config 1 has no interface number 0 [ 586.957863][ T996] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.957894][ T996] usb 7-1: Product: syz [ 586.957911][ T996] usb 7-1: Manufacturer: syz [ 586.957928][ T996] usb 7-1: SerialNumber: syz [ 587.370643][ T5772] usb 7-1: USB disconnect, device number 22 [ 587.432217][ T996] usb 2-1: USB disconnect, device number 69 [ 587.479537][ T996] Unregistered device Abilis Systems DVB-Titan [ 587.483476][ T996] as10x_usb: device has been disconnected [ 588.095289][T10003] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1180'. [ 588.095609][T10003] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1180'. [ 588.095825][T10003] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1180'. [ 588.096022][T10003] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1180'. [ 588.096190][T10003] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1180'. [ 588.096317][T10003] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1180'. [ 588.096494][T10003] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1180'. [ 588.096630][T10003] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1180'. [ 588.096783][T10003] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1180'. [ 588.272963][T10006] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x57e00 [ 588.272987][T10006] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 588.273010][T10006] raw: 00fff00000000000 ffffea00015f8048 ffffea00015f7fc8 0000000000000000 [ 588.273025][T10006] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 588.273034][T10006] page dumped because: unmovable page [ 588.273042][T10006] page_owner tracks the page as allocated [ 588.273049][T10006] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x28c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS), pid 5781, tgid 5781 (kworker/1:5), ts 362670961181 [ 588.273101][T10006] post_alloc_hook+0x1f9/0x250 [ 588.273128][T10006] get_page_from_freelist+0x220f/0x2280 [ 588.273155][T10006] __alloc_frozen_pages_noprof+0x1fe/0x410 [ 588.273182][T10006] alloc_pages_mpol+0x21e/0x390 [ 588.273212][T10006] alloc_pages_noprof+0xb1/0x2b0 [ 588.273575][T10006] __vmalloc_node_range_noprof+0x9c2/0x16f0 [ 588.273617][T10006] vmalloc_noprof+0xb2/0xe0 [ 588.273639][T10006] kcov_remote_start+0x3a0/0x7e0 [ 588.273682][T10006] hub_event+0x15a/0x4d30 [ 588.273706][T10006] process_scheduled_works+0xc3d/0x1630 [ 588.273728][T10006] worker_thread+0xa47/0xfb0 [ 588.273751][T10006] kthread+0x38b/0x480 [ 588.273766][T10006] ret_from_fork+0x514/0xb70 [ 588.273780][T10006] ret_from_fork_asm+0x1a/0x30 [ 588.273804][T10006] page last free pid 1 tgid 1 ts 26934090623 stack trace: [ 588.273816][T10006] free_pages_prepare+0x9eb/0xaf0 [ 588.273841][T10006] __free_contig_range_common+0x174/0x340 [ 588.273862][T10006] destroy_args+0x4e5/0x570 [ 588.273880][T10006] debug_vm_pgtable+0x3f8/0x410 [ 588.273903][T10006] do_one_initcall+0x250/0x870 [ 588.273925][T10006] do_initcall_level+0x10a/0x1a0 [ 588.284522][T10006] do_initcalls+0x59/0xa0 [ 588.284618][T10006] kernel_init_freeable+0x29d/0x3e0 [ 588.284695][T10006] kernel_init+0x22/0x1d0 [ 588.284738][T10006] ret_from_fork+0x514/0xb70 [ 588.284788][T10006] ret_from_fork_asm+0x1a/0x30 [ 588.316053][ T5762] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 588.474296][ T5762] usb 7-1: Using ep0 maxpacket: 16 [ 588.480845][ T5762] usb 7-1: New USB device found: idVendor=04f3, idProduct=074d, bcdDevice=0.00 [ 588.507072][ T5762] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 588.507136][ T5762] usb 7-1: config 0 has no interface number 0 [ 588.507239][ T5762] usb 7-1: config 0 interface 1 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 588.507303][ T5762] usb 7-1: config 0 interface 1 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 588.507358][ T5762] usb 7-1: config 0 interface 1 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 588.507437][ T5762] usb 7-1: config 0 interface 1 has no altsetting 0 [ 588.507510][ T5762] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.530471][ T5762] usb 7-1: config 0 descriptor?? [ 588.589584][ T5762] usbhid 7-1:0.1: fixing wrong optional hid class descriptors count [ 588.753801][T10011] FAULT_INJECTION: forcing a failure. [ 588.753801][T10011] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 588.753835][T10011] CPU: 0 UID: 0 PID: 10011 Comm: syz.1.1183 Tainted: G L syzkaller #0 PREEMPT(full) [ 588.753863][T10011] Tainted: [L]=SOFTLOCKUP [ 588.753871][T10011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 588.753884][T10011] Call Trace: [ 588.753893][T10011] [ 588.753903][T10011] dump_stack_lvl+0xe8/0x150 [ 588.753939][T10011] should_fail_ex+0x3eb/0x540 [ 588.753979][T10011] _copy_to_user+0x31/0xb0 [ 588.754012][T10011] simple_read_from_buffer+0xe1/0x170 [ 588.754043][T10011] proc_fail_nth_read+0x1bb/0x230 [ 588.754078][T10011] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 588.754112][T10011] ? rw_verify_area+0x24a/0x4c0 [ 588.754139][T10011] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 588.754169][T10011] vfs_read+0x213/0xa80 [ 588.754206][T10011] ? __pfx___mutex_lock+0x10/0x10 [ 588.754236][T10011] ? __pfx_vfs_read+0x10/0x10 [ 588.754263][T10011] ? __fget_files+0x2a/0x420 [ 588.754285][T10011] ? __fget_files+0x3a2/0x420 [ 588.754308][T10011] ? __fget_files+0x2a/0x420 [ 588.754335][T10011] ? fdget+0x1ac/0x250 [ 588.754366][T10011] ksys_read+0x150/0x270 [ 588.754393][T10011] ? __pfx_ksys_read+0x10/0x10 [ 588.754431][T10011] do_syscall_64+0x166/0x520 [ 588.754457][T10011] ? trace_irq_disable+0x3b/0x140 [ 588.754483][T10011] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.754505][T10011] ? clear_bhb_loop+0x70/0xc0 [ 588.754532][T10011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.754553][T10011] RIP: 0033:0x7fe32315fd8e [ 588.754572][T10011] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 588.754590][T10011] RSP: 002b:00007fe324070fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 588.754612][T10011] RAX: ffffffffffffffda RBX: 00007fe3240716c0 RCX: 00007fe32315fd8e [ 588.754627][T10011] RDX: 000000000000000f RSI: 00007fe3240710a0 RDI: 0000000000000004 [ 588.754641][T10011] RBP: 00007fe324071090 R08: 0000000000000000 R09: 0000000000000000 [ 588.754654][T10011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 588.754668][T10011] R13: 00007fe323426038 R14: 00007fe323425fa0 R15: 00007ffd5b6805e8 [ 588.754702][T10011] [ 588.820779][ T5762] usbhid 7-1:0.1: can't add hid device: -71 [ 588.821054][ T5762] usbhid 7-1:0.1: probe with driver usbhid failed with error -71 [ 588.933227][ T5762] usb 7-1: USB disconnect, device number 23 [ 589.198596][T10017] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3765145859 (60242333744 ns) > initial count (29576955120 ns). Using initial count to start timer. [ 589.307153][T10021] FAULT_INJECTION: forcing a failure. [ 589.307153][T10021] name failslab, interval 1, probability 0, space 0, times 0 [ 589.307278][T10021] CPU: 0 UID: 0 PID: 10021 Comm: syz.1.1187 Tainted: G L syzkaller #0 PREEMPT(full) [ 589.307310][T10021] Tainted: [L]=SOFTLOCKUP [ 589.307319][T10021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 589.307333][T10021] Call Trace: [ 589.307342][T10021] [ 589.307352][T10021] dump_stack_lvl+0xe8/0x150 [ 589.307390][T10021] should_fail_ex+0x3eb/0x540 [ 589.307427][T10021] should_failslab+0xa8/0x100 [ 589.307460][T10021] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 589.307486][T10021] ? __d_alloc+0x37/0x820 [ 589.307511][T10021] ? __d_alloc+0x37/0x820 [ 589.307541][T10021] __d_alloc+0x37/0x820 [ 589.307571][T10021] d_make_root+0x41/0x80 [ 589.307598][T10021] devpts_fill_super+0x1e8/0x4f0 [ 589.307627][T10021] ? __pfx_devpts_fill_super+0x10/0x10 [ 589.307659][T10021] get_tree_nodev+0xbb/0x150 [ 589.307689][T10021] vfs_get_tree+0x92/0x2a0 [ 589.307719][T10021] do_new_mount+0x325/0xb00 [ 589.307749][T10021] ? __pfx_do_new_mount+0x10/0x10 [ 589.307775][T10021] ? ns_capable+0x84/0xe0 [ 589.307803][T10021] ? path_mount+0x647/0x1050 [ 589.307829][T10021] ? user_path_at+0xd4/0x160 [ 589.307858][T10021] __se_sys_mount+0x31d/0x420 [ 589.307887][T10021] ? __pfx___se_sys_mount+0x10/0x10 [ 589.307918][T10021] ? __x64_sys_mount+0x20/0xc0 [ 589.307944][T10021] do_syscall_64+0x166/0x520 [ 589.307973][T10021] ? trace_irq_disable+0x3b/0x140 [ 589.308000][T10021] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.308023][T10021] ? clear_bhb_loop+0x70/0xc0 [ 589.308049][T10021] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.308072][T10021] RIP: 0033:0x7fe32319f559 [ 589.308093][T10021] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 589.308113][T10021] RSP: 002b:00007fe324071028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 589.308146][T10021] RAX: ffffffffffffffda RBX: 00007fe323425fa0 RCX: 00007fe32319f559 [ 589.308163][T10021] RDX: 0000200000000080 RSI: 0000200000000140 RDI: 0000000000000000 [ 589.308179][T10021] RBP: 00007fe323236b20 R08: 0000000000000000 R09: 0000000000000000 [ 589.308193][T10021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 589.308207][T10021] R13: 00007fe323426038 R14: 00007fe323425fa0 R15: 00007ffd5b6805e8 [ 589.308242][T10021] [ 589.308340][T10021] devpts: get root dentry failed [ 589.873463][T10043] FAULT_INJECTION: forcing a failure. [ 589.873463][T10043] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 589.873489][T10043] CPU: 1 UID: 0 PID: 10043 Comm: syz.1.1196 Tainted: G L syzkaller #0 PREEMPT(full) [ 589.873511][T10043] Tainted: [L]=SOFTLOCKUP [ 589.873517][T10043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 589.873526][T10043] Call Trace: [ 589.873532][T10043] [ 589.873539][T10043] dump_stack_lvl+0xe8/0x150 [ 589.873567][T10043] should_fail_ex+0x3eb/0x540 [ 589.873595][T10043] _copy_from_iter+0x1d3/0x1680 [ 589.873628][T10043] ? __pfx__copy_from_iter+0x10/0x10 [ 589.873649][T10043] ? trace_kmalloc+0x2a/0xf0 [ 589.873668][T10043] ? __kmalloc_noprof+0x387/0x710 [ 589.873685][T10043] ? __kmalloc_noprof+0x1a6/0x710 [ 589.873702][T10043] ? kernfs_fop_write_iter+0x157/0x540 [ 589.873729][T10043] kernfs_fop_write_iter+0x19a/0x540 [ 589.873752][T10043] vfs_write+0x612/0xba0 [ 589.873777][T10043] ? __pfx_vfs_write+0x10/0x10 [ 589.873799][T10043] ? __fget_files+0x3a2/0x420 [ 589.873816][T10043] ? __fget_files+0x2a/0x420 [ 589.873837][T10043] ? fdget+0x1ac/0x250 [ 589.873859][T10043] ksys_write+0x150/0x270 [ 589.873880][T10043] ? __pfx_ksys_write+0x10/0x10 [ 589.873908][T10043] do_syscall_64+0x166/0x520 [ 589.873929][T10043] ? trace_irq_disable+0x3b/0x140 [ 589.873972][T10043] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.873995][T10043] ? clear_bhb_loop+0x70/0xc0 [ 589.874023][T10043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.874045][T10043] RIP: 0033:0x7fe32319f559 [ 589.874065][T10043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 589.874085][T10043] RSP: 002b:00007fe324071028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 589.874120][T10043] RAX: ffffffffffffffda RBX: 00007fe323425fa0 RCX: 00007fe32319f559 [ 589.874137][T10043] RDX: 0000000000000012 RSI: 00002000000003c0 RDI: 0000000000000006 [ 589.874152][T10043] RBP: 00007fe324071090 R08: 0000000000000000 R09: 0000000000000000 [ 589.874167][T10043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 589.874181][T10043] R13: 00007fe323426038 R14: 00007fe323425fa0 R15: 00007ffd5b6805e8 [ 589.874218][T10043] [ 590.817730][T10052] FAULT_INJECTION: forcing a failure. [ 590.817730][T10052] name failslab, interval 1, probability 0, space 0, times 0 [ 590.817768][T10052] CPU: 0 UID: 0 PID: 10052 Comm: syz.6.1199 Tainted: G L syzkaller #0 PREEMPT(full) [ 590.817801][T10052] Tainted: [L]=SOFTLOCKUP [ 590.817810][T10052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 590.817825][T10052] Call Trace: [ 590.817835][T10052] [ 590.817845][T10052] dump_stack_lvl+0xe8/0x150 [ 590.817893][T10052] should_fail_ex+0x3eb/0x540 [ 590.817934][T10052] should_failslab+0xa8/0x100 [ 590.817968][T10052] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 590.817996][T10052] ? __d_alloc+0x37/0x820 [ 590.818023][T10052] ? __d_alloc+0x37/0x820 [ 590.818058][T10052] __d_alloc+0x37/0x820 [ 590.818091][T10052] d_alloc+0x4b/0x190 [ 590.818117][T10052] ? lookup_one_qstr_excl+0xc4/0x360 [ 590.818150][T10052] lookup_one_qstr_excl+0xd8/0x360 [ 590.818179][T10052] ? lookup_noperm_common+0x245/0x430 [ 590.818210][T10052] start_dirop+0x5c/0x90 [ 590.818237][T10052] simple_start_creating+0xcc/0x110 [ 590.818268][T10052] ? __pfx_simple_start_creating+0x10/0x10 [ 590.818305][T10052] ? do_raw_spin_unlock+0xf5/0x200 [ 590.818347][T10052] devpts_fill_super+0x293/0x4f0 [ 590.818379][T10052] ? __pfx_devpts_fill_super+0x10/0x10 [ 590.818411][T10052] get_tree_nodev+0xbb/0x150 [ 590.818443][T10052] vfs_get_tree+0x92/0x2a0 [ 590.818476][T10052] do_new_mount+0x325/0xb00 [ 590.818516][T10052] ? __pfx_do_new_mount+0x10/0x10 [ 590.818545][T10052] ? ns_capable+0x84/0xe0 [ 590.818575][T10052] ? path_mount+0x647/0x1050 [ 590.818605][T10052] ? user_path_at+0xd4/0x160 [ 590.818636][T10052] __se_sys_mount+0x31d/0x420 [ 590.818669][T10052] ? __pfx___se_sys_mount+0x10/0x10 [ 590.818702][T10052] ? __x64_sys_mount+0x20/0xc0 [ 590.818731][T10052] do_syscall_64+0x166/0x520 [ 590.818762][T10052] ? trace_irq_disable+0x3b/0x140 [ 590.818790][T10052] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.818815][T10052] ? clear_bhb_loop+0x70/0xc0 [ 590.818844][T10052] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.818867][T10052] RIP: 0033:0x7fbd3279f559 [ 590.818890][T10052] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 590.818910][T10052] RSP: 002b:00007fbd335c2028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 590.818935][T10052] RAX: ffffffffffffffda RBX: 00007fbd32a25fa0 RCX: 00007fbd3279f559 [ 590.818952][T10052] RDX: 0000200000000080 RSI: 0000200000000140 RDI: 0000000000000000 [ 590.818969][T10052] RBP: 00007fbd32836b20 R08: 0000000000000000 R09: 0000000000000000 [ 590.818984][T10052] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 590.818999][T10052] R13: 00007fbd32a26038 R14: 00007fbd32a25fa0 R15: 00007ffe50cd9418 [ 590.819037][T10052] [ 590.822839][T10052] devpts: Unable to alloc dentry for ptmx node [ 591.183376][T10054] FAULT_INJECTION: forcing a failure. [ 591.183376][T10054] name failslab, interval 1, probability 0, space 0, times 0 [ 591.183411][T10054] CPU: 0 UID: 0 PID: 10054 Comm: syz.6.1200 Tainted: G L syzkaller #0 PREEMPT(full) [ 591.183440][T10054] Tainted: [L]=SOFTLOCKUP [ 591.183448][T10054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 591.183476][T10054] Call Trace: [ 591.183485][T10054] [ 591.183494][T10054] dump_stack_lvl+0xe8/0x150 [ 591.183529][T10054] should_fail_ex+0x3eb/0x540 [ 591.183565][T10054] should_failslab+0xa8/0x100 [ 591.183596][T10054] __kmalloc_noprof+0xf9/0x710 [ 591.183620][T10054] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 591.183648][T10054] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 591.183683][T10054] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 591.183719][T10054] genl_family_rcv_msg_doit+0xda/0x340 [ 591.183752][T10054] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 591.183788][T10054] ? apparmor_capable+0x126/0x170 [ 591.183812][T10054] ? bpf_lsm_capable+0x9/0x20 [ 591.183913][T10054] ? security_capable+0x7e/0x2c0 [ 591.183951][T10054] genl_rcv_msg+0x614/0x7a0 [ 591.183991][T10054] ? __pfx_genl_rcv_msg+0x10/0x10 [ 591.184016][T10054] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 591.184041][T10054] ? __pfx_nl80211_del_pmk+0x10/0x10 [ 591.184067][T10054] ? __pfx_nl80211_post_doit+0x10/0x10 [ 591.184108][T10054] netlink_rcv_skb+0x226/0x4a0 [ 591.184142][T10054] ? __pfx_genl_rcv_msg+0x10/0x10 [ 591.184170][T10054] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 591.184218][T10054] ? down_read+0x2b9/0x320 [ 591.184253][T10054] genl_rcv+0x28/0x40 [ 591.184277][T10054] netlink_unicast+0x8ef/0xa80 [ 591.184325][T10054] netlink_sendmsg+0x7f0/0xb20 [ 591.184353][T10054] ? __pfx_netlink_sendmsg+0x10/0x10 [ 591.184378][T10054] ? aa_sock_msg_perm+0x144/0x210 [ 591.184412][T10054] ? apparmor_socket_sendmsg+0x98/0x360 [ 591.184440][T10054] ? __pfx_netlink_sendmsg+0x10/0x10 [ 591.184461][T10054] sock_sendmsg_nosec+0x14e/0x190 [ 591.184516][T10054] ____sys_sendmsg+0x54e/0x850 [ 591.184550][T10054] ? __pfx_____sys_sendmsg+0x10/0x10 [ 591.184588][T10054] ? import_iovec+0x73/0xa0 [ 591.184626][T10054] ___sys_sendmsg+0x2a6/0x360 [ 591.184651][T10054] ? __lock_acquire+0x747/0x2de0 [ 591.184683][T10054] ? __pfx____sys_sendmsg+0x10/0x10 [ 591.184751][T10054] ? __fget_files+0x3a2/0x420 [ 591.184775][T10054] ? __fget_files+0x2a/0x420 [ 591.184811][T10054] __x64_sys_sendmsg+0x1b1/0x290 [ 591.184842][T10054] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 591.184894][T10054] do_syscall_64+0x166/0x520 [ 591.184925][T10054] ? trace_irq_disable+0x3b/0x140 [ 591.184953][T10054] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.184983][T10054] ? clear_bhb_loop+0x70/0xc0 [ 591.185011][T10054] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.185034][T10054] RIP: 0033:0x7fbd3279f559 [ 591.185055][T10054] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 591.185075][T10054] RSP: 002b:00007fbd335c2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 591.185100][T10054] RAX: ffffffffffffffda RBX: 00007fbd32a25fa0 RCX: 00007fbd3279f559 [ 591.185117][T10054] RDX: 0000000000044800 RSI: 0000200000000880 RDI: 0000000000000004 [ 591.185132][T10054] RBP: 00007fbd335c2090 R08: 0000000000000000 R09: 0000000000000000 [ 591.185145][T10054] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 591.185159][T10054] R13: 00007fbd32a26038 R14: 00007fbd32a25fa0 R15: 00007ffe50cd9418 [ 591.185195][T10054] [ 592.496992][T10075] FAULT_INJECTION: forcing a failure. [ 592.496992][T10075] name failslab, interval 1, probability 0, space 0, times 0 [ 592.497019][T10075] CPU: 0 UID: 0 PID: 10075 Comm: syz.1.1208 Tainted: G L syzkaller #0 PREEMPT(full) [ 592.497041][T10075] Tainted: [L]=SOFTLOCKUP [ 592.497047][T10075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 592.497058][T10075] Call Trace: [ 592.497064][T10075] [ 592.497071][T10075] dump_stack_lvl+0xe8/0x150 [ 592.497100][T10075] should_fail_ex+0x3eb/0x540 [ 592.497128][T10075] should_failslab+0xa8/0x100 [ 592.497152][T10075] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 592.497171][T10075] ? __d_alloc+0x37/0x820 [ 592.497189][T10075] ? __d_alloc+0x37/0x820 [ 592.497213][T10075] __d_alloc+0x37/0x820 [ 592.497235][T10075] d_alloc+0x4b/0x190 [ 592.497252][T10075] ? lookup_one_qstr_excl+0xc4/0x360 [ 592.497274][T10075] lookup_one_qstr_excl+0xd8/0x360 [ 592.497294][T10075] ? lookup_noperm_common+0x245/0x430 [ 592.497315][T10075] start_dirop+0x5c/0x90 [ 592.497333][T10075] simple_start_creating+0xcc/0x110 [ 592.497353][T10075] ? __pfx_simple_start_creating+0x10/0x10 [ 592.497379][T10075] ? do_raw_spin_unlock+0xf5/0x200 [ 592.497412][T10075] devpts_fill_super+0x293/0x4f0 [ 592.497434][T10075] ? __pfx_devpts_fill_super+0x10/0x10 [ 592.497456][T10075] get_tree_nodev+0xbb/0x150 [ 592.497479][T10075] vfs_get_tree+0x92/0x2a0 [ 592.497501][T10075] do_new_mount+0x325/0xb00 [ 592.497523][T10075] ? __pfx_do_new_mount+0x10/0x10 [ 592.497542][T10075] ? ns_capable+0x84/0xe0 [ 592.497563][T10075] ? path_mount+0x647/0x1050 [ 592.497583][T10075] ? user_path_at+0xd4/0x160 [ 592.497603][T10075] __se_sys_mount+0x31d/0x420 [ 592.497625][T10075] ? __pfx___se_sys_mount+0x10/0x10 [ 592.497648][T10075] ? __x64_sys_mount+0x20/0xc0 [ 592.497667][T10075] do_syscall_64+0x166/0x520 [ 592.497688][T10075] ? trace_irq_disable+0x3b/0x140 [ 592.497708][T10075] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.497724][T10075] ? clear_bhb_loop+0x70/0xc0 [ 592.497743][T10075] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.497759][T10075] RIP: 0033:0x7fe32319f559 [ 592.497774][T10075] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 592.497788][T10075] RSP: 002b:00007fe324071028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 592.497806][T10075] RAX: ffffffffffffffda RBX: 00007fe323425fa0 RCX: 00007fe32319f559 [ 592.497817][T10075] RDX: 0000200000000080 RSI: 0000200000000140 RDI: 0000000000000000 [ 592.497828][T10075] RBP: 00007fe323236b20 R08: 0000000000000000 R09: 0000000000000000 [ 592.497838][T10075] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 592.497848][T10075] R13: 00007fe323426038 R14: 00007fe323425fa0 R15: 00007ffd5b6805e8 [ 592.497873][T10075] [ 592.497891][T10075] devpts: Unable to alloc dentry for ptmx node [ 592.841624][T10077] netlink: 'syz.1.1209': attribute type 2 has an invalid length. [ 592.932843][T10082] FAULT_INJECTION: forcing a failure. [ 592.932843][T10082] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 592.932876][T10082] CPU: 0 UID: 0 PID: 10082 Comm: syz.7.1211 Tainted: G L syzkaller #0 PREEMPT(full) [ 592.932904][T10082] Tainted: [L]=SOFTLOCKUP [ 592.932913][T10082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 592.932925][T10082] Call Trace: [ 592.932934][T10082] [ 592.932943][T10082] dump_stack_lvl+0xe8/0x150 [ 592.932979][T10082] should_fail_ex+0x3eb/0x540 [ 592.933015][T10082] _copy_from_user+0x2d/0xb0 [ 592.933049][T10082] memdup_user_nul+0x66/0x110 [ 592.933071][T10082] subsystem_filter_write+0x76/0xf0 [ 592.933101][T10082] ? __pfx_subsystem_filter_write+0x10/0x10 [ 592.933131][T10082] vfs_write+0x296/0xba0 [ 592.933166][T10082] ? __pfx_vfs_write+0x10/0x10 [ 592.933193][T10082] ? __fget_files+0x2a/0x420 [ 592.933217][T10082] ? __fget_files+0x3a2/0x420 [ 592.933238][T10082] ? __fget_files+0x2a/0x420 [ 592.933266][T10082] ? fdget+0x1ac/0x250 [ 592.933297][T10082] ksys_write+0x150/0x270 [ 592.933325][T10082] ? __pfx_ksys_write+0x10/0x10 [ 592.933363][T10082] do_syscall_64+0x166/0x520 [ 592.933391][T10082] ? trace_irq_disable+0x3b/0x140 [ 592.933416][T10082] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.933438][T10082] ? clear_bhb_loop+0x70/0xc0 [ 592.933463][T10082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.933486][T10082] RIP: 0033:0x7f548db9f559 [ 592.933506][T10082] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 592.933525][T10082] RSP: 002b:00007f548ea36028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 592.933547][T10082] RAX: ffffffffffffffda RBX: 00007f548de25fa0 RCX: 00007f548db9f559 [ 592.933562][T10082] RDX: 0000000000000002 RSI: 0000200000000400 RDI: 0000000000000003 [ 592.933576][T10082] RBP: 00007f548ea36090 R08: 0000000000000000 R09: 0000000000000000 [ 592.933589][T10082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 592.933601][T10082] R13: 00007f548de26038 R14: 00007f548de25fa0 R15: 00007ffd313a6498 [ 592.933633][T10082] [ 593.174122][ T5781] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 593.212483][T10086] __nla_validate_parse: 24 callbacks suppressed [ 593.212584][T10086] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1213'. [ 593.325345][ T5781] usb 7-1: New USB device found: idVendor=046d, idProduct=0821, bcdDevice=1.00 [ 593.326850][ T5781] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 593.326877][ T5781] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 593.326936][ T5781] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 593.363039][ T5781] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.363107][ T5781] usb 7-1: Product: syz [ 593.363144][ T5781] usb 7-1: Manufacturer: syz [ 593.363182][ T5781] usb 7-1: SerialNumber: syz [ 593.412586][ T32] audit: type=1326 audit(1793227666.899:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10093 comm="syz.7.1215" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f548db9f559 code=0x0 [ 593.447429][ T5781] uvcvideo 7-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 593.462406][ T32] audit: type=1326 audit(1793227666.949:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10093 comm="syz.7.1215" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=436 compat=0 ip=0x7f548db9f559 code=0x0 [ 593.613809][ T5781] uvcvideo 7-1:1.0: Failed to query (GET_INFO) UVC control 1 on unit 3: -71 (exp. 1). [ 593.614290][ T5781] uvcvideo 7-1:1.0: No streaming interface found for terminal 32770. [ 593.646308][ T5781] usb 7-1: USB disconnect, device number 24 [ 593.671833][ T6013] udevd[6013]: setting owner of /dev/bus/usb/007/024 to uid=0, gid=0 failed: No such file or directory [ 594.216714][T10099] FAULT_INJECTION: forcing a failure. [ 594.216714][T10099] name failslab, interval 1, probability 0, space 0, times 0 [ 594.216746][T10099] CPU: 0 UID: 0 PID: 10099 Comm: syz.6.1217 Tainted: G L syzkaller #0 PREEMPT(full) [ 594.216767][T10099] Tainted: [L]=SOFTLOCKUP [ 594.216773][T10099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 594.216782][T10099] Call Trace: [ 594.216788][T10099] [ 594.216796][T10099] dump_stack_lvl+0xe8/0x150 [ 594.216823][T10099] should_fail_ex+0x3eb/0x540 [ 594.216849][T10099] should_failslab+0xa8/0x100 [ 594.216871][T10099] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 594.216889][T10099] ? __d_alloc+0x37/0x820 [ 594.216929][T10099] ? __d_alloc+0x37/0x820 [ 594.216962][T10099] __d_alloc+0x37/0x820 [ 594.216993][T10099] d_alloc+0x4b/0x190 [ 594.217019][T10099] ? lookup_one_qstr_excl+0xc4/0x360 [ 594.217040][T10099] lookup_one_qstr_excl+0xd8/0x360 [ 594.217059][T10099] ? lookup_noperm_common+0x245/0x430 [ 594.217078][T10099] start_dirop+0x5c/0x90 [ 594.217094][T10099] simple_start_creating+0xcc/0x110 [ 594.217114][T10099] ? __pfx_simple_start_creating+0x10/0x10 [ 594.217135][T10099] ? do_raw_spin_unlock+0xf5/0x200 [ 594.217162][T10099] devpts_fill_super+0x293/0x4f0 [ 594.217182][T10099] ? __pfx_devpts_fill_super+0x10/0x10 [ 594.217203][T10099] get_tree_nodev+0xbb/0x150 [ 594.217223][T10099] vfs_get_tree+0x92/0x2a0 [ 594.217246][T10099] do_new_mount+0x325/0xb00 [ 594.217267][T10099] ? __pfx_do_new_mount+0x10/0x10 [ 594.217284][T10099] ? ns_capable+0x84/0xe0 [ 594.217304][T10099] ? path_mount+0x647/0x1050 [ 594.217322][T10099] ? user_path_at+0xd4/0x160 [ 594.217341][T10099] __se_sys_mount+0x31d/0x420 [ 594.217362][T10099] ? __pfx___se_sys_mount+0x10/0x10 [ 594.217383][T10099] ? __x64_sys_mount+0x20/0xc0 [ 594.217403][T10099] do_syscall_64+0x166/0x520 [ 594.217424][T10099] ? trace_irq_disable+0x3b/0x140 [ 594.217443][T10099] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.217458][T10099] ? clear_bhb_loop+0x70/0xc0 [ 594.217477][T10099] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.217493][T10099] RIP: 0033:0x7fbd3279f559 [ 594.217507][T10099] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 594.217520][T10099] RSP: 002b:00007fbd335c2028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 594.217536][T10099] RAX: ffffffffffffffda RBX: 00007fbd32a25fa0 RCX: 00007fbd3279f559 [ 594.217548][T10099] RDX: 0000200000000080 RSI: 0000200000000140 RDI: 0000000000000000 [ 594.217560][T10099] RBP: 00007fbd32836b20 R08: 0000000000000000 R09: 0000000000000000 [ 594.217570][T10099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 594.217579][T10099] R13: 00007fbd32a26038 R14: 00007fbd32a25fa0 R15: 00007ffe50cd9418 [ 594.217603][T10099] [ 594.223161][T10099] devpts: Unable to alloc dentry for ptmx node [ 595.539180][T10116] FAULT_INJECTION: forcing a failure. [ 595.539180][T10116] name failslab, interval 1, probability 0, space 0, times 0 [ 595.539217][T10116] CPU: 0 UID: 0 PID: 10116 Comm: syz.6.1222 Tainted: G L syzkaller #0 PREEMPT(full) [ 595.539249][T10116] Tainted: [L]=SOFTLOCKUP [ 595.539256][T10116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 595.539266][T10116] Call Trace: [ 595.539272][T10116] [ 595.539280][T10116] dump_stack_lvl+0xe8/0x150 [ 595.539309][T10116] should_fail_ex+0x3eb/0x540 [ 595.539336][T10116] should_failslab+0xa8/0x100 [ 595.539358][T10116] ? vm_area_alloc+0x24/0x140 [ 595.539382][T10116] kmem_cache_alloc_noprof+0x9c/0x600 [ 595.539400][T10116] ? vma_merge_new_range+0x556/0x810 [ 595.539419][T10116] ? vm_area_alloc+0x24/0x140 [ 595.539447][T10116] vm_area_alloc+0x24/0x140 [ 595.539471][T10116] mmap_region+0x18ff/0x2840 [ 595.539502][T10116] ? __lock_acquire+0x747/0x2de0 [ 595.539525][T10116] ? __pfx_mmap_region+0x10/0x10 [ 595.539552][T10116] ? ring_buffer_record_is_set_on+0x48/0x70 [ 595.539577][T10116] ? traceon_trigger+0x68/0xa0 [ 595.539604][T10116] ? __trace_trigger_soft_disabled+0x248/0x280 [ 595.539629][T10116] ? lock_acquire+0x115/0x350 [ 595.539699][T10116] ? arch_get_unmapped_area_topdown+0x269/0xc30 [ 595.539740][T10116] ? shmem_get_unmapped_area+0x2cf/0x8f0 [ 595.539761][T10116] ? cap_mmap_addr+0xaa/0xf0 [ 595.539779][T10116] ? bpf_lsm_mmap_addr+0x9/0x50 [ 595.539798][T10116] ? security_mmap_addr+0x71/0x240 [ 595.539823][T10116] do_mmap+0xe0a/0x1300 [ 595.539852][T10116] ? __pfx_do_mmap+0x10/0x10 [ 595.539882][T10116] ? vm_mmap_pgoff+0x1ed/0x520 [ 595.539898][T10116] ? down_write_killable+0x179/0x230 [ 595.539925][T10116] ? __pfx_down_write_killable+0x10/0x10 [ 595.539950][T10116] ? apparmor_mmap_file+0x1cc/0x390 [ 595.539967][T10116] ? security_mmap_file+0x4df/0xa20 [ 595.539989][T10116] vm_mmap_pgoff+0x27a/0x520 [ 595.540011][T10116] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 595.540026][T10116] ? ksys_write+0x242/0x270 [ 595.540046][T10116] ? __pfx___se_sys_futex+0x10/0x10 [ 595.540070][T10116] ? __pfx_ksys_write+0x10/0x10 [ 595.540093][T10116] ? ksys_mmap_pgoff+0xf3/0x760 [ 595.540117][T10116] ? __x64_sys_mmap+0x7f/0x140 [ 595.540136][T10116] do_syscall_64+0x166/0x520 [ 595.540158][T10116] ? trace_irq_disable+0x3b/0x140 [ 595.540178][T10116] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.540194][T10116] ? clear_bhb_loop+0x70/0xc0 [ 595.540214][T10116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.540230][T10116] RIP: 0033:0x7fbd3279f559 [ 595.540245][T10116] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 595.540258][T10116] RSP: 002b:00007fbd335c2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 595.540275][T10116] RAX: ffffffffffffffda RBX: 00007fbd32a25fa0 RCX: 00007fbd3279f559 [ 595.540287][T10116] RDX: 0000000003000007 RSI: 0000000000b36000 RDI: 0000200000000000 [ 595.540297][T10116] RBP: 00007fbd32836b20 R08: ffffffffffffffff R09: 0000000000000000 [ 595.540320][T10116] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 595.540329][T10116] R13: 00007fbd32a26038 R14: 00007fbd32a25fa0 R15: 00007ffe50cd9418 [ 595.540352][T10116] [ 596.155848][T10125] FAULT_INJECTION: forcing a failure. [ 596.155848][T10125] name fail_futex, interval 1, probability 0, space 0, times 0 [ 596.155904][T10125] CPU: 1 UID: 0 PID: 10125 Comm: syz.7.1227 Tainted: G L syzkaller #0 PREEMPT(full) [ 596.155937][T10125] Tainted: [L]=SOFTLOCKUP [ 596.155946][T10125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 596.155960][T10125] Call Trace: [ 596.155970][T10125] [ 596.155980][T10125] dump_stack_lvl+0xe8/0x150 [ 596.156019][T10125] should_fail_ex+0x3eb/0x540 [ 596.156058][T10125] get_futex_key+0x1ab/0x1410 [ 596.156103][T10125] ? __pfx_get_futex_key+0x10/0x10 [ 596.156143][T10125] ? rcu_is_watching+0x16/0xb0 [ 596.156176][T10125] ? __update_load_avg_cfs_rq+0x6ae/0xad0 [ 596.156229][T10125] futex_wait_setup+0x4a/0x590 [ 596.156261][T10125] ? __futex_wait+0xdb/0x470 [ 596.156291][T10125] __futex_wait+0x175/0x470 [ 596.156327][T10125] ? __pfx___futex_wait+0x10/0x10 [ 596.156358][T10125] ? __pfx_futex_wake_mark+0x10/0x10 [ 596.156390][T10125] ? try_to_wake_up+0x8ce/0x14e0 [ 596.156434][T10125] futex_wait+0x121/0x390 [ 596.156463][T10125] ? __pfx_futex_wait+0x10/0x10 [ 596.156503][T10125] ? __pfx_userfaultfd_register+0x10/0x10 [ 596.156535][T10125] do_futex+0x3e7/0x4e0 [ 596.156575][T10125] ? __pfx_do_futex+0x10/0x10 [ 596.156620][T10125] __se_sys_futex+0x3a8/0x450 [ 596.156659][T10125] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 596.156685][T10125] ? __pfx___se_sys_futex+0x10/0x10 [ 596.156730][T10125] ? __x64_sys_futex+0x21/0xf0 [ 596.156768][T10125] do_syscall_64+0x166/0x520 [ 