last executing test programs: 6m58.837258313s ago: executing program 3 (id=1355): syz_open_dev$I2C(&(0x7f0000001bc0), 0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000003f80)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_io_uring_setup(0x111, &(0x7f0000003fc0)={0x0, 0x39c4, 0x2, 0x3, 0xfffffffe}, &(0x7f0000004040), 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000004140)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) syz_usb_connect$midi(0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000004480)=0x4, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x5c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_enter(0xffffffffffffffff, 0x806c23, 0x4e8b, 0x30, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x38, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x38}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f00000044c0)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r1, &(0x7f0000004500)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) 6m56.369728805s ago: executing program 3 (id=1361): syz_open_dev$I2C(&(0x7f0000001bc0), 0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000003f80)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_io_uring_setup(0x111, &(0x7f0000003fc0)={0x0, 0x39c4, 0x2, 0x3, 0xfffffffe}, &(0x7f0000004040), 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000004140)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) syz_usb_connect$midi(0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000004480)=0x4, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x5c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_enter(0xffffffffffffffff, 0x806c23, 0x4e8b, 0x30, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x38, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x38}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f00000044c0)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r1, &(0x7f0000004500)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) 6m53.823580167s ago: executing program 3 (id=1367): lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x1c, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ftruncate(0xffffffffffffffff, 0xffffffff) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x0, 0x2) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) connect$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000100), 0x318, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) 6m53.071095194s ago: executing program 1 (id=1370): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@gettfilter={0x24, 0x2e, 0x1, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0x7}, {0xe}, {0x0, 0xfff2}}}, 0x24}}, 0x40000d0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(r2, 0x24, &(0x7f0000000600)={0x1, 0x0, 0x7, 0x800005fffffffffe}) write$binfmt_script(r3, &(0x7f00000006c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000740)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000800)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000840)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = fsopen(&(0x7f00000002c0)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000300)='test_dummy_encryption', &(0x7f0000000340)='v8\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r6, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000a00)="a6", 0x5dc}], 0x2b}}], 0x5, 0x4040000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0xfffffffffffffffa) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f00000004c0)={0x2, 0x0, 0x81, 0x10001, @vifc_lcl_addr=@rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 6m51.10546712s ago: executing program 1 (id=1372): openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/bus/input/devices\x00', 0x0, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x802, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00', 0x19}) syz_io_uring_setup(0xf08, &(0x7f0000000980)={0x0, 0xfefffffe, 0x800, 0x3, 0x800000c5}, &(0x7f0000000a00), &(0x7f0000000a40), &(0x7f0000000a80)) pselect6(0x40, &(0x7f0000000200)={0x2, 0x2, 0x2, 0x4, 0x97, 0x0, 0x241}, &(0x7f0000000240)={0x8, 0x0, 0x6, 0xe14b, 0x4, 0x2, 0xfffffffffffffffb, 0x200}, 0x0, 0x0, &(0x7f0000000380)={0x0}) ioctl$UI_DEV_CREATE(r0, 0x5501) 6m49.547227964s ago: executing program 1 (id=1374): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@gettfilter={0x24, 0x2e, 0x1, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0x7}, {0xe}, {0x0, 0xfff2}}}, 0x24}}, 0x40000d0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(r2, 0x24, &(0x7f0000000600)={0x1, 0x0, 0x7, 0x800005fffffffffe}) write$binfmt_script(r3, &(0x7f00000006c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000740)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000800)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000840)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = fsopen(&(0x7f00000002c0)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000300)='test_dummy_encryption', &(0x7f0000000340)='v8\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0xfffffffffffffffa) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r8, 0x0, 0xca, &(0x7f00000004c0)={0x2, 0x0, 0x81, 0x10001, @vifc_lcl_addr=@rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 6m48.852040888s ago: executing program 3 (id=1375): syz_usb_connect(0x5, 0x0, 0x0, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100), 0x28041, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x40003, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x40, 0x1, 0x200, "690694c400002c74f6024305f11fd3454ad23d00", 0x32314d48}) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000000180)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00221800"], 0x0}, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f00000000c0)=0x4081ff) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r4, 0x0) sendfile(r4, r4, 0x0, 0x1002000ff) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc008561c, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_VDPA_GET_DEVICE_ID(0xffffffffffffffff, 0x8004af70, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000013c0)=ANY=[@ANYBLOB="180000002600296bd90a834177b93508b8c3375b4247002d"], 0x18}, 0x1, 0x0, 0x0, 0x8c811}, 0x4040840) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003a00)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x1000, @private0, 0x80000001}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=[@dstopts={{0x14}}, @tclass={{0x10, 0x29, 0x43, 0x7}}, @rthdr_2292={{0x24, 0x29, 0x39, {0x6, 0x2, 0x2, 0x1, 0x0, [@empty]}}}], 0x48}}], 0x1, 0x8880) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r6, 0x80000) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r7, 0x0, 0xf3a, 0x0) 6m45.746914591s ago: executing program 1 (id=1380): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0x8, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0x8, 0x5, 0xfffffffe], [0xa76f, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) ioctl$MEMREAD(0xffffffffffffffff, 0xc0404d1a, &(0x7f00000003c0)={0x4, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', {0x6, 0x8b, 0x4bc}}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x14, 0x2, 0x6, 0xa03}, 0x14}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000120001000000", @ANYRES32=0x0, @ANYBLOB="000000000000000408001d00ff03"], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 6m43.938031493s ago: executing program 3 (id=1383): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@gettfilter={0x24, 0x2e, 0x1, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0x7}, {0xe}, {0x0, 0xfff2}}}, 0x24}}, 0x40000d0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(r2, 0x24, &(0x7f0000000600)={0x1, 0x0, 0x7, 0x800005fffffffffe}) write$binfmt_script(r3, &(0x7f00000006c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000740)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000800)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000840)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000300)='test_dummy_encryption', &(0x7f0000000340)='v8\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000a00)="a6", 0x5dc}], 0x2b}}], 0x5, 0x4040000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, &(0x7f00000004c0)={0x2, 0x0, 0x81, 0x10001, @vifc_lcl_addr=@rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 6m43.811116065s ago: executing program 1 (id=1384): syz_open_dev$I2C(&(0x7f0000001bc0), 0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000003f80)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_io_uring_setup(0x111, &(0x7f0000003fc0)={0x0, 0x39c4, 0x2, 0x3, 0xfffffffe}, &(0x7f0000004040), &(0x7f0000004080), &(0x7f00000040c0)) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000004140)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) syz_usb_connect$midi(0x0, 0x59, 0x0, &(0x7f0000004180)={0x0, 0x0, 0x0, 0x0}) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000004480)=0x4, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xd4}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_enter(0xffffffffffffffff, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x38, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x38}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f00000044c0)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r1, &(0x7f0000004500)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) 6m40.190020755s ago: executing program 1 (id=1389): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x840000000002, 0x3, 0x100) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r3, &(0x7f0000000900), 0x4000095, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r3, 0x0, 0x29, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a010400000000000000000200000a0900010073797a30000000000900030073797a300000000014000480080001400000000308000240000000004c000000060a010400000000000000000200000a0900010073797a30000000000900020073797a3000000000200004801c0001800a00010071756575650000000c000280060001400000000014000000110001"], 0xd4}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b80)={0x28, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000c40)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000005c0), 0x48100) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r8, 0x6, 0x16, &(0x7f00000004c0), 0x20000328) getsockopt$inet_IP_IPSEC_POLICY(r8, 0x0, 0x10, 0x0, &(0x7f0000000500)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r9, 0xc08c5332, &(0x7f0000000640)={0x2000, 0x101, 0x0, 'queue1\x00'}) write$sndseq(r9, &(0x7f0000000700)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r7, 0xc08c5335, &(0x7f0000000740)={0x0, 0x80, 0x0, 'queue0\x00'}) close_range(r6, 0xffffffffffffffff, 0x0) 6m36.889581542s ago: executing program 3 (id=1393): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@gettfilter={0x24, 0x2e, 0x1, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0x7}, {0xe}, {0x0, 0xfff2}}}, 0x24}}, 0x40000d0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(r2, 0x24, &(0x7f0000000600)={0x1, 0x0, 0x7, 0x800005fffffffffe}) write$binfmt_script(r3, &(0x7f00000006c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000740)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000800)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000840)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = fsopen(&(0x7f00000002c0)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000300)='test_dummy_encryption', &(0x7f0000000340)='v8\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000a00)="a6", 0x5dc}], 0x2b}}], 0x5, 0x4040000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0xfffffffffffffffa) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r8, 0x0, 0xca, &(0x7f00000004c0)={0x2, 0x0, 0x81, 0x10001, @vifc_lcl_addr=@rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 6m24.000704901s ago: executing program 32 (id=1389): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x840000000002, 0x3, 0x100) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r3, &(0x7f0000000900), 0x4000095, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r3, 0x0, 0x29, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a010400000000000000000200000a0900010073797a30000000000900030073797a300000000014000480080001400000000308000240000000004c000000060a010400000000000000000200000a0900010073797a30000000000900020073797a3000000000200004801c0001800a00010071756575650000000c000280060001400000000014000000110001"], 0xd4}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b80)={0x28, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000c40)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000005c0), 0x48100) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r8, 0x6, 0x16, &(0x7f00000004c0), 0x20000328) getsockopt$inet_IP_IPSEC_POLICY(r8, 0x0, 0x10, 0x0, &(0x7f0000000500)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r9, 0xc08c5332, &(0x7f0000000640)={0x2000, 0x101, 0x0, 'queue1\x00'}) write$sndseq(r9, &(0x7f0000000700)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r7, 0xc08c5335, &(0x7f0000000740)={0x0, 0x80, 0x0, 'queue0\x00'}) close_range(r6, 0xffffffffffffffff, 0x0) 6m21.309952367s ago: executing program 33 (id=1393): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@gettfilter={0x24, 0x2e, 0x1, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0x7}, {0xe}, {0x0, 0xfff2}}}, 0x24}}, 0x40000d0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(r2, 0x24, &(0x7f0000000600)={0x1, 0x0, 0x7, 0x800005fffffffffe}) write$binfmt_script(r3, &(0x7f00000006c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000740)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000800)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000840)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = fsopen(&(0x7f00000002c0)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000300)='test_dummy_encryption', &(0x7f0000000340)='v8\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000a00)="a6", 0x5dc}], 0x2b}}], 0x5, 0x4040000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0xfffffffffffffffa) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r8, 0x0, 0xca, &(0x7f00000004c0)={0x2, 0x0, 0x81, 0x10001, @vifc_lcl_addr=@rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 25.420593866s ago: executing program 2 (id=1840): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb47, 0x4, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="d6", 0x1}], 0x1}}], 0x1, 0x4004851) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) socket$netlink(0x10, 0x3, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000500), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc1105511, &(0x7f0000000800)={{0xc}, 0x0, [0x0, 0x100, 0x7fff, 0xfffffffffffffffe, 0x9, 0x100000002, 0x0, 0x800000000000004, 0x0, 0x5, 0xc3, 0x7f, 0x1, 0x0, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x1, 0x0, 0x32, 0x0, 0x3, 0x100000000, 0xffffffffffffffbf, 0xfffffffffffffffc, 0x5, 0x4, 0x4, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x3, 0x20, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xc, 0x0, 0x1, 0x0, 0x7d, 0x3, 0xfffffffe, 0x0, 0x6, 0xfffffdfffffffffe, 0x23, 0x804000, 0x0, 0xffffffff, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xb4e, 0x6, 0x2000000, 0xfffffffc, 0x1, 0x0, 0x0, 0xd87, 0x8a95, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000004, 0x0, 0x1, 0xfffffffffffffffd, 0xdf9cd8e, 0x7, 0x6, 0x5, 0x0, 0x0, 0x0, 0xbb, 0x200000, 0x0, 0xfffffffffffffff7, 0xfffffffb, 0x7, 0x7ffffffd, 0x3, 0x8, 0xffffffffffff2328, 0x2, 0x7, 0x2, 0x77, 0x0, 0x2, 0x8000000000000003, 0xf916, 0x8, 0x8, 0x8, 0x4, 0x0, 0x7, 0xb, 0x1, 0x7, 0x0, 0x0, 0x6, 0xfffffffffffffffe, 0x0, 0x0, 0x7ff]}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000300)={0x0, @adiantum, 0x0, @desc2}) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200000}]}) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000640)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@dev={0xfe, 0x80, '\x00', 0x1a}, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x4d3, 0x3c}, @in6=@mcast1, {0x0, 0x0, 0x82, 0x0, 0x10000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) setsockopt(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x5, 0x401d031, 0xffffffffffffffff, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) timer_create(0x0, &(0x7f0000000400)={0x0, 0x21, 0x4}, &(0x7f0000000440)=0x0) timer_settime(r7, 0x0, &(0x7f00000005c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$TCSETSW2(r6, 0x5408, &(0x7f0000000600)={0x4, 0x37, 0x783, 0xfff, 0x2, "b850e43615b178e300000000000400190500", 0x800, 0x1}) 24.414114674s ago: executing program 4 (id=1842): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x5, 0x0, 0x5, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r0 = syz_io_uring_setup(0x111, &(0x7f0000000080)={0x0, 0x39c6, 0x2, 0x1, 0xfffffffe}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f00000001c0)='n', 0x1) io_pgetevents(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$kcm(0xa, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syslog(0x3, &(0x7f00000011c0)=""/4091, 0xffb) setsockopt$sock_attach_bpf(r2, 0x1, 0x14, &(0x7f0000000340), 0x75bb17c2) sendmmsg$inet6(r1, &(0x7f0000000380)=[{{&(0x7f00000003c0)={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x14}, 0x6}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000480)='Q', 0x1}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e24, 0x9, @empty, 0x2}, 0x1c, 0x0}}], 0x2, 0x4000840) shutdown(r1, 0x1) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000007c0)={'lo\x00'}) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket(0x1e, 0x1, 0x0) connect$tipc(r4, &(0x7f0000000240)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) recvmmsg(r4, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/17, 0x11}, 0x8000}], 0x1, 0x2102, 0x0) write$binfmt_misc(r4, &(0x7f0000000300), 0x2000011a) timer_create(0x0, &(0x7f0000000400)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f00000005c0)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000600)={0x0, 0x0, 0xfd8b, 0x5}) r5 = syz_open_dev$video(&(0x7f0000000640), 0x101, 0xab02) ioctl$VIDIOC_S_CROP(r5, 0x4014563c, &(0x7f00000006c0)={0x9, {0xf8000002, 0x9, 0x8, 0xb}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000021c0)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1e, 0x9, 0x46d, 0xc082, 0x4, 0x0, "0600ff0901a1018510750895060901810209019102851175089513090181"}}, 0x136) 23.081404049s ago: executing program 4 (id=1843): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000005c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)=ANY=[@ANYRES16=0x0, @ANYBLOB="010027bd7000fbdbdf252e00000008000300", @ANYRES32=0x0, @ANYBLOB="cbe0ff070000000008002201b10000000800000006a8442c685f8363899b535f6d1c88bdd6f3d464009806000000000c002a010006020202020000000000"], 0x60}, 0x1, 0x0, 0x0, 0x24008800}, 0x85) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs2/custom1\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0x5acf, 0x40, 0xffffffff}) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_sys\x00', 0x275a, 0x0) flock(r3, 0x5) fcntl$lock(r3, 0x6, &(0x7f0000000240)={0x0, 0x0, 0x8}) unshare(0x20000400) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='fdinfo/3\x00') read$FUSE(r4, &(0x7f0000000880)={0x2020}, 0x2020) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0) write(r5, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$SIOCGSTAMP(r6, 0x8906, 0x0) write(r5, &(0x7f0000000200)='1', 0x1) ioctl$KVM_RUN(r5, 0xae80, 0x0) 22.856141743s ago: executing program 2 (id=1844): syz_open_dev$video(&(0x7f00000002c0), 0x5, 0x2) openat$sndseq(0xffffffffffffff9c, 0x0, 0x608502) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x800000000007, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000440)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000480)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000005c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000a80)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000019a80)=0x7) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r4, 0x6, 0x21, &(0x7f0000019ac0)="5766dff3eacc03e400007a00", 0x10) listen(r4, 0xfffd) shutdown(r4, 0x0) pipe(0x0) syz_open_procfs(0x0, 0x0) 11.2418169s ago: executing program 2 (id=1846): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000140)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x2, @remote, 