last executing test programs: 4m46.949914069s ago: executing program 2 (id=144): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan0\x00'}) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x80, 0x400e}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffd}, 0x39) openat$ptp0(0xffffffffffffff9c, &(0x7f0000002340), 0x20400, 0x0) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r0, 0x0, 0x0}, 0x10) 4m46.20316094s ago: executing program 2 (id=147): r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) connect(0xffffffffffffffff, &(0x7f00000000c0)=@l2tp={0x2, 0x0, @rand_addr=0x64010101, 0x4}, 0x80) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() getpeername$unix(0xffffffffffffffff, 0x0, &(0x7f0000000280)) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x2000400}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x176}}], 0x400000000000172, 0x4000000) sched_setscheduler(r2, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_GET_SECCOMP(0x15) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setxattr$security_ima(&(0x7f0000000480)='./file7\x00', 0x0, 0x0, 0x0, 0x1) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r7, &(0x7f0000000a00)={'syz1\x00', {0x6, 0x7, 0x5, 0x7}, 0x3f, [0x6, 0x10000002, 0x18, 0x2, 0x8, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0x40000001, 0x7, 0x39, 0x747d5e13, 0x400, 0xfffffb9a, 0xfffffffe, 0x0, 0xffffffeb, 0x2004, 0x3, 0x0, 0xf250, 0x80, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8000, 0x7, 0x3, 0xc, 0x3, 0xba55, 0x8da8, 0x2a, 0x200, 0x2, 0x5, 0x2000000e, 0x6, 0x2, 0x8000006f, 0x8, 0x405, 0x80000000, 0x199d, 0x6, 0x7, 0xffffffff, 0xffffffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0x9, 0x5], [0x7, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x2, 0x25, 0xa, 0xfffffffc, 0x8, 0x7fff, 0x729, 0x1c32, 0x3, 0x2, 0x10000, 0x400, 0x7ffd, 0x5, 0x3, 0x297, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x7, 0x1000001, 0x14, 0xfffffff7, 0xfffffffd, 0x7, 0x9, 0xffffffff, 0x6, 0x4, 0x800, 0x0, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xc, 0x3, 0x37a, 0x9, 0xe, 0x5, 0x7, 0x6, 0x6, 0x1, 0x1, 0xe, 0x20007, 0x200, 0x3], [0x1, 0x8000c584, 0xffff, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0x1e88, 0x1000, 0x80000001, 0xffff0000, 0x3f92, 0x9000, 0x0, 0x6611, 0x6, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x8, 0x6, 0x200003, 0x1, 0x5, 0x80, 0x8, 0x8001, 0x10000, 0x4, 0x4, 0x400004, 0x3, 0x7, 0x3, 0x8, 0xb3c, 0xbf23, 0x6, 0x5, 0x956, 0x0, 0x3ff, 0x80000e, 0x6, 0x100fffd, 0x2005, 0x9, 0x4, 0x1000, 0x9, 0x7fffffff, 0x3, 0x80, 0x0, 0x7d, 0x401, 0x5], [0x80108e, 0xffff, 0x3, 0x3, 0x88, 0x80000002, 0x4000000, 0x4, 0x50, 0x2, 0x763, 0xb, 0x2402, 0x1, 0x5, 0x1000, 0x7f, 0x5, 0x8, 0x4, 0x0, 0x5, 0x3, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x200, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4004, 0x20008, 0x8a5, 0x7fff, 0x44, 0x409, 0x6, 0x4, 0x4, 0xe, 0x4, 0xfffffff7, 0x7fff, 0xffff8a33, 0xfffffff8, 0x401, 0x3, 0x200, 0x8, 0x4edf, 0xffffffff, 0xd, 0x5, 0x101, 0xf, 0xf, 0x136, 0x6]}, 0x45c) utime(&(0x7f0000000080)='.\x00', &(0x7f0000000180)={0x8, 0x2}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) ioctl$SYNC_IOC_MERGE(r1, 0xc0303e03, &(0x7f0000000000)={"03c4d3001ef0392eec5c119f5ec8a50cf951fa30c531b755f097532a9eda3fef", r1}) 4m43.862047045s ago: executing program 2 (id=153): socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8f}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) mkdir(&(0x7f0000000140)='./control\x00', 0x111) syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x1}}}) ioctl$VIDIOC_QBUF(r3, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {}, {0x5, 0x0, 0x4, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) 4m41.757026287s ago: executing program 2 (id=156): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000000) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c400000000328000480"], 0xa4}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='westwood', 0x8) r2 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r2, &(0x7f0000000080)="4c00000012001f15b9409b8400feffffffffffff000000000017030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94acc000000000000000000000051d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="3400000013000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB="000000000000000014001a80100004800c"], 0x34}}, 0x0) 4m39.309400797s ago: executing program 1 (id=157): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x18, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0xffbffffa, 0x0, 0x0, 0x0, 0x40}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x58}}]}, 0x0, 0x9, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffa}, [@call={0x85, 0x0, 0x0, 0x8}]}, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6fa6c04eee5c85fd, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r4}, &(0x7f0000000280), &(0x7f0000000240)=r1}, 0x20) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$inet(r3, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x2040094) (fail_nth: 3) 4m38.56964356s ago: executing program 2 (id=159): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) connect(0xffffffffffffffff, &(0x7f00000000c0)=@l2tp={0x2, 0x0, @rand_addr=0x64010101, 0x4}, 0x80) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() getpeername$unix(0xffffffffffffffff, 0x0, &(0x7f0000000280)) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x2000400}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x176}}], 0x400000000000172, 0x4000000) sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_GET_SECCOMP(0x15) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setxattr$security_ima(&(0x7f0000000480)='./file7\x00', 0x0, 0x0, 0x0, 0x1) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r6, &(0x7f0000000a00)={'syz1\x00', {0x6, 0x7, 0x5, 0x7}, 0x3f, [0x6, 0x10000002, 0x18, 0x2, 0x8, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0x40000001, 0x7, 0x39, 0x747d5e13, 0x400, 0xfffffb9a, 0xfffffffe, 0x0, 0xffffffeb, 0x2004, 0x3, 0x0, 0xf250, 0x80, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8000, 0x7, 0x3, 0xc, 0x3, 0xba55, 0x8da8, 0x2a, 0x200, 0x2, 0x5, 0x2000000e, 0x6, 0x2, 0x8000006f, 0x8, 0x405, 0x80000000, 0x199d, 0x6, 0x7, 0xffffffff, 0xffffffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0x9, 0x5], [0x7, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x2, 0x25, 0xa, 0xfffffffc, 0x8, 0x7fff, 0x729, 0x1c32, 0x3, 0x2, 0x10000, 0x400, 0x7ffd, 0x5, 0x3, 0x297, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x7, 0x1000001, 0x14, 0xfffffff7, 0xfffffffd, 0x7, 0x9, 0xffffffff, 0x6, 0x4, 0x800, 0x0, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xc, 0x3, 0x37a, 0x9, 0xe, 0x5, 0x7, 0x6, 0x6, 0x1, 0x1, 0xe, 0x20007, 0x200, 0x3], [0x1, 0x8000c584, 0xffff, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0x1e88, 0x1000, 0x80000001, 0xffff0000, 0x3f92, 0x9000, 0x0, 0x6611, 0x6, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x8, 0x6, 0x200003, 0x1, 0x5, 0x80, 0x8, 0x8001, 0x10000, 0x4, 0x4, 0x400004, 0x3, 0x7, 0x3, 0x8, 0xb3c, 0xbf23, 0x6, 0x5, 0x956, 0x0, 0x3ff, 0x80000e, 0x6, 0x100fffd, 0x2005, 0x9, 0x4, 0x1000, 0x9, 0x7fffffff, 0x3, 0x80, 0x0, 0x7d, 0x401, 0x5], [0x80108e, 0xffff, 0x3, 0x3, 0x88, 0x80000002, 0x4000000, 0x4, 0x50, 0x2, 0x763, 0xb, 0x2402, 0x1, 0x5, 0x1000, 0x7f, 0x5, 0x8, 0x4, 0x0, 0x5, 0x3, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x200, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4004, 0x20008, 0x8a5, 0x7fff, 0x44, 0x409, 0x6, 0x4, 0x4, 0xe, 0x4, 0xfffffff7, 0x7fff, 0xffff8a33, 0xfffffff8, 0x401, 0x3, 0x200, 0x8, 0x4edf, 0xffffffff, 0xd, 0x5, 0x101, 0xf, 0xf, 0x136, 0x6]}, 0x45c) utime(&(0x7f0000000080)='.\x00', &(0x7f0000000180)={0x8, 0x2}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000000)={"03c4d3001ef0392eec5c119f5ec8a50cf951fa30c531b755f097532a9eda3fef"}) 4m38.269451785s ago: executing program 1 (id=161): mkdirat(0xffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x800, 0x0) openat(0xffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 4m37.000536161s ago: executing program 2 (id=162): socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8f}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = signalfd(0xffffffffffffffff, &(0x7f00000001c0)={[0x5]}, 0x8) mkdir(&(0x7f0000000140)='./control\x00', 0x111) inotify_init1(0x800) fcntl$setstatus(r2, 0x4, 0x2c00) r3 = gettid() fcntl$setown(r2, 0x8, r3) rmdir(&(0x7f00000000c0)='./control\x00') mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@default_permissions}]}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x1}}}) ioctl$VIDIOC_QBUF(r4, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {}, {0x5, 0x0, 0x4, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) 4m36.949748604s ago: executing program 1 (id=164): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x2, 0x0, &(0x7f0000000140)={0xfffffffffffffd15, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) gettid() r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r4, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r5, 0x4734}}, 0x10) r6 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010001ffffff40460801100001010203010902270001010080fa0904000003ffffff00070581020002000705020200020007058303"], 0x0) syz_usb_connect$printer(0x4, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7, 0x20, 0xbf, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x7, 0x1, 0x2, 0x8f, "", {{{0x9, 0x5, 0x1, 0x2, 0x20, 0x4, 0x9, 0x53}}, [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x63, 0x6, 0x4}}]}}}]}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x201, 0x3, 0x7d, 0xb, 0x40}, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="cb63b2742d"], 0x6, [{0x72, &(0x7f0000000100)=@string={0x72, 0x3, "cbef3997e4c22c45994922f893ea21fb7de90a6ab150eb862ff42f150ee3f4e24371994f15d7149d5f4014045a25e0d9642dfb3b11fc95d17d42aa50990e565088997d27cc162f9260e83ff86a8997eb8702ce43896b099ed3e410d7337631d4b35b3ba09d6d73c418195dc6db572185"}}, {0x95, &(0x7f0000000180)=@string={0x95, 0x3, "36566ffedccc5fe623d7615dcb9d646717532f02cc7b81c38a915d5c9697a5d8236137dc68aa997941e1be3db3cd6168227fd04655d6a2c5d9aa2a02fddb2d818246189602646f6ae5e768d5bc47409e1f64b363b6f67e62a46463cac2f9c0d1c47602e19356902e1f09584c9d5dc7e53d4522677d58cbe9b84c8692bdeb74ea8a8e4db009d1b5a99d15047e1005b6ce834903"}}, {0xc5, &(0x7f0000000240)=@string={0xc5, 0x3, "0f79df0212d4badbf29b9085b0f4ade4f0180916c2761dc271e7a44485dbd107c7b030a45f0a71d3293f1f2d060b89f124e6819b0fe38fde58cf9fb05c7835fa5d920670b4a55cdb19de6ac3468a45bba332de02003fe17d6d4a9fcc13d96bfcf0843a5b1f0632f46b1c38c799fe594b595220ee526231f4e9f9e31f983c1a1f6a0c7f4cbb1b3eb6d364bf799c733d2a23e4f4bb18a13be03f15c8ffa62f075636dc183afcbdcdea4936cc79a20465c336c8499daa6954bef97e5aa7fe221d5ad44efc"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x416}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x449}}, {0x32, &(0x7f00000003c0)=@string={0x32, 0x3, "007a9e312d6bad19d60daae86e21f8513683a168823e0faea7f65d9829f3fd766356b3f3159f9e37f770873ac6b05ad2"}}]}) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$uac3(r6, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000480)={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r6, 0x0, 0x0) 4m25.773305331s ago: executing program 1 (id=171): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x2d, 0x2, 0x0) mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000000000), &(0x7f0000000040), 0x2, 0x2) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x400) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000140)={{0x2, 0x3, 0x100, 0x0, 0x3}}) 4m20.478473775s ago: executing program 32 (id=162): socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8f}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = signalfd(0xffffffffffffffff, &(0x7f00000001c0)={[0x5]}, 0x8) mkdir(&(0x7f0000000140)='./control\x00', 0x111) inotify_init1(0x800) fcntl$setstatus(r2, 0x4, 0x2c00) r3 = gettid() fcntl$setown(r2, 0x8, r3) rmdir(&(0x7f00000000c0)='./control\x00') mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@default_permissions}]}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x1}}}) ioctl$VIDIOC_QBUF(r4, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {}, {0x5, 0x0, 0x4, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) 4m16.255317423s ago: executing program 1 (id=182): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000000c0)=ANY=[@ANYRES64, @ANYRES64], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x14) add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0xc0) ioctl$OCFS2_IOC_MOVE_EXT(r0, 0x40406f06, &(0x7f0000000600)={0x200, 0xc, 0x9, 0x5, 0x1}) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000e70f007c0000000000006000000300000a3c000000090a0104f6000000000000000a00181dd1683d69eddc381901f1301daa00040900010073797a300000000007000000000000000900020073797a310000000008000a40fffffffc40000000e909010100000000000000000a0000020900020073797a31000000000900010073797a310000000014000380100000800c00018005000100d1000000"], 0xa4}}, 0x40) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_pidfd_open(0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000640)='numa_maps\x00') r2 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$sock_int(r2, 0x1, 0x10, 0x0, &(0x7f0000000140)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x4000000) r3 = memfd_create(&(0x7f0000000040)='rootmode', 0x0) userfaultfd(0x80001) r4 = socket$packet(0x11, 0x3, 0x300) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000280)=0x8) (fail_nth: 3) openat$dsp(0xffffffffffffff9c, &(0x7f00000002c0), 0x204001, 0x0) syz_usb_connect$uac1(0x3, 0xa4, &(0x7f0000000180)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9ffff28bbe044ff092403f3", @ANYRES8=r3, @ANYRES64=r4], 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) r6 = add_key$fscrypt_v1(&(0x7f0000000300), &(0x7f0000000440)={'fscrypt:', @auto=[0x39, 0x38, 0x30, 0x35, 0x31, 0x39, 0x66, 0x32, 0x33, 0x63, 0x63, 0x38, 0x66, 0x64, 0x66, 0x38]}, &(0x7f0000000500)={0x0, "ef76abb86bf7a536d5f64ee166d9ec93975ec3635aee02bf8233ff5cc9846dfa45b6a0c442da0ae1d78d221eb1261241a65c25d3d46ae5489145d690ddc983ba", 0x39}, 0x48, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000580)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r6, r7, 0x59) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r1, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x4b}], 0x1}}], 0x49, 0x20008000) 4m15.247541262s ago: executing program 1 (id=183): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x2c, 0x2, 0x9, 0x5, 0x0, 0x0, {0x3, 0x0, 0x8}, [@NFCTH_TUPLE={0x18, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @rand_addr=0x64010102}}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000800}, 0x2040) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) r2 = socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000a00)={'syztnl1\x00', &(0x7f0000000980)={'ip6gre0\x00', 0x0, 0x29, 0x1, 0x9, 0x6, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x25}, 0x1, 0x10, 0x1, 0x7}}) (rerun: 64) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000ac0)={'sit0\x00', &(0x7f0000000a40)={'erspan0\x00', r3, 0x10, 0x80, 0x9, 0x8001, {{0x17, 0x4, 0x3, 0x4, 0x5c, 0x68, 0x0, 0x5, 0x4, 0x0, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@end, @ssrr={0x89, 0x13, 0x97, [@dev={0xac, 0x14, 0x14, 0x32}, @rand_addr=0x64010102, @remote, @private=0xa010100]}, @lsrr={0x83, 0xb, 0x57, [@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback]}, @cipso={0x86, 0x21, 0x0, [{0x5, 0x5, "7a0631"}, {0x1, 0xc, "a884305cd7959d44257b"}, {0x5, 0xa, "1b9d073279cb33cc"}]}, @lsrr={0x83, 0x7, 0xc4, [@multicast1]}]}}}}}) bind$packet(r0, &(0x7f00000000c0)={0x11, 0x1b, r4, 0x1, 0x3, 0x6, @local}, 0x14) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) (async, rerun: 32) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) (rerun: 32) r5 = fsopen(&(0x7f0000000000)='jfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f00000000c0)='resize', &(0x7f0000000100)='0', 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) fcntl$getflags(r7, 0x3) (async, rerun: 32) r8 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) (rerun: 32) writev(r8, &(0x7f0000000600)=[{&(0x7f0000000040)="002e2e606200000000afe3", 0xb}], 0x1) (async, rerun: 64) write(r6, &(0x7f0000000100)='file read \\0tc/passwd task.uid=0-0xec.argv[0]=\"sh\" exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) (async, rerun: 64) sendmsg(r0, &(0x7f0000000940)={&(0x7f0000000040)=@l2tp={0x2, 0x0, @rand_addr=0x64010100}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="9d538ec59203de1717845e63917cdbde43d4b291357c13252cf1e12be4b906df0f38e60ab12c0dc071c4ccefb607a9f5c779706f358eed0fe6c87e992dde57df78da9c5f29e7dca4c3", 0x49}, {&(0x7f0000000240)="2cf011498e07ae38c30af3b2fa8cbbc26613ba28710d7d57bcc42bc231c51b0a677fa006f4dd39", 0x27}, {&(0x7f0000000280)="d1a40b8ed25eb06e139003e1b9b26393126728202aa5f476bde95dde7675249dfe91c386b0240a8132917a88ad10b352061bc38cea3bd20c28bce54149c2be25a87c636a0cf1466330fd8a0810ebba04", 0x50}, {&(0x7f00000003c0)="836c69be93df131c1f9e9170abf37ffd0bee8de5954297f4347739ea147f8f06f80e52e805217aa770d90ff53fe742e6ade86fa6849c9c9d8016454678824d532df6ae7a1874e5107cd37c0fe1768effbb6d0179809510703a12cf381021a714283c04", 0x63}, {&(0x7f0000000440)="ae4b19279e791bdccebad61f27f4158e170025a5c4c7f9da3ba8204a3cef59e40fd434d298c76b89148a8781b744982e730f5f636f38679355b5e828b4907f987732cd7f3262b695432be897a4763084e27643cca4a28a316ff44e040b6b1a371020", 0x62}], 0x5, &(0x7f0000000540)=[{0xf0, 0x115, 0x2, "9d18346d8d30bada436e94edb40a5537326bfa5f3d26a0dbf1b123444df1632167723895827a6cab090564772b3c5b86ec6e93460c080bae22d1d2e5d3cc18a2802323731b1c0e11c4f212acd0fbbd65373cacd3af0b5e1200fb8b5dddd17388e87ca45dc380bd67b71b5920be01d759fc2e90d7bc1c1dbad25540c1843a3698aec6a084fb132aa5368b85f78cbd653a2142973dd4dcd370776d90e30ab6a795c8e760bd1f097b22fc35c3833099102d541538777b3e8c918c414b44b706a066a3826263f9649ba583a199e9ea13331f777147c1f098eb4b8dbf479714"}, {0x88, 0x6, 0x200, "0708f7d74dab1f254c5ce6b202338f99183772e832eac2f9b0ebbcc1afaa42fc573f36e838fb57272c20e3a5513bad8d3efb4faf1a1d0f60a37878b6faebcc9d23773f4eb57104285c4f7295e3cb3e50159337d5dcaa6f16f0504cf96f9b1e154af1fc8bc843d58bde0199e93fba0ca28878c2d0da7cf0"}, {0xb0, 0x10e, 0xf3d, "b0dd9b44cdbded2082a566e31a866612046508568736a1c277213c3136d9ac2b43cd16accbe53e156bbf1d25339673847152a8d215770e77bff153007d659e36f3bbc90f6f5839cc14496264e3e3abf3d61dacc9f1954fbcc2b60edee06e41f2321e154bb3ff35df08461134835c06ea6493c930e7ac599129a90cf3a2e8849b18cfd044aac2d7b7514d3b3e31de271fcc633a37267101ab7a"}, {0xe0, 0x104, 0x10, "e4bd54891b345787dec1ed2dd029ca378b8452deb9ce03422723043f9ab6879371f8aa19b1810fc90b0ee3c4e5f5e79e9f1c16376dfcad4463984340f6e27f3653d60e5fc82fb2340bfd07d1a6e0eec04b8fcaa31afd7b36752ccc2512af5bf1120380843e4e175108d568fcd2450d7d6340688c2eaf6b4891b1a26d8b5177e9cd43a9ce25430d031cac7943e54e3acf3f015b247d840f37df666e41d78ae47fe92719d5d1f14e8bdb4370a97ba445b4cd1cb98a7b017ebe04a2accb2f1adb59c9526cda7d89641fa1f37c29cacc"}, {0xd0, 0x117, 0x1, "7ae9c4509eb50cc82581366499207a8386f23a42ae97b8a468e2e132734a7001b50ec02ff9b84f709eec40380b884e1787f0874f3d2e513431de22f02e9ed5f070c9d4214d479b12f97c1c3e2a478d4ad93c3173d6f95f36ac492a098a288818c1e35c8fe40b414385521f4ac70714e5b74bcb2d03f0936bf21485b9a1c586f16af4350228cd0c0ea4f1e00551a73c76862547e9357253d469c8fd6b51dc728e90568bd901faa15deff92333cb7ec4ff80678d4ddca142c735"}], 0x3d8}, 0x44) (async) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000380)='\x00', 0x89901) fchdir(r9) (async, rerun: 64) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) (async, rerun: 64) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x1000, &(0x7f0000001dc0)={0xf, 0x0, 