last executing test programs: 8.954685592s ago: executing program 3 (id=458): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40841, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x64, 0x2c, 0x601, 0x0, 0x200, {0x0, 0x0, 0x0, 0x0, {0xfff3}, {0xc, 0xffff}, {0x300, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0x38, 0x2, [@TCA_U32_SEL={0x34, 0x5, {0x0, 0xf, 0x2, 0x1, 0x200, 0x400, 0x1, 0x8, [{0x8, 0x8, 0x9108, 0xf}, {0x6, 0x2, 0x8, 0xfff}]}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4001}, 0x0) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000003c0)=ANY=[], 0x82) 8.05719274s ago: executing program 1 (id=461): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000240)="cd742d85ea", 0x0}, 0x50) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000013c0)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_NAME={0xe, 0x1, 'connlimit\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}}, 0x4048010) sendmsg$NL80211_CMD_REGISTER_FRAME(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x4c, r6, 0x20, 0x1, 0x0, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x7, 0x42}}}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_MATCH={0x1d, 0x5b, "9212aafc2be381c21b1bcc9c0f5b6496d9f07159ddf948b924"}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0xd0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r13, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x48000) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r4, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 8.04452114s ago: executing program 3 (id=462): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) syz_io_uring_setup(0x34b9, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0xf00, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) 7.727756225s ago: executing program 3 (id=466): mkdir(&(0x7f0000000040)='./my_configfs/target/core/rd_mcp_0\x00', 0x140) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$tipc(0x1e, 0x2, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x2a, 0xfffffffffffffff9) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x40, 0x2, 0x2, 0x3}, 0x10) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000001c0)="39000000140081ae0000dc676f97daf01e2357f9ffffffffffffff0521018701546fabca1b4e8a06a6580e88370200c54c1960b89c40ebb373", 0x39}], 0x1}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bind$bt_hci(r0, &(0x7f0000000240)={0x1f, 0xffff, 0x3}, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs\x00', 0x117) mount(0x0, &(0x7f0000000080)='./my_configfs\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) symlinkat(&(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/obex.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/configs/c.1/obex.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./mnt/usb_gadget/g1/functions/geth.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./mnt/usb_gadget/g1/functions/geth.usb0\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./mnt/usb_gadget/g1/configs/c.1/geth.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='dummy_udc.0', 0xb) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1000}) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c69637930000800020000000002080003000000001e", 0x68}], 0x1}, 0x0) 6.900603063s ago: executing program 1 (id=469): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x22, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x89, 0x0, @empty, @broadcast}}}}}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7, 0x0, 0xffffffffffffffff, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x4, 0xc, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0xffffffff}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x1e}}]}, &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f0000000600)={'c6xdigio\x00', [0x7c, 0x1f, 0x0, 0xc, 0x10, 0x4, 0x100002, 0x7, 0x5, 0x100, 0x4, 0x1, 0x1, 0x20003, 0x7ff, 0x8, 0x83, 0x8, 0x1010003, 0x0, 0x18, 0x0, 0x3, 0xffffffff, 0xb, 0xfffffff9, 0x38, 0xc, 0x10000006, 0x664, 0xfffffff8]}) symlinkat(&(0x7f0000001040)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') 6.516096416s ago: executing program 3 (id=473): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000a20000/0x2000)=nil) socket$inet6(0xa, 0x800, 0xfffffffe) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x1000)=nil) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) open(&(0x7f0000000000)='./file1\x00', 0x143142, 0x80) 5.86498301s ago: executing program 2 (id=474): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40841, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x64, 0x2c, 0x601, 0x0, 0x200, {0x0, 0x0, 0x0, 0x0, {0xfff3}, {0xc, 0xffff}, {0x300, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0x38, 0x2, [@TCA_U32_SEL={0x34, 0x5, {0x0, 0xf, 0x2, 0x1, 0x200, 0x400, 0x1, 0x8, [{0x8, 0x8, 0x9108, 0xf}, {0x6, 0x2, 0x8, 0xfff}]}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4001}, 0x0) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000003c0)=ANY=[], 0x82) 5.718455248s ago: executing program 1 (id=475): sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008040}, 0x40048110) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x60042, 0x0) syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="7f454c460e02fab7ff7f00000000000002000300fffeffffdf020000000000004000000000000000030300ef0000000000000000080038000100040004000d000300000000800000000000000000000007000000000000000800000000004000050000000000000002"], 0x78) ioctl$SNDCTL_SEQ_SYNC(r0, 0x5101) 5.646229894s ago: executing program 4 (id=476): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x18, 0x1e, 0x221, 0x70bd2d, 0x0, {0x7}, [@nested={0x4, 0x144}]}, 0x18}}, 0x4000080) 5.587061659s ago: executing program 0 (id=477): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, 0x0, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, 0x0, 0x10040881) mkdirat(0xffffffffffffff9c, 0x0, 0x67) mount(0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, 0x0}) mount$9p_rdma(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340), 0x10400, &(0x7f00000003c0)=ANY=[@ANYRESHEX=r1]) socket$nl_generic(0x10, 0x3, 0x10) futimesat(0xffffffffffffffff, 0x0, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) 5.507381632s ago: executing program 4 (id=479): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fedbdf252c000000180001801400020064756d"], 0x2c}, 0x1, 0x0, 0x0, 0x20048881}, 0x2000c800) 5.375108401s ago: executing program 4 (id=480): ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f00000000c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4008814) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000640)={{0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x16, 0x8}, 0x6, 0x40, 0x9, 0xfffffffffffffffb, 0x0, 0x0, 0xd382}) connect$unix(0xffffffffffffffff, 0x0, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) getsockopt$llc_int(r4, 0x10c, 0x4, &(0x7f0000000000), &(0x7f00000002c0)=0x4) 4.206679173s ago: executing program 0 (id=481): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000015}, 0xc844) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$nci(0xffffff9c, 0x0, 0x2, 0x0) write$nci(r1, &(0x7f00000005c0)=ANY=[], 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) shmget$private(0x0, 0x1000, 0x1000, &(0x7f0000fff000/0x1000)=nil) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 4.168567982s ago: executing program 3 (id=482): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x401, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x7c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4c, 0x2, [@TCA_BASIC_ACT={0x48, 0x3, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x20000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x7c}}, 0x0) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="03030800030016000c00452400300068000007019078640101"], 0x3a) 3.775700406s ago: executing program 1 (id=483): syz_emit_ethernet(0xa2, &(0x7f0000000680)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd603000bb006c2b00fc020000000000000000000000000000fe8000000000000000000000000000aa0000030000000000000000000064907802000000000000020000000082f63de64f6ce2ee11028289aefdb3449391a823213e6336516748a7949bb108402f65631d661c18460675368a1860929ddeb8f71aa23d391b8fa99e9816af2d040876a663a86d97f46b9665cc18492b"], 0x0) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000cc0)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2a, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xffff, 0x3}, {}, {0x7, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4e3, 0xca0b, 0x2, 0x3}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40800}, 0x44000) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4) 3.463907265s ago: executing program 2 (id=484): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x8, 0x13, [{0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}]}]}, 0x40}}, 0x0) 3.33505212s ago: executing program 2 (id=485): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) syz_io_uring_setup(0x34b9, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0xf00, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000006c0)="c1"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) 3.036655391s ago: executing program 5 (id=486): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, 0x0, 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f4070009", 0xe) ioctl(r0, 0xc138fd02, &(0x7f0000000000)="0400000000000000") 2.984878349s ago: executing program 0 (id=487): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) syz_io_uring_setup(0x34b9, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0xf00, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) 2.870016337s ago: executing program 4 (id=488): socket$inet6_sctp(0xa, 0x1, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x11, 0x3, 0x0, &(0x7f0000000040)='syzkaller\x00'}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000000001c0010800800014000000000d97405010000000008000240000000000800", @ANYRES64=r0], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 2.771040574s ago: executing program 0 (id=489): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x1}, 0xe) fcntl$setstatus(r0, 0x4, 0x800) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setrlimit(0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000080)={0x0, 0xf5, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000104000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352', 0x29) symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') write(0xffffffffffffffff, &(0x7f0000000640)='usbip-vudc.0', 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f00000000c0)={'pcmda12\x00', [0x100, 0x7, 0x2, 0x1000, 0xf, 0x5, 0x79, 0x3, 0x80008, 0x6, 0xffffffff, 0x1, 0x800008, 0x5, 0x100, 0x101, 0xfffffffb, 0x9, 0x7f, 0x7fffffff, 0x89, 0xca9f, 0xfffffffe, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0xa6b8, 0x0, 0xfffffff8]}) socket$inet6(0xa, 0x80002, 0x0) 2.740125251s ago: executing program 5 (id=490): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) fsetxattr$trusted_overlay_redirect(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000380)='./dev/../file0\x00', 0xf, 0x2) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPATH(r0, 0x0, 0x20) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8000000f3aa6ea) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0xffffffff, @remote}}}, 0x108) r2 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @broadcast}, {0x1, @local}, 0x4a, {0x2, 0x0, @local}}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r4, 0x89a2, &(0x7f0000000000)='bridge0\x00') writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000080)="290000001e00190f00003fffffffda060200000000e80001dd0008040d000900250000000005000000", 0x29}], 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) 2.151667821s ago: executing program 4 (id=491): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000001500)={0x0, 0x0, &(0x7f00000000b0)={&(0x7f0000000500)=@setlink={0x20, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x41, 0x1}}, 0x20}}, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) bind$packet(r2, &(0x7f0000000700)={0x11, 0x300}, 0x14) setsockopt$sock_int(r2, 0x1, 0xc, &(0x7f00000005c0)=0x10001, 0x4) write(r2, &(0x7f0000000600)='\x00', 0x1) 2.106907946s ago: executing program 3 (id=492): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000400)=ANY=[@ANYBLOB="12011001000000106d043ac500000000000109022d"], 0x0) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = signalfd(0xffffffffffffffff, &(0x7f0000000040)={[0xed]}, 0x8) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8004002, 0xc1e6e71558eba5be, 0x401d031, r1, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x3, 0x6ee, 0x0, 0x0, 0x1000, 0x1, 0x0, 0x0, 0x113}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x403, 0x60, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x83ac}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x800, 0x4003bffb, 0x34a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 2.100150638s ago: executing program 1 (id=493): socket$inet_tcp(0x2, 0x1, 0x0) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00', 0x0) copy_file_range(r1, 0x0, r1, &(0x7f00000003c0)=0xffffffffffff8000, 0x0, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r2, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)="653aa3c2184ee1c5b6170607265d8155c6ae", 0x12) unlinkat(r4, &(0x7f0000004800)='./file0\x00', 