last executing test programs: 10.31677157s ago: executing program 2 (id=3023): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x18) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, 0x0, 0x0, 0x49, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x6, &(0x7f0000000180)=0xff, 0x4) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r4 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r5 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r4) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000180)={r5}, &(0x7f00000008c0)=ANY=[@ANYBLOB="656e633d706b63733120686173683d6d643529000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f000000000000000000000000000000005419a81690ced2afb3b3671179dec10e8b6ec46acf736d6a6ee1da"], 0x0, 0x0) 9.946044651s ago: executing program 2 (id=3025): r0 = socket$tipc(0x1e, 0x5, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='ns\x00') getdents(r3, &(0x7f0000000140)=""/72, 0x48) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) mq_unlink(&(0x7f0000000080)='\x00') syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r4 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e, 0x2}, 0x18, 0x0) landlock_restrict_self(r4, 0xe) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000060a0b040000000000000000020000002400685000000000000001006374000014000280080002400000000208000140000000160900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x78}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000200)={@local, @random="d8be17d19221", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x23, 0x28, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x2, 0x0, 0xe7}}}}}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r3, 0x3ba0, &(0x7f0000000300)={0x48, 0x17, 0x0, 0x0, 0x5, 0x0, 0x0}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYRESHEX=r8, @ANYRES32=r7, @ANYRESOCT=r1, @ANYRESDEC=r1, @ANYRES64=r2, @ANYRES64=r0, @ANYRES32=r7, @ANYRESDEC=r0], 0x48}, 0x1, 0x0, 0x0, 0x4500}, 0x4) 7.812049406s ago: executing program 2 (id=3034): syz_emit_ethernet(0x66, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x4, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) memfd_create(0x0, 0x3) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x5b) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x801d) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x63b5, &(0x7f0000006680)) request_key(0x0, 0x0, 0x0, 0xfffffffffffffffd) syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x5300a2) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, 0x0, &(0x7f0000000280), 0x0) syz_usb_connect(0x6, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201574a403731103b0904a101000102030904610001000000000000b482fd7b85864b5266e6"], 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080003006400000008000200c8"], 0x2c}, 0x1, 0x0, 0x6000}, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 7.147610351s ago: executing program 0 (id=3041): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r0, r0, &(0x7f0000000000)=0x2eb4, 0x2000007ff) 6.996478023s ago: executing program 0 (id=3043): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff00700000ae04020000000000be400300000000006504030001ed00007b130000000000007f44000000000000630a04fe000000007933ff80000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffdbb, 0x0, 0xffffffffffffffff, 