last executing test programs: 25.413380089s ago: executing program 0 (id=100): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, 0x0, 0x0) ioctl(r0, 0xc138fd02, &(0x7f0000000000)="0400000000000000") 25.341772593s ago: executing program 0 (id=103): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r0, &(0x7f0000000340), 0x2000011a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r3, &(0x7f0000000380)=@abs={0x1, 0x0, 0x4e22}, 0x6e) listen(r3, 0x6) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r2, 0x1, 0x0, 0x0, {{}, {}, {0x8, 0x11, 0x2007ff}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write$UHID_SET_REPORT_REPLY(r4, &(0x7f0000000640)=ANY=[@ANYBLOB="0e00000002000000097f5d005e2597939e7684a094ee8db3c8b04a59fe7f667d755abc3a27219539e0328beac173da1c76484e55d9dec9127d2515fb612b0c1e3b49ee75c8f1f58e7fcab44681fe64eb937e7d59b195852f137404dd3e94997fb52b47004200d664ceb6e3fc121eb48d2008ea61e5ba06cdfdb04d30036d861d76a37ad6ee8392af0f4594fb003a4282195f4e0e4b1360bf86739932fe11e791667ce25775780464c95efd8e8bed32bc3ef650bdd0c7bec2e3e74575a95320513826cddd882e3ab118f9a230bdfa467bb309c773ee6ad816e0b1f2ecfc3b259ce65a8aae972a1279e8a3fc3a04b0bb59c01c0e7cecd98e8699693b8372d17f36fda053334818acde93c28bac0cb1a905f668569a40d8"], 0x69) write(r4, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r5 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x109022, 0x0) close(r5) writev(r5, &(0x7f0000001640)=[{&(0x7f0000000000)='i', 0x1}], 0x1) 24.505807201s ago: executing program 0 (id=111): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, 0x0, 0x0) ioctl(r0, 0xc138fd02, &(0x7f0000000000)="0400000000000000") 24.187385493s ago: executing program 0 (id=112): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1ec) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000200)={0xfffffff5, 0x0, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000480)={'syztnl0\x00', &(0x7f0000000400)={'ip6_vti0\x00', 0x0, 0x4, 0xb, 0x1, 0xe, 0x11, @dev={0xfe, 0x80, '\x00', 0xf}, @private0, 0x7, 0x7827, 0x10, 0xf7}}) lstat(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000580)={{{@in6=@private2, @in6=@mcast2, 0x4e22, 0x0, 0x4e23, 0x3, 0xa, 0x20, 0x0, 0x3c, r1, r2}, {0x80000000, 0xe22, 0x8000, 0x0, 0x4b, 0x7, 0x5, 0x7ff}, {0x66, 0x269d, 0x9, 0x94b1}, 0x1000, 0x6e6bb2, 0x0, 0x1, 0x2, 0x2}, {{@in=@loopback, 0x4d2, 0x8b}, 0xa, @in=@multicast2, 0x3501, 0x4, 0x0, 0x1, 0x3, 0xffff0001, 0x5}}, 0xe8) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8018, 0x1f7) r4 = fanotify_init(0x200, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r6 = openat$cgroup_devices(r5, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="62a02a3a3435"], 0xa) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KIOCSOUND(r7, 0x4b2f, 0x4) fanotify_mark(r4, 0x201, 0x4000003e, r3, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x2000, 0x100) r9 = socket$unix(0x1, 0x5, 0x0) bind$unix(r9, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r9, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) connect$unix(r10, &(0x7f0000000140)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) accept4$unix(r9, 0x0, 0x0, 0x80800) ioctl$FS_IOC_FSSETXATTR(r8, 0x401c5820, &(0x7f0000000080)={0x8}) 23.776753782s ago: executing program 0 (id=115): r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000180)=""/198, &(0x7f00000002c0)=0xc6) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a", @ANYRES32=r3], 0x14}, 0x1, 0x0, 0x0, 0x24008094}, 0x0) readv(r3, &(0x7f0000000180)=[{&(0x7f0000000540)=""/4114, 0x1012}], 0x1) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r2}) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r1, 0x3ba0, &(0x7f00000001c0)={0x48, 0x6, r4}) recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_first_group\x00', 0x1, 0x0) 23.400449315s ago: executing program 0 (id=118): r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x1a3400) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0x5) ioctl$NBD_DO_IT(r0, 0xab03) 22.774601666s ago: executing program 32 (id=118): r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x1a3400) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0x5) ioctl$NBD_DO_IT(r0, 0xab03) 3.916693691s ago: executing program 1 (id=218): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) r2 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x80800) readv(r2, &(0x7f0000000280), 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="210f00000000000000002000000008000300", @ANYRES32=r3, @ANYBLOB="94619c41541a04b672295fb0a9d65062655c7ebca4518a2a7930f43264d41a38aea3add163da07086ada4a77a8d502ef5c1c09f16436ea66acb72cc8bcb05f1d19b28ac1cafcb5f38324f9cc465f06821c3d0334cfd76e0bbad9d98ca2e54e5736084212fac4ad8a9027d4a769f87e1c1e170827bec8bacb41c86c0aa0147109930053b32506dfb6691fa824e2b73b48e3f8d4521143914e882c3c788d5bb5e7147ba236a3667f9c2df954dc33e2e141ec039c07f1660e8e625fb3160f20aa307e7148aad27735df2c1c9d693911a3af669716b3c4011584f5a18d1cddc7285b1223860e2315b6ce2ad2be53119d93b55e9725223bff3d727c60d793d105405bab1fd5c764d7c1d39999127cf285268675652a734e3b8b70b206e7f50c85d1c5af51bde946b08d8749257509199e6b0a00883a9a74b101599306735c3e406c339645123527223e1378ecf60a1a82f3b3712f1222c97d50dbd6b2528afb93cad600c80e74c63b842b6439dcc87477cac30614eab5de7ac7c22db3cb7447814bc0aa03d8f52eacde00ab3395e53e88de410c13e516e8242e83d85267ae5b3e151de71633c5181e84af9c1af2e363efcc0dc171"], 0x1c}, 0x1, 0x0, 0x0, 0x20000015}, 0x4850) 3.802120841s ago: executing program 1 (id=220): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000020000000000", 0x1b) ioctl(r0, 0xc138fd02, &(0x7f0000000000)="0400000000000000") 3.695666551s ago: executing program 1 (id=223): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYRESOCT, @ANYRESDEC, @ANYRESDEC, @ANYRES8=0x0, @ANYRESOCT=0x0, @ANYRES64=0x0, @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_usb_connect$rtl8150(0x1, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r1, &(0x7f0000000240)={0x14, &(0x7f00000000c0)={0x0, 0xc, 0xc2, {0xc2, 0x11, "1801d1896da762288fb3e3c309efccbeab37ad9e7be059b03cf228840c17606a9d8a57d3e2b751299cd3f00f868aa450c37f56cf2ce409e17abd95070c03c610968cbcc0e98c95aac64e8e3a249a5ccc945044e68179e08a974b6b8d42020aa04e1c657b995fb3dc1bd00929f6c7af9bae4de205a7b0a85de775665e648bea1487366dee1a7fc10e6435fefff59e3dcbe62f15de428052b793e342840747d0cdc455bf47233096500c802480ed0f8dfcd1967deda9df4dfaadce13ba8c607a5e"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x440a}}}, &(0x7f0000000400)={0x2c, &(0x7f0000000280)={0x0, 0x12, 0x60, "2ffcf217b6c9af3bdd852d52e54220c8ba4cd1a496ed8bd68b281d99faddfac41b960011367e24106cd4864563f6901d5a59ea4a53c686b5fd9a2829d01b63338557ee4b2d1825d98650ff939e312333257f15bde2e94b92c8282b3cc05b5039"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000380)={0xc0, 0x5, 0x4, 'x$El'}, &(0x7f00000003c0)}) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000ec0)=ANY=[@ANYBLOB="0022220000009623132742a0be5003e7e036042a0008070200000083"], 0x0}, 0x0) 3.556424773s ago: executing program 3 (id=224): socket(0x18, 0x6, 0x746) r0 = syz_usb_connect(0x6, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="0005080000370000000000005870dd00"/25], 0x0, &(0x7f0000000240)={0x0, 0x8, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000000)='./my_config\x00', 0x1ff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000000000)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x20, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}], 0x0, 0x20004801) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000000080)=ANY=[@ANYRES32=r4], 0x9) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r5) syz_clone3(&(0x7f0000000680)={0x80000000, 0x0, 0x0, 0x0, {0x1c}, 0x0, 0x0, 0x0, &(0x7f0000000600)=[0x0], 0x1}, 0x58) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000003700)={0x1, 0x0, [{0x485, 0x0, 0x4}]}) mount(0x0, &(0x7f0000000100)='./my_config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) openat(0xffffff9c, &(0x7f0000000600)='./my_config/usb_gadget/g1/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0) 2.817118267s ago: executing program 2 (id=225): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffff7]}, 0x8, 0x80000) fremovexattr(r2, &(0x7f0000000040)=@known='system.posix_acl_access\x00') sendmmsg$alg(r1, &(0x7f0000004500)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@iv={0x18}], 0x18, 0x4040000}], 0x1, 0x4) 2.794100192s ago: executing program 3 (id=226): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000340)='erofs\x00', 0x0, &(0x7f0000000240)='acl') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000009, 0x204031, 0xffffffffffffffff, 0x44592000) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a00)='blkio.bfq.empty_time\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000006, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x34, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x100000000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x5}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, 0x0, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x8, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYRES64=r2, @ANYBLOB="b43563f029106190ea9893e50fa3159a5c66c1e7906e8e3a296d63f19a1c78", @ANYRES32=r4, @ANYRESDEC=r5, @ANYRES16=r3], 0x128}, 0x0) recvmsg$unix(r9, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=[@rights={{0x10}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x50}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r11) 2.712626065s ago: executing program 2 (id=227): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0, 0x0, 0x4000}, 0x20000800) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) 2.705410651s ago: executing program 2 (id=228): setns(0xc9, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_usb_connect(0x0, 0x4f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005cdd2e106307151088560000000109023d00010000d0000904"], 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r0, 0x1, &(0x7f0000000140)={&(0x7f0000000000)=""/120, 0x78}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/vlan/vlan0\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8923, &(0x7f0000000000)={'vlan0\x00', @multicast}) pselect6(0x40, &(0x7f0000003800)={0x3, 0x6, 0x8, 0x1, 0x4, 0x1, 0x5, 0x7}, 0x0, &(0x7f0000003880)={0x9, 0x3, 0xfffffffffffffffe, 0x8, 0xfffffffffffffc00, 0x8000000000000000, 0x0, 0x5}, &(0x7f00000038c0)={0x0, 0x989680}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8) writev(r2, &(0x7f0000000300)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560aff820fffff5bab00070000002058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd0000000c0001000a0c100000000000224e0000", 0x58}], 0x1) syz_usb_connect$uac1(0x1, 0x90, &(0x7f0000000240)=ANY=[@ANYBLOB="12010102000000086307802040000102030109027e0003018160030904000000010100000a24010900280002"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_connect$uac1(0x0, 0x81, &(0x7f0000000480)=ANY=[@ANYBLOB="12011000000000208205160040000102030109026f0003010050810904000000010100000a240100000a0002010209040100000102000009040101010102000008240201080204020724eefb64c2283f25b70910020c0777072501000803000904020000010200000904020101010200000905820920000602fd07250104027b6879d6f945a75731dfcba857c5093a223cf183a0da30298541a0442750eb1a4bf189dc426f904d15732efb3f33cf5bf99d6832d78d0513f4e08e4b2107e49f8e1a681b20424c8db39f18fb81cd3b85f3af6aa4ea267c371000e282e2af2be567cb1c9b66cae27408edaa"], 0x0) syz_usb_connect(0x1, 0x685, &(0x7f0000000980)={{0x12, 0x1, 0x200, 0x2b, 0x4b, 0x2f, 0x10, 0x5050, 0x1000, 0x4e14, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x673, 0x1, 0x2a, 0x3, 0x5a35487298135127, 0x0, "", [{{0x9, 0x4, 0xad, 0x3, 0x10, 0x42, 0x4a, 0xfe, 0x1, [@cdc_ncm={{0x8, 0x24, 0x6, 0x0, 0x1, "f3872f"}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0xa4, 0xffff, 0x4, 0x8}, {0x6, 0x24, 0x1a, 0x6, 0x23}, [@mdlm_detail={0xb7, 0x24, 0x13, 0x0, "bf1e304188f4e0250e86950eac655aa8939589d59224bf0565ea1190a12dbaf144e7d9908a3dddfec5e1a720f8b617f25e7b4d126f60639e0b898f635f06d9f007e82313fdfdd0f827f0f983e32f4e538e83366c256583a2dcb2b5a2bb287a31f8d9f04c865c807e9e1e49c8951c25b9dd805c06b04d827616ceee2ada5840849e579a4aa01295309bdb71a4259c145fa6808cb8ad7c9620c55a45a92442d81b511a1f13bd4464b835e74cf2d7ceb0f4ab3630"}, @mbim={0xc, 0x24, 0x1b, 0x100, 0x9, 0xf8, 0x0, 0x5, 0x10}, @call_mgmt={0x5, 0x24, 0x1, 0x3, 0x8}, @mbim={0xc, 0x24, 0x1b, 0x7f, 0xff81, 0x9, 0x3, 0xbb, 0xe}, @mdlm={0x15, 0x24, 0x12, 0xc9}]}], [{{0x9, 0x5, 0x2, 0x0, 0x40, 0x36, 0xf, 0x5, [@generic={0x94, 0x11, "145a5f0712fc04169d0e7e5dac218e866c09f3d301b0552f1f06433d0c42f9e2b53a4dfefa553e727fa73e17a50388b9d40748736e8f3e953d82e4d87627b9a545a56b2d6915c73aa0dbe8fb300b04aca7f740fafd9e495902a29e7f9ff498f0f5b3d511b73968e9a459bc9b6fa0f93e56fdcd7de9ff9888ebedfa442d4fbd4b2826c5d982cf12515a19714dd3aa138a4dad"}]}}, {{0x9, 0x5, 0xb, 0x4, 0x10, 0x6, 0x0, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x6}, @generic={0xdd, 0x9, "6f10e0793e821b847d9022a91542ab741eabca20db42a2a97087b05542f1776d675cf37731395c719a28d657577136e156ece37fb6aafafe92b0ad4a5a54f75958e9de997fa5b2b2d13b4b9b3a2e297eed5707784c4d760ac749ac8b1873e25d29072f1b5a8f6d035b3c8481d7955f5b848f64ebd7d950d2ac2ed91bdd940cae5d801fe0c2f87428bf4fb844e223a4300e1035c0f0b8cd47767e1e730d0b964c848d02a960dc93a668c20895eec6acfd02b0bd4c18f2ac4a1ea60c1ea3d9a0a92f9fa253b1661ff31e1d9b43a7a9a564f8cb97a76d7fd34fcd2fb0"}]}}, {{0x9, 0x5, 0x3, 0x19, 0x8, 0xf, 0x34, 0xac}}, {{0x9, 0x5, 0xe, 0x2, 0x18, 0x3, 0x2, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x6, 0x6}]}}, {{0x9, 0x5, 0xb, 0x10, 0x20, 0x3, 0x8, 0x4, [@generic={0x49, 0x2, "9aab2a7b98cc835382d6834654e3e1636f2a12b1c1889f9ab072bf0ffff9c30fb2792da30546ea6cd619fab07eec5c64031fb6e6dc6081877204cc9e412ab62c1327d3ce6e167a"}]}}, {{0x9, 0x5, 0xb, 0x3, 0x200, 0x0, 0x3, 0x80, [@generic={0xd4, 0x9, "e126ec4d0f396e34dfd6953e961ad7c2e1e913d60e79c0063882567a045bd1dc58bb19ca220be54a43fd7dca07f74ca93205a6efcc4fa1484b0ad5ab2e852818ca0f60f23a40b380a5887473c335c25342006c8c3fd6a90c5dd1ba3b4a71cf3872b9c659fcd038cfe0c23d9f5224734b0d5111ef090d2712b69b11df4e3a673b1c3185bbc3ae50a21621e5fefef58f81ef6d5f835672e71598d65ffc1b56714de707bb0a7e1786ba866c1d423c0b03d81975bec14b3e56e65c4b0e3223c87107ca3045e050aff23130d79d03d89a1920734e"}, @generic={0xa7, 0x0, "9f5b988e32bcd20d3efac7c0180e348b73204579dec414901dff5f5e089f2df417b01ca774dc6de37c532f974836b72cfa154429b78128c23c75329aab8f594ff6d84abefee5d21ba4048e44e41faf80f6f1509df1827a45e96451654faf0d8eaa1f912432caffe297f8b1a4f17d0ded613db720cad49246bba4af0a22d9e307310ba76791e0d006fbeca6d0850b6e507adda509097a21931042de33f5ec1193ae2b2a3f53"}]}}, {{0x9, 