596.156801][T10125] ? trace_irq_disable+0x3b/0x140 [ 596.156830][T10125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.156854][T10125] ? clear_bhb_loop+0x70/0xc0 [ 596.156884][T10125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.156908][T10125] RIP: 0033:0x7f548db9f559 [ 596.156931][T10125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 596.156952][T10125] RSP: 002b:00007f548ea360e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 596.156978][T10125] RAX: ffffffffffffffda RBX: 00007f548de25fa8 RCX: 00007f548db9f559 [ 596.157000][T10125] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f548de25fa8 [ 596.157016][T10125] RBP: 00007f548de25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 596.157032][T10125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 596.157046][T10125] R13: 00007f548de26038 R14: 00007ffd313a63b0 R15: 00007ffd313a6498 [ 596.157084][T10125] [ 596.791835][T10135] FAULT_INJECTION: forcing a failure. [ 596.791835][T10135] name fail_futex, interval 1, probability 0, space 0, times 0 [ 596.791876][T10135] CPU: 0 UID: 0 PID: 10135 Comm: syz.7.1232 Tainted: G L syzkaller #0 PREEMPT(full) [ 596.791919][T10135] Tainted: [L]=SOFTLOCKUP [ 596.791929][T10135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 596.791944][T10135] Call Trace: [ 596.791954][T10135] [ 596.791965][T10135] dump_stack_lvl+0xe8/0x150 [ 596.792006][T10135] should_fail_ex+0x3eb/0x540 [ 596.792046][T10135] get_futex_key+0x1ab/0x1410 [ 596.792094][T10135] ? __pfx_get_futex_key+0x10/0x10 [ 596.792130][T10135] ? update_se+0x90/0x1080 [ 596.792169][T10135] futex_wait_setup+0x4a/0x590 [ 596.792202][T10135] ? __futex_wait+0xdb/0x470 [ 596.792234][T10135] __futex_wait+0x175/0x470 [ 596.792258][T10135] ? update_protect_slice+0x45/0x320 [ 596.792290][T10135] ? __pfx___futex_wait+0x10/0x10 [ 596.792321][T10135] ? __pfx_futex_wake_mark+0x10/0x10 [ 596.792353][T10135] ? try_to_wake_up+0x8ce/0x14e0 [ 596.792396][T10135] futex_wait+0x121/0x390 [ 596.792425][T10135] ? __pfx_futex_wait+0x10/0x10 [ 596.792473][T10135] do_futex+0x3e7/0x4e0 [ 596.792514][T10135] ? __pfx_do_futex+0x10/0x10 [ 596.792566][T10135] __se_sys_futex+0x3a8/0x450 [ 596.792609][T10135] ? __pfx___se_sys_futex+0x10/0x10 [ 596.792658][T10135] ? __x64_sys_futex+0x21/0xf0 [ 596.792697][T10135] do_syscall_64+0x166/0x520 [ 596.792729][T10135] ? trace_irq_disable+0x3b/0x140 [ 596.792759][T10135] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.792784][T10135] ? clear_bhb_loop+0x70/0xc0 [ 596.792813][T10135] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.792838][T10135] RIP: 0033:0x7f548db9f559 [ 596.792861][T10135] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 596.792882][T10135] RSP: 002b:00007f548ea360e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 596.792909][T10135] RAX: ffffffffffffffda RBX: 00007f548de25fa8 RCX: 00007f548db9f559 [ 596.792927][T10135] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f548de25fa8 [ 596.792943][T10135] RBP: 00007f548de25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 596.792958][T10135] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 596.792973][T10135] R13: 00007f548de26038 R14: 00007ffd313a63b0 R15: 00007ffd313a6498 [ 596.793012][T10135] [ 597.100712][T10137] openvswitch: netlink: Tunnel attr 4106 out of range max 16 [ 597.696529][ T996] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 597.834134][ T996] usb 2-1: device descriptor read/64, error -71 [ 598.085546][ T996] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 598.224384][ T996] usb 2-1: device descriptor read/64, error -71 [ 598.345859][ T996] usb usb2-port1: attempt power cycle [ 598.684113][ T996] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 598.705613][ T996] usb 2-1: device descriptor read/8, error -71 [ 598.955728][ T996] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 598.974724][ T996] usb 2-1: device descriptor read/8, error -71 [ 599.086832][ T996] usb usb2-port1: unable to enumerate USB device [ 600.887151][T10164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 600.887616][T10164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 601.002380][ T32] audit: type=1800 audit(1793227674.489:63): pid=10167 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1243" name=08 dev="sda1" ino=2053 res=0 errno=-22 [ 601.125861][ T5782] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 601.257104][ T5782] usb 2-1: device descriptor read/64, error -71 [ 601.468865][ T4959] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 601.470310][ T4959] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 601.482813][ T4959] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 601.499782][ T5782] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 601.499845][ T4959] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 601.501427][ T4959] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 601.624057][ T5782] usb 2-1: device descriptor read/64, error -71 [ 601.734656][ T5782] usb usb2-port1: attempt power cycle [ 601.973796][T10171] rxe_eth0 speed is unknown, defaulting to 1000 [ 602.074049][ T5782] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 602.096582][ T5782] usb 2-1: device descriptor read/8, error -71 [ 602.334096][ T5782] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 602.354700][ T5782] usb 2-1: device descriptor read/8, error -71 [ 602.464303][ T5782] usb usb2-port1: unable to enumerate USB device [ 602.602701][T10171] bridge0: port 1(bridge_slave_0) entered blocking state [ 602.602905][T10171] bridge0: port 1(bridge_slave_0) entered disabled state [ 602.603348][T10171] bridge_slave_0: entered allmulticast mode [ 602.607018][T10171] bridge_slave_0: entered promiscuous mode [ 602.615597][T10171] bridge0: port 2(bridge_slave_1) entered blocking state [ 602.616042][T10171] bridge0: port 2(bridge_slave_1) entered disabled state [ 602.617018][T10171] bridge_slave_1: entered allmulticast mode [ 602.620651][T10171] bridge_slave_1: entered promiscuous mode [ 602.694808][T10171] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 602.698550][T10171] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 602.744509][T10171] team0: Port device team_slave_0 added [ 602.747838][T10171] team0: Port device team_slave_1 added [ 602.801591][T10171] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 602.801610][T10171] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 602.801639][T10171] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 602.803913][T10171] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 602.803928][T10171] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 602.805668][T10171] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 602.918305][T10171] hsr_slave_0: entered promiscuous mode [ 602.919451][T10171] hsr_slave_1: entered promiscuous mode [ 602.920194][T10171] debugfs: 'hsr0' already exists in 'hsr' [ 602.920214][T10171] Cannot create hsr debugfs directory [ 603.203473][T10171] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 603.212479][T10171] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 603.213705][T10171] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 603.230567][T10171] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 603.231312][T10171] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 603.246731][T10171] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 603.250081][T10171] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 603.273569][T10171] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 603.307442][T10171] bridge0: port 2(bridge_slave_1) entered blocking state [ 603.307578][T10171] bridge0: port 2(bridge_slave_1) entered forwarding state [ 603.308534][T10171] bridge0: port 1(bridge_slave_0) entered blocking state [ 603.308704][T10171] bridge0: port 1(bridge_slave_0) entered forwarding state [ 603.410534][T10171] 8021q: adding VLAN 0 to HW filter on device bond0 [ 603.428212][ T6073] bridge0: port 1(bridge_slave_0) entered disabled state [ 603.429772][ T6073] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.462830][T10171] 8021q: adding VLAN 0 to HW filter on device team0 [ 603.477780][ T6235] bridge0: port 1(bridge_slave_0) entered blocking state [ 603.477886][ T6235] bridge0: port 1(bridge_slave_0) entered forwarding state [ 603.505096][ T6235] bridge0: port 2(bridge_slave_1) entered blocking state [ 603.505200][ T6235] bridge0: port 2(bridge_slave_1) entered forwarding state [ 603.574623][ T55] Bluetooth: hci4: command tx timeout [ 604.152541][T10171] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 604.315578][ T5799] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 604.465762][ T5799] usb 2-1: New USB device found: idVendor=10c4, idProduct=ea90, bcdDevice=0.80 [ 604.467367][ T5799] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 604.467401][ T5799] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 604.467460][ T5799] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.473690][ T5799] usb 2-1: config 0 descriptor?? [ 604.746618][T10171] veth0_vlan: entered promiscuous mode [ 604.779255][T10171] veth1_vlan: entered promiscuous mode [ 604.824312][T10171] veth0_macvtap: entered promiscuous mode [ 604.829467][T10171] veth1_macvtap: entered promiscuous mode [ 604.869378][T10171] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 604.891668][T10171] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 604.923612][ T5799] cp2112 0003:10C4:EA90.0014: unknown main item tag 0x0 [ 604.923645][ T5799] cp2112 0003:10C4:EA90.0014: unknown main item tag 0x0 [ 604.923671][ T5799] cp2112 0003:10C4:EA90.0014: unknown main item tag 0x0 [ 604.923697][ T5799] cp2112 0003:10C4:EA90.0014: unknown main item tag 0x0 [ 604.923722][ T5799] cp2112 0003:10C4:EA90.0014: unknown main item tag 0x0 [ 604.923747][ T5799] cp2112 0003:10C4:EA90.0014: unknown main item tag 0x0 [ 604.923774][ T5799] cp2112 0003:10C4:EA90.0014: unknown main item tag 0x0 [ 604.987010][ T6073] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.990375][ T5799] cp2112 0003:10C4:EA90.0014: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 605.026047][ T6181] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.085543][ T6181] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.085618][ T6181] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.135504][ T5799] cp2112 0003:10C4:EA90.0014: Part Number: 0x00 Device Version: 0x00 [ 605.184059][ T2098] block nbd5: Possible stuck request ffff88802879e000: control (read@0,4096B). Runtime 120 seconds [ 605.243237][ T6181] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 605.243260][ T6181] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 605.322799][ T6072] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 605.322823][ T6072] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 605.345631][ T5799] cp2112 0003:10C4:EA90.0014: error requesting SMBus config [ 605.350190][ T5799] cp2112 0003:10C4:EA90.0014: probe with driver cp2112 failed with error -32 syzkaller syzkaller login: [ 605.619371][T10222] 9p: Bad value for 'wfdno' [ 605.655412][ T55] Bluetooth: hci4: command tx timeout [ 606.344224][ T5799] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 606.474105][ T5799] usb 9-1: device descriptor read/64, error -71 [ 606.714540][ T5799] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 606.844133][ T5799] usb 9-1: device descriptor read/64, error -71 [ 606.955790][ T5799] usb usb9-port1: attempt power cycle [ 606.995009][ T5781] usb 2-1: USB disconnect, device number 79 [ 607.294137][ T5799] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 607.314786][ T5799] usb 9-1: device descriptor read/8, error -71 [ 607.474097][ T5781] usb 2-1: new full-speed USB device number 80 using dummy_hcd [ 607.554738][ T5799] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 607.576095][ T5799] usb 9-1: device descriptor read/8, error -71 [ 607.634932][ T5781] usb 2-1: New USB device found: idVendor=0b48, idProduct=1003, bcdDevice=1.00 [ 607.636314][ T5781] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 607.636381][ T5781] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.671063][ T5781] usb 2-1: selecting invalid altsetting 1 [ 607.685047][ T5799] usb usb9-port1: unable to enumerate USB device [ 607.716826][ T5781] dvb_ttusb_budget: ttusb_init_controller: error [ 607.716848][ T5781] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 607.742165][ T55] Bluetooth: hci4: command tx timeout [ 607.833772][ T5781] DVB: Unable to find symbol stv0299_attach() [ 607.911367][ T5781] DVB: Unable to find symbol tda8083_attach() [ 607.911382][ T5781] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 607.927397][ T5781] usb 2-1: USB disconnect, device number 80 [ 608.764137][ T5762] usb 2-1: new full-speed USB device number 81 using dummy_hcd [ 608.928579][ T5762] usb 2-1: New USB device found: idVendor=03fd, idProduct=ebbe, bcdDevice=36.54 [ 608.929527][ T5762] usb 2-1: config 34 has an invalid interface number: 167 but max is 0 [ 608.929554][ T5762] usb 2-1: config 34 has no interface number 0 [ 608.929583][ T5762] usb 2-1: config 34 interface 167 has no altsetting 0 [ 608.931982][ T5762] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.932005][ T5762] usb 2-1: Product: syz [ 608.932021][ T5762] usb 2-1: Manufacturer: syz [ 608.932037][ T5762] usb 2-1: SerialNumber: syz [ 609.188475][ T5762] usb 2-1: USB disconnect, device number 81 [ 609.424361][ T5799] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 609.585372][ T5799] usb 9-1: New USB device found: idVendor=10c4, idProduct=ea90, bcdDevice=0.80 [ 609.586808][ T5799] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 609.586848][ T5799] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 609.586886][ T5799] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.605057][ T5799] usb 9-1: config 0 descriptor?? [ 609.752129][T10255] netlink: 68 bytes leftover after parsing attributes in process `syz.7.1262'. [ 609.768461][T10255] netlink: 96 bytes leftover after parsing attributes in process `syz.7.1262'. [ 609.802318][T10257] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1263'. [ 609.815159][ T55] Bluetooth: hci4: command tx timeout [ 609.905228][T10262] FAULT_INJECTION: forcing a failure. [ 609.905228][T10262] name failslab, interval 1, probability 0, space 0, times 0 [ 609.905265][T10262] CPU: 1 UID: 0 PID: 10262 Comm: syz.7.1264 Tainted: G L syzkaller #0 PREEMPT(full) [ 609.905295][T10262] Tainted: [L]=SOFTLOCKUP [ 609.905304][T10262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 609.905326][T10262] Call Trace: [ 609.905334][T10262] [ 609.905345][T10262] dump_stack_lvl+0xe8/0x150 [ 609.905382][T10262] should_fail_ex+0x3eb/0x540 [ 609.905423][T10262] should_failslab+0xa8/0x100 [ 609.905457][T10262] __kmalloc_cache_noprof+0x9e/0x600 [ 609.905483][T10262] ? __kmalloc_cache_noprof+0x148/0x600 [ 609.905506][T10262] ? kvm_set_irq_routing+0x18d/0xd10 [ 609.905535][T10262] ? kvm_set_irq_routing+0x18d/0xd10 [ 609.905573][T10262] kvm_set_irq_routing+0x18d/0xd10 [ 609.905616][T10262] kvm_arch_vm_ioctl+0x1755/0x1a10 [ 609.905648][T10262] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 609.905681][T10262] ? __lock_acquire+0x747/0x2de0 [ 609.905734][T10262] ? lock_acquire+0x115/0x350 [ 609.905765][T10262] ? lock_acquire+0x115/0x350 [ 609.905799][T10262] ? is_bpf_text_address+0x26/0x2b0 [ 609.905837][T10262] ? is_bpf_text_address+0x292/0x2b0 [ 609.905869][T10262] ? is_bpf_text_address+0x26/0x2b0 [ 609.905905][T10262] ? kernel_text_address+0xa5/0xe0 [ 609.905931][T10262] ? __kernel_text_address+0xd/0x30 [ 609.905954][T10262] ? unwind_get_return_address+0x4d/0x90 [ 609.905980][T10262] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 609.906005][T10262] ? arch_stack_walk+0xfb/0x150 [ 609.906039][T10262] ? stack_trace_save+0xa9/0x100 [ 609.906060][T10262] ? __pfx_stack_trace_save+0x10/0x10 [ 609.906079][T10262] ? kasan_save_track+0x4f/0x80 [ 