0xfc55}, 0x48) 6.854494826s ago: executing program 0 (id=3045): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000300)=@newlink={0x34, 0x10, 0x439, 0xfffffffd, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x9901, 0x49a41}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x4}}}]}, 0x34}}, 0x0) timer_create(0x1, &(0x7f0000000300)={0x0, 0x13, 0x0, @thr={&(0x7f00000001c0)="f4ff8dacc868d2a648f9479104a647ebffd952708b725f549605f15bf52bc460f389ae58d7480aa1c2d18e0da2077b31bdae409832925c2307c3bbfbcee442e92bdd05ababbff78d01c2ede300ec20e705fe2cbacad3266fb7688e7dc57d27ab04fb27a3213c5b082defddbdcfafae4299c80cbc", 0x0}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000005c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xb, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x7f, 0x76, 0x1, 0x0, 0x0, 0x8, 0x10, 0xc, 0xff, 0x0, '\x00', 0x0, 0x7f}) ioctl$KVM_RUN(r2, 0xae80, 0x800000000000000) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x10000, 0xe, 0x10001, 0xfffffffe, 0x0, [{0x2, 0xc, 0x87, '\x00', 0x8}, {0x9, 0x18, 0x40, '\x00', 0xb}, {0xff, 0x83, 0x9, '\x00', 0x64}, {0x0, 0x5, 0xd4, '\x00', 0xf}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7b}, {0x4, 0x82, 0xc}, {0x7f, 0xd, 0xb, '\x00', 0xb}, {0xd7, 0xd, 0x1, '\x00', 0x6}, {0x0, 0x28, 0x80, '\x00', 0xdc}, {0xff, 0x1, 0xee, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x10, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x7, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0x9, 0x5, '\x00', 0xc}, {0x7, 0xe1, 0x7, '\x00', 0xc6}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7b}, {0x10, 0x6, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x3, 0x4}]}}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) 6.320764596s ago: executing program 0 (id=3046): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="0500000003"], 0x48}}, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000540)={0x48, 0x2, r5, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r4, 0x3b89, &(0x7f0000000200)={0x28, 0x3, r6, r5, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r4, 0x3b8c, &(0x7f0000000040)={0x30, r7, 0x0, 0x0, 0x0, 0x801, 0x2ad, 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'xfrm0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000002c0)={'wg0\x00', 0x0}) syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000000)=0xffffffffffffffff, 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) ppoll(&(0x7f0000000100)=[{r11, 0xe008}, {r11, 0x8004}], 0x2, 0x0, 0x0, 0x0) wait4(0xffffffffffffffff, 0x0, 0x40000000, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f00000003c0)={@private1, 0x0}, &(0x7f00000005c0)=0x14) r13 = openat$binfmt_register(0xffffff9c, &(0x7f0000000000), 0x1, 0x0) write$binfmt_register(r13, &(0x7f00000000c0)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x80000000, 0x3a, '\\x]^\\', 0x3a, '', 0x3a, './file0/../file0'}, 0x35) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000740)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)=ANY=[@ANYBLOB="c8000000", @ANYRES16=r3, @ANYBLOB="00012cbd7000ffdbdf25190000001800018014000200776731000000000000000000000000009000018008000100", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="14000200766972745f776966693000000000000014000200626f6e645f736c6176655f3100000000140002006e657464657673696d300000000000000800030002000000140002007866726d30000000000000000000000008000100", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="140002006e7230000000000000000000000000000c00010100000100", @ANYRES32=r12, @ANYBLOB], 