0x5, 0x9, 0x0, 0x8, 0x4a, 0x1, 0x7f, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x1, 0x9}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x8, 0x3ff}]}}, {{0x9, 0x5, 0x0, 0x2, 0x3ff, 0x7, 0x0, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x0, 0x9}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x1, 0xfff7}]}}, {{0x9, 0x5, 0xc, 0x2, 0x200, 0x10, 0x9, 0x1}}, {{0x9, 0x5, 0x6, 0x0, 0x200, 0x7, 0x80, 0x94, [@generic={0x5d, 0x6, "4570ea9ebae62f4470f846824f6507ca06f68705c2ea43e862286c2f3d4d39310d9470bdb2d2bd57f732a049e0b847096f7133736da8f1be44900dc3ddc74a3d8269a2b2f00ec2b44a4512a6d3d157aa65db567a4e2a0d003fda37"}]}}, {{0x9, 0x5, 0x1a, 0x4, 0x10, 0x7, 0x3, 0x8}}, {{0x9, 0x5, 0xe, 0x0, 0x400, 0x0, 0x8, 0x4, [@generic={0x5e, 0x20, "0b5d86bc6741ec8207782aef0dca8c7dc6f5386c3f1315b44e24769dd8ded84b026d3fca244e29d4cf39b30d95322e7f185f258bb40b5d84b32c195d375c9ca3992cdfbc6c0334c9afae0d711b93a6d5414b4e6bcd616a88187e2999"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0xcd, 0x9}]}}, {{0x9, 0x5, 0xc, 0x10, 0x200, 0x2, 0x6, 0x4}}, {{0x9, 0x5, 0xf, 0x0, 0x20, 0x81, 0x3, 0xec}}, {{0x9, 0x5, 0xc, 0x8, 0x8, 0x0, 0x9, 0xc}}, {{0x9, 0x5, 0xa, 0xd890221ad644231f, 0x40, 0xe, 0x0, 0x3, [@generic={0xa7, 0x8, "11bbffd53c32c729a8c3018c5c1d7789c07ac4761551b3275e55c1fbf67bcb733244f29270a2cc1a74e59ef26653beba65cbde2fcce2eba04ea0a0396802086c7353f3a440a75f9e5f900e78ab18b3d84140a589263edd9f1b17571333ae23aaf97a2b05315c55a726728675d72b66642c3e4117ae9bfdf3b522fa0c038bc78f5dab4629b35e16e86209c451cfc35c191537d25da76a685cd50f013d942d9abb53788c24bb"}]}}]}}]}}]}}, &(0x7f0000001180)={0xa, &(0x7f0000001040)={0xa, 0x6, 0x201, 0x1, 0x7, 0x0, 0x20, 0x72}, 0x8f, &(0x7f0000001080)={0x5, 0xf, 0x8f, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0x7d, "fd50ce97ca84a290af9082eaa40ff77d"}, @generic={0x61, 0x10, 0x3, "b3fe82bc6301c4b1f98852e76b07c087a76833693c3d14f79d23ad1f73f183495ab36905f6a25c1f8cb28b3e1eea113db004f09e8038e466defc08690d83ef310a4ce5d938fb85b2a8bdc5d66b8152fc53df1c0268b89f949a38088fd470"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x0, 0xf9, 0x8, 0x5, 0x40}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0xe}]}, 0x1, [{0x4, &(0x7f0000001140)=@lang_id={0x4, 0x3, 0x41a}}]}) syz_usb_connect$uac2(0x3, 0xcc, &(0x7f0000000580)={{0x12, 0x1, 0x168, 0x0, 0x0, 0x0, 0x40, 0x15ca, 0x1806, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xba, 0x3, 0x1, 0x10, 0x20, 0x0, {0x8, 0xb, 0x2, 0x1, 0x1, 0xb, 0x20, 0x4}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4, 0x9, 0x10, 0x7}, [@processing_unit={0x7, 0x24, 0x8, 0x2, 0x1, [0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x2, 0x1ff, 0xb6, "7b68b6e4"}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x2, 0x7, 0x0, {0x8, 0x25, 0x1, 0x2, 0x3, 0x3, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0x8}, @as_header={0x10, 0x24, 0x1, 0x0, 0x8, 0x3, 0x4, 0x4, 0x1efd, 0xfe}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x4, 0x3, 0x0, 0x44, "be13"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0xf8}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x7, 0x1, 0xf0, 0x3a, "aa4a"}, @format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x58, 0x4, 0x6, 0x3, "260e8c0fe7"}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x4, 0x8, 0x5, {0x8, 0x25, 0x1, 0x82, 0x36, 0x7, 0xbf4}}}}}}}}]}}, &(0x7f0000000940)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x201, 0xf2, 0x7, 0x40, 0x8, 0xd8}, 0xdc, &(0x7f00000006c0)={0x5, 0xf, 0xdc, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x4, 0x7, 0x5, 0x1}, @ptm_cap={0x3}, @generic={0xcd, 0x10, 0x2, "7372e556b74d206dfc2673acb4e6538acbeb697ce53867406dde4ee3306b151da97e2e6a18bc773be47d07d3f3c9b18878a6229dfb61b5f4626ee60971890761cead35c84c7649c1d1081edaefcc1dfc3c3402a61e56648e8ba300186c066ea7b16f4ca598e2e639aaab1763f0f8eed7293dc18846dfd2f0bc2ac254a69a10d7fc35ff5a28f0715b86e81fedb0816abf3e204c9380908bb1a566d8a723095f09f642d64db518ea650468688c8bd517731fc70e189015cfa5bd50f04cbfa968259aef1b63cf3a89cbd737"}]}, 0x3, [{0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x827}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x80a}}, {0xc6, &(0x7f0000000840)=@string={0xc6, 0x3, "037c984a50ba8e0663ebad1b1acadb83cf222a1337236e7c16c845bac213385a9a927062a5cb9fbca63d631b3b11bfa13c4f2d022e4e78fbc40fc95175058268e1e2efccb38ce09ac7bb5d452edfb4f91f0facea76a9f1d845ccd5762e834fa146f27786877a6ad7c7463f1a564056ab13c37c879e8d770033208610f978b19d4f51e6c9393e4341c9b86c11fda32b15698175ca992a046842a29cdfffdd5ab9c48e5648083d5cdfceaaf42b6397a10b28390dc36f5c4f9e16e4ae8499d28cca03c81d11"}}]}) 2.454353299s ago: executing program 3 (id=229): r0 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000000)) r1 = mmap$KVM_VCPU(&(0x7f000018c000/0x1000)=nil, 0x0, 0x2000001, 0x100010, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f0000000080)="7cf1739af874f228fc02bf4d3acc856ad161bfd829d1f148495aa80a5dc04acf72559c47e3096507d6fa498857619fbd995fff70859123d430806b71d79a14a135648a969aeed688", 0x0, 0x48) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0xfffffffc, @loopback, 0xe}, {0xa, 0xce1e, 0x800000d, @mcast1}, 0xffffffffffffffff, 0x1005}}, 0x48) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, &(0x7f0000000100)=0xc, 0x4) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 2.182138483s ago: executing program 4 (id=232): ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)={'wlan1\x00'}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r0) r2 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) r4 = openat$cgroup_pressure(r3, &(0x7f0000000080)='memory.pressure\x00', 0x2, 0x0) read$nci(r4, &(0x7f0000000000)=""/95, 0x5f) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000680)=ANY=[@ANYRES16, @ANYRES16=r1, @ANYBLOB="010000000000000000002f010000100001800a000200626f6e643000000004000280"], 0x28}, 0x1, 0x0, 0x0, 0x86}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x10000) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) setns(0xc9, 0x0) r9 = socket(0x2a, 0x2, 0x0) r10 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r10, 0x560d, 0x1000000000003) ioctl$INCFS_IOC_CREATE_FILE(r10, 0xc058671e, &(0x7f0000001bc0)={{'\x00', 0x2}, {0x8000000000000001}, 0x0, 0x0, 0x0, &(0x7f00000007c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000017c0)='./file0\x00', &(0x7f0000001800)="fe3501717238912c51b2fdff95c597acf0ea6c2fa1dd576a7b6c9aad5eafc2850ec69b8665ab51eb2152ca2903b7ada6d69f2cd0c2b6303997960d94faec2f13eeadb17cac122ff1034db9c0e2d6f186f80b5b018051631016260791c429658a89293e5907cb3b0406ed2f38b49c5366c85891c377091cbfd754c35ef0aa4e827a5380873e5909435404b185625f6a47c917a961d298a6999246608303d54eaad60c7e378f9a3fc6e1325b7f01271cfc21ad43d702e8b6faeaee2393b7f0991995459f886b4dc76c2fbe4a50e1e81268a3a417e165f76cc8dfed785331982ae19283265218697dd8ddb3fc1e74a5d37005a7db468b9caaf9554dcc0d1e12317077438385ff35bb4367563837023ee9a7d77ca63c7900c8a823152515d915cd4c2b90b065b3c73c5fe72030d47fafd47e64d841603cc5a8ff27d55900463e3cff4e10cd29028c441c66e2ae96a2536febd758d74d282428eeaa122e996b7286e7b5b39e83395de86216dee293c19fc9b6b1556c9c4afcdbdfc2d4308865466f07e116f8305618dc0cc4ff5680c10ee55e1cea4e9a9816fd7961517ae91a73de7d8eba548093e8a1683e4e706def21626551fba442204566d3bcc5999775c13d721ce83e67cfbd76b1e2f208bd150bf2555a4b5f266246c48c3e4534def319869e70b49fd3cfb95cd32e5350b313", 0x1ed, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000017010000000000000cf20000005e407824a985b401101589a5159f399e7c0013385ea70d8f0cf3808af1260250ac9974069962c7e1633c516a43e9620d51a7b82cd2b777d86702cc3291f9d2df9a1856b21ec468890abfdce34868f9013931d9f474beddbea37c1cd3995c5709ba612f63e7ca6b53ea43736e20d9c94a86b95079a0a811c35e031e76d222e3406090c863ceb08c40428425d87c4cdcd2489ce8fd328cfe334012ed46a60de6bbe6865274a2d293506cf221d40ccd67fbacc80801c71b115cbf0bfa98f09b0fd38b8d44727c113b56d688e9bbd5d2f7f9b78e46e0359655abeb8f8f54ab0d5c496cc1ecfe4d34c82805cbaeacb671eb7c4d05a550f968638d6ca9dbd39e806b1800000091efca963e5e614fb51a15716b7553ee1a8ed7548861810d87000000c2e48c9e0759570504b5292d12aa5358763c8633fbfe27813ac57fa60d15d091ae6e9e7306a3c5e3b3a8ca75a4f40e5bcac805bd6f981a4b0aa97091e45eb5b84bea4917f133651be2dc2fdd30e18a23af859de42a2f4241cbfcd1d5ed93171ce1573e76a496b91f026d92d3eb4beac715424b4f62748fc5beead82b4f4a07828896079df0b084"], 0x1aa}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r9, 0x8915, 0x0) r11 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000240)={'veth1_virt_wifi\x00', 0x0}) syz_usb_connect(0x0, 0x5a, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000060f94d100d05020027230102030109024840020000000009047d04031d5abf0009050400005539000009050b00000000000009050200000005000009047d01013481af0009a00e00230000690009047d"], 0x0) bind$packet(r11, &(0x7f0000000080)={0x11, 0x3, r12, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3a}}, 0x14) close_range(r7, 0xffffffffffffffff, 0x0) r13 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r13, 0x11c, 0x4, 0x0, &(0x7f00000005c0)) r14 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r14, 0x4400ae8f, &(0x7f0000000140)=@x86={0xae, 0x3, 0x7, 0x0, 0xa, 0x7, 0xfe, 0x8, 0x10, 0x7, 0x3, 0x1, 0x0, 0x3, 0x19, 0x4, 0x81, 0x7, 0x7f, '\x00', 0x2, 0x8}) 1.447857971s ago: executing program 3 (id=233): r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000180)=""/198, &(0x7f00000002c0)=0xc6) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a", @ANYRES32=r3], 0x14}, 0x1, 0x0, 0x0, 0x24008094}, 0x0) readv(r3, &(0x7f0000000180)=[{&(0x7f0000000540)=""/4114, 0x1012}], 0x1) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r2}) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r1, 0x3ba0, &(0x7f00000001c0)={0x48, 0x6, r4}) recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_first_group\x00', 0x1, 0x0) 1.255526169s ago: executing program 2 (id=234): socket(0x18, 0x6, 0x746) r0 = syz_usb_connect(0x6, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="0005080000370000000000005870dd00"/25], 0x0, &(0x7f0000000240)={0x0, 0x8, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000000)='./my_config\x00', 0x1ff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000000000)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x20, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}], 0x0, 0x20004801) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000000080)=ANY=[@ANYRES32=r4], 0x9) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r5) syz_clone3(&(0x7f0000000680)={0x80000000, 0x0, 0x0, 0x0, {0x1c}, 0x0, 0x0, 0x0, &(0x7f0000000600)=[0x0], 0x1}, 0x58) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000003700)={0x1, 0x0, [{0x485, 0x0, 0x4}]}) mount(0x0, &(0x7f0000000100)='./my_config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) openat(0xffffff9c, &(0x7f0000000600)='./my_config/usb_gadget/g1/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0) 1.215995002s ago: executing program 4 (id=235): setns(0xc9, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb", 0x57}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000440)={0x80000001, 0x0, 0x0, 0x100}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="1c0000001a000100000000000000000080"], 0x84}}, 0x20048010) r1 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f00000001c0)=[{&(0x7f0000000000)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e422000000000100804824cabecc4b381eaadc28f23457e792945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff", 0x58}, {&(0x7f0000000080)="8c1d69e0d27406055fe12832ef2bc6df90f807901d1f3ab6c697def4f6a6afa9f04671365a8efb0bc85f9c51c25930af08c7de0e05ef509647469a4c31ab", 0x3e}, {&(0x7f0000000140)="3d1a83dbb66dad7210e7c0dfadcf99f8324fa3d74f15a7bc0a31eeb6e1fc082e08763e74ca2a1d9ad0f01240c9675920455ef24bfe052181674b1b617e5e3e1e7ca5645a4d789ec94d", 0x49}], 0x3) 1.063987848s ago: executing program 4 (id=236): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = fsopen(&(0x7f0000000180)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x80) r3 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000001c00), 0x12) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000001c40)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_WRITE(r4, &(0x7f0000003c80)={0x18, 0xffffffffffffffda, r5, {0x6}}, 0x18) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0xfffffffe, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0xe2, 0x4000, @fd=r6, 0x65, 0x0, 0x0, 0x1, 0x0, {0x0, 0x0, 0xdb, '\x00', 0x0, 0x7}}) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x4, 0x2ef, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x20d}}}, &(0x7f0000000440)) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) (async) fsopen(&(0x7f0000000180)='cgroup2\x00', 0x0) (async) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async) fsmount(r1, 0x0, 0x80) (async) openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f0000001c00), 0x12) (async) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000001c40)={0x2020}, 0x2020) (async) write$FUSE_WRITE(r4, &(0x7f0000003c80)={0x18, 0xffffffffffffffda, r5, {0x6}}, 0x18) (async) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0xfffffffe, 0x1e5}, &(0x7f0000000000), &(0x7f0000000080), &(0x7f0000000140)) (async) syz_io_uring_submit(r7, r8, r9, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0xe2, 0x4000, @fd=r6, 0x65, 0x0, 0x0, 0x1, 0x0, {0x0, 0x0, 0xdb, '\x00', 0x0, 0x7}}) (async) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x4, 0x2ef, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x20d}}}, &(0x7f0000000440)) (async) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) (async) 549.924141ms ago: executing program 2 (id=237): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000040)={0xa, 0x4e20, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000340), 0x4) write(r0, &(0x7f0000000700)='0', 0x1) 548.614986ms ago: executing program 3 (id=238): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) r1 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) pselect6(0xffffffffffffff26, &(0x7f0000000240)={0x3, 0x8, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x3, 0xffffffffffffffff, 0xc, 0x1, 0xffff, 0x80000006, 0xb06c}, 0x0, 0x0) ioctl$VIDIOC_S_TUNER(r1, 0x4054561e, &(0x7f00000000c0)={0x4, "6816d6d64309719f8db9029258c1a34f9d2adc3c97eb3af1929fb38c9ceeb696", 0x1, 0x1000, 0x4, 0x3, 0x4, 0x0, 0x10, 0x7}) listen(r0, 