0x0) connect$vsock_stream(r3, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) accept4(r2, 0x0, 0x0, 0x0) r5 = syz_ublk_setup_io_uring(0x41eb, &(0x7f0000000000)={0x0, 0x25dc, 0x1, 0x1, 0x3a9}, &(0x7f00000000c0), 0x0, &(0x7f0000000180)) syz_ublk_setup_io_uring(0x10b5, &(0x7f0000000240)={0x0, 0x140a, 0x20000, 0x1, 0x25, 0x0, r5}, 0x0, 0x0, &(0x7f00000047c0)) 2.09325576s ago: executing program 5 (id=494): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000a20000/0x2000)=nil) syz_open_procfs(0x0, 0x0) socket$inet6(0xa, 0x800, 0xfffffffe) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x1000)=nil) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) open(&(0x7f0000000000)='./file1\x00', 0x143142, 0x80) 2.005765358s ago: executing program 2 (id=495): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="09000000010000000800000008"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a40)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x4b72, &(0x7f0000000040)={0x1, 0x1, 0x12, 0xc, 0x17d, 0x0}) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e0000001ac1414aa0000"], 0x1c) setsockopt$inet_mreqn(r1, 0x0, 0x25, &(0x7f0000000080)={@multicast1, @local}, 0xc) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) unshare(0x24020400) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0xa, &(0x7f0000000040)=@raw=[@jmp={0x5, 0x0, 0x3, 0x0, 0xa, 0x1, 0x4}, @alu={0x0, 0x1, 0xb, 0x3, 0x2, 0x30}, @map_idx={0x18, 0x2, 0x5, 0x0, 0x8}, @ldst={0x3, 0x0, 0x6, 0x1, 0x0, 0x30, 0x4}, @ldst={0x3, 0x1, 0x2, 0x3, 0x9, 0x1, 0x8}, @ringbuf_query], &(0x7f00000000c0)='GPL\x00', 0x1, 0xc1, &(0x7f0000000240)=""/193, 0x40f00, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x0, 0xf, 0x4, 0x8}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000380)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000003c0)=[{0x1, 0x4, 0x3}, {0x3, 0x3, 0xc, 0xc}], 0x10, 0x7}, 0x94) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000004700)) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f00000005c0)={0x14, r3, 0x405, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4040df5}, 0x4040084) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/netdevsim/new_device\x00', 0x1, 0x1d3) write(r4, &(0x7f0000000000)="313230eb7317c8fc", 0x8) 1.803001666s ago: executing program 0 (id=496): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40841, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x64, 0x2c, 0x601, 0x0, 0x200, {0x0, 0x0, 0x0, 0x0, {0xfff3}, {0xc, 0xffff}, {0x300, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0x38, 0x2, [@TCA_U32_SEL={0x34, 0x5, {0x0, 0xf, 0x2, 0x1, 0x200, 0x400, 0x1, 0x8, [{0x8, 0x8, 0x9108, 0xf}, {0x6, 0x2, 0x8, 0xfff}]}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4001}, 0x0) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000003c0)=ANY=[], 0x82) 928.24348ms ago: executing program 5 (id=497): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x8, 0x13, [{0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}]}]}, 0x40}}, 0x0) 826.99388ms ago: executing program 4 (id=498): socket$key(0xf, 0x3, 0x2) openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) r0 = syz_usb_connect(0x0, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004051045f500001010203020902350001020080300904000005ff00000007058102000200070501020002000705820200020007050202000200070583030a"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 701.961685ms ago: executing program 1 (id=499): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x3, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="18020000fcffffff0000000003000008850000002800000085000000a0"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000000)={0xf, r0, 0x4b36baea9e1c7e99}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000126bd700001b133d62ec562bab7670a5b99ea33d7"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x20048004) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fd, 0x0, 0x3, 0x3}, 0x10) recvmmsg(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=""/36, 0x24}], 0x1}, 0x4}], 0x1, 0x400101a0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) r4 = syz_io_uring_setup(0x34b8, &(0x7f0000000500)={0x0, 0x12d9, 0x20, 0x3, 0xe9}, &(0x7f0000000300)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000400)=0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x34000, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x30, 0x0}) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r4}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r8 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0) 644.947169ms ago: executing program 2 (id=500): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000600)={0x1, r1}) 542.698978ms ago: executing program 5 (id=501): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1fe) 541.035012ms ago: executing program 0 (id=502): ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x50}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r7], 0x90}}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x8041) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x44}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r11}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) 210.361589ms ago: executing program 5 (id=503): mkdir(&(0x7f0000000040)='./my_configfs/target/core/rd_mcp_0\x00', 0x140) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$tipc(0x1e, 0x2, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x2a, 0xfffffffffffffff9) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x40, 0x2, 0x2, 0x3}, 0x10) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000001c0)="39000000140081ae0000dc676f97daf01e2357f9ffffffffffffff0521018701546fabca1b4e8a06a6580e88370200c54c1960b89c40ebb373", 0x39}], 0x1}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bind$bt_hci(r0, &(0x7f0000000240)={0x1f, 0xffff, 0x3}, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs\x00', 0x117) mount(0x0, &(0x7f0000000080)='./my_configfs\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) symlinkat(&(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/obex.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/configs/c.1/obex.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./mnt/usb_gadget/g1/functions/geth.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./mnt/usb_gadget/g1/functions/geth.usb0\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./mnt/usb_gadget/g1/configs/c.1/geth.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='dummy_udc.0', 0xb) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1000}) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c69637930000800020000000002080003000000001e", 0x68}], 0x1}, 0x0) 0s ago: executing program 2 (id=504): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x109) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000002300)={0x2020}, 0x2020) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.157' (ED25519) to the list of known hosts. [ 75.752550][ T5604] cgroup: Unknown subsys name 'net' [ 75.870011][ T5604] cgroup: Unknown subsys name 'cpuset' [ 75.873676][ T5604] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 77.360191][ T5604] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 81.700286][ T5624] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 81.702004][ T5629] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 81.720724][ T5637] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 81.721562][ T5637] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 81.723553][ T5637] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 81.725010][ T5637] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 81.727302][ T5637] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 81.730808][ T5637] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 81.731339][ T5637] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 81.732247][ T5637] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 81.734444][ T5641] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 81.736766][ T5641] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 81.737592][ T5641] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 81.738161][ T5641] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 81.739177][ T5641] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 81.739858][ T5641] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 81.740321][ T5641] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 81.742009][ T5641] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 81.743445][ T5641] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 81.744416][ T5641] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 81.745359][ T5641] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 81.745867][ T5641] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 81.746914][ T5641] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 81.747674][ T5641] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.750312][ T5641] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 81.762524][ T5637] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 81.773805][ T5629] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 81.774839][ T5629] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 81.804473][ T5637] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 81.811503][ T5629] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 83.765723][ T5637] Bluetooth: hci3: command tx timeout [ 83.846224][ T5633] Bluetooth: hci0: command tx timeout [ 83.846245][ T5624] Bluetooth: hci5: command tx timeout [ 83.846391][ T5637] Bluetooth: hci1: command tx timeout [ 83.925851][ T5633] Bluetooth: hci4: command tx timeout [ 83.926021][ T5637] Bluetooth: hci2: command tx timeout [ 84.181901][ T5630] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.182065][ T5630] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.182258][ T5630] bridge_slave_0: entered allmulticast mode [ 84.184651][ T5630] bridge_slave_0: entered promiscuous mode [ 84.232718][ T5630] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.232861][ T5630] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.232973][ T5630] bridge_slave_1: entered allmulticast mode [ 84.234512][ T5630] bridge_slave_1: entered promiscuous mode [ 84.332824][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.332938][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.333059][ T5621] bridge_slave_0: entered allmulticast mode [ 84.334820][ T5621] bridge_slave_0: entered promiscuous mode [ 84.405530][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.405728][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.405839][ T5621] bridge_slave_1: entered allmulticast mode [ 84.407367][ T5621] bridge_slave_1: entered promiscuous mode [ 84.425449][ T5628] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.425558][ T5628] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.425689][ T5628] bridge_slave_0: entered allmulticast mode [ 84.428049][ T5628] bridge_slave_0: entered promiscuous mode [ 84.431805][ T5628] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.431919][ T5628] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.432049][ T5628] bridge_slave_1: entered allmulticast mode [ 84.434325][ T5628] bridge_slave_1: entered promiscuous mode [ 84.461505][ T5622] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.461613][ T5622] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.462084][ T5622] bridge_slave_0: entered allmulticast mode [ 84.464362][ T5622] bridge_slave_0: entered promiscuous mode [ 84.467996][ T5622] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.468162][ T5622] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.468292][ T5622] bridge_slave_1: entered allmulticast mode [ 84.470365][ T5622] bridge_slave_1: entered promiscuous mode [ 84.476622][ T5630] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.480459][ T5630] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.600922][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.603914][ T5628] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.646637][ T5630] team0: Port device team_slave_0 added [ 84.674001][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.676797][ T5628] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.677017][ T5635] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.677388][ T5635] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.677813][ T5635] bridge_slave_0: entered allmulticast mode [ 84.679906][ T5635] bridge_slave_0: entered promiscuous mode [ 84.686530][ T5622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.690525][ T5630] team0: Port device team_slave_1 added [ 84.690769][ T5623] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.690877][ T5623] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.691620][ T5623] bridge_slave_0: entered allmulticast mode [ 84.694015][ T5623] bridge_slave_0: entered promiscuous mode [ 84.728750][ T5635] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.728861][ T5635] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.729003][ T5635] bridge_slave_1: entered allmulticast mode [ 84.731556][ T5635] bridge_slave_1: entered promiscuous mode [ 84.737360][ T5622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.789352][ T5623] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.789462][ T5623] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.789771][ T5623] bridge_slave_1: entered allmulticast mode [ 84.792977][ T5623] bridge_slave_1: entered promiscuous mode [ 84.853334][ T5630] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.853351][ T5630] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.853377][ T5630] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.872565][ T5621] team0: Port device team_slave_0 added [ 84.876876][ T5628] team0: Port device team_slave_0 added [ 84.912136][ T5630] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.912153][ T5630] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.912182][ T5630] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.914762][ T5622] team0: Port device team_slave_0 added [ 84.936060][ T5623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.939353][ T5621] team0: Port device team_slave_1 added [ 84.942068][ T5628] team0: Port device team_slave_1 added [ 84.963157][ T5635] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.979731][ T5623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.998457][ T5622] team0: Port device team_slave_1 added [ 85.021528][ T5635] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.062574][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.062591][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.062616][ T5628] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.111974][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.111987][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.112009][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.128991][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.129007][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.129036][ T5628] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.166477][ T5623] team0: Port device team_slave_0 added [ 85.168565][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.168580][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.168609][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.170706][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.170720][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.170748][ T5622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.186686][ T5635] team0: Port device team_slave_0 added [ 85.196906][ T5630] hsr_slave_0: entered promiscuous mode [ 85.198250][ T5630] hsr_slave_1: entered promiscuous mode [ 85.202671][ T5623] team0: Port device team_slave_1 added [ 85.214374][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.214390][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.214420][ T5622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.222804][ T5635] team0: Port device team_slave_1 added [ 85.384449][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.384466][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.384492][ T5623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.389041][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.389056][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.389084][ T5623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.417804][ T5628] hsr_slave_0: entered promiscuous mode [ 85.420515][ T5628] hsr_slave_1: entered promiscuous mode [ 85.422892][ T5628] debugfs: 'hsr0' already exists in 'hsr' [ 85.422968][ T5628] Cannot create hsr debugfs directory [ 85.427398][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.427413][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.427441][ T5635] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.437924][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.437938][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.437967][ T5635] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.590384][ T5621] hsr_slave_0: entered promiscuous mode [ 85.591231][ T5621] hsr_slave_1: entered promiscuous mode [ 85.591831][ T5621] debugfs: 'hsr0' already exists in 'hsr' [ 85.591851][ T5621] Cannot create hsr debugfs directory [ 85.619990][ T5622] hsr_slave_0: entered promiscuous mode [ 85.620803][ T5622] hsr_slave_1: entered promiscuous mode [ 85.621379][ T5622] debugfs: 'hsr0' already exists in 'hsr' [ 85.621398][ T5622] Cannot create hsr debugfs directory [ 85.735883][ T5623] hsr_slave_0: entered promiscuous mode [ 85.736704][ T5623] hsr_slave_1: entered promiscuous mode [ 85.737279][ T5623] debugfs: 'hsr0' already exists in 'hsr' [ 85.737300][ T5623] Cannot create hsr debugfs directory [ 85.775582][ T5635] hsr_slave_0: entered promiscuous mode [ 85.776413][ T5635] hsr_slave_1: entered promiscuous mode [ 85.777022][ T5635] debugfs: 'hsr0' already exists in 'hsr' [ 85.777041][ T5635] Cannot create hsr debugfs directory [ 85.845504][ T5637] Bluetooth: hci3: command tx timeout [ 85.925849][ T5633] Bluetooth: hci1: command tx timeout [ 85.925872][ T5624] Bluetooth: hci0: command tx timeout [ 85.925943][ T5637] Bluetooth: hci5: command tx timeout [ 86.005799][ T5624] Bluetooth: hci4: command tx timeout [ 86.005903][ T5637] Bluetooth: hci2: command tx timeout [ 86.093201][ T982] cfg80211: failed to load regulatory.db [ 86.423858][ T5630] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 86.438351][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.439484][ T5630] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 86.445038][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.467994][ T5630] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 86.471790][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.497305][ T5630] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 86.500829][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.530560][ T5628] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 86.536920][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.541685][ T5628] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 86.556803][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.568698][ T5628] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 86.577906][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.578815][ T5628] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 86.583895][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.666698][ T5621] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 86.673548][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.674412][ T5621] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 86.678938][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.710756][ T5621] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 86.714450][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.719655][ T5621] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 86.727243][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.831694][ T5622] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.836611][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.837469][ T5622] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.846692][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.851046][ T5622] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.860929][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.872452][ T5630] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.878772][ T5622] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.890790][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.967837][ T5635] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 86.977373][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.979770][ T5635] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 86.992039][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.009471][ T5630] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.017713][ T5635] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 87.027052][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.043908][ T5635] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 87.050065][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.091681][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.091789][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.148139][ T115] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.148221][ T115] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.198765][ T5623] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 87.202439][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.228400][ T5628] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.232377][ T5623] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 87.237025][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.264965][ T5623] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 87.276601][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.297690][ T5623] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 87.301098][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.331810][ T5628] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.343094][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.394321][ T3325] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.394409][ T3325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.424270][ T1460] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.424515][ T1460] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.467308][ T5621] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.523001][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.523110][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.571495][ T1444] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.571578][ T1444] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.657825][ T5622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.669715][ T5635] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.749255][ T5622] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.784461][ T5635] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.807708][ T3325] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.807811][ T3325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.870774][ T3325] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.870892][ T3325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.873841][ T3325] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.874000][ T3325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.926063][ T5637] Bluetooth: hci3: command tx timeout [ 87.936262][ T3325] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.936372][ T3325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.005753][ T5624] Bluetooth: hci5: command tx timeout [ 88.005789][ T5624] Bluetooth: hci1: command tx timeout [ 88.005927][ T5637] Bluetooth: hci0: command tx timeout [ 88.049396][ T5623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.086098][ T5633] Bluetooth: hci4: command tx timeout [ 88.086180][ T5637] Bluetooth: hci2: command tx timeout [ 88.174307][ T5623] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.239501][ T1444] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.239619][ T1444] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.299580][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.299725][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.684179][ T5630] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.950916][ T5628] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.170937][ T5628] veth0_vlan: entered promiscuous mode [ 89.212906][ T5628] veth1_vlan: entered promiscuous mode [ 89.403769][ T5628] veth0_macvtap: entered promiscuous mode [ 89.424168][ T5628] veth1_macvtap: entered promiscuous mode [ 89.514027][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.553221][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.612104][ T1487] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.614831][ T115] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.616858][ T115] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.618204][ T115] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.687803][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.749775][ T5635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.951106][ T3325] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.951130][ T3325] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.007830][ T5637] Bluetooth: hci3: command tx timeout [ 90.013136][ T5622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.090692][ T5633] Bluetooth: hci1: command tx timeout [ 90.090727][ T5633] Bluetooth: hci5: command tx timeout [ 90.090787][ T5637] Bluetooth: hci0: command tx timeout [ 90.124222][ T5630] veth0_vlan: entered promiscuous mode [ 90.130756][ T1460] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.130775][ T1460] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.151499][ T5623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.167881][ T5624] Bluetooth: hci4: command tx timeout [ 90.167928][ T5637] Bluetooth: hci2: command tx timeout [ 90.221714][ T5635] veth0_vlan: entered promiscuous mode [ 90.231643][ T5630] veth1_vlan: entered promiscuous mode [ 90.301034][ T5635] veth1_vlan: entered promiscuous mode [ 90.314815][ T5628] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 90.377180][ T5622] veth0_vlan: entered promiscuous mode [ 90.437792][ T5853] FAULT_INJECTION: forcing a failure. [ 90.437792][ T5853] name failslab, interval 1, probability 0, space 0, times 1 [ 90.437831][ T5853] CPU: 0 UID: 0 PID: 5853 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT(full) [ 90.437858][ T5853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 90.437873][ T5853] Call Trace: [ 