0xc8}, 0x1, 0x0, 0x0, 0x8000}, 0x41) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xfc) r14 = syz_usb_connect$printer(0x6, 0x36, &(0x7f0000000780)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x5, 0x30, 0x1b, "", [{{0x9, 0x4, 0x0, 0x40, 0x1, 0x7, 0x1, 0x2, 0x3, "", {{{0x9, 0x5, 0x1, 0x2, 0x8, 0x3, 0xa, 0x5}}, [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x8, 0x4, 0x9}}]}}}]}}]}}, &(0x7f0000000940)={0xa, &(0x7f00000007c0)={0xa, 0x6, 0x0, 0x3, 0x5, 0x1, 0x8, 0x3}, 0xb6, &(0x7f0000000800)={0x5, 0xf, 0xb6, 0x1, [@generic={0xb1, 0x10, 0xd, "442ae33cab7fb54522355675063d717fea6cfffc8f3817c0d6a5b299a1ad40a8ce1f2f8131d1548df4e20132e895e8b17f5a81a1d04249e2726b374ac0b067644d264ed0d888e62b67a559f306427bc1994e859efb745a044279f21ae848190f487c9ba7c9b14bc916cf4d207b2cc64f956ac625211249a8102ef25b09ab998384641da7ca3d2e6d5f6ac74ca6678489143cc0127238d6a6d6bce84ab1d67339ddc59040d965cc1585cbfadbc872"}]}, 0x2, [{0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x41c}}]}) syz_usb_control_io$printer(r14, &(0x7f0000000b40)={0x14, &(0x7f0000000980)={0x0, 0xe, 0xe6, {0xe6, 0x11, "e621e40d2977ee59ffbf7a02b404d6b50e89e88c92b5e73a1d47c465bd136d0590601b477741cb2a9de3e6b88421d9f8edbf06c56567226e0aea6e48a2d70e79e5e98bce41572b0efa4c4fe25bd324b6ccedc2cb97d40c85c80af946ea73b6d97fc92a44143c7d9732689d3c2ee4d6739a3b9550bdb39e6cc3a3b20831fadfef1a3c49e9e2d2c7a851966d39c02714d6209caf70a68626caaab22e483cf07bd1df163ebd3ff17ffd33f05c2728692b5fb9286c5536eef91e831b14622297fc94b52611f84400e5d10699371a7873bc520ed106d8a8429d9173e0bc039e3837c7ec020a36"}}, &(0x7f0000000a80)={0x0, 0x3, 0x80, @string={0x80, 0x3, "1446e081df10261365f9a33b64ae73817560dfa63d136beaaf69962b788c9e50a14c844230bf103fc447032f402a391a1d338079f695ff00259843b74555e4203bd8ab10fa470cde21fb29042c923f95b4b17580072a6b9065c9b20ea8a790b9bdd31443b887b75560578be781fe0b1e0a0187ecb100005c01d3743cabb8"}}}, &(0x7f0000000dc0)={0x34, &(0x7f0000000b80)={0x20, 0xe, 0xea, "029d4a72562cbcd8cb0fe16fd31c88673494d52d496d331392bd5c1a1d26affd2d0db60354d04bb35bf57d89dc5d0d2f5a1386235ae2c9ef1fe2a314738d56e78c5e20012e0444ea1b0b6a5e474f101ed5906f9aeec665f6d48ece4754668e76456a4eb5a98e7f63811ecdb059514cc872f6c83c8de73bc146182a52af341c1a7e21c827e8555f0ff7512d31a13f2c4938a62ad49593bf08efd5306e749548ed1b8f9533688dcfbae3adf70cb7a648d1176c013cab52f3d95735dedfb0d798d2217dd595be8507ed31dbf522d55160d3839626e3a7bc14b56cea04c47d0027b8ecc950f08af091de86d8"}, &(0x7f0000000c80)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000cc0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000d00)={0x20, 0x0, 0x11, {0xf, "8bc3670e8a458d652923e6d6bc7972"}}, &(0x7f0000000d40)={0x20, 0x1, 0x1, 0x2}, &(0x7f0000000d80)={0x20, 0x0, 0x1, 0x56}}) r15 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) open_tree(r15, 0x0, 0x89101) write$USERIO_CMD_REGISTER(r15, &(0x7f00000000c0)={0x0, 0x48}, 0x2) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000040)={0x0, 0xb8f0, 0x30}, &(0x7f0000000080)=0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f0000000480)={r16, @in6={{0xa, 0x4e24, 0x10, @private1, 0x9}}, [0x2, 0x8, 0xa1, 0x0, 0x7a, 