0x3) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0xb8, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x4c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x30, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0x12}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_COMPAT={0x4c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x809b}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x33}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6005}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x62}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0xb9}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x87}]}]}], {0x14}}, 0xe0}, 0x1, 0x0, 0x0, 0x40}, 0x4040080) r4 = accept(0xffffffffffffffff, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x24008840}, 0x0) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r5, &(0x7f00000001c0)={&(0x7f00000017c0)={0x2, 0x4e21, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000700)=[@rdma_args={0x48, 0x114, 0x1, {{0x4000, 0x800}, {&(0x7f0000000140)=""/108, 0x6c}, &(0x7f0000001b40)=[{&(0x7f0000000080)=""/79, 0x4f}], 0xffa1, 0x40}}], 0x48}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, r6) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x900, 0x0, 0x400c081}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), r4) 547.67556ms ago: executing program 4 (id=245): r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000180)=""/198, &(0x7f00000002c0)=0xc6) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a", @ANYRES32=r3], 0x14}, 0x1, 0x0, 0x0, 0x24008094}, 0x0) readv(r3, &(0x7f0000000180)=[{&(0x7f0000000540)=""/4114, 0x1012}], 0x1) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r2}) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r1, 0x3ba0, &(0x7f00000001c0)={0x48, 0x6, r4}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_first_group\x00', 0x1, 0x0) 528.065539ms ago: executing program 1 (id=239): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f4070009", 0xe) ioctl(r0, 0xc138fd02, &(0x7f0000000000)="04000000") 383.775479ms ago: executing program 4 (id=240): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f407000904001f000000000200000000000008", 0x1d) ioctl(r0, 0xc138fd02, &(0x7f0000000000)="0400000000000000") 287.928732ms ago: executing program 1 (id=241): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, 0x0) syz_open_dev$radio(&(0x7f0000000400), 0x3, 0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) pselect6(0x40, &(0x7f0000000240)={0x3000000, 0x0, 0x1ff, 0x7d, 0x4000000000000000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x5, 0x4, 0xf, 0x80000006, 0x6}, 0x0, 0x0) 262.648532ms ago: executing program 3 (id=242): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x210, 0x1, 0xfff}, 0xc) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, 0xffffffffffffffff, 0x1000) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0xffffffff, 0x1e5}, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_OPENAT2={0x1c, 0x10, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000140)=@any_dev={0x4, 0x974, 0x0, 0x0, 0x1000, 0x4, 0x0, 0x0, 0x45}}}, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 237.038861ms ago: executing program 4 (id=243): r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000440)={'vcan0\x00', 0xcd}) pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$OCFS2_IOC_RESVSP(r1, 0x40305828, &(0x7f0000001180)={0x0, 0x2, 0x8, 0xd, 0xff, 0xb}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f0000001080)=[@uexit={0x0, 0x18, 0x800}], 0x18}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="00082dbd7000fbd8df25"], 0x14}, 0x1, 0x0, 0x0, 0x8004}, 0xa4) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$x86(r5, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r6, &(0x7f0000000040)={0x0, 0x0}) mremap(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000ffe000/0x2000)=nil) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000280)={0xaa, 0x28}) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r7, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ff9000/0x4000)=nil) migrate_pages(0x0, 0x5, &(0x7f0000000040)=0x9, &(0x7f0000000080)=0x272) pipe(&(0x7f00000002c0)) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) r14 = dup(r13) syz_ublk_setup_queues(r14, r12, &(0x7f0000000180)={0x0, 0x20fb83, 0x800, 0x1, 0x2d2}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x15a, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8000, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x1, 0x3, 0x0, 0x0, r14}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x82, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r14, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x829, 0x0, 0x0}}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x28, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x4011}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) 231.528649ms ago: executing program 2 (id=244): r0 = socket$inet_tcp(0x2, 0x1, 0x6) bind(r0, &(0x7f0000000000)=@in={0x2, 0x808, @loopback}, 0x80) listen(r0, 0x5) r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000200)='source\x00', &(0x7f0000000300)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000400)='addr\x00', &(0x7f0000000500)='127.0.0.1\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x2d41, 0xd5) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000001040)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000240)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0x50) syz_fuse_handle_req(r2, &(0x7f0000008380)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d79e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ff00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xfffffebf, 0xffffffffffffffda, 0xa1e0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x109881, 0x74) fcntl$lock(r4, 0x24, &(0x7f0000000200)={0x1, 0x0, 0x700, 0x1000000}) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000600)='port\x00', &(0x7f0000000700)='2056\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000800)='vers\x00', &(0x7f0000000900)='4.2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000a00)='xprtsec\x00', &(0x7f0000000b00)='tls\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async) r5 = accept(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000c00), 0x4) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0x100b, 0x4}) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0}) dup3(r7, r6, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r8, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000940)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000400)={@ptr={0x66642a85, 0x1, 0x0, 0x0, 0x80000001, 0x3e}, @ptr={0x70742a85, 0x20000000, &(0x7f0000000680)=""/227, 0xe3, 0x1, 0x26}, @fd}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0}) 0s ago: executing program 1 (id=246): socket(0x18, 0x6, 0x746) r0 = syz_usb_connect(0x6, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="0005080000370000000000005870dd00"/25], 0x0, &(0x7f0000000240)={0x0, 0x8, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000000)='./my_config\x00', 0x1ff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000000000)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x20, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}], 0x0, 0x20004801) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r3, 0x84, 0x17, &(0x7f0000000080)=ANY=[@ANYRES32=r5], 0x9) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r6) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0xfffffffffffffffb) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000003700)={0x1, 0x0, [{0x485, 0x0, 0x4}]}) mount(0x0, &(0x7f0000000100)='./my_config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) openat(0xffffff9c, &(0x7f0000000600)='./my_config/usb_gadget/g1/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.179' (ED25519) to the list of known hosts. [ 63.384405][ T5601] cgroup: Unknown subsys name 'net' [ 63.497982][ T5601] cgroup: Unknown subsys name 'cpuset' [ 63.505965][ T5601] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 64.885010][ T5601] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 67.030267][ T5612] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.038598][ T5612] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 67.057534][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 67.059112][ T5617] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 67.059661][ T5617] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.061082][ T4934] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 67.071533][ T4934] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 67.073728][ T4934] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 67.095599][ T4934] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 67.110450][ T4934] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 67.123289][ T4934] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 67.134128][ T4934] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 67.142218][ T4934] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 67.150335][ T4934] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 67.157954][ T4934] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 67.197990][ T4934] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 67.207899][ T4934] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 67.208861][ T4934] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 67.215913][ T4934] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 67.216508][ T4934] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 68.513460][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.514492][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.514644][ T5615] bridge_slave_0: entered allmulticast mode [ 68.516531][ T5615] bridge_slave_0: entered promiscuous mode [ 68.520618][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.520756][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.521109][ T5615] bridge_slave_1: entered allmulticast mode [ 68.522644][ T5615] bridge_slave_1: entered promiscuous mode [ 68.567785][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.567920][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.568362][ T5611] bridge_slave_0: entered allmulticast mode [ 68.570600][ T5611] bridge_slave_0: entered promiscuous mode [ 68.614245][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.615122][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.615497][ T5611] bridge_slave_1: entered allmulticast mode [ 68.617124][ T5611] bridge_slave_1: entered promiscuous mode [ 68.668764][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.693471][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.698258][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.720935][ T5626] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.721811][ T5626] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.721925][ T5626] bridge_slave_0: entered allmulticast mode [ 68.723587][ T5626] bridge_slave_0: entered promiscuous mode [ 68.729829][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.743344][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.743439][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.743550][ T5619] bridge_slave_0: entered allmulticast mode [ 68.746500][ T5619] bridge_slave_0: entered promiscuous mode [ 68.749673][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.749765][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.750114][ T5619] bridge_slave_1: entered allmulticast mode [ 68.751786][ T5619] bridge_slave_1: entered promiscuous mode [ 68.810004][ T5626] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.810160][ T5626] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.810315][ T5626] bridge_slave_1: entered allmulticast mode [ 68.812675][ T5626] bridge_slave_1: entered promiscuous mode [ 68.831514][ T5615] team0: Port device team_slave_0 added [ 68.863853][ T5615] team0: Port device team_slave_1 added [ 68.876742][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.879813][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.904294][ T5611] team0: Port device team_slave_0 added [ 68.925524][ T5626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.928235][ T5611] team0: Port device team_slave_1 added [ 68.929081][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.929098][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.929121][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.932303][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.932316][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.932339][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.936584][ T5619] team0: Port device team_slave_0 added [ 68.939830][ T5626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.964227][ T5619] team0: Port device team_slave_1 added [ 69.033602][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.033617][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.033641][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.037622][ T5626] team0: Port device team_slave_0 added [ 69.040109][ T5626] team0: Port device team_slave_1 added [ 69.072783][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.072798][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.072822][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.111840][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.111856][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.111879][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.117104][ T4934] Bluetooth: hci0: command tx timeout [ 69.124797][ T5615] hsr_slave_0: entered promiscuous mode [ 69.128554][ T5615] hsr_slave_1: entered promiscuous mode [ 69.192803][ T4934] Bluetooth: hci2: command tx timeout [ 69.195037][ T4934] Bluetooth: hci1: command tx timeout [ 69.231769][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.235042][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.235068][ T5626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.236131][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.236142][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.236164][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.265096][ T4934] Bluetooth: hci3: command tx timeout [ 69.277706][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.277720][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.277744][ T5626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.366793][ T5611] hsr_slave_0: entered promiscuous mode [ 69.368028][ T5611] hsr_slave_1: entered promiscuous mode [ 69.369267][ T5611] debugfs: 'hsr0' already exists in 'hsr' [ 69.369372][ T5611] Cannot create hsr debugfs directory [ 69.383117][ T5619] hsr_slave_0: entered promiscuous mode [ 