90.437883][ T5853] [ 90.437893][ T5853] dump_stack_lvl+0xe8/0x150 [ 90.437941][ T5853] should_fail_ex+0x410/0x560 [ 90.437976][ T5853] should_failslab+0xa8/0x100 [ 90.438010][ T5853] __kmalloc_cache_noprof+0xa3/0x600 [ 90.438037][ T5853] ? fanotify_alloc_overflow_event+0x4a/0x140 [ 90.438076][ T5853] ? fanotify_alloc_overflow_event+0x4a/0x140 [ 90.438116][ T5853] ? __se_sys_fanotify_init+0x4d8/0xb20 [ 90.438158][ T5853] fanotify_alloc_overflow_event+0x4a/0x140 [ 90.438200][ T5853] __se_sys_fanotify_init+0x524/0xb20 [ 90.438249][ T5853] ? __pfx___se_sys_fanotify_init+0x10/0x10 [ 90.438285][ T5853] ? srso_alias_return_thunk+0x5/0xfbef5 [ 90.438329][ T5853] do_syscall_64+0x166/0x520 [ 90.438361][ T5853] ? trace_irq_disable+0x3b/0x140 [ 90.438387][ T5853] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.438419][ T5853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.438444][ T5853] RIP: 0033:0x7f810579e159 [ 90.438467][ T5853] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.438487][ T5853] RSP: 002b:00007f81066c1028 EFLAGS: 00000246 ORIG_RAX: 000000000000012c [ 90.438513][ T5853] RAX: ffffffffffffffda RBX: 00007f8105a25fa0 RCX: 00007f810579e159 [ 90.438532][ T5853] RDX: 0000000000000000 RSI: 0000000000080000 RDI: 0000000000000010 [ 90.438548][ T5853] RBP: 00007f810583506b R08: 0000000000000000 R09: 0000000000000000 [ 90.438564][ T5853] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.438579][ T5853] R13: 00007f8105a26038 R14: 00007f8105a25fa0 R15: 00007fffc5589978 [ 90.438617][ T5853] [ 90.472804][ T5630] veth0_macvtap: entered promiscuous mode [ 90.479516][ T5622] veth1_vlan: entered promiscuous mode [ 90.528923][ T5630] veth1_macvtap: entered promiscuous mode [ 90.550312][ T5623] veth0_vlan: entered promiscuous mode [ 90.578239][ T5635] veth0_macvtap: entered promiscuous mode [ 90.628773][ T5635] veth1_macvtap: entered promiscuous mode [ 90.680763][ T5621] veth0_vlan: entered promiscuous mode [ 90.701183][ T5623] veth1_vlan: entered promiscuous mode [ 90.719773][ T5630] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.758918][ T5630] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.773929][ T5621] veth1_vlan: entered promiscuous mode [ 90.792735][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.826115][ T5856] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 90.826187][ T5856] block device autoloading is deprecated and will be removed. [ 90.854722][ T41] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.855090][ T41] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.857787][ T41] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.865449][ T41] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.899128][ T5622] veth0_macvtap: entered promiscuous mode [ 90.904436][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.939504][ T5623] veth0_macvtap: entered promiscuous mode [ 90.991567][ T5622] veth1_macvtap: entered promiscuous mode [ 91.003106][ T5623] veth1_macvtap: entered promiscuous mode [ 91.028983][ T5858] FAULT_INJECTION: forcing a failure. [ 91.028983][ T5858] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 91.029018][ T5858] CPU: 0 UID: 0 PID: 5858 Comm: syz.3.8 Not tainted syzkaller #0 PREEMPT(full) [ 91.029045][ T5858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 91.029060][ T5858] Call Trace: [ 91.029070][ T5858] [ 91.029080][ T5858] dump_stack_lvl+0xe8/0x150 [ 91.029121][ T5858] should_fail_ex+0x410/0x560 [ 91.029157][ T5858] prepare_alloc_pages+0x223/0x600 [ 91.029192][ T5858] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 91.029226][ T5858] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 91.029260][ T5858] ? __pfx_policy_nodemask+0x10/0x10 [ 91.029304][ T5858] alloc_pages_mpol+0x21e/0x390 [ 91.029343][ T5858] alloc_pages_noprof+0xb1/0x2b0 [ 91.029379][ T5858] get_free_pages_noprof+0xf/0x80 [ 91.029407][ T5858] __kasan_populate_vmalloc+0x38/0x1c0 [ 91.029432][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.029462][ T5858] ? do_raw_spin_unlock+0xf5/0x200 [ 91.029504][ T5858] alloc_vmap_area+0xd1a/0x1420 [ 91.029558][ T5858] ? __pfx_alloc_vmap_area+0x10/0x10 [ 91.029591][ T5858] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 91.029619][ T5858] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 91.029643][ T5858] ? __get_vm_area_node+0x155/0x2f0 [ 91.029683][ T5858] __get_vm_area_node+0x200/0x2f0 [ 91.029729][ T5858] __vmalloc_node_range_noprof+0x343/0x1540 [ 91.029771][ T5858] ? n_tty_open+0x1d/0x150 [ 91.029813][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.029862][ T5858] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 91.029902][ T5858] ? n_tty_open+0x11c/0x150 [ 91.029940][ T5858] ? n_tty_open+0x1d/0x150 [ 91.029970][ T5858] vzalloc_noprof+0xb2/0xe0 [ 91.030007][ T5858] ? n_tty_open+0x1d/0x150 [ 91.030040][ T5858] n_tty_open+0x1d/0x150 [ 91.030072][ T5858] tty_ldisc_setup+0x1b6/0x270 [ 91.030098][ T5858] tty_init_dev+0x279/0x4d0 [ 91.030137][ T5858] ptmx_open+0xeb/0x2e0 [ 91.030175][ T5858] chrdev_open+0x4d9/0x600 [ 91.030204][ T5858] ? __pfx_chrdev_open+0x10/0x10 [ 91.030231][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.030259][ T5858] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 91.030293][ T5858] ? __pfx_chrdev_open+0x10/0x10 [ 91.030321][ T5858] do_dentry_open+0x816/0x1380 [ 91.030364][ T5858] vfs_open+0x3b/0x340 [ 91.030391][ T5858] ? path_openat+0x1428/0x1d60 [ 91.030420][ T5858] path_openat+0x1443/0x1d60 [ 91.030468][ T5858] do_file_open+0x23e/0x4a0 [ 91.030500][ T5858] ? __pfx_do_file_open+0x10/0x10 [ 91.030551][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.030580][ T5858] ? _raw_spin_unlock+0x28/0x50 [ 91.030607][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.030635][ T5858] ? alloc_fd+0x651/0x6c0 [ 91.030682][ T5858] do_sys_openat2+0x115/0x200 [ 91.030713][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.030742][ T5858] ? __se_sys_futex+0x3a8/0x450 [ 91.030777][ T5858] ? __pfx_do_sys_openat2+0x10/0x10 [ 91.030816][ T5858] ? rcu_is_watching+0x16/0xb0 [ 91.030847][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.030882][ T5858] __x64_sys_openat+0x138/0x170 [ 91.030930][ T5858] do_syscall_64+0x166/0x520 [ 91.030962][ T5858] ? trace_irq_disable+0x3b/0x140 [ 91.030987][ T5858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.031019][ T5858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.031045][ T5858] RIP: 0033:0x7f810579e159 [ 91.031068][ T5858] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.031087][ T5858] RSP: 002b:00007f81066c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 91.031130][ T5858] RAX: ffffffffffffffda RBX: 00007f8105a25fa0 RCX: 00007f810579e159 [ 91.031149][ T5858] RDX: 0000000000080042 RSI: 0000200000000380 RDI: ffffffffffffff9c [ 91.031166][ T5858] RBP: 00007f810583506b R08: 0000000000000000 R09: 0000000000000000 [ 91.031181][ T5858] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.031196][ T5858] R13: 00007f8105a26038 R14: 00007f8105a25fa0 R15: 00007fffc5589978 [ 91.031234][ T5858] [ 91.031344][ T5858] syz.3.8: vmalloc error: size 9112, align 0x1, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 91.031477][ T5858] CPU: 0 UID: 0 PID: 5858 Comm: syz.3.8 Not tainted syzkaller #0 PREEMPT(full) [ 91.031503][ T5858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 91.031517][ T5858] Call Trace: [ 91.031526][ T5858] [ 91.031536][ T5858] dump_stack_lvl+0xe8/0x150 [ 91.031574][ T5858] warn_alloc+0x24d/0x270 [ 91.031600][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.031629][ T5858] ? lockdep_hardirqs_on+0x7b/0x110 [ 91.031664][ T5858] ? __pfx_warn_alloc+0x10/0x10 [ 91.031688][ T5858] ? kfree+0x1c5/0x650 [ 91.031732][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.031761][ T5858] ? __get_vm_area_node+0x219/0x2f0 [ 91.031806][ T5858] __vmalloc_node_range_noprof+0x36b/0x1540 [ 91.031856][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.031907][ T5858] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 91.031955][ T5858] ? n_tty_open+0x11c/0x150 [ 91.031989][ T5858] ? n_tty_open+0x1d/0x150 [ 91.032019][ T5858] vzalloc_noprof+0xb2/0xe0 [ 91.032057][ T5858] ? n_tty_open+0x1d/0x150 [ 91.032090][ T5858] n_tty_open+0x1d/0x150 [ 91.032122][ T5858] tty_ldisc_setup+0x1b6/0x270 [ 91.032151][ T5858] tty_init_dev+0x279/0x4d0 [ 91.032194][ T5858] ptmx_open+0xeb/0x2e0 [ 91.032236][ T5858] chrdev_open+0x4d9/0x600 [ 91.032268][ T5858] ? __pfx_chrdev_open+0x10/0x10 [ 91.032298][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.032326][ T5858] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 91.032361][ T5858] ? __pfx_chrdev_open+0x10/0x10 [ 91.032388][ T5858] do_dentry_open+0x816/0x1380 [ 91.032433][ T5858] vfs_open+0x3b/0x340 [ 91.032460][ T5858] ? path_openat+0x1428/0x1d60 [ 91.032488][ T5858] path_openat+0x1443/0x1d60 [ 91.032537][ T5858] do_file_open+0x23e/0x4a0 [ 91.032568][ T5858] ? __pfx_do_file_open+0x10/0x10 [ 91.032618][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.032647][ T5858] ? _raw_spin_unlock+0x28/0x50 [ 91.032672][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.032701][ T5858] ? alloc_fd+0x651/0x6c0 [ 91.032747][ T5858] do_sys_openat2+0x115/0x200 [ 91.032778][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.032807][ T5858] ? __se_sys_futex+0x3a8/0x450 [ 91.032840][ T5858] ? __pfx_do_sys_openat2+0x10/0x10 [ 91.032879][ T5858] ? rcu_is_watching+0x16/0xb0 [ 91.032916][ T5858] ? srso_alias_return_thunk+0x5/0xfbef5 [ 91.032949][ T5858] __x64_sys_openat+0x138/0x170 [ 91.032988][ T5858] do_syscall_64+0x166/0x520 [ 91.033019][ T5858] ? trace_irq_disable+0x3b/0x140 [ 91.033042][ T5858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.033073][ T5858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.033098][ T5858] RIP: 0033:0x7f810579e159 [ 91.033119][ T5858] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.033138][ T5858] RSP: 002b:00007f81066c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 91.033164][ T5858] RAX: ffffffffffffffda RBX: 00007f8105a25fa0 RCX: 00007f810579e159 [ 91.033183][ T5858] RDX: 0000000000080042 RSI: 0000200000000380 RDI: ffffffffffffff9c [ 91.033200][ T5858] RBP: 00007f810583506b R08: 0000000000000000 R09: 0000000000000000 [ 91.033216][ T5858] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.033231][ T5858] R13: 00007f8105a26038 R14: 00007f8105a25fa0 R15: 00007fffc5589978 [ 91.033271][ T5858] [ 91.033280][ T5858] Mem-Info: [ 91.033292][ T5858] active_anon:6396 inactive_anon:0 isolated_anon:0 [ 91.033292][ T5858] active_file:0 inactive_file:41167 isolated_file:0 [ 91.033292][ T5858] unevictable:0 dirty:1764 writeback:0 [ 91.033292][ T5858] slab_reclaimable:9779 slab_unreclaimable:92817 [ 91.033292][ T5858] mapped:34320 shmem:519 pagetables:1079 [ 91.033292][ T5858] sec_pagetables:0 bounce:0 [ 91.033292][ T5858] kernel_misc_reclaimable:0 [ 91.033292][ T5858] free:1319377 free_pcp:20956 free_cma:0 [ 91.033354][ T5858] Node 0 active_anon:25584kB inactive_anon:0kB active_file:0kB inactive_file:164456kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:137280kB dirty:7032kB writeback:0kB shmem:2076kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12340kB pagetables:4200kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 91.033421][ T5858] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:212kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:24kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:116kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 91.033480][ T5858] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 91.033550][ T5858] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 91.033600][ T5858] Node 0 DMA32 free:1327552kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:25584kB inactive_anon:0kB active_file:0kB inactive_file:164456kB unevictable:0kB writepending:7032kB zspages:0kB present:3129332kB managed:2546944kB mlocked:0kB bounce:0kB free_pcp:82820kB local_pcp:25820kB free_cma:0kB [ 91.033674][ T5858] lowmem_reserve[]: 0 0 0 0 0 [ 91.033721][ T5858] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 91.033787][ T5858] lowmem_reserve[]: 0 0 0 0 0 [ 91.033835][ T5858] Node 1 Normal free:3934596kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:212kB unevictable:0kB writepending:24kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:1004kB local_pcp:0kB free_cma:0kB [ 91.033906][ T5858] lowmem_reserve[]: 0 0 0 0 0 [ 91.033958][ T5858] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 91.034129][ T5858] Node 0 DMA32: 726*4kB (UME) 101*8kB (UME) 6*16kB (M) 7*32kB (ME) 7*64kB (UM) 8*128kB (M) 6*256kB (ME) 3*512kB (ME) 2*1024kB (M) 3*2048kB (UM) 320*4096kB (M) = 1327488kB [ 91.034343][ T5858] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 91.034476][ T5858] Node 1 Normal: 1*4kB (M) 2*8kB (UM) 1*16kB (M) 1*32kB (M) 1*64kB (M) 2*128kB (UM) 2*256kB (M) 3*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 959*4096kB (M) = 3934596kB [ 91.034689][ T5858] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 91.034710][ T5858] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 91.034730][ T5858] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 91.034750][ T5858] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 91.034770][ T5858] 41682 total pagecache pages [ 91.034780][ T5858] 0 pages in swap cache [ 91.034789][ T5858] Free swap = 124996kB [ 91.034799][ T5858] Total swap = 124996kB [ 91.034810][ T5858] 2097051 pages RAM [ 91.034819][ T5858] 0 pages HighMem/MovableOnly [ 91.034828][ T5858] 428699 pages reserved [ 91.034838][ T5858] 0 pages cma reserved [ 91.035043][ T5858] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 91.075550][ T50] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.076571][ T50] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.076615][ T50] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.076655][ T50] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.373398][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.407856][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.407875][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.416440][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.416958][ T5621] veth0_macvtap: entered promiscuous mode [ 91.502063][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.926904][ T5864] netlink: 'syz.3.9': attribute type 10 has an invalid length. [ 92.480313][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.521073][ T5621] veth1_macvtap: entered promiscuous mode [ 92.542208][ T5864] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.543041][ T5864] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.569084][ T5864] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.569193][ T5864] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.569607][ T5864] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.569707][ T5864] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.573503][ T5864] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 92.574364][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.574379][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.735115][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.735138][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.736497][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.743179][ T1444] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.743244][ T1444] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.743286][ T1444] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.747963][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.748009][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.750535][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.750581][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.882180][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.882938][ T1444] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.882956][ T1444] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.960584][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.988009][ T1444] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.988082][ T1444] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.988141][ T1444] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.988183][ T1444] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.160646][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.160670][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.271827][ T3325] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.271852][ T3325] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.769955][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.769976][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.917406][ T41] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.917427][ T41] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.050730][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.050755][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.293379][ T5884] mmap: syz.5.15 (5884) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 96.202084][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.202109][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.420446][ T5895] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16'. [ 96.583900][ T5900] syz.0.1 uses obsolete (PF_INET,SOCK_PACKET) [ 96.703306][ T5895] hsr_slave_1 (unregistering): left promiscuous mode [ 96.717153][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 96.835104][ T5906] netlink: 'syz.1.14': attribute type 10 has an invalid length. [ 96.854023][ T5906] team0: Port device dummy0 added [ 96.876266][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 96.877700][ T10] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 96.881775][ T10] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 96.881827][ T10] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 96.881853][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 96.881880][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 96.881906][ T10] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 96.881951][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.976284][ T5907] netlink: 'syz.1.14': attribute type 10 has an invalid length. [ 97.079504][ T5907] team0: Port device dummy0 removed [ 97.119622][ T5906] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 97.248306][ T10] usb 3-1: GET_CAPABILITIES returned 0 [ 97.248362][ T10] usbtmc 3-1:16.0: can't read capabilities [ 97.439747][ T5921] jffs2: notice: (5921) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 97.535070][ T5894] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3'. [ 97.665163][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.675959][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.676010][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.676060][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.676104][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.676559][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.676605][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.676649][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.676692][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.676914][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.676963][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.677019][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.677070][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.677516][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.677562][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 97.684655][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -2 [ 98.366996][ T5948] process 'syz.5.23' launched './file2' with NULL argv: empty string added [ 98.778860][ T5625] usb 3-1: USB disconnect, device number 2 [ 99.066828][ T5956] netlink: 4 bytes leftover after parsing attributes in process `syz.4.27'. [ 99.122260][ T5956] netlink: 12 bytes leftover after parsing attributes in process `syz.4.27'. [ 99.765092][ T5983] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 99.834322][ T5971] syzkaller1: entered promiscuous mode [ 99.834349][ T5971] syzkaller1: entered allmulticast mode [ 100.025902][ T5974] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 100.049799][ T5986] netlink: zone id is out of range [ 100.052032][ T5986] netlink: zone id is out of range [ 100.056428][ T5986] netlink: zone id is out of range [ 100.060270][ T5986] netlink: zone id is out of range [ 100.063988][ T5986] netlink: zone id is out of range [ 100.065801][ T5986] netlink: zone id is out of range [ 100.066678][ T5986] netlink: zone id is out of range [ 100.543266][ T5988] capability: warning: `syz.4.34' uses 32-bit capabilities (legacy support in use) [ 100.647410][ T5986] netlink: zone id is out of range [ 100.647521][ T5986] netlink: zone id is out of range [ 100.647694][ T5986] netlink: zone id is out of range [ 102.303331][ T5996] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 102.467151][ T6002] Zero length message leads to an empty skb [ 102.501183][ T6002] loop2: detected capacity change from 0 to 2640 [ 102.597155][ T6002] Buffer I/O error on dev loop2, logical block 0, lost async page write [ 102.597319][ T6002] Buffer I/O error on dev loop2, logical block 1, lost async page write [ 102.597454][ T6002] Buffer I/O error on dev loop2, logical block 2, lost async page write [ 102.597557][ T6002] Buffer I/O error on dev loop2, logical block 3, lost async page write [ 102.597797][ T6002] Buffer I/O error on dev loop2, logical block 4, lost async page write [ 102.597926][ T6002] Buffer I/O error on dev loop2, logical block 5, lost async page write [ 102.597971][ T6002] Buffer I/O error on dev loop2, logical block 6, lost async page write [ 102.598016][ T6002] Buffer I/O error on dev loop2, logical block 7, lost async page write [ 102.598060][ T6002] Buffer I/O error on dev loop2, logical block 8, lost async page write [ 102.598105][ T6002] Buffer I/O error on dev loop2, logical block 9, lost async page write [ 104.722742][ T6015] overlay: Unknown parameter 'audit' [ 107.616831][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 107.858895][ T6031] syz.0.45 (6031): drop_caches: 1 [ 107.993821][ T6031] syz.0.45 (6031): drop_caches: 1 [ 108.321597][ T5985] syz.4.34 (5985): drop_caches: 1 [ 109.555751][ T9] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 109.683130][ T6054] syzkaller0: entered promiscuous mode [ 109.683155][ T6054] syzkaller0: entered allmulticast mode [ 109.712704][ T9] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 109.719579][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 109.719603][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 109.719653][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.742664][ T9] usb 1-1: config 0 descriptor?? [ 109.797550][ T9] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 109.797797][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 109.930568][ T9] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 109.940587][ T9] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 109.940641][ T9] usb 1-1: media controller created [ 109.960080][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 110.106995][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 110.107180][ T9] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 110.162477][ T9] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input5 [ 110.302312][ T9] dvb-usb: schedule remote query interval to 150 msecs. [ 110.302338][ T9] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 110.325358][ T9] usb 1-1: USB disconnect, device number 2 [ 110.538568][ T9] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 111.028878][ T6090] device-mapper: ioctl: Invalid ioctl structure: name t, dev f800 [ 113.115356][ T3325] netdevsim netdevsim120 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.510699][ T6133] syz.0.72 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 113.717276][ T6134] bridge_slave_0: left allmulticast mode [ 113.717307][ T6134] bridge_slave_0: left promiscuous mode [ 113.717627][ T6134] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.783630][ T6110] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 113.783657][ T6110] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 114.767328][ T6110] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 114.767355][ T6110] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 114.925039][ T6110] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 114.925066][ T6110] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 115.022210][ T6110] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 115.022236][ T6110] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 115.092902][ T6110] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 115.092927][ T6110] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 115.231248][ T6154] device-mapper: dirty region log: invalid region size 1024 [ 115.231841][ T6154] device-mapper: table: 248:0: mirror: Error creating mirror dirty log (-EINVAL) [ 115.233796][ T6154] device-mapper: ioctl: error adding target to table [ 118.329298][ T6167] FAULT_INJECTION: forcing a failure. [ 118.329298][ T6167] name failslab, interval 1, probability 0, space 0, times 0 [ 118.329336][ T6167] CPU: 0 UID: 0 PID: 6167 Comm: syz.0.83 Not tainted syzkaller #0 PREEMPT(full) [ 118.329363][ T6167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 118.329378][ T6167] Call Trace: [ 118.329388][ T6167] [ 118.329398][ T6167] dump_stack_lvl+0xe8/0x150 [ 118.329445][ T6167] should_fail_ex+0x410/0x560 [ 118.329481][ T6167] should_failslab+0xa8/0x100 [ 118.329516][ T6167] __kmalloc_cache_noprof+0xa3/0x600 [ 118.329543][ T6167] ? __kmalloc_cache_noprof+0x14d/0x600 [ 118.329567][ T6167] ? fuse_get_tree+0xc2/0x3b0 [ 118.329600][ T6167] ? fuse_get_tree+0xc2/0x3b0 [ 118.329642][ T6167] fuse_get_tree+0xc2/0x3b0 [ 118.329679][ T6167] vfs_get_tree+0x92/0x2a0 [ 118.329707][ T6167] vfs_cmd_create+0xa2/0x200 [ 118.329741][ T6167] __se_sys_fsconfig+0x6b9/0x810 [ 118.329778][ T6167] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 118.329811][ T6167] ? rcu_is_watching+0x16/0xb0 [ 118.329842][ T6167] ? srso_alias_return_thunk+0x5/0xfbef5 [ 118.329879][ T6167] ? srso_alias_return_thunk+0x5/0xfbef5 [ 118.329907][ T6167] ? __x64_sys_fsconfig+0x20/0xc0 [ 118.329940][ T6167] do_syscall_64+0x166/0x520 [ 118.329972][ T6167] ? trace_irq_disable+0x3b/0x140 [ 118.329998][ T6167] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.330030][ T6167] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.330055][ T6167] RIP: 0033:0x7fa34ed9e159 [ 118.330077][ T6167] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.330096][ T6167] RSP: 002b:00007fa34fc90028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 