0x0, 0xf7b, 0x1, 0x80000001, 0x3, 0x5, 0x9, 0x8, 0x6, 0x8]}, &(0x7f0000000580)=0x100) 4.748949586s ago: executing program 3 (id=3063): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a140000001000010000000000000000000084000a113b553283ccff079c57d31a1a59a4a80f66abaa99977f929547b6730bdc"], 0x28}, 0x1, 0x0, 0x0, 0x20000080}, 0x10) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x60, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xfffffffa}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x8800) (fail_nth: 6) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x25, &(0x7f0000000080)=[@in={0x2, 0x0, @dev}], 0xffe2) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x28000, 0x0) ioctl$TUNGETFEATURES(r2, 0x800454cf, &(0x7f0000000300)) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x16) 4.527663046s ago: executing program 3 (id=3064): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) socket(0x10, 0x803, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0xe0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000000c0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, &(0x7f00000001c0)=[0x0], &(0x7f00000002c0)=[0x0], 0x0, 0x9a, &(0x7f0000000440)=[{}], 0x8, 0x10, &(0x7f0000000480), &(0x7f00000004c0), 0x8, 0xc4, 0x8, 0x8, &(0x7f0000000500)}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000680)={r4}, 0x4) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0x2}, 0x1c) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x403, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x94440}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e6576650000200002801400070000000000000000000000000000000001050004000100000008000a00", @ANYRES32=r2], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 4.132064271s ago: executing program 2 (id=3066): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x18, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0xd}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x64}}, {{0x6, 0x0, 0x6}, {0x6, 0x0, 0x0, 0xb}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}, {0x56}}, @call={0x85, 0x0, 0x0, 0x1f}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0xf2}}}, &(0x7f0000000780)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xef12}, 0x94) 4.06201767s ago: executing program 2 (id=3067): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f00000003c0)={{0x6, @dev={0xac, 0x14, 0x14, 0x40}, 0x4e23, 0x2, 'none\x00', 0x12, 0x3, 0x69}, {@private=0xa010102, 0x4e22, 0x10000, 0x4, 0x3, 0x9}}, 0x44) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x340, 0x130, 0x111, 0x4b4, 0x130, 0xd4feffff, 0x270, 0x20a, 0x278, 0x270, 0x278, 0x3, 0x0, {[{{@ipv6={@private2, @remote, [], [0x0, 0x0, 0x0, 0xffffff00], 'dvmrp0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x0, 0x108, 0x130, 0x0, {}, [@common=@inet=@tcp={{0x30}, {[0x4e20, 0x4e23], [0x4e20, 0x4e22], 0x3, 0x8, 0x80, 0x7}}, @common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x0, 0x10}}]}, @common=@inet=@TCPMSS={0x28}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@ipv6header={{0x28}}, @common=@ipv6header={{0x28}, {0x4, 0x11, 0x1}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x8ba4, 0x0, 0x80000001, '\x00', {0x10000}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) syz_usb_connect$uac3(0x0, 