0x40000}, 0x20) (async, rerun: 64) close(r9) (async, rerun: 64) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) (async) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xd, 0x1e, &(0x7f0000000040)=ANY=[@ANYBLOB="18080000000000f2000000000000040018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000060000000bf0900000000000055090100000000009500000000000000b7020000000000007b9a00fe00000000b5090800000100007baaf0ff00000000be9800000000000004080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r10, @ANYBLOB="0000000000000000b705000008f2ffff450000007600000018140000", @ANYRES32=r11, @ANYBLOB="0000000000000000bf9100000000000076080000000000008500000084000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) 3m59.252146667s ago: executing program 33 (id=183): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x2c, 0x2, 0x9, 0x5, 0x0, 0x0, {0x3, 0x0, 0x8}, [@NFCTH_TUPLE={0x18, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @rand_addr=0x64010102}}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000800}, 0x2040) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) r2 = socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000a00)={'syztnl1\x00', &(0x7f0000000980)={'ip6gre0\x00', 0x0, 0x29, 0x1, 0x9, 0x6, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x25}, 0x1, 0x10, 0x1, 0x7}}) (rerun: 64) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000ac0)={'sit0\x00', &(0x7f0000000a40)={'erspan0\x00', r3, 0x10, 0x80, 0x9, 0x8001, {{0x17, 0x4, 0x3, 0x4, 0x5c, 0x68, 0x0, 0x5, 0x4, 0x0, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@end, @ssrr={0x89, 0x13, 0x97, [@dev={0xac, 0x14, 0x14, 0x32}, @rand_addr=0x64010102, @remote, @private=0xa010100]}, @lsrr={0x83, 0xb, 0x57, [@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback]}, @cipso={0x86, 0x21, 0x0, [{0x5, 0x5, "7a0631"}, {0x1, 0xc, "a884305cd7959d44257b"}, {0x5, 0xa, "1b9d073279cb33cc"}]}, @lsrr={0x83, 0x7, 0xc4, [@multicast1]}]}}}}}) bind$packet(r0, &(0x7f00000000c0)={0x11, 0x1b, r4, 0x1, 0x3, 0x6, @local}, 0x14) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) (async, rerun: 32) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) (rerun: 32) r5 = fsopen(&(0x7f0000000000)='jfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f00000000c0)='resize', &(0x7f0000000100)='0', 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) fcntl$getflags(r7, 0x3) (async, rerun: 32) r8 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) (rerun: 32) writev(r8, &(0x7f0000000600)=[{&(0x7f0000000040)="002e2e606200000000afe3", 0xb}], 0x1) (async, rerun: 64) write(r6, &(0x7f0000000100)='file read \\0tc/passwd task.uid=0-0xec.argv[0]=\"sh\" exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) (async, rerun: 64) sendmsg(r0, &(0x7f0000000940)={&(0x7f0000000040)=@l2tp={0x2, 0x0, @rand_addr=0x64010100}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="9d538ec59203de1717845e63917cdbde43d4b291357c13252cf1e12be4b906df0f38e60ab12c0dc071c4ccefb607a9f5c779706f358eed0fe6c87e992dde57df78da9c5f29e7dca4c3", 0x49}, {&(0x7f0000000240)="2cf011498e07ae38c30af3b2fa8cbbc26613ba28710d7d57bcc42bc231c51b0a677fa006f4dd39", 0x27}, {&(0x7f0000000280)="d1a40b8ed25eb06e139003e1b9b26393126728202aa5f476bde95dde7675249dfe91c386b0240a8132917a88ad10b352061bc38cea3bd20c28bce54149c2be25a87c636a0cf1466330fd8a0810ebba04", 0x50}, {&(0x7f00000003c0)="836c69be93df131c1f9e9170abf37ffd0bee8de5954297f4347739ea147f8f06f80e52e805217aa770d90ff53fe742e6ade86fa6849c9c9d8016454678824d532df6ae7a1874e5107cd37c0fe1768effbb6d0179809510703a12cf381021a714283c04", 0x63}, {&(0x7f0000000440)="ae4b19279e791bdccebad61f27f4158e170025a5c4c7f9da3ba8204a3cef59e40fd434d298c76b89148a8781b744982e730f5f636f38679355b5e828b4907f987732cd7f3262b695432be897a4763084e27643cca4a28a316ff44e040b6b1a371020", 0x62}], 0x5, &(0x7f0000000540)=[{0xf0, 0x115, 0x2, "9d18346d8d30bada436e94edb40a5537326bfa5f3d26a0dbf1b123444df1632167723895827a6cab090564772b3c5b86ec6e93460c080bae22d1d2e5d3cc18a2802323731b1c0e11c4f212acd0fbbd65373cacd3af0b5e1200fb8b5dddd17388e87ca45dc380bd67b71b5920be01d759fc2e90d7bc1c1dbad25540c1843a3698aec6a084fb132aa5368b85f78cbd653a2142973dd4dcd370776d90e30ab6a795c8e760bd1f097b22fc35c3833099102d541538777b3e8c918c414b44b706a066a3826263f9649ba583a199e9ea13331f777147c1f098eb4b8dbf479714"}, {0x88, 0x6, 0x200, "0708f7d74dab1f254c5ce6b202338f99183772e832eac2f9b0ebbcc1afaa42fc573f36e838fb57272c20e3a5513bad8d3efb4faf1a1d0f60a37878b6faebcc9d23773f4eb57104285c4f7295e3cb3e50159337d5dcaa6f16f0504cf96f9b1e154af1fc8bc843d58bde0199e93fba0ca28878c2d0da7cf0"}, {0xb0, 0x10e, 0xf3d, "b0dd9b44cdbded2082a566e31a866612046508568736a1c277213c3136d9ac2b43cd16accbe53e156bbf1d25339673847152a8d215770e77bff153007d659e36f3bbc90f6f5839cc14496264e3e3abf3d61dacc9f1954fbcc2b60edee06e41f2321e154bb3ff35df08461134835c06ea6493c930e7ac599129a90cf3a2e8849b18cfd044aac2d7b7514d3b3e31de271fcc633a37267101ab7a"}, {0xe0, 0x104, 0x10, "e4bd54891b345787dec1ed2dd029ca378b8452deb9ce03422723043f9ab6879371f8aa19b1810fc90b0ee3c4e5f5e79e9f1c16376dfcad4463984340f6e27f3653d60e5fc82fb2340bfd07d1a6e0eec04b8fcaa31afd7b36752ccc2512af5bf1120380843e4e175108d568fcd2450d7d6340688c2eaf6b4891b1a26d8b5177e9cd43a9ce25430d031cac7943e54e3acf3f015b247d840f37df666e41d78ae47fe92719d5d1f14e8bdb4370a97ba445b4cd1cb98a7b017ebe04a2accb2f1adb59c9526cda7d89641fa1f37c29cacc"}, {0xd0, 0x117, 0x1, "7ae9c4509eb50cc82581366499207a8386f23a42ae97b8a468e2e132734a7001b50ec02ff9b84f709eec40380b884e1787f0874f3d2e513431de22f02e9ed5f070c9d4214d479b12f97c1c3e2a478d4ad93c3173d6f95f36ac492a098a288818c1e35c8fe40b414385521f4ac70714e5b74bcb2d03f0936bf21485b9a1c586f16af4350228cd0c0ea4f1e00551a73c76862547e9357253d469c8fd6b51dc728e90568bd901faa15deff92333cb7ec4ff80678d4ddca142c735"}], 0x3d8}, 0x44) (async) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000380)='\x00', 0x89901) fchdir(r9) (async, rerun: 64) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) (async, rerun: 64) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x1000, &(0x7f0000001dc0)={0xf, 0x0, 0x40000}, 0x20) (async, rerun: 64) close(r9) (async, rerun: 64) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) (async) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xd, 0x1e, &(0x7f0000000040)=ANY=[@ANYBLOB="18080000000000f2000000000000040018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000060000000bf0900000000000055090100000000009500000000000000b7020000000000007b9a00fe00000000b5090800000100007baaf0ff00000000be9800000000000004080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r10, @ANYBLOB="0000000000000000b705000008f2ffff450000007600000018140000", @ANYRES32=r11, @ANYBLOB="0000000000000000bf9100000000000076080000000000008500000084000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) 14.086305293s ago: executing program 3 (id=536): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000000c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000100)={'wpan0\x00'}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r3, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000140)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r1, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x38, r4, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x48801}, 0x220440c1) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) setreuid(0xee01, 0xee01) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r7, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x80, 0x400e}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffd}, 0x39) unshare(0x2040400) openat$ptp0(0xffffffffffffff9c, &(0x7f0000002340), 0x20400, 0x0) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r0, 0x0, 0x0}, 0x10) 12.081551884s ago: executing program 4 (id=542): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000040)={0x2c, &(0x7f00000006c0)={0x7fe51287edc2689d, 0xc}, 0x0, 0x0, 0x0, 0x0}) 9.284748684s ago: executing program 3 (id=543): r0 = fsopen(&(0x7f0000000300)='devpts\x00', 0x1) fcntl$dupfd(r0, 0x0, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='\n', 0x1) 8.703114284s ago: executing program 4 (id=545): syz_open_procfs(0x0, &(0x7f0000000300)='task\x00') socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect$midi(0x0, 0x58, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201f70200000040"], 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) r1 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x10}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="10", 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4060845) 8.478878497s ago: executing program 3 (id=546): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f00000000c0)={0x0, 0xb, 0x4, &(0x7f0000000080)={0x2, "f70ee6526a62fc2dbc1acb09bb337e117893548884ee00"}}) 8.128511951s ago: executing program 0 (id=548): socket(0x10, 0x803, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) socket(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) shutdown(r4, 0x0) connect$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10) sendto$inet(r4, &(0x7f0000000200)="e1", 0x1, 0x20000000, 0x0, 0x0) splice(r4, 0x0, r3, 0x0, 0xfea8, 0xa) r5 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) socket(0x15, 0x5, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24048005}, 0x4000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x810}, 0x20004000) openat$6lowpan_control(0xffffff9c, 0x0, 0x2, 0x0) 6.815154828s ago: executing program 0 (id=549): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="40010000", @ANYRES16=r1, @ANYBLOB="0100000000000400000001000000240003000000000000000000000000000000000000000000000000000000000000000000140002007767310000000000000000"], 0x140}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fcdbdf2501000000140002007767310000000000000000000000000024000300a05ca84f6c"], 0x4c}, 0x1, 0x0, 0x0, 0x40090}, 0x44000) 6.32407226s ago: executing program 0 (id=550): r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, &(0x7f0000000300)) 6.2676345s ago: executing program 3 (id=551): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0xe}, 0x94) r3 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000080)) io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) 6.100395019s ago: executing program 0 (id=552): r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000040)=@id, 0x10) recvfrom$unix(r0, &(0x7f00000000c0)=""/41, 0x29, 0x10003, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, 0x0, 0x0) syz_open_dev$vim2m(0x0, 0x1, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000280)=0x5) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() lseek(0xffffffffffffffff, 0x1fd, 0x3) sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r6, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x0, 0x4, 0x1ff}}) 4.921562826s ago: executing program 3 (id=553): socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(&(0x7f0000000540)='./trace\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./trace\x00', &(0x7f0000000600)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffff9c, &(0x7f0000000640)='./trace/events/mac80211/enable\x00', 0x40000, 0x0) readv(r1, &(0x7f0000000740)=[{&(0x7f0000000340)=""/122, 0x7a}], 0x1) 3.00192534s ago: executing program 3 (id=554): syz_open_procfs(0x0, &(0x7f0000000300)='task\x00') syz_usb_connect$midi(0x0, 0x58, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201f70200000040"], 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x10}], 0x1}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="10", 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4060845) 2.427848995s ago: executing program 4 (id=555): r0 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000200)={r1, r0, r0}, &(0x7f0000000140)=""/68, 0x44, 0x0) 2.31271882s ago: executing program 0 (id=556): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f0000002340)=[{&(0x7f0000001080)=""/4096, 0x1000}], 0x1}, 0x81}, {{0x0, 0x0, &(0x7f0000003ac0)=[{&(0x7f00000039c0)=""/16, 0x10}], 0x1}, 0xd4}], 0x2, 0x40000141, 0x0) 2.021172995s ago: executing program 4 (id=557): read$dsp(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xfffe, 0x8, @mcast2, 0x9}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa) 1.385920581s ago: executing program 4 (id=558): r0 = socket$inet6(0xa, 0x80002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 3.382629ms ago: executing program 0 (id=559): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ed) mount(&(0x7f0000000140)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/module/dvb_as102/parameters/fw_upload\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='0\x00', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vidtv/unbind\x00', 0x1, 0x0) syz_usb_connect$uac1(0x3, 0xba, 0x0, 0x0) write(r1, &(0x7f0000000300)='vidtv.0', 0x7) 0s ago: executing program 4 (id=560): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0x4f1}}}, 0x108) setsockopt$MRT6_INIT(0xffffffffffffffff, 0x29, 0xc8, &(0x7f0000000340), 0x4) setsockopt$MRT6_DONE(0xffffffffffffffff, 0x29, 0xc9, 0x12, 0x0) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000001a00)=ANY=[@ANYBLOB="03000000000000000a004e2300000010ff010000000000000000000000000001f8ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000a004e2000000008fe8000000000000000000000000000aa05000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000010000000c0000000000000000000000000000000104000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ad94e2100000073fe8000"], 0x610) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x71228}, [@IFLA_MTU={0x8, 0x4, 0x81}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x4004090) kernel console output (not intermixed with test programs): d_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 162.854588][ T6164] lowmem_reserve[]: 0 2499 2501 2501 2501 [ 162.854637][ T6164] Node 0 DMA32 free:1266668kB boost:0kB min:3920kB low:6452kB high:8984kB reserved_highatomic:0KB free_highatomic:0KB active_anon:748kB inactive_anon:46420kB active_file:53420kB inactive_file:162496kB unevictable:0kB writepending:352kB zspages:0kB present:3129332kB managed:2559592kB mlocked:0kB bounce:0kB free_pcp:80172kB local_pcp:2644kB free_cma:0kB [ 162.854698][ T6164] lowmem_reserve[]: 0 0 1 1 1 [ 162.854732][ T6164] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1840kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 162.854822][ T6164] lowmem_reserve[]: 0 0 0 0 0 [ 162.854878][ T6164] Node 1 Normal free:3940740kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:196kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 162.854944][ T6164] lowmem_reserve[]: 0 0 0 0 0 [ 162.854983][ T6164] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 162.855123][ T6164] Node 0 DMA32: 914*4kB (UME) 119*8kB (UE) 40*16kB (UE) 225*32kB (UME) 111*64kB (UME) 123*128kB (UME) 86*256kB (ME) 46*512kB (UME) 12*1024kB (UME) 11*2048kB (UM) 281*4096kB (UM) = 1266656kB [ 162.855307][ T6164] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 162.855423][ T6164] Node 1 Normal: 1*4kB (M) 8*8kB (UM) 4*16kB (UM) 12*32kB (UM) 8*64kB (UM) 5*128kB (UM) 3*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 960*4096kB (M) = 3940740kB [ 162.855608][ T6164] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 162.855626][ T6164] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 162.855644][ T6164] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 162.855662][ T6164] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 162.855679][ T6164] 60283 total pagecache pages [ 162.855692][ T6164] 0 pages in swap cache [ 162.855700][ T6164] Free swap = 124996kB [ 162.855708][ T6164] Total swap = 124996kB [ 162.855717][ T6164] 2097051 pages RAM [ 162.855725][ T6164] 0 pages HighMem/MovableOnly [ 162.855732][ T6164] 425078 pages reserved [ 162.855740][ T6164] 0 pages cma reserved [ 164.353474][ T5828] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 164.766283][ T5828] usb 3-1: Using ep0 maxpacket: 32 [ 164.770060][ T5828] usb 3-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 164.773880][ T5828] usb 3-1: config 2 has an invalid interface number: 88 but max is 0 [ 164.773952][ T5828] usb 3-1: config 2 has no interface number 0 [ 164.774077][ T5828] usb 3-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 164.774165][ T5828] usb 3-1: config 2 interface 88 has no altsetting 0 [ 164.795689][ T5828] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 164.795766][ T5828] usb 3-1: Product: syz [ 164.795821][ T5828] usb 3-1: Manufacturer: syz [ 164.795865][ T5828] usb 3-1: SerialNumber: syz [ 164.899031][ T199] usb 2-1: USB disconnect, device number 3 [ 165.805355][ T6172] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 166.059126][ T6172] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 168.598945][ T6226] netlink: 20 bytes leftover after parsing attributes in process `syz.0.106'. [ 168.599059][ T6226] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 169.294586][ T5828] asix 3-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 169.945263][ T6237] process 'syz.3.109' launched './file2' with NULL argv: empty string added [ 170.558964][ T5828] asix 3-1:2.88: probe with driver asix failed with error -71 [ 171.805006][ T5828] usb 3-1: USB disconnect, device number 3 [ 171.943635][ T6243] comedi comedi0: No hardware detected at I/O base 0x294 [ 172.072970][ T1234] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 172.073030][ T1234] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 172.073073][ T1234] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 172.073115][ T1234] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 173.620023][ T6261] netlink: 20 bytes leftover after parsing attributes in process `syz.4.116'. [ 173.620060][ T6261] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 173.879092][ T6264] FAULT_INJECTION: forcing a failure. [ 173.879092][ T6264] name failslab, interval 1, probability 0, space 0, times 0 [ 173.879131][ T6264] CPU: 0 UID: 0 PID: 6264 Comm: syz.3.117 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 173.879170][ T6264] Tainted: [L]=SOFTLOCKUP [ 173.879177][ T6264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 173.879193][ T6264] Call Trace: [ 173.879201][ T6264] [ 173.879210][ T6264] dump_stack_lvl+0xe8/0x150 [ 173.879250][ T6264] should_fail_ex+0x46b/0x600 [ 173.879290][ T6264] should_failslab+0xa8/0x100 [ 173.879318][ T6264] __kmalloc_cache_noprof+0xa0/0x6b0 [ 173.879340][ T6264] ? __se_sys_mount+0x166/0x420 [ 173.879362][ T6264] ? __se_sys_mount+0x166/0x420 [ 173.879386][ T6264] ? memdup_user+0x99/0xd0 [ 173.879419][ T6264] __se_sys_mount+0x166/0x420 [ 173.879450][ T6264] ? __pfx___se_sys_mount+0x10/0x10 [ 173.879481][ T6264] ? __x64_sys_mount+0x20/0xc0 [ 173.879508][ T6264] do_syscall_64+0x166/0x520 [ 173.879532][ T6264] ? trace_irq_disable+0x3b/0x140 [ 173.879555][ T6264] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.879578][ T6264] ? clear_bhb_loop+0x70/0xc0 [ 173.879606][ T6264] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.879629][ T6264] RIP: 0033:0x7fab5263e0d9 [ 173.879649][ T6264] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.879667][ T6264] RSP: 002b:00007fab50896028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 173.879691][ T6264] RAX: ffffffffffffffda RBX: 00007fab528c5fa0 RCX: 00007fab5263e0d9 [ 173.879707][ T6264] RDX: 0000200000007500 RSI: 00002000000074c0 RDI: 0000000000000000 [ 173.879722][ T6264] RBP: 00007fab50896090 R08: 0000200000000080 R09: 0000000000000000 [ 173.879737][ T6264] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 173.879750][ T6264] R13: 00007fab528c6038 R14: 00007fab528c5fa0 R15: 00007fff053259e8 [ 173.879785][ T6264] [ 174.800670][ T6271] syz.1.118 (6271): drop_caches: 2 [ 176.508026][ T6286] FAULT_INJECTION: forcing a