last executing test programs: 13.440831593s ago: executing program 2 (id=19): mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0) 13.193517352s ago: executing program 2 (id=21): r0 = open(&(0x7f00000003c0)='.\x00', 0x0, 0x166) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1ff, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0xa9525000) chmod(&(0x7f0000000040)='.\x00', 0x35e) 12.883677881s ago: executing program 0 (id=25): r0 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e02, 0xffffffff, @empty, 0x5}}, 0x0, 0x0, 0x23f, 0x0, "bb02a3c364ca41d6357e544524474004000b42a21d7214bf92494925208a0e2f964e0000c534a6324d6193fcf19b2df3ee818afaa4ff1f56c54dc46d8b6d2ccd008aa0cc1dc2767bbe00"}, 0xd8) r1 = socket$kcm(0x23, 0x5, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000002c0)={'veth0_to_team\x00', 0xc201}) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) listen(r1, 0x800) accept4(r1, 0x0, 0x0, 0x80000) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfd"], 0x78) connect$can_bcm(r0, &(0x7f00000000c0), 0x10) connect$can_bcm(r0, &(0x7f0000000000), 0x10) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r3, &(0x7f00000001c0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0xfffc, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f00000000c0)={0xfd, 0x0, 0xfe, 0x22, 0x0, 0x7, 0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3}, 0xe) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') preadv(r4, &(0x7f0000000340)=[{&(0x7f0000000180)=""/112, 0x70}], 0x1, 0x0, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r4, 0xc010643a, &(0x7f0000000200)={0x0, 0x3, 0x401}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc35d4f6d52288271}, 0x200048c4) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMK(r4, &(0x7f0000000480)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYRES64=r5, @ANYRES16=r6, @ANYBLOB="09042cbd7000fddbdf257c00000008000300", @ANYRES32=r7, @ANYBLOB="0c00990008000000060000000a00060008021100000100000a0006000802110000000000"], 0x40}, 0x1, 0x0, 0x0, 0x20008014}, 0x2000050) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000040)=0x10001, 0x4) shutdown(r3, 0x1) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_VOICE(r8, 0x112, 0x13, 0x0, 0x0) recvmmsg(r3, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) 12.662865482s ago: executing program 3 (id=26): socket$inet6_mptcp(0xa, 0x1, 0x106) socket$kcm(0x11, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) r1 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x288082, 0x52) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$SNDCTL_SYNTH_ID(r1, 0xc08c5114, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101401, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f0000000140)={'dt2814\x00', [0x294, 0x7, 0x7fffffff, 0x8, 0x2c, 0x2006, 0xf5, 0x4, 0x8080ffa, 0x5, 0x7, 0x9, 0x0, 0x6, 0x1, 0x5, 0xfff7ffa8, 0x7ffffff9, 0x1ef, 0x1, 0x2000000f, 0x9, 0x8, 0xb, 0x4, 0x100088, 0x6, 0xc, 0xee, 0x4, 0x7ffe]}) 10.53923196s ago: executing program 1 (id=28): syz_usb_connect(0x6, 0x371, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x48885) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000400)='./sys/bus/pci/rescan\x00', 0x1f7) r2 = syz_open_dev$usbfs(&(0x7f0000000140), 0x80, 0x113201) read$usbfs(r2, &(0x7f0000000600)=""/234, 0xea) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000240), r1) write(r3, &(0x7f00000000c0)='1\x00', 0x1) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x10000082}, 0x4044841) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000008c0), 0x103000, 0x0) ioctl$KVM_GET_MSRS_sys(r4, 0xc008ae88, &(0x7f00000003c0)={0x1, 0x0, [{0x8b, 0x0, 0x8}]}) 10.450164361s ago: executing program 3 (id=29): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'s526\x00', [0x100, 0x202, 0x2, 0x10, 0x81, 0x15, 0x1, 0xfffffffa, 0x6, 0x7fd, 0x80000a, 0x80000000, 0x7, 0x2, 0x0, 0xfffffffd, 0xfffffffe, 0x20007, 0x100003, 0x82000000, 0x489, 0x7, 0x7ffffffd, 0x2, 0xffffffff, 0x3, 0xb, 0x8, 0x6, 0xffffffff, 0xfffffff8]}) 10.264268788s ago: executing program 0 (id=31): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) modify_ldt$read(0x0, &(0x7f0000002140)=""/4098, 0xfffffffffffffe8e) 9.311581257s ago: executing program 3 (id=33): socket$nl_netfilter(0x10, 0x3, 0xc) mknodat$loop(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1004, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) socket(0x10, 0x803, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x9) syz_clone(0x2280700, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xfffff000) 8.545499762s ago: executing program 2 (id=34): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001880)=ANY=[@ANYBLOB="900b0000", @ANYRES16=r1, @ANYBLOB="010028bd70000000000001000000c404088070040080e801098088000080060001000a00000014000200000000000000000000000000000000000500030002000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200640101020500030003000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000040000801c0000800600010002000000080002007f0000010500030002000000b8000080060001000a00000014000200ff0200000000000000000000000000010500030001000000060001000a00000014000200fe8000000000000000000000000000bb0500030003000000060001000a00000014000200000000000000000000000000000000010500030003000000060001000200000008000200ac1e00010500030001000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414aa050003000100000044000080060001000a0000001400020000000000000000000000ffffac1414bb0500030001000000060001000a00000014000200fc02000000000000000000000000000005"], 0xb90}, 0x1, 0x0, 0x0, 0x4004840}, 0x2000000) 7.904242777s ago: executing program 4 (id=35): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/nd/drivers/nd_pmem/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='namespace0.0', 0xc) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f0000000340), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/nd/drivers/nd_pmem/bind\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='pfn0.0', 0x6) 6.244943181s ago: executing program 0 (id=36): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f0000000000)=0x2, 0x4) socket$unix(0x1, 0x2, 0x0) socket$igmp6(0xa, 0x3, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0xffffffffffffffff, 0x0, 0x7fffffff, 0x6}, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4) bind$rds(r0, &(0x7f0000000100)={0x2, 0x4e29, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4, 0x1a000}], 0x1, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x42}], 0x18}, 0x4000000) 6.243858076s ago: executing program 1 (id=37): syz_usb_connect(0x6, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x48885) syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) getpid() mkdirat(0xffffffffffffffff, &(0x7f0000000400)='./sys/bus/pci/rescan\x00', 0x1f7) r1 = syz_open_dev$usbfs(0x0, 0x80, 0x113201) read$usbfs(r1, &(0x7f0000000600)=""/234, 0xea) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r2, &(0x7f00000000c0)='1\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)="3100d90daaa91f198d99db922334963f621e49a6ca0b870113948d1bd6e243e5da22cf2ba7bca0e3865eaa6666cca12e329a784c6e63a08e7d57f2e2a6fa1f85d8a30f16645140e37208d917f43c0e86486bb3e9fd67f758c7f029fcbacd68c67fd996ba190681103b5cb8dbd189543ac4d64867e39469625a900852b3220d4788d9f52245fb79fec8cffbcf9a5d9764a4d5c3af2d283279ca35f820d073a1f7a0e134b89c8a9433c78e6698004ab5f3584de90135190d323bf6d75843821518979868ae7c7734c0", 0xc8) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000008c0), 0x103000, 0x0) ioctl$KVM_GET_MSRS_sys(r4, 0xc008ae88, &(0x7f00000003c0)={0x1, 0x0, [{0x8b, 0x0, 0x8}]}) 6.243319074s ago: executing program 4 (id=38): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmsg$rds(r1, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000f00)=[@mask_cswp={0x58, 0x114, 0x9, {{0x7f, 0x5}, 0x0, 0x0, 0x2, 0x7, 0x7ea, 0x0, 0x6c, 0x80000000}}, @mask_cswp={0x58, 0x114, 0x9, {{0x3, 0xf}, 0x0, 0x0, 0x4, 0x0, 0x2, 0x8000000000000001, 0x5a, 0x800}}], 0xb0, 0x10}, 0x44010) 6.241967642s ago: executing program 3 (id=39): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fchmod(r0, 0x128) 6.191889358s ago: executing program 2 (id=40): r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) close(0xffffffffffffffff) shutdown(0xffffffffffffffff, 0x0) syz_open_pts(r0, 0x2000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002940)=@newtfilter={0xea4, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe70, 0x2, [@TCA_MATCHALL_ACT={0xe6c, 0x2, [@m_pedit={0xe68, 0x3fff, 0x0, 0x0, {{0xa}, {0xe3c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x2, 0x9, 0x20000000, 0x6}, 0x1, 0xfb}, [{0x2, 0x9c, 0x9, 0x5, 0x2, 0x7}, {0x0, 0x6, 0x4, 0x10000, 0xfffffffd, 0x81}, {0x1, 0x1, 0x8, 0x101, 0x1}, {0x3, 0x3, 0x1000, 0x7, 0x5, 0x4}, {0xf, 0x7, 0x9, 0x51, 0x200004}, {0x3, 0x8004, 0xc, 0x101, 0x103, 0x84b5}, {0x9c, 0x4, 0x9, 0x2, 0x487, 0x8}, {0x1, 0x10000, 0x5, 0x4, 0x3, 0x8000}, {0x7, 0x9, 0x1ff, 0x8, 0x2, 0x7fff}, {0x439356e7, 0x60b, 0x16, 0xfffffffc, 0x10000, 0x6}, {0x5, 0x3, 0x8, 0x3, 0x400000, 0xffffffff}, {0x5, 0xfffffff8, 0x7, 0x7, 0x8, 0x5}, {0x5, 0x8, 0xfffffffe, 0x5, 0xfffff000, 0x7}, {0x768d, 0xcd, 0x8, 0x7, 0x5, 0x10000}, {0xfffffffe, 0xfffffffb, 0x6, 0x5, 0x7ff, 0x5}, {0x240, 0x6, 0xfffffffe, 0x6, 0x2}, {0xfffff9fd, 0x49, 0xa5f, 0xa, 0x5, 0x2}, {0x6, 0x9, 0x167, 0x2, 0x71, 0xa2}, {0x140, 0x2, 0xc, 0x6, 0x87}, {0x5, 0xa, 0x2, 0x4, 0x3, 0x2000}, {0x32d, 0x2008, 0x7fff, 0x4, 0x8, 0x9}, {0x6, 0x200, 0x58fe, 0x7ff, 0x4, 0x3}, {0x101, 0xd, 0x101, 0x0, 0x3, 0x4}, {0x0, 0x3, 0x1, 0x7437ec78, 0x2, 0x53f9}, {0xffffffff, 0x1, 0x9, 0x0, 0x1, 0x4}, {0xc, 0x80000e, 0x0, 0x3, 0x8, 0x81}, {0x3, 0x3, 0x8006, 0xe, 0x0, 0x80}, {0xd, 0x638c, 0x7ff, 0x0, 0x80000000, 0x2}, {0x4, 0xb, 0x6c5f1878, 0x57c4, 0x8, 0x25ff}, {0x4, 0xd, 0x1fadd976, 0x3071, 0x0, 0x7fffffff}, {0x5, 0x800, 0x3, 0x3, 0x3, 0x9}, {0x9, 0x1ff, 0xffc, 0x20009c, 0x1, 0x5}, {0x9, 0xd76, 0x6, 0xdc2, 0xa16a, 0x2}, {0x1ff, 0x1, 0x1000007, 0x5, 0x6, 0xffffffff}, {0x1, 0x32158140, 0x0, 0x8, 0x6, 0x7}, {0xe, 0x4, 0x9000, 0x5, 0x2, 0x7f}, {0x3, 0x2ec74d53, 0x0, 0x0, 0x8, 0x2}, {0x5, 0xfff, 0xffffff13, 0x6, 0x7f, 0x6}, {0x1, 0x6, 0x3, 0x4, 0xff8, 0xc}, {0x6, 0x6, 0x1ff, 0xb, 0x7ff, 0x8001}, {0x4, 0xffffffff, 0x0, 0xfffff740, 0x4, 0x4}, {0xffff, 0x5, 0x7, 0xac, 0xf}, {0x5, 0x3, 0x6, 0xfff, 0x4, 0x8001}, {0xd, 0x3, 0x7, 0x0, 0xffffff81, 0x7ff}, {0xfffffffb, 0x2, 0x1ff, 0x5d, 0xffff8001, 0x800000}, {0x0, 0x6, 0x7ffc, 0x9, 0x500, 0x7}, {0x1, 0xffffffff, 0x834, 0x7, 0x0, 0x3}, {0x7fff, 0x6, 0x0, 0x2002, 0x6, 0x8}, {0xf61, 0x101, 0x9, 0x2, 0x80000000, 0x7fff}, {0x8c7, 0x1, 0x8, 0x2, 0xffff, 0x1ffffffe}, {0x0, 0x5, 0x1, 0xffff, 0x3, 0x3}, {0x9, 0x10001, 0x9f98, 0xbb, 0x8, 0x66a}, {0xfff, 0x6, 0x8, 0x80000001, 0x0, 0x7f}, {0xff, 0x6, 0x7f, 0x5, 0x3, 0xb}, {0x4, 0x4b, 0x0, 0x1, 0x7f, 0x7fffffff}, {0xfff, 0x47e4, 0x1, 0xffffffff, 0x80000001, 0x9}, {0x3, 0x4, 0x7, 0x6, 0x8, 0xe5}, {0x9, 0x9, 0x1, 0x9, 0x0, 0x2}, {0x8, 0x80000001, 0x7fff, 0x8, 0xfffffffe, 0x8}, {0x80000001, 0x8, 0x5202, 0x2, 0x53ce, 0x3}, {0x6, 0x4, 0x8, 0x8, 0x7f, 0x80000000}, {0xfffffff9, 0x9, 0x6, 0x6, 0x9, 0x3}, {0xfffffffd, 0x8, 0x6, 0x5, 0x3, 0x8f}, {0x741, 0x0, 0x9, 0x7fffffff, 0x2, 0x200}, {0x401, 0x2, 0x8, 0x4, 0x7ffc, 0xc6e9}, {0x1, 0x2d73, 0x400, 0x5, 0x9f17, 0xffffff7f}, {0x10000, 0x401, 0x2b00, 0xfffff57b, 0xfffffc00, 0xd}, {0x3, 0x4, 0xc52b, 0x9, 0x5, 0xff}, {0x0, 0x4, 0x401, 0xffffffff, 0x1, 0xe}, {0x8, 0x2, 0x1, 0x2, 0x10, 0x1}, {0xff, 0x8, 0x6, 0x5, 0xff, 0x5}, {0x2, 0xb15ce2d, 0x80000001, 0xbeab, 0x4, 0x5}, {0x3, 0x18, 0x3, 0x7, 0x8, 0x4}, {0xfff, 0x9, 0x6, 0x3, 0x100, 0x57}, {0x9, 0x5, 0x8, 0x3, 0xa, 0x2}, {0xb3, 0xe, 0x3, 0x7e8, 0x7, 0x9}, {0x400000ff, 0x7, 0x5, 0x10001, 0x2, 0x6}, {0x1, 0x8, 0xb0, 0xffffff46, 0x4, 0x88000000}, {0x9, 0x2, 0xfffffffc, 0x1, 0xd52, 0x3}, {0xd203, 0x7, 0x1, 0x10000, 0x43, 0x1ff}, {0x1004, 0x3ff, 0xffffffff, 0x1, 0x5, 0x100}, {0x1ff, 0x3, 0x802, 0xfffffff8, 0x1ff, 0x68}, {0x7, 0x20, 0x83ff, 0x1, 0x7, 0x4}, {0x0, 0x6, 0x0, 0x6, 0xffff0001, 0xcca}, {0x7, 0x1, 0xfffffff1, 0x3ff, 0x100, 0x4}, {0x3, 0x9, 0x0, 0x400, 0x4, 0x80000009}, {0x9, 0x0, 0x8001, 0x7, 0x2, 0x2}, {0x5, 0xfff, 0x9, 0x5, 0xb5, 0x3}, {0x10, 0x1, 0x1, 0x5, 0x96e, 0xfff}, {0x7, 0x5, 0x2, 0xa5f, 