0x8}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000280)="d6", 0x1}], 0x1}}], 0x1, 0x4004851) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)={0x24, 0x1e, 0x21, 0x70bd2b, 0x0, {0x6}, [@typed={0x5, 0x12c, 0x0, 0x0, @str='\x00'}, @nested={0x8, 0xf, 0x0, 0x1, [@typed={0x4, 0xb6}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x2008800}, 0x8086) r4 = syz_open_dev$sndctrl(&(0x7f0000000500), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc1105511, &(0x7f0000000800)={{0xc}, 0x0, [0x0, 0x100, 0x7fff, 0xfffffffffffffffe, 0x9, 0x100000002, 0x0, 0x800000000000004, 0x0, 0x5, 0xc3, 0x7f, 0x1, 0x0, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x1, 0x0, 0x32, 0x0, 0x3, 0x100000000, 0xffffffffffffffbf, 0xfffffffffffffffc, 0x5, 0x4, 0x4, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x3, 0x20, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xc, 0x0, 0x1, 0x0, 0x7d, 0x3, 0xfffffffe, 0x0, 0x6, 0xfffffdfffffffffe, 0x23, 0x804000, 0x0, 0xffffffff, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xb4e, 0x6, 0x2000000, 0xfffffffc, 0x1, 0x0, 0x0, 0xd87, 0x8a95, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000004, 0x0, 0x1, 0xfffffffffffffffd, 0xdf9cd8e, 0x7, 0x6, 0x5, 0x0, 0x0, 0x0, 0xbb, 0x200000, 0x0, 0xfffffffffffffff7, 0xfffffffb, 0x7, 0x7ffffffd, 0x3, 0x8, 0xffffffffffff2328, 0x2, 0x7, 0x2, 0x77, 0x0, 0x2, 0x8000000000000003, 0xf916, 0x8, 0x8, 0x8, 0x4, 0x0, 0x7, 0xb, 0x1, 0x7, 0x0, 0x0, 0x6, 0xfffffffffffffffe, 0x0, 0x0, 0x7ff]}) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000300)={0x0, @adiantum, 0x0, @desc2}) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200000}]}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000640)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@dev={0xfe, 0x80, '\x00', 0x1a}, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x4d3, 0x3c}, @in6=@mcast1, {0x0, 0x0, 0x82, 0x0, 0x10000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) setsockopt(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x5, 0x401d031, 0xffffffffffffffff, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) 10.336904724s ago: executing program 4 (id=1847): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@gettfilter={0x24, 0x2e, 0x1, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0x7}, {0xe}, {0x0, 0xfff2}}}, 0x24}}, 0x40000d0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(r2, 0x24, &(0x7f0000000600)={0x1, 0x0, 0x7, 0x800005fffffffffe}) write$binfmt_script(r3, &(0x7f00000006c0), 0x208e24b) preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000740)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000800)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000840)={0x0, 0x18, 0x0}, 0x0) r5 = fsopen(&(0x7f00000002c0)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000300)='test_dummy_encryption', &(0x7f0000000340)='v8\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r6, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000a00)="a6", 0x5dc}], 0x2b}}], 0x5, 0x4040000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0xfffffffffffffffa) socket$igmp(0x2, 0x3, 0x2) 8.878942265s ago: executing program 0 (id=1848): memfd_create(&(0x7f0000000340)='y\x105\xfc\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xa4\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01L\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x06\xb3\xf0wVq\xe9d\xac\xe9\xaa\x9dR\x00\x9b\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2G\x1b+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2v\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x1e\x11X\f\x0f\xf0\xe2\xb5\xf8', 0xb) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x8800) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x88}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f00000004c0)={0x0, 0xd17, 0x10, 0x1, 0x80}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe702, 0x1000, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x542b, 0x2, 0x4, 0x1bf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93f9, 0x8000, 0x4003bffc, 0x2b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x3, 0x8}}], 0x1, 0x0, 0x0) 8.50107622s ago: executing program 2 (id=1849): memfd_create(&(0x7f0000000340)='y\x105\xfc\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xa4\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01L\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x06\xb3\xf0wVq\xe9d\xac\xe9\xaa\x9dR\x00\x9b\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2G\x1b+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2v\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x1e\x11X\f\x0f\xf0\xe2\xb5\xf8', 0xb) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$tipc(0x1e, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x8800) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x80}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = syz_ublk_setup_io_uring(0x467c, &(0x7f0000000140)={0x0, 0xcfab, 0x8000, 0x0, 0x118}, &(0x7f0000000280), &(0x7f00000002c0), 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r3, &(0x7f00000004c0)={0x0, 0xd17, 0x10, 0x1, 0x80, 0x0, r4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe702, 0x1000, 0x3, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x542b, 0x2, 0x4, 0x1bf, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93f9, 0x8000, 0x4003bffc, 0x2b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x3, 0x8}}], 0x1, 0x0, 0x0) 7.735130669s ago: executing program 0 (id=1850): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r0, &(0x7f00000004c0)='27', 0x2) syz_ublk_setup_io_uring(0x1a, &(0x7f0000000500)={0x0, 0x30b8, 0x1, 0x2, 0x158}, &(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)) 6.902332079s ago: executing program 0 (id=1851): memfd_create(&(0x7f0000000340)='y\x105\xfc\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xa4\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01L\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x06\xb3\xf0wVq\xe9d\xac\xe9\xaa\x9dR\x00\x9b\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2G\x1b+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2v\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x1e\x11X\f\x0f\xf0\xe2\xb5\xf8', 0xb) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$tipc(0x1e, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x8800) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb0}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, 0x0, 0x1, 0x0, 0x0) 6.221865919s ago: executing program 2 (id=1852): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@gettfilter={0x24, 0x2e, 0x1, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0x7}, {0xe}, {0x0, 0xfff2}}}, 0x24}}, 0x40000d0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(r2, 0x24, &(0x7f0000000600)={0x1, 0x0, 0x7, 0x800005fffffffffe}) write$binfmt_script(r3, &(0x7f00000006c0), 0x208e24b) preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000740)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000800)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000840)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = fsopen(&(0x7f00000002c0)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000300)='test_dummy_encryption', &(0x7f0000000340)='v8\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r6, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000a00)="a6", 0x5dc}], 0x2b}}], 0x5, 0x4040000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0xfffffffffffffffa) r9 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r9, 0x0, 0xca, &(0x7f00000004c0)={0x2, 0x0, 0x81, 0x10001, @vifc_lcl_addr=@rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 5.693759281s ago: executing program 0 (id=1853): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000840)) r2 = syz_usb_connect(0x2, 0x58, &(0x7f0000000ac0)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, &(0x7f0000000c00)={0x24, 0x0, &(0x7f0000000c40)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000c80)={0x24, 0x0, &(0x7f0000000cc0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x4c0a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000001300)={0x2c, &(0x7f0000001340)={0x40, 0x8, 0x8, "003cb3a4aa50323f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000001380)={0x18, &(0x7f0000000000)={0x20, 0x12, 0x4, "06d11a53"}, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) write$char_usb(r3, 0x0, 0x20) syz_ublk_setup_queues(r0, 0x0, &(0x7f0000000980)={0x0, 0x81aa5, 0x80, 0x2, 0x20000}, &(0x7f0000001080)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3104, 0x2, 0x0, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x56ef, 0x200, 0x1, 0x69, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x400, 0x10000, 0x3ffffe, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xee2f, 0x2, 0x3, 0x1c0}}], 0x1, &(0x7f0000000240)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0xb29, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000d00)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWTABLE={0x17c, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0xcf, 0x6, "84364aa6376ec19b0f0f03da8617df48f17b700df63874fb4f5b03ab349bb8e157dfa924c3af32bce6ecfa9671fc9b8722cc62b141293417e8f533a51f6fe62a13ef5e922c83d3f7e8c43b02bab24e80f49257441292b38b3b10c5646ee8422a7c19cede0c4a0cca9c5daa02be91640ebd552252d037b36ba98473b0adb972239f658bce488609dffee2972b2126bb6078fab5eaea6657cc216cf341ab702de7606c5b0fefe309dcdef96d46fbcb5858811f0b09ddcb4d14a53c99161147fa0593545d9a9dac67b7de46d1"}, @NFTA_TABLE_USERDATA={0x4f, 0x6, "6bb54bb7bd5ace24c149eae88f8fdf2ee6b464eee68a2d906164332cdb30207f8cf082bd2184e986c45cd7edaf06f4fbf72515752905824a7b16472a51c05e6b4de738aadafba5238350a7"}, @NFTA_TABLE_USERDATA={0x22, 0x6, "eb65fd57000043fd379f7644ce4d34d1300326ed4a240ecd7d89f8ab727d"}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @reject={{0xb}, @void}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x204}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x38, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x38}}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000400), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1, 0x2000007, 0x403f031, 0xffffffffffffffff, 0x0) munlockall() r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f0000000a40), 0x2, 0x2) r7 = epoll_create(0x1002) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000a80)={0x1000000d}) sendto$inet(r5, &(0x7f0000000440)='01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789\x00', 0xc8, 0x4000000, &(0x7f0000000540)={0x2, 0x4d2, @remote}, 0x10) 5.249668611s ago: executing program 4 (id=1854): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x5, 0x0, 0x5, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r0 = syz_io_uring_setup(0x111, &(0x7f0000000080)={0x0, 0x39c6, 0x2, 0x1, 0xfffffffe}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f00000001c0)='n', 0x1) io_pgetevents(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$kcm(0xa, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syslog(0x3, &(0x7f00000011c0)=""/4091, 0xffb) setsockopt$sock_attach_bpf(r2, 0x1, 0x14, &(0x7f0000000340), 0x75bb17c2) sendmmsg$inet6(r1, &(0x7f0000000380)=[{{&(0x7f00000003c0)={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x14}, 0x6}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000480)='Q', 0x1}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e24, 0x9, @empty, 0x2}, 0x1c, 0x0}}], 0x2, 0x4000840) shutdown(r1, 0x1) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000007c0)={'lo\x00'}) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket(0x1e, 0x1, 0x0) connect$tipc(r4, &(0x7f0000000240)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) recvmmsg(r4, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/17, 0x11}, 0x8000}], 0x1, 0x2102, 0x0) write$binfmt_misc(r4, &(0x7f0000000300), 0x2000011a) timer_create(0x0, &(0x7f0000000400)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f00000005c0)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000600)={0x0, 0x0, 0xfd8b, 0x5}) r5 = syz_open_dev$video(&(0x7f0000000640), 0x101, 0xab02) ioctl$VIDIOC_S_CROP(r5, 0x4014563c, &(0x7f00000006c0)={0x9, {0xf8000002, 0x9, 0x8, 0xb}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000021c0)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1e, 0x9, 0x46d, 0xc082, 0x4, 0x0, "0600ff0901a1018510750895060901810209019102851175089513090181"}}, 0x136) 3.475406004s ago: executing program 4 (id=1855): socket$key(0xf, 0x3, 0x2) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000180)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x4, &(0x7f0000000280)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x12, 0x18}, [@ldst={0x4, 0x3, 0x5, 0x0, 0x2, 0x10, 0x1000000}]}, &(0x7f00000002c0)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000400), 0x8, 0x10, &(0x7f0000000440), 0x10}, 0x94) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000480)={0x97, 0xfd, 0x8, 0xfb, 0x5, 0x2, 0x0, 0x8, 0x5, 0x1, 0xd, 0xfd, 0x0, 0xac}, 0xe) sendmsg$inet6(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x4048043) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000700)='ip6gretap0\x00', 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)={0x14, 0x9, 0x6, 0x201}, 0x14}}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000d80), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) 2.753555584s ago: executing program 4 (id=1856): socketpair$tipc(0x1e, 0x1, 0x0, 0x0) quotactl_fd$Q_QUOTAOFF(0xffffffffffffffff, 0xffffffff80000300, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x30, 0x2, 0x3, 0x201, 0x0, 0x0, {0x0, 0x0, 0x5}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x100, 0x2}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x7d178ce}, @NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x28}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000040}, 0x8014) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000100)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, 0x0) mmap(&(0x7f00003ff000/0x1000)=nil, 0x1000, 0x8, 0xa012, r1, 0x80000000) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000440)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000480)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000004c0), 0x0, 0x0) read$msr(r5, &(0x7f0000005840)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r6, &(0x7f0000000540)="65486d795fe250efdeed7dda726561511574b9ff9be37786fe66e431205f2e7673", 0x21) 2.547535778s ago: executing program 0 (id=1857): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x5, 0x0, 0x5, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r0 = syz_io_uring_setup(0x111, &(0x7f0000000080)={0x0, 0x39c6, 0x2, 0x1, 0xfffffffe}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f00000001c0)='n', 0x1) io_pgetevents(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$kcm(0xa, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syslog(0x3, &(0x7f00000011c0)=""/4091, 0xffb) sendmmsg$inet6(r1, &(0x7f0000000380)=[{{&(0x7f00000003c0)={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x14}, 0x6}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000480)='Q', 0x1}], 0x1}}], 0x1, 0x4000840) shutdown(r1, 0x1) socket(0x10, 0x803, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket(0x1e, 0x1, 0x0) connect$tipc(r2, &(0x7f0000000240)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) recvmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/17, 0x11}, 0x8000}], 0x1, 0x2102, 0x0) write$binfmt_misc(r2, &(0x7f0000000300), 0x2000011a) timer_create(0x0, &(0x7f0000000400)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f00000005c0)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000600)={0x0, 0x0, 0xfd8b, 0x5}) r3 = syz_open_dev$video(&(0x7f0000000640), 0x101, 0xab02) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f0000000680)=0x1) ioctl$VIDIOC_S_CROP(r3, 0x4014563c, &(0x7f00000006c0)={0x9, {0xf8000002, 0x9, 0x8, 0xb}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000021c0)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x22, 0x9, 0x46d, 0xc082, 0x4, 0x0, "0600ff0901a101851075089506090181020901910285117508951309018102090191"}}, 0x13a) 312.362417ms ago: executing program 0 (id=1858): syz_usb_connect(0x5, 0x0, 0x0, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100), 0x28041, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x40003, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x40, 0x1, 0x200, "690694c400002c74f6024305f11fd3454ad23d00", 0x32314d48}) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000000180)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000406d0495c200000000000109022d00010000000109040010020300000009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\"'], 0x0}, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f00000000c0)=0x4081ff) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r4, 0x0) sendfile(r4, r4, 0x0, 0x1002000ff) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc008561c, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_VDPA_GET_DEVICE_ID(0xffffffffffffffff, 0x8004af70, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000013c0)=ANY=[@ANYBLOB="180000002600296bd90a834177b93508b8c3375b4247002d"], 0x18}, 0x1, 0x0, 0x0, 0x8c811}, 0x4040840) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003a00)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x1000, @private0, 0x80000001}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=[@dstopts={{0x14}}, @tclass={{0x10, 0x29, 0x43, 0x7}}, @rthdr_2292={{0x24, 0x29, 0x39, {0x6, 0x2, 0x2, 0x1, 0x0, [@empty]}}}], 0x48}}], 0x1, 0x8880) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r6, 0x80000) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r7, 0x0, 0xf3a, 0x0) 0s ago: executing program 2 (id=1859): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@gettfilter={0x24, 0x2e, 0x1, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0x7}, {0xe}, {0x0, 0xfff2}}}, 0x24}}, 0x40000d0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(r2, 0x24, &(0x7f0000000600)={0x1, 0x0, 0x7, 0x800005fffffffffe}) write$binfmt_script(r3, &(0x7f00000006c0), 0x208e24b) preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000740)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000800)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000840)={0x0, 0x18, 0x0}, 0x0) r5 = fsopen(&(0x7f00000002c0)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000300)='test_dummy_encryption', &(0x7f0000000340)='v8\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r6, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000a00)="a6", 0x5dc}], 0x2b}}], 0x5, 0x4040000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0xfffffffffffffffa) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f00000004c0)={0x2, 0x0, 0x81, 0x10001, @vifc_lcl_addr=@rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) kernel console output (not intermixed with test programs): .770591][T12622] writeback 0 [ 990.770639][T12622] workingset_refault_anon 179 [ 990.770647][T12622] workingset_refault_file 229 [ 990.770654][T12622] swap 89726976 [ 990.770661][T12622] swapcached 20480 [ 990.770667][T12622] pgpgin 955576 [ 990.770680][T12622] pgpgout 879432 [ 990.770686][T12622] pgfault 339575 [ 990.770692][T12622] pgmajfault 168 [ 990.770699][T12622] inactive_anon 311435264 [ 990.770705][T12622] active_anon 450560 [ 990.770708][T12622] inactive_file 0 [ 990.770712][T12622] active_file 0 [ 990.770715][T12622] unevictable 0 [ 990.770718][T12622] hierarchical_memory_limit 314572800 [ 990.770722][T12622] hierarchical_memsw_limit 9223372036854771712 [ 990.770726][T12622] total_cache 311517184 [ 990.770730][T12622] total_rss 348160 [ 990.770733][T12622] total_shmem 311517184 [ 990.770739][T12622] total_mapped_file 181563392 [ 990.770745][T12622] total_dirty 0 [ 990.770751][T12622] total_writeback 0 [ 990.770757][T12622] total_workingset_refault_anon 179 [ 990.770764][T12622] total_workingset_refault_file 229 [ 990.770812][T12622] total_swap 89726976 [ 990.770819][T12622] total_swapcached 20480 [ 990.770826][T12622] total_pgpgin 955576 [ 990.770832][T12622] total_pgpgout 879432 [ 990.770839][T12622] total_pgfault 339575 [ 990.770845][T12622] total_pgmajfault 168 [ 990.770852][T12622] total_inactive_anon 311435264 [ 