609.906107][T10262] ? stack_depot_save_flags+0x33/0x810 [ 609.906139][T10262] ? __lock_acquire+0x747/0x2de0 [ 609.906166][T10262] ? kasan_save_track+0x4f/0x80 [ 609.906189][T10262] ? kasan_save_track+0x3e/0x80 [ 609.906210][T10262] ? kasan_save_free_info+0x40/0x50 [ 609.906228][T10262] ? __kasan_slab_free+0x5c/0x80 [ 609.906252][T10262] ? kfree+0x1c5/0x650 [ 609.906270][T10262] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 609.906295][T10262] ? security_file_ioctl+0xc3/0x2a0 [ 609.906326][T10262] ? __se_sys_ioctl+0x47/0x170 [ 609.906353][T10262] ? do_syscall_64+0x166/0x520 [ 609.906381][T10262] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.906426][T10262] kvm_vm_ioctl+0x883/0xcb0 [ 609.906462][T10262] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 609.906508][T10262] ? kasan_quarantine_put+0xbb/0x1f0 [ 609.906542][T10262] ? tomoyo_path_number_perm+0x219/0x5f0 [ 609.906571][T10262] ? tomoyo_path_number_perm+0x219/0x5f0 [ 609.906601][T10262] ? do_vfs_ioctl+0x116f/0x1530 [ 609.906653][T10262] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 609.906713][T10262] ? do_futex+0x458/0x4e0 [ 609.906765][T10262] ? __fget_files+0x2a/0x420 [ 609.906793][T10262] ? __fget_files+0x2a/0x420 [ 609.906817][T10262] ? __fget_files+0x2a/0x420 [ 609.906846][T10262] ? bpf_lsm_file_ioctl+0x9/0x20 [ 609.906874][T10262] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 609.906906][T10262] __se_sys_ioctl+0xfc/0x170 [ 609.906939][T10262] do_syscall_64+0x166/0x520 [ 609.906967][T10262] ? trace_irq_disable+0x3b/0x140 [ 609.907012][T10262] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.907036][T10262] ? clear_bhb_loop+0x70/0xc0 [ 609.907065][T10262] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.907089][T10262] RIP: 0033:0x7f548db9f559 [ 609.907111][T10262] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 609.907132][T10262] RSP: 002b:00007f548ea36028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 609.907158][T10262] RAX: ffffffffffffffda RBX: 00007f548de25fa0 RCX: 00007f548db9f559 [ 609.907176][T10262] RDX: 0000000000000000 RSI: 000000000000ae60 RDI: 0000000000000006 [ 609.907191][T10262] RBP: 00007f548dc36b20 R08: 0000000000000000 R09: 0000000000000000 [ 609.907205][T10262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 609.907219][T10262] R13: 00007f548de26038 R14: 00007f548de25fa0 R15: 00007ffd313a6498 [ 609.907257][T10262] [ 610.376895][ T5799] cp2112 0003:10C4:EA90.0015: unknown main item tag 0x0 [ 610.376933][ T5799] cp2112 0003:10C4:EA90.0015: unknown main item tag 0x0 [ 610.376961][ T5799] cp2112 0003:10C4:EA90.0015: unknown main item tag 0x0 [ 610.376990][ T5799] cp2112 0003:10C4:EA90.0015: unknown main item tag 0x0 [ 610.377035][ T5799] cp2112 0003:10C4:EA90.0015: unknown main item tag 0x0 [ 610.377064][ T5799] cp2112 0003:10C4:EA90.0015: unknown main item tag 0x0 [ 610.377091][ T5799] cp2112 0003:10C4:EA90.0015: unknown main item tag 0x0 [ 610.381592][ T5799] cp2112 0003:10C4:EA90.0015: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.8-1/input0 [ 610.383666][ T5799] cp2112 0003:10C4:EA90.0015: Part Number: 0x00 Device Version: 0x00 [ 610.584926][ T5799] cp2112 0003:10C4:EA90.0015: error requesting SMBus config [ 610.606478][ T5799] cp2112 0003:10C4:EA90.0015: probe with driver cp2112 failed with error -32 [ 610.788412][T10265] FAULT_INJECTION: forcing a failure. [ 610.788412][T10265] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 610.788447][T10265] CPU: 1 UID: 0 PID: 10265 Comm: syz.7.1265 Tainted: G L syzkaller #0 PREEMPT(full) [ 610.788475][T10265] Tainted: [L]=SOFTLOCKUP [ 610.788484][T10265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 610.788496][T10265] Call Trace: [ 610.788505][T10265] [ 610.788514][T10265] dump_stack_lvl+0xe8/0x150 [ 610.788551][T10265] should_fail_ex+0x3eb/0x540 [ 610.788586][T10265] _copy_from_iter+0x1d3/0x1680 [ 610.788624][T10265] ? __lock_acquire+0x747/0x2de0 [ 610.788648][T10265] ? __pfx__copy_from_iter+0x10/0x10 [ 610.788692][T10265] tun_get_user+0x265/0x4470 [ 610.788731][T10265] ? aa_file_perm+0x18b/0x15f0 [ 610.788768][T10265] ? aa_file_perm+0x4ed/0x15f0 [ 610.788801][T10265] ? __pfx_tun_get_user+0x10/0x10 [ 610.788826][T10265] ? __lock_acquire+0x747/0x2de0 [ 610.788853][T10265] ? kstrtoull+0x137/0x1d0 [ 610.788884][T10265] ? ref_tracker_alloc+0x172/0x530 [ 610.788905][T10265] ? lock_acquire+0x115/0x350 [ 610.788928][T10265] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 610.788951][T10265] ? lock_acquire+0x115/0x350 [ 610.788974][T10265] ? tun_get+0x1c/0x2f0 [ 610.789002][T10265] ? tun_get+0x1c/0x2f0 [ 610.789023][T10265] ? tun_get+0x1c/0x2f0 [ 610.789049][T10265] tun_chr_write_iter+0x113/0x200 [ 610.789075][T10265] vfs_write+0x612/0xba0 [ 610.789110][T10265] ? __pfx_vfs_write+0x10/0x10 [ 610.789139][T10265] ? __fget_files+0x3a2/0x420 [ 610.789162][T10265] ? __fget_files+0x2a/0x420 [ 610.789189][T10265] ? fdget+0x1ac/0x250 [ 610.789220][T10265] ksys_write+0x150/0x270 [ 610.789248][T10265] ? __pfx_ksys_write+0x10/0x10 [ 610.789285][T10265] do_syscall_64+0x166/0x520 [ 610.789314][T10265] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.789336][T10265] ? clear_bhb_loop+0x70/0xc0 [ 610.789362][T10265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.789390][T10265] RIP: 0033:0x7f548db9f559 [ 610.789410][T10265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 610.789428][T10265] RSP: 002b:00007f548ea36028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 610.789450][T10265] RAX: ffffffffffffffda RBX: 00007f548de25fa0 RCX: 00007f548db9f559 [ 610.789466][T10265] RDX: 0000000000000097 RSI: 0000200000000740 RDI: 0000000000000003 [ 610.789480][T10265] RBP: 00007f548ea36090 R08: 0000000000000000 R09: 0000000000000000 [ 610.789493][T10265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 610.789506][T10265] R13: 00007f548de26038 R14: 00007f548de25fa0 R15: 00007ffd313a6498 [ 610.789539][T10265] [ 611.410569][ T4959] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 611.425105][ T4959] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 611.430456][ T4959] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 611.455765][ T4959] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 611.459766][ T4959] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 611.562566][ T6235] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.626457][T10281] /dev/nullb0: Can't open blockdev [ 611.720719][ T6235] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.835305][ T6235] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.838578][T10288] jffs2: notice: (10288) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 611.982352][ T6235] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.171696][ T5781] usb 9-1: USB disconnect, device number 6 [ 612.308538][ T6235] bridge_slave_1: left allmulticast mode [ 612.308565][ T6235] bridge_slave_1: left promiscuous mode [ 612.308772][ T6235] bridge0: port 2(bridge_slave_1) entered disabled state [ 612.312132][ T6235] bridge_slave_0: left allmulticast mode [ 612.312155][ T6235] bridge_slave_0: left promiscuous mode [ 612.312368][ T6235] bridge0: port 1(bridge_slave_0) entered disabled state [ 612.612603][ T6235] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 612.626988][ T6235] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 612.628491][ T6235] bond0 (unregistering): Released all slaves [ 612.684096][ T5780] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 612.805001][T10323] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 612.835138][ T5780] usb 9-1: Using ep0 maxpacket: 8 [ 612.835850][ T5780] usb 9-1: New USB device found: idVendor=041e, idProduct=3000, bcdDevice=0.40 [ 612.837895][ T5780] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 612.837919][ T5780] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 612.840125][ T5780] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.840150][ T5780] usb 9-1: Product: syz [ 612.840165][ T5780] usb 9-1: Manufacturer: syz [ 612.840181][ T5780] usb 9-1: SerialNumber: syz [ 612.928554][T10268] rxe_eth0 speed is unknown, defaulting to 1000 [ 612.930422][ T5780] usb 9-1: 0:1 : does not exist [ 612.930585][ T5780] usb 9-1: unit 1 not found! [ 612.930633][ T5780] usb 9-1: unit 9 not found! [ 613.046235][ T5782] usb 2-1: new full-speed USB device number 82 using dummy_hcd [ 613.195635][ T5782] usb 2-1: New USB device found: idVendor=0e8f, idProduct=0003, bcdDevice=0.00 [ 613.197002][ T5782] usb 2-1: too many endpoints for config 0 interface 0 altsetting 8: 130, using maximum allowed: 30 [ 613.197050][ T5782] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 613.197103][ T5782] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1983, setting to 64 [ 613.197150][ T5782] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 130 [ 613.197180][ T5782] usb 2-1: config 0 interface 0 has no altsetting 0 [ 613.197215][ T5782] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 613.203083][ T5782] usb 2-1: config 0 descriptor?? [ 613.239647][T10323] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 613.335896][ T5780] usb 9-1: unit 0 not found! [ 613.496136][ T55] Bluetooth: hci1: command tx timeout [ 613.555489][ T5799] usb 9-1: USB disconnect, device number 7 [ 613.711545][ T5782] pantherlord 0003:0E8F:0003.0016: unknown main item tag 0x2 [ 613.711580][ T5782] pantherlord 0003:0E8F:0003.0016: unknown main item tag 0x0 [ 613.711604][ T5782] pantherlord 0003:0E8F:0003.0016: unknown main item tag 0x0 [ 613.772799][ T5782] input: HID 0e8f:0003 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0E8F:0003.0016/input/input47 [ 613.931230][ T5782] pantherlord 0003:0E8F:0003.0016: input,hidraw0: USB HID v0.00 Keyboard [HID 0e8f:0003] on usb-dummy_hcd.1-1/input0 [ 613.999687][ T5782] usb 2-1: USB disconnect, device number 82 [ 614.138212][T10343] fido_id[10343]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 614.280925][ T5303] 8021q: adding VLAN 0 to HW filter on device eth13 [ 614.422684][T10348] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 614.699794][ T6235] hsr_slave_0: left promiscuous mode [ 614.703834][ T6235] hsr_slave_1: left promiscuous mode [ 614.706918][ T6235] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 614.706979][ T6235] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 614.740480][ T6235] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 614.740503][ T6235] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 614.767323][ T6235] veth1_macvtap: left promiscuous mode [ 614.767363][ T6235] veth0_macvtap: left promiscuous mode [ 614.767497][ T6235] veth1_vlan: left promiscuous mode [ 614.767568][ T6235] veth0_vlan: left promiscuous mode [ 615.285889][ T6235] team0 (unregistering): Port device team_slave_1 removed [ 615.314751][ T6235] team0 (unregistering): Port device team_slave_0 removed [ 615.403202][T10378] FAULT_INJECTION: forcing a failure. [ 615.403202][T10378] name failslab, interval 1, probability 0, space 0, times 0 [ 615.403239][T10378] CPU: 0 UID: 0 PID: 10378 Comm: syz.8.1289 Tainted: G L syzkaller #0 PREEMPT(full) [ 615.403270][T10378] Tainted: [L]=SOFTLOCKUP [ 615.403279][T10378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 615.403293][T10378] Call Trace: [ 615.403302][T10378] [ 615.403312][T10378] dump_stack_lvl+0xe8/0x150 [ 615.403351][T10378] should_fail_ex+0x3eb/0x540 [ 615.403392][T10378] should_failslab+0xa8/0x100 [ 615.403423][T10378] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 615.403459][T10378] kmem_cache_alloc_noprof+0x9c/0x600 [ 615.403483][T10378] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 615.403516][T10378] ? kmem_cache_alloc_noprof+0x151/0x600 [ 615.403540][T10378] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 615.403584][T10378] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 615.403632][T10378] mmu_topup_memory_caches+0x21/0x1a0 [ 615.403660][T10378] kvm_mmu_load+0x9d/0x21e0 [ 615.403691][T10378] ? kvm_msr_allowed+0x9a/0x490 [ 615.403714][T10378] ? kvm_msr_allowed+0x3f4/0x490 [ 615.403736][T10378] ? kvm_msr_allowed+0x9a/0x490 [ 615.403757][T10378] ? kvm_msr_allowed+0x9a/0x490 [ 615.403787][T10378] ? kvm_apic_has_interrupt+0x740/0x770 [ 615.403839][T10378] vcpu_run+0x4f5b/0x7a90 [ 615.403943][T10378] ? __pfx_vcpu_run+0x10/0x10 [ 615.403967][T10378] ? lock_acquire+0x115/0x350 [ 615.404000][T10378] ? fpu_swap_kvm_fpstate+0xbe/0x510 [ 615.404030][T10378] ? vmx_unhandleable_emulation_required+0x77/0x230 [ 615.404086][T10378] kvm_arch_vcpu_ioctl_run+0xe83/0x18b0 [ 615.404126][T10378] ? kvm_arch_vcpu_ioctl_run+0x1f5/0x18b0 [ 615.404162][T10378] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 615.404193][T10378] kvm_vcpu_ioctl+0xa61/0xfd0 [ 615.404225][T10378] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 615.404271][T10378] ? __fget_files+0x2a/0x420 [ 615.404300][T10378] ? __fget_files+0x2a/0x420 [ 615.404325][T10378] ? __fget_files+0x2a/0x420 [ 615.404356][T10378] ? bpf_lsm_file_ioctl+0x9/0x20 [ 615.404384][T10378] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 615.404409][T10378] __se_sys_ioctl+0xfc/0x170 [ 615.404444][T10378] do_syscall_64+0x166/0x520 [ 615.404484][T10378] ? trace_irq_disable+0x3b/0x140 [ 615.404511][T10378] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 615.404550][T10378] ? clear_bhb_loop+0x70/0xc0 [ 615.404578][T10378] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 615.404601][T10378] RIP: 0033:0x7fd095d9f559 [ 615.404622][T10378] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 615.404642][T10378] RSP: 002b:00007fd096c17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 615.404666][T10378] RAX: ffffffffffffffda RBX: 00007fd096025fa0 RCX: 00007fd095d9f559 [ 615.404683][T10378] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 615.404697][T10378] RBP: 00007fd096c17090 R08: 0000000000000000 R09: 0000000000000000 [ 615.404711][T10378] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 615.404737][T10378] R13: 00007fd096026038 R14: 00007fd096025fa0 R15: 00007ffc1a50d0d8 [ 615.404770][T10378] [ 615.578417][ T55] Bluetooth: hci1: command tx timeout [ 615.822726][ T5303] 8021q: adding VLAN 0 to HW filter on device eth14 [ 616.349651][T10268] bridge0: port 1(bridge_slave_0) entered blocking state [ 616.354599][T10268] bridge0: port 1(bridge_slave_0) entered disabled state [ 616.354933][T10268] bridge_slave_0: entered allmulticast mode [ 616.377855][T10268] bridge_slave_0: entered promiscuous mode [ 616.393945][T10268] bridge0: port 2(bridge_slave_1) entered blocking state [ 616.395304][T10268] bridge0: port 2(bridge_slave_1) entered disabled state [ 616.395632][T10268] bridge_slave_1: entered allmulticast mode [ 616.416405][T10268] bridge_slave_1: entered promiscuous mode [ 616.438158][T10407] FAULT_INJECTION: forcing a failure. [ 616.438158][T10407] name failslab, interval 1, probability 0, space 0, times 0 [ 616.438204][T10407] CPU: 1 UID: 0 PID: 10407 Comm: syz.1.1293 Tainted: G L syzkaller #0 PREEMPT(full) [ 616.438233][T10407] Tainted: [L]=SOFTLOCKUP [ 616.438258][T10407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 616.438270][T10407] Call Trace: [ 616.438279][T10407] [ 616.438288][T10407] dump_stack_lvl+0xe8/0x150 [ 616.438324][T10407] should_fail_ex+0x3eb/0x540 [ 616.438359][T10407] should_failslab+0xa8/0x100 [ 616.438389][T10407] __kmalloc_cache_noprof+0x9e/0x600 [ 616.438414][T10407] ? __se_sys_memfd_create+0x21d/0x410 [ 616.438435][T10407] ? __se_sys_memfd_create+0x21d/0x410 [ 616.438462][T10407] __se_sys_memfd_create+0x21d/0x410 [ 616.438488][T10407] do_syscall_64+0x166/0x520 [ 616.438515][T10407] ? trace_irq_disable+0x3b/0x140 [ 616.438540][T10407] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 616.438561][T10407] ? clear_bhb_loop+0x70/0xc0 [ 616.438586][T10407] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 616.438607][T10407] RIP: 0033:0x7fe32319f559 [ 616.438626][T10407] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 616.438645][T10407] RSP: 