0x0, 0xfffff9de}, {0x9, 0xffffffff, 0xe6b, 0xb, 0xb, 0x8}, {0x9, 0xffffff11, 0x1, 0x2, 0xff, 0x52e2}, {0x0, 0x1, 0x0, 0x7, 0xdb, 0x6}, {0x7, 0x400, 0x9, 0x8, 0xa, 0x104}, {0x81, 0x8, 0x988, 0x1, 0x0, 0x7}, {0xdc03, 0x7, 0x80, 0x8, 0xfffffff9, 0x4}, {0xa, 0xfffffffe, 0x1, 0x1ff, 0x1ff, 0xc1b7}, {0xa24b, 0x947d, 0x40, 0x4, 0x9, 0x9}, {0x9, 0x401, 0xa89, 0x5ef, 0x9, 0x8}, {0x4, 0x7fff, 0x0, 0x4, 0x7fffffff}, {0x3, 0xb8c, 0x6, 0x21761f6a, 0x1, 0x4}, {0xfff, 0xda, 0x1d, 0x4, 0x8, 0x2}, {0x8, 0x10, 0x100, 0x0, 0xfffffff7, 0xc}, {0xfffff001, 0x8, 0xe96, 0x9, 0x9, 0x34b0}, {0x4, 0x8, 0x8, 0x3, 0x6cf4, 0x1}, {0x3, 0x3, 0x7, 0x5, 0xbe, 0x81}, {0x4, 0x800, 0x4000, 0x5, 0x8, 0xfa2f}, {0x3, 0x8d, 0x81, 0x2, 0x8, 0x6}, {0x9, 0xfed, 0x6, 0x4, 0xf, 0x5}, {0x100, 0x1, 0x2, 0xffffffff, 0x9, 0x74}, {0x4, 0x4, 0x8, 0x1, 0x0, 0x3}, {0x2, 0xfffffffb, 0xffffffff, 0x62f, 0x401, 0x30564e0}, {0x9a2f, 0x800, 0x8, 0x1, 0x80000000}, {0x20000009, 0x2, 0x7fd, 0x200, 0x9, 0xb}, {0x47, 0x6, 0x8936, 0xdcb, 0x3, 0x2}, {0x6, 0x80000000, 0x8, 0xe, 0xfffffffa, 0x8de3}, {0x1000, 0x9, 0x9, 0xfff, 0x6, 0x1ff}, {0x8195, 0x2, 0x1000}, {0x1, 0x50, 0xff, 0x9e11, 0x5, 0x3}, {0x7fff, 0x6, 0x0, 0x5, 0x8000, 0x8}, {0x7ff, 0x9, 0x9, 0x6, 0x9, 0xe77}, {0x1, 0x5e12, 0x3, 0xfffffffa, 0x2, 0x80000001}, {0xffffff8c, 0x9, 0x1, 0x1, 0x10, 0x5}, {0x7, 0x7, 0x104, 0x78d, 0xffffcff7, 0x9}, {0x1, 0xe, 0x7, 0x2, 0x2, 0x207f}, {0xf, 0x5, 0xfffffffa, 0xff, 0x80000, 0xfff}, {0x1, 0x7ff, 0x696e, 0xa, 0x49d, 0xb}, {0x9bf4, 0x0, 0x5, 0x3, 0x20003, 0x1000}], [{0x1, 0x1}, {0x2}, {}, {0x2}, {0x2, 0x745e81639ff0f356}, {0x4, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x2}, {0x3}, {}, {}, {0x2}, {0x4}, {}, {0x2}, {0x0, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x2}, {0x5}, {0x2}, {0x1, 0x1}, {0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x4}, {0x3, 0x1}, {0x5, 0x1}, {0x36bc5bece03d104f}, {0x4, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {}, {0xa}, {0x3}, {0x3, 0x1}, {0x2}, {0x3}, {0x4, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {}, {0x2}, {0x4}, {0x4, 0x1}, {0x4, 0x1}, {0x4}, {0x2}, {0x2, 0x1}, {0x5, 0x3}, {0x4, 0x1}, {0x1}, {0x4}, {0x0, 0x1}, {0x2}, {0x1, 0x1}, {0x0, 0x1}, {0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {}, {0x2, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x3}, {0x6}, {0xa, 0x1}, {0x3, 0x1}, {}, {0x5, 0x1}, {0x1}, {0x4}, {0x5}, {0x2590228f88cc2931}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x5, 0x1}, {0x6}, {0x2}, {0xb82e57098c7a44ef, 0x1}, {0x3, 0x1}, {0x1}, {0x6, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x5}, {0x0, 0x1}, {0x4}, {0x4}, {0x0, 0x1}, {0x2}, {0x4, 0x1}, {0x1}, {0x1, 0x1}, {}, {0x3}, {0x1, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x3}, {0x4}, {0x5}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x0, 0x1}, {0x4}, {0x4, 0x1}, {0x1}, {0x5, 0x1}, {0x4}, {0x0, 0x1}, {0x3}, {0x1}, {0x0, 0x1}, {0x4}], 0x1}}, @TCA_PEDIT_KEYS_EX={0x18, 0x5, 0x0, 0x1, [{0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}]}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xea4}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r6, &(0x7f0000002900)={&(0x7f0000000340)=@xdp={0x2c, 0x8, r9, 0x109}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000280)='k', 0x1}], 0x1}, 0x20000885) 5.800983491s ago: executing program 4 (id=41): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000bc0), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000001180)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r1, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f00000001c0)={0x24, r0, 0x1, 0x70bd27, 0x25dfdbc0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SEC_OUT_LEVEL={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40011}, 0x20048414) 4.540903064s ago: executing program 4 (id=42): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x0, 0x2) 4.395952837s ago: executing program 0 (id=43): syz_emit_vhci(&(0x7f0000000300)=@HCI_EVENT_PKT={0x4, @hci_ev_mode_change={{0x14, 0x6}, {0x6, 0xc9, 0x0, 0x5a}}}, 0x9) 3.152622153s ago: executing program 2 (id=44): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x2, 0x0, 0x0) 3.086583403s ago: executing program 0 (id=45): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c80000001010203010902200001010080000904"], 0x0) syz_usb_connect$uac1(0x5, 0xa6, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000406b1d010140000102030109029400030105a0090904000000010100000a2401f7ff0702010209200303000303030b052405060709040100001ae80000090401010101"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000040)=ANY=[@ANYBLOB="400108000000ebaa55"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.008172452s ago: executing program 1 (id=46): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, &(0x7f0000000200)={{0x1, 0x200, 0x400, 0x800, 0xfffffff9, 0x4}, 0xa7, [0x5, 0x8, 0x0, 0x9, 0x3, 0x10001, 0x4b, 0x6, 0x401, 0x7, 0xa64, 0x5a, 0x135, 0x40, 0x1c83, 0x400, 0x0, 0xfe5, 0x8000, 0x0, 0x2c, 0xa, 0xfffffffe, 0xfffff2eb, 0x6, 0x1, 0x1, 0x5, 0x7, 0x7ff, 0x3, 0x0, 0x6, 0x5, 0x1, 0x4, 0x5, 0x8000, 0x1, 0x2, 0x1, 0x9fb6, 0x1, 0x6, 0x7, 0x2, 0x5, 0x1, 0x3, 0x5eb, 0x5, 0x0, 0x0, 0xfff, 0x3815, 0x7, 0x45, 0xfeb4, 0x3, 0x2, 0x0, 0x8, 0x7, 0x7d8, 0x6, 0x7620, 0x2, 0x7, 0x3, 0x5, 0x80000001, 0x3, 0x9, 0xee8, 0xf17, 0x3, 0x7, 0x81, 0x3, 0x0, 0xff, 0x2, 0x7f, 0xffff, 0x7, 0x401, 0xffff, 0x5, 0x6, 0x1000, 0x7fffffff, 0xf, 0x7, 0x7, 0x0, 0x8a, 0x8, 0x6599ae0, 0x0, 0x100, 0x7, 0x7, 0x3, 0x3, 0x7fff, 0x5, 0x3, 0xe, 0x3, 0xfffffffb, 0x1ff, 0x5, 0x8, 0xffffa352, 0x0, 0x0, 0xe6ea756, 0x0, 0xf90, 0x6, 0x2, 0x6120, 0x3, 0x40, 0x4, 0x1, 0x1, 0x6, 0x3, 0x3, 0x7, 0xffff, 0x8001, 0xfffffffc, 0x6a2c, 0x0, 0x9, 0x7, 0x2, 0xa6, 0x3, 0x1, 0x9, 0x4, 0x9, 0x5, 0xfffffffe, 0x2, 0x2, 0x6, 0x7, 0xffffff2a, 0x10000, 0x9, 0x25cfd110, 0x8001, 0x6, 0xe, 0x9, 0x9, 0x8001, 0x5, 0x9, 0x8000, 0x8, 0xfffeffff, 0x7, 0x7, 0x401, 0x2, 0x4, 0x5, 0x0, 0x5, 0x800, 0x4, 0xfffff37d, 0xa8b, 0x9, 0xf3c, 0x10001, 0x4f475145, 0x6, 0x400, 0x9, 0x2, 0xf, 0xfffffff8, 0x8, 0x9, 0xfffff1ca, 0x8, 0x3ff, 0x4, 0xffffffff, 0x2, 0x9, 0x80, 0x7, 0x1ff, 0x0, 0x2, 0x7, 0x9, 0x100, 0x6, 0x8, 0x0, 0x5, 0x7fff, 0x0, 0x9, 0x0, 0x101, 0xae, 0x80, 0x8, 0x0, 0x7, 0x1064, 0x8, 0x5, 0x2, 0x40, 0x1, 0x7, 0x10000, 0x9, 0x3, 0x9, 0x100, 0x3f, 0x9, 0xb, 0xe6, 0x6, 0xb2b, 0x1, 0xfb, 0x8001, 0x8, 0x4, 0x15280000, 0x4, 0x5, 0x8001, 0x8, 0x6, 0x1, 0x3, 0x1, 0xfffffffb, 0x91fc, 0x5, 0xf78, 0x7, 0x5, 0x8000, 0x2, 0x6, 0x80000000, 0x1000, 0xadda, 0x8, 0x9, 0x8, 0x0, 0x6, 0x1, 0x4, 0x2, 0x9, 0x400, 0x8, 0xfffffffc, 0x2, 0x7ff, 0x7fff, 0x7ff, 0x5, 0x6, 0x0, 0x3, 0x7b8, 0x6, 0x6, 0x78e, 0x1, 0xb, 0x9, 0x0, 0xfffffff7, 0x0, 0x7, 0xb, 0x800, 0x6, 0xffff7fff, 0x401, 0x5, 0x71389031, 0x7, 0xc, 0xc, 0x0, 0xda, 0x2, 0xe, 0x5, 0x9, 0x10000, 0xb, 0x39, 0x9, 0x3, 0x2, 0x8001, 0x9, 0x9, 0xffffffff, 0x8, 0x9, 0xe2, 0x80000001, 0xb36, 0x4a24, 0xf, 0x5d, 0xb, 0x8, 0x1, 0x7, 0xff, 0x1, 0x8, 0x2, 0x2, 0xff, 0x9, 0xc194, 0x2, 0x81, 0x5, 0x1, 0x26df1695, 0x7, 0x6, 0x1ff, 0x1, 0x1, 0x5, 0x6, 0x2, 0x0, 0x1624, 0x9, 0x0, 0x1, 0x4, 0xd6, 0x200, 0xa, 0x4, 0x7f, 0x0, 0xbf, 0x2, 0x401, 0x4, 0x5, 0x80000001, 0x4, 0xd16, 0x4, 0x5, 0x5, 0x5, 0x80000000, 0x2, 0x3ff, 0x1, 0x8000, 0x8, 0x3, 0xdca1, 0x4, 0x8, 0x8, 0x4bac, 0x3, 0xee, 0x1ffe000, 0x7f, 0x9, 0x58, 0x101, 0x4, 0x3, 0x4, 0x6, 0x200, 0x0, 0xfffffff8, 0x7, 0x1ff, 0xe, 0x15bc, 0x80d, 0x3, 0x2, 0x5, 0x4, 0x80000000, 0x9, 0x80, 0x4f0f, 0x71, 0x9, 0x3ad5, 0x5, 0x0, 0x8, 0x0, 0x1, 0x3, 0x7, 0xb7f, 0x8, 0x6, 0x7, 0xa454, 0x10000, 0x2, 0x9, 0x4, 0x9, 0xc524, 0x3c, 0x5, 0x6, 0x9397, 0x6, 0x101, 0x800, 0x54, 0x1, 0x7, 0x7fffffff, 0x2, 0x9, 0x2, 0x8, 0x5, 0x9, 0x5, 0x0, 0xd3ef, 0xd, 0xfffffffd, 0x7, 0x4, 0x4, 0x3, 0xb, 0x5, 0x3, 0x0, 0xe0, 0xfffffffe, 0x6, 0x1000, 0xffffff1d, 0x4, 0x9, 0x3, 0x10, 0xcbb, 0x200, 0x8, 0x4, 0xb, 0x7, 0xd1, 0x21e456d6, 0x401, 0xd, 0x9, 0x10000, 0x9, 0xa3e8, 0xe6f, 0x6, 0xc02, 0xe, 0x4, 0x2, 0x10, 0x1, 0x80000001, 0x4, 0x100, 0x7ff, 0x3, 0x7bd7, 0x4, 0x10, 0xf77c, 0x80000001, 0xe, 0x400, 0x3, 0x101, 0x8, 0x0, 0x10000, 0x5, 0x4, 0x3ff, 0x2, 0xc986, 0x6, 0xfc8c, 0x8c, 0x8000, 0x4f19, 0x0, 0xffff, 0x401, 0x0, 0x7, 0x1, 0x52, 0x3a81, 0xe, 0x3, 0x9, 0x2, 0x2, 0x1, 0x2, 0x1, 0x8, 0x5, 0x81, 0x9, 0x7, 0x7fff, 0x0, 0x0, 0x4, 0x0, 0x6, 0x7, 0x5, 0x3, 0x2, 0x7fffffff, 0x3, 0x401, 0xc5, 0x7, 0xe, 0x3, 0xff, 0x9, 0x5f08, 0x2, 0x8, 0x2, 0x4, 0x6, 0x976, 0x7ff, 0x0, 0x8, 0x8, 0x0, 0xbe6, 0x9, 0xbf68, 0x3ff, 0x3, 0x1, 0x3, 0xfff, 0x1, 0x669f1a78, 0x5, 0x3, 0x0, 0x1000, 0x84d, 0x3, 0xfff, 0x7, 0x3de, 0x4, 0x7fffffff, 0x5, 0x3, 0x8, 0x2830589f, 0x6, 0x0, 0x51d, 0x8, 0x7fff, 0xdf9, 0x6, 0x7fffffff, 0x80000000, 0x0, 0x7ff, 0x2, 0x1, 0x1, 0x639000, 0x121d, 0xe9, 0x7fff, 0x7fff, 0xf, 0xffff, 0x9, 0x2, 0x8, 0x6, 0xb, 0x9, 0x3, 0x5, 0x1000, 0x7, 0x0, 0x9f49, 0x8, 0x7fff, 0x2, 0x7b, 0xa60, 0x3cda, 0x4, 0x8, 0xc, 0x2, 0x9, 0xe, 0x5, 0xc, 0x7, 0x2a2, 0x7, 0x101, 0x6000000, 0x1, 0x0, 0xfff, 0x0, 0x400, 0xc5b1, 0x79, 0x1, 0x2, 0x3, 0x2, 0x6, 0x18, 0x3, 0x5, 0x101, 0x5, 0x27e, 0x9, 0x0, 0x25dc, 0x7, 0x154a8000, 0x10000, 0x80000000, 0x4, 0x1, 0x7, 0xff, 0x4, 0x0, 0x1, 0x101, 0x7, 0xd, 0x2, 0x0, 0x7fffffff, 0x2, 0x6, 0x6, 0x48000, 0x2, 0x0, 0x5, 0x5, 0x5, 0x4, 0x1, 0x80, 0x405, 0x7ff, 0x9, 0x7, 0x3, 0x4, 0xba, 0x4, 0xa, 0x5182, 0x6aef, 0x1, 0x9, 0x3, 0x80, 0xe, 0x6, 0x100, 0x42c, 0x2f8, 0x1, 0x7, 0x3, 0x498c, 0x8, 0xd63d, 0x3, 0x3ff, 0x9, 0x4, 0x3, 0xffffffff, 0x9, 0xffff, 0x4, 0x0, 0x1, 0x6, 0x6, 0x5, 0x4, 0x7, 0x1000, 0x1, 0x8001, 0x5, 0x7, 0xf, 0x7, 0x7fffffff, 0x4, 0x55, 0xb4, 0x1, 0x2, 0xffff, 0xb, 0x80000001, 0x3ff, 0x1000, 0x7, 0x54, 0x5, 0x7, 0x2, 0x2d6, 0xca4, 0x5, 0x3, 0x5, 0x3, 0x10001, 0xd646, 0x3, 0xffffffff, 0x65, 0x2, 0x70000000, 0x67c, 0x3, 0x3, 0xfffffff7, 0x8001, 0x80000000, 0xeb, 0x800, 0x81, 0x7, 0x2, 0xa55, 0xe, 0x6, 0xd0000, 0xfffffffe, 0xedd, 0xffff, 0x7, 0x40, 0x2, 0x4, 0x7fffffff, 0x9, 0x4, 0xc, 0xc356, 0x8, 0x9, 0xfffffff8, 0xafe, 0x2, 0x7, 0x7ff, 0xa5, 0x4, 0x7ff, 0x6, 0x6, 0x6, 0x1, 0x101, 0x1, 0xfffffffa, 0x7, 0x9, 0x5, 0xd, 0x29a2, 0xc5, 0x5, 0x3, 0x8, 0x28, 0xa3a9, 0x4, 0x400, 0x873, 0x3, 0xfffffffe, 0x1, 0x2, 0x7, 0x2, 0x0, 0xffffffff, 0x81, 0xfffffff9, 0x4, 0x7, 0x6, 0x4, 0x2, 0x10, 0x0, 0x9, 0xf67, 0x6, 0x9, 0x0, 0xffffffff, 0x7, 0x4, 0x3, 0x1cb, 0xffffa34d, 0x8, 0x4, 0x4b00, 0x478, 0x2cd1, 0x4, 0x1000, 0xf, 0x7d12, 0x5, 0x9615, 0x7, 0x1, 0x4, 0x0, 0x3ff, 0x6, 0x3, 0x7ff, 0x7fff, 0x25, 0x3, 0x200, 0xf, 0x3ff, 0x10000, 0x0, 0x5, 0x8, 0x1000, 0x5, 0x5, 0x29, 0x1, 0x5, 0x7, 0x5, 0x0, 0x1, 0x9, 0x3, 0xffffff55, 0x3, 0xf, 0x5, 0x300, 0x5, 0x8, 0x9, 0x6, 0x7, 0x3, 0x6db9, 0x4, 0x7685, 0xfffffff9, 0x4, 0x5, 0xfff, 0xe, 0x3, 0x2, 0xfff, 0x7ff, 0x206, 0x5, 0x6b1f, 0x3, 0x8, 0x8001, 0x9, 0xb, 0x5, 0x5, 0x2, 0x857, 0x2, 0x6, 0x800000, 0x0, 0xfffffffa, 0x2, 0x8, 0x7, 0x9, 0x3, 0x9, 0x7, 0xa, 0x3, 0xef, 0x0, 0x2e, 0x1ff, 0x4, 0x3, 0x5, 0x200, 0xae1, 0x8, 0x3, 0x4, 0x9, 0x6, 0x5102, 0xbd, 0x100, 0xfffff000, 0xd645, 0xb, 0x400, 0x3, 0x0, 0xe, 0xfffff800, 0x40, 0x76, 0x0, 0xb811, 0x1, 0x1, 0x80, 0x8, 0x29ce7b65, 0xe111c07, 0x3, 0x7, 0x1, 0x6, 0xccc1, 0x9, 0x4, 0x9, 0x401, 0x8, 0x4, 0x6, 0x100, 0x2, 0x1ff, 0x8, 0x7, 0x9, 0x1, 0x5, 0x80000001, 0x5, 0x5, 0x84000000, 0x5, 0x5, 0x3, 0x6, 0x2, 0x3, 0x3]}) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xd01c4813, &(0x7f0000000640)={0x2, 0xffffffff, 0x100000, 0x400000, 0x0, 0x2}) 2.628218943s ago: executing program 3 (id=47): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000040)={0x16}) ioctl$EVIOCGMASK(r1, 0x5b02, 0x0) write$char_usb(r1, 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$uac2(0xae80eec08dce4c53, 0xf4, &(0x7f00000001c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xe2, 0x3, 0x1, 0x7f, 0x10, 0x5, {0x8, 0xb, 0x1, 0x1, 0x1, 0x1, 0x20, 0x1}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xe, 0x9, 0x38, 0x6}, [@multiply_unit={0x7, 0x24, 0xc, 0x7, 0xe, 0x9, 0x6}, @mixer_unit={0x6, 0x24, 0x4, 0x6, 0xfd, "8f"}, @input_terminal={0x10, 0x24, 0x2, 0x4, 0x100, 0x6, 0x5d, 0xff, 0x9, 0x9, 0x6, 0x10}, @extension_unit={0xc, 0x24, 0x9, 0x3, 0xa73, 0x3, "aa1dfa7514"}, @mixer_unit={0x6, 0x24, 0x4, 0x4, 0x8, "b9"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0xeb53, 0x7ff, 0x1, "c9c8e9a06c5890c1f5"}, @format_type_ii_discrete={0xc, 0x24, 0x2, 