990.770859][T12622] total_active_anon 450560 [ 990.770865][T12622] total_inactive_file 0 [ 990.770872][T12622] total_active_file 0 [ 990.770877][T12622] total_unevictable 0 [ 990.770880][T12622] anon_cost 9646 [ 990.770883][T12622] file_cost 3170 [ 990.770887][T12622] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1536,pid=11993,uid=0 [ 991.166526][T12622] Memory cgroup out of memory: Killed process 11993 (syz.0.1536) total-vm:202900kB, anon-rss:1296kB, file-rss:20548kB, shmem-rss:90152kB, UID:0 pgtables:292kB oom_score_adj:1000 [ 991.265580][T11231] Bluetooth: hci6: command tx timeout [ 991.269096][T11188] usb 3-1: 1:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 991.269114][T11188] usb 3-1: found format II with max.bitrate = 8, frame size=9 [ 991.269124][T11188] usb 3-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 991.279296][T11188] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 991.664507][T12057] syz.0.1546 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 991.664854][T12057] CPU: 1 UID: 0 PID: 12057 Comm: syz.0.1546 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 991.664869][T12057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 991.664876][T12057] Call Trace: [ 991.664880][T12057] [ 991.664885][T12057] dump_stack_lvl+0xe8/0x150 [ 991.664906][T12057] dump_header+0xd3/0x4b0 [ 991.664922][T12057] oom_kill_process+0x3ab/0x9e0 [ 991.664937][T12057] out_of_memory+0xfb1/0x13b0 [ 991.664954][T12057] ? lock_acquire+0x232/0x350 [ 991.664969][T12057] ? __pfx_out_of_memory+0x10/0x10 [ 991.664986][T12057] ? _mutex_lock_killable+0x15e/0x1c0 [ 991.665000][T12057] ? try_charge_memcg+0xa9e/0x1760 [ 991.665014][T12057] try_charge_memcg+0xb75/0x1760 [ 991.665025][T12057] ? __lock_acquire+0x747/0x2de0 [ 991.665048][T12057] ? __pfx_try_charge_memcg+0x10/0x10 [ 991.665057][T12057] ? lock_acquire+0x115/0x350 [ 991.665081][T12057] ? charge_memcg+0x47/0x310 [ 991.665093][T12057] charge_memcg+0x1dd/0x310 [ 991.665105][T12057] __mem_cgroup_charge+0x25/0x80 [ 991.665116][T12057] shmem_get_folio_gfp+0x781/0x17b0 [ 991.665142][T12057] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 991.665159][T12057] shmem_write_begin+0x166/0x320 [ 991.665175][T12057] generic_perform_write+0x2ad/0x8a0 [ 991.665194][T12057] ? __pfx_generic_perform_write+0x10/0x10 [ 991.665205][T12057] ? generic_write_checks_count+0x426/0x530 [ 991.665252][T12057] ? file_update_time_flags+0x2db/0x450 [ 991.665264][T12057] shmem_file_write_iter+0xfb/0x120 [ 991.665280][T12057] __kernel_write_iter+0x453/0x8f0 [ 991.665298][T12057] ? __pfx___kernel_write_iter+0x10/0x10 [ 991.665316][T12057] ? __asan_memset+0x22/0x50 [ 991.665330][T12057] ? iov_iter_bvec+0xb8/0x180 [ 991.665346][T12057] dump_user_range+0x715/0xca0 [ 991.665378][T12057] ? __pfx_dump_user_range+0x10/0x10 [ 991.665400][T12057] ? __pfx_writenote+0x10/0x10 [ 991.665420][T12057] ? __kmalloc_cache_noprof+0x3d0/0x670 [ 991.665436][T12057] ? elf_core_dump+0x28d0/0x3a70 [ 991.665461][T12057] elf_core_dump+0x346a/0x3a70 [ 991.665501][T12057] ? __pfx_elf_core_dump+0x10/0x10 [ 991.665522][T12057] ? __lock_acquire+0x747/0x2de0 [ 991.665548][T12057] ? arch_do_signal_or_restart+0xbb/0x860 [ 991.665632][T12057] ? lock_acquire+0x115/0x350 [ 991.665658][T12057] ? 0xffffffffff600000 [ 991.665688][T12057] do_coredump+0x5ee3/0x6a80 [ 991.665739][T12057] ? __pfx_do_coredump+0x10/0x10 [ 991.665758][T12057] ? __schedule+0x1733/0x56f0 [ 991.665785][T12057] ? __lock_acquire+0x747/0x2de0 [ 991.665827][T12057] ? __lock_acquire+0x747/0x2de0 [ 991.665862][T12057] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 991.665887][T12057] ? lock_acquire+0x115/0x350 [ 991.665918][T12057] ? is_bpf_text_address+0x26/0x2b0 [ 991.665955][T12057] ? is_bpf_text_address+0x292/0x2b0 [ 991.665981][T12057] ? is_bpf_text_address+0x26/0x2b0 [ 991.666005][T12057] ? kernel_text_address+0xa5/0xe0 [ 991.666028][T12057] ? __kernel_text_address+0xd/0x30 [ 991.666049][T12057] ? unwind_get_return_address+0x4d/0x90 [ 991.666072][T12057] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 991.666098][T12057] ? arch_stack_walk+0xfb/0x150 [ 991.666131][T12057] ? stack_trace_save+0xa9/0x100 [ 991.666161][T12057] ? try_to_take_rt_mutex+0x842/0xb00 [ 991.666191][T12057] ? __lock_acquire+0x747/0x2de0 [ 991.666226][T12057] ? __lock_acquire+0x747/0x2de0 [ 991.666261][T12057] ? do_raw_spin_lock+0x12b/0x2f0 [ 991.666307][T12057] ? reacquire_held_locks+0x117/0x1a0 [ 991.666326][T12057] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 991.666357][T12057] ? rt_spin_unlock+0x159/0x200 [ 991.666384][T12057] ? rt_spin_unlock+0x165/0x200 [ 991.666408][T12057] vfs_coredump+0xac3/0x10c0 [ 991.666443][T12057] ? __pfx_vfs_coredump+0x10/0x10 [ 991.666466][T12057] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 991.666483][T12057] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 991.666491][T11188] usb 3-1: USB disconnect, device number 49 [ 991.666519][T12057] ? rt_spin_unlock+0x159/0x200 [ 991.666543][T12057] ? rt_spin_unlock+0x165/0x200 [ 991.666567][T12057] get_signal+0x1090/0x12c0 [ 991.666611][T12057] arch_do_signal_or_restart+0xbb/0x860 [ 991.666634][T12057] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 991.666669][T12057] irqentry_exit+0x348/0x9b0 [ 991.666680][T12057] ? trace_irq_disable+0x3b/0x140 [ 991.666693][T12057] asm_exc_page_fault+0x26/0x30 [ 991.666704][T12057] RIP: 0033:0x0 [ 991.666713][T12057] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 991.666719][T12057] RSP: 002b:00002000000001c8 EFLAGS: 00010217 [ 991.666729][T12057] RAX: 0000000000000000 RBX: 00007f9e32925fa0 RCX: 00007f9e3269f559 [ 991.666736][T12057] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000020000 [ 991.666743][T12057] RBP: 00007f9e32736b20 R08: 0000000000000000 R09: 0000000000000000 [ 991.666749][T12057] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 991.666757][T12057] R13: 00007f9e32926038 R14: 00007f9e32925fa0 R15: 00007ffdd9128bb8 [ 991.666785][T12057] [ 991.954580][T12057] memory: usage 307200kB, limit 307200kB, failcnt 14913 [ 991.954602][T12057] memory+swap: usage 394824kB, limit 9007199254740988kB, failcnt 0 [ 991.954609][T12057] kmem: usage 2624kB, limit 9007199254740988kB, failcnt 0 [ 991.954616][T12057] Memory cgroup stats for /syz0: [ 992.241022][T12057] cache 311517184 [ 992.241034][T12057] rss 348160 [ 992.241038][T12057] shmem 311517184 [ 992.241041][T12057] mapped_file 141922304 [ 992.241253][T12057] dirty 0 [ 992.241260][T12057] writeback 0 [ 992.241266][T12057] workingset_refault_anon 179 [ 992.241273][T12057] workingset_refault_file 229 [ 992.241279][T12057] swap 89726976 [ 992.241285][T12057] swapcached 20480 [ 992.241288][T12057] pgpgin 955576 [ 992.241291][T12057] pgpgout 879432 [ 992.241295][T12057] pgfault 339575 [ 992.241298][T12057] pgmajfault 168 [ 992.241301][T12057] inactive_anon 311435264 [ 992.241305][T12057] active_anon 450560 [ 992.241308][T12057] inactive_file 0 [ 992.241311][T12057] active_file 0 [ 992.241314][T12057] unevictable 0 [ 992.241318][T12057] hierarchical_memory_limit 314572800 [ 992.241322][T12057] hierarchical_memsw_limit 9223372036854771712 [ 992.241325][T12057] total_cache 311517184 [ 992.241329][T12057] total_rss 348160 [ 992.241332][T12057] total_shmem 311517184 [ 992.241335][T12057] total_mapped_file 141922304 [ 992.241339][T12057] total_dirty 0 [ 992.241342][T12057] total_writeback 0 [ 992.241365][T12057] total_workingset_refault_anon 179 [ 992.241369][T12057] total_workingset_refault_file 229 [ 992.241372][T12057] total_swap 89726976 [ 992.241376][T12057] total_swapcached 20480 [ 992.241379][T12057] total_pgpgin 955576 [ 992.241383][T12057] total_pgpgout 879432 [ 992.241386][T12057] total_pgfault 339575 [ 992.241389][T12057] total_pgmajfault 168 [ 992.241393][T12057] total_inactive_anon 311435264 [ 992.241396][T12057] total_active_anon 450560 [ 992.241400][T12057] total_inactive_file 0 [ 992.241403][T12057] total_active_file 0 [ 992.241406][T12057] total_unevictable 0 [ 992.241409][T12057] anon_cost 9646 [ 992.241412][T12057] file_cost 3170 [ 992.241417][T12057] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1546,pid=12057,uid=0 [ 992.593596][T12057] Memory cgroup out of memory: Killed process 12057 (syz.0.1546) total-vm:202768kB, anon-rss:1304kB, file-rss:20548kB, shmem-rss:87156kB, UID:0 pgtables:280kB oom_score_adj:1000 [ 992.794404][T12428] udevd[12428]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 993.208231][ T39] oom_reaper: reaped process 11993 (syz.0.1536), now anon-rss:0kB, file-rss:3036kB, shmem-rss:0kB [ 993.626232][ T5888] usb 3-1: new full-speed USB device number 50 using dummy_hcd [ 993.855808][ T5888] usb 3-1: unable to get BOS descriptor or descriptor too short [ 993.857062][ T5888] usb 3-1: not running at top speed; connect to a high speed hub [ 993.857087][ T5888] usb 3-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 993.950620][ T5888] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 993.950639][ T5888] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 993.950649][ T5888] usb 3-1: config 14 has no interface number 0 [ 993.950669][ T5888] usb 3-1: config 14 has no interface number 1 [ 993.950710][ T5888] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 993.950722][ T5888] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 993.950735][ T5888] usb 3-1: config 14 interface 228 altsetting 5 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 993.950748][ T5888] usb 3-1: config 14 interface 57 has no altsetting 0 [ 993.950757][ T5888] usb 3-1: config 14 interface 228 has no altsetting 0 [ 993.968325][ T5888] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 993.968344][ T5888] usb 3-1: Product: syz [ 993.968351][ T5888] usb 3-1: Manufacturer: syz [ 993.968358][ T5888] usb 3-1: SerialNumber: syz [ 994.540378][ T5888] legousbtower 3-1:14.57: interrupt endpoints not found [ 994.753099][ T5888] legousbtower 3-1:14.228: interrupt endpoints not found [ 996.180900][T12558] bridge0: port 1(bridge_slave_0) entered blocking state [ 996.181119][T12558] bridge0: port 1(bridge_slave_0) entered disabled state [ 996.181265][T12558] bridge_slave_0: entered allmulticast mode [ 996.205149][T12558] bridge_slave_0: entered promiscuous mode [ 996.264871][T12558] bridge0: port 2(bridge_slave_1) entered blocking state [ 996.264942][T12558] bridge0: port 2(bridge_slave_1) entered disabled state [ 996.265077][T12558] bridge_slave_1: entered allmulticast mode [ 996.268800][T12558] bridge_slave_1: entered promiscuous mode [ 996.420256][ T9] usb 3-1: USB disconnect, device number 50 [ 996.986504][ T8384] bridge_slave_1: left allmulticast mode [ 996.986531][ T8384] bridge_slave_1: left promiscuous mode [ 996.986702][ T8384] bridge0: port 2(bridge_slave_1) entered disabled state [ 997.065745][ T5888] usb 1-1: new full-speed USB device number 50 using dummy_hcd [ 997.248191][ T5888] usb 1-1: unable to get BOS descriptor or descriptor too short [ 997.248762][ T5888] usb 1-1: not running at top speed; connect to a high speed hub [ 997.248786][ T5888] usb 1-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 997.283572][ T5888] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 997.283601][ T5888] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 997.283619][ T5888] usb 1-1: config 14 has no interface number 0 [ 997.283634][ T5888] usb 1-1: config 14 has no interface number 1 [ 997.283691][ T5888] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 997.283703][ T5888] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 997.283715][ T5888] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 997.283728][ T5888] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 997.283741][ T5888] usb 1-1: config 14 interface 57 has no altsetting 0 [ 997.283750][ T5888] usb 1-1: config 14 interface 228 has no altsetting 0 [ 997.384404][ T5888] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 997.384421][ T5888] usb 1-1: Product: syz [ 997.384429][ T5888] usb 1-1: Manufacturer: syz [ 997.384436][ T5888] usb 1-1: SerialNumber: syz [ 997.415303][ T8384] bridge_slave_0: left allmulticast mode [ 997.415351][ T8384] bridge_slave_0: left promiscuous mode [ 997.415923][ T8384] bridge0: port 1(bridge_slave_0) entered disabled state [ 998.041819][ T5888] legousbtower 1-1:14.57: interrupt endpoints not found [ 998.514187][ T5888] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 998.536097][ T5888] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 999.416084][ T203] usb 1-1: USB disconnect, device number 50 [ 999.509713][ T203] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 999.684091][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 999.684160][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 1000.808716][ T8384] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1000.907394][ T8384] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1000.965752][ T8384] bond0 (unregistering): Released all slaves [ 1001.038608][T12558] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1001.317670][T12558] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1001.592504][T12558] team0: Port device team_slave_0 added [ 1001.631325][T12558] team0: Port device team_slave_1 added [ 1001.644746][T12576] bridge0: port 1(bridge_slave_0) entered blocking state [ 1001.644956][T12576] bridge0: port 1(bridge_slave_0) entered disabled state [ 1001.645148][T12576] bridge_slave_0: entered allmulticast mode [ 1001.748544][T12576] bridge_slave_0: entered promiscuous mode [ 1002.072279][T12576] bridge0: port 2(bridge_slave_1) entered blocking state [ 1002.072395][T12576] bridge0: port 2(bridge_slave_1) entered disabled state [ 1002.072596][T12576] bridge_slave_1: entered allmulticast mode [ 1002.093242][T12576] bridge_slave_1: entered promiscuous mode [ 1002.453678][T12558] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1002.453691][T12558] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1002.453705][T12558] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1002.653859][T12558] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1002.653881][T12558] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1002.653896][T12558] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1002.755828][ T5743] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 1002.903282][ T8384] hsr_slave_0: left promiscuous mode [ 1002.915683][ T5743] usb 3-1: Using ep0 maxpacket: 16 [ 1002.919200][ T5743] usb 3-1: New USB device found: idVendor=249c, idProduct=9006, bcdDevice=0.40 [ 1002.925778][ T8384] hsr_slave_1: left promiscuous mode [ 1002.950794][ T8384] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1002.950815][ T8384] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1002.978145][ T8384] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1002.978164][ T8384] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1002.983454][ T5743] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1002.983482][ T5743] usb 3-1: Product: љ [ 1002.983495][ T5743] usb 3-1: Manufacturer: ⊲蹂쑔竳⃇뒋ԡ从鳻蛣귰喡霨礡茝奰㬣㍀⏖ᤗ鸵⩄劘앢蒊͑᣻솚୑뚋율梙춆千깃牥곤ꡟ᫵ꬩ㒍솆腬 [ 1002.983514][ T5743] usb 3-1: SerialNumber: syz [ 1003.187882][ T8384] veth1_macvtap: left promiscuous mode [ 1003.187988][ T8384] veth0_macvtap: left promiscuous mode [ 1003.188209][ T8384] veth1_vlan: left promiscuous mode [ 1003.188347][ T8384] veth0_vlan: left promiscuous mode [ 1003.560792][ T5743] usb 3-1: 1:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1003.560809][ T5743] usb 3-1: found format II with max.bitrate = 8, frame size=9 [ 1003.560818][ T5743] usb 3-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 1003.561413][ T5743] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1003.837782][ T5743] usb 3-1: USB disconnect, device number 51 [ 1004.136407][T12428] udevd[12428]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1004.895821][ T5743] usb 3-1: new full-speed USB device number 52 using dummy_hcd [ 1005.047949][ T5743] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1005.048620][ T5743] usb 3-1: not running at top speed; connect to a high speed hub [ 1005.048652][ T5743] usb 3-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1005.082791][ T5743] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 1005.082810][ T5743] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 1005.082820][ T5743] usb 3-1: config 14 has no interface number 0 [ 1005.082828][ T5743] usb 3-1: config 14 has no interface number 1 [ 1005.082881][ T5743] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1005.082895][ T5743] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1005.082907][ T5743] usb 3-1: config 14 interface 228 altsetting 5 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1005.082920][ T5743] usb 3-1: config 14 interface 57 has no altsetting 0 [ 1005.082929][ T5743] usb 3-1: config 14 interface 228 has no altsetting 0 [ 1005.186697][ T5743] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1005.186725][ T5743] usb 3-1: Product: syz [ 1005.186738][ T5743] usb 3-1: Manufacturer: syz [ 1005.186752][ T5743] usb 3-1: SerialNumber: syz [ 1005.682609][ T5743] legousbtower 3-1:14.57: interrupt endpoints not found [ 1005.899360][ T5743] legousbtower 3-1:14.228: interrupt endpoints not found [ 1006.116952][ T8384] team0 (unregistering): Port device team_slave_1 removed [ 1006.197612][ T8384] team0 (unregistering): Port device team_slave_0 removed [ 1006.537548][T12699] ptp ptp0: guarantee physical clock free running [ 1007.635606][ T203] usb 3-1: USB disconnect, device number 52 [ 1008.122183][T12706] input: syz1 as /devices/virtual/input/input63 [ 1008.434010][T12576] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1008.495240][T12576] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1008.899477][T12558] hsr_slave_0: entered promiscuous mode [ 1009.000087][T12558] hsr_slave_1: entered promiscuous mode [ 1009.000981][T12558] debugfs: 'hsr0' already exists in 'hsr' [ 1009.001004][T12558] Cannot create hsr debugfs directory [ 1009.004844][T12576] team0: Port device team_slave_0 added [ 1009.037918][T12576] team0: Port device team_slave_1 added [ 1009.469496][T12576] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1009.469508][T12576] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1009.469521][T12576] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1009.507372][T12576] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1009.507390][T12576] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1009.507415][T12576] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1010.648748][T12576] hsr_slave_0: entered promiscuous mode [ 1010.672699][T12576] hsr_slave_1: entered promiscuous mode [ 1010.674994][T12576] debugfs: 'hsr0' already exists in 'hsr' [ 1010.675016][T12576] Cannot create hsr debugfs directory [ 1012.058832][ T5266] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1012.129922][T12736] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1013.553805][ T8384] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1014.619402][ T5785] usb 5-1: new full-speed USB device number 50 using dummy_hcd [ 1014.809026][ T5785] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1014.809817][ T5785] usb 5-1: not running at top speed; connect to a high speed hub [ 1014.809845][ T5785] usb 5-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1014.815073][ T5785] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 1014.815091][ T5785] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 1014.815102][ T5785] usb 5-1: config 14 has no interface number 0 [ 1014.815119][ T5785] usb 5-1: config 14 has no interface number 1 [ 1014.815173][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1014.815192][ T5785] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1014.815205][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1014.815218][ T5785] usb 5-1: config 14 interface 57 has no altsetting 0 [ 1014.815228][ T5785] usb 5-1: config 14 interface 228 has no altsetting 0 [ 1014.940745][ T5785] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1014.940764][ T5785] usb 5-1: Product: syz [ 1014.940771][ T5785] usb 5-1: Manufacturer: syz [ 1014.940779][ T5785] usb 5-1: SerialNumber: syz [ 1015.620287][ T5785] legousbtower 5-1:14.57: interrupt endpoints not found [ 1015.879398][ T5785] legousbtower 5-1:14.228: interrupt endpoints not found [ 1016.347763][ T8384] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1016.801398][ T5266] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1017.142515][T12776] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1017.210871][ T9] usb 5-1: USB disconnect, device number 50 [ 1017.429792][ T8384] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1018.036949][ T9] usb 1-1: new full-speed USB device number 51 using dummy_hcd [ 1018.410761][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1018.413294][ T9] usb 1-1: not running at top speed; connect to a high speed hub [ 1018.413333][ T9] usb 1-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1018.416962][ T9] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 1018.416978][ T9] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 1018.416988][ T9] usb 1-1: config 14 has no interface number 0 [ 1018.416996][ T9] usb 1-1: config 14 has no interface number 1 [ 1018.417035][ T9] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1018.417047][ T9] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1018.417059][ T9] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1018.417073][ T9] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1018.417085][ T9] usb 1-1: config 14 interface 57 has no altsetting 0 [ 1018.417094][ T9] usb 1-1: config 14 interface 228 has no altsetting 0 [ 1018.422253][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1018.422279][ T9] usb 1-1: Product: syz [ 1018.422291][ T9] usb 1-1: Manufacturer: syz [ 1018.422302][ T9] usb 1-1: SerialNumber: syz [ 1018.881537][ T9] legousbtower 1-1:14.57: interrupt endpoints not found [ 1019.266650][ T9] legousbtower 1-1:14.228: get version request failed: -32 [ 1019.266821][ T9] legousbtower 1-1:14.228: probe with driver legousbtower failed with error -32 [ 1019.744812][ T8384] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1021.066415][ T5743] usb 1-1: USB disconnect, device number 51 [ 1022.945759][ T203] usb 1-1: new full-speed USB device number 52 using dummy_hcd [ 1022.955601][ T9] usb 5-1: new full-speed USB device number 51 using dummy_hcd [ 1023.108970][ T203] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1023.109836][ T203] usb 1-1: not running at top speed; connect to a high speed hub [ 1023.109860][ T203] usb 1-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1023.110877][ T203] usb 1-1: config 14 has an invalid interface number: 228 but max is 0 [ 1023.110892][ T203] usb 1-1: config 14 has no interface number 0 [ 1023.110917][ T203] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 1023.110931][ T203] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1023.110944][ T203] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1023.110957][ T203] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1023.110969][ T203] usb 1-1: config 14 interface 228 has no altsetting 0 [ 1023.113566][ T203] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1023.113585][ T203] usb 1-1: Product: syz [ 1023.113593][ T203] usb 1-1: Manufacturer: syz [ 1023.113600][ T203] usb 1-1: SerialNumber: syz [ 1023.242632][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1023.243197][ T9] usb 5-1: not running at top speed; connect to a high speed hub [ 1023.243219][ T9] usb 5-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1023.244369][ T9] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 1023.244391][ T9] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 1023.244409][ T9] usb 5-1: config 14 has no interface number 0 [ 1023.244424][ T9] usb 5-1: config 14 has no interface number 1 [ 1023.244490][ T9] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1023.244511][ T9] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1023.244534][ T9] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1023.244559][ T9] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1023.244589][ T9] usb 5-1: config 14 interface 57 has no altsetting 0 [ 1023.244603][ T9] usb 5-1: config 14 interface 228 has no altsetting 0 [ 1023.380618][T12840] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1023.387979][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1023.387996][ T9] usb 5-1: Product: syz [ 1023.388013][ T9] usb 5-1: Manufacturer: syz [ 1023.388021][ T9] usb 5-1: SerialNumber: syz [ 1023.839335][ T203] legousbtower 1-1:14.228: interrupt endpoints not found [ 1023.891476][ T9] legousbtower 5-1:14.57: interrupt endpoints not found [ 1024.293727][ T8384] bridge_slave_1: left allmulticast mode [ 1024.293762][ T8384] bridge_slave_1: left promiscuous mode [ 1024.294021][ T8384] bridge0: port 2(bridge_slave_1) entered disabled state [ 1024.358479][ T9] legousbtower 5-1:14.228: get version request failed: -121 [ 1024.358588][ T9] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -121 [ 1024.521208][ T8384] bridge_slave_0: left allmulticast mode [ 1024.521233][ T8384] bridge_slave_0: left promiscuous mode [ 1024.521385][ T8384] bridge0: port 1(bridge_slave_0) entered disabled state [ 1025.744269][ T203] usb 1-1: USB disconnect, device number 52 [ 1026.266134][ T203] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 1026.322636][ T5887] usb 5-1: USB disconnect, device number 51 [ 1026.425541][ T203] usb 1-1: Using ep0 maxpacket: 32 [ 1026.457469][ T203] usb 1-1: New USB device found: idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1026.460094][ T203] usb 1-1: config index 0 descriptor too short (expected 19, got 18) [ 1026.460120][ T203] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1026.496578][ T203] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1026.496605][ T203] usb 1-1: Product: syz [ 1026.496618][ T203] usb 1-1: Manufacturer: syz [ 1026.496631][ T203] usb 1-1: SerialNumber: syz [ 1026.504114][ T203] usb 1-1: config 0 descriptor?? [ 1026.746740][ T203] usb 1-1: USB disconnect, device number 53 [ 1026.976310][ T8384] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1027.070134][ T8384] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1027.116048][ T8384] bond0 (unregistering): Released all slaves [ 1029.253849][ T8384] hsr_slave_0: left promiscuous mode [ 1029.288933][ T8384] hsr_slave_1: left promiscuous mode [ 1029.293223][ T8384] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1029.293241][ T8384] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1029.329568][ T8384] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1029.329594][ T8384] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1029.485582][ T8384] veth1_macvtap: left promiscuous mode [ 1029.485673][ T8384] veth0_macvtap: left promiscuous mode [ 1029.485833][ T8384] veth1_vlan: left promiscuous mode [ 1029.485936][ T8384] veth0_vlan: left promiscuous mode [ 1030.138202][ T9] usb 5-1: new full-speed USB device number 52 using dummy_hcd [ 1030.309850][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1030.321523][ T9] usb 5-1: not running at top speed; connect to a high speed hub [ 1030.321551][ T9] usb 5-1: New USB device found: idVendor=0846, idProduct=1001, bcdDevice=e0.47 [ 1030.356787][ T9] usb 5-1: config 133 has an invalid interface number: 109 but max is 0 [ 1030.356805][ T9] usb 5-1: config 133 has no interface number 0 [ 1030.356832][ T9] usb 5-1: config 133 interface 109 altsetting 3 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 1030.356846][ T9] usb 5-1: config 133 interface 109 has no altsetting 0 [ 1030.405267][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1030.405285][ T9] usb 5-1: Product: syz [ 1030.405292][ T9] usb 5-1: Manufacturer: syz [ 1030.405300][ T9] usb 5-1: SerialNumber: syz [ 1032.368238][T12925] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1032.540018][ T9] kaweth 5-1:133.109: couldn't find required endpoints [ 1032.564847][ T9] usb 5-1: USB disconnect, device number 52 [ 1033.038175][ T8384] team0 (unregistering): Port device team_slave_1 removed [ 1033.106497][ T8384] team0 (unregistering): Port device team_slave_0 removed [ 1033.287288][ T5266] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1034.004836][ T203] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 1034.175577][ T203] usb 5-1: Using ep0 maxpacket: 32 [ 1034.177238][ T203] usb 5-1: New USB device found: idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1034.178770][ T203] usb 5-1: config index 0 descriptor too short (expected 19, got 18) [ 1034.180975][ T203] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.180998][ T203] usb 5-1: Product: syz [ 1034.181006][ T203] usb 5-1: Manufacturer: syz [ 1034.181013][ T203] usb 5-1: SerialNumber: syz [ 1034.183969][ T203] usb 5-1: config 0 descriptor?? [ 1034.246807][ T203] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1034.246839][ T203] dvb-usb: bulk message failed: -22 (2/0) [ 1034.251770][ T203] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1034.252477][ T203] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1034.252531][ T203] usb 5-1: media controller created [ 1034.370670][ T203] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1034.427135][ T203] usb 5-1: selecting invalid altsetting 7 [ 1034.427157][ T203] cxusb: set interface failed [ 1034.427170][ T203] dvb-usb: bulk message failed: -22 (1/0) [ 1034.533473][ T203] DVB: Unable to find symbol lgdt330x_attach() [ 1034.533484][ T203] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1034.745561][ T203] rc_core: IR keymap rc-dvico-portable not found [ 1034.745583][ T203] Registered IR keymap rc-empty [ 1034.779802][ T203] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 1034.811133][ T203] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input64 [ 1034.841047][ T203] dvb-usb: schedule remote query interval to 100 msecs. [ 1034.841639][ T203] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1034.869548][ T203] usb 5-1: USB disconnect, device number 53 [ 1035.328963][ T203] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1038.555706][ T5743] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 1038.726560][ T5743] usb 3-1: New USB device found: idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 1038.748166][ T5743] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1038.748191][ T5743] usb 3-1: Product: syz [ 1038.748200][ T5743] usb 3-1: Manufacturer: syz [ 1038.748207][ T5743] usb 3-1: SerialNumber: syz [ 1038.781954][ T5743] usb 3-1: config 0 descriptor?? [ 1038.814691][ T5743] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 1038.841207][ T5743] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1038.846863][ T5743] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 1038.846914][ T5743] usb 3-1: media controller created [ 1038.919840][ T5743] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1039.147378][ T5743] DVB: Unable to find symbol mt352_attach() [ 1039.316847][ T5743] DVB: Unable to find symbol nxt6000_attach() [ 1039.316863][ T5743] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 1039.342397][ T5743] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input65 [ 1039.371867][ T5743] dvb-usb: schedule remote query interval to 1000 msecs. [ 1039.371891][ T5743] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 1039.371906][ T5743] dvb-usb: bulk message failed: -22 (7/0) [ 1039.371919][ T5743] dvb-usb: bulk message failed: -22 (7/0) [ 1039.410254][ T5743] usb 3-1: USB disconnect, device number 53 [ 1039.920848][ T5743] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 1040.565188][T11669] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1040.587179][T11669] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1040.597339][T11669] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1040.623865][T11669] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1040.724105][T11669] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1042.023821][T11231] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1042.060861][T11231] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1042.091550][T11231] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1042.102642][T11231] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1042.104905][T11231] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1042.945602][T11669] Bluetooth: hci2: command tx timeout [ 1043.147466][T12996] rxe_eth0 speed is unknown, defaulting to 1000 [ 1043.750687][T13031] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1044.108894][T13035] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1044.145844][T11669] Bluetooth: hci3: command tx timeout [ 1045.026054][T11669] Bluetooth: hci2: command tx timeout [ 1045.675639][ T203] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 1045.831370][ T203] usb 3-1: New USB device found: idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 1045.861753][ T203] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1045.861770][ T203] usb 3-1: Product: syz [ 1045.861778][ T203] usb 3-1: Manufacturer: syz [ 1045.861785][ T203] usb 3-1: SerialNumber: syz [ 1045.885686][ T9] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 1045.919271][ T203] usb 3-1: config 0 descriptor?? [ 1045.954234][ T203] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 1046.023547][T13013] rxe_eth0 speed is unknown, defaulting to 1000 [ 1046.034542][ T203] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1046.035671][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 1046.038796][ T9] usb 5-1: New USB device found: idVendor=249c, idProduct=9006, bcdDevice=0.40 [ 1046.070595][ T203] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 1046.070675][ T203] usb 3-1: media controller created [ 1046.111748][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1046.111765][ T9] usb 5-1: Product: љ [ 1046.111772][ T9] usb 5-1: Manufacturer: ⊲蹂쑔竳⃇뒋ԡ从鳻蛣귰喡霨礡茝奰㬣㍀⏖ᤗ鸵⩄劘앢蒊͑᣻솚୑뚋율梙춆千깃牥곤ꡟ᫵ꬩ㒍솆腬 [ 1046.111782][ T9] usb 5-1: SerialNumber: syz [ 1046.225582][T11669] Bluetooth: hci3: command tx timeout [ 1046.661161][ T203] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1047.105615][T11669] Bluetooth: hci2: command tx timeout [ 1047.262994][ T203] DVB: Unable to find symbol mt352_attach() [ 1047.268510][ T9] usb 5-1: 1:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1047.268534][ T9] usb 5-1: found format II with max.bitrate = 8, frame size=9 [ 1047.268549][ T9] usb 5-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 1047.268976][ T9] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1047.465553][ T5785] usb 1-1: new full-speed USB device number 54 using dummy_hcd [ 1047.559686][ T203] DVB: Unable to find symbol nxt6000_attach() [ 1047.559700][ T203] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 1047.596928][ T203] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input66 [ 1047.648313][ T5785] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1047.648827][ T5785] usb 1-1: not running at top speed; connect to a high speed hub [ 1047.648850][ T5785] usb 1-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1047.651134][ T5785] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 1047.651158][ T5785] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 1047.651175][ T5785] usb 1-1: config 14 has no interface number 0 [ 1047.651190][ T5785] usb 1-1: config 14 has no interface number 1 [ 1047.651258][ T5785] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1047.651280][ T5785] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1047.651303][ T5785] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1047.651328][ T5785] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1047.651351][ T5785] usb 1-1: config 14 interface 57 has no altsetting 0 [ 1047.651368][ T5785] usb 1-1: config 14 interface 228 has no altsetting 0 [ 1047.776656][ T5785] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1047.776681][ T5785] usb 1-1: Product: syz [ 1047.776694][ T5785] usb 1-1: Manufacturer: syz [ 1047.776705][ T5785] usb 1-1: SerialNumber: syz [ 1047.840710][ T203] dvb-usb: schedule remote query interval to 1000 msecs. [ 1047.840736][ T203] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 1047.840751][ T203] dvb-usb: bulk message failed: -22 (7/0) [ 1047.840766][ T203] dvb-usb: bulk message failed: -22 (7/0) [ 1047.939043][ T203] usb 3-1: USB disconnect, device number 54 [ 1048.305642][T11669] Bluetooth: hci3: command tx timeout [ 1048.308558][ T9] usb 5-1: USB disconnect, device number 54 [ 1048.580426][ T5785] legousbtower 1-1:14.57: interrupt endpoints not found [ 1049.022691][ T5785] legousbtower 1-1:14.228: get version request failed: -121 [ 1049.022805][ T5785] legousbtower 1-1:14.228: probe with driver legousbtower failed with error -121 [ 1049.185734][T11669] Bluetooth: hci2: command tx timeout [ 1049.453941][ T5785] usb 1-1: USB disconnect, device number 54 [ 1049.511725][ T203] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 1050.387320][T11669] Bluetooth: hci3: command tx timeout [ 1050.688565][ T9] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 1053.559330][T11188] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1053.636876][ T5785] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 1053.754075][T11188] usb 5-1: New USB device found: idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 1053.845622][ T5785] usb 1-1: Using ep0 maxpacket: 16 [ 1053.873214][ T5785] usb 1-1: New USB device found: idVendor=249c, idProduct=9006, bcdDevice=0.40 [ 1053.954238][ T5785] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1053.954257][ T5785] usb 1-1: Product: љ [ 1053.954264][ T5785] usb 1-1: Manufacturer: ⊲蹂쑔竳⃇뒋ԡ从鳻蛣귰喡霨礡茝奰㬣㍀⏖ᤗ鸵⩄劘앢蒊͑᣻솚୑뚋율梙춆千깃牥곤ꡟ᫵ꬩ㒍솆腬 [ 1053.954274][ T5785] usb 1-1: SerialNumber: syz [ 1054.084245][T11188] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.084263][T11188] usb 5-1: Product: syz [ 1054.084271][T11188] usb 5-1: Manufacturer: syz [ 1054.084278][T11188] usb 5-1: SerialNumber: syz [ 1054.193520][T11188] usb 5-1: config 0 descriptor?? [ 1054.325761][T11188] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 1054.737965][T11188] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1054.739173][T11188] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 1054.739252][T11188] usb 5-1: media controller created [ 1054.956973][T11188] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1055.396245][ T5785] usb 1-1: 1:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1055.396269][ T5785] usb 1-1: found format II with max.bitrate = 8, frame size=9 [ 1055.396279][ T5785] usb 1-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 1055.399028][ T5785] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1055.588367][T11188] DVB: Unable to find symbol mt352_attach() [ 1055.676500][T13104] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1055.733047][ T5785] usb 1-1: USB disconnect, device number 55 [ 1055.951076][T11188] DVB: Unable to find symbol nxt6000_attach() [ 1055.951089][T11188] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 1056.080556][T11188] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input67 [ 1056.109806][T11188] dvb-usb: schedule remote query interval to 1000 msecs. [ 1056.109822][T11188] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 1056.109831][T11188] dvb-usb: bulk message failed: -22 (7/0) [ 1056.109840][T11188] dvb-usb: bulk message failed: -22 (7/0) [ 1056.196809][T11188] usb 5-1: USB disconnect, device number 55 [ 1057.019669][ T8384] bridge_slave_1: left allmulticast mode [ 1057.019694][ T8384] bridge_slave_1: left promiscuous mode [ 1057.019877][ T8384] bridge0: port 2(bridge_slave_1) entered disabled state [ 1057.230998][T11188] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 1057.271880][ T8384] bridge_slave_0: left allmulticast mode [ 1057.271906][ T8384] bridge_slave_0: left promiscuous mode [ 1057.272074][ T8384] bridge0: port 1(bridge_slave_0) entered disabled state [ 1058.602867][ T8384] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1059.033769][ T8384] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1059.199481][ T8384] bond0 (unregistering): Released all slaves [ 1059.274486][T12996] bridge0: port 1(bridge_slave_0) entered blocking state [ 1059.274555][T12996] bridge0: port 1(bridge_slave_0) entered disabled state [ 1059.274687][T12996] bridge_slave_0: entered allmulticast mode [ 