failure. [ 176.508026][ T6286] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 176.508075][ T6286] CPU: 1 UID: 0 PID: 6286 Comm: syz.1.123 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 176.508106][ T6286] Tainted: [L]=SOFTLOCKUP [ 176.508114][ T6286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 176.508127][ T6286] Call Trace: [ 176.508135][ T6286] [ 176.508149][ T6286] dump_stack_lvl+0xe8/0x150 [ 176.508187][ T6286] should_fail_ex+0x46b/0x600 [ 176.508228][ T6286] _copy_from_user+0x2d/0xb0 [ 176.508253][ T6286] bpf_test_init+0xd8/0x150 [ 176.508292][ T6286] bpf_prog_test_run_xdp+0x4cc/0x11d0 [ 176.508345][ T6286] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 176.508385][ T6286] ? __fget_files+0x2a/0x420 [ 176.508416][ T6286] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 176.508452][ T6286] bpf_prog_test_run+0x2cb/0x340 [ 176.508485][ T6286] __sys_bpf+0xa22/0xd90 [ 176.508521][ T6286] ? __pfx___sys_bpf+0x10/0x10 [ 176.508551][ T6286] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 176.508581][ T6286] ? rt_mutex_slowunlock+0x219/0x460 [ 176.508634][ T6286] ? ksys_write+0x248/0x270 [ 176.508663][ T6286] ? __pfx_ksys_write+0x10/0x10 [ 176.508697][ T6286] __x64_sys_bpf+0xba/0xd0 [ 176.508724][ T6286] do_syscall_64+0x166/0x520 [ 176.508752][ T6286] ? trace_irq_disable+0x3b/0x140 [ 176.508774][ T6286] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.508798][ T6286] ? clear_bhb_loop+0x70/0xc0 [ 176.508827][ T6286] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.508850][ T6286] RIP: 0033:0x7f3b3d78e0d9 [ 176.508870][ T6286] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 176.508895][ T6286] RSP: 002b:00007f3b3b9c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 176.508919][ T6286] RAX: ffffffffffffffda RBX: 00007f3b3da16090 RCX: 00007f3b3d78e0d9 [ 176.508935][ T6286] RDX: 0000000000000050 RSI: 0000200000000080 RDI: 000000000000000a [ 176.508950][ T6286] RBP: 00007f3b3b9c5090 R08: 0000000000000000 R09: 0000000000000000 [ 176.508964][ T6286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 176.508977][ T6286] R13: 00007f3b3da16128 R14: 00007f3b3da16090 R15: 00007ffc1cccc8b8 [ 176.509013][ T6286] [ 176.601891][ T5828] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 176.641529][ C1] raw-gadget.1 gadget.2: ignoring, device is not running [ 176.791916][ T5828] usb 3-1: device descriptor read/64, error -32 [ 176.973130][ T5723] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 177.153383][ T5723] usb 5-1: Using ep0 maxpacket: 32 [ 177.159476][ T5723] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 177.191827][ T5828] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 177.197904][ T5723] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 177.197935][ T5723] usb 5-1: config 2 has no interface number 0 [ 177.197984][ T5723] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 177.198013][ T5723] usb 5-1: config 2 interface 88 has no altsetting 0 [ 177.269367][ T199] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 177.337857][ T5723] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 177.337886][ T5723] usb 5-1: Product: syz [ 177.337902][ T5723] usb 5-1: Manufacturer: syz [ 177.337918][ T5723] usb 5-1: SerialNumber: syz [ 177.449331][ T6276] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 177.492834][ T5828] usb 3-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 177.495823][ T199] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 177.545444][ T5828] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 177.545475][ T5828] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 177.545520][ T5828] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.562015][ T199] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 177.562042][ T199] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 177.562061][ T199] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 177.578772][ T199] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 177.582056][ T199] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 177.848733][ T199] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 177.848821][ T199] usb 1-1: Product: syz [ 177.848837][ T199] usb 1-1: Manufacturer: syz [ 177.911307][ T6274] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 177.966833][ T5828] usb 3-1: probing VID:PID(0424:012C) [ 178.042168][ T199] cdc_wdm 1-1:1.0: skipping garbage [ 178.042199][ T199] cdc_wdm 1-1:1.0: skipping garbage [ 180.262121][ T5828] usb 3-1: vub300 testing BULK IN EndPoint(0) 81 [ 180.262141][ T5828] usb 3-1: vub300 testing BULK OUT EndPoint(1) 02 [ 180.262155][ T5828] usb 3-1: vub300 testing BULK IN EndPoint(2) 83 [ 180.262169][ T5828] usb 3-1: vub300 testing BULK OUT EndPoint(3) 04 [ 180.262205][ T5828] usb 3-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 180.318975][ T5723] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 180.319271][ T5723] asix 5-1:2.88: probe with driver asix failed with error -71 [ 180.578450][ T199] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 180.578496][ T199] cdc_wdm 1-1:1.0: Unknown control protocol [ 180.608501][ T5723] usb 5-1: USB disconnect, device number 2 [ 180.833689][ T6305] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.126'. [ 180.930845][ T5828] vub300 3-1:1.0: probe with driver vub300 failed with error -71 [ 181.030326][ T5828] usb 3-1: USB disconnect, device number 5 [ 185.397088][ T6326] syz.2.133 (6326): drop_caches: 2 [ 185.891371][ T6332] IPVS: set_ctl: invalid protocol: 2 224.0.0.2:20000 [ 185.929615][ T6335] FAULT_INJECTION: forcing a failure. [ 185.929615][ T6335] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 185.929652][ T6335] CPU: 1 UID: 0 PID: 6335 Comm: syz.3.135 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 185.929681][ T6335] Tainted: [L]=SOFTLOCKUP [ 185.929688][ T6335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 185.929701][ T6335] Call Trace: [ 185.929708][ T6335] [ 185.929717][ T6335] dump_stack_lvl+0xe8/0x150 [ 185.929754][ T6335] should_fail_ex+0x46b/0x600 [ 185.929793][ T6335] _copy_from_user+0x2d/0xb0 [ 185.929817][ T6335] bpf_test_init+0xd8/0x150 [ 185.929853][ T6335] bpf_prog_test_run_skb+0x31e/0x2230 [ 185.929907][ T6335] ? __fget_files+0x3a8/0x420 [ 185.929929][ T6335] ? __fget_files+0x2a/0x420 [ 185.929957][ T6335] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 185.929989][ T6335] bpf_prog_test_run+0x2cb/0x340 [ 185.930022][ T6335] __sys_bpf+0xa22/0xd90 [ 185.930056][ T6335] ? __pfx___sys_bpf+0x10/0x10 [ 185.930084][ T6335] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 185.930114][ T6335] ? rt_mutex_slowunlock+0x219/0x460 [ 185.930166][ T6335] ? ksys_write+0x248/0x270 [ 185.930194][ T6335] ? __pfx_ksys_write+0x10/0x10 [ 185.930226][ T6335] __x64_sys_bpf+0xba/0xd0 [ 185.930253][ T6335] do_syscall_64+0x166/0x520 [ 185.930275][ T6335] ? trace_irq_disable+0x3b/0x140 [ 185.930308][ T6335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.930331][ T6335] ? clear_bhb_loop+0x70/0xc0 [ 185.930359][ T6335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.930381][ T6335] RIP: 0033:0x7fab5263e0d9 [ 185.930401][ T6335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 185.930419][ T6335] RSP: 002b:00007fab50896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 185.930441][ T6335] RAX: ffffffffffffffda RBX: 00007fab528c5fa0 RCX: 00007fab5263e0d9 [ 185.930457][ T6335] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 185.930470][ T6335] RBP: 00007fab50896090 R08: 0000000000000000 R09: 0000000000000000 [ 185.930483][ T6335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 185.930495][ T6335] R13: 00007fab528c6038 R14: 00007fab528c5fa0 R15: 00007fff053259e8 [ 185.930528][ T6335] [ 186.487177][ T5723] usb 1-1: USB disconnect, device number 4 [ 188.148191][ T6357] netlink: 8 bytes leftover after parsing attributes in process `syz.1.140'. [ 188.591374][ T6363] syz.4.143 (6363): drop_caches: 2 [ 189.580536][ T6375] syz.3.146 (6375): drop_caches: 2 [ 189.808830][ T6379] syz.2.147 (6379): drop_caches: 2 [ 191.092506][ T5723] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 191.241791][ T5723] usb 1-1: Using ep0 maxpacket: 32 [ 191.242842][ T5723] usb 1-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 191.246648][ T5723] usb 1-1: config 2 has an invalid interface number: 88 but max is 0 [ 191.246675][ T5723] usb 1-1: config 2 has no interface number 0 [ 191.246723][ T5723] usb 1-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 191.246751][ T5723] usb 1-1: config 2 interface 88 has no altsetting 0 [ 191.348129][ T5723] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 191.348156][ T5723] usb 1-1: Product: syz [ 191.348170][ T5723] usb 1-1: Manufacturer: syz [ 191.348184][ T5723] usb 1-1: SerialNumber: syz [ 191.439520][ T6378] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 191.715912][ T6377] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 193.203778][ T6392] netlink: 8 bytes leftover after parsing attributes in process `syz.3.151'. [ 194.328956][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.333596][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.334669][ T5723] asix 1-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 196.334957][ T5723] asix 1-1:2.88: probe with driver asix failed with error -71 [ 196.366221][ T6424] FAULT_INJECTION: forcing a failure. [ 196.366221][ T6424] name failslab, interval 1, probability 0, space 0, times 0 [ 196.366258][ T6424] CPU: 1 UID: 0 PID: 6424 Comm: syz.1.157 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 196.366289][ T6424] Tainted: [L]=SOFTLOCKUP [ 196.366297][ T6424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 196.366310][ T6424] Call Trace: [ 196.366318][ T6424] [ 196.366327][ T6424] dump_stack_lvl+0xe8/0x150 [ 196.366366][ T6424] should_fail_ex+0x46b/0x600 [ 196.366404][ T6424] ? alloc_slab_obj_exts+0x4d/0x170 [ 196.366439][ T6424] should_failslab+0xa8/0x100 [ 196.366466][ T6424] __kmalloc_flags_noprof+0x12c/0x850 [ 196.366492][ T6424] ? alloc_slab_obj_exts+0x4d/0x170 [ 196.366532][ T6424] alloc_slab_obj_exts+0x4d/0x170 [ 196.366568][ T6424] __memcg_slab_post_alloc_hook+0x602/0xf60 [ 196.366637][ T6424] kmem_cache_alloc_node_noprof+0x4ac/0x670 [ 196.366674][ T6424] ? __alloc_skb+0x1db/0x7a0 [ 196.366700][ T6424] ? __alloc_skb+0x1db/0x7a0 [ 196.366744][ T6424] __alloc_skb+0x1db/0x7a0 [ 196.366778][ T6424] alloc_skb_with_frags+0xc6/0x760 [ 196.366816][ T6424] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 196.366849][ T6424] sock_alloc_send_pskb+0x884/0x9a0 [ 196.366905][ T6424] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 196.366946][ T6424] ? smack_socket_getpeersec_dgram+0x320/0x430 [ 196.366988][ T6424] unix_dgram_sendmsg+0x4da/0x17b0 [ 196.367024][ T6424] ? __pfx_smack_socket_sendmsg+0x10/0x10 [ 196.367086][ T6424] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 196.367110][ T6424] ? __lock_acquire+0x683/0x2ce0 [ 196.367146][ T6424] ? __kernel_text_address+0xd/0x30 [ 196.367168][ T6424] ? unwind_get_return_address+0x4d/0x90 [ 196.367196][ T6424] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 196.367222][ T6424] sock_sendmsg_nosec+0x13a/0x180 [ 196.367251][ T6424] ____sys_sendmsg+0x565/0x870 [ 196.367283][ T6424] ? __might_fault+0xaf/0x130 [ 196.367311][ T6424] ? __pfx_____sys_sendmsg+0x10/0x10 [ 196.367354][ T6424] ? import_iovec+0x73/0xa0 [ 196.367382][ T6424] ___sys_sendmsg+0x2a5/0x360 [ 196.367412][ T6424] ? __lock_acquire+0x683/0x2ce0 [ 196.367441][ T6424] ? __pfx____sys_sendmsg+0x10/0x10 [ 196.367512][ T6424] ? __fget_files+0x2a/0x420 [ 196.367536][ T6424] ? __fget_files+0x3a8/0x420 [ 196.367571][ T6424] __x64_sys_sendmsg+0x1b7/0x290 [ 196.367607][ T6424] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 196.367663][ T6424] do_syscall_64+0x166/0x520 [ 196.367686][ T6424] ? trace_irq_disable+0x3b/0x140 [ 196.367709][ T6424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.367741][ T6424] ? clear_bhb_loop+0x70/0xc0 [ 196.367768][ T6424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.367790][ T6424] RIP: 0033:0x7f3b3d78e0d9 [ 196.367810][ T6424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.367828][ T6424] RSP: 002b:00007f3b3b9e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 196.367851][ T6424] RAX: ffffffffffffffda RBX: 00007f3b3da15fa0 RCX: 00007f3b3d78e0d9 [ 196.367867][ T6424] RDX: 0000000002040094 RSI: 0000200000000600 RDI: 0000000000000006 [ 196.367881][ T6424] RBP: 00007f3b3b9e6090 R08: 0000000000000000 R09: 0000000000000000 [ 196.367894][ T6424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.367907][ T6424] R13: 00007f3b3da16038 R14: 00007f3b3da15fa0 R15: 00007ffc1cccc8b8 [ 196.367942][ T6424] [ 196.515346][ T5723] usb 1-1: USB disconnect, device number 5 [ 197.554374][ T6436] syz.2.159 (6436): drop_caches: 2 [ 198.155942][ T6440] syz.3.160 (6440): drop_caches: 2 [ 198.952694][ T36] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 199.132674][ T36] usb 4-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.40 [ 199.134466][ T36] usb 4-1: config 1 interface 0 has no altsetting 0 [ 199.159539][ T36] usb 4-1: string descriptor 0 read error: -22 [ 199.159696][ T36] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.269082][ T6457] netlink: 8 bytes leftover after parsing attributes in process `syz.0.167'. [ 202.479906][ T5690] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 202.698213][ T5690] usb 2-1: New USB device found, idVendor=0846, idProduct=1001, bcdDevice= 1.00 [ 203.775494][ T5828] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 203.944183][ T5828] usb 5-1: Using ep0 maxpacket: 32 [ 203.945234][ T5828] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 203.947086][ T5828] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 203.947112][ T5828] usb 5-1: config 2 has no interface number 0 [ 203.947159][ T5828] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 203.947187][ T5828] usb 5-1: config 2 interface 88 has no altsetting 0 [ 203.953440][ T5828] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 203.953467][ T5828] usb 5-1: Product: syz [ 203.953484][ T5828] usb 5-1: Manufacturer: syz [ 203.953499][ T5828] usb 5-1: SerialNumber: syz [ 203.961327][ T5690] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 203.961364][ T5690] usb 2-1: can't read configurations, error -71 [ 204.200757][ T6467] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 204.280268][ T36] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 204.280312][ T36] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 204.280340][ T36] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 204.280431][ T36] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 204.280460][ T36] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 204.280487][ T36] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 204.280514][ T36] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 204.280604][ T36] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 204.280632][ T36] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 204.280660][ T36] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 204.368840][ T36] razer 0003:1532:010D.0001: unexpected long global item [ 204.415342][ T6467] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 204.425272][ T36] razer 0003:1532:010D.0001: probe with driver razer failed with error -22 [ 204.826447][ T36] usb 4-1: USB disconnect, device number 2 [ 209.680530][ T5828] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -110 [ 209.680793][ T5828] asix 5-1:2.88: probe with driver asix failed with error -110 [ 209.857833][ T5717] usb 5-1: USB disconnect, device number 3 [ 210.703546][ T6483] syz.0.172 (6483): drop_caches: 2 [ 214.094997][ T6489] netlink: 12 bytes leftover after parsing attributes in process `syz.0.175'. [ 214.095990][ T6489] netlink: 104 bytes leftover after parsing attributes in process `syz.0.175'. [ 215.506089][ T5596] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 215.557092][ T5596] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 215.560703][ T5596] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 215.577026][ T5596] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 215.582928][ T5596] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 216.624439][ T6510] syz.0.179 (6510): drop_caches: 2 [ 217.775294][ T60] Bluetooth: hci5: command tx timeout [ 218.891808][ T36] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 219.111754][ T36] usb 1-1: Using ep0 maxpacket: 32 [ 219.112586][ T36] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 219.114087][ T36] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 219.114112][ T36] usb 1-1: config 0 has no interface number 0 [ 219.114159][ T36] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 219.117885][ T36] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.117908][ T36] usb 1-1: Product: syz [ 219.117922][ T36] usb 1-1: Manufacturer: syz [ 219.117936][ T36] usb 1-1: SerialNumber: syz [ 219.249785][ T36] usb 1-1: config 0 descriptor?? [ 219.258023][ T6518] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 219.469993][ T6517] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 219.498274][ T6525] FAULT_INJECTION: forcing a failure. [ 219.498274][ T6525] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 219.498306][ T6525] CPU: 1 UID: 0 PID: 6525 Comm: syz.1.182 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 219.498329][ T6525] Tainted: [L]=SOFTLOCKUP [ 219.498334][ T6525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 219.498347][ T6525] Call Trace: [ 219.498354][ T6525] [ 219.498361][ T6525] dump_stack_lvl+0xe8/0x150 [ 219.498393][ T6525] should_fail_ex+0x46b/0x600 [ 219.498426][ T6525] _copy_to_user+0x31/0xb0 [ 219.498449][ T6525] simple_read_from_buffer+0xe1/0x170 [ 219.498475][ T6525] proc_fail_nth_read+0x1be/0x230 [ 219.498496][ T6525] ? __local_bh_enable+0x1e3/0x2f0 [ 219.498519][ T6525] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 219.498543][ T6525] ? rw_verify_area+0x250/0x4d0 [ 219.498564][ T6525] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 219.498585][ T6525] vfs_read+0x219/0xa90 [ 219.498612][ T6525] ? __pfx_vfs_read+0x10/0x10 [ 219.498634][ T6525] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 219.498656][ T6525] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 219.498674][ T6525] ? mutex_lock_nested+0x152/0x1d0 [ 219.498697][ T6525] ? fdget_pos+0x252/0x320 [ 219.498723][ T6525] ksys_read+0x156/0x270 [ 219.498747][ T6525] ? __pfx_ksys_read+0x10/0x10 [ 219.498765][ T6525] ? fput+0xa0/0xd0 [ 219.498801][ T6525] do_syscall_64+0x166/0x520 [ 219.498819][ T6525] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.498837][ T6525] ? clear_bhb_loop+0x70/0xc0 [ 219.498862][ T6525] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.498886][ T6525] RIP: 0033:0x7f3b3d74e90e [ 219.498905][ T6525] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 219.498923][ T6525] RSP: 002b:00007f3b3b9e5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 219.498967][ T6525] RAX: ffffffffffffffda RBX: 00007f3b3b9e66c0 RCX: 00007f3b3d74e90e [ 219.498983][ T6525] RDX: 000000000000000f RSI: 00007f3b3b9e60a0 RDI: 000000000000000b [ 219.498997][ T6525] RBP: 00007f3b3b9e6090 R08: 0000000000000000 R09: 0000000000000000 [ 219.499010][ T6525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 219.499023][ T6525] R13: 00007f3b3da16038 R14: 00007f3b3da15fa0 R15: 00007ffc1cccc8b8 [ 219.499058][ T6525] [ 219.850347][ T4899] Bluetooth: hci5: command tx timeout [ 220.000909][ T36] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 220.004907][ T36] asix 1-1:0.188: probe with driver asix failed with error -71 [ 220.033844][ T36] usb 1-1: USB disconnect, device number 6 [ 220.345245][ T6527] netlink: 'syz.1.183': attribute type 1 has an invalid length. [ 222.497142][ T5597] Bluetooth: hci4: command 0x0406 tx timeout [ 222.497931][ T5597] Bluetooth: hci5: command tx timeout [ 222.497956][ T5597] Bluetooth: hci3: command 0x0406 tx timeout [ 222.498047][ T5597] Bluetooth: hci0: command 0x0406 tx timeout [ 222.498070][ T5597] Bluetooth: hci1: command 0x0406 tx timeout [ 222.562848][ T5690] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 222.783363][ T5690] usb 4-1: Using ep0 maxpacket: 32 [ 222.785735][ T5690] usb 4-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 222.795382][ T5690] usb 4-1: config 2 has an invalid interface number: 88 but max is 0 [ 222.795452][ T5690] usb 4-1: config 2 has no interface number 0 [ 222.795573][ T5690] usb 4-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 222.795613][ T5690] usb 4-1: config 2 interface 88 has no altsetting 0 [ 222.873136][ T5690] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 222.873156][ T5690] usb 4-1: Product: syz [ 222.873167][ T5690] usb 4-1: Manufacturer: syz [ 222.873178][ T5690] usb 4-1: SerialNumber: syz [ 223.257656][ T6548] netlink: 12 bytes leftover after parsing attributes in process `syz.0.186'. [ 223.273520][ T6548] netlink: 104 bytes leftover after parsing attributes in process `syz.0.186'. [ 224.159141][ T6536] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 224.541819][ T4899] Bluetooth: hci5: command tx timeout [ 225.823244][ T5690] asix 4-1:2.88: probe with driver asix failed with error -71 [ 226.417393][ T5690] usb 4-1: USB disconnect, device number 3 [ 226.569663][ T6556] tmpfs: Bad value for 'mpol' [ 227.601079][ T1112] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.964364][ T6496] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.964575][ T6496] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.965083][ T6496] bridge_slave_0: entered allmulticast mode [ 229.967892][ T6496] bridge_slave_0: entered promiscuous mode [ 229.971559][ T6496] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.991839][ T6496] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.993013][ T6496] bridge_slave_1: entered allmulticast mode [ 230.043897][ T6496] bridge_slave_1: entered promiscuous mode [ 230.980699][ T6590] netlink: 48 bytes leftover after parsing attributes in process `syz.3.194'. [ 231.698719][ T6496] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 232.299045][ T1112] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 232.407206][ T6496] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 233.550377][ T6594] syz.3.195 (6594): drop_caches: 2 [ 233.577046][ T1112] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.051121][ T6496] team0: Port device team_slave_0 added [ 234.085171][ T6610] netlink: 8 bytes leftover after parsing attributes in process `syz.0.199'. [ 234.087681][ T6496] team0: Port device team_slave_1 added [ 234.163172][ T5718] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 234.312777][ T5718] usb 5-1: Using ep0 maxpacket: 32 [ 234.314122][ T5718] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 234.315764][ T5718] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 234.315781][ T5718] usb 5-1: config 2 has no interface number 0 [ 234.315811][ T5718] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 234.315830][ T5718] usb 5-1: config 2 interface 88 has no altsetting 0 [ 234.318257][ T5718] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 234.318283][ T5718] usb 5-1: Product: syz [ 234.318299][ T5718] usb 5-1: Manufacturer: syz [ 234.318319][ T5718] usb 5-1: SerialNumber: syz [ 234.485847][ T1112] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.491316][ T6601] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 234.633783][ T6496] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 234.633802][ T6496] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 234.633894][ T6496] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 234.700557][ T6601] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 234.728203][ T6496] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 234.728217][ T6496] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 234.728282][ T6496] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 239.983910][ T5718] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 239.984190][ T5718] asix 5-1:2.88: probe with driver asix failed with error -71 [ 240.084368][ T5718] usb 5-1: USB disconnect, device number 4 [ 240.449275][ T6496] hsr_slave_0: entered promiscuous mode [ 240.461397][ T6496] hsr_slave_1: entered promiscuous mode [ 240.472699][ T6496] debugfs: 'hsr0' already exists in 'hsr' [ 240.472727][ T6496] Cannot create hsr debugfs directory [ 241.086804][ T5591] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 241.166284][ T5591] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 241.175338][ T5591] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 241.177651][ T5591] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 241.178445][ T5591] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 243.414071][ T6641] syz.0.209 (6641): drop_caches: 2 [ 243.436423][ T5591] Bluetooth: hci2: command tx timeout [ 244.616992][ T6657] netlink: 12 bytes leftover after parsing attributes in process `syz.3.211'. [ 244.631096][ T6657] netlink: 104 bytes leftover after parsing attributes in process `syz.3.211'. [ 245.509095][ T5591] Bluetooth: hci2: command tx timeout [ 247.249011][ T1112] bridge_slave_1: left allmulticast mode [ 247.249169][ T1112] bridge_slave_1: left promiscuous mode [ 247.254327][ T1112] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.603427][ T5591] Bluetooth: hci2: command tx timeout [ 248.683296][ T1112] bridge_slave_0: left allmulticast mode [ 248.686489][ T1112] bridge_slave_0: left promiscuous mode [ 248.711888][ T1112] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.550467][ T6689] syz.4.218 (6689): drop_caches: 2 [ 250.141900][ T5591] Bluetooth: hci2: command tx timeout [ 250.686045][ T6696] netlink: 12 bytes leftover after parsing attributes in process `syz.4.220'. [ 250.687005][ T6696] netlink: 104 bytes leftover after parsing attributes in process `syz.4.220'. [ 254.183309][ T1112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 254.226882][ T1112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 254.244297][ T1112] bond0 (unregistering): Released all slaves [ 254.993971][ T6730] netlink: 12 bytes leftover after parsing attributes in process `syz.4.228'. [ 255.011391][ T6730] netlink: 104 bytes leftover after parsing attributes in process `syz.4.228'. [ 255.968903][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.968983][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.544394][ T6762] netlink: 12 bytes leftover after parsing attributes in process `syz.0.233'. [ 258.552480][ T6762] netlink: 104 bytes leftover after parsing attributes in process `syz.0.233'. [ 260.123233][ T5718] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 260.335228][ T5718] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 260.356690][ T5718] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 260.356719][ T5718] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 260.356740][ T5718] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 260.356790][ T5718] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 260.360295][ T5718] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 260.360336][ T5718] usb 1-1: Product: syz [ 260.360350][ T5718] usb 1-1: Manufacturer: syz [ 260.532745][ T5718] cdc_wdm 1-1:1.0: skipping garbage [ 260.532767][ T5718] cdc_wdm 1-1:1.0: skipping garbage [ 260.625249][ T5718] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 260.625272][ T5718] cdc_wdm 1-1:1.0: Unknown control protocol [ 260.670524][ T5245] 8021q: adding VLAN 0 to HW filter on device eth1 [ 260.893710][ T6783] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 260.895029][ T6783] CIFS: Attempting to mount //127.0.0.1/s:e[12harefDr=root [ 261.171821][ T6783] CIFS: VFS: Error connecting to socket. Aborting operation. [ 261.172021][ T6783] CIFS: VFS: cifs_mount failed w/return code = -111 [ 261.656838][ T6496] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 261.803651][ T6496] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 261.843172][ T6496] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 262.009167][ T6496] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 262.628212][ T5718] usb 1-1: USB disconnect, device number 7 [ 262.957059][ T6811] Invalid argument reading file caps for ./file0 [ 262.981160][ T6811] netlink: 'syz.0.240': attribute type 3 has an invalid length. [ 263.043928][ T6496] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 263.177797][ T6496] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 263.466490][ T6823] netlink: 12 bytes leftover after parsing attributes in process `syz.3.242'. [ 263.475152][ T6823] netlink: 104 bytes leftover after parsing attributes in process `syz.3.242'. [ 264.429020][ T6496] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 264.624127][ T6496] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 266.321565][ T1112] hsr_slave_0: left promiscuous mode [ 266.494364][ T1112] hsr_slave_1: left promiscuous mode [ 266.528786][ T1112] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 266.528873][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 266.624954][ T1112] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 266.624981][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 266.649800][ T5690] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 266.686202][ T6855] FAULT_INJECTION: forcing a failure. [ 266.686202][ T6855] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 266.686264][ T6855] CPU: 0 UID: 0 PID: 6855 Comm: syz.0.248 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 266.686294][ T6855] Tainted: [L]=SOFTLOCKUP [ 266.686302][ T6855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 266.686319][ T6855] Call Trace: [ 266.686328][ T6855] [ 266.686337][ T6855] dump_stack_lvl+0xe8/0x150 [ 266.686375][ T6855] should_fail_ex+0x46b/0x600 [ 266.686415][ T6855] _copy_from_iter+0x1d3/0x1660 [ 266.686446][ T6855] ? rcu_is_watching+0x16/0xb0 [ 266.686476][ T6855] ? trace_kmem_cache_alloc+0x29/0xe0 [ 266.686514][ T6855] ? kmem_cache_alloc_noprof+0x3c5/0x660 [ 266.686547][ T6855] ? __build_skb+0x62/0x440 [ 266.686573][ T6855] ? __build_skb+0x62/0x440 [ 266.686600][ T6855] ? __pfx__copy_from_iter+0x10/0x10 [ 266.686638][ T6855] ? __build_skb+0x2a2/0x440 [ 266.686668][ T6855] ? netlink_sendmsg+0x650/0xb40 [ 266.686701][ T6855] ? skb_put+0x112/0x210 [ 266.686734][ T6855] netlink_sendmsg+0x6c0/0xb40 [ 266.686769][ T6855] ? _parse_integer_limit+0x192/0x1e0 [ 266.686806][ T6855] ? __pfx_netlink_sendmsg+0x10/0x10 [ 266.686843][ T6855] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 266.686884][ T6855] ? get_pid_task+0x20/0x1f0 [ 266.686918][ T6855] ? __pfx_netlink_sendmsg+0x10/0x10 [ 266.686951][ T6855] sock_sendmsg_nosec+0x13a/0x180 [ 266.686980][ T6855] sock_write_iter+0x2e4/0x3f0 [ 266.687005][ T6855] ? __pfx_sock_write_iter+0x10/0x10 [ 266.687036][ T6855] ? bpf_lsm_file_permission+0x9/0x20 [ 266.687067][ T6855] ? security_file_permission+0x75/0x260 [ 266.687105][ T6855] vfs_write+0x61e/0xbb0 [ 266.687141][ T6855] ? __pfx_vfs_write+0x10/0x10 [ 266.687178][ T6855] ? __fget_files+0x2a/0x420 [ 266.687213][ T6855] ksys_write+0x156/0x270 [ 266.687262][ T6855] ? __pfx_ksys_write+0x10/0x10 [ 266.687301][ T6855] do_syscall_64+0x166/0x520 [ 266.687324][ T6855] ? trace_irq_disable+0x3b/0x140 [ 266.687347][ T6855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.687369][ T6855] ? clear_bhb_loop+0x70/0xc0 [ 266.687396][ T6855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.687423][ T6855] RIP: 0033:0x7f8c49a5e0d9 [ 266.687462][ T6855] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 266.687480][ T6855] RSP: 002b:00007f8c47cb6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 266.687503][ T6855] RAX: ffffffffffffffda RBX: 00007f8c49ce5fa0 RCX: 00007f8c49a5e0d9 [ 266.687519][ T6855] RDX: 000000000000fe33 RSI: 0000200000000000 RDI: 0000000000000003 [ 266.687533][ T6855] RBP: 00007f8c47cb6090 R08: 0000000000000000 R09: 0000000000000000 [ 266.687546][ T6855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 266.687559][ T6855] R13: 00007f8c49ce6038 R14: 00007f8c49ce5fa0 R15: 00007fff212c9828 [ 266.687597][ T6855] [ 266.811780][ T5690] usb 5-1: Using ep0 maxpacket: 8 [ 266.850356][ T5690] usb 5-1: New USB device found, idVendor=194f, idProduct=010c, bcdDevice= 0.40 [ 266.913931][ T5690] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 231, changing to 7 [ 267.040851][ T5690] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.040881][ T5690] usb 5-1: Product: ꊐ밖㞩휽が㰰ࠌ㗑쁜啅⒠切骛诫ሔ똎쭤᩺ﭿ㮲◉ꀜ썾땮癩น慰퐥⢧切⊮뗀廭໚ꫥ쉠婼䙜ϳꋶ䐦ꁴﮢ譯䇣狠㋥ﻫ贽螽㝪耠命⣍蟮䊘ꌞ詖ᰟ䑊ꓫ㭰䬨帱⪞╡祟㓴 [ 267.040909][ T5690] usb 5-1: Manufacturer: ꆮ๻⋜쭞痎硖뻐欉蒍뭷똃묜⍘剤꠶﵇‚括ㅍ芴黵퉡颴葇੉ሳ飴쥧鵸뉽䙴ᰖ蹼Ղ扆歈겮꧞攄䓖௅䖅맄飁诙䶁輫쯜烑꺌﹊⌹䷖ᡴಉ瞳䶗聕 [ 267.040936][ T5690] usb 5-1: SerialNumber: င [ 267.466163][ T1112] veth1_macvtap: left promiscuous mode [ 267.528230][ T1112] veth0_macvtap: left promiscuous mode [ 267.563287][ T1112] veth1_vlan: left promiscuous mode [ 267.599615][ T1112] veth0_vlan: left promiscuous mode [ 269.108340][ T6868] netlink: 12 bytes leftover after parsing attributes in process `syz.3.251'. [ 269.116170][ T6868] netlink: 104 bytes leftover after parsing attributes in process `syz.3.251'. [ 270.107750][ T6870] netlink: 4 bytes leftover after parsing attributes in process `syz.3.252'. [ 270.180290][ T5690] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 271.409903][ T5690] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 271.469982][ T5690] usb 5-1: USB disconnect, device number 5 [ 271.583369][ T6675] udevd[6675]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 272.226833][ T1112] team0 (unregistering): Port device team_slave_1 removed [ 272.283854][ T1112] team0 (unregistering): Port device team_slave_0 removed [ 274.220667][ T5245] 8021q: adding VLAN 0 to HW filter on device eth2 [ 275.437962][ T6911] netlink: 12 bytes leftover after parsing attributes in process `syz.0.260'. [ 275.451037][ T6911] netlink: 104 bytes leftover after parsing attributes in process `syz.0.260'. [ 277.803841][ T6928] netlink: 8 bytes leftover after parsing attributes in process `syz.0.261'. [ 280.274380][ T4899] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 280.333006][ T4899] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 280.335224][ T4899] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 280.367571][ T4899] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 280.387264][ T4899] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 280.883737][ T6943] netlink: 52 bytes leftover after parsing attributes in process `syz.4.263'. [ 281.349241][ T6631] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.349378][ T6631] bridge0: port 1(bridge_slave_0) entered disabled state [ 281.349556][ T6631] bridge_slave_0: entered allmulticast mode [ 281.373109][ T6631] bridge_slave_0: entered promiscuous mode [ 281.386960][ T6631] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.387262][ T6631] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.387686][ T6631] bridge_slave_1: entered allmulticast mode [ 281.470828][ T6631] bridge_slave_1: entered promiscuous mode [ 281.724149][ T6631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 281.728901][ T6631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 281.815861][ T6631] team0: Port device team_slave_0 added [ 281.819835][ T6631] team0: Port device team_slave_1 added [ 282.023586][ T6955] netlink: 104 bytes leftover after parsing attributes in process `syz.4.265'. [ 282.052252][ T6631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 282.052268][ T6631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 282.052293][ T6631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 282.542083][ T4899] Bluetooth: hci3: command tx timeout [ 283.469694][ T6960] netlink: 8 bytes leftover after parsing attributes in process `syz.0.266'. [ 284.548051][ T6631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 284.548708][ T6631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 284.549416][ T6631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 284.621881][ T4899] Bluetooth: hci3: command tx timeout [ 286.546172][ T5245] 8021q: adding VLAN 0 to HW filter on device eth3 [ 286.581954][ T5828] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 286.705779][ T4899] Bluetooth: hci3: command tx timeout [ 286.741807][ T5828] usb 1-1: Using ep0 maxpacket: 32 [ 286.742776][ T5828] usb 1-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 286.744414][ T5828] usb 1-1: config 2 has an invalid interface number: 88 but max is 0 [ 286.744438][ T5828] usb 1-1: config 2 has no interface number 0 [ 286.744508][ T5828] usb 1-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 286.744538][ T5828] usb 1-1: config 2 interface 88 has no altsetting 0 [ 286.747752][ T5828] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 286.747777][ T5828] usb 1-1: Product: syz [ 286.747793][ T5828] usb 1-1: Manufacturer: syz [ 286.747809][ T5828] usb 1-1: SerialNumber: syz [ 286.872886][ T6975] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 287.097161][ T6975] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 287.480852][ T1112] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 287.480892][ T1112] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 290.553635][ T4899] Bluetooth: hci3: command tx timeout [ 291.065283][ T6631] hsr_slave_0: entered promiscuous mode [ 291.066734][ T6631] hsr_slave_1: entered promiscuous mode [ 291.067681][ T6631] debugfs: 'hsr0' already exists in 'hsr' [ 291.067730][ T6631] Cannot create hsr debugfs directory [ 292.172259][ T5828] asix 1-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 292.172554][ T5828] asix 1-1:2.88: probe with driver asix failed with error -71 [ 292.706025][ T5828] usb 1-1: USB disconnect, device number 8 [ 293.866440][ T7004] netlink: 8 bytes leftover after parsing attributes in process `syz.4.277'. [ 294.317031][ T1112] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 294.317068][ T1112] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.340155][ T7021] netlink: 12 bytes leftover after parsing attributes in process `syz.4.279'. [ 295.688850][ T1112] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 295.688889][ T1112] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.362466][ T7035] netlink: 16 bytes leftover after parsing attributes in process `syz.0.282'. [ 298.777087][ T1112] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 298.777121][ T1112] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 299.618384][ T5245] 8021q: adding VLAN 0 to HW filter on device eth4 [ 299.901984][ T5802] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 300.234522][ T5802] usb 5-1: Using ep0 maxpacket: 32 [ 300.314481][ T5802] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 300.346135][ T5802] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 300.346163][ T5802] usb 5-1: config 2 has no interface number 0 [ 300.346211][ T5802] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 300.346239][ T5802] usb 5-1: config 2 interface 88 has no altsetting 0 [ 300.392219][ T5802] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 300.392247][ T5802] usb 5-1: Product: syz [ 300.392262][ T5802] usb 5-1: Manufacturer: syz [ 300.392277][ T5802] usb 5-1: SerialNumber: syz [ 300.458346][ T7052] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 300.909914][ T7051] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 302.289142][ T7069] netlink: 8 bytes leftover after parsing attributes in process `syz.0.287'. [ 303.451150][ T7081] netlink: 16 bytes leftover after parsing attributes in process `syz.3.288'. [ 303.912393][ T5591] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 304.020883][ T5591] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 304.054950][ T5591] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 304.057242][ T5591] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 304.059196][ T5591] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 304.307898][ T5802] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 304.308156][ T5802] asix 5-1:2.88: probe with driver asix failed with error -71 [ 304.387981][ T5802] usb 5-1: USB disconnect, device number 6 [ 304.688462][ T7090] random: crng reseeded on system resumption [ 304.743199][ T7085] FAULT_INJECTION: forcing a failure. [ 304.743199][ T7085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 304.743230][ T7085] CPU: 0 UID: 0 PID: 7085 Comm: syz.4.289 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 304.743251][ T7085] Tainted: [L]=SOFTLOCKUP [ 304.743257][ T7085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 304.743266][ T7085] Call Trace: [ 304.743272][ T7085] [ 304.743278][ T7085] dump_stack_lvl+0xe8/0x150 [ 304.743308][ T7085] should_fail_ex+0x46b/0x600 [ 304.743340][ T7085] _copy_from_user+0x2d/0xb0 [ 304.743358][ T7085] kstrtouint_from_user+0xd6/0x180 [ 304.743383][ T7085] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 304.743404][ T7085] ? __lock_acquire+0x683/0x2ce0 [ 304.743434][ T7085] proc_fail_nth_write+0x8e/0x210 [ 304.743455][ T7085] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 304.743482][ T7085] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 304.743502][ T7085] vfs_write+0x29f/0xbb0 [ 304.743529][ T7085] ? __pfx_vfs_write+0x10/0x10 [ 304.743550][ T7085] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 304.743570][ T7085] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 304.743587][ T7085] ? mutex_lock_nested+0x152/0x1d0 [ 304.743608][ T7085] ? fdget_pos+0x252/0x320 [ 304.743632][ T7085] ksys_write+0x156/0x270 [ 304.743653][ T7085] ? __pfx_ksys_write+0x10/0x10 [ 304.743694][ T7085] do_syscall_64+0x166/0x520 [ 304.743709][ T7085] ? trace_irq_disable+0x3b/0x140 [ 304.743725][ T7085] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.743741][ T7085] ? clear_bhb_loop+0x70/0xc0 [ 304.743760][ T7085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.743775][ T7085] RIP: 0033:0x7f1b9ac0e90e [ 304.743789][ T7085] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 304.743801][ T7085] RSP: 002b:00007f1b98ea5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 304.743825][ T7085] RAX: ffffffffffffffda RBX: 00007f1b98ea66c0 RCX: 00007f1b9ac0e90e [ 304.743836][ T7085] RDX: 0000000000000001 RSI: 00007f1b98ea60a0 RDI: 0000000000000007 [ 304.743846][ T7085] RBP: 00007f1b98ea6090 R08: 0000000000000000 R09: 0000000000000000 [ 304.743855][ T7085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 304.743864][ T7085] R13: 00007f1b9aed6038 R14: 00007f1b9aed5fa0 R15: 00007ffd424bc208 [ 304.743888][ T7085] [ 305.028562][ T7092] capability: warning: `syz.3.290' uses 32-bit capabilities (legacy support in use) [ 305.427103][ T6631] netdevsim netdevsim6: probe with driver netdevsim failed with error -12 [ 306.344513][ T7105] syz.3.291 uses obsolete (PF_INET,SOCK_PACKET) [ 306.963809][ T4899] Bluetooth: hci5: command tx timeout [ 308.163381][ T1112] bridge_slave_1: left allmulticast mode [ 308.163416][ T1112] bridge_slave_1: left promiscuous mode [ 308.163762][ T1112] bridge0: port 2(bridge_slave_1) entered disabled state [ 308.353705][ T1112] bridge_slave_0: left allmulticast mode [ 308.353740][ T1112] bridge_slave_0: left promiscuous mode [ 308.376301][ T1112] bridge0: port 1(bridge_slave_0) entered disabled state [ 308.392114][ T5828] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 308.571962][ T5828] usb 4-1: unable to get BOS descriptor or descriptor too short [ 308.572871][ T5828] usb 4-1: not running at top speed; connect to a high speed hub [ 308.572898][ T5828] usb 4-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice= 0.40 [ 308.609439][ T5828] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 308.609475][ T5828] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 58, changing to 4 [ 308.646258][ T5828] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.646286][ T5828] usb 4-1: Product: syz [ 308.646301][ T5828] usb 4-1: Manufacturer: syz [ 308.646316][ T5828] usb 4-1: SerialNumber: syz [ 309.022309][ T4899] Bluetooth: hci5: command tx timeout [ 311.101751][ T4899] Bluetooth: hci5: command tx timeout [ 311.459717][ T5802] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 311.612647][ T5802] usb 5-1: Using ep0 maxpacket: 32 [ 311.614099][ T5802] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 311.615926][ T5802] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 311.615943][ T5802] usb 5-1: config 2 has no interface number 0 [ 311.615999][ T5802] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 311.616027][ T5802] usb 5-1: config 2 interface 88 has no altsetting 0 [ 311.733139][ T5802] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 311.733201][ T5802] usb 5-1: Product: syz [ 311.733218][ T5802] usb 5-1: Manufacturer: syz [ 311.733235][ T5802] usb 5-1: SerialNumber: syz [ 311.851181][ T7143] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 312.208606][ T7142] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 315.144498][ T4899] Bluetooth: hci5: command tx timeout [ 315.194515][ T5828] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 317.120283][ T7160] netlink: 8 bytes leftover after parsing attributes in process `syz.0.300'. [ 317.680352][ T5802] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -110 [ 317.681199][ T5802] asix 5-1:2.88: probe with driver asix failed with error -110 [ 317.715891][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.729729][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.540738][ T5802] usb 5-1: USB disconnect, device number 7 [ 319.113417][ T1112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 319.197008][ T1112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 319.263715][ T1112] bond0 (unregistering): Released all slaves [ 319.859640][ T5245] 8021q: adding VLAN 0 to HW filter on device eth5 [ 320.200805][ T5718] usb 4-1: USB disconnect, device number 4 [ 320.635830][ T5813] IPVS: starting estimator thread 0... [ 320.809309][ T7176] IPVS: using max 10 ests per chain, 24000 per kthread [ 320.909267][ T6932] bridge0: port 1(bridge_slave_0) entered blocking state [ 320.909568][ T6932] bridge0: port 1(bridge_slave_0) entered disabled state [ 320.909809][ T6932] bridge_slave_0: entered allmulticast mode [ 320.948043][ T6932] bridge_slave_0: entered promiscuous mode [ 321.031795][ T6932] bridge0: port 2(bridge_slave_1) entered blocking state [ 321.031941][ T6932] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.032094][ T6932] bridge_slave_1: entered allmulticast mode [ 321.101055][ T6932] bridge_slave_1: entered promiscuous mode [ 321.352513][ T6932] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 321.438194][ T6932] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 321.579517][ T6932] team0: Port device team_slave_0 added [ 321.609732][ T6932] team0: Port device team_slave_1 added [ 322.768635][ T7197] netlink: 12 bytes leftover after parsing attributes in process `syz.4.301'. [ 323.510853][ T7200] FAULT_INJECTION: forcing a failure. [ 323.510853][ T7200] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 323.510951][ T7200] CPU: 0 UID: 0 PID: 7200 Comm: syz.0.308 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 323.510981][ T7200] Tainted: [L]=SOFTLOCKUP [ 323.510992][ T7200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 323.511004][ T7200] Call Trace: [ 323.511010][ T7200] [ 323.511016][ T7200] dump_stack_lvl+0xe8/0x150 [ 323.511044][ T7200] should_fail_ex+0x46b/0x600 [ 323.511070][ T7200] _copy_from_user+0x2d/0xb0 [ 323.511086][ T7200] memdup_user+0x5e/0xd0 [ 323.511140][ T7200] strndup_user+0x68/0xd0 [ 323.511161][ T7200] __se_sys_mount+0xdf/0x420 [ 323.511181][ T7200] ? __pfx___se_sys_mount+0x10/0x10 [ 323.511202][ T7200] ? __x64_sys_mount+0x20/0xc0 [ 323.511222][ T7200] do_syscall_64+0x166/0x520 [ 323.511239][ T7200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.511255][ T7200] ? clear_bhb_loop+0x70/0xc0 [ 323.511278][ T7200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.511293][ T7200] RIP: 0033:0x7f8c49a5e0d9 [ 323.511307][ T7200] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 323.511320][ T7200] RSP: 002b:00007f8c47c95028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 323.511337][ T7200] RAX: ffffffffffffffda RBX: 00007f8c49ce6090 RCX: 00007f8c49a5e0d9 [ 323.511348][ T7200] RDX: 0000200000000240 RSI: 0000200000000100 RDI: 0000200000000280 [ 323.511359][ T7200] RBP: 00007f8c47c95090 R08: 0000000000000000 R09: 0000000000000000 [ 323.511368][ T7200] R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000001 [ 323.511377][ T7200] R13: 00007f8c49ce6128 R14: 00007f8c49ce6090 R15: 00007fff212c9828 [ 323.511400][ T7200] [ 324.107679][ T6932] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 324.107691][ T6932] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 324.107710][ T6932] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 324.971853][ T5828] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 325.054329][ T6932] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 325.054358][ T6932] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 325.054378][ T6932] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 325.181763][ T5691] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 325.356917][ T5691] usb 5-1: Using ep0 maxpacket: 32 [ 325.372762][ T5691] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 325.399395][ T5691] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 325.399425][ T5691] usb 5-1: config 2 has no interface number 0 [ 325.399474][ T5691] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 325.399502][ T5691] usb 5-1: config 2 interface 88 has no altsetting 0 [ 325.469891][ T5691] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 325.469921][ T5691] usb 5-1: Product: syz [ 325.469937][ T5691] usb 5-1: Manufacturer: syz [ 325.469952][ T5691] usb 5-1: SerialNumber: syz [ 325.522504][ T7203] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 325.896957][ T7202] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 326.163466][ T1112] hsr_slave_0: left promiscuous mode [ 326.206802][ T1112] hsr_slave_1: left promiscuous mode [ 326.209319][ T1112] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 326.209346][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 326.266764][ T1112] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 326.266793][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 330.984419][ T1112] veth1_macvtap: left promiscuous mode [ 330.988791][ T1112] veth0_macvtap: left promiscuous mode [ 330.990680][ T1112] veth1_vlan: left promiscuous mode [ 331.046981][ T1112] veth0_vlan: left promiscuous mode [ 331.159113][ T5691] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 331.159348][ T5691] asix 5-1:2.88: probe with driver asix failed with error -71 [ 331.205971][ T5691] usb 5-1: USB disconnect, device number 8 [ 331.491928][ T7227] netlink: 32 bytes leftover after parsing attributes in process `syz.3.313'. [ 334.068952][ T1112] team0 (unregistering): Port device team_slave_1 removed [ 334.183593][ T1112] team0 (unregistering): Port device team_slave_0 removed [ 335.307380][ T5245] 8021q: adding VLAN 0 to HW filter on device eth6 [ 335.490903][ T7246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.316'. [ 335.627078][ T6932] hsr_slave_0: entered promiscuous mode [ 335.640955][ T6932] hsr_slave_1: entered promiscuous mode [ 335.991832][ T5691] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 336.182696][ T5691] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 336.238020][ T5691] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.238050][ T5691] usb 4-1: Product: syz [ 336.238066][ T5691] usb 4-1: Manufacturer: syz [ 336.238082][ T5691] usb 4-1: SerialNumber: syz [ 337.155915][ T7278] 9p: Bad value for 'wfdno' [ 338.482455][ T5591] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 338.528883][ T5591] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 338.541001][ T5591] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 338.567939][ T5596] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 338.570130][ T5596] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 339.154027][ T5691] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 339.154108][ T5691] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 339.157718][ T5691] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 339.256285][ T5691] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 339.931372][ T5691] usb 4-1: USB disconnect, device number 6 [ 340.704121][ T7312] netlink: 48 bytes leftover after parsing attributes in process `syz.3.324'. [ 340.744740][ T5828] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 341.282431][ T5596] Bluetooth: hci2: command tx timeout [ 341.552683][ T5828] usb 5-1: Using ep0 maxpacket: 32 [ 341.553986][ T5828] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 341.562352][ T5828] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 341.562372][ T5828] usb 5-1: config 2 has no interface number 0 [ 341.562407][ T5828] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 341.562427][ T5828] usb 5-1: config 2 interface 88 has no altsetting 0 [ 341.607470][ T5828] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 341.607502][ T5828] usb 5-1: Product: syz [ 341.607519][ T5828] usb 5-1: Manufacturer: syz [ 341.607586][ T5828] usb 5-1: SerialNumber: syz [ 341.882072][ T7296] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 342.274144][ T5828] asix 5-1:2.88: probe with driver asix failed with error -71 [ 342.418543][ T5828] usb 5-1: USB disconnect, device number 9 [ 342.641330][ T7080] bridge0: port 1(bridge_slave_0) entered blocking state [ 342.641452][ T7080] bridge0: port 1(bridge_slave_0) entered disabled state [ 342.642198][ T7080] bridge_slave_0: entered allmulticast mode [ 342.694984][ T7080] bridge_slave_0: entered promiscuous mode [ 342.768097][ T7080] bridge0: port 2(bridge_slave_1) entered blocking state [ 342.768325][ T7080] bridge0: port 2(bridge_slave_1) entered disabled state [ 342.768518][ T7080] bridge_slave_1: entered allmulticast mode [ 342.788110][ T7080] bridge_slave_1: entered promiscuous mode [ 343.297563][ T7080] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 343.327320][ T7080] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 343.341939][ T5596] Bluetooth: hci2: command tx timeout [ 343.668209][ T5245] 8021q: adding VLAN 0 to HW filter on device eth7 [ 343.698408][ T7080] team0: Port device team_slave_0 added [ 345.439205][ T5596] Bluetooth: hci2: command tx timeout [ 346.980499][ T7080] team0: Port device team_slave_1 added [ 347.575066][ T5596] Bluetooth: hci2: command tx timeout [ 347.833182][ T7080] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 347.833200][ T7080] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.833229][ T7080] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 347.889433][ T7080] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 347.889450][ T7080] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.889480][ T7080] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 352.692287][ T7366] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 354.256285][ T5596] Bluetooth: to_multiplier 0 < 10 [ 355.471060][ T7381] netlink: 'syz.3.338': attribute type 1 has an invalid length. [ 355.539975][ T7381] syz.3.338 (7381) used greatest stack depth: 18336 bytes left [ 355.581749][ T5566] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 355.741716][ T5566] usb 1-1: Using ep0 maxpacket: 32 [ 355.743292][ T5566] usb 1-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 355.745066][ T5566] usb 1-1: config 2 has an invalid interface number: 88 but max is 0 [ 355.745091][ T5566] usb 1-1: config 2 has no interface number 0 [ 355.745137][ T5566] usb 1-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 355.745164][ T5566] usb 1-1: config 2 interface 88 has no altsetting 0 [ 355.809323][ T5566] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 355.809350][ T5566] usb 1-1: Product: syz [ 355.809365][ T5566] usb 1-1: Manufacturer: syz [ 355.809381][ T5566] usb 1-1: SerialNumber: syz [ 355.860862][ T7377] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 356.301758][ T5596] Bluetooth: hci4: command 0x0406 tx timeout [ 356.409375][ T7373] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 356.695535][ T7080] hsr_slave_0: entered promiscuous mode [ 356.712201][ T7080] hsr_slave_1: entered promiscuous mode [ 356.713966][ T7080] debugfs: 'hsr0' already exists in 'hsr' [ 356.713993][ T7080] Cannot create hsr debugfs directory [ 357.345431][ T5566] asix 1-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 357.383341][ T5566] asix 1-1:2.88: probe with driver asix failed with error -71 [ 357.409594][ T5566] usb 1-1: USB disconnect, device number 9 [ 358.397691][ T7415] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.344'. [ 358.964735][ T7423] netlink: 48 bytes leftover after parsing attributes in process `syz.3.345'. [ 360.915423][ T7428] veth3: entered promiscuous mode [ 362.298860][ T4899] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 362.313652][ T4899] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 362.320515][ T4899] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 362.350340][ T4899] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 362.351177][ T4899] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 363.005163][ T37] kauditd_printk_skb: 103 callbacks suppressed [ 363.005181][ T37] audit: type=1326 audit(1787319454.060:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7445 comm="syz.3.348" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fab5263e0d9 code=0x0 [ 363.319629][ T5245] 8021q: adding VLAN 0 to HW filter on device eth8 [ 363.471955][ T5691] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 363.651676][ T5691] usb 4-1: Using ep0 maxpacket: 8 [ 363.652661][ T5691] usb 4-1: New USB device found, idVendor=1235, idProduct=8201, bcdDevice= 0.40 [ 363.654544][ T5691] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 363.661478][ T5691] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.661509][ T5691] usb 4-1: Product: syz [ 363.661524][ T5691] usb 4-1: Manufacturer: syz [ 363.661538][ T5691] usb 4-1: SerialNumber: syz [ 364.551098][ T5596] Bluetooth: hci3: command tx timeout [ 364.651853][ T5566] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 364.801750][ T5566] usb 5-1: Using ep0 maxpacket: 32 [ 364.803544][ T5566] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 364.805907][ T5566] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 364.805932][ T5566] usb 5-1: config 2 has no interface number 0 [ 364.806044][ T5566] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 364.806072][ T5566] usb 5-1: config 2 interface 88 has no altsetting 0 [ 364.874706][ T5566] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 364.874726][ T5566] usb 5-1: Product: syz [ 364.874736][ T5566] usb 5-1: Manufacturer: syz [ 