0x2, 0x3, 0x7, 0x6, "7b1bd9"}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x40, 0x27, 0x4, {0x8, 0x25, 0x1, 0x40, 0x0, 0x7, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x6, 0x7, 0x0, "ee1184da"}, @as_header={0x10, 0x24, 0x1, 0x6, 0x10, 0x2, 0x3, 0xf5, 0xffff, 0xff}, @format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x2074, 0x7, 0x4, "34fec877576e"}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x9, 0x1, 0x2, {0x8, 0x25, 0x1, 0x80, 0x3d, 0x9}}}}}}}}]}}, &(0x7f0000000580)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x300, 0x4, 0x4, 0x8, 0x8f, 0xb5}, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x3, [{0x4, &(0x7f0000000000)=@lang_id={0x4, 0x3, 0xc01}}, {0x61, &(0x7f0000000380)=@string={0x61, 0x3, "1b7f5f8b3afd5fbfdaaca6bbfc57dda15b5bcc4994fda1842397dc30ac9b014810731e94858c2c998f58cb556c7d181a93e44bc0484239742e758a7dc6e9d58ad807c5ad0b63b838adfc3f0ecd00a33f7a9fe607b2aef21b39a5fdb2acd3af"}}, {0xcf, &(0x7f0000000480)=@string={0xcf, 0x3, "1f47b31169d48ec13787ff28163475d53d8e1f11241c46587f882c8c861a043b601aae0140816afa2c0d4d0132abade2fdcc0a92bbc4354915ac401c8ab1853bf8c5054152a20bfe41e927cf46bef947d10f42f4cd0c9c5416a448a39a63bf8d83c561d21d8e4f2068f1670882a289c890a9b369927358312e39187fb195c7bfc4235b266454d7d46e177a861be8547cbdeb0c9721a89f48e3571298bab34e91555221775cdb0ba27d52f12b9575bc9a44f82cec8d5bbd407979bd3add0ab30b04e59abdfcdbc5969f85bc3fa4"}}]}) syz_usb_connect(0x0, 0x24, &(0x7f0000000180)={{0x12, 0x1, 0x201, 0x9, 0x8f, 0xa0, 0x40, 0x45e, 0xc5e, 0x15a9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x8, 0x45, 0x20, 0x8, "", [{{0x9, 0x4, 0x26, 0xc, 0x0, 0xf1, 0x15, 0x4a, 0x5e}}]}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac1(0x0, 0x7d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000002082057d0040000102030109026b0003010680070904000000010100000a240108000a000201020904010000010200000904010101010200000b244201050380046c28d409050109000406b80807250104030100090300000001020000090402"], 0x0) 2.219184797s ago: executing program 4 (id=48): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1b96, 0x11, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x4, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x8, 0xfc}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150025ff0904a101090192008c0508950129309102c0"], 0x0}, 0x0) 1.320469012s ago: executing program 0 (id=49): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="000e0f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) 1.123801671s ago: executing program 1 (id=50): socket$nl_netfilter(0x10, 0x3, 0xc) mknodat$loop(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1004, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) socket(0x10, 0x803, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x9) syz_clone(0x2280700, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xfffff000) 862.379801ms ago: executing program 1 (id=51): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000180)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x0, 0x0, {0x77359400}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'y)\x00'}, 0x0, 0x1, {0x0}, 0xea}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x7f7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2002, 0x8) write(r2, &(0x7f0000000180)='10000', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r4 = socket$inet(0x2, 0x5, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, 0x0, 0x0) write(r3, &(0x7f0000000200)='1', 0x1) r5 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_ADAP_S_LOG_ADDRS(r5, 0xc05c6104, &(0x7f0000000040)={'\x00', 0x0, 0x5, 0x2, 0xfffffff9, 0xe, "00000000020000000000002100", "00000001", "0052008f", "0000f807", ["fdd5c01000", "0000000000000400", "00f638000000007c0300", "00d703500200"]}) ioctl$CEC_TRANSMIT(r5, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf7, 0x1, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0x1, 0x56, 0x1, 0xfa, 0x9, 0x1}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') preadv(r7, &(0x7f0000000000)=[{&(0x7f0000000480)=""/187, 0xbb}], 0x1, 0x25, 0x0) write(r6, &(0x7f0000000280)='0', 0x1) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={&(0x7f0000000100), 0x10, &(0x7f0000000200)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x74, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0xd, 0x1, 'devgroup\x00'}, @NFTA_MATCH_REV={0x8}, @NFTA_MATCH_INFO={0x18, 0x3, "0400"/20}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xfc}}, 0x0) 379.883631ms ago: executing program 4 (id=52): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x198, 0x0, 0x0, 0x0, 0x20, 0x5ac, 0x265, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xd9, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x11, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) 195.441175ms ago: executing program 1 (id=53): r0 = syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004366b408c70b0800c84f010203010902"], 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d6c5552018161391"], 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000f80)={0x2c, &(0x7f0000000680)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000dc0)={0x1c, &(0x7f00000006c0)={0x20, 0x14, 0x2, "5fab"}, 0x0, 0x0}) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac3(r1, 0x0, &(0x7f0000000940)={0x44, &(0x7f00000000c0)={0x0, 0xe, 0x5c, "bcab9410eb127a68f72ea782c46d20d0c9028b6ccef1a224116404d23c71d0a0be68604b2cfefbce62d130318a6e4aba60933caf5bc4aa0dec5b531fbe062e83f826fca975c900efa7f9c3e45f02b213ae79616227315be094413114"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac2(0x3, 0x0, 0x0, &(0x7f00000004c0)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x200, 0x6, 0x7f, 0x7, 0x10, 0x6}, 0x0, 0x0}) 121.560763ms ago: executing program 2 (id=54): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newsa={0x150, 0x10, 0x405, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0x1234, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "1122334455667788990011223344556611223344"}}]}, 0x150}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r2, &(0x7f0000000200)={0x2, 0x115c, @loopback}, 0x10) listen(r2, 0x5) r3 = socket$inet_tcp(0x2, 0x1, 0x6) connect$inet(r3, &(0x7f0000000200)={0x2, 0x115c, @loopback}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000500)={{{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x1}, {{@in=@loopback, 0x1234, 0x32}, 0x2, @in=@loopback}}, 0xe8) sendto$inet(r3, &(0x7f0000000600)="12", 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002380)=@newlink={0x38, 0x10, 0x401, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4, 0x268}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast2}]}}}]}, 0x38}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 3 (id=55): r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000480)=ANY=[@ANYBLOB="201019"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000c40)={0x2c, &(0x7f0000000a00)={0x40, 0x0, 0x1, "cc"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.108' (ED25519) to the list of known hosts. [ 74.093754][ T5606] cgroup: Unknown subsys name 'net' [ 74.206552][ T5606] cgroup: Unknown subsys name 'cpuset' [ 74.215760][ T5606] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.730294][ T5606] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 79.693499][ T5620] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.704098][ T5622] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.704452][ T5622] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.706059][ T5622] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.706964][ T5622] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 79.715178][ T5622] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 79.740350][ T5622] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.756352][ T5624] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 79.756788][ T5624] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.764840][ T5624] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.774003][ T5631] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.775126][ T5631] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 79.776919][ T5629] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.780001][ T5629] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.792037][ T5629] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 79.793157][ T5629] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.795751][ T5629] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 79.799546][ T5620] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 79.844803][ T5629] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 79.856304][ T5629] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 79.874703][ T5622] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 79.885760][ T5622] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 79.893410][ T5622] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 79.906513][ T5622] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 79.916848][ T5622] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 81.674858][ T5627] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.675025][ T5627] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.677115][ T5627] bridge_slave_0: entered allmulticast mode [ 81.681896][ T5627] bridge_slave_0: entered promiscuous mode [ 81.735376][ T5627] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.735613][ T5627] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.735944][ T5627] bridge_slave_1: entered allmulticast mode [ 81.740655][ T5627] bridge_slave_1: entered promiscuous mode [ 81.756137][ T5629] Bluetooth: hci0: command tx timeout [ 81.806762][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.807094][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.807411][ T5616] bridge_slave_0: entered allmulticast mode [ 81.812156][ T5616] bridge_slave_0: entered promiscuous mode [ 81.815010][ T5629] Bluetooth: hci2: command tx timeout [ 81.827915][ T5627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.865674][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.866112][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.867184][ T5616] bridge_slave_1: entered allmulticast mode [ 81.871925][ T5616] bridge_slave_1: entered promiscuous mode [ 81.893382][ T5629] Bluetooth: hci1: command tx timeout [ 81.893404][ T5622] Bluetooth: hci3: command tx timeout [ 81.911543][ T5627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.973398][ T5629] Bluetooth: hci4: command tx timeout [ 81.978238][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.979195][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.979541][ T5621] bridge_slave_0: entered allmulticast mode [ 81.986640][ T5621] bridge_slave_0: entered promiscuous mode [ 82.006012][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.044482][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.044841][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.045160][ T5621] bridge_slave_1: entered allmulticast mode [ 82.050083][ T5621] bridge_slave_1: entered promiscuous mode [ 82.061193][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.088417][ T5627] team0: Port device team_slave_0 added [ 82.095042][ T5627] team0: Port device team_slave_1 added [ 82.151706][ T5626] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.151946][ T5626] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.152312][ T5626] bridge_slave_0: entered allmulticast mode [ 82.163638][ T5626] bridge_slave_0: entered promiscuous mode [ 82.170076][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.170413][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.170725][ T5617] bridge_slave_0: entered allmulticast mode [ 82.178621][ T5617] bridge_slave_0: entered promiscuous mode [ 82.211418][ T5616] team0: Port device team_slave_0 added [ 82.226075][ T5626] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.226380][ T5626] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.226671][ T5626] bridge_slave_1: entered allmulticast mode [ 82.230922][ T5626] bridge_slave_1: entered promiscuous mode [ 82.238594][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.238788][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.239706][ T5617] bridge_slave_1: entered allmulticast mode [ 82.253181][ T5617] bridge_slave_1: entered promiscuous mode [ 82.286615][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.300404][ T5616] team0: Port device team_slave_1 added [ 82.315455][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.322511][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.322571][ T5627] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.372141][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.399533][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.399564][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.399593][ T5627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.452659][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.471666][ T5621] team0: Port device team_slave_0 added [ 82.479163][ T5621] team0: Port device team_slave_1 added [ 82.481539][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.481583][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.481649][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.508792][ T5626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.528313][ T5626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.546216][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.579519][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.579903][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.579975][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.689797][ T5627] hsr_slave_0: entered promiscuous mode [ 82.694858][ T5627] hsr_slave_1: entered promiscuous mode [ 82.699921][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.699957][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.700014][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.710735][ T5626] team0: Port device team_slave_0 added [ 82.720504][ T5617] team0: Port device team_slave_0 added [ 82.730097][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.730149][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.730211][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.806810][ T5626] team0: Port device team_slave_1 added [ 82.831201][ T5617] team0: Port device team_slave_1 added [ 82.855379][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.855402][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.855425][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.909351][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.909389][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.909417][ T5626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.920259][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.920295][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.920356][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.951496][ T5616] hsr_slave_0: entered promiscuous mode [ 82.956214][ T5616] hsr_slave_1: entered promiscuous mode [ 82.958365][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 82.958554][ T5616] Cannot create hsr debugfs directory [ 82.964180][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.964215][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.964278][ T5626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.095403][ T5621] hsr_slave_0: entered promiscuous mode [ 83.098681][ T5621] hsr_slave_1: entered promiscuous mode [ 83.100312][ T5621] debugfs: 'hsr0' already exists in 'hsr' [ 83.100351][ T5621] Cannot create hsr debugfs directory [ 83.268541][ T5617] hsr_slave_0: entered promiscuous mode [ 83.270744][ T5617] hsr_slave_1: entered promiscuous mode [ 83.272396][ T5617] debugfs: 'hsr0' already exists in 'hsr' [ 83.272447][ T5617] Cannot create hsr debugfs directory [ 83.292254][ T5626] hsr_slave_0: entered promiscuous mode [ 83.295685][ T5626] hsr_slave_1: entered promiscuous mode [ 83.297375][ T5626] debugfs: 'hsr0' already exists in 'hsr' [ 83.297419][ T5626] Cannot create hsr debugfs directory [ 83.734672][ T5627] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 83.750611][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.770195][ T5627] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 83.781152][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.789200][ T5627] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 83.800290][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.813400][ T5629] Bluetooth: hci0: command tx timeout [ 83.817536][ T5627] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 83.832238][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.893188][ T5629] Bluetooth: hci2: command tx timeout [ 83.907589][ T5616] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 83.921463][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.936201][ T5616] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.948639][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.951037][ T5616] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.964052][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.972926][ T5622] Bluetooth: hci1: command tx timeout [ 83.973305][ T5629] Bluetooth: hci3: command tx timeout [ 83.988700][ T5616] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.998452][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.052838][ T5629] Bluetooth: hci4: command tx timeout [ 84.094819][ T5621] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 84.107837][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.109860][ T5621] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 84.120866][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.138629][ T5621] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 84.148153][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.162098][ T5621] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 84.171635][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.247422][ T5627] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.280282][ T5617] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 84.289879][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.295855][ T5617] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 84.305019][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.312146][ T5617] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 84.324219][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.337914][ T5617] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 84.347618][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.400060][ T5627] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.417336][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.417631][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.476988][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.477232][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.488882][ T5626] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 84.502575][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.508370][ T5626] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 84.516485][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.540554][ T5626] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 84.550082][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.569073][ T5626] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.578844][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.617996][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.682028][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.705169][ T1005] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.705287][ T1005] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.731049][ T1108] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.731150][ T1108] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.761810][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.862073][ T5621] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.878837][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.908625][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.909457][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.935579][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.935795][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.979403][ T5626] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.008260][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.057853][ T27] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.058085][ T27] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.101483][ T27] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.101689][ T27] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.126336][ T5626] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.183892][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.184014][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.224500][ T27] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.224614][ T27] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.894304][ T5629] Bluetooth: hci0: command tx timeout [ 85.927779][ T5627] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.975116][ T5629] Bluetooth: hci2: command tx timeout [ 86.056628][ T5622] Bluetooth: hci1: command tx timeout [ 86.062212][ T5629] Bluetooth: hci3: command tx timeout [ 86.133807][ T5629] Bluetooth: hci4: command tx timeout [ 86.181917][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.361162][ T5616] veth0_vlan: entered promiscuous mode [ 86.418755][ T5616] veth1_vlan: entered promiscuous mode [ 86.462353][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.537626][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.611081][ T5626] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.648252][ T5621] veth0_vlan: entered promiscuous mode [ 86.657192][ T5616] veth0_macvtap: entered promiscuous mode [ 86.699751][ T5616] veth1_macvtap: entered promiscuous mode [ 86.711037][ T5621] veth1_vlan: entered promiscuous mode [ 86.727007][ T5627] veth0_vlan: entered promiscuous mode [ 86.771941][ T5617] veth0_vlan: entered promiscuous mode [ 86.791223][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.805213][ T5627] veth1_vlan: entered promiscuous mode [ 86.820530][ T5617] veth1_vlan: entered promiscuous mode [ 86.867455][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.891276][ T5621] veth0_macvtap: entered promiscuous mode [ 86.942269][ T5621] veth1_macvtap: entered promiscuous mode [ 86.954643][ T5626] veth0_vlan: entered promiscuous mode [ 86.976219][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.989436][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.989502][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.989540][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.037312][ T5626] veth1_vlan: entered promiscuous mode [ 87.098234][ T5627] veth0_macvtap: entered promiscuous mode [ 87.108766][ T5617] veth0_macvtap: entered promiscuous mode [ 87.126205][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.167558][ T5627] veth1_macvtap: entered promiscuous mode [ 87.180050][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.201821][ T5617] veth1_macvtap: entered promiscuous mode [ 87.217456][ T1005] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.217499][ T1005] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.277594][ T1005] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.277637][ T1005] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.301670][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.334303][ T1005] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.334354][ T1005] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.334401][ T1005] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.334437][ T1005] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.368820][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.390917][ T5626] veth0_macvtap: entered promiscuous mode [ 87.419658][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.434880][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.445652][ T5616] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 87.471923][ T5626] veth1_macvtap: entered promiscuous mode [ 87.579106][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.579148][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.649975][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.724531][ T27] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.727693][ T1108] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.778559][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.797745][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.807856][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.950107][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.950154][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.973231][ T5629] Bluetooth: hci0: command tx timeout [ 88.053006][ T5629] Bluetooth: hci2: command tx timeout [ 88.101341][ T84] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.101380][ T84] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.132879][ T5622] Bluetooth: hci1: command tx timeout [ 88.136900][ T5629] Bluetooth: hci3: command tx timeout [ 88.203675][ T27] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.213065][ T5629] Bluetooth: hci4: command tx timeout [ 88.237008][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.237030][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.419986][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.420042][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.486963][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.487059][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.702840][ T59] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.702988][ T59] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.703065][ T59] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.703242][ T59] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.703893][ T59] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.703934][ T59] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.703977][ T59] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.283606][ T1005] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.283777][ T1005] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.504600][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.514246][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.622480][ T5823] netlink: 'syz.4.5': attribute type 1 has an invalid length. [ 89.622576][ T5823] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5'. [ 90.085485][ T5828] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 92.434716][ T31] cfg80211: failed to load regulatory.db [ 92.978906][ T5831] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3'. [ 93.077512][ T5837] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3'. [ 93.692232][ T5841] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 93.815003][ T5841] xt_nfacct: accounting object `syz0' does not exist [ 93.897063][ T5849] netlink: 'syz.0.11': attribute type 10 has an invalid length. [ 94.196002][ T5849] team0 (unregistering): Port device team_slave_0 removed [ 94.237188][ T5849] team0 (unregistering): Port device team_slave_1 removed [ 95.983079][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 97.224579][ T5872] syzkaller1: entered promiscuous mode [ 97.230368][ T5872] syzkaller1: entered allmulticast mode [ 98.555245][ T5903] kernel profiling enabled (shift: 7) [ 99.498560][ T5917] ÿÿÿÿ: renamed from lo (while UP) [ 99.824191][ T5924] syz.0.25 uses obsolete (PF_INET,SOCK_PACKET) [ 99.956489][ T5925] netlink: 8 bytes leftover after parsing attributes in process `syz.1.24'. [ 101.562847][ T5933] comedi comedi0: reset error (fatal) [ 105.813184][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 106.406843][ T5965] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 109.654755][ T5732] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 109.675304][ T4947] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 109.713045][ T5630] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 109.823920][ T5732] usb 3-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 109.834320][ T4947] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 109.848773][ T4947] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 109.859656][ T5732] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 109.859691][ T5732] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 109.859743][ T5732] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.884381][ T5630] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 109.901587][ T5630] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 109.901635][ T5630] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 109.901672][ T5630] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 109.901707][ T5630] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 109.901747][ T5630] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.947386][ T5630] usb 2-1: config 0 descriptor?? [ 109.973853][ T5979] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 109.984492][ T4947] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.984558][ T4947] usb 1-1: Product: syz [ 109.984589][ T4947] usb 1-1: Manufacturer: syz [ 109.984606][ T4947] usb 1-1: SerialNumber: syz [ 110.039383][ T5732] usb 3-1: probing VID:PID(0424:012C) [ 110.052417][ T5732] usb 3-1: vub300 testing BULK IN EndPoint(0) 81 [ 110.059008][ T5732] usb 3-1: vub300 testing BULK OUT EndPoint(1) 02 [ 110.065622][ T5732] usb 3-1: vub300 testing BULK IN EndPoint(2) 83 [ 110.072090][ T5732] usb 3-1: vub300 testing BULK OUT EndPoint(3) 04 [ 110.079365][ T5732] usb 3-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 110.133003][ T987] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 110.229014][ T5980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.238837][ T5980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 110.277552][ T4947] usb 1-1: Direct firmware load for 6fire/dmx6firel2.ihx failed with error -2 [ 110.277648][ T4947] usb 1-1: Falling back to sysfs fallback for: 6fire/dmx6firel2.ihx [ 110.298953][ T987] usb 4-1: Using ep0 maxpacket: 8 [ 110.300844][ T987] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 110.304829][ T987] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 110.304874][ T987] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 110.305010][ T987] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 110.305073][ T987] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 110.305252][ T987] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 110.305428][ T987] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.392195][ T5732] usb 3-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 110.409444][ T5630] plantronics 0003:047F:FFFF.0001: reserved main item tag 0xd [ 110.439237][ T5630] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 110.483726][ T5815] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 110.586277][ T987] usb 4-1: usb_control_msg returned -32 [ 110.586342][ T987] usbtmc 4-1:16.0: can't read capabilities [ 110.598885][ T5732] usb 3-1: USB vub300 remote SDIO host controller[0]connected with SD/SDIO card inserted [ 110.634703][ T5815] usb 5-1: New USB device found, idVendor=1b96, idProduct=0011, bcdDevice= 0.00 [ 110.643633][ T5815] usb 5-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 110.643755][ T5815] usb 5-1: config 0 interface 0 has no altsetting 0 [ 110.643807][ T5815] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.657534][ T5815] usb 5-1: config 0 descriptor?? [ 110.695195][ T987] usb 2-1: USB disconnect, device number 2 [ 110.792544][ T31] usb 4-1: USB disconnect, device number 2 [ 111.078291][ T5815] input: HID 1b96:0011 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:1B96:0011.0002/input/input6 [ 111.133505][ T5815] ntrig 0003:1B96:0011.0002: offset (1) exceeds report_count (1) [ 111.133953][ T5815] ntrig 0003:1B96:0011.0002: offset (2) exceeds report_count (1) [ 111.133974][ T5815] ntrig 0003:1B96:0011.0002: offset (3) exceeds report_count (1) [ 111.133991][ T5815] ntrig 0003:1B96:0011.0002: offset (4) exceeds report_count (1) [ 111.134009][ T5815] ntrig 0003:1B96:0011.0002: offset (5) exceeds report_count (1) [ 111.134028][ T5815] ntrig 0003:1B96:0011.0002: offset (39) exceeds report_count (1) [ 111.134046][ T5815] ntrig 0003:1B96:0011.0002: offset (9) exceeds report_count (1) [ 111.134063][ T5815] ntrig 0003:1B96:0011.0002: offset (25) exceeds report_count (1) [ 111.256197][ T189] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 111.316668][ T5815] ntrig 0003:1B96:0011.0002: input,hidraw0: USB HID v0.04 Joystick [HID 1b96:0011] on usb-dummy_hcd.4-1/input0 [ 111.366443][ T5815] usb 5-1: USB disconnect, device number 2 [ 111.415118][ T189] usb 4-1: unable to get BOS descriptor or descriptor too short [ 111.415179][ T189] usb 4-1: New USB device found, idVendor=045e, idProduct=0c5e, bcdDevice=15.a9 [ 111.433593][ T189] usb 4-1: config 8 has an invalid interface number: 38 but max is 0 [ 111.433635][ T189] usb 4-1: config 8 has no interface number 0 [ 111.433688][ T189] usb 4-1: config 8 interface 38 has no altsetting 0 [ 111.459378][ T189] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.459413][ T189] usb 4-1: Product: syz [ 111.459441][ T189] usb 4-1: Manufacturer: syz [ 111.459458][ T189] usb 4-1: SerialNumber: syz [ 111.498434][ T189] r8152-cfgselector 4-1: Unknown version 0x0000 [ 111.621944][ T5996] fido_id[5996]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 111.685948][ T5724] usb 3-1: USB disconnect, device number 2 [ 111.695075][ T5732] usb 3-1: SET_CLOCK_SPEED 200kHz failed with retval=-71 [ 111.711244][ T5732] usb 3-1: SET_CLOCK_SPEED 200kHz failed with retval=-19 [ 111.716406][ T5732] usb 3-1: SET_CLOCK_SPEED 200kHz failed with retval=-19 [ 111.731669][ T5985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 111.749106][ T5985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.782352][ T189] hub 4-1:8.38: bad descriptor, ignoring hub [ 111.789278][ T189] hub 4-1:8.38: probe with driver hub failed with error -5 [ 111.825354][ T189] r8152-cfgselector 4-1: USB disconnect, device number 3 [ 111.907606][ T5998] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 112.296358][ T5840] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 112.399842][ T5724] USB vub300 remote SDIO host controller[0] now disconnected [ 112.452965][ T5840] usb 5-1: Using ep0 maxpacket: 32 [ 112.470332][ T5840] usb 5-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 112.480812][ T5840] usb 5-1: config 0 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 17, changing to 8 [ 112.480861][ T5840] usb 5-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 112.480901][ T5840] usb 5-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 112.480946][ T5840] usb 5-1: config 0 interface 0 has no altsetting 0 [ 112.480994][ T5840] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.494100][ T5630] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 112.543310][ T5840] usb 5-1: config 0 descriptor?? [ 112.613273][ C1] [ 112.616344][ C1] ============================= [ 112.621286][ C1] WARNING: suspicious RCU usage [ 112.626222][ C1] syzkaller #0 Not tainted [ 112.630674][ C1] ----------------------------- [ 112.635568][ C1] kernel/sched/core.c:9198 Illegal context switch in RCU-sched read-side critical section! [ 112.645699][ C1] [ 112.645699][ C1] other info that might help us debug this: [ 112.645699][ C1] [ 112.656001][ C1] [ 112.656001][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 112.664138][ C1] locks held by syz.2.54/6016: 5, last CPU#1: [ 112.670252][ C1] #0: ffff8880344f7678 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 112.679444][ C1] #1: ffffffff8ed5ca60 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 112.689059][ C1] #2: ffff8880750cd138 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 112.699611][ C1] #3: ffffffff8ed5cb20 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 112.709127][ C1] #4: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 112.719683][ C1] [ 112.719683][ C1] stack backtrace: [ 112.725670][ C1] CPU: 1 UID: 0 PID: 6016 Comm: syz.2.54 Not tainted syzkaller #0 PREEMPT(full) [ 112.734837][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 112.744920][ C1] Call Trace: [ 112.748228][ C1] [ 112.751092][ C1] dump_stack_lvl+0xe8/0x150 [ 112.755737][ C1] lockdep_rcu_suspicious+0x140/0x1d0 [ 112.761148][ C1] __might_resched+0xbb/0x4c0 [ 112.765868][ C1] ? __cancel_work_sync+0x5c/0x110 [ 112.771021][ C1] __cancel_work_sync+0x6d/0x110 [ 112.776023][ C1] mmc_free_host+0x19/0x30 [ 112.780484][ C1] call_timer_fn+0x18d/0x5f0 [ 112.785114][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 112.791818][ C1] ? call_timer_fn+0xd5/0x5f0 [ 112.796521][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 112.801680][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 112.806909][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 112.813613][ C1] __run_timer_base+0x652/0x8b0 [ 112.818511][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 112.823932][ C1] ? ktime_get+0x1f5/0x220 [ 112.828377][ C1] ? lapic_next_event+0x11/0x20 [ 112.833258][ C1] run_timer_softirq+0xb7/0x170 [ 112.838136][ C1] handle_softirqs+0x226/0x860 [ 112.842939][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 112.847763][ C1] __irq_exit_rcu+0xcb/0x220 [ 112.852424][ C1] irq_exit_rcu+0x9/0x30 [ 112.856734][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 112.862410][ C1] [ 112.865372][ C1] [ 112.868345][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 112.874371][ C1] RIP: 0010:pfn_valid+0x11f/0x490 [ 112.879423][ C1] Code: 74 7d e8 54 3e 84 ff 4d 85 ff 75 11 e8 4a 3e 84 ff eb 3d e8 43 3e 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 43 80 7c 25 00 00 <74> 08 4c 89 ff e8 c7 07 f4 ff 49 8b 2f 48 89 ee 48 83 e6 02 31 ff [ 112.899050][ C1] RSP: 0018:ffffc90005427318 EFLAGS: 00000246 [ 112.905140][ C1] RAX: ffffffff8243811c RBX: ffffffff824380da RCX: ffff88807b723e80 [ 112.906596][ T5630] usb 2-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 112.909830][ T5630] usb 2-1: config 0 has no interfaces? [ 112.917957][ T5630] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.918050][ T5630] usb 2-1: Product: syz [ 112.918093][ T5630] usb 2-1: Manufacturer: syz [ 112.918156][ T5630] usb 2-1: SerialNumber: syz [ 112.948977][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d8d60 RDI: ffffffff8c6d8d20 [ 112.956971][ C1] RBP: 0000000000000001 R08: 5a00000000000000 R09: 0000000000000000 [ 112.965051][ C1] R10: 0000000000000000 R11: ffffffff8ed5cb20 R12: dffffc0000000000 [ 112.973058][ C1] R13: 1ffff11027fc1430 R14: 0000000000062413 R15: ffff88813fe0a180 [ 112.981074][ C1] ? pfn_valid+0xba/0x490 [ 112.985432][ C1] ? pfn_valid+0xfc/0x490 [ 112.989802][ C1] ? pfn_valid+0xfc/0x490 [ 112.994165][ C1] page_table_check_clear+0x21/0x500 [ 112.999475][ C1] ? vm_normal_page+0x13c/0x2b0 [ 113.004363][ C1] __zap_vma_range+0x3a12/0x4f80 [ 113.009378][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 113.014713][ C1] ? mas_find+0x6d6/0xcb0 [ 113.019081][ C1] unmap_vmas+0x390/0x550 [ 113.023446][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 113.028321][ C1] ? mas_next_slot+0xc91/0xd70 [ 113.033168][ C1] exit_mmap+0x293/0x9f0 [ 113.037442][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 113.042266][ C1] ? __pfx_exit_aio+0x10/0x10 [ 113.047002][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 113.052243][ C1] __mmput+0x118/0x420 [ 113.056380][ C1] exit_mm+0x221/0x2d0 [ 113.060509][ C1] do_exit+0x6cd/0x2360 [ 113.064703][ C1] ? __pfx_do_exit+0x10/0x10 [ 113.069325][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 113.074402][ C1] do_group_exit+0x22d/0x2f0 [ 113.079013][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 113.084254][ C1] get_signal+0x121b/0x12c0 [ 113.088826][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 113.094412][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 113.100617][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 113.106025][ C1] ? rcu_is_watching+0x16/0xb0 [ 113.110827][ C1] do_syscall_64+0x328/0x520 [ 113.115465][ C1] ? trace_irq_disable+0x3b/0x140 [ 113.120523][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.126620][ C1] ? clear_bhb_loop+0x70/0xc0 [ 113.131333][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.137259][ C1] RIP: 0033:0x7fc29599e0d9 [ 113.141724][ C1] Code: Unable to access opcode bytes at 0x7fc29599e0af. [ 113.148787][ C1] RSP: 002b:00007fc2968730e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 113.157233][ C1] RAX: fffffffffffffe00 RBX: 00007fc295c26098 RCX: 00007fc29599e0d9 [ 113.165229][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc295c26098 [ 113.171392][ T5630] usb 2-1: config 0 descriptor?? [ 113.178170][ C1] RBP: 00007fc295c26090 R08: 0000000000000000 R09: 0000000000000000 [ 113.186167][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 113.194169][ C1] R13: 00007fc295c26128 R14: 00007ffe0f462540 R15: 00007ffe0f462628 [ 113.202190][ C1] [ 113.205848][ C1] BUG: sleeping function called from invalid context at ker ** replaying previous printk message ** [ 113.205848][ C1] BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 [ 113.205877][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6016, name: syz.2.54 [ 113.205929][ C1] preempt_count: 102, expected: 0 [ 113.205966][ C1] RCU nest depth: 1, expected: 0 [ 113.205994][ C1] locks held by syz.2.54/6016: 5, last CPU#1: [ 113.206049][ C1] #0: ffff8880344f7678 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 113.206224][ C1] #1: ffffffff8ed5ca60 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 113.206377][ C1] #2: ffff8880750cd138 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 113.206536][ C1] #3: ffffffff8ed5cb20 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 113.206674][ C1] #4: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 113.206815][ C1] Preemption disabled at: [ 113.206826][ C1] [<0000000000000000>] 0x0 [ 113.206891][ C1] CPU: 1 UID: 0 PID: 6016 Comm: syz.2.54 Not tainted syzkaller #0 PREEMPT(full) [ 113.206966][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 113.207011][ C1] Call Trace: [ 113.207036][ C1] [ 113.207064][ C1] dump_stack_lvl+0xe8/0x150 [ 113.207146][ C1] __might_resched+0x36a/0x4c0 [ 113.207242][ C1] __cancel_work_sync+0x6d/0x110 [ 113.207334][ C1] mmc_free_host+0x19/0x30 [ 113.207424][ C1] call_timer_fn+0x18d/0x5f0 [ 113.207502][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 113.207568][ C1] ? call_timer_fn+0xd5/0x5f0 [ 113.207633][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 113.207720][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 113.207784][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 113.207858][ C1] __run_timer_base+0x652/0x8b0 [ 113.207959][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 113.208025][ C1] ? ktime_get+0x1f5/0x220 [ 113.208081][ C1] ? lapic_next_event+0x11/0x20 [ 113.208156][ C1] run_timer_softirq+0xb7/0x170 [ 113.208195][ C1] handle_softirqs+0x226/0x860 [ 113.208272][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 113.208364][ C1] __irq_exit_rcu+0xcb/0x220 [ 113.208427][ C1] irq_exit_rcu+0x9/0x30 [ 113.208479][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 113.208546][ C1] [ 113.208564][ C1] [ 113.208584][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 113.208647][ C1] RIP: 0010:pfn_valid+0x11f/0x490 [ 113.208702][ C1] Code: 74 7d e8 54 3e 84 ff 4d 85 ff 75 11 e8 4a 3e 84 ff eb 3d e8 43 3e 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 43 80 7c 25 00 00 <74> 08 4c 89 ff e8 c7 07 f4 ff 49 8b 2f 48 89 ee 48 83 e6 02 31 ff [ 113.208747][ C1] RSP: 0018:ffffc90005427318 EFLAGS: 00000246 [ 113.208798][ C1] RAX: ffffffff8243811c RBX: ffffffff824380da RCX: ffff88807b723e80 [ 113.208850][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d8d60 RDI: ffffffff8c6d8d20 [ 113.208892][ C1] RBP: 0000000000000001 R08: 5a00000000000000 R09: 0000000000000000 [ 113.208930][ C1] R10: 0000000000000000 R11: ffffffff8ed5cb20 R12: dffffc0000000000 [ 113.208962][ C1] R13: 1ffff11027fc1430 R14: 0000000000062413 R15: ffff88813fe0a180 [ 113.209009][ C1] ? pfn_valid+0xba/0x490 [ 113.209071][ C1] ? pfn_valid+0xfc/0x490 [ 113.209137][ C1] ? pfn_valid+0xfc/0x490 [ 113.209201][ C1] page_table_check_clear+0x21/0x500 [ 113.209256][ C1] ? vm_normal_page+0x13c/0x2b0 [ 113.209321][ C1] __zap_vma_range+0x3a12/0x4f80 [ 113.209492][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 113.209576][ C1] ? mas_find+0x6d6/0xcb0 [ 113.209660][ C1] unmap_vmas+0x390/0x550 [ 113.209743][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 113.209789][ C1] ? mas_next_slot+0xc91/0xd70 [ 113.209918][ C1] exit_mmap+0x293/0x9f0 [ 113.209997][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 113.210131][ C1] ? __pfx_exit_aio+0x10/0x10 [ 113.210258][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 113.210341][ C1] __mmput+0x118/0x420 [ 113.210413][ C1] exit_mm+0x221/0x2d0 [ 113.210459][ C1] do_exit+0x6cd/0x2360 [ 113.210532][ C1] ? __pfx_do_exit+0x10/0x10 [ 113.210596][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 113.210684][ C1] do_group_exit+0x22d/0x2f0 [ 113.210732][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 113.210807][ C1] get_signal+0x121b/0x12c0 [ 113.210951][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 113.211030][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 113.211151][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 113.211207][ C1] ? rcu_is_watching+0x16/0xb0 [ 113.211280][ C1] do_syscall_64+0x328/0x520 [ 113.211347][ C1] ? trace_irq_disable+0x3b/0x140 [ 113.211400][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.211450][ C1] ? clear_bhb_loop+0x70/0xc0 [ 113.211515][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.211582][ C1] RIP: 0033:0x7fc29599e0d9 [ 113.211640][ C1] Code: Unable to access opcode bytes at 0x7fc29599e0af. [ 113.211661][ C1] RSP: 002b:00007fc2968730e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 113.211715][ C1] RAX: fffffffffffffe00 RBX: 00007fc295c26098 RCX: 00007fc29599e0d9 [ 113.211752][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc295c26098 [ 113.211788][ C1] RBP: 00007fc295c26090 R08: 0000000000000000 R09: 0000000000000000 [ 113.211818][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 113.211846][ C1] R13: 00007fc295c26128 R14: 00007ffe0f462540 R15: 00007ffe0f462628 [ 113.211957][ C1] [ 113.212529][ C1] [ 113.431719][ T6009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 113.440234][ T6009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 113.454566][ T5630] usb 2-1: USB disconnect, device number 3 [ 113.759987][ C1] ============================= [ 113.764934][ C1] WARNING: suspicious RCU usage [ 113.769809][ C1] syzkaller #0 Tainted: G W [ 113.775885][ C1] ----------------------------- [ 113.780760][ C1] kernel/rcu/srcutree.c:1468 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! [ 113.792813][ C1] [ 113.792813][ C1] other info that might help us debug this: [ 113.792813][ C1] [ 113.803136][ C1] [ 113.803136][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 113.811235][ C1] locks held by syz.2.54/6016: 5, last CPU#1: [ 113.817352][ C1] #0: ffff8880344f7678 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 113.826490][ C1] #1: ffffffff8ed5ca60 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 113.836066][ C1] #2: ffff8880750cd138 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 113.846597][ C1] #3: ffffffff8ed5cb20 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 113.856109][ C1] #4: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 113.866637][ C1] [ 113.866637][ C1] stack backtrace: [ 113.872592][ C1] CPU: 1 UID: 0 PID: 6016 Comm: syz.2.54 Tainted: G W syzkaller #0 PREEMPT(full) [ 113.883303][ C1] Tainted: [W]=WARN [ 113.887208][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 113.897281][ C1] Call Trace: [ 113.900584][ C1] [ 113.903449][ C1] dump_stack_lvl+0xe8/0x150 [ 113.908081][ C1] lockdep_rcu_suspicious+0x140/0x1d0 [ 113.913510][ C1] __synchronize_srcu+0x157/0x2f0 [ 113.918586][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 113.924175][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 113.929257][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 113.935114][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 113.940699][ C1] ? synchronize_srcu+0x20a/0x260 [ 113.945779][ C1] wakeup_source_unregister+0x129/0x3f0 [ 113.951371][ C1] mmc_host_classdev_release+0x47/0x100 [ 113.956972][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 