1059.296952][T12996] bridge_slave_0: entered promiscuous mode [ 1059.487164][T11188] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 1059.506767][ T5266] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1059.522549][T12996] bridge0: port 2(bridge_slave_1) entered blocking state [ 1059.522708][T12996] bridge0: port 2(bridge_slave_1) entered disabled state [ 1059.522901][T12996] bridge_slave_1: entered allmulticast mode [ 1059.525097][T12996] bridge_slave_1: entered promiscuous mode [ 1059.675851][T11188] usb 5-1: Using ep0 maxpacket: 16 [ 1059.677841][T11188] usb 5-1: New USB device found: idVendor=249c, idProduct=9006, bcdDevice=0.40 [ 1059.681019][T11188] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1059.681034][T11188] usb 5-1: Product: љ [ 1059.681041][T11188] usb 5-1: Manufacturer: ⊲蹂쑔竳⃇뒋ԡ从鳻蛣귰喡霨礡茝奰㬣㍀⏖ᤗ鸵⩄劘앢蒊͑᣻솚୑뚋율梙춆千깃牥곤ꡟ᫵ꬩ㒍솆腬 [ 1059.681051][T11188] usb 5-1: SerialNumber: syz [ 1060.203281][T12996] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1060.374709][T12996] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1060.749944][T11188] usb 5-1: 1:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1060.749964][T11188] usb 5-1: found format II with max.bitrate = 8, frame size=9 [ 1060.749973][T11188] usb 5-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 1060.753045][T11188] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1061.117594][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 1061.117663][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 1061.182797][T11188] usb 5-1: USB disconnect, device number 56 [ 1061.354887][T13156] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1061.801421][T12996] team0: Port device team_slave_0 added [ 1061.992702][T12996] team0: Port device team_slave_1 added [ 1062.868226][ T8384] hsr_slave_0: left promiscuous mode [ 1062.921711][ T8384] hsr_slave_1: left promiscuous mode [ 1062.923926][ T8384] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1062.965752][ T8384] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1064.161655][T13189] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1064.353382][ T8384] team0 (unregistering): Port device team_slave_1 removed [ 1064.472169][ T8384] team0 (unregistering): Port device team_slave_0 removed [ 1065.542125][T12996] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1065.542139][T12996] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1065.542157][T12996] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1065.610431][T13207] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1065.614191][ T5266] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1065.819018][T12996] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1065.819031][T12996] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1065.819046][T12996] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1066.064073][T13013] bridge0: port 1(bridge_slave_0) entered blocking state [ 1066.064181][T13013] bridge0: port 1(bridge_slave_0) entered disabled state [ 1066.064316][T13013] bridge_slave_0: entered allmulticast mode [ 1066.071129][T13013] bridge_slave_0: entered promiscuous mode [ 1066.099359][T13013] bridge0: port 2(bridge_slave_1) entered blocking state [ 1066.099550][T13013] bridge0: port 2(bridge_slave_1) entered disabled state [ 1066.099749][T13013] bridge_slave_1: entered allmulticast mode [ 1066.109195][T13013] bridge_slave_1: entered promiscuous mode [ 1067.235544][ T5891] usb 1-1: new full-speed USB device number 56 using dummy_hcd [ 1067.398633][ T5891] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1067.399176][ T5891] usb 1-1: not running at top speed; connect to a high speed hub [ 1067.399212][ T5891] usb 1-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1067.400245][ T5891] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 1067.400259][ T5891] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 1067.400270][ T5891] usb 1-1: config 14 has no interface number 0 [ 1067.400278][ T5891] usb 1-1: config 14 has no interface number 1 [ 1067.400322][ T5891] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1067.400333][ T5891] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1067.400345][ T5891] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1067.400359][ T5891] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1067.400372][ T5891] usb 1-1: config 14 interface 57 has no altsetting 0 [ 1067.400381][ T5891] usb 1-1: config 14 interface 228 has no altsetting 0 [ 1067.459893][ T5891] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1067.459911][ T5891] usb 1-1: Product: syz [ 1067.459919][ T5891] usb 1-1: Manufacturer: syz [ 1067.459926][ T5891] usb 1-1: SerialNumber: syz [ 1068.082172][ T5891] legousbtower 1-1:14.57: interrupt endpoints not found [ 1068.226306][T13211] bridge0: port 2(bridge_slave_1) entered disabled state [ 1068.246080][T13211] bridge0: port 1(bridge_slave_0) entered disabled state [ 1068.491545][ T5891] legousbtower 1-1:14.228: get version request failed: -121 [ 1068.491734][ T5891] legousbtower 1-1:14.228: probe with driver legousbtower failed with error -121 [ 1068.852855][ T5743] usb 1-1: USB disconnect, device number 56 [ 1068.964786][T13211] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1069.001572][T13211] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1070.664089][T12996] hsr_slave_0: entered promiscuous mode [ 1070.674255][T12996] hsr_slave_1: entered promiscuous mode [ 1070.684715][T12996] debugfs: 'hsr0' already exists in 'hsr' [ 1070.684736][T12996] Cannot create hsr debugfs directory [ 1070.711224][T13013] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1070.738671][T13013] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1071.112335][T13013] team0: Port device team_slave_0 added [ 1071.247491][T13013] team0: Port device team_slave_1 added [ 1071.714594][T13013] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1071.714613][T13013] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1071.714638][T13013] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1071.854553][T13013] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1071.854567][T13013] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1071.854583][T13013] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1072.168372][T13236] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1073.591643][T13251] netlink: 'syz.0.1742': attribute type 15 has an invalid length. [ 1073.923420][ T5266] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1073.955053][T13013] hsr_slave_0: entered promiscuous mode [ 1074.021916][T13013] hsr_slave_1: entered promiscuous mode [ 1074.022740][T13013] debugfs: 'hsr0' already exists in 'hsr' [ 1074.022758][T13013] Cannot create hsr debugfs directory [ 1074.473202][T13260] ptp ptp0: guarantee physical clock free running [ 1079.375715][ T2685] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1079.376476][ T2685] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1079.376561][ T2685] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1079.376581][ T2685] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.716359][T13347] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1084.152789][ T8384] bridge_slave_1: left allmulticast mode [ 1084.152814][ T8384] bridge_slave_1: left promiscuous mode [ 1084.326567][ T8384] bridge0: port 2(bridge_slave_1) entered disabled state [ 1084.692659][ T8384] bridge_slave_0: left allmulticast mode [ 1084.692695][ T8384] bridge_slave_0: left promiscuous mode [ 1084.731049][ T8384] bridge0: port 1(bridge_slave_0) entered disabled state [ 1086.150418][ T8384] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1086.358829][ T8384] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1086.464398][ T8384] bond0 (unregistering): Released all slaves [ 1089.335715][ T8384] hsr_slave_0: left promiscuous mode [ 1089.378354][ T8384] hsr_slave_1: left promiscuous mode [ 1089.381254][ T8384] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1089.458391][ T8384] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1091.578369][ T8384] team0 (unregistering): Port device team_slave_1 removed [ 1091.689726][ T8384] team0 (unregistering): Port device team_slave_0 removed [ 1091.705125][T13426] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1093.015598][ T9] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 1093.176589][ T9] usb 1-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 1093.177703][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1093.177726][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1093.177739][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1093.177749][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1093.177772][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1093.266569][ T9] usb 1-1: config 0 descriptor?? [ 1093.926410][ T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 1093.926434][ T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 1093.926449][ T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 1093.926464][ T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 1093.926478][ T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 1094.352108][ T9] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 1096.022140][ T5743] usb 1-1: USB disconnect, device number 57 [ 1096.026963][ T5785] usb 5-1: new full-speed USB device number 57 using dummy_hcd [ 1096.187268][ T5785] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1096.189023][ T5785] usb 5-1: not running at top speed; connect to a high speed hub [ 1096.189059][ T5785] usb 5-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1096.190430][ T5785] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 1096.190454][ T5785] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 1096.190473][ T5785] usb 5-1: config 14 has no interface number 0 [ 1096.190488][ T5785] usb 5-1: config 14 has no interface number 1 [ 1096.190582][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1096.190605][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1096.190628][ T5785] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1096.190653][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1096.190677][ T5785] usb 5-1: config 14 interface 57 has no altsetting 0 [ 1096.190693][ T5785] usb 5-1: config 14 interface 228 has no altsetting 0 [ 1096.328391][ T5785] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1096.328419][ T5785] usb 5-1: Product: syz [ 1096.328433][ T5785] usb 5-1: Manufacturer: syz [ 1096.328447][ T5785] usb 5-1: SerialNumber: syz [ 1096.868873][ T5785] legousbtower 5-1:14.57: interrupt endpoints not found [ 1097.294491][ T5785] legousbtower 5-1:14.228: get version request failed: -71 [ 1097.294620][ T5785] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 1097.400661][ T5785] usb 5-1: USB disconnect, device number 57 [ 1097.657333][T12996] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1097.702903][T12996] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1097.716067][T12996] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1097.788192][T12996] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1097.865848][T12996] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1097.974579][T12996] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1097.987984][T12996] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1098.432233][T12996] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1100.203415][T13493] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1100.325352][T13013] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1100.541424][T13013] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1100.687986][T11231] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1100.750046][T11231] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1100.766453][T11231] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1100.767619][T11231] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1100.768312][T11231] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1102.507253][T11231] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1102.541614][T11231] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1102.545372][T11231] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1102.564797][T11231] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1102.570502][T11231] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1102.955793][T11669] Bluetooth: hci5: command tx timeout [ 1103.453060][T13013] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1103.612222][T13013] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1104.709852][T11669] Bluetooth: hci2: command tx timeout [ 1105.056112][T11669] Bluetooth: hci5: command tx timeout [ 1105.403298][ T5743] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 1105.545604][ T5743] usb 3-1: Using ep0 maxpacket: 16 [ 1105.551288][ T5743] usb 3-1: New USB device found: idVendor=249c, idProduct=9006, bcdDevice=0.40 [ 1105.585349][ T5743] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1105.585366][ T5743] usb 3-1: Product: љ [ 1105.585373][ T5743] usb 3-1: Manufacturer: ⊲蹂쑔竳⃇뒋ԡ从鳻蛣귰喡霨礡茝奰㬣㍀⏖ᤗ鸵⩄劘앢蒊͑᣻솚୑뚋율梙춆千깃牥곤ꡟ᫵ꬩ㒍솆腬 [ 1105.585384][ T5743] usb 3-1: SerialNumber: syz [ 1106.473911][ T5743] usb 3-1: 1:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1106.473929][ T5743] usb 3-1: found format II with max.bitrate = 8, frame size=9 [ 1106.473938][ T5743] usb 3-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 1106.521413][ T5743] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1106.785894][T11669] Bluetooth: hci2: command tx timeout [ 1106.874201][ T5743] usb 3-1: USB disconnect, device number 56 [ 1106.948361][T12428] udevd[12428]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1107.105606][T11669] Bluetooth: hci5: command tx timeout [ 1108.619728][T13507] rxe_eth0 speed is unknown, defaulting to 1000 [ 1108.866492][T11669] Bluetooth: hci2: command tx timeout [ 1109.185582][T11669] Bluetooth: hci5: command tx timeout [ 1110.950038][T11669] Bluetooth: hci2: command tx timeout [ 1111.024614][T13523] rxe_eth0 speed is unknown, defaulting to 1000 [ 1112.479800][T13612] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1115.648442][T13507] bridge0: port 1(bridge_slave_0) entered blocking state [ 1115.648553][T13507] bridge0: port 1(bridge_slave_0) entered disabled state [ 1115.648891][T13507] bridge_slave_0: entered allmulticast mode [ 1115.692033][T13507] bridge_slave_0: entered promiscuous mode [ 1115.801024][T13507] bridge0: port 2(bridge_slave_1) entered blocking state [ 1115.801856][T13507] bridge0: port 2(bridge_slave_1) entered disabled state [ 1115.802922][T13507] bridge_slave_1: entered allmulticast mode [ 1115.840735][T13507] bridge_slave_1: entered promiscuous mode [ 1116.333366][ T95] bridge_slave_1: left allmulticast mode [ 1116.333391][ T95] bridge_slave_1: left promiscuous mode [ 1116.333555][ T95] bridge0: port 2(bridge_slave_1) entered disabled state [ 1116.671418][ T95] bridge_slave_0: left allmulticast mode [ 1116.671443][ T95] bridge_slave_0: left promiscuous mode [ 1116.671598][ T95] bridge0: port 1(bridge_slave_0) entered disabled state [ 1118.087799][ T95] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1118.323926][ T95] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1118.443239][ T95] bond0 (unregistering): Released all slaves [ 1118.789915][T13507] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1118.889094][T13507] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1118.974602][T13507] team0: Port device team_slave_0 added [ 1118.999900][T13507] team0: Port device team_slave_1 added [ 1119.273796][T13507] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1119.273809][T13507] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1119.273822][T13507] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1119.573015][T13507] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1119.573032][T13507] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1119.573047][T13507] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1121.165235][ T95] hsr_slave_0: left promiscuous mode [ 1121.203332][ T95] hsr_slave_1: left promiscuous mode [ 1121.204264][ T95] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1121.277802][ T95] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1121.347814][T13676] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1121.763728][ T5606] syz-executor invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_COMP), order=0, oom_score_adj=0 [ 1121.763758][ T5606] CPU: 0 UID: 0 PID: 5606 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1121.763770][ T5606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1121.763777][ T5606] Call Trace: [ 1121.763782][ T5606] [ 1121.763787][ T5606] dump_stack_lvl+0xe8/0x150 [ 1121.763811][ T5606] dump_header+0xd3/0x4b0 [ 1121.763829][ T5606] oom_kill_process+0x3ab/0x9e0 [ 1121.763843][ T5606] out_of_memory+0xfb1/0x13b0 [ 1121.763863][ T5606] ? __pfx_out_of_memory+0x10/0x10 [ 1121.763874][ T5606] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1121.763887][ T5606] ? _mutex_lock_killable+0x14d/0x1c0 [ 1121.763900][ T5606] ? try_charge_memcg+0xa9e/0x1760 [ 1121.763915][ T5606] try_charge_memcg+0xb75/0x1760 [ 1121.763936][ T5606] ? __pfx_try_charge_memcg+0x10/0x10 [ 1121.763951][ T5606] ? percpu_ref_tryget+0x15/0x180 [ 1121.763969][ T5606] ? __memcg_kmem_charge_page+0x1a8/0x5a0 [ 1121.763986][ T5606] __memcg_kmem_charge_page+0x379/0x5a0 [ 1121.764000][ T5606] ? __memcg_kmem_charge_page+0x1a8/0x5a0 [ 1121.764016][ T5606] __alloc_frozen_pages_noprof+0x25a/0x440 [ 1121.764029][ T5606] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1121.764046][ T5606] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1121.764063][ T5606] alloc_pages_mpol+0xd4/0x280 [ 1121.764078][ T5606] alloc_pages_noprof+0xd2/0x2f0 [ 1121.764091][ T5606] pte_alloc_one+0x22/0x380 [ 1121.764107][ T5606] __pte_alloc+0x25/0x1a0 [ 1121.764120][ T5606] copy_pmd_range+0x4fa7/0x58f0 [ 1121.764134][ T5606] ? arch_stack_walk+0xfb/0x150 [ 1121.764160][ T5606] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1121.764176][ T5606] ? __pfx_copy_pmd_range+0x10/0x10 [ 1121.764192][ T5606] ? __lock_acquire+0x747/0x2de0 [ 1121.764219][ T5606] copy_page_range+0xb61/0x11b0 [ 1121.764240][ T5606] ? __pfx_copy_page_range+0x10/0x10 [ 1121.764252][ T5606] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1121.764263][ T5606] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1121.764273][ T5606] ? up_write+0x5a/0x190 [ 1121.764285][ T5606] dup_mmap+0xf7c/0x1dd0 [ 1121.764309][ T5606] ? __pfx_dup_mmap+0x10/0x10 [ 1121.764322][ T5606] ? reacquire_held_locks+0x117/0x1a0 [ 1121.764332][ T5606] ? rt_spin_lock+0x1e2/0x400 [ 1121.764357][ T5606] ? lock_acquire+0x115/0x350 [ 1121.764381][ T5606] copy_mm+0x115/0x470 [ 1121.764396][ T5606] copy_process+0x1ed1/0x44c0 [ 1121.764416][ T5606] ? copy_process+0xd17/0x44c0 [ 1121.764438][ T5606] ? __pfx_copy_process+0x10/0x10 [ 1121.764458][ T5606] kernel_clone+0x2d2/0x8d0 [ 1121.764473][ T5606] ? __pfx_kernel_clone+0x10/0x10 [ 1121.764498][ T5606] __x64_sys_clone+0x1b6/0x230 [ 1121.764514][ T5606] ? __pfx___x64_sys_clone+0x10/0x10 [ 1121.764536][ T5606] ? do_user_addr_fault+0xd3f/0x1480 [ 1121.764555][ T5606] do_syscall_64+0x166/0x520 [ 1121.764565][ T5606] ? trace_irq_disable+0x3b/0x140 [ 1121.764576][ T5606] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1121.764587][ T5606] ? clear_bhb_loop+0x70/0xc0 [ 1121.764599][ T5606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1121.764608][ T5606] RIP: 0033:0x7f2fe5ee7fd2 [ 1121.764620][ T5606] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 1121.764633][ T5606] RSP: 002b:00007ffcf1d1f440 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1121.764646][ T5606] RAX: ffffffffffffffda RBX: 00007ffcf1d1f440 RCX: 00007f2fe5ee7fd2 [ 1121.764653][ T5606] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 1121.764659][ T5606] RBP: 00007ffcf1d1f5cc R08: 0000000000000000 R09: 0000000000000001 [ 1121.764665][ T5606] R10: 000055555f9047d0 R11: 0000000000000246 R12: 0000000000000001 [ 1121.764671][ T5606] R13: 000055555f917a00 R14: 0000000000110bd7 R15: 00007ffcf1d1f620 [ 1121.764688][ T5606] [ 1122.176043][ T5606] memory: usage 307200kB, limit 307200kB, failcnt 