0xa0, &(0x7f0000000080)=ANY=[@ANYBLOB="120110030000004035121000400001020301090284f90649002040080b0201012130ac090400e700010130000a2401042a00ff0f000013240303000000060202800000070010000200132409020200010000f446"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xb, &(0x7f0000000140)=@string={0xb, 0x3, "db9ef8278d32d9140d"}}]}) 3.81517618s ago: executing program 3 (id=3070): syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x0, 0x44ae, 0x200, 0x0, 0x188}, &(0x7f0000000080)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf9ae, 0x80000, 0x3, 0x2a8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9452, 0x0, 0x3, 0x23c}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9056, 0x80, 0x1, 0x2e3}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xad42, 0x40000, 0x0, 0x8c}, 0xffffffffffffffff}], 0x4, &(0x7f0000001300)={0x2e, 0x1b, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, '\x00', {0x1, 0x35e, 0x0, &(0x7f0000000300)=@buf_max_buf="a1f27f54b952fc2fd44eae97a70367074ff06aac15c1cc08950be3af85c4271ac6deb69cc85e75870783e0eaba591e39a2c32d1880dffc2d935fe1823dc7bc6cd1af3656f2463bce291abc16ee8b7757c1b117e75a970f3ba76fd72e00cc6958a3295446fd6ab54300c34ad0bf21a6b374b814f52ffb41dd4fb0a4bffa9d3449efafa191f486a3e97c7573a249c7bdfcf38a4e9647fcb0f6f452bdedc36bbd401385ceba73e03eb5a0650bedb7a8a38a0b10e53a8fe8acfcbabe79d19968aa022656121cdbab6addaf1e8f4043e6fd246af5831589e0a0452c02125e85645a005373fea6eac980636897623d4a560190ba704ab3fc4a27a529caf550fe7af6d609b9b3910ab51c1d810a9290798bea8d15a92a0031d70bcb24de1bd0146668f62f0a04fde3f4ff9f78c61af1a70bb4f70c557bac9f54ab11058c26f9120d82b15c8d1437ef664f38408c86c91a0c752320b876a8daa43a7596667fd34cef27965761156378b88dded01c14f49eedf1147c17760ed96e22e3d8b3c028dafd107ee50239c63a078422fb32635f7d58fa7172394474d363165b424f3a55788efa0211f662433e86fa71730c55d119a59596e0ab77e5118f288ec994b38e1035004c29b19106276848e4500722b5ba3e015c522dd02a66b22a5dd10ca709c2645b2daf0298da939add6d23d0360f0ac8018dfad28279863fd8fd0ce7eb6a8da850658f4c09ce0faf7808830672e16e667c3d441296fb4a85ee7b9fefa922d01ac986b44666f9a735cefe9b0476c02eaaecbce1296ce46d1f54c8eac63faeb60d07b8855e10451bf2e015259feb08b6917cccf7d87eb58a3c49073ec20b46bd610b17169f0d30fbd7d30fc445fd27d6b4f67787c20d2b2545c022eab4cb9ab8c508b8f232b33e6c4ff52966b89e7b82f837b242131bbaa637351782ddb5a02639c4cb20a99037ba0f314075fe6528e1f0e5bbb428ddbcdb4ec1a2e04b3b559d83fe39c034f1754fc6d32951146473afb6e874053ea7c10168469795f4c71d53ef87f10cf3bec4b00a9ba6d244aef1d180614eb8fd98dfd74491d1bfe1bdfa7ac7081412c88df55ac5f5796217d4a21230325b75758698b6bbac33c7fdd70b4a1968a394572e71a7b5629e992f2fed08cd3f337b375befd9487bfb00ad62fb2488ab402fe0d056aeed82bc604c048a04b89dc129cf110d9042980adf1aefea82ac688585aa6a886ba75aca12d05384d2a8ee20c041a03e0706a2f8eddf16118d3faa25828cbff11f24e439e805a573a66dbd150d6edf53931861fab58cb2b18905a99340564b0a20f56f75a408a7cfad9c5de48497526bdbf484c8a6f4d2b21809873d1dc98b5574682c92bef540d9438f977a503643cbe471a9abdc123d3e70c034ce773f04e1c9868b42c9f85444754d60f92b50679127c765def60d99277fcb8373451a41d766d2b505de14b2d6a00f5de9c08aae9e858353bf0d16a6e5d7127d5c0d077bae01fea0fc3beab2924a4b75bad064819523d11234aa4138f25164fbef361312ee8ab7b59ecb36bd6cc42516a512b159569687eb8fa44bb79232541d2d0e329e21bc084b1c1151fb5d51ffeaad971ca6b50e5922f9babbf2239f9b2ea266263a4874d5043efd639f44bc7afb8b4fee712d1074ecceff28b35c80ad2543731eb3fb45742d869aa195