002b:00007fe324050028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 616.438667][T10407] RAX: ffffffffffffffda RBX: 00007fe323426090 RCX: 00007fe32319f559 [ 616.438682][T10407] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00002000000004c0 [ 616.438695][T10407] RBP: 00007fe323236b20 R08: 0000000000000000 R09: 0000000000000000 [ 616.438708][T10407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 616.438721][T10407] R13: 00007fe323426128 R14: 00007fe323426090 R15: 00007ffd5b6805e8 [ 616.438752][T10407] [ 616.690191][T10268] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 616.717470][T10268] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 616.826943][T10268] team0: Port device team_slave_0 added [ 616.831900][T10268] team0: Port device team_slave_1 added [ 616.884509][ T5690] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 616.930819][T10268] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 616.930837][T10268] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 616.930864][T10268] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 616.933831][T10268] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 616.933846][T10268] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 616.933875][T10268] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 617.055184][ T5690] usb 2-1: Using ep0 maxpacket: 8 [ 617.058611][ T5690] usb 2-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 617.060796][ T5690] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 617.060847][ T5690] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 617.060873][ T5690] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 617.060899][ T5690] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 617.060926][ T5690] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 617.060971][ T5690] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 617.225336][ T5303] 8021q: adding VLAN 0 to HW filter on device eth15 [ 617.259136][T10268] hsr_slave_0: entered promiscuous mode [ 617.268100][T10268] hsr_slave_1: entered promiscuous mode [ 617.271092][T10268] debugfs: 'hsr0' already exists in 'hsr' [ 617.271114][T10268] Cannot create hsr debugfs directory [ 617.588688][T10399] nbd: must specify an index to disconnect [ 617.612836][T10268] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 617.626361][T10268] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 617.627812][T10268] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 617.632480][T10268] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 617.633637][T10268] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 617.659977][T10268] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 617.668014][ T55] Bluetooth: hci1: command tx timeout [ 617.668797][T10268] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 617.693588][T10268] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 617.808434][T10268] 8021q: adding VLAN 0 to HW filter on device bond0 [ 617.841038][T10268] 8021q: adding VLAN 0 to HW filter on device team0 [ 617.858945][ T6072] bridge0: port 1(bridge_slave_0) entered blocking state [ 617.859016][ T6072] bridge0: port 1(bridge_slave_0) entered forwarding state [ 617.872458][ T6194] bridge0: port 2(bridge_slave_1) entered blocking state [ 617.872725][ T6194] bridge0: port 2(bridge_slave_1) entered forwarding state [ 617.958173][T10407] usbtmc 2-1:16.0: simple usb_control_msg returned 0 [ 618.161357][ T5782] usb 2-1: USB disconnect, device number 83 [ 618.248365][ T5303] 8021q: adding VLAN 0 to HW filter on device eth16 [ 618.422828][T10450] netlink: 'syz.8.1297': attribute type 3 has an invalid length. [ 618.685783][T10268] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 618.956145][T10476] device-mapper: table: 248:8: crypt: Error decoding and setting key (-EINVAL) [ 618.956172][T10476] device-mapper: ioctl: error adding target to table [ 619.037940][T10481] /dev/nullb0: Can't open blockdev [ 619.101527][T10483] Line length is too long: Should be less than 4094 [ 619.101756][ T55] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 619.104289][ T5690] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 619.133503][T10268] veth0_vlan: entered promiscuous mode [ 619.145640][T10268] veth1_vlan: entered promiscuous mode [ 619.178870][T10268] veth0_macvtap: entered promiscuous mode [ 619.191010][T10268] veth1_macvtap: entered promiscuous mode [ 619.209268][T10268] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 619.226376][T10268] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 619.267337][ T6291] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.276825][ T5690] usb 9-1: New USB device found: idVendor=10c4, idProduct=ea90, bcdDevice=0.80 [ 619.277817][ T5690] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 619.277845][ T5690] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 619.277880][ T5690] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 619.298893][ T5690] usb 9-1: config 0 descriptor?? [ 619.337499][ T6235] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.340669][ T6072] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.428642][ T6291] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 619.428663][ T6291] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 619.458422][ T6083] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.487030][ T6184] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 619.487052][ T6184] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 619.734089][ T55] Bluetooth: hci1: command tx timeout [ 619.750341][ T5690] cp2112 0003:10C4:EA90.0017: unknown main item tag 0x0 [ 619.750373][ T5690] cp2112 0003:10C4:EA90.0017: unknown main item tag 0x0 [ 619.750397][ T5690] cp2112 0003:10C4:EA90.0017: unknown main item tag 0x0 [ 619.750421][ T5690] cp2112 0003:10C4:EA90.0017: unknown main item tag 0x0 [ 619.750456][ T5690] cp2112 0003:10C4:EA90.0017: unknown main item tag 0x0 [ 619.750483][ T5690] cp2112 0003:10C4:EA90.0017: unknown main item tag 0x0 [ 619.750510][ T5690] cp2112 0003:10C4:EA90.0017: unknown main item tag 0x0 [ 619.802364][ T5690] cp2112 0003:10C4:EA90.0017: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.8-1/input0 [ 619.850785][T10490] /dev/nullb0: Can't open blockdev [ 619.880127][T10490] FAULT_INJECTION: forcing a failure. [ 619.880127][T10490] name failslab, interval 1, probability 0, space 0, times 0 [ 619.880161][T10490] CPU: 1 UID: 0 PID: 10490 Comm: syz.1.1306 Tainted: G L syzkaller #0 PREEMPT(full) [ 619.880192][T10490] Tainted: [L]=SOFTLOCKUP [ 619.880200][T10490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 619.880214][T10490] Call Trace: [ 619.880223][T10490] [ 619.880232][T10490] dump_stack_lvl+0xe8/0x150 [ 619.880269][T10490] should_fail_ex+0x3eb/0x540 [ 619.880306][T10490] should_failslab+0xa8/0x100 [ 619.880340][T10490] __kmalloc_node_track_caller_noprof+0xf6/0x720 [ 619.880369][T10490] ? key_alloc+0x38c/0xd20 [ 619.880462][T10490] ? key_alloc+0x38c/0xd20 [ 619.880507][T10490] kmemdup_noprof+0x2b/0x70 [ 619.880530][T10490] key_alloc+0x38c/0xd20 [ 619.880570][T10490] keyring_alloc+0x45/0xb0 [ 619.880603][T10490] keyctl_get_persistent+0x493/0x7c0 [ 619.880642][T10490] ? __pfx_keyctl_get_persistent+0x10/0x10 [ 619.880671][T10490] ? futex_wake+0x51b/0x5f0 [ 619.880699][T10490] ? __pfx_futex_wake+0x10/0x10 [ 619.880734][T10490] __se_sys_keyctl+0x839/0xbc0 [ 619.880761][T10490] ? __pfx___se_sys_keyctl+0x10/0x10 [ 619.880788][T10490] ? __pfx_do_futex+0x10/0x10 [ 619.880815][T10490] ? __fget_files+0x3a2/0x420 [ 619.880838][T10490] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 619.880874][T10490] ? __se_sys_futex+0x3a8/0x450 [ 619.880939][T10490] ? rcu_is_watching+0x16/0xb0 [ 619.880977][T10490] ? __x64_sys_keyctl+0x20/0xc0 [ 619.881006][T10490] do_syscall_64+0x166/0x520 [ 619.881034][T10490] ? trace_irq_disable+0x3b/0x140 [ 619.881060][T10490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 619.881083][T10490] ? clear_bhb_loop+0x70/0xc0 [ 619.881110][T10490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 619.881131][T10490] RIP: 0033:0x7fe32319f559 [ 619.881151][T10490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 619.881170][T10490] RSP: 002b:00007fe324071028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 619.881193][T10490] RAX: ffffffffffffffda RBX: 00007fe323425fa0 RCX: 00007fe32319f559 [ 619.881210][T10490] RDX: fffffffffffffffd RSI: ffffffffffffffff RDI: 0000000000000016 [ 619.881227][T10490] RBP: 00007fe323236b20 R08: 0000000000000000 R09: 0000000000000000 [ 619.881259][T10490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 619.881274][T10490] R13: 00007fe323426038 R14: 00007fe323425fa0 R15: 00007ffd5b6805e8 [ 619.881311][T10490] [ 619.979019][ T5690] cp2112 0003:10C4:EA90.0017: Part Number: 0x00 Device Version: 0x00 [ 620.192531][ T5690] cp2112 0003:10C4:EA90.0017: error requesting SMBus config [ 620.205796][ T5690] cp2112 0003:10C4:EA90.0017: probe with driver cp2112 failed with error -32 [ 620.795956][T10526] FAULT_INJECTION: forcing a failure. [ 620.795956][T10526] name failslab, interval 1, probability 0, space 0, times 0 [ 620.795996][T10526] CPU: 0 UID: 0 PID: 10526 Comm: syz.7.1311 Tainted: G L syzkaller #0 PREEMPT(full) [ 620.796029][T10526] Tainted: [L]=SOFTLOCKUP [ 620.796038][T10526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 620.796052][T10526] Call Trace: [ 620.796062][T10526] [ 620.796075][T10526] dump_stack_lvl+0xe8/0x150 [ 620.796114][T10526] should_fail_ex+0x3eb/0x540 [ 620.796153][T10526] should_failslab+0xa8/0x100 [ 620.796185][T10526] ? ceph_msg_new2+0x3b/0x4d0 [ 620.796220][T10526] kmem_cache_alloc_noprof+0x9c/0x600 [ 620.796247][T10526] ? rcu_is_watching+0x16/0xb0 [ 620.796276][T10526] ? ceph_msg_new2+0x3b/0x4d0 [ 620.796317][T10526] ceph_msg_new2+0x3b/0x4d0 [ 620.796351][T10526] ? __kmalloc_node_noprof+0x2eb/0x720 [ 620.796378][T10526] msgpool_alloc+0x80/0x210 [ 620.796413][T10526] ? __pfx_msgpool_alloc+0x10/0x10 [ 620.796448][T10526] mempool_init_node+0x1f4/0x510 [ 620.796554][T10526] ? __pfx_msgpool_alloc+0x10/0x10 [ 620.796591][T10526] mempool_create_node_noprof+0xb8/0x150 [ 620.796625][T10526] ? __pfx_msgpool_free+0x10/0x10 [ 620.796664][T10526] ceph_msgpool_init+0xb3/0x1c0 [ 620.796704][T10526] ceph_osdc_init+0x55b/0x900 [ 620.796748][T10526] ceph_create_client+0x246/0x310 [ 620.796781][T10526] ceph_get_tree+0x1ca/0x1a80 [ 620.796809][T10526] ? apparmor_capable+0x126/0x170 [ 620.796841][T10526] vfs_get_tree+0x92/0x2a0 [ 620.796874][T10526] do_new_mount+0x325/0xb00 [ 620.796906][T10526] ? __pfx_do_new_mount+0x10/0x10 [ 620.796934][T10526] ? ns_capable+0x84/0xe0 [ 620.796966][T10526] ? path_mount+0x647/0x1050 [ 620.796994][T10526] ? user_path_at+0xd4/0x160 [ 620.797025][T10526] __se_sys_mount+0x31d/0x420 [ 620.797057][T10526] ? __pfx___se_sys_mount+0x10/0x10 [ 620.797089][T10526] ? __seccomp_permit_syscall+0xe7/0x2b0 [ 620.797122][T10526] ? __x64_sys_mount+0x20/0xc0 [ 620.797150][T10526] do_syscall_64+0x166/0x520 [ 620.797181][T10526] ? trace_irq_disable+0x3b/0x140 [ 620.797209][T10526] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.797233][T10526] ? clear_bhb_loop+0x70/0xc0 [ 620.797260][T10526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.797283][T10526] RIP: 0033:0x7f548db9f559 [ 620.797304][T10526] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 620.797325][T10526] RSP: 002b:00007f548e9f4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 620.797351][T10526] RAX: ffffffffffffffda RBX: 00007f548de26180 RCX: 00007f548db9f559 [ 620.797369][T10526] RDX: 00002000000028c0 RSI: 0000200000002880 RDI: 0000200000002840 [ 620.797386][T10526] RBP: 00007f548dc36b20 R08: 0000000000000000 R09: 0000000000000000 [ 620.797402][T10526] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 620.797416][T10526] R13: 00007f548de26218 R14: 00007f548de26180 R15: 00007ffd313a6498 [ 620.797452][T10526] [ 621.276787][T10534] netlink: 'syz.9.1314': attribute type 29 has an invalid length. [ 621.278461][T10534] netlink: 'syz.9.1314': attribute type 29 has an invalid length. [ 621.492929][T10546] netlink: 'syz.1.1318': attribute type 5 has an invalid length. [ 621.899832][ T5690] usb 9-1: USB disconnect, device number 8 [ 621.934115][ T5781] usb 2-1: new full-speed USB device number 84 using dummy_hcd [ 621.991084][T10567] FAULT_INJECTION: forcing a failure. [ 621.991084][T10567] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 621.991118][T10567] CPU: 0 UID: 0 PID: 10567 Comm: syz.8.1324 Tainted: G L syzkaller #0 PREEMPT(full) [ 621.991146][T10567] Tainted: [L]=SOFTLOCKUP [ 621.991155][T10567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 621.991168][T10567] Call Trace: [ 621.991177][T10567] [ 621.991186][T10567] dump_stack_lvl+0xe8/0x150 [ 621.991222][T10567] should_fail_ex+0x3eb/0x540 [ 621.991268][T10567] _copy_from_user+0x2d/0xb0 [ 621.991299][T10567] msr_io+0xab/0x8b0 [ 621.991327][T10567] ? lock_acquire+0x115/0x350 [ 621.991349][T10567] ? __pfx_do_get_msr+0x10/0x10 [ 621.991377][T10567] ? __pfx_msr_io+0x10/0x10 [ 621.991405][T10567] ? __srcu_check_read_flavor+0x13d/0x2e0 [ 621.991434][T10567] ? kvm_get_msrs+0x68/0x100 [ 621.991458][T10567] kvm_get_msrs+0x9f/0x100 [ 621.991487][T10567] kvm_arch_vcpu_ioctl+0x11b6/0x23a0 [ 621.991517][T10567] ? lock_acquire+0x115/0x350 [ 621.991540][T10567] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 621.991572][T10567] ? lock_acquire+0x115/0x350 [ 621.991605][T10567] ? is_bpf_text_address+0x26/0x2b0 [ 621.991642][T10567] ? is_bpf_text_address+0x292/0x2b0 [ 621.991673][T10567] ? is_bpf_text_address+0x26/0x2b0 [ 621.991707][T10567] ? kernel_text_address+0xa5/0xe0 [ 621.991733][T10567] ? __kernel_text_address+0xd/0x30 [ 621.991756][T10567] ? unwind_get_return_address+0x4d/0x90 [ 621.991782][T10567] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 621.991806][T10567] ? arch_stack_walk+0xfb/0x150 [ 621.991843][T10567] ? stack_trace_save+0xa9/0x100 [ 621.991865][T10567] ? __pfx_stack_trace_save+0x10/0x10 [ 621.991886][T10567] ? kasan_save_track+0x4f/0x80 [ 621.991915][T10567] ? stack_depot_save_flags+0x33/0x810 [ 621.991951][T10567] ? __lock_acquire+0x747/0x2de0 [ 621.991976][T10567] ? kfree+0x1c5/0x650 [ 621.991995][T10567] ? __se_sys_ioctl+0x47/0x170 [ 621.992026][T10567] ? do_syscall_64+0x166/0x520 [ 621.992053][T10567] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.992094][T10567] ? __mutex_trylock_common+0x15f/0x270 [ 621.992126][T10567] ? __pfx___mutex_trylock_common+0x10/0x10 [ 621.992157][T10567] ? rcu_is_watching+0x16/0xb0 [ 621.992185][T10567] ? trace_contention_end+0x3d/0x140 [ 621.992216][T10567] ? __mutex_lock+0x305/0x15a0 [ 621.992254][T10567] ? kasan_quarantine_put+0xbb/0x1f0 [ 621.992284][T10567] ? kvm_vcpu_ioctl+0x27f/0xfd0 [ 621.992309][T10567] ? __pfx___mutex_lock+0x10/0x10 [ 621.992339][T10567] ? tomoyo_path_number_perm+0x219/0x5f0 [ 621.992370][T10567] ? do_vfs_ioctl+0x116f/0x1530 [ 621.992402][T10567] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 621.992436][T10567] kvm_vcpu_ioctl+0x7e3/0xfd0 [ 621.992466][T10567] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 621.992510][T10567] ? __fget_files+0x2a/0x420 [ 621.992537][T10567] ? __fget_files+0x2a/0x420 [ 621.992571][T10567] ? __fget_files+0x2a/0x420 [ 621.992597][T10567] ? bpf_lsm_file_ioctl+0x9/0x20 [ 621.992623][T10567] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 621.992645][T10567] __se_sys_ioctl+0xfc/0x170 [ 621.992674][T10567] do_syscall_64+0x166/0x520 [ 621.992700][T10567] ? trace_irq_disable+0x3b/0x140 [ 621.992724][T10567] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.992744][T10567] ? clear_bhb_loop+0x70/0xc0 [ 621.992769][T10567] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.992790][T10567] RIP: 0033:0x7fd095d9f559 [ 621.992808][T10567] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 621.992826][T10567] RSP: 002b:00007fd096c17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 621.992847][T10567] RAX: ffffffffffffffda RBX: 00007fd096025fa0 