17665 [ 1122.176064][ T5606] memory+swap: usage 412340kB, limit 9007199254740988kB, failcnt 0 [ 1122.176076][ T5606] kmem: usage 2316kB, limit 9007199254740988kB, failcnt 0 [ 1122.176086][ T5606] Memory cgroup stats for /syz4: [ 1122.176281][ T5606] cache 312029184 [ 1122.176290][ T5606] rss 69632 [ 1122.176296][ T5606] shmem 312029184 [ 1122.176302][ T5606] mapped_file 174948352 [ 1122.176308][ T5606] dirty 0 [ 1122.176314][ T5606] writeback 0 [ 1122.176328][ T5606] workingset_refault_anon 179 [ 1122.176335][ T5606] workingset_refault_file 215 [ 1122.176341][ T5606] swap 107663360 [ 1122.176348][ T5606] swapcached 102400 [ 1122.176354][ T5606] pgpgin 1169428 [ 1122.176360][ T5606] pgpgout 1093207 [ 1122.176366][ T5606] pgfault 387847 [ 1122.176372][ T5606] pgmajfault 299 [ 1122.176378][ T5606] inactive_anon 312008704 [ 1122.176385][ T5606] active_anon 192512 [ 1122.176391][ T5606] inactive_file 0 [ 1122.176397][ T5606] active_file 0 [ 1122.176404][ T5606] unevictable 0 [ 1122.176410][ T5606] hierarchical_memory_limit 314572800 [ 1122.176417][ T5606] hierarchical_memsw_limit 9223372036854771712 [ 1122.176424][ T5606] total_cache 312029184 [ 1122.176431][ T5606] total_rss 69632 [ 1122.176437][ T5606] total_shmem 312029184 [ 1122.176443][ T5606] total_mapped_file 174948352 [ 1122.176449][ T5606] total_dirty 0 [ 1122.176456][ T5606] total_writeback 0 [ 1122.176462][ T5606] total_workingset_refault_anon 179 [ 1122.176469][ T5606] total_workingset_refault_file 215 [ 1122.176476][ T5606] total_swap 107663360 [ 1122.176483][ T5606] total_swapcached 102400 [ 1122.176489][ T5606] total_pgpgin 1169428 [ 1122.176496][ T5606] total_pgpgout 1093207 [ 1122.176502][ T5606] total_pgfault 387847 [ 1122.176509][ T5606] total_pgmajfault 299 [ 1122.176515][ T5606] total_inactive_anon 312008704 [ 1122.176522][ T5606] total_active_anon 192512 [ 1122.176528][ T5606] total_inactive_file 0 [ 1122.176535][ T5606] total_active_file 0 [ 1122.176541][ T5606] total_unevictable 0 [ 1122.176548][ T5606] anon_cost 17787 [ 1122.176554][ T5606] file_cost 1145 [ 1122.176561][ T5606] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.1705,pid=13051,uid=0 [ 1122.176970][ T5606] Memory cgroup out of memory: Killed process 13051 (syz.4.1705) total-vm:202900kB, anon-rss:1300kB, file-rss:20548kB, shmem-rss:101868kB, UID:0 pgtables:312kB oom_score_adj:1000 [ 1122.547846][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 1122.547888][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 1122.969994][T13147] syz.4.1724 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1122.970032][T13147] CPU: 0 UID: 0 PID: 13147 Comm: syz.4.1724 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1122.970046][T13147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1122.970052][T13147] Call Trace: [ 1122.970057][T13147] [ 1122.970063][T13147] dump_stack_lvl+0xe8/0x150 [ 1122.970083][T13147] dump_header+0xd3/0x4b0 [ 1122.970102][T13147] oom_kill_process+0x3ab/0x9e0 [ 1122.970115][T13147] out_of_memory+0xfb1/0x13b0 [ 1122.970133][T13147] ? __pfx_out_of_memory+0x10/0x10 [ 1122.970143][T13147] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1122.970154][T13147] ? _mutex_lock_killable+0x14d/0x1c0 [ 1122.970167][T13147] ? try_charge_memcg+0xa9e/0x1760 [ 1122.970181][T13147] try_charge_memcg+0xb75/0x1760 [ 1122.970192][T13147] ? __lock_acquire+0x747/0x2de0 [ 1122.970228][T13147] ? __pfx_try_charge_memcg+0x10/0x10 [ 1122.970246][T13147] ? lock_acquire+0x115/0x350 [ 1122.970285][T13147] ? charge_memcg+0x47/0x310 [ 1122.970307][T13147] charge_memcg+0x1dd/0x310 [ 1122.970328][T13147] __mem_cgroup_charge+0x25/0x80 [ 1122.970347][T13147] shmem_get_folio_gfp+0x781/0x17b0 [ 1122.970392][T13147] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 1122.970419][T13147] ? ktime_get_coarse_real_ts64_mg+0x59/0x1e0 [ 1122.970443][T13147] shmem_write_begin+0x166/0x320 [ 1122.970469][T13147] generic_perform_write+0x2ad/0x8a0 [ 1122.970501][T13147] ? __pfx_generic_perform_write+0x10/0x10 [ 1122.970519][T13147] ? generic_write_checks_count+0x426/0x530 [ 1122.970544][T13147] ? file_update_time_flags+0x2db/0x450 [ 1122.970566][T13147] shmem_file_write_iter+0xfb/0x120 [ 1122.970593][T13147] __kernel_write_iter+0x453/0x8f0 [ 1122.970620][T13147] ? __pfx___kernel_write_iter+0x10/0x10 [ 1122.970649][T13147] ? __asan_memset+0x22/0x50 [ 1122.970673][T13147] ? iov_iter_bvec+0xb8/0x180 [ 1122.970698][T13147] dump_user_range+0x715/0xca0 [ 1122.970741][T13147] ? __pfx_dump_user_range+0x10/0x10 [ 1122.970775][T13147] ? __pfx_writenote+0x10/0x10 [ 1122.970796][T13147] ? __kmalloc_cache_noprof+0x3d0/0x670 [ 1122.970814][T13147] ? elf_core_dump+0x28d0/0x3a70 [ 1122.970843][T13147] elf_core_dump+0x346a/0x3a70 [ 1122.970886][T13147] ? __pfx_elf_core_dump+0x10/0x10 [ 1122.970907][T13147] ? __lock_acquire+0x747/0x2de0 [ 1122.970935][T13147] ? arch_do_signal_or_restart+0xbb/0x860 [ 1122.971001][T13147] ? lock_acquire+0x115/0x350 [ 1122.971026][T13147] ? 0xffffffffff600000 [ 1122.971054][T13147] do_coredump+0x5ee3/0x6a80 [ 1122.971104][T13147] ? __pfx_do_coredump+0x10/0x10 [ 1122.971127][T13147] ? __schedule+0x1733/0x56f0 [ 1122.971156][T13147] ? __lock_acquire+0x747/0x2de0 [ 1122.971196][T13147] ? __lock_acquire+0x747/0x2de0 [ 1122.971229][T13147] ? __lock_acquire+0x747/0x2de0 [ 1122.971265][T13147] ? lock_acquire+0x115/0x350 [ 1122.971298][T13147] ? ktime_get+0x45/0x220 [ 1122.971316][T13147] ? ktime_get+0x45/0x220 [ 1122.971332][T13147] ? seqcount_lockdep_reader_access+0xd4/0x100 [ 1122.971351][T13147] ? ktime_get+0x1f5/0x220 [ 1122.971370][T13147] ? lapic_next_event+0x11/0x20 [ 1122.971391][T13147] ? clockevents_program_event+0x491/0x630 [ 1122.971418][T13147] ? __pfx_clockevents_program_event+0x10/0x10 [ 1122.971469][T13147] ? try_to_take_rt_mutex+0x842/0xb00 [ 1122.971500][T13147] ? __lock_acquire+0x747/0x2de0 [ 1122.971537][T13147] ? __lock_acquire+0x747/0x2de0 [ 1122.971573][T13147] ? do_raw_spin_lock+0x12b/0x2f0 [ 1122.971622][T13147] ? reacquire_held_locks+0x117/0x1a0 [ 1122.971642][T13147] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1122.971673][T13147] ? rt_spin_unlock+0x159/0x200 [ 1122.971699][T13147] ? rt_spin_unlock+0x165/0x200 [ 1122.971724][T13147] vfs_coredump+0xac3/0x10c0 [ 1122.971767][T13147] ? __pfx_vfs_coredump+0x10/0x10 [ 1122.971797][T13147] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1122.971841][T13147] get_signal+0x1090/0x12c0 [ 1122.971889][T13147] arch_do_signal_or_restart+0xbb/0x860 [ 1122.971909][T13147] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1122.971933][T13147] irqentry_exit+0x348/0x9b0 [ 1122.971943][T13147] ? trace_irq_disable+0x3b/0x140 [ 1122.971957][T13147] asm_exc_page_fault+0x26/0x30 [ 1122.971967][T13147] RIP: 0033:0x0 [ 1122.971976][T13147] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 1122.971982][T13147] RSP: 002b:00002000000001c8 EFLAGS: 00010217 [ 1122.971992][T13147] RAX: 0000000000000000 RBX: 00007f2fe6145fa0 RCX: 00007f2fe5ebf559 [ 1122.971999][T13147] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000020000 [ 1122.972006][T13147] RBP: 00007f2fe5f56b20 R08: 0000000000000000 R09: 0000000000000000 [ 1122.972012][T13147] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1122.972018][T13147] R13: 00007f2fe6146038 R14: 00007f2fe6145fa0 R15: 00007ffcf1d1f228 [ 1122.972034][T13147] [ 1123.182327][ T95] team0 (unregistering): Port device team_slave_1 removed [ 1123.443311][T13147] memory: usage 307200kB, limit 307200kB, failcnt 17716 [ 1123.443324][T13147] memory+swap: usage 412340kB, limit 9007199254740988kB, failcnt 0 [ 1123.443331][T13147] kmem: usage 2292kB, limit 9007199254740988kB, failcnt 0 [ 1123.443337][T13147] Memory cgroup stats for /syz4: [ 1123.443671][T13147] cache 312029184 [ 1123.443676][T13147] rss 69632 [ 1123.443679][T13147] shmem 312029184 [ 1123.443683][T13147] mapped_file 135307264 [ 1123.443686][T13147] dirty 0 [ 1123.443689][T13147] writeback 0 [ 1123.443692][T13147] workingset_refault_anon 179 [ 1123.443698][T13147] workingset_refault_file 215 [ 1123.443702][T13147] swap 107663360 [ 1123.443705][T13147] swapcached 102400 [ 1123.443709][T13147] pgpgin 1169428 [ 1123.443712][T13147] pgpgout 1093207 [ 1123.443715][T13147] pgfault 387848 [ 1123.443719][T13147] pgmajfault 299 [ 1123.443722][T13147] inactive_anon 312008704 [ 1123.443725][T13147] active_anon 192512 [ 1123.443728][T13147] inactive_file 0 [ 1123.443732][T13147] active_file 0 [ 1123.443735][T13147] unevictable 0 [ 1123.443738][T13147] hierarchical_memory_limit 314572800 [ 1123.443744][T13147] hierarchical_memsw_limit 9223372036854771712 [ 1123.443749][T13147] total_cache 312029184 [ 1123.443752][T13147] total_rss 69632 [ 1123.443756][T13147] total_shmem 312029184 [ 1123.443759][T13147] total_mapped_file 135307264 [ 1123.443763][T13147] total_dirty 0 [ 1123.443766][T13147] total_writeback 0 [ 1123.443769][T13147] total_workingset_refault_anon 179 [ 1123.443773][T13147] total_workingset_refault_file 215 [ 1123.443777][T13147] total_swap 107663360 [ 1123.443780][T13147] total_swapcached 102400 [ 1123.443783][T13147] total_pgpgin 1169428 [ 1123.443787][T13147] total_pgpgout 1093207 [ 1123.443791][T13147] total_pgfault 387848 [ 1123.443794][T13147] total_pgmajfault 299 [ 1123.443797][T13147] total_inactive_anon 312008704 [ 1123.443801][T13147] total_active_anon 192512 [ 1123.443804][T13147] total_inactive_file 0 [ 1123.443808][T13147] total_active_file 0 [ 1123.443812][T13147] total_unevictable 0 [ 1123.443815][T13147] anon_cost 17787 [ 1123.443818][T13147] file_cost 1145 [ 1123.443822][T13147] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.1724,pid=13147,uid=0 [ 1123.444058][T13147] Memory cgroup out of memory: Killed process 13147 (syz.4.1724) total-vm:202900kB, anon-rss:1300kB, file-rss:20548kB, shmem-rss:68980kB, UID:0 pgtables:248kB oom_score_adj:1000 [ 1123.846565][ T95] team0 (unregistering): Port device team_slave_0 removed [ 1124.729631][ T5266] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1125.029361][T13507] hsr_slave_0: entered promiscuous mode [ 1125.051064][T13507] hsr_slave_1: entered promiscuous mode [ 1125.051705][T13507] debugfs: 'hsr0' already exists in 'hsr' [ 1125.051721][T13507] Cannot create hsr debugfs directory [ 1125.074652][T13523] bridge0: port 1(bridge_slave_0) entered blocking state [ 1125.074726][T13523] bridge0: port 1(bridge_slave_0) entered disabled state [ 1125.074856][T13523] bridge_slave_0: entered allmulticast mode [ 1125.138438][T13523] bridge_slave_0: entered promiscuous mode [ 1125.209766][T13523] bridge0: port 2(bridge_slave_1) entered blocking state [ 1125.209873][T13523] bridge0: port 2(bridge_slave_1) entered disabled state [ 1125.210001][T13523] bridge_slave_1: entered allmulticast mode [ 1125.219002][T13523] bridge_slave_1: entered promiscuous mode [ 1125.673984][ T5743] usb 3-1: new full-speed USB device number 57 using dummy_hcd [ 1125.822306][T13523] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1125.849703][ T5743] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1125.850156][ T5743] usb 3-1: not running at top speed; connect to a high speed hub [ 1125.850181][ T5743] usb 3-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1125.853907][ T5743] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 1125.853921][ T5743] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 1125.853931][ T5743] usb 3-1: config 14 has no interface number 0 [ 1125.853940][ T5743] usb 3-1: config 14 has no interface number 1 [ 1125.853978][ T5743] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1125.853990][ T5743] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1125.854003][ T5743] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1125.854016][ T5743] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1125.854030][ T5743] usb 3-1: config 14 interface 57 has no altsetting 0 [ 1125.854038][ T5743] usb 3-1: config 14 interface 228 has no altsetting 0 [ 1126.000384][ T5743] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1126.000401][ T5743] usb 3-1: Product: syz [ 1126.000408][ T5743] usb 3-1: Manufacturer: syz [ 1126.000415][ T5743] usb 3-1: SerialNumber: syz [ 1126.349167][T13523] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1126.853579][ T5743] legousbtower 3-1:14.57: interrupt endpoints not found [ 1126.910856][T13707] ptp ptp0: guarantee physical clock free running [ 1127.532390][ T5743] legousbtower 3-1:14.228: get version request failed: -71 [ 1127.532500][ T5743] legousbtower 3-1:14.228: probe with driver legousbtower failed with error -71 [ 1127.576792][ T5743] usb 3-1: USB disconnect, device number 57 [ 1127.784584][T13523] team0: Port device team_slave_0 added [ 1127.887474][T13523] team0: Port device team_slave_1 added [ 1128.354004][T13523] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1128.354017][T13523] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1128.354031][T13523] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1128.444949][T13523] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1128.444962][T13523] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1128.444977][T13523] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1129.131724][T13523] hsr_slave_0: entered promiscuous mode [ 1129.135075][T13523] hsr_slave_1: entered promiscuous mode [ 1129.149099][T13523] debugfs: 'hsr0' already exists in 'hsr' [ 1129.149117][T13523] Cannot create hsr debugfs directory [ 1129.505738][ T9] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1129.691015][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 1129.729931][ T9] usb 3-1: New USB device found: idVendor=249c, idProduct=9006, bcdDevice=0.40 [ 1129.762855][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1129.762872][ T9] usb 3-1: Product: љ [ 1129.762880][ T9] usb 3-1: Manufacturer: ⊲蹂쑔竳⃇뒋ԡ从鳻蛣귰喡霨礡茝奰㬣㍀⏖ᤗ鸵⩄劘앢蒊͑᣻솚୑뚋율梙춆千깃牥곤ꡟ᫵ꬩ㒍솆腬 [ 1129.762890][ T9] usb 3-1: SerialNumber: syz [ 1130.661530][ T9] usb 3-1: 1:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1130.661548][ T9] usb 3-1: found format II with max.bitrate = 8, frame size=9 [ 1130.661558][ T9] usb 3-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 1130.680221][ T9] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1131.160119][ T9] usb 3-1: USB disconnect, device number 58 [ 1131.205621][T11188] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 1131.330634][T12428] udevd[12428]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1131.356120][T11188] usb 1-1: New USB device found: idVendor=1ba6, idProduct=0001, bcdDevice=0.01 [ 1131.357502][T11188] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1131.357533][T11188] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1131.422462][T11188] as10x_usb: device has been detected [ 1131.423074][T11188] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 1131.555009][T11188] usb 1-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 1131.987620][T11188] as10x_usb: error during firmware upload part1 [ 1131.987996][T11188] Registered device Abilis Systems DVB-Titan [ 1132.491533][ T5266] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1133.651340][T13743] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1136.032838][ T5785] usb 5-1: new full-speed USB device number 58 using dummy_hcd [ 1136.278253][ T5785] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1136.278971][ T5785] usb 5-1: not running at top speed; connect to a high speed hub [ 1136.279008][ T5785] usb 5-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1136.280317][ T5785] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 1136.280331][ T5785] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 1136.280341][ T5785] usb 5-1: config 14 has no interface number 0 [ 1136.280349][ T5785] usb 5-1: config 14 has no interface number 1 [ 1136.280413][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1136.280436][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1136.280458][ T5785] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1136.280479][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1136.280491][ T5785] usb 5-1: config 14 interface 57 has no altsetting 0 [ 1136.280500][ T5785] usb 5-1: config 14 interface 228 has no altsetting 0 [ 1136.287424][ T5785] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1136.287448][ T5785] usb 5-1: Product: syz [ 1136.287460][ T5785] usb 5-1: Manufacturer: syz [ 1136.287473][ T5785] usb 5-1: SerialNumber: syz [ 1137.006183][ T5785] legousbtower 5-1:14.57: interrupt endpoints not found [ 1137.423647][ T5785] legousbtower 5-1:14.228: get version request failed: -121 [ 1137.424839][ T5785] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -121 [ 1138.328796][T11188] usb 1-1: USB disconnect, device number 58 [ 1138.505105][T13771] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1139.948270][ T5785] usb 5-1: USB disconnect, device number 58 [ 1140.090332][T11188] Unregistered device Abilis Systems DVB-Titan [ 1140.130135][T11188] as10x_usb: device has been disconnected [ 1140.695631][T11188] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 1145.668053][T13822] FAULT_INJECTION: forcing a failure. [ 1145.668053][T13822] name failslab, interval 1, probability 0, space 0, times 0 [ 1145.668075][T13822] CPU: 0 UID: 0 PID: 13822 Comm: syz.4.1825 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1145.668088][T13822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1145.668095][T13822] Call Trace: [ 1145.668100][T13822] [ 1145.668105][T13822] dump_stack_lvl+0xe8/0x150 [ 1145.668129][T13822] should_fail_ex+0x447/0x5e0 [ 1145.668146][T13822] should_failslab+0xa8/0x100 [ 1145.668159][T13822] __kmalloc_cache_noprof+0x9c/0x670 [ 1145.668171][T13822] ? __io_uring_add_tctx_node+0x186/0x630 [ 1145.668216][T13822] ? __io_uring_add_tctx_node+0x186/0x630 [ 1145.668231][T13822] __io_uring_add_tctx_node+0x186/0x630 [ 1145.668245][T13822] ? __pfx___io_uring_add_tctx_node+0x10/0x10 [ 1145.668257][T13822] ? __anon_inode_getfile+0x16c/0x210 [ 1145.668273][T13822] io_uring_create+0x591/0x980 [ 1145.668295][T13822] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 1145.668307][T13822] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1145.668322][T13822] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1145.668341][T13822] ? rcu_is_watching+0x16/0xb0 [ 1145.668359][T13822] do_syscall_64+0x166/0x520 [ 1145.668369][T13822] ? trace_irq_disable+0x3b/0x140 [ 1145.668446][T13822] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1145.668472][T13822] ? clear_bhb_loop+0x70/0xc0 [ 1145.668485][T13822] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1145.668496][T13822] RIP: 0033:0x7f2fe5ebf559 [ 1145.668509][T13822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1145.668517][T13822] RSP: 002b:00007f2fe410dfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1145.668530][T13822] RAX: ffffffffffffffda RBX: 0000200000000500 RCX: 00007f2fe5ebf559 [ 1145.668538][T13822] RDX: 00002000000005c0 RSI: 0000200000000500 RDI: 000000000000001a [ 1145.668545][T13822] RBP: 00007f2fe5f56b20 R08: 0000000000000000 R09: 0000000000000000 [ 1145.668551][T13822] R10: 0000200000000600 R11: 0000000000000206 R12: 00002000000005c0 [ 1145.668558][T13822] R13: 0000200000000600 R14: 0000200000000580 R15: 00007ffcf1d1f228 [ 1145.668574][T13822] [ 1146.865824][ T9] usb 1-1: new full-speed USB device number 59 using dummy_hcd [ 1146.929750][T13839] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1147.037458][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1147.044542][ T9] usb 1-1: not running at top speed; connect to a high speed hub [ 1147.044588][ T9] usb 1-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1147.094084][ T9] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 1147.094102][ T9] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 1147.094113][ T9] usb 1-1: config 14 has no interface number 0 [ 1147.094121][ T9] usb 1-1: config 14 has no interface number 1 [ 1147.094162][ T9] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1147.094174][ T9] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1147.094186][ T9] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1147.094200][ T9] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1147.094213][ T9] usb 1-1: config 14 interface 57 has no