364.874747][ T5566] usb 5-1: SerialNumber: syz [ 365.001506][ T7468] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 365.374292][ T7466] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 366.231142][ T5566] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 366.231430][ T5566] asix 5-1:2.88: probe with driver asix failed with error -71 [ 366.261545][ T5691] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 366.301354][ T5691] usb 4-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 366.301382][ T5691] usb 4-1: 2:1 : invalid channels 0 [ 366.315480][ T5691] usb 4-1: unit 6 not found! [ 366.376567][ T5566] usb 5-1: USB disconnect, device number 10 [ 366.630633][ T5596] Bluetooth: hci3: command tx timeout [ 367.512114][ T68] IPVS: starting estimator thread 0... [ 367.626009][ T7497] IPVS: using max 7 ests per chain, 16800 per kthread [ 367.664253][ T7277] bridge0: port 1(bridge_slave_0) entered blocking state [ 367.664398][ T7277] bridge0: port 1(bridge_slave_0) entered disabled state [ 367.665074][ T7277] bridge_slave_0: entered allmulticast mode [ 367.668123][ T7277] bridge_slave_0: entered promiscuous mode [ 367.737812][ T7277] bridge0: port 2(bridge_slave_1) entered blocking state [ 367.737934][ T7277] bridge0: port 2(bridge_slave_1) entered disabled state [ 367.738110][ T7277] bridge_slave_1: entered allmulticast mode [ 367.780316][ T7277] bridge_slave_1: entered promiscuous mode [ 368.118739][ T1112] bridge_slave_1: left allmulticast mode [ 368.118767][ T1112] bridge_slave_1: left promiscuous mode [ 368.119006][ T1112] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.176368][ T5691] usb 4-1: USB disconnect, device number 7 [ 368.701674][ T5596] Bluetooth: hci3: command tx timeout [ 368.756089][ T7456] udevd[7456]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 369.135972][ T1112] bridge_slave_0: left allmulticast mode [ 369.136008][ T1112] bridge_slave_0: left promiscuous mode [ 369.136299][ T1112] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.466019][ T1112] bridge_slave_1: left allmulticast mode [ 369.466057][ T1112] bridge_slave_1: left promiscuous mode [ 369.466313][ T1112] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.658603][ T1112] bridge_slave_0: left allmulticast mode [ 369.658639][ T1112] bridge_slave_0: left promiscuous mode [ 369.658902][ T1112] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.958139][ T1112] bridge_slave_1: left allmulticast mode [ 369.958176][ T1112] bridge_slave_1: left promiscuous mode [ 369.958441][ T1112] bridge0: port 2(bridge_slave_1) entered disabled state [ 371.039537][ T5596] Bluetooth: hci3: command tx timeout [ 371.080104][ T1112] bridge_slave_0: left allmulticast mode [ 371.080141][ T1112] bridge_slave_0: left promiscuous mode [ 371.080394][ T1112] bridge0: port 1(bridge_slave_0) entered disabled state [ 371.822695][ T10] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 371.992977][ T10] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 371.994716][ T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 371.994747][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 371.994774][ T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 371.997836][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.997861][ T10] usb 1-1: Product: syz [ 371.997877][ T10] usb 1-1: Manufacturer: syz [ 371.997892][ T10] usb 1-1: SerialNumber: syz [ 372.080204][ T10] usb 1-1: config 0 descriptor?? [ 372.094171][ T7549] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 372.094396][ T7549] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 372.123925][ T10] usb 1-1: ucan: probing device on interface #0 [ 372.708698][ T10] usb 1-1: ucan: device reported invalid device info [ 372.708723][ T10] usb 1-1: ucan: probe failed; try to update the device firmware [ 372.892504][ T1112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 373.001920][ T5717] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 373.003068][ T1112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 373.114746][ T1112] bond0 (unregistering): Released all slaves [ 373.153423][ T5717] usb 5-1: Using ep0 maxpacket: 32 [ 373.154368][ T5717] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 373.159730][ T5717] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 373.159756][ T5717] usb 5-1: config 2 has no interface number 0 [ 373.159802][ T5717] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 373.159829][ T5717] usb 5-1: config 2 interface 88 has no altsetting 0 [ 373.169610][ T5717] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 373.169677][ T5717] usb 5-1: Product: syz [ 373.169721][ T5717] usb 5-1: Manufacturer: syz [ 373.170009][ T5717] usb 5-1: SerialNumber: syz [ 373.221439][ T7551] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 373.447636][ T7551] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 373.938060][ T1112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 374.034450][ T1112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 374.112916][ T5717] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 374.113173][ T5717] asix 5-1:2.88: probe with driver asix failed with error -71 [ 374.163789][ T1112] bond0 (unregistering): Released all slaves [ 374.191422][ T5717] usb 5-1: USB disconnect, device number 11 [ 374.773525][ T1112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 374.892549][ T1112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 374.983323][ T1112] bond0 (unregistering): Released all slaves [ 375.273307][ T5566] usb 1-1: USB disconnect, device number 10 [ 375.860939][ T7277] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 375.921085][ T7277] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 376.257605][ T7277] team0: Port device team_slave_0 added [ 376.317425][ T7277] team0: Port device team_slave_1 added [ 376.389027][ T1112] hsr_slave_0: left promiscuous mode [ 376.421958][ T1112] hsr_slave_1: left promiscuous mode [ 376.424052][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 376.482885][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 376.692846][ T1112] hsr_slave_0: left promiscuous mode [ 376.733000][ T1112] hsr_slave_1: left promiscuous mode [ 376.734351][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 376.775825][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 376.907217][ T7588] netlink: 'syz.0.367': attribute type 2 has an invalid length. [ 376.937069][ T7590] GUP no longer grows the stack in syz.0.367 (7590): 200000001000-200000c01000 (200000000000) [ 376.938781][ T7590] CPU: 1 UID: 0 PID: 7590 Comm: syz.0.367 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 376.938813][ T7590] Tainted: [L]=SOFTLOCKUP [ 376.938821][ T7590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 376.938848][ T7590] Call Trace: [ 376.938924][ T7590] [ 376.938970][ T7590] dump_stack_lvl+0xe8/0x150 [ 376.939181][ T7590] __get_user_pages+0x21e9/0x2590 [ 376.939242][ T7590] ? __pfx___rwbase_read_lock+0x10/0x10 [ 376.939382][ T7590] ? down_read_killable+0x16f/0x220 [ 376.939426][ T7590] __gup_longterm_locked+0xd52/0x15c0 [ 376.939469][ T7590] ? gup_fast_fallback+0x20d/0x2040 [ 376.939514][ T7590] gup_fast_fallback+0x1cfd/0x2040 [ 376.939581][ T7590] ? __pfx_gup_fast_fallback+0x10/0x10 [ 376.939615][ T7590] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 376.939647][ T7590] ? is_valid_gup_args+0x11f/0x200 [ 376.939683][ T7590] ? get_user_pages_fast+0x4d/0xb0 [ 376.939720][ T7590] get_futex_key+0x90f/0x1580 [ 376.939781][ T7590] ? __pfx_get_futex_key+0x10/0x10 [ 376.939805][ T7590] ? futex_unqueue+0x22/0x240 [ 376.939834][ T7590] ? __futex_wait+0x1e3/0x410 [ 376.939862][ T7590] futex_requeue+0x23a/0x1b10 [ 376.939903][ T7590] ? __pfx_futex_wake_mark+0x10/0x10 [ 376.939945][ T7590] ? try_to_wake_up+0x843/0x1430 [ 376.939993][ T7590] ? __pfx_futex_requeue+0x10/0x10 [ 376.940037][ T7590] ? futex_wait+0x2a2/0x390 [ 376.940060][ T7590] ? __pfx_futex_wait+0x10/0x10 [ 376.940089][ T7590] ? __se_sys_mremap+0x106e/0x11d0 [ 376.940127][ T7590] do_futex+0x41b/0x4e0 [ 376.940171][ T7590] ? __pfx_do_futex+0x10/0x10 [ 376.940211][ T7590] __se_sys_futex+0x3a8/0x450 [ 376.940248][ T7590] ? __pfx___se_sys_futex+0x10/0x10 [ 376.940278][ T7590] ? rcu_is_watching+0x16/0xb0 [ 376.940319][ T7590] ? __x64_sys_futex+0x21/0xf0 [ 376.940352][ T7590] do_syscall_64+0x166/0x520 [ 376.940415][ T7590] ? trace_irq_disable+0x3b/0x140 [ 376.940441][ T7590] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.940476][ T7590] ? clear_bhb_loop+0x70/0xc0 [ 376.940502][ T7590] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.940524][ T7590] RIP: 0033:0x7f8c49a5e0d9 [ 376.940565][ T7590] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.940584][ T7590] RSP: 002b:00007f8c47c74028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 376.940631][ T7590] RAX: ffffffffffffffda RBX: 00007f8c49ce6180 RCX: 00007f8c49a5e0d9 [ 376.940646][ T7590] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000200000000000 [ 376.940659][ T7590] RBP: 00007f8c49af5024 R08: 0000000000000000 R09: 0000000000000000 [ 376.940672][ T7590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 376.940685][ T7590] R13: 00007f8c49ce6218 R14: 00007f8c49ce6180 R15: 00007fff212c9828 [ 376.940718][ T7590] [ 377.028717][ T1112] hsr_slave_0: left promiscuous mode [ 377.065678][ T1112] hsr_slave_1: left promiscuous mode [ 377.077601][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 377.144278][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 377.932190][ T7601] netlink: 12 bytes leftover after parsing attributes in process `syz.3.369'. [ 378.827943][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.828014][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.882663][ T1112] team0 (unregistering): Port device team_slave_1 removed [ 378.952481][ T1112] team0 (unregistering): Port device team_slave_0 removed [ 379.512505][ T1112] team0 (unregistering): Port device team_slave_1 removed [ 379.590923][ T1112] team0 (unregistering): Port device team_slave_0 removed [ 380.232382][ T1112] team0 (unregistering): Port device team_slave_1 removed [ 380.304386][ T1112] team0 (unregistering): Port device team_slave_0 removed [ 381.144574][ T7277] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 381.144593][ T7277] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 381.144623][ T7277] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 381.444753][ T7613] syz.3.371 (7613): drop_caches: 2 [ 382.016338][ T7277] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 382.016356][ T7277] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 382.016385][ T7277] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 383.884696][ T7277] hsr_slave_0: entered promiscuous mode [ 383.886163][ T7277] hsr_slave_1: entered promiscuous mode [ 386.581765][ T5802] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 386.582059][ C0] raw-gadget.0 gadget.0: ignoring, device is not running [ 387.080624][ T7663] syz.3.380 (7663): drop_caches: 2 [ 387.460954][ T7438] bridge0: port 1(bridge_slave_0) entered blocking state [ 387.461181][ T7438] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.461397][ T7438] bridge_slave_0: entered allmulticast mode [ 387.504341][ T7438] bridge_slave_0: entered promiscuous mode [ 387.526494][ T5802] usb 1-1: device descriptor read/64, error -32 [ 387.689121][ T7438] bridge0: port 2(bridge_slave_1) entered blocking state [ 387.689270][ T7438] bridge0: port 2(bridge_slave_1) entered disabled state [ 387.689455][ T7438] bridge_slave_1: entered allmulticast mode [ 387.723046][ T7438] bridge_slave_1: entered promiscuous mode [ 387.783981][ T5802] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 387.896273][ T7438] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 387.940349][ T7438] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 387.962622][ T5802] usb 1-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 387.982352][ T5802] usb 1-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 387.982392][ T5802] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 387.990889][ T5802] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.990918][ T5802] usb 1-1: Product: syz [ 387.990935][ T5802] usb 1-1: Manufacturer: syz [ 387.990951][ T5802] usb 1-1: SerialNumber: syz [ 388.087157][ T5802] usb 1-1: config 0 descriptor?? [ 388.100176][ T7438] team0: Port device team_slave_0 added [ 388.110784][ T7438] team0: Port device team_slave_1 added [ 388.190664][ T5802] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 388.315640][ T7438] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 388.315656][ T7438] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 388.315682][ T7438] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 388.369619][ T7438] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 388.369637][ T7438] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 388.369669][ T7438] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 389.031639][ T5802] usb 1-1: USB disconnect, device number 12 [ 389.791695][ T7689] syz.4.382 (7689): drop_caches: 2 [ 389.863375][ T5245] 8021q: adding VLAN 0 to HW filter on device eth9 [ 390.068166][ T7438] hsr_slave_0: entered promiscuous mode [ 390.084289][ T7438] hsr_slave_1: entered promiscuous mode [ 390.085112][ T7438] debugfs: 'hsr0' already exists in 'hsr' [ 390.085133][ T7438] Cannot create hsr debugfs directory [ 391.301778][ T5717] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 391.451673][ T5717] usb 4-1: Using ep0 maxpacket: 8 [ 391.475256][ T5717] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 391.499746][ T5717] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.499789][ T5717] usb 4-1: Product: syz [ 391.499804][ T5717] usb 4-1: Manufacturer: syz [ 391.499818][ T5717] usb 4-1: SerialNumber: syz [ 391.533133][ T7721] FAULT_INJECTION: forcing a failure. [ 391.533133][ T7721] name failslab, interval 1, probability 0, space 0, times 0 [ 391.533170][ T7721] CPU: 1 UID: 0 PID: 7721 Comm: syz.0.390 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 391.533201][ T7721] Tainted: [L]=SOFTLOCKUP [ 391.533209][ T7721] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 391.533222][ T7721] Call Trace: [ 391.533231][ T7721] [ 391.533240][ T7721] dump_stack_lvl+0xe8/0x150 [ 391.533280][ T7721] should_fail_ex+0x46b/0x600 [ 391.533381][ T7721] should_failslab+0xa8/0x100 [ 391.533415][ T7721] kmem_cache_alloc_node_noprof+0xae/0x670 [ 391.533454][ T7721] ? __alloc_skb+0x1db/0x7a0 [ 391.533577][ T7721] ? __alloc_skb+0x1db/0x7a0 [ 391.533613][ T7721] __alloc_skb+0x1db/0x7a0 [ 391.533647][ T7721] netlink_ack+0x136/0xb30 [ 391.533765][ T7721] ? __pfx_genl_rcv_msg+0x10/0x10 [ 391.533811][ T7721] ? __lock_acquire+0x683/0x2ce0 [ 391.533856][ T7721] netlink_rcv_skb+0x2a4/0x4a0 [ 391.533889][ T7721] ? __pfx_genl_rcv_msg+0x10/0x10 [ 391.533915][ T7721] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 391.533960][ T7721] ? netlink_deliver_tap+0x2e/0x1b0 [ 391.534000][ T7721] ? netlink_deliver_tap+0x2e/0x1b0 [ 391.534036][ T7721] genl_rcv+0x28/0x40 [ 391.534077][ T7721] netlink_unicast+0x7f5/0x990 [ 391.534120][ T7721] netlink_sendmsg+0x813/0xb40 [ 391.534159][ T7721] ? __pfx_netlink_sendmsg+0x10/0x10 [ 391.534192][ T7721] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 391.534238][ T7721] ? __kernel_text_address+0xd/0x30 [ 391.534273][ T7721] ? unwind_get_return_address+0x4d/0x90 [ 391.534311][ T7721] ? __pfx_netlink_sendmsg+0x10/0x10 [ 391.534343][ T7721] sock_sendmsg_nosec+0x13a/0x180 [ 391.534439][ T7721] ____sys_sendmsg+0x565/0x870 [ 391.534495][ T7721] ? __might_fault+0xaf/0x130 [ 391.534519][ T7721] ? __pfx_____sys_sendmsg+0x10/0x10 [ 391.534556][ T7721] ? import_iovec+0x73/0xa0 [ 391.534580][ T7721] ___sys_sendmsg+0x2a5/0x360 [ 391.534609][ T7721] ? __lock_acquire+0x683/0x2ce0 [ 391.534639][ T7721] ? __pfx____sys_sendmsg+0x10/0x10 [ 391.534691][ T7721] ? __fget_files+0x2a/0x420 [ 391.534723][ T7721] ? __fget_files+0x3a8/0x420 [ 391.534750][ T7721] __x64_sys_sendmsg+0x1b7/0x290 [ 391.534780][ T7721] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 391.534824][ T7721] do_syscall_64+0x166/0x520 [ 391.534844][ T7721] ? trace_irq_disable+0x3b/0x140 [ 391.534864][ T7721] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.534884][ T7721] ? clear_bhb_loop+0x70/0xc0 [ 391.534908][ T7721] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.534925][ T7721] RIP: 0033:0x7f8c49a5e0d9 [ 391.534942][ T7721] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 391.534956][ T7721] RSP: 002b:00007f8c47c74028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 391.534975][ T7721] RAX: ffffffffffffffda RBX: 00007f8c49ce6180 RCX: 00007f8c49a5e0d9 [ 391.534998][ T7721] RDX: 000000000000c054 RSI: 0000200000000780 RDI: 0000000000000009 [ 391.535009][ T7721] RBP: 00007f8c47c74090 R08: 0000000000000000 R09: 0000000000000000 [ 391.535019][ T7721] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 391.535029][ T7721] R13: 00007f8c49ce6218 R14: 00007f8c49ce6180 R15: 00007fff212c9828 [ 391.535057][ T7721] [ 391.908843][ T5717] usb 4-1: config 0 descriptor?? [ 392.146282][ T5717] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 392.261769][ T5828] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 392.416971][ T5828] usb 5-1: Using ep0 maxpacket: 8 [ 392.419650][ T5828] usb 5-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 392.421349][ T5828] usb 5-1: config 2 has an invalid interface number: 31 but max is 0 [ 392.421372][ T5828] usb 5-1: config 2 has no interface number 0 [ 392.421416][ T5828] usb 5-1: config 2 interface 31 has no altsetting 0 [ 392.482073][ T5828] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.482104][ T5828] usb 5-1: Product: syz [ 392.482185][ T5828] usb 5-1: Manufacturer: syz [ 392.482202][ T5828] usb 5-1: SerialNumber: syz [ 394.247619][ T5828] ch9200 5-1:2.31: probe with driver ch9200 failed with error -22 [ 394.314757][ T1112] bridge_slave_1: left allmulticast mode [ 394.314793][ T1112] bridge_slave_1: left promiscuous mode [ 394.315049][ T1112] bridge0: port 2(bridge_slave_1) entered disabled state [ 394.412013][ T5828] usb 5-1: USB disconnect, device number 12 [ 394.567983][ T1112] bridge_slave_0: left allmulticast mode [ 394.568022][ T1112] bridge_slave_0: left promiscuous mode [ 394.568303][ T1112] bridge0: port 1(bridge_slave_0) entered disabled state [ 394.704759][ T5717] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 394.750093][ T5717] usb 4-1: USB disconnect, device number 8 [ 395.965215][ T7772] syz.3.398 (7772): drop_caches: 2 [ 396.775138][ T1112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 398.254780][ T1112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 398.693597][ T4899] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 398.752198][ T4899] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 398.753579][ T4899] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 398.755397][ T4899] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 398.757098][ T4899] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 398.757728][ T1112] bond0 (unregistering): Released all slaves [ 399.169779][ T7789] Bluetooth: MGMT ver 1.23 [ 399.697752][ T1112] hsr_slave_0: left promiscuous mode [ 400.018129][ T1112] hsr_slave_1: left promiscuous mode [ 400.019331][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 400.587622][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 400.791849][ T7819] FAULT_INJECTION: forcing a failure. [ 400.791849][ T7819] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 400.791892][ T7819] CPU: 0 UID: 0 PID: 7819 Comm: syz.3.409 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 