RCX: 00007fd095d9f559 [ 621.992862][T10567] RDX: 0000200000001300 RSI: 00000000c008ae88 RDI: 0000000000000005 [ 621.992875][T10567] RBP: 00007fd096c17090 R08: 0000000000000000 R09: 0000000000000000 [ 621.992888][T10567] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 621.992900][T10567] R13: 00007fd096026038 R14: 00007fd096025fa0 R15: 00007ffc1a50d0d8 [ 621.992932][T10567] [ 622.123542][ T5781] usb 2-1: New USB device found: idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 622.195429][ T5781] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 622.195504][ T5781] usb 2-1: Product: syz [ 622.195547][ T5781] usb 2-1: Manufacturer: syz [ 622.195589][ T5781] usb 2-1: SerialNumber: syz [ 622.263444][ T5781] usb 2-1: config 0 descriptor?? [ 622.513914][ T5781] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 622.680618][T10576] device-mapper: ioctl: populate_table: next target spec (offset 242) overlaps 'struct dm_ioctl' [ 622.719930][T10578] netlink: 16 bytes leftover after parsing attributes in process `syz.9.1326'. [ 622.824379][T10583] FAULT_INJECTION: forcing a failure. [ 622.824379][T10583] name failslab, interval 1, probability 0, space 0, times 0 [ 622.824414][T10583] CPU: 0 UID: 0 PID: 10583 Comm: syz.8.1328 Tainted: G L syzkaller #0 PREEMPT(full) [ 622.824452][T10583] Tainted: [L]=SOFTLOCKUP [ 622.824464][T10583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 622.824484][T10583] Call Trace: [ 622.824494][T10583] [ 622.824504][T10583] dump_stack_lvl+0xe8/0x150 [ 622.824541][T10583] should_fail_ex+0x3eb/0x540 [ 622.824593][T10583] should_failslab+0xa8/0x100 [ 622.824654][T10583] __kmalloc_noprof+0xf9/0x710 [ 622.824678][T10583] ? tomoyo_encode+0x2ad/0x570 [ 622.824705][T10583] ? tomoyo_encode+0x2ad/0x570 [ 622.824740][T10583] tomoyo_encode+0x2ad/0x570 [ 622.824775][T10583] tomoyo_realpath_from_path+0x5fa/0x640 [ 622.824814][T10583] ? tomoyo_path_number_perm+0x219/0x5f0 [ 622.824839][T10583] tomoyo_path_number_perm+0x246/0x5f0 [ 622.824866][T10583] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 622.824890][T10583] ? __lock_acquire+0x747/0x2de0 [ 622.824968][T10583] ? __fget_files+0x2a/0x420 [ 622.824995][T10583] ? __fget_files+0x2a/0x420 [ 622.825019][T10583] ? __fget_files+0x2a/0x420 [ 622.825048][T10583] security_file_ioctl+0xc3/0x2a0 [ 622.825074][T10583] __se_sys_ioctl+0x47/0x170 [ 622.825107][T10583] do_syscall_64+0x166/0x520 [ 622.825135][T10583] ? trace_irq_disable+0x3b/0x140 [ 622.825161][T10583] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.825183][T10583] ? clear_bhb_loop+0x70/0xc0 [ 622.825216][T10583] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.825237][T10583] RIP: 0033:0x7fd095d9f1eb [ 622.825257][T10583] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 622.825275][T10583] RSP: 002b:00007fd096c16f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 622.825298][T10583] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd095d9f1eb [ 622.825313][T10583] RDX: 00007fd096c16fc0 RSI: 000000004020ae46 RDI: 0000000000000003 [ 622.825327][T10583] RBP: 00007fd095e56860 R08: 0000000000000000 R09: 0000000000000003 [ 622.825340][T10583] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000b19000 [ 622.825353][T10583] R13: 0000000000000002 R14: 0000000000000000 R15: 00000000003ef000 [ 622.825385][T10583] [ 622.825486][T10583] ERROR: Out of memory at tomoyo_realpath_from_path. [ 623.260789][T10588] FAULT_INJECTION: forcing a failure. [ 623.260789][T10588] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 623.260825][T10588] CPU: 1 UID: 0 PID: 10588 Comm: syz.7.1329 Tainted: G L syzkaller #0 PREEMPT(full) [ 623.260861][T10588] Tainted: [L]=SOFTLOCKUP [ 623.260870][T10588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 623.260884][T10588] Call Trace: [ 623.260893][T10588] [ 623.260905][T10588] dump_stack_lvl+0xe8/0x150 [ 623.260944][T10588] should_fail_ex+0x3eb/0x540 [ 623.260984][T10588] _copy_to_user+0x31/0xb0 [ 623.261022][T10588] sw_sync_ioctl+0xda7/0x10f0 [ 623.261154][T10588] ? __pfx_sw_sync_ioctl+0x10/0x10 [ 623.261192][T10588] ? __fget_files+0x2a/0x420 [ 623.261226][T10588] ? __fget_files+0x2a/0x420 [ 623.261257][T10588] ? bpf_lsm_file_ioctl+0x9/0x20 [ 623.261287][T10588] ? __pfx_sw_sync_ioctl+0x10/0x10 [ 623.261323][T10588] __se_sys_ioctl+0xfc/0x170 [ 623.261359][T10588] do_syscall_64+0x166/0x520 [ 623.261390][T10588] ? trace_irq_disable+0x3b/0x140 [ 623.261418][T10588] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.261453][T10588] ? clear_bhb_loop+0x70/0xc0 [ 623.261493][T10588] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.261515][T10588] RIP: 0033:0x7f548db9f559 [ 623.261553][T10588] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 623.261573][T10588] RSP: 002b:00007f548ea15028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 623.261597][T10588] RAX: ffffffffffffffda RBX: 00007f548de26090 RCX: 00007f548db9f559 [ 623.261614][T10588] RDX: 0000200000000280 RSI: 00000000c0285700 RDI: 0000000000000003 [ 623.261630][T10588] RBP: 00007f548dc36b20 R08: 0000000000000000 R09: 0000000000000000 [ 623.261644][T10588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 623.261658][T10588] R13: 00007f548de26128 R14: 00007f548de26090 R15: 00007ffd313a6498 [ 623.261701][T10588] [ 624.384919][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.384982][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.577153][T10610] kvm [10594]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010000) = 0x8000000000001 [ 624.621642][ T5781] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 624.652874][ T5781] usb 2-1: USB disconnect, device number 84 [ 624.834306][ T5799] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 625.005359][ T5799] usb 10-1: New USB device found: idVendor=10c4, idProduct=ea90, bcdDevice=0.80 [ 625.006691][ T5799] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 625.006722][ T5799] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 625.006787][ T5799] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 625.011349][ T5799] usb 10-1: config 0 descriptor?? [ 625.341144][T10641] FAULT_INJECTION: forcing a failure. [ 625.341144][T10641] name failslab, interval 1, probability 0, space 0, times 0 [ 625.341170][T10641] CPU: 0 UID: 0 PID: 10641 Comm: syz.1.1336 Tainted: G L syzkaller #0 PREEMPT(full) [ 625.341191][T10641] Tainted: [L]=SOFTLOCKUP [ 625.341197][T10641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 625.341207][T10641] Call Trace: [ 625.341213][T10641] [ 625.341222][T10641] dump_stack_lvl+0xe8/0x150 [ 625.341250][T10641] should_fail_ex+0x3eb/0x540 [ 625.341277][T10641] should_failslab+0xa8/0x100 [ 625.341298][T10641] ? sctp_chunkify+0x5a/0x260 [ 625.341322][T10641] kmem_cache_alloc_noprof+0x9c/0x600 [ 625.341338][T10641] ? __kmalloc_node_track_caller_noprof+0x2e6/0x720 [ 625.341356][T10641] ? _sctp_make_chunk+0x59/0x290 [ 625.341379][T10641] ? sctp_chunkify+0x5a/0x260 [ 625.341406][T10641] sctp_chunkify+0x5a/0x260 [ 625.341431][T10641] _sctp_make_chunk+0x122/0x290 [ 625.341457][T10641] sctp_make_datafrag_empty+0x12a/0x240 [ 625.341479][T10641] ? __kasan_kmalloc+0x93/0xb0 [ 625.341507][T10641] ? __pfx_sctp_make_datafrag_empty+0x10/0x10 [ 625.341529][T10641] ? skb_put+0x112/0x210 [ 625.341550][T10641] ? sctp_user_addto_chunk+0x9c/0x230 [ 625.341600][T10641] sctp_datamsg_from_user+0x735/0xef0 [ 625.341671][T10641] sctp_sendmsg_to_asoc+0x106b/0x1a40 [ 625.341720][T10641] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 625.341759][T10641] ? arch_stack_walk+0xfb/0x150 [ 625.341796][T10641] ? do_raw_spin_lock+0x12b/0x2f0 [ 625.341830][T10641] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 625.341856][T10641] ? sctp_sendmsg+0xbb8/0x2d00 [ 625.341873][T10641] ? sctp_sendmsg_check_sflags+0x18a/0x330 [ 625.341893][T10641] sctp_sendmsg+0x1bb5/0x2d00 [ 625.341919][T10641] ? __pfx_sctp_sendmsg+0x10/0x10 [ 625.341947][T10641] ? process_measurement+0x7b2/0x1c10 [ 625.341974][T10641] ? __mutex_trylock_common+0x15f/0x270 [ 625.341999][T10641] ? aa_sock_msg_perm+0xf5/0x210 [ 625.342023][T10641] ? sock_rps_record_flow+0x19/0x350 [ 625.342044][T10641] ? inet_sendmsg+0x298/0x320 [ 625.342062][T10641] ? apparmor_socket_sendmsg+0x98/0x360 [ 625.342083][T10641] ? __pfx_inet_sendmsg+0x10/0x10 [ 625.342101][T10641] sock_sendmsg_nosec+0x10f/0x190 [ 625.342127][T10641] sock_sendmsg+0x1ca/0x2d0 [ 625.342155][T10641] ? __pfx_sock_sendmsg+0x10/0x10 [ 625.342187][T10641] ? __asan_memset+0x22/0x50 [ 625.342205][T10641] ? iov_iter_bvec+0xb8/0x180 [ 625.342230][T10641] splice_to_socket+0xc4d/0x1460 [ 625.342269][T10641] ? __pfx_splice_to_socket+0x10/0x10 [ 625.342317][T10641] ? bpf_lsm_file_permission+0x9/0x20 [ 625.342337][T10641] ? security_file_permission+0x75/0x260 [ 625.342356][T10641] ? rw_verify_area+0x203/0x4c0 [ 625.342375][T10641] ? __pfx_splice_to_socket+0x10/0x10 [ 625.342395][T10641] do_splice+0xf9e/0x19f0 [ 625.342427][T10641] ? __fget_files+0x2a/0x420 [ 625.342449][T10641] ? __pfx_do_splice+0x10/0x10 [ 625.342467][T10641] ? __fget_files+0x2a/0x420 [ 625.342487][T10641] ? fdget+0x1ac/0x250 [ 625.342514][T10641] __se_sys_splice+0x353/0x490 [ 625.342539][T10641] ? __pfx___se_sys_splice+0x10/0x10 [ 625.342564][T10641] ? __x64_sys_splice+0x21/0xf0 [ 625.342586][T10641] do_syscall_64+0x166/0x520 [ 625.342609][T10641] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 625.342625][T10641] ? clear_bhb_loop+0x70/0xc0 [ 625.342646][T10641] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 625.342662][T10641] RIP: 0033:0x7fe32319f559 [ 625.342677][T10641] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 625.342691][T10641] RSP: 002b:00007fe324050028 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 625.342723][T10641] RAX: ffffffffffffffda RBX: 00007fe323426090 RCX: 00007fe32319f559 [ 625.342740][T10641] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000005 [ 625.342753][T10641] RBP: 00007fe324050090 R08: 000000000000ffff R09: 0000000000000002 [ 625.342768][T10641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 625.342782][T10641] R13: 00007fe323426128 R14: 00007fe323426090 R15: 00007ffd5b6805e8 [ 625.342819][T10641] [ 625.526461][ T5799] cp2112 0003:10C4:EA90.0018: unknown main item tag 0x0 [ 625.526557][ T5799] cp2112 0003:10C4:EA90.0018: unknown main item tag 0x0 [ 625.526635][ T5799] cp2112 0003:10C4:EA90.0018: unknown main item tag 0x0 [ 625.526707][ T5799] cp2112 0003:10C4:EA90.0018: unknown main item tag 0x0 [ 625.526782][ T5799] cp2112 0003:10C4:EA90.0018: unknown main item tag 0x0 [ 625.526854][ T5799] cp2112 0003:10C4:EA90.0018: unknown main item tag 0x0 [ 625.526943][ T5799] cp2112 0003:10C4:EA90.0018: unknown main item tag 0x0 [ 625.584690][ T5799] cp2112 0003:10C4:EA90.0018: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.9-1/input0 [ 625.641047][ T5799] cp2112 0003:10C4:EA90.0018: Part Number: 0x00 Device Version: 0x00 [ 625.852938][ T5799] cp2112 0003:10C4:EA90.0018: error requesting SMBus config [ 625.891174][ T5799] cp2112 0003:10C4:EA90.0018: probe with driver cp2112 failed with error -32 [ 626.493728][T10658] FAULT_INJECTION: forcing a failure. [ 626.493728][T10658] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 626.493755][T10658] CPU: 1 UID: 0 PID: 10658 Comm: syz.1.1341 Tainted: G L syzkaller #0 PREEMPT(full) [ 626.493804][T10658] Tainted: [L]=SOFTLOCKUP [ 626.493813][T10658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 626.493826][T10658] Call Trace: [ 626.493835][T10658] [ 626.493852][T10658] dump_stack_lvl+0xe8/0x150 [ 626.493887][T10658] should_fail_ex+0x3eb/0x540 [ 626.493926][T10658] _copy_from_user+0x2d/0xb0 [ 626.493977][T10658] wext_handle_ioctl+0xc7/0x1d0 [ 626.494003][T10658] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 626.494065][T10658] sock_ioctl+0x159/0x7e0 [ 626.494115][T10658] ? __fget_files+0x2a/0x420 [ 626.494141][T10658] ? __pfx_sock_ioctl+0x10/0x10 [ 626.494172][T10658] ? __fget_files+0x2a/0x420 [ 626.494197][T10658] ? __fget_files+0x2a/0x420 [ 626.494227][T10658] ? bpf_lsm_file_ioctl+0x9/0x20 [ 626.494256][T10658] ? __pfx_sock_ioctl+0x10/0x10 [ 626.494287][T10658] __se_sys_ioctl+0xfc/0x170 [ 626.494321][T10658] do_syscall_64+0x166/0x520 [ 626.494351][T10658] ? trace_irq_disable+0x3b/0x140 [ 626.494379][T10658] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.494402][T10658] ? clear_bhb_loop+0x70/0xc0 [ 626.494430][T10658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.494453][T10658] RIP: 0033:0x7fe32319f559 [ 626.494474][T10658] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 626.494494][T10658] RSP: 002b:00007fe324071028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 626.494519][T10658] RAX: ffffffffffffffda RBX: 00007fe323425fa0 RCX: 00007fe32319f559 [ 626.494536][T10658] RDX: 0000200000001480 RSI: 0000000000008b04 RDI: 0000000000000007 [ 626.494550][T10658] RBP: 00007fe324071090 R08: 0000000000000000 R09: 0000000000000000 [ 626.494564][T10658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 626.494579][T10658] R13: 00007fe323426038 R14: 00007fe323425fa0 R15: 00007ffd5b6805e8 [ 626.494615][T10658] [ 626.766975][T10659] rxe_eth0 speed is unknown, defaulting to 1000 [ 626.884055][ T5780] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 627.034600][ T5780] usb 2-1: New USB device found: idVendor=0572, idProduct=cafe, bcdDevice=1.00 [ 627.035470][ T5780] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 627.035504][ T5780] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 627.035519][ T5780] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 627.035536][ T5780] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 627.035565][ T5780] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 627.043420][ T5780] cxacru 2-1:1.0: submit of read urb for cm 0x90 failed (-90) [ 627.043454][ T5780] cxacru 2-1:1.0: usbatm_usb_probe: invalid endpoint 02! [ 627.043643][ T5780] cxacru 2-1:1.0: probe with driver cxacru failed with error -22 [ 627.242017][ T1243] usb 2-1: USB disconnect, device number 85 [ 627.264388][ T5690] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 627.424893][ T5690] usb 9-1: Using ep0 maxpacket: 32 [ 627.425644][ T5690] usb 9-1: New USB device found: idVendor=1199, idProduct=6852, bcdDevice=6c.d5 [ 627.427403][ T5690] usb 9-1: config 0 has an invalid interface number: 153 but max is 0 [ 627.427430][ T5690] usb 9-1: config 0 has no interface number 0 [ 627.427461][ T5690] usb 9-1: config 0 interface 153 has no altsetting 0 [ 627.429718][ T5690] usb 9-1: New USB device strings: Mfr=208, Product=45, SerialNumber=3 [ 627.429744][ T5690] usb 9-1: Product: syz [ 627.429772][ T5690] usb 9-1: Manufacturer: syz [ 627.429784][ T5690] usb 9-1: SerialNumber: syz [ 627.431910][ T5690] usb 9-1: config 0 descriptor?? [ 627.581944][ T5780] usb 10-1: USB disconnect, device number 2 [ 627.902192][ T5690] hub 9-1:0.153: bad descriptor, ignoring hub [ 627.902222][ T5690] hub 9-1:0.153: probe with driver hub failed with error -5 [ 627.906885][ T5690] sierra 9-1:0.153: Sierra USB modem converter detected [ 627.980352][ T5690] usb 9-1: USB disconnect, device number 9 [ 628.000054][ T5690] sierra 9-1:0.153: device disconnected [ 628.028401][T10669] /dev/nullb0: Can't open blockdev [ 628.322810][T10676] FAULT_INJECTION: forcing a failure. [ 628.322810][T10676] name fail_futex, interval 1, probability 0, space 0, times 0 [ 628.322846][T10676] CPU: 1 UID: 0 PID: 10676 Comm: syz.7.1347 Tainted: G L syzkaller #0 PREEMPT(full) [ 628.322876][T10676] Tainted: [L]=SOFTLOCKUP [ 628.322884][T10676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 628.322898][T10676] Call Trace: [ 628.322907][T10676] [ 628.322917][T10676] dump_stack_lvl+0xe8/0x150 [ 628.322962][T10676] should_fail_ex+0x3eb/0x540 [ 628.322997][T10676] get_futex_key+0x1ab/0x1410 [ 628.323027][T10676] ? do_ipv6_setsockopt+0x1ebe/0x2960 [ 628.323054][T10676] ? do_ipv6_setsockopt+0x1ebe/0x2960 [ 628.323075][T10676] ? do_ipv6_setsockopt+0x36a/0x2960 [ 