altsetting 0 [ 1147.094230][ T9] usb 1-1: config 14 interface 228 has no altsetting 0 [ 1147.195209][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1147.195227][ T9] usb 1-1: Product: syz [ 1147.195234][ T9] usb 1-1: Manufacturer: syz [ 1147.195244][ T9] usb 1-1: SerialNumber: syz [ 1147.629793][ T95] bridge_slave_1: left allmulticast mode [ 1147.671469][ T95] bridge_slave_1: left promiscuous mode [ 1147.671788][ T95] bridge0: port 2(bridge_slave_1) entered disabled state [ 1147.704176][ T9] legousbtower 1-1:14.57: interrupt endpoints not found [ 1147.838626][ T95] bridge_slave_0: left allmulticast mode [ 1147.838662][ T95] bridge_slave_0: left promiscuous mode [ 1147.838901][ T95] bridge0: port 1(bridge_slave_0) entered disabled state [ 1147.973724][ T9] legousbtower 1-1:14.228: get version request failed: -71 [ 1147.985375][ T9] legousbtower 1-1:14.228: probe with driver legousbtower failed with error -71 [ 1148.038350][ T9] usb 1-1: USB disconnect, device number 59 [ 1149.127181][ T95] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1149.272814][ T95] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1149.348935][ T95] bond0 (unregistering): Released all slaves [ 1149.415616][ T9] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 1149.595670][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 1149.600751][ T9] usb 1-1: New USB device found: idVendor=249c, idProduct=9006, bcdDevice=0.40 [ 1149.687821][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1149.687850][ T9] usb 1-1: Product: љ [ 1149.687863][ T9] usb 1-1: Manufacturer: ⊲蹂쑔竳⃇뒋ԡ从鳻蛣귰喡霨礡茝奰㬣㍀⏖ᤗ鸵⩄劘앢蒊͑᣻솚୑뚋율梙춆千깃牥곤ꡟ᫵ꬩ㒍솆腬 [ 1149.687882][ T9] usb 1-1: SerialNumber: syz [ 1150.049632][ T9] usb 1-1: 1:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1150.049650][ T9] usb 1-1: found format II with max.bitrate = 8, frame size=9 [ 1150.049659][ T9] usb 1-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 1150.050034][ T9] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1150.287138][ T9] usb 1-1: USB disconnect, device number 60 [ 1150.396786][T12428] udevd[12428]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1151.615014][T13883] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1152.408556][ T95] hsr_slave_0: left promiscuous mode [ 1152.459433][ T95] hsr_slave_1: left promiscuous mode [ 1152.472603][ T95] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1152.523632][ T95] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1153.700524][ T95] team0 (unregistering): Port device team_slave_1 removed [ 1153.811098][ T95] team0 (unregistering): Port device team_slave_0 removed [ 1154.649845][ T5785] usb 5-1: new full-speed USB device number 60 using dummy_hcd [ 1154.832256][ T5785] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1154.833518][ T5785] usb 5-1: not running at top speed; connect to a high speed hub [ 1154.833554][ T5785] usb 5-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1154.889213][ T5785] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 1154.889241][ T5785] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 1154.889260][ T5785] usb 5-1: config 14 has no interface number 0 [ 1154.889275][ T5785] usb 5-1: config 14 has no interface number 1 [ 1154.889333][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1154.889345][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1154.889357][ T5785] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1154.889371][ T5785] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1154.889384][ T5785] usb 5-1: config 14 interface 57 has no altsetting 0 [ 1154.889393][ T5785] usb 5-1: config 14 interface 228 has no altsetting 0 [ 1154.986547][ T5785] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1154.986563][ T5785] usb 5-1: Product: syz [ 1154.986571][ T5785] usb 5-1: Manufacturer: syz [ 1154.986578][ T5785] usb 5-1: SerialNumber: syz [ 1155.588244][ T5785] legousbtower 5-1:14.57: interrupt endpoints not found [ 1155.943956][ T5785] legousbtower 5-1:14.228: get version request failed: -71 [ 1155.944066][ T5785] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 1156.012081][ T5785] usb 5-1: USB disconnect, device number 60 [ 1157.066974][T13928] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1159.401416][T13946] ptp ptp0: guarantee physical clock free running [ 1162.021318][T13954] syz.2.1844 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 1162.021347][T13954] CPU: 1 UID: 0 PID: 13954 Comm: syz.2.1844 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1162.021359][T13954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1162.021366][T13954] Call Trace: [ 1162.021372][T13954] [ 1162.021378][T13954] dump_stack_lvl+0xe8/0x150 [ 1162.021399][T13954] dump_header+0xd3/0x4b0 [ 1162.021417][T13954] oom_kill_process+0x3ab/0x9e0 [ 1162.021430][T13954] out_of_memory+0xfb1/0x13b0 [ 1162.021447][T13954] ? __pfx_out_of_memory+0x10/0x10 [ 1162.021457][T13954] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1162.021468][T13954] ? _mutex_lock_killable+0x14d/0x1c0 [ 1162.021481][T13954] ? try_charge_memcg+0xa9e/0x1760 [ 1162.021496][T13954] try_charge_memcg+0xb75/0x1760 [ 1162.021506][T13954] ? __lock_acquire+0x747/0x2de0 [ 1162.021531][T13954] ? __pfx_try_charge_memcg+0x10/0x10 [ 1162.021553][T13954] ? charge_memcg+0x47/0x310 [ 1162.021566][T13954] charge_memcg+0x1dd/0x310 [ 1162.021578][T13954] __mem_cgroup_charge+0x25/0x80 [ 1162.021589][T13954] filemap_add_folio+0x199/0x610 [ 1162.021610][T13954] __filemap_get_folio_mpol+0x43d/0xf50 [ 1162.021619][T13954] ? count_memcg_event_mm+0x1d/0x250 [ 1162.021633][T13954] filemap_fault+0xa97/0x13d0 [ 1162.021649][T13954] ? __pfx_filemap_fault+0x10/0x10 [ 1162.021661][T13954] ? __pfx_filemap_map_pages+0x10/0x10 [ 1162.021671][T13954] ? lock_acquire+0x115/0x350 [ 1162.021691][T13954] __do_fault+0x138/0x2a0 [ 1162.021704][T13954] do_pte_missing+0x17ee/0x2970 [ 1162.021718][T13954] ? handle_mm_fault+0xeb/0x28c0 [ 1162.021734][T13954] handle_mm_fault+0xf64/0x28c0 [ 1162.021750][T13954] ? handle_mm_fault+0xeb/0x28c0 [ 1162.021767][T13954] ? follow_page_pte+0x663/0xf20 [ 1162.021779][T13954] ? __pfx_handle_mm_fault+0x10/0x10 [ 1162.021793][T13954] ? follow_page_pte+0x73e/0xf20 [ 1162.021810][T13954] ? __pfx_follow_page_pte+0x10/0x10 [ 1162.021827][T13954] __get_user_pages+0x1671/0x2650 [ 1162.021857][T13954] get_dump_page+0x1b5/0x410 [ 1162.021870][T13954] ? __pfx_get_dump_page+0x10/0x10 [ 1162.021882][T13954] ? __asan_memset+0x22/0x50 [ 1162.021896][T13954] ? iov_iter_bvec+0xb8/0x180 [ 1162.021911][T13954] dump_user_range+0x208/0xca0 [ 1162.021934][T13954] ? __pfx_dump_user_range+0x10/0x10 [ 1162.021954][T13954] ? __pfx_writenote+0x10/0x10 [ 1162.021966][T13954] ? __kmalloc_cache_noprof+0x3d0/0x670 [ 1162.021977][T13954] ? elf_core_dump+0x28d0/0x3a70 [ 1162.021994][T13954] elf_core_dump+0x346a/0x3a70 [ 1162.022018][T13954] ? __pfx_elf_core_dump+0x10/0x10 [ 1162.022030][T13954] ? __lock_acquire+0x747/0x2de0 [ 1162.022044][T13954] ? arch_do_signal_or_restart+0xbb/0x860 [ 1162.022083][T13954] ? lock_acquire+0x115/0x350 [ 1162.022097][T13954] ? 0xffffffffff600000 [ 1162.022114][T13954] do_coredump+0x5ee3/0x6a80 [ 1162.022143][T13954] ? __pfx_do_coredump+0x10/0x10 [ 1162.022161][T13954] ? __lock_acquire+0x747/0x2de0 [ 1162.022184][T13954] ? __lock_acquire+0x747/0x2de0 [ 1162.022206][T13954] ? lock_acquire+0x115/0x350 [ 1162.022224][T13954] ? lock_acquire+0x115/0x350 [ 1162.022242][T13954] ? is_bpf_text_address+0x26/0x2b0 [ 1162.022258][T13954] ? is_bpf_text_address+0x292/0x2b0 [ 1162.022270][T13954] ? is_bpf_text_address+0x26/0x2b0 [ 1162.022284][T13954] ? kernel_text_address+0xa5/0xe0 [ 1162.022298][T13954] ? __kernel_text_address+0xd/0x30 [ 1162.022313][T13954] ? unwind_get_return_address+0x4d/0x90 [ 1162.022328][T13954] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1162.022343][T13954] ? arch_stack_walk+0xfb/0x150 [ 1162.022363][T13954] ? stack_trace_save+0xa9/0x100 [ 1162.022381][T13954] ? try_to_take_rt_mutex+0x842/0xb00 [ 1162.022398][T13954] ? __lock_acquire+0x747/0x2de0 [ 1162.022418][T13954] ? __lock_acquire+0x747/0x2de0 [ 1162.022437][T13954] ? do_raw_spin_lock+0x12b/0x2f0 [ 1162.022464][T13954] ? reacquire_held_locks+0x117/0x1a0 [ 1162.022475][T13954] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1162.022492][T13954] ? rt_spin_unlock+0x159/0x200 [ 1162.022506][T13954] ? rt_spin_unlock+0x165/0x200 [ 1162.022520][T13954] vfs_coredump+0xac3/0x10c0 [ 1162.022540][T13954] ? __pfx_vfs_coredump+0x10/0x10 [ 1162.022553][T13954] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1162.022563][T13954] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1162.022585][T13954] ? rt_spin_unlock+0x159/0x200 [ 1162.022600][T13954] ? rt_spin_unlock+0x165/0x200 [ 1162.022613][T13954] get_signal+0x1090/0x12c0 [ 1162.022639][T13954] arch_do_signal_or_restart+0xbb/0x860 [ 1162.022651][T13954] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1162.022674][T13954] irqentry_exit+0x348/0x9b0 [ 1162.022684][T13954] ? trace_irq_disable+0x3b/0x140 [ 1162.022698][T13954] asm_exc_page_fault+0x26/0x30 [ 1162.022709][T13954] RIP: 0033:0x7f51f380f561 [ 1162.022720][T13954] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 1162.022729][T13954] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 1162.022739][T13954] RAX: 0000000000000000 RBX: 00007f51f3a96090 RCX: 00007f51f380f559 [ 1162.022746][T13954] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 1162.022752][T13954] RBP: 00007f51f38a6b20 R08: 0000000000000000 R09: 0000000000000000 [ 1162.022758][T13954] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1162.022764][T13954] R13: 00007f51f3a96128 R14: 00007f51f3a96090 R15: 00007ffebd6ae278 [ 1162.022782][T13954] [ 1162.022786][T13954] memory: usage 307200kB, limit 307200kB, failcnt 15385 [ 1162.022793][T13954] memory+swap: usage 344528kB, limit 9007199254740988kB, failcnt 0 [ 1162.022800][T13954] kmem: usage 2412kB, limit 9007199254740988kB, failcnt 0 [ 1162.022806][T13954] Memory cgroup stats for /syz2: [ 1162.022981][T13954] cache 311582720 [ 1162.022986][T13954] rss 520192 [ 1162.022989][T13954] shmem 311459840 [ 1162.022992][T13954] mapped_file 149110784 [ 1162.022996][T13954] dirty 0 [ 1162.022999][T13954] writeback 0 [ 1162.023002][T13954] workingset_refault_anon 506 [ 1162.023006][T13954] workingset_refault_file 3501 [ 1162.023010][T13954] swap 38223872 [ 1162.023013][T13954] swapcached 0 [ 1162.023016][T13954] pgpgin 1077331 [ 1162.023020][T13954] pgpgout 1001134 [ 1162.023023][T13954] pgfault 394905 [ 1162.023026][T13954] pgmajfault 571 [ 1162.023030][T13954] inactive_anon 300036096 [ 1162.023033][T13954] active_anon 11939840 [ 1162.023037][T13954] inactive_file 0 [ 1162.023040][T13954] active_file 0 [ 1162.023044][T13954] unevictable 0 [ 1162.023047][T13954] hierarchical_memory_limit 314572800 [ 1162.023051][T13954] hierarchical_memsw_limit 9223372036854771712 [ 1162.023055][T13954] total_cache 311582720 [ 1162.023058][T13954] total_rss 520192 [ 1162.023062][T13954] total_shmem 311459840 [ 1162.023065][T13954] total_mapped_file 149110784 [ 1162.023069][T13954] total_dirty 0 [ 1162.023072][T13954] total_writeback 0 [ 1162.023076][T13954] total_workingset_refault_anon 506 [ 1162.023079][T13954] total_workingset_refault_file 3501 [ 1162.023083][T13954] total_swap 38223872 [ 1162.023086][T13954] total_swapcached 0 [ 1162.023090][T13954] total_pgpgin 1077331 [ 1162.023094][T13954] total_pgpgout 1001134 [ 1162.023098][T13954] total_pgfault 394905 [ 1162.023102][T13954] total_pgmajfault 571 [ 1162.023105][T13954] total_inactive_anon 300036096 [ 1162.023109][T13954] total_active_anon 11939840 [ 1162.023113][T13954] total_inactive_file 0 [ 1162.023117][T13954] total_active_file 0 [ 1162.023121][T13954] total_unevictable 0 [ 1162.023125][T13954] anon_cost 11831 [ 1162.023128][T13954] file_cost 0 [ 1162.023132][T13954] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.1785,pid=13551,uid=0 [ 1162.023366][T13954] Memory cgroup out of memory: Killed process 13551 (syz.2.1785) total-vm:202900kB, anon-rss:1300kB, file-rss:20548kB, shmem-rss:98324kB, UID:0 pgtables:308kB oom_score_adj:1000 [ 1163.022221][T13954] syz.2.1844 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 1163.022247][T13954] CPU: 0 UID: 0 PID: 13954 Comm: syz.2.1844 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1163.022260][T13954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1163.022267][T13954] Call Trace: [ 1163.022273][T13954] [ 1163.022280][T13954] dump_stack_lvl+0xe8/0x150 [ 1163.022302][T13954] dump_header+0xd3/0x4b0 [ 1163.022319][T13954] oom_kill_process+0x3ab/0x9e0 [ 1163.022332][T13954] out_of_memory+0xfb1/0x13b0 [ 1163.022349][T13954] ? __pfx_out_of_memory+0x10/0x10 [ 1163.022360][T13954] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1163.022371][T13954] ? _mutex_lock_killable+0x14d/0x1c0 [ 1163.022385][T13954] ? try_charge_memcg+0xa9e/0x1760 [ 1163.022398][T13954] try_charge_memcg+0xb75/0x1760 [ 1163.022409][T13954] ? __lock_acquire+0x747/0x2de0 [ 1163.022434][T13954] ? __pfx_try_charge_memcg+0x10/0x10 [ 1163.022456][T13954] ? charge_memcg+0x47/0x310 [ 1163.022468][T13954] charge_memcg+0x1dd/0x310 [ 1163.022481][T13954] __mem_cgroup_charge+0x25/0x80 [ 1163.022492][T13954] filemap_add_folio+0x199/0x610 [ 1163.022513][T13954] __filemap_get_folio_mpol+0x43d/0xf50 [ 1163.022522][T13954] ? count_memcg_event_mm+0x1d/0x250 [ 1163.022536][T13954] filemap_fault+0xa97/0x13d0 [ 1163.022552][T13954] ? __pfx_filemap_fault+0x10/0x10 [ 1163.022565][T13954] ? __pfx_filemap_map_pages+0x10/0x10 [ 1163.022575][T13954] ? lock_acquire+0x115/0x350 [ 1163.022595][T13954] __do_fault+0x138/0x2a0 [ 1163.022607][T13954] do_pte_missing+0x17ee/0x2970 [ 1163.022622][T13954] ? handle_mm_fault+0xeb/0x28c0 [ 1163.022638][T13954] handle_mm_fault+0xf64/0x28c0 [ 1163.022655][T13954] ? handle_mm_fault+0xeb/0x28c0 [ 1163.022672][T13954] ? follow_page_pte+0x663/0xf20 [ 1163.022685][T13954] ? __pfx_handle_mm_fault+0x10/0x10 [ 1163.022700][T13954] ? follow_page_pte+0x73e/0xf20 [ 1163.022717][T13954] ? __pfx_follow_page_pte+0x10/0x10 [ 1163.022739][T13954] __get_user_pages+0x1671/0x2650 [ 1163.022770][T13954] get_dump_page+0x1b5/0x410 [ 1163.022783][T13954] ? __pfx_get_dump_page+0x10/0x10 [ 1163.022795][T13954] ? __asan_memset+0x22/0x50 [ 1163.022809][T13954] ? iov_iter_bvec+0xb8/0x180 [ 1163.022823][T13954] dump_user_range+0x208/0xca0 [ 1163.022857][T13954] ? __pfx_dump_user_range+0x10/0x10 [ 1163.022877][T13954] ? __pfx_writenote+0x10/0x10 [ 1163.022889][T13954] ? __kmalloc_cache_noprof+0x3d0/0x670 [ 1163.022900][T13954] ? elf_core_dump+0x28d0/0x3a70 [ 1163.022917][T13954] elf_core_dump+0x346a/0x3a70 [ 1163.022941][T13954] ? __pfx_elf_core_dump+0x10/0x10 [ 1163.022953][T13954] ? __lock_acquire+0x747/0x2de0 [ 1163.022969][T13954] ? arch_do_signal_or_restart+0xbb/0x860 [ 1163.023009][T13954] ? lock_acquire+0x115/0x350 [ 1163.023023][T13954] ? 0xffffffffff600000 [ 1163.023040][T13954] do_coredump+0x5ee3/0x6a80 [ 1163.023069][T13954] ? __pfx_do_coredump+0x10/0x10 [ 1163.023088][T13954] ? __lock_acquire+0x747/0x2de0 [ 1163.023111][T13954] ? __lock_acquire+0x747/0x2de0 [ 1163.023133][T13954] ? lock_acquire+0x115/0x350 [ 1163.023151][T13954] ? lock_acquire+0x115/0x350 [ 1163.023169][T13954] ? is_bpf_text_address+0x26/0x2b0 [ 1163.023186][T13954] ? is_bpf_text_address+0x292/0x2b0 [ 1163.023197][T13954] ? is_bpf_text_address+0x26/0x2b0 [ 1163.023212][T13954] ? kernel_text_address+0xa5/0xe0 [ 1163.023225][T13954] ? __kernel_text_address+0xd/0x30 [ 1163.023242][T13954] ? unwind_get_return_address+0x4d/0x90 [ 1163.023257][T13954] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1163.023272][T13954] ? arch_stack_walk+0xfb/0x150 [ 1163.023292][T13954] ? stack_trace_save+0xa9/0x100 [ 1163.023310][T13954] ? try_to_take_rt_mutex+0x842/0xb00 [ 1163.023328][T13954] ? __lock_acquire+0x747/0x2de0 [ 1163.023348][T13954] ? __lock_acquire+0x747/0x2de0 [ 1163.023368][T13954] ? do_raw_spin_lock+0x12b/0x2f0 [ 1163.023395][T13954] ? reacquire_held_locks+0x117/0x1a0 [ 1163.023406][T13954] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1163.023423][T13954] ? rt_spin_unlock+0x159/0x200 [ 1163.023438][T13954] ? rt_spin_unlock+0x165/0x200 [ 1163.023452][T13954] vfs_coredump+0xac3/0x10c0 [ 1163.023478][T13954] ? __pfx_vfs_coredump+0x10/0x10 [ 1163.023499][T13954] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1163.023515][T13954] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1163.023551][T13954] ? rt_spin_unlock+0x159/0x200 [ 1163.023568][T13954] ? rt_spin_unlock+0x165/0x200 [ 1163.023582][T13954] get_signal+0x1090/0x12c0 [ 1163.023609][T13954] arch_do_signal_or_restart+0xbb/0x860 [ 1163.023622][T13954] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1163.023645][T13954] irqentry_exit+0x348/0x9b0 [ 1163.023655][T13954] ? trace_irq_disable+0x3b/0x140 [ 1163.023671][T13954] asm_exc_page_fault+0x26/0x30 [ 1163.023682][T13954] RIP: 0033:0x7f51f380f561 [ 1163.023694][T13954] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 1163.023703][T13954] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 1163.023713][T13954] RAX: 0000000000000000 RBX: 00007f51f3a96090 RCX: 00007f51f380f559 [ 1163.023727][T13954] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 1163.023734][T13954] RBP: 00007f51f38a6b20 R08: 0000000000000000 R09: 0000000000000000 [ 1163.023741][T13954] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1163.023747][T13954] R13: 00007f51f3a96128 R14: 00007f51f3a96090 R15: 00007ffebd6ae278 [ 1163.023764][T13954] [ 1163.023769][T13954] memory: usage 307200kB, limit 307200kB, failcnt 17921 [ 1163.023776][T13954] memory+swap: usage 344528kB, limit 9007199254740988kB, failcnt 0 [ 1163.023783][T13954] kmem: usage 2412kB, limit 9007199254740988kB, failcnt 0 [ 1163.023790][T13954] Memory cgroup stats for /syz2: [ 1163.023867][T13954] cache 311582720 [ 1163.023872][T13954] rss 520192 [ 1163.023876][T13954] shmem 311472128 [ 1163.023879][T13954] mapped_file 148733952 [ 1163.023883][T13954] dirty 0 [ 1163.023887][T13954] writeback 0 [ 1163.023890][T13954] workingset_refault_anon 506 [ 1163.023894][T13954] workingset_refault_file 3546 [ 1163.023898][T13954] swap 38223872 [ 1163.023902][T13954] swapcached 0 [ 1163.023906][T13954] pgpgin 1077379 [ 1163.023910][T13954] pgpgout 1001182 [ 1163.023913][T13954] pgfault 394907 [ 1163.023917][T13954] pgmajfault 572 [ 1163.023921][T13954] inactive_anon 300052480 [ 1163.023925][T13954] active_anon 11939840 [ 1163.023928][T13954] inactive_file 0 [ 1163.023932][T13954] active_file 0 [ 1163.023936][T13954] unevictable 0 [ 1163.023940][T13954] hierarchical_memory_limit 314572800 [ 1163.023944][T13954] hierarchical_memsw_limit 9223372036854771712 [ 1163.023948][T13954] total_cache 311582720 [ 1163.023952][T13954] total_rss 520192 [ 1163.023956][T13954] total_shmem 311472128 [ 1163.023960][T13954] total_mapped_file 148733952 [ 1163.023964][T13954] total_dirty 0 [ 1163.023968][T13954] total_writeback 0 [ 1163.023971][T13954] total_workingset_refault_anon 506 [ 1163.023975][T13954] total_workingset_refault_file 3546 [ 1163.023979][T13954] total_swap 38223872 [ 1163.023983][T13954] total_swapcached 0 [ 1163.023987][T13954] total_pgpgin 1077379 [ 1163.023991][T13954] total_pgpgout 1001182 [ 1163.023994][T13954] total_pgfault 394907 [ 1163.023998][T13954] total_pgmajfault 572 [ 1163.024002][T13954] total_inactive_anon 300052480 [ 1163.024005][T13954] total_active_anon 11939840 [ 1163.024009][T13954] total_inactive_file 0 [ 1163.024013][T13954] total_active_file 0 [ 1163.024017][T13954] total_unevictable 0 [ 1163.024021][T13954] anon_cost 9831 [ 1163.024024][T13954] file_cost 3907 [ 1163.024029][T13954] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.1810,pid=13730,uid=0 [ 1163.024094][T13954] Memory cgroup out of memory: Killed process 13730 (syz.2.1810) total-vm:202768kB, anon-rss:1444kB, file-rss:20548kB, shmem-rss:47280kB, UID:0 pgtables:208kB oom_score_adj:1000 [ 1167.143290][ T39] oom_reaper: reaped process 13730 (syz.2.1810), now anon-rss:0kB, file-rss:20480kB, shmem-rss:47280kB [ 1167.272304][T13954] syz.2.1844 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 1167.272330][T13954] CPU: 0 UID: 0 PID: 13954 Comm: syz.2.1844 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1167.272343][T13954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1167.272350][T13954] Call Trace: [ 1167.272355][T13954] [ 1167.272362][T13954] dump_stack_lvl+0xe8/0x150 [ 1167.272383][T13954] dump_header+0xd3/0x4b0 [ 1167.272400][T13954] oom_kill_process+0x3ab/0x9e0 [ 1167.272414][T13954] out_of_memory+0xfb1/0x13b0 [ 1167.272432][T13954] ? __pfx_out_of_memory+0x10/0x10 [ 1167.272442][T13954] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1167.272454][T13954] ? _mutex_lock_killable+0x14d/0x1c0 [ 1167.272467][T13954] ? try_charge_memcg+0xa9e/0x1760 [ 1167.272482][T13954] try_charge_memcg+0xb75/0x1760 [ 1167.272493][T13954] ? __lock_acquire+0x747/0x2de0 [ 1167.272517][T13954] ? __pfx_try_charge_memcg+0x10/0x10 [ 1167.272539][T13954] ? charge_memcg+0x47/0x310 [ 1167.272552][T13954] charge_memcg+0x1dd/0x310 [ 1167.272564][T13954] __mem_cgroup_charge+0x25/0x80 [ 1167.272575][T13954] filemap_add_folio+0x199/0x610 [ 1167.272595][T13954] __filemap_get_folio_mpol+0x43d/0xf50 [ 1167.272605][T13954] ? count_memcg_event_mm+0x1d/0x250 [ 1167.272619][T13954] filemap_fault+0xa97/0x13d0 [ 1167.272635][T13954] ? __pfx_filemap_fault+0x10/0x10 [ 1167.272648][T13954] ? __pfx_filemap_map_pages+0x10/0x10 [ 1167.272657][T13954] ? lock_acquire+0x115/0x350 [ 1167.272677][T13954] __do_fault+0x138/0x2a0 [ 1167.272690][T13954] do_pte_missing+0x17ee/0x2970 [ 1167.272704][T13954] ? handle_mm_fault+0xeb/0x28c0 [ 1167.272720][T13954] handle_mm_fault+0xf64/0x28c0 [ 1167.272737][T13954] ? handle_mm_fault+0xeb/0x28c0 [ 1167.272754][T13954] ? follow_page_pte+0x663/0xf20 [ 1167.272767][T13954] ? __pfx_handle_mm_fault+0x10/0x10 [ 1167.272781][T13954] ? follow_page_pte+0x73e/0xf20 [ 1167.272799][T13954] ? __pfx_follow_page_pte+0x10/0x10 [ 1167.272816][T13954] __get_user_pages+0x1671/0x2650 [ 1167.272864][T13954] get_dump_page+0x1b5/0x410 [ 1167.272878][T13954] ? __pfx_get_dump_page+0x10/0x10 [ 1167.272890][T13954] ? __asan_memset+0x22/0x50 [ 1167.272905][T13954] ? iov_iter_bvec+0xb8/0x180 [ 1167.272919][T13954] dump_user_range+0x208/0xca0 [ 1167.272947][T13954] ? __pfx_dump_user_range+0x10/0x10 [ 1167.272968][T13954] ? __pfx_writenote+0x10/0x10 [ 1167.272981][T13954] ? __kmalloc_cache_noprof+0x3d0/0x670 [ 1167.272991][T13954] ? elf_core_dump+0x28d0/0x3a70 [ 1167.273009][T13954] elf_core_dump+0x346a/0x3a70 [ 1167.273032][T13954] ? __pfx_elf_core_dump+0x10/0x10 [ 1167.273044][T13954] ? __lock_acquire+0x747/0x2de0 [ 1167.273059][T13954] ? arch_do_signal_or_restart+0xbb/0x860 [ 1167.273098][T13954] ? lock_acquire+0x115/0x350 [ 1167.273111][T13954] ? 