400.791947][ T7819] Tainted: [L]=SOFTLOCKUP [ 400.791962][ T7819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 400.791982][ T7819] Call Trace: [ 400.791991][ T7819] [ 400.792001][ T7819] dump_stack_lvl+0xe8/0x150 [ 400.792038][ T7819] should_fail_ex+0x46b/0x600 [ 400.792079][ T7819] _copy_to_user+0x31/0xb0 [ 400.792103][ T7819] video_usercopy+0xdf4/0x1430 [ 400.792214][ T7819] ? __pfx___video_do_ioctl+0x10/0x10 [ 400.792244][ T7819] ? __pfx_video_usercopy+0x10/0x10 [ 400.792269][ T7819] ? smack_file_ioctl+0x2c4/0x370 [ 400.792321][ T7819] ? __fget_files+0x2a/0x420 [ 400.792343][ T7819] ? __fget_files+0x3a8/0x420 [ 400.792368][ T7819] v4l2_ioctl+0x190/0x1e0 [ 400.792393][ T7819] ? __pfx_v4l2_ioctl+0x10/0x10 [ 400.792416][ T7819] __se_sys_ioctl+0xff/0x170 [ 400.792447][ T7819] do_syscall_64+0x166/0x520 [ 400.792470][ T7819] ? trace_irq_disable+0x3b/0x140 [ 400.792498][ T7819] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 400.792520][ T7819] ? clear_bhb_loop+0x70/0xc0 [ 400.792546][ T7819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 400.792586][ T7819] RIP: 0033:0x7fab5263e0d9 [ 400.792607][ T7819] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 400.792627][ T7819] RSP: 002b:00007fab50896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 400.792651][ T7819] RAX: ffffffffffffffda RBX: 00007fab528c5fa0 RCX: 00007fab5263e0d9 [ 400.792667][ T7819] RDX: 0000200000000140 RSI: 00000000c0d05605 RDI: 0000000000000003 [ 400.792682][ T7819] RBP: 00007fab50896090 R08: 0000000000000000 R09: 0000000000000000 [ 400.792696][ T7819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 400.792709][ T7819] R13: 00007fab528c6038 R14: 00007fab528c5fa0 R15: 00007fff053259e8 [ 400.792744][ T7819] [ 401.021768][ T5596] Bluetooth: hci5: command tx timeout [ 402.167281][ T1112] team0 (unregistering): Port device team_slave_1 removed [ 402.243773][ T1112] team0 (unregistering): Port device team_slave_0 removed [ 402.461736][ T5802] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 402.651500][ T5802] usb 1-1: not running at top speed; connect to a high speed hub [ 402.651541][ T5802] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 402.670859][ T5802] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 402.670887][ T5802] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 402.670941][ T5802] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 402.742216][ T5802] uvcvideo 1-1:1.0: Found Unit with invalid ID 0 [ 402.940985][ T7851] netlink: 12 bytes leftover after parsing attributes in process `syz.0.414'. [ 403.101900][ T5596] Bluetooth: hci5: command tx timeout [ 403.806002][ T5802] usb 1-1: string descriptor 0 read error: -71 [ 403.806458][ T5802] uvcvideo 1-1:1.0: Found UVC 0.00 device (046d:0825) [ 403.806676][ T5802] uvcvideo 1-1:1.0: No streaming interface found for terminal 32770. [ 403.874627][ T5802] usb 1-1: USB disconnect, device number 13 [ 404.621842][ T5828] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 404.627084][ T7882] FAULT_INJECTION: forcing a failure. [ 404.627084][ T7882] name failslab, interval 1, probability 0, space 0, times 0 [ 404.627113][ T7882] CPU: 1 UID: 0 PID: 7882 Comm: syz.0.420 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 404.627136][ T7882] Tainted: [L]=SOFTLOCKUP [ 404.627141][ T7882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 404.627151][ T7882] Call Trace: [ 404.627157][ T7882] [ 404.627164][ T7882] dump_stack_lvl+0xe8/0x150 [ 404.627194][ T7882] should_fail_ex+0x46b/0x600 [ 404.627223][ T7882] should_failslab+0xa8/0x100 [ 404.627242][ T7882] __kmalloc_noprof+0xfe/0x780 [ 404.627262][ T7882] ? security_sk_alloc+0x52/0x360 [ 404.627280][ T7882] ? security_sk_alloc+0x52/0x360 [ 404.627304][ T7882] security_sk_alloc+0x52/0x360 [ 404.627325][ T7882] sk_prot_alloc+0x101/0x210 [ 404.627348][ T7882] ? sk_alloc+0x27/0x390 [ 404.627372][ T7882] sk_alloc+0x3a/0x390 [ 404.627396][ T7882] bpf_prog_test_run_skb+0x3a6/0x2230 [ 404.627436][ T7882] ? __fget_files+0x3a8/0x420 [ 404.627453][ T7882] ? __fget_files+0x2a/0x420 [ 404.627473][ T7882] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 404.627499][ T7882] bpf_prog_test_run+0x2cb/0x340 [ 404.627563][ T7882] __sys_bpf+0xa22/0xd90 [ 404.627588][ T7882] ? __pfx___sys_bpf+0x10/0x10 [ 404.627609][ T7882] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 404.627630][ T7882] ? rt_mutex_slowunlock+0x219/0x460 [ 404.627667][ T7882] ? ksys_write+0x248/0x270 [ 404.627694][ T7882] ? __pfx_ksys_write+0x10/0x10 [ 404.627717][ T7882] __x64_sys_bpf+0xba/0xd0 [ 404.627735][ T7882] do_syscall_64+0x166/0x520 [ 404.627752][ T7882] ? trace_irq_disable+0x3b/0x140 [ 404.627768][ T7882] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.627785][ T7882] ? clear_bhb_loop+0x70/0xc0 [ 404.627805][ T7882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.627821][ T7882] RIP: 0033:0x7f8c49a5e0d9 [ 404.627836][ T7882] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 404.627850][ T7882] RSP: 002b:00007f8c47cb6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 404.627867][ T7882] RAX: ffffffffffffffda RBX: 00007f8c49ce5fa0 RCX: 00007f8c49a5e0d9 [ 404.627879][ T7882] RDX: 0000000000000050 RSI: 0000200000000540 RDI: 000000000000000a [ 404.627889][ T7882] RBP: 00007f8c47cb6090 R08: 0000000000000000 R09: 0000000000000000 [ 404.627899][ T7882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 404.627908][ T7882] R13: 00007f8c49ce6038 R14: 00007f8c49ce5fa0 R15: 00007fff212c9828 [ 404.627932][ T7882] [ 405.005339][ T5828] usb 4-1: Using ep0 maxpacket: 32 [ 405.008740][ T5828] usb 4-1: unable to get BOS descriptor or descriptor too short [ 405.008800][ T5828] usb 4-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 405.040423][ T5828] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.040453][ T5828] usb 4-1: Product: syz [ 405.040469][ T5828] usb 4-1: Manufacturer: syz [ 405.040486][ T5828] usb 4-1: SerialNumber: syz [ 405.157543][ T5828] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 405.195907][ T5596] Bluetooth: hci5: command tx timeout [ 405.196154][ T5828] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 405.597670][ T7895] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 405.598275][ T7895] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 405.826838][ T7897] syz.4.423 (7897): drop_caches: 2 [ 406.725667][ T7904] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 407.261708][ T5596] Bluetooth: hci5: command tx timeout [ 407.484700][ T5802] usb 4-1: USB disconnect, device number 9 [ 407.598382][ T7438] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 407.792191][ T7438] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 407.862666][ T7438] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 407.951087][ T7438] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 408.011961][ T7438] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 408.150297][ T7438] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 408.466032][ T7438] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 409.213666][ T7438] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 410.685325][ T7950] syz.0.433 (7950): drop_caches: 2 [ 411.662571][ T7782] bridge0: port 1(bridge_slave_0) entered blocking state [ 411.662759][ T7782] bridge0: port 1(bridge_slave_0) entered disabled state [ 411.662948][ T7782] bridge_slave_0: entered allmulticast mode [ 411.672613][ T7782] bridge_slave_0: entered promiscuous mode [ 411.989759][ T7782] bridge0: port 2(bridge_slave_1) entered blocking state [ 411.991308][ T7782] bridge0: port 2(bridge_slave_1) entered disabled state [ 411.991525][ T7782] bridge_slave_1: entered allmulticast mode [ 412.108385][ T7963] syz.3.437 (7963): drop_caches: 2 [ 412.847227][ T7782] bridge_slave_1: entered promiscuous mode [ 413.396410][ T7782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 413.751730][ T5566] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 413.902846][ T5566] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 413.921126][ T5566] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 413.921201][ T5566] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.933235][ T7976] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 413.967264][ T5566] usb 5-1: config 0 descriptor?? [ 414.018015][ T7782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 414.107262][ T5566] pwc: Askey VC010 type 2 USB webcam detected. [ 414.553396][ T7782] team0: Port device team_slave_0 added [ 414.632657][ T7782] team0: Port device team_slave_1 added [ 414.723388][ T1112] bridge_slave_1: left allmulticast mode [ 414.723425][ T1112] bridge_slave_1: left promiscuous mode [ 414.723885][ T1112] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.899311][ T5566] pwc: recv_control_msg error -71 req 02 val 2700 [ 414.901355][ T5566] pwc: recv_control_msg error -71 req 02 val 2c00 [ 414.928700][ T5566] pwc: recv_control_msg error -71 req 04 val 1000 [ 414.939079][ T5566] pwc: recv_control_msg error -71 req 04 val 1300 [ 414.941540][ T5566] pwc: recv_control_msg error -71 req 04 val 1400 [ 414.953061][ T5566] pwc: recv_control_msg error -71 req 02 val 2000 [ 414.958496][ T5566] pwc: recv_control_msg error -71 req 02 val 2100 [ 414.959151][ T5566] pwc: recv_control_msg error -71 req 04 val 1500 [ 414.966849][ T5566] pwc: recv_control_msg error -71 req 02 val 2500 [ 414.968110][ T5566] pwc: recv_control_msg error -71 req 02 val 2400 [ 414.979780][ T5566] pwc: recv_control_msg error -71 req 02 val 2600 [ 414.991526][ T5566] pwc: recv_control_msg error -71 req 02 val 2900 [ 414.997965][ T5566] pwc: recv_control_msg error -71 req 02 val 2800 [ 415.017838][ T5566] pwc: recv_control_msg error -71 req 04 val 1100 [ 415.034877][ T5802] usb 1-1: new low-speed USB device number 14 using dummy_hcd [ 415.087381][ T5566] pwc: recv_control_msg error -71 req 04 val 1200 [ 415.136423][ T1112] bridge_slave_0: left allmulticast mode [ 415.136454][ T1112] bridge_slave_0: left promiscuous mode [ 415.136686][ T1112] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.210593][ T5566] pwc: Registered as video4. [ 415.244118][ T5566] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input36 [ 415.244741][ T5802] usb 1-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 415.324073][ T5802] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 415.324110][ T5802] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 415.730137][ T5566] usb 5-1: USB disconnect, device number 13 [ 416.567628][ T67] IPVS: starting estimator thread 0... [ 416.661886][ T8001] IPVS: using max 8 ests per chain, 19200 per kthread [ 417.270331][ T1112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 417.746989][ T1112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 417.779367][ T5802] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.841939][ T5802] usb 1-1: config 0 descriptor?? [ 417.868933][ T1112] bond0 (unregistering): Released all slaves [ 417.870534][ T5802] usb 1-1: can't set config #0, error -71 [ 417.914558][ T5802] usb 1-1: USB disconnect, device number 14 [ 418.106681][ T5566] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 418.281771][ T5566] usb 5-1: Using ep0 maxpacket: 16 [ 418.282618][ T5566] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 418.284181][ T5566] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 418.284216][ T5566] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 418.284262][ T5566] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.373501][ T5566] usb 5-1: config 0 descriptor?? [ 418.448924][ T7782] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 418.448943][ T7782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 418.448973][ T7782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 418.638212][ T7782] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 418.638230][ T7782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 418.638259][ T7782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 419.406206][ T8017] netlink: 48 bytes leftover after parsing attributes in process `syz.0.450'. [ 420.072146][ T7438] 8021q: adding VLAN 0 to HW filter on device bond0 [ 420.113323][ T5566] usbhid 5-1:0.0: can't add hid device: -71 [ 420.113772][ T5566] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 420.206297][ T5566] usb 5-1: USB disconnect, device number 14 [ 421.017474][ T8026] syz.0.451 (8026): drop_caches: 2 [ 421.884614][ T8032] syz.4.454 (8032): drop_caches: 2 [ 422.688518][ T1112] hsr_slave_0: left promiscuous mode [ 422.793577][ T1112] hsr_slave_1: left promiscuous mode [ 422.796013][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 422.847806][ T1112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 423.129325][ T4899] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 423.164350][ T4899] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 423.167441][ T4899] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 423.223430][ T4899] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 423.224733][ T4899] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 425.333170][ T1112] team0 (unregistering): Port device team_slave_1 removed [ 425.531156][ T8062] syz.4.463 (8062): drop_caches: 2 [ 426.183723][ T4899] Bluetooth: hci2: command tx timeout [ 426.202949][ T1112] team0 (unregistering): Port device team_slave_0 removed [ 426.688468][ T8072] syz.4.465 (8072): drop_caches: 2 [ 428.242549][ T4899] Bluetooth: hci2: command tx timeout [ 429.500220][ T7782] hsr_slave_0: entered promiscuous mode [ 429.513662][ T7782] hsr_slave_1: entered promiscuous mode [ 430.313364][ T4899] Bluetooth: hci2: command tx timeout [ 432.381962][ T4899] Bluetooth: hci2: command tx timeout [ 432.413108][ T8130] syz.3.474 (8130): drop_caches: 2 [ 433.014940][ T5245] 8021q: adding VLAN 0 to HW filter on device eth9 [ 433.558013][ T8148] pvfs2: Unknown parameter 'cpuset' [ 438.529352][ T8219] tmpfs: Unknown parameter 'grpquota_blosk_hardlimdt' [ 438.949078][ T8212] bridge0: port 2(bridge_slave_1) entered listening state [ 439.067649][ T8212] bridge0: port 2(bridge_slave_1) entered disabled state [ 440.311165][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.311240][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 444.812608][ T1227] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 444.965240][ T1227] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 444.967338][ T1227] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 444.967390][ T1227] usb 5-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 445.028040][ T1227] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.028070][ T1227] usb 5-1: Product: syz [ 445.028086][ T1227] usb 5-1: Manufacturer: syz [ 445.028104][ T1227] usb 5-1: SerialNumber: syz [ 445.096479][ T1227] cdc_ncm 5-1:1.0: skipping garbage [ 445.096512][ T1227] cdc_ncm 5-1:1.0: CDC Union missing and no IAD found [ 445.096562][ T1227] cdc_ncm 5-1:1.0: bind() failure [ 445.197116][ T1227] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 445.197164][ T1227] cdc_ncm 5-1:1.1: bind() failure [ 445.344288][ T8038] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.344421][ T8038] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.344629][ T8038] bridge_slave_0: entered allmulticast mode [ 445.350606][ T8038] bridge_slave_0: entered promiscuous mode [ 445.408108][ T1227] usb 5-1: USB disconnect, device number 15 [ 445.425572][ T8038] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.425676][ T8038] bridge0: port 2(bridge_slave_1) entered disabled state [ 445.425860][ T8038] bridge_slave_1: entered allmulticast mode [ 445.554045][ T8038] bridge_slave_1: entered promiscuous mode [ 445.974594][ T8038] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 446.006642][ T8038] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 446.117607][ T8038] team0: Port device team_slave_0 added [ 446.117690][ T7782] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 446.309106][ T8301] netlink: 12 bytes leftover after parsing attributes in process `syz.3.510'. [ 446.993026][ T7782] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 447.006627][ T8038] team0: Port device team_slave_1 added [ 448.319675][ T1124] bridge_slave_1: left allmulticast mode [ 448.319703][ T1124] bridge_slave_1: left promiscuous mode [ 448.319926][ T1124] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.485664][ T1124] bridge_slave_0: left allmulticast mode [ 448.485701][ T1124] bridge_slave_0: left promiscuous mode [ 448.486039][ T1124] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.691660][ T5566] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 449.269478][ T8335] netlink: 48 bytes leftover after parsing attributes in process `syz.0.516'. [ 449.871675][ T5566] usb 5-1: Using ep0 maxpacket: 32 [ 449.872484][ T5566] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 449.874080][ T5566] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 449.874106][ T5566] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 449.874128][ T5566] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 449.874150][ T5566] usb 5-1: config 1 has no interface number 0 [ 449.874195][ T5566] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 449.874313][ T5566] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 449.874366][ T5566] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.988009][ T5566] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 450.633512][ T5566] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now attached [ 450.972538][ T1124] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 451.072512][ T1124] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 451.134286][ T1124] bond0 (unregistering): Released all slaves [ 451.239651][ T7782] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 451.331888][ T7782] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 451.510743][ T7782] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 452.059685][ T8352] netlink: 48 bytes leftover after parsing attributes in process `syz.0.518'. [ 452.520217][ T5566] snd_usb_pod 5-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 452.635914][ T7782] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 452.876760][ T7782] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 452.912445][ T7782] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 452.913652][ T8038] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 452.913665][ T8038] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 452.913689][ T8038] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 452.982959][ T1227] usb 5-1: USB disconnect, device number 16 [ 453.051752][ T1227] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 453.332787][ T8038] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 453.332817][ T8038] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 453.332849][ T8038] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 454.370061][ T8375] device-mapper: ioctl: Unable to rename non-existent device, to [ 454.535195][ T1124] hsr_slave_0: left promiscuous mode [ 454.573964][ T1124] hsr_slave_1: left promiscuous mode [ 454.576361][ T1124] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 454.720566][ T8377] netlink: 12 bytes leftover after parsing attributes in process `syz.3.525'. [ 455.578703][ T1124] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 455.829731][ T8383] netlink: 20 bytes leftover after parsing attributes in process `syz.4.526'. [ 455.829777][ T8383] netlink: 16 bytes leftover after parsing attributes in process `syz.4.526'. [ 455.937405][ T8384] netlink: 20 bytes leftover after parsing attributes in process `syz.4.526'. [ 455.937441][ T8384] netlink: 