628.323096][T10676] ? __pfx_get_futex_key+0x10/0x10 [ 628.323132][T10676] futex_wake+0x119/0x5f0 [ 628.323158][T10676] ? __pfx_aa_inet_opt_perm+0x10/0x10 [ 628.323188][T10676] ? __pfx_futex_wake+0x10/0x10 [ 628.323252][T10676] do_futex+0x458/0x4e0 [ 628.323290][T10676] ? __pfx_do_futex+0x10/0x10 [ 628.323331][T10676] __se_sys_futex+0x3a8/0x450 [ 628.323370][T10676] ? __pfx___se_sys_futex+0x10/0x10 [ 628.323411][T10676] ? __x64_sys_futex+0x21/0xf0 [ 628.323446][T10676] do_syscall_64+0x166/0x520 [ 628.323475][T10676] ? trace_irq_disable+0x3b/0x140 [ 628.323501][T10676] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.323523][T10676] ? clear_bhb_loop+0x70/0xc0 [ 628.323550][T10676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.323572][T10676] RIP: 0033:0x7f548db9f559 [ 628.323592][T10676] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 628.323611][T10676] RSP: 002b:00007f548ea360e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 628.323634][T10676] RAX: ffffffffffffffda RBX: 00007f548de25fa8 RCX: 00007f548db9f559 [ 628.323650][T10676] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f548de25fac [ 628.323665][T10676] RBP: 00007f548de25fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 628.323680][T10676] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 628.323693][T10676] R13: 00007f548de26038 R14: 00007ffd313a63b0 R15: 00007ffd313a6498 [ 628.323727][T10676] [ 628.760141][T10674] fuse: Bad value for 'group_id' [ 628.760162][T10674] fuse: Bad value for 'group_id' [ 629.162015][T10689] netlink: 80 bytes leftover after parsing attributes in process `syz.9.1350'. [ 629.395275][ T5690] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 629.414943][ T5799] usb 10-1: new full-speed USB device number 3 using dummy_hcd [ 629.548371][ T5690] usb 2-1: New USB device found: idVendor=10c4, idProduct=ea90, bcdDevice=0.80 [ 629.550980][ T5690] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 629.551012][ T5690] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 629.551050][ T5690] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.563908][ T5690] usb 2-1: config 0 descriptor?? [ 629.602539][ T5799] usb 10-1: New USB device found: idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 629.627302][ T5799] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 629.627328][ T5799] usb 10-1: Product: syz [ 629.627344][ T5799] usb 10-1: Manufacturer: syz [ 629.627359][ T5799] usb 10-1: SerialNumber: syz [ 629.632301][ T5799] usb 10-1: config 0 descriptor?? [ 629.840754][ T5799] usb 10-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 629.977475][ T5690] cp2112 0003:10C4:EA90.0019: unknown main item tag 0x0 [ 629.977514][ T5690] cp2112 0003:10C4:EA90.0019: unknown main item tag 0x0 [ 629.977543][ T5690] cp2112 0003:10C4:EA90.0019: unknown main item tag 0x0 [ 629.981765][ T5690] cp2112 0003:10C4:EA90.0019: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 630.092678][ T5799] dvb_usb_rtl28xxu 10-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 630.110048][ T5799] usb 10-1: USB disconnect, device number 3 [ 630.175066][ T5690] cp2112 0003:10C4:EA90.0019: Part Number: 0x00 Device Version: 0x00 [ 630.377167][ T5690] cp2112 0003:10C4:EA90.0019: error requesting SMBus config [ 630.393050][ T5690] cp2112 0003:10C4:EA90.0019: probe with driver cp2112 failed with error -32 [ 631.045731][ T1226] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 631.196066][ T1226] usb 10-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 631.198331][ T1226] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 631.201852][ T1226] usb 10-1: config 0 descriptor?? [ 631.410193][ T1226] udl 10-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 631.632224][ T1226] [drm] Initialized udl 0.0.1 for 10-1:0.0 on minor 1 [ 631.632254][ T1226] [drm] Initialized udl on minor 1 [ 631.812888][T10745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 631.824579][T10745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 632.037785][T10745] FAULT_INJECTION: forcing a failure. [ 632.037785][T10745] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 632.037835][T10745] CPU: 0 UID: 0 PID: 10745 Comm: syz.9.1356 Tainted: G L syzkaller #0 PREEMPT(full) [ 632.037867][T10745] Tainted: [L]=SOFTLOCKUP [ 632.037903][T10745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 632.037918][T10745] Call Trace: [ 632.037927][T10745] [ 632.037937][T10745] dump_stack_lvl+0xe8/0x150 [ 632.037979][T10745] should_fail_ex+0x3eb/0x540 [ 632.038029][T10745] _copy_from_user+0x2d/0xb0 [ 632.038062][T10745] __ia32_sys_rt_sigreturn+0x27f/0x860 [ 632.038105][T10745] ? __pfx___ia32_sys_rt_sigreturn+0x10/0x10 [ 632.038134][T10745] ? fpu__clear_user_states+0x7e/0x400 [ 632.038187][T10745] ? rcu_is_watching+0x16/0xb0 [ 632.038218][T10745] do_syscall_64+0x166/0x520 [ 632.038267][T10745] ? trace_irq_disable+0x3b/0x140 [ 632.038293][T10745] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.038314][T10745] ? clear_bhb_loop+0x70/0xc0 [ 632.038342][T10745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.038357][T10745] RIP: 0033:0x7fdce91408d9 [ 632.038372][T10745] Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25 [ 632.038402][T10745] RSP: 002b:00007fdce9f9ca80 EFLAGS: 00000246 ORIG_RAX: 000000000000000f [ 632.038426][T10745] RAX: ffffffffffffffda RBX: 00007fdce9425fa0 RCX: 00007fdce91408d9 [ 632.038441][T10745] RDX: 00007fdce9f9ca80 RSI: 00007fdce9f9cbb0 RDI: 0000000000000011 [ 632.038455][T10745] RBP: 00007fdce9236b20 R08: 9999999999999999 R09: 0000000000000000 [ 632.038469][T10745] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 632.038486][T10745] R13: 00007fdce9426038 R14: 00007fdce9425fa0 R15: 00007ffd267cf908 [ 632.038509][T10745] [ 632.281806][ T5780] usb 2-1: USB disconnect, device number 86 [ 632.672337][T10793] FAULT_INJECTION: forcing a failure. [ 632.672337][T10793] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 632.672375][T10793] CPU: 0 UID: 0 PID: 10793 Comm: syz.8.1366 Tainted: G L syzkaller #0 PREEMPT(full) [ 632.672406][T10793] Tainted: [L]=SOFTLOCKUP [ 632.672415][T10793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 632.672429][T10793] Call Trace: [ 632.672438][T10793] [ 632.672448][T10793] dump_stack_lvl+0xe8/0x150 [ 632.672488][T10793] should_fail_ex+0x3eb/0x540 [ 632.672526][T10793] _copy_from_user+0x2d/0xb0 [ 632.672562][T10793] video_usercopy+0x359/0x1430 [ 632.672599][T10793] ? __pfx___video_do_ioctl+0x10/0x10 [ 632.672630][T10793] ? __pfx_video_usercopy+0x10/0x10 [ 632.672675][T10793] ? __fget_files+0x2a/0x420 [ 632.672702][T10793] ? __fget_files+0x2a/0x420 [ 632.672731][T10793] v4l2_ioctl+0x18d/0x1e0 [ 632.672758][T10793] ? __pfx_v4l2_ioctl+0x10/0x10 [ 632.672785][T10793] __se_sys_ioctl+0xfc/0x170 [ 632.672819][T10793] do_syscall_64+0x166/0x520 [ 632.672850][T10793] ? trace_irq_disable+0x3b/0x140 [ 632.672878][T10793] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.672901][T10793] ? clear_bhb_loop+0x70/0xc0 [ 632.672932][T10793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.672955][T10793] RIP: 0033:0x7fd095d9f559 [ 632.672976][T10793] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 632.672996][T10793] RSP: 002b:00007fd096c17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 632.673021][T10793] RAX: ffffffffffffffda RBX: 00007fd096025fa0 RCX: 00007fd095d9f559 [ 632.673038][T10793] RDX: 0000200000000100 RSI: 00000000c0d05604 RDI: 0000000000000003 [ 632.673054][T10793] RBP: 00007fd096c17090 R08: 0000000000000000 R09: 0000000000000000 [ 632.673069][T10793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 632.673083][T10793] R13: 00007fd096026038 R14: 00007fd096025fa0 R15: 00007ffc1a50d0d8 [ 632.673120][T10793] [ 633.236467][ T5690] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 633.396454][ T5690] usb 9-1: Using ep0 maxpacket: 32 [ 633.397282][ T5690] usb 9-1: New USB device found: idVendor=0403, idProduct=6030, bcdDevice=0.00 [ 633.398742][ T5690] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 633.398775][ T5690] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 633.399091][ T5690] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.403270][ T5690] usb 9-1: config 0 descriptor?? [ 633.564095][ T5772] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 633.742846][ T5772] usb 2-1: New USB device found: idVendor=10c4, idProduct=ea90, bcdDevice=0.80 [ 633.748901][ T5772] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 633.749174][ T5772] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 633.749351][ T5772] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.788521][ T5772] usb 2-1: config 0 descriptor?? [ 634.156654][ T5690] usbhid 9-1:0.0: can't add hid device: -71 [ 634.156802][ T5690] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 634.179932][ T5690] usb 9-1: USB disconnect, device number 10 [ 634.243541][ T5772] cp2112 0003:10C4:EA90.001A: global environment stack underflow [ 634.243563][ T5772] cp2112 0003:10C4:EA90.001A: item 0 1 1 11 parsing failed [ 634.257493][ T5772] cp2112 0003:10C4:EA90.001A: parse failed [ 634.258132][ T5772] cp2112 0003:10C4:EA90.001A: probe with driver cp2112 failed with error -22 [ 634.428856][T10811] Sensor B: ================= START STATUS ================= [ 634.428900][T10811] Sensor B: Test Pattern: 75% Colorbar [ 634.429038][T10811] Sensor B: Show Information: All [ 634.429060][T10811] Sensor B: Vertical Flip: false [ 634.429107][T10811] Sensor B: Horizontal Flip: false [ 634.429128][T10811] Sensor B: Brightness: 128 [ 634.429150][T10811] Sensor B: Contrast: 128 [ 634.429179][T10811] Sensor B: Hue: 0 [ 634.429199][T10811] Sensor B: Saturation: 128 [ 634.429219][T10811] Sensor B: Pixel Rate: 160000000 [ 634.429862][T10811] Sensor B: Horizontal Blanking: 800 [ 634.429922][T10811] Sensor B: Vertical Blanking: 3223 [ 634.429942][T10811] Sensor B: ================== END STATUS ================== [ 634.433790][ T5690] usb 2-1: USB disconnect, device number 87 [ 634.733725][T10813] EXT4-fs warning (device sda1): ext4_resize_fs:2021: can't read last block, resize aborted [ 635.224979][ T5690] usb 9-1: new full-speed USB device number 11 using dummy_hcd [ 635.265737][ T2098] block nbd5: Possible stuck request ffff88802879e000: control (read@0,4096B). Runtime 150 seconds [ 635.374194][ T5690] usb 9-1: device descriptor read/64, error -71 [ 635.585709][T10824] FAULT_INJECTION: forcing a failure. [ 635.585709][T10824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 635.585747][T10824] CPU: 0 UID: 0 PID: 10824 Comm: syz.1.1377 Tainted: G L syzkaller #0 PREEMPT(full) [ 635.585779][T10824] Tainted: [L]=SOFTLOCKUP [ 635.585788][T10824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 635.585804][T10824] Call Trace: [ 635.585813][T10824] [ 635.585824][T10824] dump_stack_lvl+0xe8/0x150 [ 635.585864][T10824] should_fail_ex+0x3eb/0x540 [ 635.585905][T10824] _copy_from_user+0x2d/0xb0 [ 635.585942][T10824] lo_ioctl+0x6ff/0x1730 [ 635.585970][T10824] ? __pfx_clockevents_program_event+0x10/0x10 [ 635.586009][T10824] ? __pfx_lo_ioctl+0x10/0x10 [ 635.586044][T10824] ? finish_task_switch+0x40e/0xc60 [ 635.586100][T10824] ? lockdep_hardirqs_on+0x7b/0x110 [ 635.586140][T10824] ? rcu_is_watching+0x16/0xb0 [ 635.586172][T10824] ? trace_sched_exit_tp+0x3a/0x130 [ 635.586219][T10824] ? __schedule+0x17f3/0x5830 [ 635.586254][T10824] ? __lock_acquire+0x747/0x2de0 [ 635.586305][T10824] ? __lock_acquire+0x747/0x2de0 [ 635.586330][T10824] ? __lock_acquire+0x747/0x2de0 [ 635.586368][T10824] ? __lock_acquire+0x747/0x2de0 [ 635.586410][T10824] ? lock_acquire+0x115/0x350 [ 635.586442][T10824] ? lock_acquire+0x115/0x350 [ 635.586477][T10824] ? is_bpf_text_address+0x26/0x2b0 [ 635.586506][T10824] ? is_bpf_text_address+0x292/0x2b0 [ 635.586553][T10824] ? is_bpf_text_address+0x26/0x2b0 [ 635.586589][T10824] ? kernel_text_address+0xa5/0xe0 [ 635.586621][T10824] ? __kernel_text_address+0xd/0x30 [ 635.586640][T10824] ? unwind_get_return_address+0x4d/0x90 [ 635.586661][T10824] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 635.586699][T10824] ? arch_stack_walk+0xfb/0x150 [ 635.586739][T10824] ? stack_trace_save+0xa9/0x100 [ 635.586763][T10824] ? __pfx_stack_trace_save+0x10/0x10 [ 635.586789][T10824] ? kasan_save_track+0x4f/0x80 [ 635.586813][T10824] ? stack_depot_save_flags+0x33/0x810 [ 635.586858][T10824] ? __lock_acquire+0x747/0x2de0 [ 635.586887][T10824] ? kasan_save_track+0x4f/0x80 [ 635.586911][T10824] ? kasan_save_track+0x3e/0x80 [ 635.586944][T10824] ? kasan_save_free_info+0x40/0x50 [ 635.586959][T10824] ? __kasan_slab_free+0x5c/0x80 [ 635.586979][T10824] ? kfree+0x1c5/0x650 [ 635.587011][T10824] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 635.587038][T10824] ? security_file_ioctl+0xc3/0x2a0 [ 635.587061][T10824] ? __se_sys_ioctl+0x47/0x170 [ 635.587103][T10824] ? do_syscall_64+0x166/0x520 [ 635.587125][T10824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.587163][T10824] ? __asan_memset+0x22/0x50 [ 635.587189][T10824] ? blk_get_meta_cap+0x19d/0x780 [ 635.587323][T10824] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 635.587369][T10824] ? blkdev_common_ioctl+0x14d4/0x3260 [ 635.587433][T10824] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 635.587476][T10824] ? kasan_quarantine_put+0xbb/0x1f0 [ 635.587514][T10824] ? tomoyo_path_number_perm+0x219/0x5f0 [ 635.587543][T10824] ? tomoyo_path_number_perm+0x219/0x5f0 [ 635.587578][T10824] ? do_vfs_ioctl+0x116f/0x1530 [ 635.587822][T10824] ? __pfx_lo_ioctl+0x10/0x10 [ 635.587875][T10824] blkdev_ioctl+0x5e3/0x740 [ 635.587916][T10824] ? __pfx_blkdev_ioctl+0x10/0x10 [ 635.587958][T10824] ? bpf_lsm_file_ioctl+0x9/0x20 [ 635.587981][T10824] ? __pfx_blkdev_ioctl+0x10/0x10 [ 635.588024][T10824] __se_sys_ioctl+0xfc/0x170 [ 635.588071][T10824] do_syscall_64+0x166/0x520 [ 635.588107][T10824] ? trace_irq_disable+0x3b/0x140 [ 635.588129][T10824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.588146][T10824] ? clear_bhb_loop+0x70/0xc0 [ 635.588184][T10824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.588210][T10824] RIP: 0033:0x7fe32319f559 [ 635.588231][T10824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 635.588251][T10824] RSP: 002b:00007fe324071028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 635.588279][T10824] RAX: ffffffffffffffda RBX: 00007fe323425fa0 RCX: 00007fe32319f559 [ 635.588292][T10824] RDX: 0000200000000180 RSI: 0000000000004c0a RDI: 0000000000000004 [ 635.588309][T10824] RBP: 00007fe323236b20 R08: 0000000000000000 R09: 0000000000000000 [ 635.588335][T10824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 635.588350][T10824] R13: 00007fe323426038 R14: 00007fe323425fa0 R15: 00007ffd5b6805e8 [ 635.588387][T10824] [ 635.591277][T10824] FAULT_INJECTION: forcing a failure. [ 635.591277][T10824] name failslab, interval 1, probability 0, space 0, times 0 [ 635.591310][T10824] CPU: 0 UID: 0 PID: 10824 Comm: syz.1.1377 Tainted: G L syzkaller #0 PREEMPT(full) [ 635.591333][T10824] Tainted: [L]=SOFTLOCKUP [ 635.591340][T10824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 635.591368][T10824] Call Trace: [ 635.591377][T10824] [ 635.591388][T10824] dump_stack_lvl+0xe8/0x150 [ 635.591424][T10824] should_fail_ex+0x3eb/0x540 [ 635.591464][T10824] should_failslab+0xa8/0x100 [ 635.591488][T10824] __kmalloc_noprof+0xf9/0x710 [ 635.591523][T10824] ? tomoyo_encode+0x2ad/0x570 [ 635.591557][T10824] ? tomoyo_encode+0x2ad/0x570 [ 635.591597][T10824] tomoyo_encode+0x2ad/0x570 [ 635.591634][T10824] tomoyo_realpath_from_path+0x5fa/0x640 [ 635.591683][T10824] ? tomoyo_path_number_perm+0x219/0x5f0 [ 635.591714][T10824] tomoyo_path_number_perm+0x246/0x5f0 [ 635.591745][T10824] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 635.591775][T10824] ? __lock_acquire+0x747/0x2de0 [ 635.591855][T10824] ? __fget_files+0x2a/0x420 [ 635.591884][T10824] ? __fget_files+0x2a/0x420 [ 635.591908][T10824] ? __fget_files+0x2a/0x420 [ 635.591939][T10824] security_file_ioctl+0xc3/0x2a0 [ 635.591958][T10824] __se_sys_ioctl+0x47/0x170 [ 635.591999][T10824] do_syscall_64+0x166/0x520 [ 635.592029][T10824] ? trace_irq_disable+0x3b/0x140 [ 635.592062][T10824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.592088][T10824] ? clear_bhb_loop+0x70/0xc0 [ 635.592107][T10824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.592123][T10824] RIP: 0033:0x7fe32319f1eb [ 635.592153][T10824] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 635.592174][T10824] RSP: 002b:00007fe32406ef00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 635.592196][T10824] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007fe32319f1eb [ 635.592212][T10824] RDX: 00007fe32406ffd0 RSI: 0000000041015500 RDI: 0000000000000009 [ 635.592228][T10824] RBP: 00007fe32406ffd0 R08: 0000000000000001 R09: 00000000ffffffff [ 635.592244][T10824] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe32406efa0 [ 635.592254][T10824] R13: 00002000000002c0 R14: 0000000000000005 R15: 0000000000000000 [ 635.592278][T10824] [ 635.592309][T10824] ERROR: Out of memory at tomoyo_realpath_from_path. [ 635.635385][ T5690] usb 9-1: new full-speed USB device number 12 using dummy_hcd [ 635.778521][ T5690] usb 9-1: device descriptor read/64, error -71 [ 635.887393][ T5690] usb usb9-port1: attempt power cycle [ 635.914017][ T5833] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 636.218421][ T5833] usb 2-1: Using ep0 maxpacket: 32 [ 636.254411][ T5690] usb 9-1: new full-speed USB device number 13 using dummy_hcd [ 636.259262][ T5833] usb 2-1: unable to get BOS descriptor or descriptor too short [ 636.259381][ T5833] usb 2-1: New USB device found: idVendor=413c, idProduct=81c2, bcdDevice=c9.4b [ 636.262886][ T5833] usb 2-1: config 14 has an invalid interface number: 8 but max is 1 [ 636.262951][ T5833] usb 2-1: config 14 has no interface number 1 [ 636.263038][ T5833] usb 2-1: config 14 interface 8 has no altsetting 0 [ 636.263084][ T5833] usb 2-1: config 14 interface 0 has no altsetting 0 [ 636.268543][ T5833] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.268612][ T5833] usb 2-1: Product: syz [ 636.268652][ T5833] usb 2-1: Manufacturer: syz [ 636.268704][ T5833] usb 2-1: SerialNumber: syz [ 636.330456][ T5690] usb 9-1: device descriptor read/8, error -71 [ 636.482370][T10824] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1377'. [ 636.523857][ T5833] usb 2-1: selecting invalid altsetting 0 [ 636.523879][ T5833] usb 2-1: Could not set interface, error -22 [ 636.542652][ T5833] usb 2-1: USB disconnect, device number 88 [ 636.544410][ T35] INFO: task syz.5.668:8183 blocked for more than 143 seconds. [ 636.544477][ T35] Tainted: G L syzkaller #0 [ 636.544507][ T35] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 636.544523][ T35] task:syz.5.668 state:D stack:25368 pid:8183 tgid:8182 ppid:7469 task_flags:0x400140 flags:0x00080002 [ 636.544673][ T35] Call Trace: [ 636.544699][ T35] [ 636.544736][ T35] __schedule+0x17dd/0x5830 [ 636.544932][ T35] ? __pfx___schedule+0x10/0x10 [ 636.545034][ T35] ? schedule+0x90/0x2b0 [ 636.545115][ T35] schedule+0x164/0x2b0 [ 636.545197][ T35] schedule_preempt_disabled+0x13/0x30 [ 636.545270][ T35] __mutex_lock+0x7c4/0x15a0 [ 636.545368][ T35] ? __mutex_lock+0x5cd/0x15a0 [ 636.545452][ T35] ? bdev_release+0x1b8/0x690 [ 636.545691][ T35] ? __pfx___mutex_lock+0x10/0x10 [ 636.545765][ T35] ? __asan_memset+0x22/0x50 [ 636.546150][ T35] ? __fsnotify_parent+0x267/0x620 [ 636.546315][ T35] ? __pfx___fsnotify_parent+0x10/0x10 [ 636.546461][ T35] bdev_release+0x1b8/0x690 [ 636.546613][ T35] ? __pfx_blkdev_release+0x10/0x10 [ 636.546700][ T35] blkdev_release+0x15/0x20 [ 636.546828][ T35] __fput+0x408/0xa40 [ 636.546908][ T35] task_work_run+0x1d9/0x260 [ 636.547033][ T35] ? __pfx_task_work_run+0x10/0x10 [ 636.547082][ T35] ? __fput_deferred+0x222/0x390 [ 636.547202][ T35] exit_to_user_mode_loop+0x204/0x770 [ 636.547267][ T35] ? rcu_is_watching+0x16/0xb0 [ 636.547395][ T35] do_syscall_64+0x328/0x520 [ 636.547463][ ** replaying previous printk message ** [ 636.547463][ T35] ? trace_irq_disable+0x3b/0x140 [ 636.547585][ T35] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.547647][ T35] ? clear_bhb_loop+0x70/0xc0 [ 636.588299][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.588429][ T35] RIP: 0033:0x7f392739f559 [ 636.588487][ T35] RSP: 002b:00007f3928286028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 636.588607][ T35] RAX: 0000000000000000 RBX: 00007f3927625fa0 RCX: 00007f392739f559 [ 636.588655][ T35] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003 [ 636.588681][ T35] RBP: 00007f3927436b20 R08: 0000000000000000 R09: 0000000000000000 [ 636.588769][ T35] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 636.588807][ T35] R13: 00007f3927626038 R14: 00007f3927625fa0 R15: 00007ffe0534f368 [ 636.588944][ T35] [ 636.591362][ T35] [ 636.591362][ T35] Showing all locks held in the system: [ 636.591458][ T35] locks held by pr/ttyS0/34: 2, last CPU#0: [ 636.591692][ T35] #0: ffffffff90033f58 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 636.591943][ T35] #1: ffff8880b8226498 (&base->lock){-.-.}-{2:2}, at: rcu_core+0x8b0/0x1230 [ 636.592032][ T35] locks held by khungtaskd/35: 1, last CPU#1: [ 636.592049][ T35] #0: ffffffff9015a460 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 636.607165][ T35] locks held by kworker/1:2/1226: 12, on CPU#1: [ 636.607215][ T35] #0: ffff8880206a9948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 636.607489][ T35] #1: ffffc9000572fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 636.607725][ T35] #2: ffff88802b81b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 636.607975][ T35] #3: ffff888054b341d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 [ 636.608176][ T35] #4: ffff8880276631a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 [ 636.608382][ T35] #5: ffff888036d04260 (&dev->clientlist_mutex){+.+.}-{4:4}, at: drm_client_register+0x4b/0x200 [ 636.608651][ T35] #6: ffff888035fa8270 [ 636.609180][ T5690] usb 9-1: new full-speed USB device number 14 using dummy_hcd [ 636.611751][ T35] (&helper->lock){+.+.}-{4:4}, at: drm_fb_helper_initial_config+0x46/0x80 [ 636.612045][ T35] #7: ffff888035fa8090 (&client->modeset_mutex){+.+.}-{4:4}, at: drm_client_modeset_probe+0x42f/0x60c0 [ 636.612251][ T35] #8: ffff888036d043f8 (&dev->mode_config.mutex){+.+.}-{4:4}, at: drm_client_modeset_probe+0x44a/0x60c0 [ 636.619623][ T35] #9: ffffc9000572e6f0 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_helper_probe_single_connector_modes+0x17c/0x1a60 [ 636.619909][ T35] #10: ffffc9000572e718 (crtc_ww_class_mutex){+.+.}-{4:4}, at: drm_helper_probe_single_connector_modes+0x17c/0x1a60 [ 636.620149][ T35] #11: ffffffff90b169f8 (drm_unplug_srcu){.+.+}-{0:0}, at: drm_dev_enter+0x49/0x150 [ 636.622508][ T35] locks held by udevd/5008: 1, on CPU#1: [ 636.622550][ T35] #0: ffff88801d69c180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_iop_get_link+0xca/0x730 [ 636.622810][ T35] locks held by kworker/1:0/5690: 5, on CPU#1: [ 636.622849][ T35] #0: ffff8880206a9948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 636.647539][ T35] #1: ffffc90003d57c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 636.647790][ T35] #2: ffff88802b3161d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 636.647992][ T35] #3: ffff88802b392568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x20a1/0x4d30 [ 636.648100][ T35] #4: ffff88802b25bd60 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x20c9/0x4d30 [ 636.648184][ T35] locks held by kworker/u8:5/5700: 3, last CPU#1: [ 636.648199][ T35] #0: ffff88813fe64148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 636.648278][ T35] #1: ffffc90003d37c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 636.648333][ T35] #2: ffff88807f08c258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 [ 636.648461][ T35] locks held by kworker/0:7/5833: 7, on CPU#0: [ 636.648476][ T35] #0: ffff8880206a9948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 636.648532][ T35] #1: ffffc90004bb7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 636.648650][ T35] #2: ffff88802b0b61d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 636.648703][ T35] #3: ffff88807f38b1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 [ 636.648752][ T35] #4: ffff88801d69c2a0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3f/0x140 [ 636.648841][ T35] #5: ffff88801d69c180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x4e/0x140 [ 636.648922][ T35] #6: ffffffff9000ec20 (sched_map-wait-type-override){+.+.}-{3:3}, at: schedule+0x90/0x2b0 [ 636.649199][ T35] locks held by udevd/5935: 3, last CPU#1: [ 636.649237][ T35] #0: ffff888058663580 (&type->i_mutex_dir_key#4){++++}-{4:4}, at: lookup_slow+0x46/0x80 [ 636.652180][ T5690] usb 9-1: device descriptor read/8, error -71 [ 636.673532][ T35] #1: ffff8880b833c5e0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 636.673739][ T35] #2: ffff8880b8324708 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x57/0x7d0 [ 636.674129][ T35] locks held by udevd/6013: 4, on CPU#0: [ 636.674177][ T35] #0: ffff888066a6dab8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 [ 636.674384][ T35] #1: ffff88803348fc80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 [ 636.674653][ T35] #2: ffff8880758c4008 (kn->active#33){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 636.674880][ T35] #3: ffff88807f38b1d8 (&dev->mutex){....}-{4:4}, at: serial_show+0x26/0xa0 [ 636.675198][ T35] locks held by kworker/u8:24/6082: 3, last CPU#1: [ 636.675245][ T35] #0: ffff88813fe64148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 636.688212][ T35] #1: ffff8880b8324708 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x57/0x7d0 [ 636.688486][ T35] #2: ffff8880786d0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 636.688700][ T35] locks held by kworker/u8:39/6186: 3, last CPU#1: [ 636.688738][ T35] #0: ffff88813fe64148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 636.688958][ T35] #1: ffffc9000649fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 636.689205][ T35] #2: ffff88807fd09258 (&devlink->lock_key#9){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 [ 636.689429][ T35] locks held by udevd/8071: 1, on CPU#1: [ 636.689450][ T35] #0: ffff8880275b8350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd70 [ 636.689503][ T35] locks held by syz.5.668/8183: 1, on CPU#1: [ 636.689578][ T35] #0: ffff8880275b8350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1b8/0x690 [ 636.689803][ T35] locks held by syz.3.1170/9971: 1, on CPU#1: [ 636.689855][ T35] #0: ffff8880275b8350 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x276/0x470 [ 636.700878][ T35] locks held by getty/10218: 2, on CPU#1: [ 636.700973][ T35] #0: ffff888033c4e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 636.701170][ T35] #1: ffffc9000357b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 636.701357][ T35] locks held by syz.9.1356/10744: 1, on CPU#1: [ 636.701394][ T35] #0: ffff888036d04260 (&dev->clientlist_mutex){+.+.}-{4:4}, at: drm_client_dev_restore+0xb1/0x290 [ 636.705292][ T35] [ 636.705314][ T35] ============================================= [ 636.705314][ T35] [ 636.705401][ T35] NMI backtrace for cpu 1 [ 636.705458][ T35] CPU: 1 UID: 0 PID: 35 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 636.705536][ T35] Tainted: [L]=SOFTLOCKUP [ 636.705557][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 636.705594][ T35] Call Trace: [ 636.705615][ T35] [ 636.705636][ T35] dump_stack_lvl+0xe8/0x150 [ 636.705724][ T35] nmi_cpu_backtrace+0x274/0x2d0 [ 636.705785][ T35] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 636.705876][ T35] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 636.705958][ T35] sys_info+0x135/0x170 [ 636.706015][ T35] watchdog+0x1073/0x10f0 [ 636.706103][ T35] ? watchdog+0x209/0x10f0 [ 636.706196][ T35] kthread+0x38b/0x480 [ 636.706257][ T35] ? __pfx_watchdog+0x10/0x10 [ 636.706324][ T35] ? __pfx_kthread+0x10/0x10 [ 636.706385][ T35] ret_from_fork+0x514/0xb70 [ 636.706442][ T35] ? __pfx_ret_from_fork+0x10/0x10 [ 636.706492][ T35] ? __switch_to+0xc78/0x1410 [ 636.706574][ T35] ? __pfx_kthread+0x10/0x10 [ 636.706630][ T35] ret_from_fork_asm+0x1a/0x30 [ 636.706747][ T35] [ 636.706824][ T35] Sending NMI from CPU 1 to CPUs 0: [ 636.706892][ C0] NMI backtrace for cpu 0 [ 636.706907][ C0] CPU: 0 UID: 0 PID: 34 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 636.706931][ C0] Tainted: [L]=SOFTLOCKUP [ 636.706938][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 636.706958][ C0] RIP: 0010:io_serial_in+0x77/0xc0 [ 636.707028][ C0] Code: e8 5e d8 39 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 7f eb b0 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f c3 cc cc cc cc cc 44 89 f9 80 e1 07 [ 636.707043][ C0] RSP: 0018:ffffc90000aa78b8 EFLAGS: 00000002 [ 636.707058][ C0] RAX: 1ffffffff3853100 RBX: 00000000000003fd RCX: 0000000000000000 [ 636.707071][ C0] RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 [ 636.707082][ C0] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 636.707094][ C0] R10: dffffc0000000000 R11: ffffffff858f70a0 R12: dffffc0000000000 [ 636.707111][ C0] R13: 0000000000000000 R14: ffffffff9c298940 R15: 0000000000000000 [ 636.707124][ C0] FS: 0000000000000000(0000) GS:ffff888123376000(0000) knlGS:0000000000000000 [ 636.707138][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 636.707151][ C0] CR2: 0000557cbddbc450 CR3: 000000005e7e2000 CR4: 00000000003526f0 [ 636.707168][ C0] Call Trace: [ 636.707175][ C0] [ 636.707183][ C0] wait_for_lsr+0x184/0x2f0 [ 636.707204][ C0] __serial8250_console_fifo_write+0xcd/0x3e0 [ 636.707260][ C0] serial8250_console_write+0xa7e/0x1200 [ 636.707285][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 636.707303][ C0] ? __schedule+0x17f3/0x5830 [ 636.707332][ C0] nbcon_emit_next_record+0xef5/0x1a90 [ 636.707361][ C0] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 636.707388][ C0] ? nbcon_context_try_acquire+0x819/0xbd0 [ 636.707418][ C0] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 636.707441][ C0] nbcon_kthread_func+0x6d9/0x8d0 [ 636.707464][ C0] ? nbcon_kthread_func+0x163/0x8d0 [ 636.707484][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 636.707507][ C0] ? __kthread_parkme+0x71/0x1f0 [ 636.707537][ C0] ? __kthread_parkme+0x199/0x1f0 [ 636.707565][ C0] kthread+0x38b/0x480 [ 636.707582][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 636.707601][ C0] ? __pfx_kthread+0x10/0x10 [ 636.707618][ C0] ret_from_fork+0x514/0xb70 [ 636.707636][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 636.707652][ C0] ? __switch_to+0xc78/0x1410 [ 636.707681][ C0] ? __pfx_kthread+0x10/0x10 [ 636.707698][ C0] ret_from_fork_asm+0x1a/0x30 [ 636.707733][ C0] [ 636.710379][ T1226] udl 10-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffff92 [ 636.711480][ T1226] udl 10-1:0.0: [drm] Cannot find any crtc or sizes [ 636.722649][ T35] Kernel panic - not syncing: hung_task: blocked tasks [ 637.944978][ T35] CPU: 1 UID: 0 PID: 35 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 637.956823][ T35] Tainted: [L]=SOFTLOCKUP [ 637.961586][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 637.972658][ T35] Call Trace: [ 637.976257][ T35] [ 637.979481][ T35] vpanic+0x26f/0x710 [ 637.983894][ T35] panic+0xc5/0xd0 [ 637.987992][ T35] ? __pfx_panic+0x10/0x10 [ 637.992858][ T35] watchdog+0x10e7/0x10f0 [ 637.997637][ T35] ? watchdog+0x209/0x10f0 [ 638.002522][ T35] kthread+0x38b/0x480 [ 638.006990][ T35] ? __pfx_watchdog+0x10/0x10 [ 638.012149][ T35] ? __pfx_kthread+0x10/0x10 [ 638.017199][ T35] ret_from_fork+0x514/0xb70 [ 638.022264][ T35] ? __pfx_ret_from_fork+0x10/0x10 [ 638.027875][ T35] ? __switch_to+0xc78/0x1410 [ 638.033049][ T35] ? __pfx_kthread+0x10/0x10 [ 638.038112][ T35] ret_from_fork_asm+0x1a/0x30 [ 638.043395][ T35] [ 638.047406][ T35] Kernel Offset: disabled [ 638.052158][ T35] Rebooting in 86400 seconds..