694205d2a16cbe0bd64769fdad38b04f6430b8b3748491c84d42af03490ea41ba9660e800f002bf4b09b358a17468a90f99e4c478aad0475b01ad99b10637b8ebf37a77276e293f9aa19ff9e0d1f7f997b7e3a1981a3bb8722a05907dadc5c367b186586379b22d71c2527749651196a50599e481d1eb200fd6558aca5d37189569bc087829ab4c87d17489535f102070681d13d81ae8f28329fbf78e47859320a72b3b2b3edcff3ea331c89748089313733cd3a296e9fa7b41b8c014ea679edcac265b092a295ca55dd683c1319e95d4677baa37e04c68d4d6a70f8bb29eaa8faf1dfcfa9dac2161490efd005eb5f5fc4cd67ba2a6b1f44201b93314d1b03b3b8141e6f4e13852c433ede7f0da0898c1816ab8a584bd646777da1340f7d8c35210c1ed973b525d0cf54e5a8f12824b6a9e91034029bc01c14d47f6e731cecfd36665c6155f88d5709c87bd4519d162c17c5e13bb3cc2e9e1aa088754315c64e4717db1e9e19f52763172522aecfaf0e4e849fa3a30127784c8452ba338b91f3addff1199954617de46f0e0388b711b0fa16d08effc29f969204a28b5f2e46467c54e1cb68d216214ff9059d6ef11281b2d5f526f8cd2ea659bde82167893360d24791b6fab31c3e2c376f4b0e654d5ec5dd40c1be991e43cc537e6577fdcc7ba791ec7574e2865bb11f7ca5a2fd62dcfa5eeccf05bdedb1a1cb458e9c3ca9cb23eae30dcddcc576dba70722d598d295e50d314b7d81b1a6e84c89fb905e9ce7dd1700592274f28c54d0a09beecb6fb0d4bc3bc1409af06d44a55923a554c8687223e49c84f00ded2d88c14e6e9bd0487de48c9fd474ab889d7ef5016ef2327f6f1d9782a871d805e5849d35adf3652b7fffcb4fa32fe14269121b6e3052eb58745d04afa3cef5d813810e6a00bd1b8a92f9277bc79eca1197be0a1f670346d1e8a288467192bc49af91a2afaadfc7c1c4b66e636f235938c2a901e07aca278d99185b2dc21aa54acc81317f7281f383ba7090afd4acb41aa384e3141f80eea3f98564c35c72629c5a14e9b4577904d3fd79cf6d23030ab8fb7097611dfc2f6c4fae11a0bcd4b1d7e4bd55ba0f256de1fff0240c7b6d83799267a855c94e869c584bbdc3ed124c068351889c157abce25e98bb7f5de8013ff6c5c85bc4d8746aa1b48be59b02b105fe34765e0f04b48d35dade0f07a4352d09c1b90e69714f885d9b53dab25aa0efc67cfd02a2f87e4a961aa7efce7fb84f8286b9acb33a2886389ed93f05c8ffb1964fbb0c97540894418592074a64eb0aad93f08286edbb52f1ee5a7d7454f6d3d913925bbd7d305e96c9de3b13a031d6e93806e5c5712d0ed9a0d50c7c644bbd50e8cbafaf29d9761239bbff2ee993f1cf1f3b650a0375a062ab8a2a03352a9889b2886ccc3031e9b9c9146485fb09f4a0fd9f49e29ec08128df4537403a255ab2000e0553307de24145d4096eea7b0a94cddebd4342863f2890a61fc097abb0b001b2b7bb16ac4b79990d7b5d0c56185a02b7ff99e1f664744b0d2f62e444b25e736a6b5827b56fc98e8391a288b353d144c3139ab8d0d77719e8abebcd1a10d510e38ea73c0735958ee7d15b6400893b50778e613ee05c629773ca63c00b0d202322a87823eafd43735f19daf6364457f072606160bd7bb7262116f7585219926fe15e1d573539367d8d2ff11fdd9451cf14014eeffd9f7b2d4b86adeca5165b876eb4d92a9dad0ea4f0793c5da6b4d06b57fc019b824ed317e85ece24c2a773dd893c22268e079a892751c8cd47c25694d2ef701201198b421085f74145b98643ac4a28aa5f84389642b45b9a73e703b3e089d07bbe17fa9d7296241335488cc64c513e36c540b0b93f7bcb74b14f359415d238aab9a6d0de5c69eebfa8b12d44b60f799eb5f3de43b931336c9d3f23f6d588688893041dda2e3f665360971026fed2390899cfc89b2663186f46ac787e66addd2dd960805252d4e4a86b84dbc4ec8c081d213ef41d16d1b3650002d2e97fe681ec8d8cb1cf58fb1c8bfb3478cd4e816515eef356953529bb2c855bda4c7d4bd06ddf92d48a574089920fa4104fd1b7facd3a93b9221c1905653c289d143421ee01b0d64be8e3f6423b0f3d048b77ee510a2fc4d3651e33c2ba2e6f3b635f1029dd787ff6f5069ba6bfa121d5e9f08f6ca07097e2697e242528182ef18c2871bc56b938240da3bf18a657c3d0cf6290b2aaf1d051b59da080b8050467c82c5655b3d727ec3be343b1f60d3b02bd00e10269937370e543e265f8b448afcd8e98ad391fddd2237af96b58c74f3f32fc28b8e66bd54af1e49d2ae25ef