16 bytes leftover after parsing attributes in process `syz.4.526'. [ 456.093187][ T1124] team0 (unregistering): Port device team_slave_1 removed [ 456.162636][ T1124] team0 (unregistering): Port device team_slave_0 removed [ 456.732097][ T8383] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 456.732113][ T8383] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 456.784271][ T8384] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 456.784292][ T8384] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 456.852641][ T7782] kthread_run failed with err -4 [ 456.932966][ T8038] hsr_slave_0: entered promiscuous mode [ 456.933988][ T8038] hsr_slave_1: entered promiscuous mode [ 456.934703][ T8038] debugfs: 'hsr0' already exists in 'hsr' [ 456.934722][ T8038] Cannot create hsr debugfs directory [ 457.402116][ T8399] unsupported nlmsg_type 40 [ 457.605691][ T5596] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 457.721334][ T5596] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 457.730096][ T5596] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 457.751016][ T5596] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 457.759518][ T5596] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 458.025041][ T8411] netlink: 12 bytes leftover after parsing attributes in process `syz.0.532'. [ 458.041029][ T8411] netlink: 104 bytes leftover after parsing attributes in process `syz.0.532'. [ 459.091718][ T5566] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 459.264222][ T5566] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 0.40 [ 459.266224][ T5566] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 459.266255][ T5566] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 459.324051][ T5566] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.324092][ T5566] usb 5-1: Product: ఉ [ 459.324107][ T5566] usb 5-1: Manufacturer: 侮荍௨缗蜯懿濓聎陱ၥ릶鿽鰕嗕ဨꏥ脶镾⦈娖寣ⳑ婔闻氛㹻ꡌ譌孒쿠闡뇢덜秬律䷽ᒖ蘮伊ߗ䲴큼ࡪష썤롄쟞頪쒁 [ 459.324133][ T5566] usb 5-1: SerialNumber: ⰻ [ 459.717384][ T5566] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 460.207819][ T5596] Bluetooth: hci3: command tx timeout [ 460.412018][ T8434] netlink: 12 bytes leftover after parsing attributes in process `syz.3.535'. [ 460.413267][ T8434] netlink: 104 bytes leftover after parsing attributes in process `syz.3.535'. [ 461.293525][ T5566] usb 5-1: USB disconnect, device number 17 [ 461.594648][ T8446] FAULT_INJECTION: forcing a failure. [ 461.594648][ T8446] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 461.594687][ T8446] CPU: 1 UID: 0 PID: 8446 Comm: syz.0.538 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 461.594716][ T8446] Tainted: [L]=SOFTLOCKUP [ 461.594724][ T8446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 461.594737][ T8446] Call Trace: [ 461.594746][ T8446] [ 461.594755][ T8446] dump_stack_lvl+0xe8/0x150 [ 461.594795][ T8446] should_fail_ex+0x46b/0x600 [ 461.594837][ T8446] _copy_to_user+0x31/0xb0 [ 461.594863][ T8446] simple_read_from_buffer+0xe1/0x170 [ 461.594895][ T8446] proc_fail_nth_read+0x1be/0x230 [ 461.594979][ T8446] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 461.595012][ T8446] ? rw_verify_area+0x250/0x4d0 [ 461.595041][ T8446] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 461.595067][ T8446] vfs_read+0x219/0xa90 [ 461.595111][ T8446] ? __pfx_vfs_read+0x10/0x10 [ 461.595141][ T8446] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 461.595171][ T8446] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 461.595195][ T8446] ? mutex_lock_nested+0x152/0x1d0 [ 461.595225][ T8446] ? fdget_pos+0x252/0x320 [ 461.595259][ T8446] ksys_read+0x156/0x270 [ 461.595289][ T8446] ? __pfx_ksys_read+0x10/0x10 [ 461.595319][ T8446] ? __pfx_v4l2_ioctl+0x10/0x10 [ 461.595358][ T8446] do_syscall_64+0x166/0x520 [ 461.595381][ T8446] ? trace_irq_disable+0x3b/0x140 [ 461.595405][ T8446] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.595430][ T8446] ? clear_bhb_loop+0x70/0xc0 [ 461.595458][ T8446] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.595482][ T8446] RIP: 0033:0x7f8c49a1e90e [ 461.595502][ T8446] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 461.595521][ T8446] RSP: 002b:00007f8c47cb5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 461.595545][ T8446] RAX: ffffffffffffffda RBX: 00007f8c47cb66c0 RCX: 00007f8c49a1e90e [ 461.595561][ T8446] RDX: 000000000000000f RSI: 00007f8c47cb60a0 RDI: 0000000000000004 [ 461.595575][ T8446] RBP: 00007f8c47cb6090 R08: 0000000000000000 R09: 0000000000000000 [ 461.595588][ T8446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 461.595601][ T8446] R13: 00007f8c49ce6038 R14: 00007f8c49ce5fa0 R15: 00007fff212c9828 [ 461.595635][ T8446] [ 462.619748][ T5596] Bluetooth: hci3: command tx timeout [ 463.642367][ T5566] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 463.891825][ T5566] usb 5-1: Using ep0 maxpacket: 16 [ 463.897419][ T5566] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 463.922391][ T5566] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 463.922447][ T5566] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 464.256603][ T5566] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.256997][ T5566] usb 5-1: Product: syz [ 464.257389][ T5566] usb 5-1: Manufacturer: syz [ 464.257692][ T5566] usb 5-1: SerialNumber: syz [ 464.525190][ T5566] usb 5-1: config 0 descriptor?? [ 464.621730][ T5596] Bluetooth: hci3: command tx timeout [ 464.970533][ T5566] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 464.971032][ T5566] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 465.664531][ T5566] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 465.695019][ T5566] em28xx 5-1:0.0: Config register raw data: 0x41 [ 465.860259][ T5245] 8021q: adding VLAN 0 to HW filter on device eth11 [ 465.921875][ T5802] usb 5-1: USB disconnect, device number 18 [ 465.965525][ T5802] em28xx 5-1:0.0: Disconnecting em28xx [ 466.217128][ T5802] em28xx: Freeing device [ 466.702333][ T5596] Bluetooth: hci3: command tx timeout [ 466.975474][ T5566] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 467.274925][ T5802] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 467.463878][ T5802] usb 4-1: Using ep0 maxpacket: 8 [ 467.470893][ T5802] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 467.488717][ T5802] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 467.514353][ T5802] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.514381][ T5802] usb 4-1: Product: syz [ 467.514459][ T5802] usb 4-1: Manufacturer: syz [ 467.514478][ T5802] usb 4-1: SerialNumber: syz [ 467.564089][ T5802] usb 4-1: config 0 descriptor?? [ 468.220468][ T5802] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 468.220688][ T5802] usb 4-1: setting power ON [ 468.295791][ T5802] dvb-usb: bulk message failed: -22 (2/0) [ 468.694715][ T8500] netlink: 244 bytes leftover after parsing attributes in process `syz.0.549'. [ 469.280014][ T5802] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 469.314085][ T5802] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 469.314260][ T5802] usb 4-1: media controller created [ 472.737423][ T5566] usb 5-1: unable to get BOS descriptor or descriptor too short [ 472.737485][ T5566] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 472.737540][ T5566] usb 5-1: no configurations [ 472.737554][ T5566] usb 5-1: can't read configurations, error -22 [ 472.784658][ T5802] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 473.144287][ T5802] usb 4-1: selecting invalid altsetting 6 [ 473.144312][ T5802] usb 4-1: digital interface selection failed (-22) [ 473.144409][ T5802] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 473.145712][ T5802] usb 4-1: setting power OFF [ 473.193912][ T5802] dvb-usb: bulk message failed: -22 (2/0) [ 473.193939][ T5802] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 473.193955][ T5802] (NULL device *): no alternate interface [ 473.305781][ T5802] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 473.330484][ T5802] usb 4-1: USB disconnect, device number 10 [ 473.359686][ T8114] udevd[8114]: setting mode of /dev/bus/usb/004/010 to 020664 failed: No such file or directory [ 473.359859][ T8114] udevd[8114]: setting owner of /dev/bus/usb/004/010 to uid=0, gid=0 failed: No such file or directory [ 473.671764][ T5802] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 475.642221][ T8543] ================================================================== [ 475.642294][ T8543] BUG: KASAN: slab-use-after-free in dvb_media_device_free+0x3a/0x510 [ 475.642383][ T8543] Read of size 8 at addr ffff88802c59a8f0 by task syz.0.559/8543 [ 475.642402][ T8543] [ 475.642448][ T8543] CPU: 0 UID: 0 PID: 8543 Comm: syz.0.559 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 475.642487][ T8543] Tainted: [L]=SOFTLOCKUP [ 475.642496][ T8543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 475.642519][ T8543] Call Trace: [ 475.642528][ T8543] [ 475.642548][ T8543] dump_stack_lvl+0xe8/0x150 [ 475.642602][ T8543] print_address_description+0x55/0x1e0 [ 475.642651][ T8543] ? dvb_media_device_free+0x3a/0x510 [ 475.642674][ T8543] print_report+0x58/0x70 [ 475.642712][ T8543] kasan_report+0x117/0x150 [ 475.642746][ T8543] ? dvb_media_device_free+0x3a/0x510 [ 475.642775][ T8543] dvb_media_device_free+0x3a/0x510 [ 475.642802][ T8543] dvb_remove_device+0x107/0x280 [ 475.642828][ T8543] dvb_unregister_frontend+0x79/0x130 [ 475.642890][ T8543] vidtv_bridge_remove+0x86/0x110 [ 475.642922][ T8543] ? __pfx_platform_remove+0x10/0x10 [ 475.643030][ T8543] device_release_driver_internal+0x48b/0x880 [ 475.643090][ T8543] unbind_store+0x1a4/0x1d0 [ 475.643123][ T8543] ? __pfx_sysfs_kf_write+0x10/0x10 [ 475.643147][ T8543] kernfs_fop_write_iter+0x3a5/0x540 [ 475.643185][ T8543] vfs_write+0x61e/0xbb0 [ 475.643217][ T8543] ? __pfx_vfs_write+0x10/0x10 [ 475.643245][ T8543] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 475.643273][ T8543] ? mutex_lock_nested+0x152/0x1d0 [ 475.643302][ T8543] ? fdget_pos+0x252/0x320 [ 475.643331][ T8543] ksys_write+0x156/0x270 [ 475.643358][ T8543] ? __pfx_ksys_write+0x10/0x10 [ 475.643391][ T8543] do_syscall_64+0x166/0x520 [ 475.643413][ T8543] ? trace_irq_disable+0x3b/0x140 [ 475.643437][ T8543] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.643460][ T8543] ? clear_bhb_loop+0x70/0xc0 [ 475.643485][ T8543] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.643508][ T8543] RIP: 0033:0x7f8c49a5e0d9 [ 475.643527][ T8543] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 475.643556][ T8543] RSP: 002b:00007f8c47cb6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 475.643581][ T8543] RAX: ffffffffffffffda RBX: 00007f8c49ce5fa0 RCX: 00007f8c49a5e0d9 [ 475.643598][ T8543] RDX: 0000000000000007 RSI: 0000200000000300 RDI: 0000000000000004 [ 475.643613][ T8543] RBP: 00007f8c49af5024 R08: 0000000000000000 R09: 0000000000000000 [ 475.643628][ T8543] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 475.643643][ T8543] R13: 00007f8c49ce6038 R14: 00007f8c49ce5fa0 R15: 00007fff212c9828 [ 475.643670][ T8543] [ 475.643678][ T8543] [ 475.643683][ T8543] Allocated by task 1: [ 475.643726][ T8543] kasan_save_track+0x3e/0x80 [ 475.643760][ T8543] __kasan_kmalloc+0x93/0xb0 [ 475.643786][ T8543] __kmalloc_cache_noprof+0x3da/0x6b0 [ 475.643806][ T8543] dvb_register_device+0x309/0x1dd0 [ 475.643838][ T8543] dvb_register_frontend+0x619/0x900 [ 475.643870][ T8543] vidtv_bridge_probe+0x9d5/0xf60 [ 475.643929][ T8543] platform_probe+0xf9/0x190 [ 475.643955][ T8543] really_probe+0x254/0xae0 [ 475.643985][ T8543] __driver_probe_device+0x1e8/0x360 [ 475.644014][ T8543] driver_probe_device+0x4f/0x240 [ 475.644044][ T8543] __driver_attach+0x339/0x600 [ 475.644073][ T8543] bus_for_each_dev+0x23e/0x2c0 [ 475.644094][ T8543] bus_add_driver+0x348/0x670 [ 475.644116][ T8543] driver_register+0x23a/0x320 [ 475.644133][ T8543] vidtv_bridge_init+0x3d/0x60 [ 475.644269][ T8543] do_one_initcall+0x250/0x870 [ 475.644299][ T8543] do_initcall_level+0x10a/0x1a0 [ 475.644359][ T8543] do_initcalls+0x59/0xa0 [ 475.644386][ T8543] kernel_init_freeable+0x29d/0x3e0 [ 475.644414][ T8543] kernel_init+0x22/0x1d0 [ 475.644440][ T8543] ret_from_fork+0x514/0xb70 [ 475.644483][ T8543] ret_from_fork_asm+0x1a/0x30 [ 475.644514][ T8543] [ 475.644519][ T8543] Freed by task 8543: [ 475.644529][ T8543] kasan_save_track+0x3e/0x80 [ 475.644567][ T8543] kasan_save_free_info+0x40/0x50 [ 475.644593][ T8543] __kasan_slab_free+0x5c/0x80 [ 475.644611][ T8543] kfree+0x1c5/0x6d0 [ 475.644638][ T8543] dvb_remove_device+0xce/0x280 [ 475.644658][ T8543] dvb_unregister_frontend+0x79/0x130 [ 475.644689][ T8543] vidtv_bridge_remove+0x86/0x110 [ 475.644714][ T8543] device_release_driver_internal+0x48b/0x880 [ 475.644745][ T8543] unbind_store+0x1a4/0x1d0 [ 475.644768][ T8543] kernfs_fop_write_iter+0x3a5/0x540 [ 475.644799][ T8543] vfs_write+0x61e/0xbb0 [ 475.644820][ T8543] ksys_write+0x156/0x270 [ 475.644841][ T8543] do_syscall_64+0x166/0x520 [ 475.644862][ T8543] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.644881][ T8543] [ 475.644887][ T8543] The buggy address belongs to the object at ffff88802c59a800 [ 475.644887][ T8543] which belongs to the cache kmalloc-512 of size 512 [ 475.644905][ T8543] The buggy address is located 240 bytes inside of [ 475.644905][ T8543] freed 512-byte region [ffff88802c59a800, ffff88802c59aa00) [ 475.644927][ T8543] [ 475.644933][ T8543] The buggy address belongs to the physical page: [ 475.644948][ T8543] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c598 [ 475.644968][ T8543] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 475.645004][ T8543] flags: 0x80000000000040(head|node=0|zone=1) [ 475.645022][ T8543] page_type: f5(slab) [ 475.645042][ T8543] raw: 0080000000000040 ffff88813ffb5c80 dead000000000100 dead000000000122 [ 475.645063][ T8543] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 475.645083][ T8543] head: 0080000000000040 ffff88813ffb5c80 dead000000000100 dead000000000122 [ 475.645102][ T8543] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 475.645123][ T8543] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 475.645142][ T8543] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 475.645153][ T8543] page dumped because: kasan: bad access detected [ 475.645170][ T8543] page_owner tracks the page as allocated [ 475.645178][ T8543] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 20715677226, free_ts 20715349293 [ 475.645219][ T8543] post_alloc_hook+0x1f9/0x250 [ 475.645252][ T8543] get_page_from_freelist+0x2630/0x26a0 [ 475.645276][ T8543] __alloc_frozen_pages_noprof+0x18d/0x380 [ 475.645299][ T8543] allocate_slab+0x79/0x5e0 [ 475.645324][ T8543] refill_objects+0x2d8/0x350 [ 475.645351][ T8543] __pcs_replace_empty_main+0x334/0x690 [ 475.645377][ T8543] __kmalloc_cache_noprof+0x470/0x6b0 [ 475.645397][ T8543] bus_add_driver+0x165/0x670 [ 475.645420][ T8543] driver_register+0x23a/0x320 [ 475.645439][ T8543] usb_register_driver+0x1e4/0x390 [ 475.645518][ T8543] uvc_init+0x22/0x40 [ 475.645552][ T8543] do_one_initcall+0x250/0x870 [ 475.645583][ T8543] do_initcall_level+0x10a/0x1a0 [ 475.645614][ T8543] do_initcalls+0x59/0xa0 [ 475.645642][ T8543] kernel_init_freeable+0x29d/0x3e0 [ 475.645673][ T8543] kernel_init+0x22/0x1d0 [ 475.645700][ T8543] page last free pid 1 tgid 1 stack trace: [ 475.645712][ T8543] __free_frozen_pages+0x1105/0x11e0 [ 475.645746][ T8543] stack_depot_save_flags+0x41e/0x7f0 [ 475.645795][ T8543] kasan_save_track+0x4f/0x80 [ 475.645828][ T8543] __kasan_slab_alloc+0x6c/0x80 [ 475.645847][ T8543] kmem_cache_alloc_lru_noprof+0x35b/0x650 [ 475.645880][ T8543] alloc_inode+0x6a/0x1b0 [ 475.645899][ T8543] new_inode+0x1f/0x170 [ 475.645919][ T8543] debugfs_create_dir+0x68/0x350 [ 475.645974][ T8543] uvc_debugfs_init+0x43/0x50 [ 475.646059][ T8543] uvc_init+0xb/0x40 [ 475.646084][ T8543] do_one_initcall+0x250/0x870 [ 475.646115][ T8543] do_initcall_level+0x10a/0x1a0 [ 475.646146][ T8543] do_initcalls+0x59/0xa0 [ 475.646175][ T8543] kernel_init_freeable+0x29d/0x3e0 [ 475.646204][ T8543] kernel_init+0x22/0x1d0 [ 475.646230][ T8543] ret_from_fork+0x514/0xb70 [ 475.646261][ T8543] [ 475.646266][ T8543] Memory state around the buggy address: [ 475.646279][ T8543] ffff88802c59a780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 475.646295][ T8543] ffff88802c59a800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 475.646311][ T8543] >ffff88802c59a880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 475.646322][ T8543] ^ [ 475.646336][ T8543] ffff88802c59a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 475.646351][ T8543] ffff88802c59a980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 475.646363][ T8543] ================================================================== [ 475.646669][ T8543] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 475.646692][ T8543] CPU: 0 UID: 0 PID: 8543 Comm: syz.0.559 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 475.646730][ T8543] Tainted: [L]=SOFTLOCKUP [ 475.646739][ T8543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 475.646754][ T8543] Call Trace: [ 475.646763][ T8543] [ 475.646773][ T8543] vpanic+0x56d/0xa60 [ 475.646811][ T8543] ? rcu_is_watching+0x16/0xb0 [ 475.646843][ T8543] ? __pfx_vpanic+0x10/0x10 [ 475.646884][ T8543] panic+0xc5/0xd0 [ 475.646918][ T8543] ? __pfx_panic+0x10/0x10 [ 475.646954][ T8543] ? preempt_schedule_thunk+0x16/0x40 [ 475.646983][ T8543] ? preempt_schedule_thunk+0x16/0x40 [ 475.647010][ T8543] ? dvb_media_device_free+0x3a/0x510 [ 475.647034][ T8543] check_panic_on_warn+0x89/0xb0 [ 475.647071][ T8543] ? dvb_media_device_free+0x3a/0x510 [ 475.647095][ T8543] end_report+0x73/0x170 [ 475.647119][ T8543] ? dvb_media_device_free+0x3a/0x510 [ 475.647141][ T8543] kasan_report+0x128/0x150 [ 475.647167][ T8543] ? dvb_media_device_free+0x3a/0x510 [ 475.647196][ T8543] dvb_media_device_free+0x3a/0x510 [ 475.647222][ T8543] dvb_remove_device+0x107/0x280 [ 475.647247][ T8543] dvb_unregister_frontend+0x79/0x130 [ 475.647285][ T8543] vidtv_bridge_remove+0x86/0x110 [ 475.647315][ T8543] ? __pfx_platform_remove+0x10/0x10 [ 475.647345][ T8543] device_release_driver_internal+0x48b/0x880 [ 475.647385][ T8543] unbind_store+0x1a4/0x1d0 [ 475.647416][ T8543] ? __pfx_sysfs_kf_write+0x10/0x10 [ 475.647439][ T8543] kernfs_fop_write_iter+0x3a5/0x540 [ 475.647477][ T8543] vfs_write+0x61e/0xbb0 [ 475.647509][ T8543] ? __pfx_vfs_write+0x10/0x10 [ 475.647536][ T8543] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 475.647573][ T8543] ? mutex_lock_nested+0x152/0x1d0 [ 475.647604][ T8543] ? fdget_pos+0x252/0x320 [ 475.647634][ T8543] ksys_write+0x156/0x270 [ 475.647662][ T8543] ? __pfx_ksys_write+0x10/0x10 [ 475.647696][ T8543] do_syscall_64+0x166/0x520 [ 475.647720][ T8543] ? trace_irq_disable+0x3b/0x140 [ 475.647744][ T8543] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.647768][ T8543] ? clear_bhb_loop+0x70/0xc0 [ 475.647794][ T8543] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.647817][ T8543] RIP: 0033:0x7f8c49a5e0d9 [ 475.647838][ T8543] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 475.647858][ T8543] RSP: 002b:00007f8c47cb6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 475.647882][ T8543] RAX: ffffffffffffffda RBX: 00007f8c49ce5fa0 RCX: 00007f8c49a5e0d9 [ 475.647900][ T8543] RDX: 0000000000000007 RSI: 0000200000000300 RDI: 0000000000000004 [ 475.647916][ T8543] RBP: 00007f8c49af5024 R08: 0000000000000000 R09: 0000000000000000 [ 475.647931][ T8543] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 475.647945][ T8543] R13: 00007f8c49ce6038 R14: 00007f8c49ce5fa0 R15: 00007fff212c9828 [ 475.647973][ T8543] [ 475.648598][ T8543] Kernel Offset: disabled