113.963172][ C1] device_release+0xc4/0x1f0 [ 113.967811][ C1] kobject_put+0x222/0x550 [ 113.972266][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 113.977081][ C1] call_timer_fn+0x18d/0x5f0 [ 113.981717][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 113.988422][ C1] ? call_timer_fn+0xd5/0x5f0 [ 113.993135][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 113.998327][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 114.003591][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 114.010322][ C1] __run_timer_base+0x652/0x8b0 [ 114.015226][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 114.020636][ C1] ? ktime_get+0x1f5/0x220 [ 114.025088][ C1] ? lapic_next_event+0x11/0x20 [ 114.029979][ C1] run_timer_softirq+0xb7/0x170 [ 114.034875][ C1] handle_softirqs+0x226/0x860 [ 114.039680][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 114.044488][ C1] __irq_exit_rcu+0xcb/0x220 [ 114.049122][ C1] irq_exit_rcu+0x9/0x30 [ 114.053402][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 114.059067][ C1] [ 114.062022][ C1] [ 114.064986][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 114.071006][ C1] RIP: 0010:pfn_valid+0x11f/0x490 [ 114.076066][ C1] Code: 74 7d e8 54 3e 84 ff 4d 85 ff 75 11 e8 4a 3e 84 ff eb 3d e8 43 3e 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 43 80 7c 25 00 00 <74> 08 4c 89 ff e8 c7 07 f4 ff 49 8b 2f 48 89 ee 48 83 e6 02 31 ff [ 114.095694][ C1] RSP: 0018:ffffc90005427318 EFLAGS: 00000246 [ 114.101807][ C1] RAX: ffffffff8243811c RBX: ffffffff824380da RCX: ffff88807b723e80 [ 114.109807][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d8d60 RDI: ffffffff8c6d8d20 [ 114.117806][ C1] RBP: 0000000000000001 R08: 5a00000000000000 R09: 0000000000000000 [ 114.123389][ T5630] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 114.133267][ C1] R10: 0000000000000000 R11: ffffffff8ed5cb20 R12: dffffc0000000000 [ 114.141272][ C1] R13: 1ffff11027fc1430 R14: 0000000000062413 R15: ffff88813fe0a180 [ 114.149278][ C1] ? pfn_valid+0xba/0x490 [ 114.153671][ C1] ? pfn_valid+0xfc/0x490 [ 114.158047][ C1] ? pfn_valid+0xfc/0x490 [ 114.162419][ C1] page_table_check_clear+0x21/0x500 [ 114.167748][ C1] ? vm_normal_page+0x13c/0x2b0 [ 114.172655][ C1] __zap_vma_range+0x3a12/0x4f80 [ 114.177683][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 114.183019][ C1] ? mas_find+0x6d6/0xcb0 [ 114.187414][ C1] unmap_vmas+0x390/0x550 [ 114.191789][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 114.196668][ C1] ? mas_next_slot+0xc91/0xd70 [ 114.201476][ C1] exit_mmap+0x293/0x9f0 [ 114.205757][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 114.210574][ C1] ? __pfx_exit_aio+0x10/0x10 [ 114.215303][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 114.220580][ C1] __mmput+0x118/0x420 [ 114.224696][ C1] exit_mm+0x221/0x2d0 [ 114.228849][ C1] do_exit+0x6cd/0x2360 [ 114.233034][ C1] ? __pfx_do_exit+0x10/0x10 [ 114.237674][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 114.242740][ C1] do_group_exit+0x22d/0x2f0 [ 114.247361][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 114.252592][ C1] get_signal+0x121b/0x12c0 [ 114.257141][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 114.262748][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 114.268951][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 114.274355][ C1] ? rcu_is_watching+0x16/0xb0 [ 114.279159][ C1] do_syscall_64+0x328/0x520 [ 114.283785][ C1] ? trace_irq_disable+0x3b/0x140 [ 114.288823][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.294931][ C1] ? clear_bhb_loop+0x70/0xc0 [ 114.299630][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.305541][ C1] RIP: 0033:0x7fc29599e0d9 [ 114.309969][ C1] Code: Unable to access opcode bytes at 0x7fc29599e0af. [ 114.317000][ C1] RSP: 002b:00007fc2968730e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 114.325432][ C1] RAX: fffffffffffffe00 RBX: 00007fc295c26098 RCX: 00007fc29599e0d9 [ 114.333413][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc295c26098 [ 114.341389][ C1] RBP: 00007fc295c26090 R08: 0000000000000000 R09: 0000000000000000 [ 114.349362][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.357337][ C1] R13: 00007fc295c26128 R14: 00007ffe0f462540 R15: 00007ffe0f462628 [ 114.365322][ C1] [ 114.368452][ C1] BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1472 [ 114.368474][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6016, name: syz.2.54 [ 114.368497][ C1] preempt_count: 102, expected: 0 [ 114.368514][ C1] RCU nest depth: 1, expected: 0 [ 114.368530][ C1] locks held by syz.2.54/6016: 5, last CPU#1: [ 114.368552][ C1] #0: ffff8880344f7678 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 114.368651][ C1] #1: ffffffff8ed5ca60 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 114.368750][ C1] #2: ffff8880750cd138 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 114.368844][ C1] #3: ffffffff8ed5cb20 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 114.368924][ C1] #4: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 114.369012][ C1] Preemption disabled at: [ 114.369022][ C1] [<0000000000000000>] 0x0 [ 114.369055][ C1] CPU: 1 UID: 0 PID: 6016 Comm: syz.2.54 Tainted: G W syzkaller #0 PREEMPT(full) [ 114.369106][ C1] Tainted: [W]=WARN [ 114.369115][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 114.369135][ C1] Call Trace: [ 114.369144][ C1] [ 114.369154][ C1] dump_stack_lvl+0xe8/0x150 [ 114.369193][ C1] __might_resched+0x36a/0x4c0 [ 114.369237][ C1] __synchronize_srcu+0x1a1/0x2f0 [ 114.369266][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 114.369290][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 114.369348][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 114.369378][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 114.369417][ C1] ? synchronize_srcu+0x20a/0x260 [ 114.369446][ C1] wakeup_source_unregister+0x129/0x3f0 [ 114.369488][ C1] mmc_host_classdev_release+0x47/0x100 [ 114.369529][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 114.369571][ C1] device_release+0xc4/0x1f0 [ 114.369601][ C1] kobject_put+0x222/0x550 [ 114.369625][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 114.369655][ C1] call_timer_fn+0x18d/0x5f0 [ 114.369685][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 114.369716][ C1] ? call_timer_fn+0xd5/0x5f0 [ 114.369745][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 114.369786][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 114.369815][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 114.369850][ C1] __run_timer_base+0x652/0x8b0 [ 114.369893][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 114.369925][ C1] ? ktime_get+0x1f5/0x220 [ 114.369950][ C1] ? lapic_next_event+0x11/0x20 [ 114.369984][ C1] run_timer_softirq+0xb7/0x170 [ 114.370012][ C1] handle_softirqs+0x226/0x860 [ 114.370049][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 114.370089][ C1] __irq_exit_rcu+0xcb/0x220 [ 114.370122][ C1] irq_exit_rcu+0x9/0x30 [ 114.370152][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 114.370184][ C1] [ 114.370192][ C1] [ 114.370202][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 114.370229][ C1] RIP: 0010:pfn_valid+0x11f/0x490 [ 114.370256][ C1] Code: 74 7d e8 54 3e 84 ff 4d 85 ff 75 11 e8 4a 3e 84 ff eb 3d e8 43 3e 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 43 80 7c 25 00 00 <74> 08 4c 89 ff e8 c7 07 f4 ff 49 8b 2f 48 89 ee 48 83 e6 02 31 ff [ 114.370276][ C1] RSP: 0018:ffffc90005427318 EFLAGS: 00000246 [ 114.370296][ C1] RAX: ffffffff8243811c RBX: ffffffff824380da RCX: ffff88807b723e80 [ 114.370312][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d8d60 RDI: ffffffff8c6d8d20 [ 114.370335][ C1] RBP: 0000000000000001 R08: 5a00000000000000 R09: 0000000000000000 [ 114.370350][ C1] R10: 0000000000000000 R11: ffffffff8ed5cb20 R12: dffffc0000000000 [ 114.370366][ C1] R13: 1ffff11027fc1430 R14: 0000000000062413 R15: ffff88813fe0a180 [ 114.370387][ C1] ? pfn_valid+0xba/0x490 [ 114.370415][ C1] ? pfn_valid+0xfc/0x490 [ 114.370446][ C1] ? pfn_valid+0xfc/0x490 [ 114.370472][ C1] page_table_check_clear+0x21/0x500 [ 114.370496][ C1] ? vm_normal_page+0x13c/0x2b0 [ 114.370523][ C1] __zap_vma_range+0x3a12/0x4f80 [ 114.370597][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 114.370634][ C1] ? mas_find+0x6d6/0xcb0 [ 114.370669][ C1] unmap_vmas+0x390/0x550 [ 114.370703][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 114.370735][ C1] ? mas_next_slot+0xc91/0xd70 [ 114.370787][ C1] exit_mmap+0x293/0x9f0 [ 114.370822][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 114.370879][ C1] ? __pfx_exit_aio+0x10/0x10 [ 114.370925][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 114.370962][ C1] __mmput+0x118/0x420 [ 114.370994][ C1] exit_mm+0x221/0x2d0 [ 114.371021][ C1] do_exit+0x6cd/0x2360 [ 114.371052][ C1] ? __pfx_do_exit+0x10/0x10 [ 114.371079][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 114.371122][ C1] do_group_exit+0x22d/0x2f0 [ 114.371145][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 114.371177][ C1] get_signal+0x121b/0x12c0 [ 114.371229][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 114.371268][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 114.371322][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 114.371355][ C1] ? rcu_is_watching+0x16/0xb0 [ 114.371388][ C1] do_syscall_64+0x328/0x520 [ 114.371420][ C1] ? trace_irq_disable+0x3b/0x140 [ 114.371443][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.371467][ C1] ? clear_bhb_loop+0x70/0xc0 [ 114.371492][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.371513][ C1] RIP: 0033:0x7fc29599e0d9 [ 114.371533][ C1] Code: Unable to access opcode bytes at 0x7fc29599e0af. [ 114.371562][ C1] RSP: 002b:00007fc2968730e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 114.371586][ C1] RAX: fffffffffffffe00 RBX: 00007fc295c26098 RCX: 00007fc29599e0d9 [ 114.371602][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc295c26098 [ 114.371617][ C1] RBP: 00007fc295c26090 R08: 0000000000000000 R09: 0000000000000000 [ 114.371632][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.371646][ C1] R13: 00007fc295c26128 R14: 00007ffe0f462540 R15: 00007ffe0f462628 [ 114.371678][ C1] [ 114.371694][ C1] ODEBUG: object ffffc90000a18a80 is NOT on stack ffffc90005420000, but annotated. [ 114.372569][ C1] ------------[ cut here ]------------ [ 114.372581][ C1] 1 [ 114.372592][ C1] WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0, CPU#1: syz.2.54/6016 [ 114.424002][ T5630] usb 2-1: Using ep0 maxpacket: 32 [ 114.443937][ T5630] usb 2-1: New USB device found, idVendor=1618, idProduct=9113, bcdDevice= 0.00 [ 114.458779][ T5630] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 114.458907][ T5630] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 114.503715][ T5630] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.503861][ T5630] usb 2-1: Product: syz [ 114.503904][ T5630] usb 2-1: Manufacturer: syz [ 114.503945][ T5630] usb 2-1: SerialNumber: syz [ 115.030829][ C1] Modules linked in: [ 115.034765][ C1] CPU: 1 UID: 0 PID: 6016 Comm: syz.2.54 Tainted: G W syzkaller #0 PREEMPT(full) [ 115.045460][ C1] Tainted: [W]=WARN [ 115.049272][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 115.059342][ C1] RIP: 0010:__debug_object_init+0x2c4/0x3c0 [ 115.065271][ C1] Code: fd 06 cc 41 ff c7 44 89 3d 49 b2 e8 15 48 c7 c1 80 96 6d 8c 48 c7 c7 e0 96 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 cd 47 3e fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 01 13 6f 0a 3b 05 ff [ 115.084915][ C1] RSP: 0018:ffffc90000a189b8 EFLAGS: 00010046 [ 115.091008][ C1] RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: ff93c07a584d8800 [ 115.098991][ C1] RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 [ 115.106971][ C1] RBP: ffff88807b723ea0 R08: 0000000000000100 R09: 1ffff920001430e4 [ 115.114957][ C1] R10: dffffc0000000000 R11: fffff520001430e5 R12: 1ffff9200014314c [ 115.122948][ C1] R13: ffff888076d5aaf0 R14: dffffc0000000000 R15: 0000000000000001 [ 115.130962][ C1] FS: 0000000000000000(0000) GS:ffff888124dda000(0000) knlGS:0000000000000000 [ 