118.330123][ T6167] RAX: ffffffffffffffda RBX: 00007fa34f025fa0 RCX: 00007fa34ed9e159 [ 118.330141][ T6167] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 118.330156][ T6167] RBP: 00007fa34ee3506b R08: 0000000000000000 R09: 0000000000000000 [ 118.330171][ T6167] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 118.330186][ T6167] R13: 00007fa34f026038 R14: 00007fa34f025fa0 R15: 00007fffc63c0fd8 [ 118.330225][ T6167] [ 119.181141][ T6182] 9pnet_virtio: no channels available for device 127.0.0.1 [ 120.228862][ T6191] overlay: Unknown parameter 'audit' [ 122.931790][ T6218] bridge_slave_0: left allmulticast mode [ 122.931814][ T6218] bridge_slave_0: left promiscuous mode [ 122.932005][ T6218] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.102473][ T6225] FAULT_INJECTION: forcing a failure. [ 123.102473][ T6225] name failslab, interval 1, probability 0, space 0, times 0 [ 123.102510][ T6225] CPU: 0 UID: 0 PID: 6225 Comm: syz.2.98 Not tainted syzkaller #0 PREEMPT(full) [ 123.102536][ T6225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 123.102551][ T6225] Call Trace: [ 123.102561][ T6225] [ 123.102572][ T6225] dump_stack_lvl+0xe8/0x150 [ 123.102615][ T6225] should_fail_ex+0x410/0x560 [ 123.102651][ T6225] should_failslab+0xa8/0x100 [ 123.102683][ T6225] ? inet_bind_bucket_create+0x30/0x240 [ 123.102718][ T6225] kmem_cache_alloc_noprof+0xa1/0x600 [ 123.102767][ T6225] ? inet_bind_bucket_create+0x30/0x240 [ 123.102809][ T6225] inet_bind_bucket_create+0x30/0x240 [ 123.102847][ T6225] inet_csk_get_port+0xbf5/0x1740 [ 123.102892][ T6225] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 123.102930][ T6225] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.102965][ T6225] ? __inet_bind+0x3b0/0xaa0 [ 123.102998][ T6225] ? __local_bh_enable_ip+0xd6/0x140 [ 123.103034][ T6225] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.103069][ T6225] __inet_bind+0x5e0/0xaa0 [ 123.103104][ T6225] __sys_bind+0x2e3/0x410 [ 123.103138][ T6225] ? __pfx___sys_bind+0x10/0x10 [ 123.103181][ T6225] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.103210][ T6225] ? rcu_is_watching+0x16/0xb0 [ 123.103253][ T6225] __x64_sys_bind+0x7a/0x90 [ 123.103284][ T6225] do_syscall_64+0x166/0x520 [ 123.103316][ T6225] ? trace_irq_disable+0x3b/0x140 [ 123.103342][ T6225] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.103375][ T6225] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.103400][ T6225] RIP: 0033:0x7f5841b9e159 [ 123.103423][ T6225] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.103449][ T6225] RSP: 002b:00007f5842a8b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 123.103475][ T6225] RAX: ffffffffffffffda RBX: 00007f5841e25fa0 RCX: 00007f5841b9e159 [ 123.103494][ T6225] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000003 [ 123.103511][ T6225] RBP: 00007f5841c3506b R08: 0000000000000000 R09: 0000000000000000 [ 123.103527][ T6225] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.103542][ T6225] R13: 00007f5841e26038 R14: 00007f5841e25fa0 R15: 00007ffc41ddb7a8 [ 123.103582][ T6225] [ 123.469815][ T6231] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.97'. [ 123.488019][ T6227] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.97'. [ 123.488354][ T6230] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.97'. [ 124.208127][ T6239] 9pnet_virtio: no channels available for device 127.0.0.1 [ 127.275487][ T5779] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 127.435283][ T5779] usb 2-1: Using ep0 maxpacket: 8 [ 127.436000][ T5779] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 127.436713][ T5779] usb 2-1: config 0 has no interfaces? [ 127.436748][ T5779] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.523899][ T6294] overlayfs: overlapping lowerdir path [ 127.570160][ T6295] overlayfs: overlapping lowerdir path [ 127.635272][ T5779] usb 2-1: config 0 descriptor?? [ 128.388583][ T5757] usb 2-1: USB disconnect, device number 2 [ 129.101946][ T6318] netlink: 4 bytes leftover after parsing attributes in process `syz.3.122'. [ 129.102051][ T6318] bridge_slave_1: left allmulticast mode [ 129.102076][ T6318] bridge_slave_1: left promiscuous mode [ 129.102322][ T6318] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.150580][ T6318] bridge_slave_0: left allmulticast mode [ 129.150607][ T6318] bridge_slave_0: left promiscuous mode [ 129.152112][ T6318] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.252487][ T6325] fuse: Bad value for 'fd' [ 130.820592][ T6318] bond0: (slave bridge0): Releasing backup interface [ 131.687226][ T6353] warning: `syz.1.133' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 132.197022][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.197107][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 136.233025][ T6391] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.499934][ T6391] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.242160][ T6391] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.827862][ T6391] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.068205][ T1017] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.138192][ T1017] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.187986][ T115] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.195869][ T59] netdevsim netdevsim0 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.858595][ T6465] netlink: 'syz.2.174': attribute type 1 has an invalid length. [ 140.858652][ T6465] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 140.858665][ T6465] IPv6: NLM_F_CREATE should be set when creating new route [ 147.243816][ T6508] FAULT_INJECTION: forcing a failure. [ 147.243816][ T6508] name fail_futex, interval 1, probability 0, space 0, times 1 [ 147.243852][ T6508] CPU: 1 UID: 0 PID: 6508 Comm: syz.3.189 Not tainted syzkaller #0 PREEMPT(full) [ 147.243878][ T6508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 147.243893][ T6508] Call Trace: [ 147.243902][ T6508] [ 147.243912][ T6508] dump_stack_lvl+0xe8/0x150 [ 147.243954][ T6508] should_fail_ex+0x410/0x560 [ 147.243989][ T6508] get_futex_key+0x1b4/0x1580 [ 147.244034][ T6508] ? __pfx_get_futex_key+0x10/0x10 [ 147.244065][ T6508] ? srso_alias_return_thunk+0x5/0xfbef5 [ 147.244094][ T6508] ? update_se+0x90/0xff0 [ 147.244129][ T6508] ? srso_alias_return_thunk+0x5/0xfbef5 [ 147.244166][ T6508] futex_wait_setup+0x4a/0x590 [ 147.244213][ T6508] ? __futex_wait+0xdf/0x400 [ 147.244257][ T6508] __futex_wait+0x15f/0x400 [ 147.244302][ T6508] ? __pfx___futex_wait+0x10/0x10 [ 147.244344][ T6508] ? __pfx_futex_wake_mark+0x10/0x10 [ 147.244387][ T6508] ? srso_alias_return_thunk+0x5/0xfbef5 [ 147.244416][ T6508] ? try_to_wake_up+0x8c5/0x14d0 [ 147.244454][ T6508] ? srso_alias_return_thunk+0x5/0xfbef5 [ 147.244493][ T6508] futex_wait+0x121/0x390 [ 147.244534][ T6508] ? __pfx_futex_wait+0x10/0x10 [ 147.244591][ T6508] ? __local_bh_enable_ip+0xd6/0x140 [ 147.244629][ T6508] do_futex+0x3e7/0x4e0 [ 147.244659][ T6508] ? __inet_bind+0x438/0xaa0 [ 147.244689][ T6508] ? __pfx_do_futex+0x10/0x10 [ 147.244721][ T6508] ? srso_alias_return_thunk+0x5/0xfbef5 [ 147.244749][ T6508] ? __sys_bind+0x36b/0x410 [ 147.244784][ T6508] __se_sys_futex+0x3a8/0x450 [ 147.244825][ T6508] ? __pfx___se_sys_futex+0x10/0x10 [ 147.244857][ T6508] ? rcu_is_watching+0x16/0xb0 [ 147.244894][ T6508] ? srso_alias_return_thunk+0x5/0xfbef5 [ 147.244922][ T6508] ? __x64_sys_futex+0x21/0xf0 [ 147.244958][ T6508] do_syscall_64+0x166/0x520 [ 147.244990][ T6508] ? trace_irq_disable+0x3b/0x140 [ 147.245015][ T6508] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.245047][ T6508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.245071][ T6508] RIP: 0033:0x7f810579e159 [ 147.245093][ T6508] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.245112][ T6508] RSP: 002b:00007f81066c10e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 147.245138][ T6508] RAX: ffffffffffffffda RBX: 00007f8105a25fa8 RCX: 00007f810579e159 [ 147.245157][ T6508] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8105a25fa8 [ 147.245173][ T6508] RBP: 00007f8105a25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 147.245191][ T6508] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 147.245206][ T6508] R13: 00007f8105a26038 R14: 00007fffc5589890 R15: 00007fffc5589978 [ 147.245244][ T6508] [ 147.345025][ T6507] netlink: 'syz.0.190': attribute type 9 has an invalid length. [ 151.553959][ T6547] syzkaller0: entered promiscuous mode [ 151.553984][ T6547] syzkaller0: entered allmulticast mode [ 151.848411][ T6556] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 152.577098][ T6555] netlink: 'syz.3.207': attribute type 9 has an invalid length. [ 152.738428][ T5859] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 152.920082][ T5859] usb 2-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice= 1.00 [ 152.946487][ T5859] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 152.946736][ T5859] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 152.947733][ T5859] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.689298][ T5859] usb 2-1: USB disconnect, device number 3 [ 155.495847][ T6605] netlink: 'syz.4.226': attribute type 1 has an invalid length. [ 156.001815][ T6605] 8021q: adding VLAN 0 to HW filter on device bond1 [ 156.288821][ T6608] bond1: (slave ip6gretap1): making interface the new active one [ 156.294078][ T6608] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 156.582348][ T5757] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 156.934254][ T5757] usb 6-1: New USB device found, idVendor=0e8d, idProduct=0608, bcdDevice= 1.00 [ 156.989695][ T5757] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 156.989749][ T5757] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.951376][ T5757] usb 6-1: can't set config #1, error -71 [ 159.726694][ T6659] ======================================================= [ 159.726694][ T6659] WARNING: The mand mount option has been deprecated and [ 159.726694][ T6659] and is ignored by this kernel. Remove the mand [ 159.726694][ T6659] option from the mount to silence this warning. [ 159.726694][ T6659] ======================================================= [ 159.878318][ T5757] usb 6-1: USB disconnect, device number 2 [ 160.608901][ T6684] bridge_slave_0: left allmulticast mode [ 160.608931][ T6684] bridge_slave_0: left promiscuous mode [ 160.609196][ T6684] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.667674][ T5625] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 160.829847][ T5625] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 160.833087][ T5625] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 160.833137][ T5625] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 160.833165][ T5625] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 160.840053][ T5625] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 160.840079][ T5625] usb 3-1: Product: syz [ 160.840096][ T5625] usb 3-1: Manufacturer: syz [ 160.867669][ T6678] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 160.873395][ T5625] garmin_gps 3-1:1.0: Garmin GPS usb/tty converter detected [ 160.926915][ T5625] usb 3-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 161.116169][ T982] usb 3-1: USB disconnect, device number 3 [ 161.173345][ T982] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 161.174165][ T982] garmin_gps 3-1:1.0: device disconnected [ 161.927227][ T982] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 162.315389][ T982] usb 2-1: Using ep0 maxpacket: 16 [ 162.317531][ T982] usb 2-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 162.321275][ T982] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 162.321300][ T982] usb 2-1: config 0 has no interfaces? [ 162.321331][ T982] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.365276][ T982] usb 2-1: config 0 descriptor?? [ 162.674801][ T5757] usb 2-1: USB disconnect, device number 4 [ 162.736213][ T5625] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 162.897383][ T5625] usb 6-1: Using ep0 maxpacket: 32 [ 162.904526][ T5625] usb 6-1: unable to get BOS descriptor or descriptor too short [ 162.904575][ T5625] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 162.944174][ T5625] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 162.944202][ T5625] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 162.944225][ T5625] usb 6-1: config 14 has no interface number 0 [ 162.944243][ T5625] usb 6-1: config 14 has no interface number 1 [ 162.944307][ T5625] usb 6-1: config 14 interface 57 has no altsetting 0 [ 162.944328][ T5625] usb 6-1: config 14 interface 228 has no altsetting 0 [ 162.957532][ T5625] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.957558][ T5625] usb 6-1: Product: syz [ 162.957574][ T5625] usb 6-1: Manufacturer: syz [ 162.957590][ T5625] usb 6-1: SerialNumber: syz [ 163.620037][ T5625] legousbtower 6-1:14.57: interrupt endpoints not found [ 164.008717][ T5625] legousbtower 6-1:14.228: interrupt endpoints not found [ 166.436325][ T5859] usb 6-1: USB disconnect, device number 3 [ 166.792152][ T6804] netlink: 'syz.3.295': attribute type 9 has an invalid length. [ 166.885507][ T982] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 167.002337][ T6819] netlink: 'syz.4.298': attribute type 1 has an invalid length. [ 167.038121][ T982] usb 1-1: Using ep0 maxpacket: 16 [ 167.039011][ T982] usb 1-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 167.041320][ T982] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 167.041345][ T982] usb 1-1: config 0 has no interfaces? [ 167.041376][ T982] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.089849][ T982] usb 1-1: config 0 descriptor?? [ 167.166870][ T6819] 8021q: adding VLAN 0 to HW filter on device bond2 [ 167.234009][ T6821] macvlan2: entered promiscuous mode [ 167.234035][ T6821] macvlan2: entered allmulticast mode [ 167.249301][ T6821] bond2: entered allmulticast mode [ 167.249391][ T6821] bond2: entered promiscuous mode [ 167.250338][ T6821] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 167.275743][ T6821] team0: Port device macvlan2 added [ 167.312238][ T6831] net_ratelimit: 9 callbacks suppressed [ 167.312257][ T6831] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 167.521246][ T5625] usb 1-1: USB disconnect, device number 3 [ 168.240206][ T6838] orangefs_mount: mount request failed with -4 [ 168.632920][ T6847] device-mapper: dirty region log: invalid region size 1024 [ 168.632963][ T6847] device-mapper: table: 248:0: mirror: Error creating mirror dirty log (-EINVAL) [ 168.632983][ T6847] device-mapper: ioctl: error adding target to table [ 170.217573][ T6866] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 172.468171][ T5744] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 172.667060][ T5744] usb 3-1: Using ep0 maxpacket: 16 [ 172.670808][ T5744] usb 3-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 172.674983][ T5744] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 172.675002][ T5744] usb 3-1: config 0 has no interfaces? [ 172.675032][ T5744] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.709068][ T5744] usb 3-1: config 0 descriptor?? [ 173.030235][ T6898] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 173.048892][ T1017] IPVS: starting estimator thread 0... [ 173.129335][ T5625] usb 3-1: USB disconnect, device number 4 [ 173.145278][ T6901] IPVS: using max 34 ests per chain, 81600 per kthread [ 174.620145][ T6896] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 174.638317][ T982] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 174.673266][ T6896] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 174.796127][ T982] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 174.814483][ T982] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 33, changing to 9 [ 174.829154][ T982] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 33, changing to 9 [ 174.850376][ T982] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.850402][ T982] usb 6-1: Product: syz [ 174.850420][ T982] usb 6-1: Manufacturer: syz [ 174.850437][ T982] usb 6-1: SerialNumber: syz [ 174.908363][ T982] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 174.983466][ T982] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 175.020707][ T982] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 175.297173][ T6906] bridge_slave_0: left allmulticast mode [ 175.297202][ T6906] bridge_slave_0: left promiscuous mode [ 175.297425][ T6906] bridge0: port 1(bridge_slave_0) entered disabled state [ 175.335852][ T289] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.335892][ T289] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.335923][ T289] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.335957][ T289] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.839011][ T6907] netlink: 72 bytes leftover after parsing attributes in process `syz.5.328'. [ 176.965561][ T6909] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot clear input buffers, -110 [ 176.968410][ T5859] usb 6-1: USB disconnect, device number 4 [ 177.090422][ T5859] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 177.130378][ T5859] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 177.133488][ T5859] ti_usb_3410_5052 6-1:2.0: device disconnected [ 178.274474][ T7014] fuse: Bad value for 'fd' [ 178.423553][ T7019] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 179.113263][ T7014] orangefs_mount: mount request failed with -4 [ 180.299605][ T982] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 180.494804][ T982] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 180.577526][ T982] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 180.580464][ T982] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 180.581556][ T982] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 180.712836][ T982] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 180.712993][ T982] usb 1-1: Product: syz [ 180.713067][ T982] usb 1-1: Manufacturer: syz [ 180.938664][ T7044] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 180.941015][ T982] garmin_gps 1-1:1.0: Garmin GPS usb/tty converter detected [ 180.963158][ T982] usb 1-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 181.219357][ T982] usb 1-1: USB disconnect, device number 4 [ 181.403600][ T982] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 181.404361][ T982] garmin_gps 1-1:1.0: device disconnected [ 182.470735][ T7075] fuse: Bad value for 'fd' [ 182.637627][ T7077] netlink: 'syz.5.372': attribute type 9 has an invalid length. [ 183.883512][ T7075] orangefs_mount: mount request failed with -4 [ 183.959991][ T7096] overlayfs: overlapping lowerdir path [ 185.249079][ T5625] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 185.397594][ T5625] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 185.402013][ T5625] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 185.402064][ T5625] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 185.402092][ T5625] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 185.410063][ T5625] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 185.410089][ T5625] usb 3-1: Product: syz [ 185.410105][ T5625] usb 3-1: Manufacturer: syz [ 185.429582][ T7127] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 185.448622][ T5625] garmin_gps 3-1:1.0: Garmin GPS usb/tty converter detected [ 185.501528][ T5625] usb 3-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 185.674707][ T5625] usb 3-1: USB disconnect, device number 5 [ 185.731520][ T5625] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 185.739734][ T5625] garmin_gps 3-1:1.0: device disconnected [ 185.984698][ T5660] udevd[5660]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 186.067839][ T5652] udevd[5652]: inotify_add_watch(7, /dev/loop1, 10) failed: No such file or directory [ 186.070959][ T5660] udevd[5660]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 186.071411][ T5657] udevd[5657]: inotify_add_watch(7, /dev/loop3, 10) failed: No such file or directory [ 186.091496][ T6087] udevd[6087]: inotify_add_watch(7, /dev/loop4, 10) failed: No such file or directory [ 186.129672][ T7161] overlayfs: overlapping lowerdir path [ 186.409029][ T5649] udevd[5649]: inotify_add_watch(7, /dev/loop2, 10) failed: No such file or directory [ 188.501058][ T5649] udevd[5649]: inotify_add_watch(7, /dev/loop5, 10) failed: No such file or directory [ 190.918832][ T7206] syzkaller0: entered promiscuous mode [ 190.918861][ T7206] syzkaller0: entered allmulticast mode [ 191.192311][ T7221] overlayfs: overlapping lowerdir path [ 193.379693][ T7238] device-mapper: dirty region log: invalid region size 1024 [ 193.379737][ T7238] device-mapper: table: 248:0: mirror: Error creating mirror dirty log (-EINVAL) [ 193.379757][ T7238] device-mapper: ioctl: error adding target to table [ 193.631412][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.631490][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.005035][ T7286] netlink: 32 bytes leftover after parsing attributes in process `syz.5.427'. [ 200.481077][ T7311] syzkaller0: entered promiscuous mode [ 200.481097][ T7311] syzkaller0: entered allmulticast mode [ 200.670153][ T7315] netlink: 28 bytes leftover after parsing attributes in process `syz.0.438'. [ 201.425565][ T5744] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 201.655830][ T5744] usb 2-1: Using ep0 maxpacket: 16 [ 201.689809][ T5744] usb 2-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 201.809504][ T5744] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 201.811339][ T5744] usb 2-1: config 0 has no interfaces? [ 201.814944][ T5744] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.079870][ T5744] usb 2-1: config 0 descriptor?? [ 202.286913][ T7346] FAULT_INJECTION: forcing a failure. [ 202.286913][ T7346] name fail_futex, interval 1, probability 0, space 0, times 0 [ 202.286951][ T7346] CPU: 1 UID: 0 PID: 7346 Comm: syz.5.448 Not tainted syzkaller #0 PREEMPT(full) [ 202.286976][ T7346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 202.286990][ T7346] Call Trace: [ 202.287000][ T7346] [ 202.287010][ T7346] dump_stack_lvl+0xe8/0x150 [ 202.287058][ T7346] should_fail_ex+0x410/0x560 [ 202.287094][ T7346] get_futex_key+0x1b4/0x1580 [ 202.287140][ T7346] ? __pfx_get_futex_key+0x10/0x10 [ 202.287173][ T7346] ? srso_alias_return_thunk+0x5/0xfbef5 [ 202.287203][ T7346] ? update_se+0x90/0xff0 [ 202.287238][ T7346] ? srso_alias_return_thunk+0x5/0xfbef5 [ 202.287275][ T7346] futex_wait_setup+0x4a/0x590 [ 202.287321][ T7346] ? __futex_wait+0xdf/0x400 [ 202.287364][ T7346] __futex_wait+0x15f/0x400 [ 202.287413][ T7346] ? __pfx___futex_wait+0x10/0x10 [ 202.287456][ T7346] ? __pfx_futex_wake_mark+0x10/0x10 [ 202.287501][ T7346] ? srso_alias_return_thunk+0x5/0xfbef5 [ 202.287530][ T7346] ? try_to_wake_up+0x8c5/0x14d0 [ 202.287569][ T7346] ? srso_alias_return_thunk+0x5/0xfbef5 [ 202.287602][ T7346] futex_wait+0x121/0x390 [ 202.287643][ T7346] ? __pfx_futex_wait+0x10/0x10 [ 202.287695][ T7346] ? __fget_files+0x2a/0x420 [ 202.287737][ T7346] do_futex+0x3e7/0x4e0 [ 202.287767][ T7346] ? __fget_files+0x2a/0x420 [ 202.287808][ T7346] ? __pfx_do_futex+0x10/0x10 [ 202.287841][ T7346] ? srso_alias_return_thunk+0x5/0xfbef5 [ 202.287870][ T7346] ? __sys_bind+0x175/0x410 [ 202.287907][ T7346] __se_sys_futex+0x3a8/0x450 [ 202.287948][ T7346] ? __pfx___se_sys_futex+0x10/0x10 [ 202.287980][ T7346] ? rcu_is_watching+0x16/0xb0 [ 202.288018][ T7346] ? srso_alias_return_thunk+0x5/0xfbef5 [ 202.288053][ T7346] ? __x64_sys_futex+0x21/0xf0 [ 202.288090][ T7346] do_syscall_64+0x166/0x520 [ 202.288123][ T7346] ? trace_irq_disable+0x3b/0x140 [ 202.288149][ T7346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.288181][ T7346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.288206][ T7346] RIP: 0033:0x7faff759e159 [ 202.288228][ T7346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 202.288248][ T7346] RSP: 002b:00007faff57f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 202.288275][ T7346] RAX: ffffffffffffffda RBX: 00007faff7825fa8 RCX: 00007faff759e159 [ 202.288294][ T7346] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007faff7825fa8 [ 202.288311][ T7346] RBP: 00007faff7825fa0 R08: 0000000000000000 R09: 0000000000000000 [ 202.288326][ T7346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 202.288341][ T7346] R13: 00007faff7826038 R14: 00007ffc6555bfa0 R15: 00007ffc6555c088 [ 202.288380][ T7346] [ 202.567176][ T7347] overlay: Unknown parameter 'audit' [ 202.760046][ T5744] usb 2-1: USB disconnect, device number 5 [ 203.191944][ T7370] netlink: 28 bytes leftover after parsing attributes in process `syz.5.454'. [ 203.274371][ T7369] syzkaller0: entered promiscuous mode [ 203.274391][ T7369] syzkaller0: entered allmulticast mode [ 204.423507][ T7384] orangefs_mount: mount request failed with -4 [ 204.620740][ T7390] netlink: 4 bytes leftover after parsing attributes in process `syz.1.461'. [ 204.620825][ T7390] bridge_slave_1: left allmulticast mode [ 204.620848][ T7390] bridge_slave_1: left promiscuous mode [ 204.621083][ T7390] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.000679][ T7404] configfs-gadget.g1 gadget.0: HOST MAC b2:02:01:61:3a:4d [ 205.000709][ T7404] configfs-gadget.g1 gadget.0: MAC 82:97:e7:91:7b:b3 [ 205.615516][ T7404] udc dummy_udc.0: failed to start g1: -4 [ 205.615541][ T7404] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -4 [ 205.733439][ T7404] UDC core: g1: couldn't find an available UDC or it's busy [ 205.916565][ T7423] netlink: 28 bytes leftover after parsing attributes in process `syz.0.472'. [ 207.287036][ T7460] trusted_key: encrypted_key: insufficient parameters specified [ 207.290431][ T7460] trusted_key: encrypted_key: insufficient parameters specified [ 209.227454][ T7479] overlayfs: overlapping lowerdir path [ 209.429549][ T7461] syz.4.480 (7461): drop_caches: 1 [ 209.438011][ T7483] binder_alloc: 7481: binder_alloc_buf, no vma [ 210.825446][ T982] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 210.986195][ T982] usb 4-1: Using ep0 maxpacket: 16 [ 210.988283][ T982] usb 4-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 211.002282][ T982] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 211.002323][ T982] usb 4-1: config 0 has no interfaces? [ 211.002926][ T982] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.052276][ T982] usb 4-1: config 0 descriptor?? [ 211.711628][ T5764] usb 4-1: USB disconnect, device number 2 [ 211.935402][ T982] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 211.955891][ T7546] netlink: 'syz.0.502': attribute type 1 has an invalid length. [ 212.102705][ T7546] 8021q: adding VLAN 0 to HW filter on device bond1 [ 212.108126][ T982] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 212.109390][ T982] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 212.111319][ T982] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 212.117078][ T982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.117130][ T982] usb 5-1: Product: syz [ 212.117147][ T982] usb 5-1: Manufacturer: syz [ 212.117164][ T982] usb 5-1: SerialNumber: syz [ 212.158166][ T982] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 212.188180][ T7552] macvlan2: entered promiscuous mode [ 212.188202][ T7552] macvlan2: entered allmulticast mode [ 212.188514][ T7552] bond1: entered allmulticast mode [ 212.188554][ T7552] bond1: entered promiscuous mode [ 212.194414][ T982] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 212.201878][ T7552] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 212.215333][ T7552] team0: Port device macvlan2 added [ 212.247315][ T982] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 212.474069][ T7553] bond1: (slave ip6gretap1): making interface the new active one [ 212.474096][ T7553] ip6gretap1: entered promiscuous mode [ 212.474259][ T7553] ip6gretap1: entered allmulticast mode [ 212.489655][ T7553] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 212.574501][ T7558] ================================================================== [ 212.574518][ T7558] BUG: KASAN: slab-use-after-free in pn_bind+0x106/0xb20 [ 212.574561][ T7558] Write of size 8 at addr ffff888076b60800 by task syz.5.503/7558 [ 212.574590][ T7558] [ 212.574605][ T7558] CPU: 1 UID: 0 PID: 7558 Comm: syz.5.503 Not tainted syzkaller #0 PREEMPT(full) [ 212.574632][ T7558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 212.574646][ T7558] Call Trace: [ 212.574656][ T7558] [ 212.574666][ T7558] dump_stack_lvl+0xe8/0x150 [ 212.574704][ T7558] print_address_description+0x55/0x1e0 [ 212.574738][ T7558] ? pn_bind+0x106/0xb20 [ 212.574774][ T7558] print_report+0x58/0x70 [ 212.574804][ T7558] kasan_report+0x117/0x150 [ 212.574837][ T7558] ? pn_bind+0x106/0xb20 [ 212.574879][ T7558] pn_bind+0x106/0xb20 [ 212.574921][ T7558] usb_add_function+0x2e1/0x9f0 [ 212.574951][ T7558] ? check_remote_wakeup_config+0x58/0x1c0 [ 212.574986][ T7558] configfs_composite_bind+0xde0/0x1410 [ 212.575026][ T7558] ? __pfx_configfs_composite_bind+0x10/0x10 [ 212.575058][ T7558] gadget_bind_driver+0x2ca/0x9e0 [ 212.575090][ T7558] ? __pfx_gadget_bind_driver+0x10/0x10 [ 212.575113][ T7558] really_probe+0x254/0xae0 [ 212.575148][ T7558] __driver_probe_device+0x1e8/0x360 [ 212.575181][ T7558] driver_probe_device+0x4f/0x240 [ 212.575214][ T7558] __driver_attach+0x339/0x600 [ 212.575245][ T7558] bus_for_each_dev+0x23b/0x2c0 [ 212.575282][ T7558] ? __pfx___driver_attach+0x10/0x10 [ 212.575312][ T7558] ? __pfx_bus_for_each_dev+0x10/0x10 [ 212.575351][ T7558] ? srso_alias_return_thunk+0x5/0xfbef5 [ 212.575380][ T7558] ? do_raw_spin_unlock+0xf5/0x200 [ 212.575419][ T7558] bus_add_driver+0x345/0x670 [ 212.575461][ T7558] driver_register+0x23a/0x320 [ 212.575496][ T7558] usb_gadget_register_driver_owner+0xf9/0x270 [ 212.575538][ T7558] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 212.575570][ T7558] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 212.575598][ T7558] configfs_write_iter+0x337/0x430 [ 212.575627][ T7558] vfs_write+0x612/0xba0 [ 212.575670][ T7558] ? __pfx_vfs_write+0x10/0x10 [ 212.575713][ T7558] ? __fget_files+0x2a/0x420 [ 212.575750][ T7558] ? srso_alias_return_thunk+0x5/0xfbef5 [ 212.575782][ T7558] ksys_write+0x150/0x270 [ 212.575820][ T7558] ? __pfx_ksys_write+0x10/0x10 [ 212.575864][ T7558] do_syscall_64+0x166/0x520 [ 212.575896][ T7558] ? trace_irq_disable+0x3b/0x140 [ 212.575922][ T7558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.575950][ T7558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.575975][ T7558] RIP: 0033:0x7faff759e159 [ 212.575996][ T7558] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 212.576016][ T7558] RSP: 002b:00007faff57d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 212.576042][ T7558] RAX: ffffffffffffffda RBX: 00007faff7826090 RCX: 00007faff759e159 [ 212.576061][ T7558] RDX: 000000000000000b RSI: 0000200000000540 RDI: 0000000000000008 [ 212.576077][ T7558] RBP: 00007faff763506b R08: 0000000000000000 R09: 0000000000000000 [ 212.576093][ T7558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 212.576108][ T7558] R13: 00007faff7826128 R14: 00007faff7826090 R15: 00007ffc6555c088 [ 212.576138][ T7558] [ 212.576147][ T7558] [ 212.576153][ T7558] Allocated by task 6534: [ 212.576164][ T7558] kasan_save_track+0x3e/0x80 [ 212.576188][ T7558] __kasan_kmalloc+0x93/0xb0 [ 212.576213][ T7558] __kvmalloc_node_noprof+0x50f/0x820 [ 212.576239][ T7558] alloc_netdev_mqs+0xa9/0x12a0 [ 212.576260][ T7558] phonet_alloc_inst+0xa4/0x180 [ 212.576294][ T7558] usb_get_function_instance+0xe3/0x2f0 [ 212.576327][ T7558] function_make+0x127/0x360 [ 212.576348][ T7558] configfs_mkdir+0x4f6/0x9e0 [ 212.576373][ T7558] vfs_mkdir+0x40c/0x620 [ 212.576395][ T7558] filename_mkdirat+0x285/0x510 [ 212.576418][ T7558] __se_sys_mkdirat+0x35/0x150 [ 212.576442][ T7558] do_syscall_64+0x166/0x520 [ 212.576470][ T7558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.576493][ T7558] [ 212.576499][ T7558] Freed by task 7404: [ 212.576510][ T7558] kasan_save_track+0x3e/0x80 [ 212.576533][ T7558] kasan_save_free_info+0x40/0x50 [ 212.576571][ T7558] __kasan_slab_free+0x5c/0x80 [ 212.576596][ T7558] kfree+0x1c5/0x650 [ 212.576628][ T7558] pn_bind+0x131/0xb20 [ 212.576662][ T7558] usb_add_function+0x2e1/0x9f0 [ 212.576689][ T7558] configfs_composite_bind+0xde0/0x1410 [ 212.576718][ T7558] gadget_bind_driver+0x2ca/0x9e0 [ 212.576739][ T7558] really_probe+0x254/0xae0 [ 212.576767][ T7558] __driver_probe_device+0x1e8/0x360 [ 212.576793][ T7558] driver_probe_device+0x4f/0x240 [ 212.576821][ T7558] __driver_attach+0x339/0x600 [ 212.576847][ T7558] bus_for_each_dev+0x23b/0x2c0 [ 212.576880][ T7558] bus_add_driver+0x345/0x670 [ 212.576914][ T7558] driver_register+0x23a/0x320 [ 212.576944][ T7558] usb_gadget_register_driver_owner+0xf9/0x270 [ 212.576981][ T7558] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 212.577003][ T7558] configfs_write_iter+0x337/0x430 [ 212.577025][ T7558] vfs_write+0x612/0xba0 [ 212.577058][ T7558] ksys_write+0x150/0x270 [ 212.577091][ T7558] do_syscall_64+0x166/0x520 [ 212.577119][ T7558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.577142][ T7558] [ 212.577148][ T7558] The buggy address belongs to the object at ffff888076b60000 [ 212.577148][ T7558] which belongs to the cache kmalloc-cg-4k of size 4096 [ 212.577168][ T7558] The buggy address is located 2048 bytes inside of [ 212.577168][ T7558] freed 4096-byte region [ffff888076b60000, ffff888076b61000) [ 212.577193][ T7558] [ 212.577199][ T7558] The buggy address belongs to the physical page: [ 212.577210][ T7558] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76b60 [ 212.577231][ T7558] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 212.577250][ T7558] memcg:ffff8880286cc901 [ 212.577260][ T7558] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 212.577282][ T7558] page_type: f5(slab) [ 212.577303][ T7558] raw: 00fff00000000040 ffff88801b04b500 dead000000000100 dead000000000122 [ 212.577325][ T7558] raw: 0000000000000000 0000000200040004 00000000f5000000 ffff8880286cc901 [ 212.577348][ T7558] head: 00fff00000000040 ffff88801b04b500 dead000000000100 dead000000000122 [ 212.577370][ T7558] head: 0000000000000000 0000000200040004 00000000f5000000 ffff8880286cc901 [ 212.577392][ T7558] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 212.577413][ T7558] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 212.577426][ T7558] page dumped because: kasan: bad access detected [ 212.577437][ T7558] page_owner tracks the page as allocated [ 212.577446][ T7558] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4982, tgid 4982 (udevd), ts 44549417858 [ 212.577483][ T7558] post_alloc_hook+0x1f9/0x250 [ 212.577517][ T7558] get_page_from_freelist+0x2209/0x2280 [ 212.577542][ T7558] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 212.577574][ T7558] allocate_slab+0x7d/0x620 [ 212.577603][ T7558] refill_objects+0x2d5/0x350 [ 212.577634][ T7558] __pcs_replace_empty_main+0x2c8/0x6c0 [ 212.577663][ T7558] __kvmalloc_node_noprof+0x63c/0x820 [ 212.577688][ T7558] seq_read_iter+0x1ea/0xca0 [ 212.577713][ T7558] vfs_read+0x595/0xa80 [ 212.577745][ T7558] ksys_read+0x150/0x270 [ 212.577778][ T7558] do_syscall_64+0x166/0x520 [ 212.577807][ T7558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.577830][ T7558] page last free pid 1 tgid 1 ts 22004347762 stack trace: [ 212.577846][ T7558] free_pages_prepare+0x9eb/0xaf0 [ 212.577879][ T7558] __free_contig_range_common+0x174/0x340 [ 212.577908][ T7558] destroy_args+0x4e5/0x570 [ 212.577930][ T7558] debug_vm_pgtable+0x3f8/0x410 [ 212.577963][ T7558] do_one_initcall+0x250/0x870 [ 212.577996][ T7558] do_initcall_level+0x10a/0x1a0 [ 212.578031][ T7558] do_initcalls+0x59/0xa0 [ 212.578064][ T7558] kernel_init_freeable+0x29d/0x3e0 [ 212.578098][ T7558] kernel_init+0x22/0x1d0 [ 212.578132][ T7558] ret_from_fork+0x514/0xb70 [ 212.578152][ T7558] ret_from_fork_asm+0x1a/0x30 [ 212.578187][ T7558] [ 212.578193][ T7558] Memory state around the buggy address: [ 212.578206][ T7558] ffff888076b60700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 212.578222][ T7558] ffff888076b60780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 212.578238][ T7558] >ffff888076b60800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 212.578251][ T7558] ^ [ 212.578263][ T7558] ffff888076b60880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 212.578279][ T7558] ffff888076b60900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 212.578291][ T7558] ================================================================== [ 212.678279][ T7558] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 213.528066][ T7558] CPU: 1 UID: 0 PID: 7558 Comm: syz.5.503 Not tainted syzkaller #0 PREEMPT(full) [ 213.537245][ T7558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 213.547302][ T7558] Call Trace: [ 213.550561][ T7558] [ 213.553479][ T7558] vpanic+0x56d/0xa60 [ 213.557455][ T7558] ? __pfx_vpanic+0x10/0x10 [ 213.561949][ T7558] panic+0xc5/0xd0 [ 213.565683][ T7558] ? __pfx_panic+0x10/0x10 [ 213.570087][ T7558] ? preempt_schedule_thunk+0x16/0x40 [ 213.575442][ T7558] ? srso_alias_return_thunk+0x5/0xfbef5 [ 213.581054][ T7558] ? preempt_schedule_thunk+0x16/0x40 [ 213.586407][ T7558] ? pn_bind+0x106/0xb20 [ 213.590655][ T7558] check_panic_on_warn+0x89/0xb0 [ 213.595575][ T7558] ? pn_bind+0x106/0xb20 [ 213.599804][ T7558] end_report+0x73/0x170 [ 213.604031][ T7558] ? pn_bind+0x106/0xb20 [ 213.608258][ T7558] kasan_report+0x128/0x150 [ 213.612742][ T7558] ? pn_bind+0x106/0xb20 [ 213.616974][ T7558] pn_bind+0x106/0xb20 [ 213.621033][ T7558] usb_add_function+0x2e1/0x9f0 [ 213.625864][ T7558] ? check_remote_wakeup_config+0x58/0x1c0 [ 213.631663][ T7558] configfs_composite_bind+0xde0/0x1410 [ 213.637199][ T7558] ? __pfx_configfs_composite_bind+0x10/0x10 [ 213.643162][ T7558] gadget_bind_driver+0x2ca/0x9e0 [ 213.648168][ T7558] ? __pfx_gadget_bind_driver+0x10/0x10 [ 213.653688][ T7558] really_probe+0x254/0xae0 [ 213.658176][ T7558] __driver_probe_device+0x1e8/0x360 [ 213.663445][ T7558] driver_probe_device+0x4f/0x240 [ 213.668452][ T7558] __driver_attach+0x339/0x600 [ 213.673207][ T7558] bus_for_each_dev+0x23b/0x2c0 [ 213.678086][ T7558] ? __pfx___driver_attach+0x10/0x10 [ 213.683360][ T7558] ? __pfx_bus_for_each_dev+0x10/0x10 [ 213.688731][ T7558] ? srso_alias_return_thunk+0x5/0xfbef5 [ 213.694347][ T7558] ? do_raw_spin_unlock+0xf5/0x200 [ 213.699482][ T7558] bus_add_driver+0x345/0x670 [ 213.704161][ T7558] driver_register+0x23a/0x320 [ 213.708910][ T7558] usb_gadget_register_driver_owner+0xf9/0x270 [ 213.715059][ T7558] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 213.720676][ T7558] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 213.726812][ T7558] configfs_write_iter+0x337/0x430 [ 213.731908][ T7558] vfs_write+0x612/0xba0 [ 213.736145][ T7558] ? __pfx_vfs_write+0x10/0x10 [ 213.740923][ T7558] ? __fget_files+0x2a/0x420 [ 213.745504][ T7558] ? srso_alias_return_thunk+0x5/0xfbef5 [ 213.751125][ T7558] ksys_write+0x150/0x270 [ 213.755444][ T7558] ? __pfx_ksys_write+0x10/0x10 [ 213.760289][ T7558] do_syscall_64+0x166/0x520 [ 213.764864][ T7558] ? trace_irq_disable+0x3b/0x140 [ 213.769867][ T7558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.775919][ T7558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.781792][ T7558] RIP: 0033:0x7faff759e159 [ 213.786188][ T7558] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 213.805785][ T7558] RSP: 002b:00007faff57d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 213.814180][ T7558] RAX: ffffffffffffffda RBX: 00007faff7826090 RCX: 00007faff759e159 [ 213.822131][ T7558] RDX: 000000000000000b RSI: 0000200000000540 RDI: 0000000000000008 [ 213.830078][ T7558] RBP: 00007faff763506b R08: 0000000000000000 R09: 0000000000000000 [ 213.838026][ T7558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 213.845974][ T7558] R13: 00007faff7826128 R14: 00007faff7826090 R15: 00007ffc6555c088 [ 213.853933][ T7558] [ 213.857158][ T7558] Kernel Offset: disabled [ 213.861463][ T7558] Rebooting in 86400 seconds..