69.384060][ T5619] hsr_slave_1: entered promiscuous mode [ 69.384809][ T5619] debugfs: 'hsr0' already exists in 'hsr' [ 69.384826][ T5619] Cannot create hsr debugfs directory [ 69.453499][ T5626] hsr_slave_0: entered promiscuous mode [ 69.454404][ T5626] hsr_slave_1: entered promiscuous mode [ 69.456378][ T5626] debugfs: 'hsr0' already exists in 'hsr' [ 69.456397][ T5626] Cannot create hsr debugfs directory [ 69.796703][ T5615] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 69.811509][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 69.812366][ T5615] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 69.823575][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 69.827044][ T5615] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 69.836916][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 69.838007][ T5615] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 69.854395][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 69.919826][ T5611] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 69.930101][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 69.932520][ T5611] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 69.940864][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 69.952875][ T5611] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 69.958639][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 69.960854][ T5611] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 69.972819][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.069735][ T5619] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 70.079341][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.089973][ T5619] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 70.098938][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.114140][ T5619] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 70.123355][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.132475][ T5619] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 70.141300][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.179713][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.225958][ T5626] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.236402][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.249163][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.256655][ T5626] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.267248][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.267995][ T5626] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.283631][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.294393][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.294725][ T5626] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.304447][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.341321][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.341457][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.373935][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.374046][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.384509][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.408191][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.408293][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.410543][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.410635][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.475498][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.528763][ T5619] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.547080][ T84] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.547176][ T84] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.574632][ T84] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.575179][ T84] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.701633][ T5626] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.778284][ T5626] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.813383][ T1150] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.813507][ T1150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.851699][ T1150] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.851816][ T1150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.185570][ T4934] Bluetooth: hci0: command tx timeout [ 71.277308][ T4934] Bluetooth: hci1: command tx timeout [ 71.277352][ T4934] Bluetooth: hci2: command tx timeout [ 71.293194][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.299835][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.345183][ T5612] Bluetooth: hci3: command tx timeout [ 71.388474][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.493940][ T5611] veth0_vlan: entered promiscuous mode [ 71.536187][ T5611] veth1_vlan: entered promiscuous mode [ 71.577604][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.617189][ T5611] veth0_macvtap: entered promiscuous mode [ 71.634492][ T5611] veth1_macvtap: entered promiscuous mode [ 71.693713][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.728820][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.734237][ T5626] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.746182][ T5615] veth0_vlan: entered promiscuous mode [ 71.753561][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.803824][ T5615] veth1_vlan: entered promiscuous mode [ 71.848671][ T5619] veth0_vlan: entered promiscuous mode [ 71.879901][ T5626] veth0_vlan: entered promiscuous mode [ 71.900011][ T5619] veth1_vlan: entered promiscuous mode [ 71.922912][ T5626] veth1_vlan: entered promiscuous mode [ 71.944325][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.944370][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.970539][ T5615] veth0_macvtap: entered promiscuous mode [ 71.999501][ T5615] veth1_macvtap: entered promiscuous mode [ 72.020765][ T462] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.020809][ T462] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.051428][ T5619] veth0_macvtap: entered promiscuous mode [ 72.060783][ T5626] veth0_macvtap: entered promiscuous mode [ 72.082018][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.086302][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.101123][ T5619] veth1_macvtap: entered promiscuous mode [ 72.104479][ T5626] veth1_macvtap: entered promiscuous mode [ 72.144877][ T5611] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 72.167657][ T1150] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.186967][ T1150] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.187158][ T1150] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.187510][ T1150] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.187693][ T1150] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.188013][ T1150] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.190126][ T1150] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.202544][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.205591][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.215982][ T59] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.235961][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.245590][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.325459][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.326321][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.326360][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.326393][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.326426][ T59] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.326459][ T59] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.326491][ T59] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.326523][ T59] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.424683][ T5763] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 72.480530][ T5763] FAULT_INJECTION: forcing a failure. [ 72.480530][ T5763] name failslab, interval 1, probability 0, space 0, times 1 [ 72.482416][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.482434][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.493771][ T5763] CPU: 0 UID: 0 PID: 5763 Comm: syz.1.5 Not tainted syzkaller #0 PREEMPT(full) [ 72.493795][ T5763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 72.493813][ T5763] Call Trace: [ 72.493824][ T5763] [ 72.493840][ T5763] dump_stack_lvl+0xe8/0x150 [ 72.493873][ T5763] should_fail_ex+0x410/0x560 [ 72.493905][ T5763] should_failslab+0xa8/0x100 [ 72.493926][ T5763] __kmalloc_noprof+0xfe/0x720 [ 72.493950][ T5763] ? tomoyo_encode+0x2ad/0x570 [ 72.493976][ T5763] ? tomoyo_encode+0x2ad/0x570 [ 72.494009][ T5763] tomoyo_encode+0x2ad/0x570 [ 72.494042][ T5763] tomoyo_realpath_from_path+0x5fa/0x640 [ 72.494081][ T5763] ? tomoyo_path_number_perm+0x219/0x5f0 [ 72.494105][ T5763] tomoyo_path_number_perm+0x246/0x5f0 [ 72.494131][ T5763] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 72.494155][ T5763] ? __lock_acquire+0x6df/0x2e50 [ 72.494200][ T5763] ? hook_file_ioctl+0x1f2/0x600 [ 72.494245][ T5763] ? __fget_files+0x2a/0x420 [ 72.494269][ T5763] ? __fget_files+0x2a/0x420 [ 72.494288][ T5763] ? __fget_files+0x3a2/0x420 [ 72.494306][ T5763] ? __fget_files+0x2a/0x420 [ 72.494330][ T5763] security_file_ioctl+0xc3/0x2a0 [ 72.494354][ T5763] __se_sys_ioctl+0x47/0x170 [ 72.494383][ T5763] do_syscall_64+0x166/0x520 [ 72.494401][ T5763] ? trace_irq_disable+0x3b/0x140 [ 72.494426][ T5763] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.494443][ T5763] ? clear_bhb_loop+0x70/0xc0 [ 72.494466][ T5763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.494485][ T5763] RIP: 0033:0x7f5ff579e0d9 [ 72.494513][ T5763] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 72.494528][ T5763] RSP: 002b:00007f5ff6698028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 72.494552][ T5763] RAX: ffffffffffffffda RBX: 00007f5ff5a25fa0 RCX: 00007f5ff579e0d9 [ 72.494566][ T5763] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 72.494577][ T5763] RBP: 00007f5ff6698090 R08: 0000000000000000 R09: 0000000000000000 [ 72.494588][ T5763] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 72.494599][ T5763] R13: 00007f5ff5a26038 R14: 00007f5ff5a25fa0 R15: 00007ffc8a1de0b8 [ 72.494627][ T5763] [ 72.547119][ T5763] ERROR: Out of memory at tomoyo_realpath_from_path. [ 72.658796][ T1150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.658815][ T1150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.772632][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.772715][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.824724][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.824770][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.984775][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.984819][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.092359][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.092406][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.276452][ T5612] Bluetooth: hci0: command tx timeout [ 73.345376][ T5612] Bluetooth: hci2: command tx timeout [ 73.345421][ T5612] Bluetooth: hci1: command tx timeout [ 73.424233][ T5779] jffs2: notice: (5779) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 73.445391][ T5612] Bluetooth: hci3: command tx timeout [ 73.791512][ T5789] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.39780378.133495060), cmd(2) [ 73.921574][ T5791] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 74.293643][ T5805] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15'. [ 74.294127][ T5805] syz.1.15 uses obsolete (PF_INET,SOCK_PACKET) [ 74.338256][ T25] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 74.507382][ T25] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 74.519890][ T25] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 74.519960][ T25] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.561107][ T25] usb 4-1: config 0 descriptor?? [ 74.797140][ T25] usbhid 4-1:0.0: can't add hid device: -71 [ 74.797254][ T25] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 74.842940][ T25] usb 4-1: USB disconnect, device number 2 [ 74.986551][ T5819] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.39780378.133495060), cmd(2) [ 75.189549][ T5689] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 75.253791][ T5827] fuse: Bad value for 'fd' [ 75.308259][ T25] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 75.345823][ T5612] Bluetooth: hci0: command tx timeout [ 75.347896][ T5689] usb 3-1: Using ep0 maxpacket: 8 [ 75.352481][ T5689] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 75.353890][ T5689] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.369665][ T5689] pvrusb2: Hardware description: Terratec Grabster AV400 [ 75.369683][ T5689] pvrusb2: ********** [ 75.369690][ T5689] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 75.369700][ T5689] pvrusb2: Important functionality might not be entirely working. [ 75.369708][ T5689] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 75.369718][ T5689] pvrusb2: ********** [ 75.425386][ T4934] Bluetooth: hci2: command tx timeout [ 75.425441][ T5612] Bluetooth: hci1: command tx timeout [ 75.465053][ T5758] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 75.465902][ T25] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 75.467281][ T25] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 75.467322][ T25] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.472991][ T25] usb 4-1: config 0 descriptor?? [ 75.506625][ T5612] Bluetooth: hci3: command tx timeout [ 75.566512][ T2357] pvrusb2: Invalid write control endpoint [ 75.588242][ T5717] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 75.615028][ T5758] usb 2-1: Using ep0 maxpacket: 32 [ 75.628932][ T5758] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 75.640050][ T5758] usb 2-1: config 1 interface 0 altsetting 252 bulk endpoint 0x82 has invalid maxpacket 8 [ 75.651745][ T5758] usb 2-1: config 1 interface 0 altsetting 252 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 75.664923][ T5758] usb 2-1: config 1 interface 0 has no altsetting 0 [ 75.679772][ T5758] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.684062][ T2357] pvrusb2: Invalid write control endpoint [ 75.684074][ T2357] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 75.684083][ T2357] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 75.684091][ T2357] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 75.684104][ T2357] pvrusb2: Device being rendered inoperable [ 75.687548][ T2357] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 75.687612][ T2357] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 75.691248][ T2357] pvrusb2: Attached sub-driver