115.139914][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 115.146521][ C1] CR2: 00007f6c28fbd0f5 CR3: 000000005f6d4000 CR4: 00000000003526f0 [ 115.154521][ C1] Call Trace: [ 115.157814][ C1] [ 115.160693][ C1] ? __init_swait_queue_head+0xa8/0x150 [ 115.166264][ C1] __synchronize_srcu+0x1d5/0x2f0 [ 115.171305][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 115.176861][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 115.181919][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 115.187835][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 115.193405][ C1] ? synchronize_srcu+0x20a/0x260 [ 115.198450][ C1] wakeup_source_unregister+0x129/0x3f0 [ 115.204017][ C1] mmc_host_classdev_release+0x47/0x100 [ 115.209599][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 115.215767][ C1] device_release+0xc4/0x1f0 [ 115.220375][ C1] kobject_put+0x222/0x550 [ 115.224804][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 115.229573][ C1] call_timer_fn+0x18d/0x5f0 [ 115.234170][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 115.240876][ C1] ? call_timer_fn+0xd5/0x5f0 [ 115.245565][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 115.250702][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 115.255923][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 115.262612][ C1] __run_timer_base+0x652/0x8b0 [ 115.267501][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 115.272892][ C1] ? ktime_get+0x1f5/0x220 [ 115.277332][ C1] ? lapic_next_event+0x11/0x20 [ 115.282213][ C1] run_timer_softirq+0xb7/0x170 [ 115.287082][ C1] handle_softirqs+0x226/0x860 [ 115.291860][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 115.296662][ C1] __irq_exit_rcu+0xcb/0x220 [ 115.301265][ C1] irq_exit_rcu+0x9/0x30 [ 115.305523][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 115.311170][ C1] [ 115.314117][ C1] [ 115.317058][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 115.323043][ C1] RIP: 0010:pfn_valid+0x11f/0x490 [ 115.328104][ C1] Code: 74 7d e8 54 3e 84 ff 4d 85 ff 75 11 e8 4a 3e 84 ff eb 3d e8 43 3e 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 43 80 7c 25 00 00 <74> 08 4c 89 ff e8 c7 07 f4 ff 49 8b 2f 48 89 ee 48 83 e6 02 31 ff [ 115.347713][ C1] RSP: 0018:ffffc90005427318 EFLAGS: 00000246 [ 115.353796][ C1] RAX: ffffffff8243811c RBX: ffffffff824380da RCX: ffff88807b723e80 [ 115.361775][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d8d60 RDI: ffffffff8c6d8d20 [ 115.369770][ C1] RBP: 0000000000000001 R08: 5a00000000000000 R09: 0000000000000000 [ 115.377749][ C1] R10: 0000000000000000 R11: ffffffff8ed5cb20 R12: dffffc0000000000 [ 115.385746][ C1] R13: 1ffff11027fc1430 R14: 0000000000062413 R15: ffff88813fe0a180 [ 115.393741][ C1] ? pfn_valid+0xba/0x490 [ 115.398107][ C1] ? pfn_valid+0xfc/0x490 [ 115.402461][ C1] ? pfn_valid+0xfc/0x490 [ 115.406833][ C1] page_table_check_clear+0x21/0x500 [ 115.412147][ C1] ? vm_normal_page+0x13c/0x2b0 [ 115.417029][ C1] __zap_vma_range+0x3a12/0x4f80 [ 115.422040][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 115.427352][ C1] ? mas_find+0x6d6/0xcb0 [ 115.431719][ C1] unmap_vmas+0x390/0x550 [ 115.436084][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 115.440945][ C1] ? mas_next_slot+0xc91/0xd70 [ 115.445771][ C1] exit_mmap+0x293/0x9f0 [ 115.450040][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 115.454842][ C1] ? __pfx_exit_aio+0x10/0x10 [ 115.459578][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 115.464798][ C1] __mmput+0x118/0x420 [ 115.468884][ C1] exit_mm+0x221/0x2d0 [ 115.472971][ C1] do_exit+0x6cd/0x2360 [ 115.477166][ C1] ? __pfx_do_exit+0x10/0x10 [ 115.481785][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 115.486829][ C1] do_group_exit+0x22d/0x2f0 [ 115.491426][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 115.496642][ C1] get_signal+0x121b/0x12c0 [ 115.501193][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 115.506757][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 115.512949][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 115.518337][ C1] ? rcu_is_watching+0x16/0xb0 [ 115.523139][ C1] do_syscall_64+0x328/0x520 [ 115.527765][ C1] ? trace_irq_disable+0x3b/0x140 [ 115.532800][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.538879][ C1] ? clear_bhb_loop+0x70/0xc0 [ 115.543575][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.549511][ C1] RIP: 0033:0x7fc29599e0d9 [ 115.553968][ C1] Code: Unable to access opcode bytes at 0x7fc29599e0af. [ 115.561002][ C1] RSP: 002b:00007fc2968730e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 115.569445][ C1] RAX: fffffffffffffe00 RBX: 00007fc295c26098 RCX: 00007fc29599e0d9 [ 115.577440][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc295c26098 [ 115.585437][ C1] RBP: 00007fc295c26090 R08: 0000000000000000 R09: 0000000000000000 [ 115.593454][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.601468][ C1] R13: 00007fc295c26128 R14: 00007ffe0f462540 R15: 00007ffe0f462628 [ 115.609503][ C1] [ 115.612558][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 115.619861][ C1] CPU: 1 UID: 0 PID: 6016 Comm: syz.2.54 Tainted: G W syzkaller #0 PREEMPT(full) [ 115.630539][ C1] Tainted: [W]=WARN [ 115.634343][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 115.644522][ C1] Call Trace: [ 115.647835][ C1] [ 115.650705][ C1] vpanic+0x56d/0xa60 [ 115.654713][ C1] ? __pfx__printk+0x10/0x10 [ 115.659342][ C1] ? __pfx_vpanic+0x10/0x10 [ 115.663903][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 115.669235][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 115.674455][ C1] panic+0xc5/0xd0 [ 115.678203][ C1] ? __pfx_panic+0x10/0x10 [ 115.682672][ C1] __warn+0x315/0x4c0 [ 115.686706][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 115.692007][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 115.697309][ C1] __report_bug+0x276/0x570 [ 115.701838][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 115.707145][ C1] ? __pfx___report_bug+0x10/0x10 [ 115.712199][ C1] ? __wake_up_klogd+0xf0/0x130 [ 115.717079][ C1] ? vprintk_emit+0x4ee/0x560 [ 115.721788][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 115.726867][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 115.732184][ C1] report_bug+0x16b/0x220 [ 115.736546][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 115.741853][ C1] ? __debug_object_init+0x2c6/0x3c0 [ 115.747183][ C1] handle_bug+0x9c/0x200 [ 115.751455][ C1] exc_invalid_op+0x1a/0x50 [ 115.756005][ C1] asm_exc_invalid_op+0x1a/0x20 [ 115.760902][ C1] RIP: 0010:__debug_object_init+0x2c4/0x3c0 [ 115.766815][ C1] Code: fd 06 cc 41 ff c7 44 89 3d 49 b2 e8 15 48 c7 c1 80 96 6d 8c 48 c7 c7 e0 96 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 cd 47 3e fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 01 13 6f 0a 3b 05 ff [ 115.786445][ C1] RSP: 0018:ffffc90000a189b8 EFLAGS: 00010046 [ 115.792559][ C1] RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: ff93c07a584d8800 [ 115.800560][ C1] RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 [ 115.808540][ C1] RBP: ffff88807b723ea0 R08: 0000000000000100 R09: 1ffff920001430e4 [ 115.816542][ C1] R10: dffffc0000000000 R11: fffff520001430e5 R12: 1ffff9200014314c [ 115.824554][ C1] R13: ffff888076d5aaf0 R14: dffffc0000000000 R15: 0000000000000001 [ 115.832562][ C1] ? __debug_object_init+0x2c3/0x3c0 [ 115.837883][ C1] ? __init_swait_queue_head+0xa8/0x150 [ 115.843462][ C1] __synchronize_srcu+0x1d5/0x2f0 [ 115.848519][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 115.854095][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 115.859158][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 115.864988][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 115.870564][ C1] ? synchronize_srcu+0x20a/0x260 [ 115.875631][ C1] wakeup_source_unregister+0x129/0x3f0 [ 115.881226][ C1] mmc_host_classdev_release+0x47/0x100 [ 115.886824][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 115.893008][ C1] device_release+0xc4/0x1f0 [ 115.897632][ C1] kobject_put+0x222/0x550 [ 115.902087][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 115.906904][ C1] call_timer_fn+0x18d/0x5f0 [ 115.911532][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 115.918260][ C1] ? call_timer_fn+0xd5/0x5f0 [ 115.922959][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 115.928127][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 115.933363][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 115.940085][ C1] __run_timer_base+0x652/0x8b0 [ 115.944990][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 115.950410][ C1] ? ktime_get+0x1f5/0x220 [ 115.954876][ C1] ? lapic_next_event+0x11/0x20 [ 115.959765][ C1] run_timer_softirq+0xb7/0x170 [ 115.964643][ C1] handle_softirqs+0x226/0x860 [ 115.969431][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 115.974226][ C1] __irq_exit_rcu+0xcb/0x220 [ 115.978841][ C1] irq_exit_rcu+0x9/0x30 [ 115.983116][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 115.988881][ C1] [ 115.991826][ C1] [ 115.994779][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 116.000780][ C1] RIP: 0010:pfn_valid+0x11f/0x490 [ 116.005815][ C1] Code: 74 7d e8 54 3e 84 ff 4d 85 ff 75 11 e8 4a 3e 84 ff eb 3d e8 43 3e 84 ff 4d 85 ff 74 ef 4d 89 fd 49 c1 ed 03 43 80 7c 25 00 00 <74> 08 4c 89 ff e8 c7 07 f4 ff 49 8b 2f 48 89 ee 48 83 e6 02 31 ff [ 116.025435][ C1] RSP: 0018:ffffc90005427318 EFLAGS: 00000246 [ 116.031522][ C1] RAX: ffffffff8243811c RBX: ffffffff824380da RCX: ffff88807b723e80 [ 116.039515][ C1] RDX: 0000000000000000 RSI: ffffffff8c6d8d60 RDI: ffffffff8c6d8d20 [ 116.047510][ C1] RBP: 0000000000000001 R08: 5a00000000000000 R09: 0000000000000000 [ 116.055496][ C1] R10: 0000000000000000 R11: ffffffff8ed5cb20 R12: dffffc0000000000 [ 116.063494][ C1] R13: 1ffff11027fc1430 R14: 0000000000062413 R15: ffff88813fe0a180 [ 116.071497][ C1] ? pfn_valid+0xba/0x490 [ 116.075859][ C1] ? pfn_valid+0xfc/0x490 [ 116.080229][ C1] ? pfn_valid+0xfc/0x490 [ 116.084602][ C1] page_table_check_clear+0x21/0x500 [ 116.089921][ C1] ? vm_normal_page+0x13c/0x2b0 [ 116.094793][ C1] __zap_vma_range+0x3a12/0x4f80 [ 116.099817][ C1] ? __pfx___zap_vma_range+0x10/0x10 [ 116.105128][ C1] ? mas_find+0x6d6/0xcb0 [ 116.109476][ C1] unmap_vmas+0x390/0x550 [ 116.113820][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 116.118677][ C1] ? mas_next_slot+0xc91/0xd70 [ 116.123489][ C1] exit_mmap+0x293/0x9f0 [ 116.127790][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 116.132615][ C1] ? __pfx_exit_aio+0x10/0x10 [ 116.137349][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 116.142570][ C1] __mmput+0x118/0x420 [ 116.146666][ C1] exit_mm+0x221/0x2d0 [ 116.150765][ C1] do_exit+0x6cd/0x2360 [ 116.154960][ C1] ? __pfx_do_exit+0x10/0x10 [ 116.159575][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 116.164630][ C1] do_group_exit+0x22d/0x2f0 [ 116.169231][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 116.174447][ C1] get_signal+0x121b/0x12c0 [ 116.178985][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 116.184578][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 116.190780][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 116.196175][ C1] ? rcu_is_watching+0x16/0xb0 [ 116.200962][ C1] do_syscall_64+0x328/0x520 [ 116.205574][ C1] ? trace_irq_disable+0x3b/0x140 [ 116.210605][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.216685][ C1] ? clear_bhb_loop+0x70/0xc0 [ 116.221410][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.227314][ C1] RIP: 0033:0x7fc29599e0d9 [ 116.231741][ C1] Code: Unable to access opcode bytes at 0x7fc29599e0af. [ 116.238791][ C1] RSP: 002b:00007fc2968730e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 116.247228][ C1] RAX: fffffffffffffe00 RBX: 00007fc295c26098 RCX: 00007fc29599e0d9 [ 116.255216][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc295c26098 [ 116.263194][ C1] RBP: 00007fc295c26090 R08: 0000000000000000 R09: 0000000000000000 [ 116.271185][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.279174][ C1] R13: 00007fc295c26128 R14: 00007ffe0f462540 R15: 00007ffe0f462628 [ 116.287178][ C1] [ 116.290820][ C1] Kernel Offset: disabled [ 116.295149][ C1] Rebooting in 86400 seconds..