0xffffffffff600000 [ 1167.273129][T13954] do_coredump+0x5ee3/0x6a80 [ 1167.273158][T13954] ? __pfx_do_coredump+0x10/0x10 [ 1167.273176][T13954] ? __lock_acquire+0x747/0x2de0 [ 1167.273199][T13954] ? __lock_acquire+0x747/0x2de0 [ 1167.273222][T13954] ? lock_acquire+0x115/0x350 [ 1167.273240][T13954] ? lock_acquire+0x115/0x350 [ 1167.273258][T13954] ? is_bpf_text_address+0x26/0x2b0 [ 1167.273275][T13954] ? is_bpf_text_address+0x292/0x2b0 [ 1167.273287][T13954] ? is_bpf_text_address+0x26/0x2b0 [ 1167.273301][T13954] ? kernel_text_address+0xa5/0xe0 [ 1167.273314][T13954] ? __kernel_text_address+0xd/0x30 [ 1167.273326][T13954] ? unwind_get_return_address+0x4d/0x90 [ 1167.273340][T13954] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1167.273356][T13954] ? arch_stack_walk+0xfb/0x150 [ 1167.273377][T13954] ? stack_trace_save+0xa9/0x100 [ 1167.273395][T13954] ? try_to_take_rt_mutex+0x842/0xb00 [ 1167.273412][T13954] ? __lock_acquire+0x747/0x2de0 [ 1167.273433][T13954] ? __lock_acquire+0x747/0x2de0 [ 1167.273452][T13954] ? do_raw_spin_lock+0x12b/0x2f0 [ 1167.273479][T13954] ? reacquire_held_locks+0x117/0x1a0 [ 1167.273490][T13954] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1167.273507][T13954] ? rt_spin_unlock+0x159/0x200 [ 1167.273522][T13954] ? rt_spin_unlock+0x165/0x200 [ 1167.273536][T13954] vfs_coredump+0xac3/0x10c0 [ 1167.273555][T13954] ? __pfx_vfs_coredump+0x10/0x10 [ 1167.273569][T13954] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1167.273583][T13954] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1167.273617][T13954] ? rt_spin_unlock+0x159/0x200 [ 1167.273633][T13954] ? rt_spin_unlock+0x165/0x200 [ 1167.273647][T13954] get_signal+0x1090/0x12c0 [ 1167.273673][T13954] arch_do_signal_or_restart+0xbb/0x860 [ 1167.273686][T13954] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1167.273709][T13954] irqentry_exit+0x348/0x9b0 [ 1167.273719][T13954] ? trace_irq_disable+0x3b/0x140 [ 1167.273734][T13954] asm_exc_page_fault+0x26/0x30 [ 1167.273744][T13954] RIP: 0033:0x7f51f380f561 [ 1167.273755][T13954] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 1167.273764][T13954] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 1167.273775][T13954] RAX: 0000000000000000 RBX: 00007f51f3a96090 RCX: 00007f51f380f559 [ 1167.273782][T13954] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 1167.273789][T13954] RBP: 00007f51f38a6b20 R08: 0000000000000000 R09: 0000000000000000 [ 1167.273795][T13954] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1167.273802][T13954] R13: 00007f51f3a96128 R14: 00007f51f3a96090 R15: 00007ffebd6ae278 [ 1167.273819][T13954] [ 1167.273824][T13954] memory: usage 307200kB, limit 307200kB, failcnt 30045 [ 1167.273831][T13954] memory+swap: usage 344528kB, limit 9007199254740988kB, failcnt 0 [ 1167.273845][T13954] kmem: usage 2420kB, limit 9007199254740988kB, failcnt 0 [ 1167.273852][T13954] Memory cgroup stats for /syz2: [ 1167.273929][T13954] cache 311689216 [ 1167.273934][T13954] rss 368640 [ 1167.273938][T13954] shmem 311476224 [ 1167.273941][T13954] mapped_file 147890176 [ 1167.273945][T13954] dirty 0 [ 1167.273949][T13954] writeback 0 [ 1167.273953][T13954] workingset_refault_anon 506 [ 1167.273957][T13954] workingset_refault_file 4811 [ 1167.273961][T13954] swap 38223872 [ 1167.273965][T13954] swapcached 0 [ 1167.273968][T13954] pgpgin 1078664 [ 1167.273972][T13954] pgpgout 1002478 [ 1167.273976][T13954] pgfault 394927 [ 1167.273979][T13954] pgmajfault 592 [ 1167.273983][T13954] inactive_anon 299847680 [ 1167.273987][T13954] active_anon 11993088 [ 1167.273991][T13954] inactive_file 0 [ 1167.273994][T13954] active_file 0 [ 1167.273998][T13954] unevictable 0 [ 1167.274001][T13954] hierarchical_memory_limit 314572800 [ 1167.274006][T13954] hierarchical_memsw_limit 9223372036854771712 [ 1167.274010][T13954] total_cache 311689216 [ 1167.274014][T13954] total_rss 368640 [ 1167.274017][T13954] total_shmem 311476224 [ 1167.274021][T13954] total_mapped_file 147890176 [ 1167.274025][T13954] total_dirty 0 [ 1167.274028][T13954] total_writeback 0 [ 1167.274032][T13954] total_workingset_refault_anon 506 [ 1167.274036][T13954] total_workingset_refault_file 4811 [ 1167.274040][T13954] total_swap 38223872 [ 1167.274044][T13954] total_swapcached 0 [ 1167.274048][T13954] total_pgpgin 1078664 [ 1167.274051][T13954] total_pgpgout 1002478 [ 1167.274055][T13954] total_pgfault 394927 [ 1167.274059][T13954] total_pgmajfault 592 [ 1167.274063][T13954] total_inactive_anon 299847680 [ 1167.274067][T13954] total_active_anon 11993088 [ 1167.274071][T13954] total_inactive_file 0 [ 1167.274074][T13954] total_active_file 0 [ 1167.274078][T13954] total_unevictable 0 [ 1167.274082][T13954] anon_cost 9831 [ 1167.274085][T13954] file_cost 3912 [ 1167.274089][T13954] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.1844,pid=13954,uid=0 [ 1167.274153][T13954] Memory cgroup out of memory: Killed process 13954 (syz.2.1844) total-vm:102412kB, anon-rss:1448kB, file-rss:53832kB, shmem-rss:0kB, UID:0 pgtables:192kB oom_score_adj:1000 [ 1167.873950][ T39] oom_reaper: reaped process 13551 (syz.2.1785), now anon-rss:0kB, file-rss:20480kB, shmem-rss:86164kB [ 1170.521987][T11231] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1170.555681][T11231] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1170.558897][T11231] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1170.560757][T11231] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1170.562054][T11231] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1171.729258][T11669] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1171.779674][T11669] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1171.802857][T11669] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1171.810819][T11669] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1171.820978][T11669] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1172.367284][T13988] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1172.705641][T13968] Bluetooth: hci3: command tx timeout [ 1173.848850][T14008] FAULT_INJECTION: forcing a failure. [ 1173.848850][T14008] name failslab, interval 1, probability 0, space 0, times 0 [ 1173.848875][T14008] CPU: 0 UID: 0 PID: 14008 Comm: syz.0.1850 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1173.848888][T14008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1173.848895][T14008] Call Trace: [ 1173.848900][T14008] [ 1173.848905][T14008] dump_stack_lvl+0xe8/0x150 [ 1173.848928][T14008] should_fail_ex+0x447/0x5e0 [ 1173.848943][T14008] should_failslab+0xa8/0x100 [ 1173.848958][T14008] __kmalloc_cache_noprof+0x9c/0x670 [ 1173.848969][T14008] ? __io_uring_add_tctx_node+0x186/0x630 [ 1173.848980][T14008] ? __io_uring_add_tctx_node+0x186/0x630 [ 1173.848996][T14008] __io_uring_add_tctx_node+0x186/0x630 [ 1173.849011][T14008] ? __pfx___io_uring_add_tctx_node+0x10/0x10 [ 1173.849025][T14008] ? __anon_inode_getfile+0x16c/0x210 [ 1173.849040][T14008] io_uring_create+0x591/0x980 [ 1173.849053][T14008] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 1173.849066][T14008] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1173.849080][T14008] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1173.849099][T14008] ? rcu_is_watching+0x16/0xb0 [ 1173.849117][T14008] do_syscall_64+0x166/0x520 [ 1173.849126][T14008] ? trace_irq_disable+0x3b/0x140 [ 1173.849136][T14008] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1173.849156][T14008] ? clear_bhb_loop+0x70/0xc0 [ 1173.849168][T14008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1173.849178][T14008] RIP: 0033:0x7f9e3269f559 [ 1173.849189][T14008] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1173.849205][T14008] RSP: 002b:00007f9e308edfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1173.849225][T14008] RAX: ffffffffffffffda RBX: 0000200000000500 RCX: 00007f9e3269f559 [ 1173.849240][T14008] RDX: 00002000000005c0 RSI: 0000200000000500 RDI: 000000000000001a [ 1173.849248][T14008] RBP: 00007f9e32736b20 R08: 0000000000000000 R09: 0000000000000000 [ 1173.849255][T14008] R10: 0000200000000600 R11: 0000000000000206 R12: 00002000000005c0 [ 1173.849262][T14008] R13: 0000200000000600 R14: 0000200000000580 R15: 00007ffdd9128bb8 [ 1173.849279][T14008] [ 1174.227225][T13968] Bluetooth: hci6: command tx timeout [ 1174.785906][T13968] Bluetooth: hci3: command tx timeout [ 1175.792479][T13965] rxe_eth0 speed is unknown, defaulting to 1000 [ 1176.175617][ T9] usb 1-1: new full-speed USB device number 61 using dummy_hcd [ 1176.306029][T13968] Bluetooth: hci6: command tx timeout [ 1176.350638][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1176.352470][ T9] usb 1-1: not running at top speed; connect to a high speed hub [ 1176.352496][ T9] usb 1-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1176.402630][ T9] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 1176.402649][ T9] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 1176.402660][ T9] usb 1-1: config 14 has no interface number 0 [ 1176.402668][ T9] usb 1-1: config 14 has no interface number 1 [ 1176.402708][ T9] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1176.402720][ T9] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1176.402733][ T9] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 1176.402747][ T9] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1176.402760][ T9] usb 1-1: config 14 interface 57 has no altsetting 0 [ 1176.402769][ T9] usb 1-1: config 14 interface 228 has no altsetting 0 [ 1176.505590][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1176.505618][ T9] usb 1-1: Product: syz [ 1176.505631][ T9] usb 1-1: Manufacturer: syz [ 1176.505644][ T9] usb 1-1: SerialNumber: syz [ 1176.584510][T14025] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1176.902576][T13968] Bluetooth: hci3: command tx timeout [ 1177.413031][ T9] legousbtower 1-1:14.57: interrupt endpoints not found [ 1177.796191][ T9] legousbtower 1-1:14.228: get version request failed: -71 [ 1177.796296][ T9] legousbtower 1-1:14.228: probe with driver legousbtower failed with error -71 [ 1177.858702][ T9] usb 1-1: USB disconnect, device number 61 [ 1177.928284][T13984] rxe_eth0 speed is unknown, defaulting to 1000 [ 1178.385562][T13968] Bluetooth: hci6: command tx timeout [ 1178.945637][T13968] Bluetooth: hci3: command tx timeout [ 1180.465757][T13968] Bluetooth: hci6: command tx timeout [ 1181.575562][ T5743] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 1181.937296][T14055] [ 1181.939670][T14055] ============================================ [ 1181.945874][T14055] WARNING: possible recursive locking detected [ 1181.952101][T14055] syzkaller #0 Not tainted [ 1181.956606][T14055] -------------------------------------------- [ 1181.962764][T14055] syz.0.1858/14055 is trying to acquire lock: [ 1181.968978][T14055] ffff888027f03108 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: blkdev_buffered_write+0xd9/0x170 [ 1181.979756][T14055] [ 1181.979756][T14055] but task is already holding lock: [ 1181.987176][T14055] ffff888027f03108 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: blkdev_write_iter+0x6c8/0x810 [ 1181.997537][T14055] [ 1181.997537][T14055] other info that might help us debug this: [ 1182.005596][T14055] Possible unsafe locking scenario: [ 1182.005596][T14055] [ 1182.013126][T14055] CPU0 [ 1182.016405][T14055] ---- [ 1182.019682][T14055] lock(&sb->s_type->i_mutex_key#9); [ 1182.025079][T14055] lock(&sb->s_type->i_mutex_key#9); [ 1182.030478][T14055] [ 1182.030478][T14055] *** DEADLOCK *** [ 1182.030478][T14055] [ 1182.038722][T14055] May be due to missing lock nesting notation [ 1182.038722][T14055] [ 1182.047041][T14055] locks held by syz.0.1858/14055: 1, last CPU#0: [ 1182.053362][T14055] #0: ffff888027f03108 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: blkdev_write_iter+0x6c8/0x810 [ 1182.064186][T14055] [ 1182.064186][T14055] stack backtrace: [ 1182.070087][T14055] CPU: 0 UID: 0 PID: 14055 Comm: syz.0.1858 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1182.079986][T14055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1182.090032][T14055] Call Trace: [ 1182.093316][T14055] [ 1182.096250][T14055] dump_stack_lvl+0xe8/0x150 [ 1182.100835][T14055] print_deadlock_bug+0x27a/0x290 [ 1182.105869][T14055] __lock_acquire+0x25db/0x2de0 [ 1182.110722][T14055] lock_acquire+0x115/0x350 [ 1182.115231][T14055] ? blkdev_buffered_write+0xd9/0x170 [ 1182.120608][T14055] down_read+0x92/0x200 [ 1182.124770][T14055] ? blkdev_buffered_write+0xd9/0x170 [ 1182.130209][T14055] ? __pfx_down_read+0x10/0x10 [ 1182.134991][T14055] ? down_read+0x151/0x200 [ 1182.139402][T14055] ? __pfx_down_read+0x10/0x10 [ 1182.144166][T14055] ? kiocb_invalidate_pages+0xfc/0x140 [ 1182.149643][T14055] blkdev_buffered_write+0xd9/0x170 [ 1182.154858][T14055] blkdev_write_iter+0x6d8/0x810 [ 1182.159795][T14055] iter_file_splice_write+0xa36/0x1240 [ 1182.165339][T14055] ? __pfx_iter_file_splice_write+0x10/0x10 [ 1182.171277][T14055] ? __pfx_copy_splice_read+0x10/0x10 [ 1182.176672][T14055] ? register_lock_class+0x31/0x2e0 [ 1182.181863][T14055] ? __pfx_iter_file_splice_write+0x10/0x10 [ 1182.187766][T14055] direct_splice_actor+0x104/0x160 [ 1182.192883][T14055] splice_direct_to_actor+0x586/0xcc0 [ 1182.198255][T14055] ? __pfx_direct_splice_actor+0x10/0x10 [ 1182.203913][T14055] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1182.209843][T14055] do_splice_direct+0x19b/0x2a0 [ 1182.214722][T14055] ? __pfx_do_splice_direct+0x10/0x10 [ 1182.220104][T14055] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1182.226012][T14055] ? bpf_lsm_file_permission+0x9/0x20 [ 1182.231379][T14055] ? security_file_permission+0x75/0x260 [ 1182.237005][T14055] ? rw_verify_area+0x209/0x4d0 [ 1182.241854][T14055] ? fdget+0x1b2/0x250 [ 1182.245916][T14055] do_sendfile+0x540/0x7e0 [ 1182.250320][T14055] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1182.256133][T14055] ? __pfx_do_sendfile+0x10/0x10 [ 1182.261079][T14055] ? __se_sys_futex+0x3a8/0x450 [ 1182.265943][T14055] __se_sys_sendfile64+0x144/0x1a0 [ 1182.271061][T14055] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 1182.276725][T14055] do_syscall_64+0x166/0x520 [ 1182.281340][T14055] ? trace_irq_disable+0x3b/0x140 [ 1182.286368][T14055] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1182.292431][T14055] ? clear_bhb_loop+0x70/0xc0 [ 1182.297121][T14055] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1182.303022][T14055] RIP: 0033:0x7f9e3269f559 [ 1182.307447][T14055] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1182.327045][T14055] RSP: 002b:00007f9e30489028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1182.335476][T14055] RAX: ffffffffffffffda RBX: 00007f9e32926270 RCX: 00007f9e3269f559 [ 1182.343634][T14055] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 1182.351640][T14055] RBP: 00007f9e32736b20 R08: 0000000000000000 R09: 0000000000000000 [ 1182.359622][T14055] R10: 00000001002000ff R11: 0000000000000246 R12: 0000000000000000 [ 1182.367605][T14055] R13: 00007f9e32926308 R14: 00007f9e32926270 R15: 00007ffdd9128bb8 [ 1182.375585][T14055] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1182.744486][T14059] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1183.436016][ T96] bridge_slave_1: left allmulticast mode [ 1183.436044][ T96] bridge_slave_1: left promiscuous mode [ 1183.436210][ T96] bridge0: port 2(bridge_slave_1) entered disabled state [ 1183.618844][ T96] bridge_slave_0: left allmulticast mode [ 1183.618863][ T96] bridge_slave_0: left promiscuous mode [ 1183.618982][ T96] bridge0: port 1(bridge_slave_0) entered disabled state [ 1183.998248][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 1183.998280][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 1184.580857][ T96] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1184.756301][ T96] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1184.886966][ T96] bond0 (unregistering): Released all slaves [ 1185.666529][ T5266] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1186.715783][ T96] hsr_slave_0: left promiscuous mode [ 1186.766925][ T96] hsr_slave_1: left promiscuous mode [ 1186.767480][ T96] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1186.809248][ T96] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1187.125915][ T96] team0 (unregistering): Port device team_slave_1 removed [ 1187.166280][ T96] team0 (unregistering): Port device team_slave_0 removed [ 1187.237050][ T5266] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1187.454472][ T5266] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1187.673086][ T5266] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1188.016575][ T96] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1188.226679][ T96] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1188.477440][ T96] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1188.706676][ T96] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.179001][ T5266] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1189.414071][ T5266] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1189.663164][ T5266] 8021q: adding VLAN 0 to HW filter on device eth15 [ 1190.063643][ T5266] 8021q: adding VLAN 0 to HW filter on device eth16 [ 1190.317150][ T5266] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1190.706909][ T5266] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1190.965250][ T5266] 8021q: adding VLAN 0 to HW filter on device eth19 [ 1191.306837][ T5266] 8021q: adding VLAN 0 to HW filter on device eth20 [ 1191.530486][ T5266] 8021q: adding VLAN 0 to HW filter on device eth21 [ 1191.786875][ T5266] 8021q: adding VLAN 0 to HW filter on device eth22