cx25840 [ 75.691260][ T2357] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 75.691270][ T2357] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 75.720667][ T5758] usb 2-1: Product: syz [ 75.720686][ T5758] usb 2-1: Manufacturer: syz [ 75.720700][ T5758] usb 2-1: SerialNumber: syz [ 75.736483][ T5717] usb 1-1: device descriptor read/64, error -71 [ 75.794234][ T5823] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 75.794402][ T5823] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 75.807673][ T5689] usb 3-1: USB disconnect, device number 2 [ 75.975158][ T5717] usb 1-1: new low-speed USB device number 3 using dummy_hcd [ 76.009616][ T5758] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 76.025500][ T5758] usb 2-1: USB disconnect, device number 2 [ 76.115171][ T5717] usb 1-1: device descriptor read/64, error -71 [ 76.226636][ T5717] usb usb1-port1: attempt power cycle [ 76.286365][ T25] aiptek 4-1:0.0: Aiptek using 400 ms programming speed [ 76.289480][ T25] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input5 [ 76.307448][ T5797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.322052][ T5797] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.432364][ T5832] capability: warning: `syz.2.25' uses 32-bit capabilities (legacy support in use) [ 76.561151][ T5838] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 76.566458][ T5717] usb 1-1: new low-speed USB device number 4 using dummy_hcd [ 76.588810][ T5717] usb 1-1: device descriptor read/8, error -71 [ 76.744612][ T5716] usb 4-1: USB disconnect, device number 3 [ 76.744714][ C1] aiptek 4-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 76.825748][ T5717] usb 1-1: new low-speed USB device number 5 using dummy_hcd [ 76.846469][ T5717] usb 1-1: device descriptor read/8, error -71 [ 76.955945][ T5717] usb usb1-port1: unable to enumerate USB device [ 77.363855][ T5853] fuse: Bad value for 'fd' [ 77.423573][ T5855] netlink: 'syz.1.35': attribute type 2 has an invalid length. [ 77.459609][ T5855] : entered promiscuous mode [ 77.674133][ T5865] netlink: 'syz.1.38': attribute type 1 has an invalid length. [ 77.674173][ T5865] netlink: 12 bytes leftover after parsing attributes in process `syz.1.38'. [ 77.674822][ T5865] ======================================================= [ 77.674822][ T5865] WARNING: The mand mount option has been deprecated and [ 77.674822][ T5865] and is ignored by this kernel. Remove the mand [ 77.674822][ T5865] option from the mount to silence this warning. [ 77.674822][ T5865] ======================================================= [ 77.900389][ T5874] faux_driver vgem: [drm] Unknown color mode 164; guessing buffer size. [ 77.941073][ T5876] fuse: Bad value for 'fd' [ 77.999402][ T5878] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 78.083716][ T5884] CIFS: VFS: bad security option: krb5iż [ 78.175105][ T5716] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 78.308499][ T5716] usb 2-1: device descriptor read/64, error -71 [ 78.325080][ T5717] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 78.419884][ T5888] sctp: [Deprecated]: syz.0.48 (pid 5888) Use of int in max_burst socket option deprecated. [ 78.419884][ T5888] Use struct sctp_assoc_value instead [ 78.475066][ T5717] usb 3-1: Using ep0 maxpacket: 32 [ 78.481074][ T5717] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 78.482631][ T5717] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 78.482653][ T5717] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 78.482693][ T5717] usb 3-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 78.482728][ T5717] usb 3-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 78.482762][ T5717] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 78.482783][ T5717] usb 3-1: config 1 interface 1 has no altsetting 0 [ 78.484591][ T5717] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.484613][ T5717] usb 3-1: Product: syz [ 78.484627][ T5717] usb 3-1: Manufacturer: syz [ 78.484640][ T5717] usb 3-1: SerialNumber: syz [ 78.548981][ T5716] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 78.677123][ T5716] usb 2-1: device descriptor read/64, error -71 [ 78.696038][ T5884] netlink: 12 bytes leftover after parsing attributes in process `syz.2.46'. [ 78.709338][ T5884] netlink: 12 bytes leftover after parsing attributes in process `syz.2.46'. [ 78.719694][ T5884] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.723122][ T5884] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.724457][ T5884] wlan1: mtu less than device minimum [ 78.743944][ T5717] usb 3-1: selecting invalid altsetting 0 [ 78.744919][ T5717] usb 3-1: 1:1: cannot get freq (v2/v3): err -71 [ 78.746414][ T5717] usb 3-1: 1:1: cannot set freq 44100 (v2/v3): err -71 [ 78.787839][ T5716] usb usb2-port1: attempt power cycle [ 78.866576][ T5717] usb 3-1: USB disconnect, device number 3 [ 78.964661][ T5625] udevd[5625]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 79.071873][ T5909] netlink: 24 bytes leftover after parsing attributes in process `syz.3.55'. [ 79.128419][ T5716] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 79.146204][ T5716] usb 2-1: device descriptor read/8, error -71 [ 79.383447][ T5921] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 79.387820][ T5716] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 79.405755][ T5716] usb 2-1: device descriptor read/8, error -71 [ 79.515626][ T5716] usb usb2-port1: unable to enumerate USB device [ 79.722693][ T5929] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 80.232243][ T5936] netlink: 348 bytes leftover after parsing attributes in process `syz.3.64'. [ 80.288296][ T5939] netlink: 8 bytes leftover after parsing attributes in process `syz.3.65'. [ 80.398063][ T5945] program syz.3.66 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 80.450764][ T5947] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 80.657628][ T5685] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 80.736750][ T5959] netlink: 8 bytes leftover after parsing attributes in process `syz.2.73'. [ 80.805070][ T5685] usb 4-1: Using ep0 maxpacket: 16 [ 80.808119][ T5685] usb 4-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 80.818879][ T5685] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.818901][ T5685] usb 4-1: Product: syz [ 80.818914][ T5685] usb 4-1: Manufacturer: syz [ 80.818927][ T5685] usb 4-1: SerialNumber: syz [ 80.871596][ T5967] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 81.067238][ T5685] usb 4-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 81.092017][ T5685] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 81.092456][ T5685] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 81.092507][ T5685] usb 4-1: media controller created [ 81.141411][ T5976] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 81.161624][ T5685] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 81.362389][ T5685] dvb_usb_gl861 4-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 81.474002][ T5758] usb 4-1: USB disconnect, device number 4 [ 81.490903][ T5987] FAULT_INJECTION: forcing a failure. [ 81.490903][ T5987] name failslab, interval 1, probability 0, space 0, times 0 [ 81.501603][ T5987] CPU: 0 UID: 0 PID: 5987 Comm: syz.1.85 Tainted: G L syzkaller #0 PREEMPT(full) [ 81.501635][ T5987] Tainted: [L]=SOFTLOCKUP [ 81.501642][ T5987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 81.501652][ T5987] Call Trace: [ 81.501661][ T5987] [ 81.501669][ T5987] dump_stack_lvl+0xe8/0x150 [ 81.501697][ T5987] should_fail_ex+0x410/0x560 [ 81.501728][ T5987] ? dup_task_struct+0x52/0xa00 [ 81.501749][ T5987] should_failslab+0xa8/0x100 [ 81.501770][ T5987] ? dup_task_struct+0x52/0xa00 [ 81.501789][ T5987] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 81.501815][ T5987] ? dup_task_struct+0x52/0xa00 [ 81.501842][ T5987] dup_task_struct+0x52/0xa00 [ 81.501863][ T5987] ? _raw_spin_unlock_irq+0x23/0x50 [ 81.501893][ T5987] copy_process+0x820/0x43e0 [ 81.501937][ T5987] ? rcu_is_watching+0x16/0xb0 [ 81.501960][ T5987] ? __pfx_copy_process+0x10/0x10 [ 81.501988][ T5987] ? mutex_init_lockdep+0xdf/0x110 [ 81.502010][ T5987] vhost_task_create+0x1f9/0x380 [ 81.502044][ T5987] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 81.502064][ T5987] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 81.502085][ T5987] ? __pfx_vhost_task_create+0x10/0x10 [ 81.502109][ T5987] ? register_lock_class+0x31/0x2e0 [ 81.502141][ T5987] ? __pfx_vhost_task_fn+0x10/0x10 [ 81.502176][ T5987] ? kasan_quarantine_put+0xbb/0x1f0 [ 81.502209][ T5987] kvm_mmu_post_init_vm+0x147/0x2b0 [ 81.502233][ T5987] kvm_arch_vcpu_ioctl_run+0x7c/0x19c0 [ 81.502266][ T5987] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 81.502299][ T5987] kvm_vcpu_ioctl+0xa61/0xfd0 [ 81.502331][ T5987] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 81.502356][ T5987] ? hook_file_ioctl+0x1f2/0x600 [ 81.502401][ T5987] ? __fget_files+0x2a/0x420 [ 81.502424][ T5987] ? __fget_files+0x2a/0x420 [ 81.502444][ T5987] ? __fget_files+0x3a2/0x420 [ 81.502464][ T5987] ? __fget_files+0x2a/0x420 [ 81.502488][ T5987] ? bpf_lsm_file_ioctl+0x9/0x20 [ 81.502510][ T5987] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 81.502536][ T5987] __se_sys_ioctl+0xfc/0x170 [ 81.502565][ T5987] do_syscall_64+0x166/0x520 [ 81.502582][ T5987] ? trace_irq_disable+0x3b/0x140 [ 81.502607][ T5987] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.502626][ T5987] ? clear_bhb_loop+0x70/0xc0 [ 81.502649][ T5987] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.502667][ T5987] RIP: 0033:0x7f5ff579e0d9 [ 81.502684][ T5987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.502700][ T5987] RSP: 002b:00007f5ff6698028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 81.502720][ T5987] RAX: ffffffffffffffda RBX: 00007f5ff5a25fa0 RCX: 00007f5ff579e0d9 [ 81.502734][ T5987] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 81.502745][ T5987] RBP: 00007f5ff6698090 R08: 0000000000000000 R09: 0000000000000000 [ 81.502757][ T5987] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 81.502767][ T5987] R13: 00007f5ff5a26038 R14: 00007f5ff5a25fa0 R15: 00007ffc8a1de0b8 [ 81.502798][ T5987] [ 81.527397][ T9] cfg80211: failed to load regulatory.db [ 81.705872][ T9] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 81.865047][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 81.865972][ T9] usb 1-1: New USB device found, idVendor=1345, idProduct=3008, bcdDevice= 0.00 [ 81.869512][ T9] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 81.869542][ T9] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 81.869566][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 81.869595][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.931554][ T9] usb 1-1: config 0 descriptor?? [ 82.152265][ T5985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.164128][ T5985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 82.410224][ T5985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.412937][ T5985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 82.417126][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 82.417216][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 82.424881][ T9] usb 1-1: USB disconnect, device number 6 [ 82.429639][ T5985] netlink: 'syz.0.84': attribute type 10 has an invalid length. [ 82.429656][ T5985] netlink: 55 bytes leftover after parsing attributes in process `syz.0.84'. [ 82.642065][ T6008] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 82.740221][ T6010] netlink: 'syz.3.92': attribute type 1 has an invalid length. [ 82.743628][ T6010] netlink: 224 bytes leftover after parsing attributes in process `syz.3.92'. [ 82.743648][ T6010] nbd: illegal input index 2147483646 [ 82.873310][ T6014] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 82.993943][ T6017] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 83.040607][ T6019] FAULT_INJECTION: forcing a failure. [ 83.040607][ T6019] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 83.041532][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz.1.96 Tainted: G L syzkaller #0 PREEMPT(full) [ 83.041561][ T6019] Tainted: [L]=SOFTLOCKUP [ 83.041568][ T6019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.041578][ T6019] Call Trace: [ 83.041586][ T6019] [ 83.041594][ T6019] dump_stack_lvl+0xe8/0x150 [ 83.041623][ T6019] should_fail_ex+0x410/0x560 [ 83.041655][ T6019] _copy_from_iter+0x1d3/0x1660 [ 83.041681][ T6019] ? __alloc_skb+0x27a/0x7a0 [ 83.041700][ T6019] ? rcu_is_watching+0x16/0xb0 [ 83.041719][ T6019] ? __alloc_skb+0x27a/0x7a0 [ 83.041743][ T6019] ? kmem_cache_alloc_node_noprof+0x3be/0x610 [ 83.041768][ T6019] ? __pfx__copy_from_iter+0x10/0x10 [ 83.041792][ T6019] ? __alloc_skb+0x27a/0x7a0 [ 83.041811][ T6019] ? __alloc_skb+0x27a/0x7a0 [ 83.041842][ T6019] skb_copy_datagram_from_iter+0xe6/0x720 [ 83.041873][ T6019] ? __local_bh_enable_ip+0xd6/0x140 [ 83.041893][ T6019] ? iov_iter_single_seg_count+0xc9/0x2f0 [ 83.041924][ T6019] tun_get_user+0xc7f/0x44d0 [ 83.041964][ T6019] ? aa_file_perm+0x4ed/0x15f0 [ 83.041983][ T6019] ? __pfx_tun_get_user+0x10/0x10 [ 83.042004][ T6019] ? __lock_acquire+0x6df/0x2e50 [ 83.042033][ T6019] ? kstrtoull+0x137/0x1d0 [ 83.042062][ T6019] ? ref_tracker_alloc+0x341/0x4b0 [ 83.042090][ T6019] ? lock_acquire+0x115/0x350 [ 83.042116][ T6019] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 83.042145][ T6019] ? lock_acquire+0x115/0x350 [ 83.042170][ T6019] ? tun_get+0x1c/0x2f0 [ 83.042194][ T6019] ? tun_get+0x1c/0x2f0 [ 83.042212][ T6019] ? tun_get+0x1c/0x2f0 [ 83.042235][ T6019] tun_chr_write_iter+0x113/0x200 [ 83.042256][ T6019] vfs_write+0x612/0xba0 [ 83.042287][ T6019] ? __pfx_vfs_write+0x10/0x10 [ 83.042320][ T6019] ? __fget_files+0x2a/0x420 [ 83.042350][ T6019] ksys_write+0x150/0x270 [ 83.042374][ T6019] ? __pfx_ksys_write+0x10/0x10 [ 83.042408][ T6019] do_syscall_64+0x166/0x520 [ 83.042434][ T6019] ? trace_irq_disable+0x3b/0x140 [ 83.042458][ T6019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.042477][ T6019] ? clear_bhb_loop+0x70/0xc0 [ 83.042500][ T6019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.042519][ T6019] RIP: 0033:0x7f5ff579e0d9 [ 83.042536][ T6019] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.042550][ T6019] RSP: 002b:00007f5ff6698028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 83.042571][ T6019] RAX: ffffffffffffffda RBX: 00007f5ff5a25fa0 RCX: 00007f5ff579e0d9 [ 83.042585][ T6019] RDX: 000000000000002e RSI: 0000200000000000 RDI: 0000000000000003 [ 83.042597][ T6019] RBP: 00007f5ff6698090 R08: 0000000000000000 R09: 0000000000000000 [ 83.042609][ T6019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 83.042620][ T6019] R13: 00007f5ff5a26038 R14: 00007f5ff5a25fa0 R15: 00007ffc8a1de0b8 [ 83.042649][ T6019] [ 83.399240][ T6028] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 83.482108][ T6032] netlink: 8 bytes leftover after parsing attributes in process `syz.1.101'. [ 83.489280][ T6032] FAULT_INJECTION: forcing a failure. [ 83.489280][ T6032] name failslab, interval 1, probability 0, space 0, times 0 [ 83.489314][ T6032] CPU: 0 UID: 0 PID: 6032 Comm: syz.1.101 Tainted: G L syzkaller #0 PREEMPT(full) [ 83.489339][ T6032] Tainted: [L]=SOFTLOCKUP [ 83.489346][ T6032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.489356][ T6032] Call Trace: [ 83.489364][ T6032] [ 83.489371][ T6032] dump_stack_lvl+0xe8/0x150 [ 83.489399][ T6032] should_fail_ex+0x410/0x560 [ 83.489431][ T6032] should_failslab+0xa8/0x100 [ 83.489452][ T6032] __kvmalloc_node_noprof+0x176/0x820 [ 83.489483][ T6032] ? nf_hook_entries_grow+0x287/0x740 [ 83.489509][ T6032] ? nf_hook_entries_grow+0x287/0x740 [ 83.489537][ T6032] ? __pfx___mutex_lock+0x10/0x10 [ 83.489560][ T6032] nf_hook_entries_grow+0x287/0x740 [ 83.489600][ T6032] __nf_register_net_hook+0x2c9/0x930 [ 83.489637][ T6032] nf_register_net_hook+0xb2/0x190 [ 83.489667][ T6032] nf_register_net_hooks+0x44/0x1b0 [ 83.489698][ T6032] ila_xlat_nl_cmd_add_mapping+0x275/0x2760 [ 83.489728][ T6032] ? rcu_is_watching+0x16/0xb0 [ 83.489748][ T6032] ? trace_kmalloc+0x2a/0xf0 [ 83.489774][ T6032] ? __kmalloc_noprof+0x38c/0x720 [ 83.489799][ T6032] ? __pfx_ila_xlat_nl_cmd_add_mapping+0x10/0x10 [ 83.489825][ T6032] ? __nla_parse+0x40/0x60 [ 83.489850][ T6032] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 83.489871][ T6032] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 83.489905][ T6032] genl_family_rcv_msg_doit+0x233/0x340 [ 83.489931][ T6032] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 83.489964][ T6032] ? bpf_lsm_capable+0x9/0x20 [ 83.489986][ T6032] ? security_capable+0x7e/0x2c0 [ 83.490019][ T6032] genl_rcv_msg+0x614/0x7a0 [ 83.490043][ T6032] ? __pfx_genl_rcv_msg+0x10/0x10 [ 83.490064][ T6032] ? __pfx_ila_xlat_nl_cmd_add_mapping+0x10/0x10 [ 83.490089][ T6032] ? __pfx_ref_tracker_free+0x10/0x10 [ 83.490120][ T6032] ? __asan_memcpy+0x40/0x70 [ 83.490142][ T6032] ? __skb_clone+0x5c/0x6c0 [ 83.490172][ T6032] netlink_rcv_skb+0x226/0x4a0 [ 83.490197][ T6032] ? __pfx_genl_rcv_msg+0x10/0x10 [ 83.490218][ T6032] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 83.490258][ T6032] ? down_read+0x2be/0x330 [ 83.490282][ T6032] genl_rcv+0x28/0x40 [ 83.490299][ T6032] netlink_unicast+0x7bd/0x940 [ 83.490332][ T6032] netlink_sendmsg+0x813/0xb40 [ 83.490366][ T6032] ? __pfx_netlink_sendmsg+0x10/0x10 [ 83.490407][ T6032] ? apparmor_socket_sendmsg+0x98/0x360 [ 83.490434][ T6032] ? __pfx_netlink_sendmsg+0x10/0x10 [ 83.490457][ T6032] sock_sendmsg_nosec+0x13a/0x180 [ 83.490488][ T6032] ____sys_sendmsg+0x54e/0x850 [ 83.490516][ T6032] ? __pfx_____sys_sendmsg+0x10/0x10 [ 83.490549][ T6032] ? import_iovec+0x73/0xa0 [ 83.490571][ T6032] ___sys_sendmsg+0x2a5/0x360 [ 83.490593][ T6032] ? __lock_acquire+0x6df/0x2e50 [ 83.490621][ T6032] ? __pfx____sys_sendmsg+0x10/0x10 [ 83.490682][ T6032] ? __fget_files+0x2a/0x420 [ 83.490702][ T6032] ? __fget_files+0x3a2/0x420 [ 83.490733][ T6032] __x64_sys_sendmsg+0x1b1/0x290 [ 83.490759][ T6032] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 83.490803][ T6032] do_syscall_64+0x166/0x520 [ 83.490820][ T6032] ? trace_irq_disable+0x3b/0x140 [ 83.490844][ T6032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.490863][ T6032] ? clear_bhb_loop+0x70/0xc0 [ 83.490886][ T6032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.490910][ T6032] RIP: 0033:0x7f5ff579e0d9 [ 83.490927][ T6032] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.490940][ T6032] RSP: 002b:00007f5ff6698028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 83.490959][ T6032] RAX: ffffffffffffffda RBX: 00007f5ff5a25fa0 RCX: 00007f5ff579e0d9 [ 83.490973][ T6032] RDX: 0000000000008050 RSI: 0000200000000040 RDI: 0000000000000003 [ 83.490985][ T6032] RBP: 00007f5ff6698090 R08: 0000000000000000 R09: 0000000000000000 [ 83.490996][ T6032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 83.491007][ T6032] R13: 00007f5ff5a26038 R14: 00007f5ff5a25fa0 R15: 00007ffc8a1de0b8 [ 83.491036][ T6032] [ 83.740274][ T6038] tipc: Started in network mode [ 83.740298][ T6038] tipc: Node identity 2007ff, cluster identity 4711 [ 83.740310][ T6038] tipc: Node number set to 2099199 [ 83.915168][ T6038] gadgetfs: bound to dummy_udc driver [ 84.140819][ T6031] gadgetfs: suspended from state 2 [ 84.155684][ T5758] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 84.265448][ T5716] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 84.315671][ T6050] FAULT_INJECTION: forcing a failure. [ 84.315671][ T6050] name failslab, interval 1, probability 0, space 0, times 0 [ 84.328898][ T6050] CPU: 1 UID: 0 PID: 6050 Comm: syz.1.110 Tainted: G L syzkaller #0 PREEMPT(full) [ 84.328930][ T6050] Tainted: [L]=SOFTLOCKUP [ 84.328937][ T6050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 84.328947][ T6050] Call Trace: [ 84.328955][ T6050] [ 84.328964][ T6050] dump_stack_lvl+0xe8/0x150 [ 84.328994][ T6050] should_fail_ex+0x410/0x560 [ 84.329026][ T6050] should_failslab+0xa8/0x100 [ 84.329044][ T6050] ? __pmd_alloc+0xc1/0x5c0 [ 84.329065][ T6050] kmem_cache_alloc_noprof+0xa1/0x600 [ 84.329089][ T6050] ? alloc_pages_mpol+0x256/0x390 [ 84.329110][ T6050] ? __pmd_alloc+0xc1/0x5c0 [ 84.329138][ T6050] __pmd_alloc+0xc1/0x5c0 [ 84.329163][ T6050] huge_pte_alloc+0x531/0x630 [ 84.329184][ T6050] ? hugetlb_vma_lock_read+0x99/0x2d0 [ 84.329212][ T6050] hugetlb_fault+0x412/0x1440 [ 84.329237][ T6050] ? __pfx_stack_trace_save+0x10/0x10 [ 84.329267][ T6050] ? __pfx_hugetlb_fault+0x10/0x10 [ 84.329308][ T6050] handle_mm_fault+0x24fc/0x3750 [ 84.329337][ T6050] ? mt_find+0x186/0x630 [ 84.329358][ T6050] ? __pfx_mt_find+0x10/0x10 [ 84.329375][ T6050] ? handle_mm_fault+0xf1/0x3750 [ 84.329408][ T6050] ? __pfx_handle_mm_fault+0x10/0x10 [ 84.329432][ T6050] ? find_vma+0xed/0x160 [ 84.329454][ T6050] ? __pfx_find_vma+0x10/0x10 [ 84.329479][ T6050] ? __lock_acquire+0x6df/0x2e50 [ 84.329509][ T6050] ? lock_mm_and_find_vma+0xa7/0x340 [ 84.329534][ T6050] do_user_addr_fault+0x746/0x1340 [ 84.329574][ T6050] exc_page_fault+0x6a/0xc0 [ 84.329602][ T6050] asm_exc_page_fault+0x26/0x30 [ 84.329619][ T6050] RIP: 0010:rep_movs_alternative+0x30/0xa0 [ 84.329640][ T6050] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 4d 6e 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 84.329654][ T6050] RSP: 0018:ffffc90005bb7db8 EFLAGS: 00050216 [ 84.329672][ T6050] RAX: 00007ffffffff001 RBX: 0000000000000020 RCX: 0000000000000020 [ 84.329684][ T6050] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffc90005bb7e20 [ 84.329696][ T6050] RBP: ffffc90005bb7ea8 R08: ffffc90005bb7e3f R09: 1ffff92000b76fc7 [ 84.329710][ T6050] R10: dffffc0000000000 R11: fffff52000b76fc8 R12: ffff88802bc43700 [ 84.329723][ T6050] R13: 00000000c02063a1 R14: ffffc90005bb7e20 R15: 0000000000000000 [ 84.329752][ T6050] _copy_from_user+0x7a/0xb0 [ 84.329772][ T6050] msr_ioctl+0x1b6/0x470 [ 84.329790][ T6050] ? __fget_files+0x2a/0x420 [ 84.329812][ T6050] ? __pfx_msr_ioctl+0x10/0x10 [ 84.329828][ T6050] ? __fget_files+0x2a/0x420 [ 84.329852][ T6050] ? bpf_lsm_file_ioctl+0x9/0x20 [ 84.329880][ T6050] ? __pfx_msr_ioctl+0x10/0x10 [ 84.329900][ T6050] __se_sys_ioctl+0xfc/0x170 [ 84.329931][ T6050] do_syscall_64+0x166/0x520 [ 84.329948][ T6050] ? trace_irq_disable+0x3b/0x140 [ 84.329975][ T6050] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.329994][ T6050] ? clear_bhb_loop+0x70/0xc0 [ 84.330019][ T6050] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.330037][ T6050] RIP: 0033:0x7f5ff579e0d9 [ 84.330055][ T6050] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.330070][ T6050] RSP: 002b:00007f5ff6698028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 84.330089][ T6050] RAX: ffffffffffffffda RBX: 00007f5ff5a25fa0 RCX: 00007f5ff579e0d9 [ 84.330103][ T6050] RDX: 0000000000000000 RSI: 00000000c02063a1 RDI: 0000000000000004 [ 84.330115][ T6050] RBP: 00007f5ff6698090 R08: 0000000000000000 R09: 0000000000000000 [ 84.330127][ T6050] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 84.330139][ T6050] R13: 00007f5ff5a26038 R14: 00007f5ff5a25fa0 R15: 00007ffc8a1de0b8 [ 84.330172][ T6050] [ 84.469249][ T6054] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 84.527501][ T5716] usb 4-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice= 1.00 [ 84.551141][ T5716] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 84.613170][ T5716] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 84.613198][ T5716] usb 4-1: Product: syz [ 84.613213][ T5716] usb 4-1: Manufacturer: syz [ 84.799801][ T5716] pwc: Philips SPC 900NC USB webcam detected. [ 84.886719][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 84.902759][ T6059] fuse: Bad value for 'fd' [ 85.040534][ T9] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 85.043244][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 85.043273][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 85.043307][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.046569][ T9] usb 3-1: config 0 descriptor?? [ 85.407913][ T5716] pwc: recv_control_msg error -32 req 02 val 2b00 [ 85.421784][ T5716] pwc: recv_control_msg error -32 req 02 val 2700 [ 85.471557][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 85.471671][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 85.492889][ T9] usb 3-1: USB disconnect, device number 4 [ 85.530713][ T3311] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.628838][ T6066] nvme_tcp: malformed address passed: 127trsvcid=8009:8009 [ 85.640224][ T5716] pwc: recv_control_msg error -71 req 02 val 2c00 [ 85.648074][ T5716] pwc: recv_control_msg error -71 req 04 val 1000 [ 85.654702][ T5716] pwc: recv_control_msg error -71 req 04 val 1300 [ 85.661448][ T5716] pwc: recv_control_msg error -71 req 04 val 1400 [ 85.668895][ T5716] pwc: recv_control_msg error -71 req 02 val 2000 [ 85.676165][ T5716] pwc: recv_control_msg error -71 req 02 val 2100 [ 85.684488][ T5716] pwc: recv_control_msg error -71 req 06 val 0600 [ 85.692327][ T5716] pwc: recv_control_msg error -71 req 04 val 1500 [ 85.700978][ T5716] pwc: recv_control_msg error -71 req 02 val 2500 [ 85.707774][ T5716] pwc: recv_control_msg error -71 req 02 val 2400 [ 85.715149][ T5716] pwc: recv_control_msg error -71 req 02 val 2600 [ 85.723085][ T5716] pwc: recv_control_msg error -71 req 02 val 2900 [ 85.732269][ T5716] pwc: recv_control_msg error -71 req 02 val 2800 [ 85.740152][ T5716] pwc: recv_control_msg error -71 req 04 val 1100 [ 85.749719][ T5716] pwc: recv_control_msg error -71 req 04 val 1200 [ 85.766658][ T5716] pwc: Registered as video103. [ 85.775757][ T5716] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input6 [ 85.792375][ T5716] usb 4-1: USB disconnect, device number 5 [ 85.815473][ T3311] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.034865][ T3311] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.076720][ T6072] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 86.265709][ T4934] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 86.274049][ T4934] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 86.278552][ T4934] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 86.281134][ T6074] ieee802154 phy0 wpan0: encryption failed: -22 [ 86.281890][ T3311] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.286387][ T4934] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 86.287505][ T4934] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.417526][ T6081] netlink: 256 bytes leftover after parsing attributes in process `syz.1.124'. [ 86.433183][ T6083] netlink: 256 bytes leftover after parsing attributes in process `syz.1.124'. [ 86.515460][ T6085] fuse: Bad value for 'fd' [ 86.887956][ T6098] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 86.898035][ T6095] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 87.017036][ T3311] bridge_slave_1: left allmulticast mode [ 87.017101][ T3311] bridge_slave_1: left promiscuous mode [ 87.018620][ T3311] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.128948][ T3311] bridge_slave_0: left allmulticast mode [ 87.128992][ T3311] bridge_slave_0: left promiscuous mode [ 87.129278][ T3311] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.157816][ T6109] openvswitch: netlink: Missing key (keys=200040, expected=80) [ 87.674362][ T6124] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.132'. [ 87.933846][ T6126] fuse: Bad value for 'fd' [ 88.059566][ T3311] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 88.139876][ T3311] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 88.171479][ T3311] bond0 (unregistering): Released all slaves [ 88.247609][ T6132] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 88.314066][ T5612] Bluetooth: hci3: command tx timeout [ 88.390880][ T3311] tipc: Left network mode [ 88.924710][ T6147] syzkaller1: entered promiscuous mode [ 88.924739][ T6147] syzkaller1: entered allmulticast mode [ 88.979303][ T6159] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 89.758460][ T3311] hsr_slave_0: left promiscuous mode [ 89.788652][ T3311] hsr_slave_1: left promiscuous mode [ 89.789583][ T3311] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 89.789617][ T3311] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 89.830783][ T3311] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 89.830827][ T3311] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 89.948238][ T3311] veth1_macvtap: left promiscuous mode [ 89.948326][ T3311] veth0_macvtap: left promiscuous mode [ 89.948433][ T3311] veth1_vlan: left promiscuous mode [ 89.948535][ T3311] veth0_vlan: left promiscuous mode [ 90.385061][ T5612] Bluetooth: hci3: command tx timeout [ 90.947336][ T5696] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 90.997345][ T5696] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 91.077946][ T3311] team0 (unregistering): Port device team_slave_1 removed [ 91.215569][ T3311] team0 (unregistering): Port device team_slave_0 removed [ 91.650676][ T6223] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 92.393289][ T6075] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.398126][ T6075] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.398255][ T6075] bridge_slave_0: entered allmulticast mode [ 92.402136][ T6075] bridge_slave_0: entered promiscuous mode [ 92.408793][ T6075] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.408928][ T6075] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.409042][ T6075] bridge_slave_1: entered allmulticast mode [ 92.412266][ T6075] bridge_slave_1: entered promiscuous mode [ 92.465670][ T5612] Bluetooth: hci3: command tx timeout [ 92.539414][ T6075] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.567430][ T6075] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.809833][ T6075] team0: Port device team_slave_0 added [ 92.819383][ T6075] team0: Port device team_slave_1 added [ 92.917530][ T6075] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.917570][ T6075] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.917593][ T6075] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.925941][ T6075] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.925957][ T6075] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.925981][ T6075] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.994812][ T5696] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 93.045329][ T6075] hsr_slave_0: entered promiscuous mode [ 93.059353][ T6075] hsr_slave_1: entered promiscuous mode [ 93.064158][ T6075] debugfs: 'hsr0' already exists in 'hsr' [ 93.064178][ T6075] Cannot create hsr debugfs directory [ 93.135057][ T5696] usb 3-1: device descriptor read/64, error -71 [ 93.385412][ T5696] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 93.515040][ T5696] usb 3-1: device descriptor read/64, error -71 [ 93.582450][ T5279] 8021q: adding VLAN 0 to HW filter on device eth1 [ 93.625861][ T5696] usb usb3-port1: attempt power cycle [ 93.896868][ T6075] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 93.940224][ T6075] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.948487][ T6075] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 93.975057][ T5696] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 94.001226][ T5696] usb 3-1: device descriptor read/8, error -71 [ 94.011556][ T6075] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.019593][ T6075] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 94.053054][ T6075] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.062694][ T6075] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 94.113074][ T6075] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.245091][ T5696] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 94.265726][ T5696] usb 3-1: device descriptor read/8, error -71 [ 94.376298][ T5696] usb usb3-port1: unable to enumerate USB device [ 94.454277][ T5279] 8021q: adding VLAN 0 to HW filter on device eth2 [ 94.475327][ T6075] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.523853][ T6294] capability: warning: `syz.1.163' uses deprecated v2 capabilities in a way that may be insecure [ 94.530508][ T6075] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.546571][ T5612] Bluetooth: hci3: command tx timeout [ 94.562433][ T84] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.562546][ T84] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.584803][ T462] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.584936][ T462] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.825605][ T5758] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 94.975148][ T5758] usb 4-1: Using ep0 maxpacket: 16 [ 94.981220][ T5758] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 94.992831][ T5758] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 95.001273][ T5758] usb 4-1: config 0 has no interface number 0 [ 95.011826][ T5758] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 95.012753][ T5758] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 95.042377][ T5758] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.052322][ T5758] usb 4-1: Product: syz [ 95.052371][ T5758] usb 4-1: Manufacturer: syz [ 95.052390][ T5758] usb 4-1: SerialNumber: syz [ 95.072564][ T5758] usb 4-1: config 0 descriptor?? [ 95.080797][ T6297] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 95.080930][ T6297] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 95.307077][ T6297] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 95.316705][ T6297] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 95.404740][ T6321] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 95.526662][ T5758] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 95.537073][ T5758] asix 4-1:0.34: probe with driver asix failed with error -61 [ 95.548441][ T5279] 8021q: adding VLAN 0 to HW filter on device eth3 [ 95.667874][ T6075] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.257940][ T6075] veth0_vlan: entered promiscuous mode [ 96.282749][ T6075] veth1_vlan: entered promiscuous mode [ 96.401780][ T6075] veth0_macvtap: entered promiscuous mode [ 96.427289][ T6075] veth1_macvtap: entered promiscuous mode [ 96.475023][ T6075] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.499063][ T6075] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.539989][ T84] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.544508][ T462] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.544552][ T462] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.544587][ T462] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.670843][ T5279] 8021q: adding VLAN 0 to HW filter on device eth4 [ 96.769948][ T1150] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.769995][ T1150] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.842392][ T1150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.842441][ T1150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.405487][ T5717] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 97.567764][ T5717] usb 5-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 97.569020][ T5717] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 97.569048][ T5717] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 97.569082][ T5717] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.619874][ T5689] usb 4-1: USB disconnect, device number 6 [ 97.856144][ T6382] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 97.898390][ T6387] netlink: 536 bytes leftover after parsing attributes in process `syz.1.179'. [ 98.532535][ T6393] Mount JFS Failure: -5 [ 98.532562][ T6393] jfs_mount failed w/return code = -5 [ 98.548952][ T5717] pegasus 5-1:1.0: probe with driver pegasus failed with error -71 [ 98.561461][ T5717] usb 5-1: USB disconnect, device number 2 [ 99.779423][ T6429] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.39780378.133495060), cmd(2) [ 100.007437][ T6435] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 100.229973][ T6447] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 100.565310][ T5717] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 100.725027][ T5717] usb 4-1: Using ep0 maxpacket: 8 [ 100.727514][ T5717] usb 4-1: unable to get BOS descriptor or descriptor too short [ 100.727562][ T5717] usb 4-1: New USB device found, idVendor=0000, idProduct=a300, bcdDevice= a.f3 [ 100.728742][ T5717] usb 4-1: config 2 has an invalid interface number: 99 but max is 0 [ 100.728764][ T5717] usb 4-1: config 2 has no interface number 0 [ 100.728801][ T5717] usb 4-1: config 2 interface 99 altsetting 7 has an endpoint descriptor with address 0xFE, changing to 0x8E [ 100.728826][ T5717] usb 4-1: config 2 interface 99 altsetting 7 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 100.728850][ T5717] usb 4-1: config 2 interface 99 altsetting 7 endpoint 0x2 has invalid wMaxPacketSize 0 [ 100.728870][ T5717] usb 4-1: config 2 interface 99 has no altsetting 0 [ 100.731415][ T5717] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.731436][ T5717] usb 4-1: Product: syz [ 100.731450][ T5717] usb 4-1: Manufacturer: syz [ 100.731464][ T5717] usb 4-1: SerialNumber: syz [ 100.957946][ T6451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 100.961980][ T6451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 100.979993][ T5717] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:2.99/input/input7 [ 101.023691][ C1] xpad 4-1:2.99: xpad_irq_in - usb_submit_urb failed with result -19 [ 101.023764][ T5717] usb 4-1: USB disconnect, device number 7 [ 101.437562][ T6459] FAULT_INJECTION: forcing a failure. [ 101.437562][ T6459] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 101.457347][ T6459] CPU: 0 UID: 0 PID: 6459 Comm: syz.2.195 Tainted: G L syzkaller #0 PREEMPT(full) [ 101.457381][ T6459] Tainted: [L]=SOFTLOCKUP [ 101.457388][ T6459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.457399][ T6459] Call Trace: [ 101.457407][ T6459] [ 101.457416][ T6459] dump_stack_lvl+0xe8/0x150 [ 101.457447][ T6459] should_fail_ex+0x410/0x560 [ 101.457480][ T6459] _copy_from_user+0x2d/0xb0 [ 101.457501][ T6459] kstrtouint_from_user+0xd6/0x180 [ 101.457530][ T6459] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 101.457565][ T6459] ? lock_acquire+0x115/0x350 [ 101.457597][ T6459] proc_fail_nth_write+0x8e/0x210 [ 101.457624][ T6459] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 101.457657][ T6459] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 101.457683][ T6459] vfs_write+0x296/0xba0 [ 101.457716][ T6459] ? __pfx_vfs_write+0x10/0x10 [ 101.457742][ T6459] ? __fget_files+0x2a/0x420 [ 101.457769][ T6459] ? __fget_files+0x3a2/0x420 [ 101.457790][ T6459] ? __fget_files+0x2a/0x420 [ 101.457818][ T6459] ksys_write+0x150/0x270 [ 101.457845][ T6459] ? __pfx_ksys_write+0x10/0x10 [ 101.457868][ T6459] ? __pfx_sock_ioctl+0x10/0x10 [ 101.457905][ T6459] do_syscall_64+0x166/0x520 [ 101.457923][ T6459] ? trace_irq_disable+0x3b/0x140 [ 101.457949][ T6459] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.457969][ T6459] ? clear_bhb_loop+0x70/0xc0 [ 101.457993][ T6459] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.458012][ T6459] RIP: 0033:0x7ff358f5e90e [ 101.458031][ T6459] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 101.458046][ T6459] RSP: 002b:00007ff359eb2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 101.458067][ T6459] RAX: ffffffffffffffda RBX: 00007ff359eb36c0 RCX: 00007ff358f5e90e [ 101.458082][ T6459] RDX: 0000000000000001 RSI: 00007ff359eb30a0 RDI: 0000000000000005 [ 101.458101][ T6459] RBP: 00007ff359eb3090 R08: 0000000000000000 R09: 0000000000000000 [ 101.458113][ T6459] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 101.458125][ T6459] R13: 00007ff359226038 R14: 00007ff359225fa0 R15: 00007fffab4b1538 [ 101.458156][ T6459] [ 102.035048][ T5716] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 102.167918][ T6475] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 102.196990][ T5716] usb 3-1: Using ep0 maxpacket: 8 [ 102.198126][ T5716] usb 3-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 102.206826][ T5716] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.206851][ T5716] usb 3-1: Product: syz [ 102.206865][ T5716] usb 3-1: Manufacturer: syz [ 102.206878][ T5716] usb 3-1: SerialNumber: syz [ 102.241177][ T5716] usb 3-1: config 0 descriptor?? [ 102.261503][ T5716] gspca_main: se401-2.14.0 probing 047d:5003 [ 102.677776][ T6490] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 103.516663][ T5716] gspca_se401: write req failed req 0x57 val 0x00 error -110 [ 103.516773][ T5716] se401 3-1:0.0: probe with driver se401 failed with error -110 [ 103.616500][ T5717] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 103.765554][ T5717] usb 2-1: Using ep0 maxpacket: 32 [ 103.770444][ T5717] usb 2-1: unable to get BOS descriptor or descriptor too short [ 103.770547][ T5717] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 103.771776][ T5717] usb 2-1: config 7 has an invalid interface number: 108 but max is 0 [ 103.771805][ T5717] usb 2-1: config 7 has an invalid descriptor of length 101, skipping remainder of the config [ 103.771823][ T5717] usb 2-1: config 7 has no interface number 0 [ 103.771848][ T5717] usb 2-1: too many endpoints for config 7 interface 108 altsetting 111: 119, using maximum allowed: 30 [ 103.771881][ T5717] usb 2-1: config 7 interface 108 altsetting 111 has 0 endpoint descriptors, different from the interface descriptor's value: 119 [ 103.771905][ T5717] usb 2-1: config 7 interface 108 has no altsetting 0 [ 103.776351][ T5717] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.776373][ T5717] usb 2-1: Product: syz [ 103.776387][ T5717] usb 2-1: Manufacturer: syz [ 103.776400][ T5717] usb 2-1: SerialNumber: syz [ 103.996379][ T6515] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 104.013890][ T5717] usb 2-1: Cannot retrieve CPort count: -71 [ 104.013959][ T5717] usb 2-1: Cannot retrieve CPort count: -71 [ 104.013977][ T5717] es2_ap_driver 2-1:7.108: probe with driver es2_ap_driver failed with error -71 [ 104.017926][ T5717] usb 2-1: USB disconnect, device number 7 [ 104.286055][ T5758] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 104.437306][ T5758] usb 4-1: not running at top speed; connect to a high speed hub [ 104.437367][ T5758] usb 4-1: New USB device found, idVendor=041e, idProduct=3040, bcdDevice= 0.40 [ 104.456323][ T5758] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 129, changing to 4 [ 104.456381][ T5758] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 104.481151][ T5758] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.489317][ T5758] usb 4-1: Product: syz [ 104.489336][ T5758] usb 4-1: Manufacturer: syz [ 104.489356][ T5758] usb 4-1: SerialNumber: syz [ 104.707817][ T6533] overlayfs: failed to resolve './file1/file0': -13 [ 104.752489][ T5758] usb 4-1: Unsupported UAC3 BADD profile [ 104.807716][ T5717] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 104.852580][ T5758] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 104.872214][ T5758] usb 4-1: USB disconnect, device number 8 [ 104.902467][ T9] usb 3-1: USB disconnect, device number 9 [ 104.979562][ T5717] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 104.980533][ T5717] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.980575][ T5717] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 104.980595][ T5717] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 104.980617][ T5717] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 104.980653][ T5717] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.101339][ T5630] udevd[5630]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 105.118713][ T6545] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 105.415059][ T5758] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 105.555115][ T5758] usb 2-1: device descriptor read/64, error -71 [ 105.795063][ T5758] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 105.838598][ T5717] gud 5-1:1.0: Failed to get connectors (error=-71) [ 105.838648][ T5717] gud 5-1:1.0: probe with driver gud failed with error -71 [ 105.894044][ T5717] usb 5-1: USB disconnect, device number 3 [ 105.926066][ T5758] usb 2-1: device descriptor read/64, error -71 [ 106.035415][ T5758] usb usb2-port1: attempt power cycle [ 106.050134][ T6559] warning: `syz.2.227' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 106.284251][ T6565] erofs (device loop3): cannot find valid erofs superblock [ 106.365751][ T9] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 106.375306][ T5758] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 106.395762][ T5758] usb 2-1: device descriptor read/8, error -71 [ 106.517511][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 106.520271][ T9] usb 3-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88 [ 106.521506][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 106.521551][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.548085][ T9] usb 3-1: config 0 descriptor?? [ 106.635373][ T5758] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 106.656817][ T5758] usb 2-1: device descriptor read/8, error -71 [ 106.765558][ T5758] usb usb2-port1: unable to enumerate USB device [ 106.827901][ T6577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.828412][ T6577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.833625][ T6577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.834025][ T6577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.850871][ T6577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.851269][ T6577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.865794][ T6577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.866192][ T6577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.969040][ T5758] usb 3-1: USB disconnect, device number 10 [ 106.977149][ T9] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 107.125308][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 107.126103][ T9] usb 5-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 107.127433][ T9] usb 5-1: config index 0 descriptor too short (expected 16456, got 72) [ 107.127480][ T9] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 107.127499][ T9] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 107.127517][ T9] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 107.127535][ T9] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 107.127554][ T9] usb 5-1: config 0 has no interface number 0 [ 107.127590][ T9] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 107.127615][ T9] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 107.127635][ T9] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 107.127664][ T9] usb 5-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 107.127687][ T9] usb 5-1: config 0 interface 125 has no altsetting 2 [ 107.130878][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.130899][ T9] usb 5-1: Product: syz [ 107.130912][ T9] usb 5-1: Manufacturer: syz [ 107.130925][ T9] usb 5-1: SerialNumber: syz [ 107.143158][ T9] usb 5-1: config 0 descriptor?? [ 107.153769][ T9] usb 5-1: selecting invalid altsetting 2 [ 107.153797][ T9] uss720 5-1:0.125: probe with driver uss720 failed with error -22 [ 107.329986][ T6589] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 107.354069][ T9] usb 5-1: USB disconnect, device number 4 [ 108.330777][ T6624] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 108.857691][ T6646] ------------[ cut here ]------------ [ 108.857727][ T6646] softleaf_cached_writable(entry) [ 108.857765][ T6646] WARNING: mm/page_table_check.c:206 at __page_table_check_ptes_set+0x186/0x340, CPU#1: syz.4.243/6646 [ 108.880907][ T6646] Modules linked in: [ 108.884831][ T6646] CPU: 1 UID: 0 PID: 6646 Comm: syz.4.243 Tainted: G L syzkaller #0 PREEMPT(full) [ 108.897195][ T6646] Tainted: [L]=SOFTLOCKUP [ 108.902498][ T6646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 108.912661][ T6646] RIP: 0010:__page_table_check_ptes_set+0x186/0x340 [ 108.919332][ T6646] Code: 89 fe e8 bd 55 84 ff 48 b8 00 00 00 00 00 00 00 94 4c 01 f8 48 c1 e8 3b 0f 94 c0 4d 39 e5 76 0f 84 c0 74 0b e8 db 4f 84 ff 90 <0f> 0b 90 eb 05 e8 d0 4f 84 ff 31 ff 89 ee e8 c7 54 84 ff 89 e8 85 [ 108.939193][ T6646] RSP: 0018:ffffc9000388f050 EFLAGS: 00010283 [ 108.945389][ T6646] RAX: ffffffff82438f95 RBX: dfffe7fff1ad2001 RCX: 0000000000080000 [ 108.953382][ T6646] RDX: ffffc900047d1000 RSI: 0000000000021bca RDI: 0000000000021bcb [ 108.961406][ T6646] RBP: 0000000000000001 R08: 0000000000000001 R09: 1ffffd4000394b78 [ 108.969491][ T6646] R10: dffffc0000000000 R11: fffff94000394b79 R12: c7fffffffffffffe [ 108.977537][ T6646] R13: dfffe7fff1ad2006 R14: ffff8880292e1000 R15: 6c00000000000000 [ 108.985561][ T6646] FS: 00007efc995e66c0(0000) GS:ffff88812498b000(0000) knlGS:0000000000000000 [ 108.995859][ T6646] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.002475][ T6646] CR2: 00007efc995c5d58 CR3: 00000000354e8000 CR4: 00000000003526f0 [ 109.011341][ T6646] Call Trace: [ 109.014644][ T6646] [ 109.017634][ T6646] ? folio_try_share_anon_rmap_pte+0x6c7/0xb60 [ 109.019554][ T6655] binder: 6642:6655 ioctl c0306201 200000000080 returned -14 [ 109.033116][ T6646] try_to_migrate_one+0x2055/0x2b90 [ 109.040038][ T6646] ? try_to_migrate_one+0x63f/0x2b90 [ 109.045562][ T6646] ? try_to_migrate_one+0x63f/0x2b90 [ 109.049984][ T6655] binder: 6642:6655 ioctl c0306201 2000000003c0 returned -14 [ 109.058311][ T6646] ? __pfx_try_to_migrate_one+0x10/0x10 [ 109.063908][ T6646] ? folio_lock_anon_vma_read+0x322/0xa50 [ 109.069783][ T6646] ? __pfx_try_to_migrate_one+0x10/0x10 [ 109.075489][ T6646] rmap_walk_anon+0x6d4/0x910 [ 109.080220][ T6646] try_to_migrate+0x33d/0x400 [ 109.084928][ T6646] ? __pfx_try_to_migrate+0x10/0x10 [ 109.090236][ T6646] ? __pfx_try_to_migrate_one+0x10/0x10 [ 109.097114][ T6646] ? __pfx_folio_not_mapped+0x10/0x10 [ 109.102534][ T6646] ? __pfx_folio_lock_anon_vma_read+0x10/0x10 [ 109.109465][ T6646] ? __pfx_invalid_migration_vma+0x10/0x10 [ 109.115387][ T6646] ? folio_get_anon_vma+0xa8/0x680 [ 109.120521][ T6646] ? folio_get_anon_vma+0xa8/0x680 [ 109.125710][ T6646] ? folio_get_anon_vma+0x464/0x680 [ 109.131018][ T6646] ? folio_get_anon_vma+0xa8/0x680 [ 109.136239][ T6646] migrate_pages_batch+0x1c1c/0x4f50 [ 109.141589][ T6646] ? __pfx_alloc_migration_target+0x10/0x10 [ 109.147554][ T6646] ? queue_folios_pte_range+0xd62/0xf10 [ 109.153118][ T6646] ? __pfx_migrate_pages_batch+0x10/0x10 [ 109.158833][ T6646] ? __pfx_queue_folios_pte_range+0x10/0x10 [ 109.164757][ T6646] ? walk_pgd_range+0x1cab/0x1dc0 [ 109.169880][ T6646] migrate_pages+0x1b9f/0x2920 [ 109.174685][ T6646] ? __pfx_alloc_migration_target+0x10/0x10 [ 109.180654][ T6646] ? __walk_page_range+0x6c1/0x720 [ 109.185911][ T6646] ? __pfx_migrate_pages+0x10/0x10 [ 109.191043][ T6646] ? queue_pages_test_walk+0x3dc/0x410 [ 109.197735][ T6646] ? walk_page_range_mm_unsafe+0x595/0x680 [ 109.203670][ T6646] ? __pfx___up_read+0x10/0x10 [ 109.209397][ T6646] do_migrate_pages+0x656/0x8b0 [ 109.214385][ T6646] ? __pfx_do_migrate_pages+0x10/0x10 [ 109.219861][ T6646] ? __se_sys_mremap+0x1160/0x12d0 [ 109.225058][ T6646] ? rcu_is_watching+0x16/0xb0 [ 109.229849][ T6646] ? security_capable+0xb9/0x2c0 [ 109.234821][ T6646] __se_sys_migrate_pages+0xaa2/0xc90 [ 109.240320][ T6646] ? __se_sys_futex+0x3a8/0x450 [ 109.245324][ T6646] ? __pfx___se_sys_migrate_pages+0x10/0x10 [ 109.251254][ T6646] ? rcu_is_watching+0x16/0xb0 [ 109.256104][ T6646] do_syscall_64+0x166/0x520 [ 109.260806][ T6646] ? trace_irq_disable+0x3b/0x140 [ 109.266123][ T6646] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.272219][ T6646] ? clear_bhb_loop+0x70/0xc0 [ 109.277074][ T6646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.282978][ T6646] RIP: 0033:0x7efc9879e0d9 [ 109.287510][ T6646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.309566][ T6646] RSP: 002b:00007efc995e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000100 [ 109.318874][ T6646] RAX: ffffffffffffffda RBX: 00007efc98a26090 RCX: 00007efc9879e0d9 [ 109.326941][ T6646] RDX: 0000200000000040 RSI: 0000000000000005 RDI: 0000000000000000 [ 109.335012][ T6646] RBP: 00007efc98835024 R08: 0000000000000000 R09: 0000000000000000 [ 109.343007][ T6646] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000000 [ 109.351137][ T6646] R13: 00007efc98a26128 R14: 00007efc98a26090 R15: 00007ffc1fc43758 [ 109.359195][ T6646] [ 109.362237][ T6646] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 109.369611][ T6646] CPU: 1 UID: 0 PID: 6646 Comm: syz.4.243 Tainted: G L syzkaller #0 PREEMPT(full) [ 109.380384][ T6646] Tainted: [L]=SOFTLOCKUP [ 109.384710][ T6646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 109.394774][ T6646] Call Trace: [ 109.398063][ T6646] [ 109.401001][ T6646] vpanic+0x56d/0xa60 [ 109.405009][ T6646] ? __pfx__printk+0x10/0x10 [ 109.409611][ T6646] ? __pfx_vpanic+0x10/0x10 [ 109.414121][ T6646] ? is_bpf_text_address+0x292/0x2b0 [ 109.419413][ T6646] ? is_bpf_text_address+0x26/0x2b0 [ 109.424618][ T6646] panic+0xc5/0xd0 [ 109.428350][ T6646] ? __pfx_panic+0x10/0x10 [ 109.432799][ T6646] __warn+0x315/0x4c0 [ 109.436790][ T6646] ? __page_table_check_ptes_set+0x186/0x340 [ 109.442779][ T6646] ? __page_table_check_ptes_set+0x186/0x340 [ 109.448772][ T6646] __report_bug+0x276/0x570 [ 109.453380][ T6646] ? __page_table_check_ptes_set+0x186/0x340 [ 109.459370][ T6646] ? __pfx___report_bug+0x10/0x10 [ 109.464403][ T6646] ? __lock_acquire+0x6df/0x2e50 [ 109.469349][ T6646] ? lock_acquire+0x115/0x350 [ 109.474029][ T6646] ? __page_table_check_ptes_set+0x186/0x340 [ 109.480011][ T6646] report_bug+0x16b/0x220 [ 109.484333][ T6646] ? __page_table_check_ptes_set+0x186/0x340 [ 109.490308][ T6646] ? __page_table_check_ptes_set+0x188/0x340 [ 109.496283][ T6646] handle_bug+0x9c/0x200 [ 109.500521][ T6646] exc_invalid_op+0x1a/0x50 [ 109.505022][ T6646] asm_exc_invalid_op+0x1a/0x20 [ 109.509866][ T6646] RIP: 0010:__page_table_check_ptes_set+0x186/0x340 [ 109.516453][ T6646] Code: 89 fe e8 bd 55 84 ff 48 b8 00 00 00 00 00 00 00 94 4c 01 f8 48 c1 e8 3b 0f 94 c0 4d 39 e5 76 0f 84 c0 74 0b e8 db 4f 84 ff 90 <0f> 0b 90 eb 05 e8 d0 4f 84 ff 31 ff 89 ee e8 c7 54 84 ff 89 e8 85 [ 109.536056][ T6646] RSP: 0018:ffffc9000388f050 EFLAGS: 00010283 [ 109.542124][ T6646] RAX: ffffffff82438f95 RBX: dfffe7fff1ad2001 RCX: 0000000000080000 [ 109.550087][ T6646] RDX: ffffc900047d1000 RSI: 0000000000021bca RDI: 0000000000021bcb [ 109.558070][ T6646] RBP: 0000000000000001 R08: 0000000000000001 R09: 1ffffd4000394b78 [ 109.566032][ T6646] R10: dffffc0000000000 R11: fffff94000394b79 R12: c7fffffffffffffe [ 109.573997][ T6646] R13: dfffe7fff1ad2006 R14: ffff8880292e1000 R15: 6c00000000000000 [ 109.581970][ T6646] ? __page_table_check_ptes_set+0x185/0x340 [ 109.587959][ T6646] ? folio_try_share_anon_rmap_pte+0x6c7/0xb60 [ 109.594125][ T6646] try_to_migrate_one+0x2055/0x2b90 [ 109.599322][ T6646] ? try_to_migrate_one+0x63f/0x2b90 [ 109.604614][ T6646] ? try_to_migrate_one+0x63f/0x2b90 [ 109.609903][ T6646] ? __pfx_try_to_migrate_one+0x10/0x10 [ 109.615454][ T6646] ? folio_lock_anon_vma_read+0x322/0xa50 [ 109.621185][ T6646] ? __pfx_try_to_migrate_one+0x10/0x10 [ 109.626728][ T6646] rmap_walk_anon+0x6d4/0x910 [ 109.631413][ T6646] try_to_migrate+0x33d/0x400 [ 109.636083][ T6646] ? __pfx_try_to_migrate+0x10/0x10 [ 109.641279][ T6646] ? __pfx_try_to_migrate_one+0x10/0x10 [ 109.646816][ T6646] ? __pfx_folio_not_mapped+0x10/0x10 [ 109.652189][ T6646] ? __pfx_folio_lock_anon_vma_read+0x10/0x10 [ 109.658245][ T6646] ? __pfx_invalid_migration_vma+0x10/0x10 [ 109.664046][ T6646] ? folio_get_anon_vma+0xa8/0x680 [ 109.669151][ T6646] ? folio_get_anon_vma+0xa8/0x680 [ 109.674264][ T6646] ? folio_get_anon_vma+0x464/0x680 [ 109.679453][ T6646] ? folio_get_anon_vma+0xa8/0x680 [ 109.684564][ T6646] migrate_pages_batch+0x1c1c/0x4f50 [ 109.689861][ T6646] ? __pfx_alloc_migration_target+0x10/0x10 [ 109.695743][ T6646] ? queue_folios_pte_range+0xd62/0xf10 [ 109.701282][ T6646] ? __pfx_migrate_pages_batch+0x10/0x10 [ 109.707029][ T6646] ? __pfx_queue_folios_pte_range+0x10/0x10 [ 109.712976][ T6646] ? walk_pgd_range+0x1cab/0x1dc0 [ 109.718011][ T6646] migrate_pages+0x1b9f/0x2920 [ 109.722782][ T6646] ? __pfx_alloc_migration_target+0x10/0x10 [ 109.728666][ T6646] ? __walk_page_range+0x6c1/0x720 [ 109.733768][ T6646] ? __pfx_migrate_pages+0x10/0x10 [ 109.738968][ T6646] ? queue_pages_test_walk+0x3dc/0x410 [ 109.744449][ T6646] ? walk_page_range_mm_unsafe+0x595/0x680 [ 109.750256][ T6646] ? __pfx___up_read+0x10/0x10 [ 109.755020][ T6646] do_migrate_pages+0x656/0x8b0 [ 109.759879][ T6646] ? __pfx_do_migrate_pages+0x10/0x10 [ 109.765243][ T6646] ? __se_sys_mremap+0x1160/0x12d0 [ 109.770360][ T6646] ? rcu_is_watching+0x16/0xb0 [ 109.775125][ T6646] ? security_capable+0xb9/0x2c0 [ 109.780069][ T6646] __se_sys_migrate_pages+0xaa2/0xc90 [ 109.785433][ T6646] ? __se_sys_futex+0x3a8/0x450 [ 109.790293][ T6646] ? __pfx___se_sys_migrate_pages+0x10/0x10 [ 109.796187][ T6646] ? rcu_is_watching+0x16/0xb0 [ 109.801211][ T6646] do_syscall_64+0x166/0x520 [ 109.805789][ T6646] ? trace_irq_disable+0x3b/0x140 [ 109.810808][ T6646] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.816862][ T6646] ? clear_bhb_loop+0x70/0xc0 [ 109.821532][ T6646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.827412][ T6646] RIP: 0033:0x7efc9879e0d9 [ 109.831821][ T6646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.851422][ T6646] RSP: 002b:00007efc995e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000100 [ 109.859844][ T6646] RAX: ffffffffffffffda RBX: 00007efc98a26090 RCX: 00007efc9879e0d9 [ 109.867834][ T6646] RDX: 0000200000000040 RSI: 0000000000000005 RDI: 0000000000000000 [ 109.875803][ T6646] RBP: 00007efc98835024 R08: 0000000000000000 R09: 0000000000000000 [ 109.883764][ T6646] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000000 [ 109.891721][ T6646] R13: 00007efc98a26128 R14: 00007efc98a26090 R15: 00007ffc1fc43758 [ 109.899700][ T6646] [ 109.902974][ T6646] Kernel Offset: disabled [ 109.907288][ T6646] Rebooting in 86400 seconds..