564efe34214bf48c2606fbbe7fbc41ff7ae2b3521c48a7953f98eceafe03ac0c58692c4866efe829589024d78b6f7185e753d55d80d365b571a3460fb83d0decc793be1e93a35ed650c3e4121f6d63d5a6cbeda2587d8a27421bb5bb3a48a1c4bf488dd32f6da2a9d2a2ded80d911725c4bbfbcac44d9fef449ab02bdec787f662d76ebd94f0e86e7eaf57c168b15d4c1de1cc27d675f16aefc8324f8bb8453f2f0eaeb3e7f6a3febc42ef02b10cb3f73b65f41019c5a03c7dd1587df1cbf5b272e27cb642c35f8c4e839146cc5426078e2f0044e7ce3bb71b1138dac10f8b863d0d4ad70f403831fb5806b3a24aab13a8b5b17b7430dbe577314d8d693de40cb0320bbcca477fd6572bc8808b0602aebbbb1402278da00f97c9fea865bad14548bc3fd6dcb7e30493156f7bd6e88eced0a3da23d2423f260d9433380e553363b554bc6be60a13b79324974c74fe468eff3770e1af1d404b50132a25a913d82b6d8d36cb852603822c773903f5b0f0ff70fe114e65017191fbb41ffa0e5da134546caa63d98d265afc3a2a61e49e8adf8347cf850ee3d01dc7d201e37431170ae0d5c6792eb46f1eb3854c4ae8bca286342c1a1e50cb9fdf90ee148f6914cf3dc87ea8030034d304fafc00bc91a2cfd5fb2a6161c6f5bf9cc2a066dd726f3b19bdc42012d2cf563b166b7ae346cb2198d4cc0641910649b668933a490633dd9a3c7b4cdd40dfc46e36516d3f17ceaa2109a66b16e7795484e1b0f5d08c1b56492b3e70796d64f01ec3460e39b7d69e917128ca5ffd75ff1a02f75395db622d19bba99d650774400c484543c9ed8ada3766d51737fa4cc76856a16e69fa9aed9cdded6b923d93a966424bc199d1fb03531e10ef43042ccb432b09622717a1cd5958ad46883e5d3ada32108bab597fd3888839ca2b473f42980e4249e2aef27b4263415653286dca30d1abe42150d806bdc6de881ef6a8dbb13a794086838a7161dec1ff497c036572826fb61220704a93e9c4496c50901417afab27ef7429a922bd59e7f652af543e3c1a61cf9ecfab490b89ec0688c43a35f358bb069b8bfa40a7837ffe38350505f94795fb55ca2b08f0208b66a2e11c423f8ecf6f0b1d712d13765cadda36f5a3088307c234b212e4783b736847a91c1b2ffc10cf49435ccb9ebbffd99035a7ea7219aaf5e07675d5df7d250195e359b74d85c2acf7d1878a696291e18f6a232e842f31f97ffd399957e1ff932fdd93313040e43754b3305c1f4de7cc0ae7216e589a85391fa670adfd32d128da6d73386e65488a008ce388dd4495a0356af6d5bc959ebee0e5717a89e432f57078a91a440bd18d353903644afd9a0d450a3b0828638d36477479f25fe000645afda55126a259b46fc1a4af00843812f986eb1051da0d0c7dff093c6a7ceee6ea32cd1c004e0de5f0a5da9c2ed1f31abaf7e2fdcb4f9393b34e123e6cb1a1d0b9d81495e41dc6ff0024f7e38798338b9b75e6173e403b6101cae37c4774d8139399d3b8536f608a216fdbc0a8984e56379dd43286aaef578a6aec318794fd90efe9ec007dbc62b129be10a2411c5a65e15a418008bac4ea7ba1f29120c489795ad3ef14ef8a0fbe04c64664d7d86b6cf82fec66773e7aac0de344a184e99de531fa013455bc30609b3cb02c579a97d89d1a79cb8da23f3614dab44a6df47c9fecfcc35d872b0f8949ce825f57e586609919eefb661595b378489c11852a40ae2a004d66118a8a94d80"}}, &(0x7f0000001380)) io_uring_enter(r1, 0x61b0, 0xd03d, 0x18, &(0x7f00000013c0)={[0x9]}, 0x8) syz_ublk_setup_queues(r2, 0x0, &(0x7f0000001400)={0x0, 0xa6c7, 0x2, 0x2, 0x2e4}, &(0x7f0000001480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd0ed, 0x4000, 0x0, 0x23e}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfe2f, 0x20, 0x0, 0x149, 0x0, r4}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9e2f, 0x200, 0x2, 0x2bd}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9437, 0x200, 0x2, 0x35d, 0x0, r3}}], 0x4, &(0x7f0000002700)={0x2e, 0x42, 0x0, r0, 0xc0107520, 0x0, 0x0, 0x0, 0x3, {0x9}, 0x0, r5, '\x00', {0x2, 0xdcd, 0x0, &(0x7f0000001700)=@buf_1k="bbeaf04b435f3fe8ec18104421d9ba8170fd100d0560b897071496f6e8fb913f9c965efd3fe1b06dfef5fcf72adae83f7681db516557d8003c85dd0ab3fb52468e7a94daf59cf0d7faf172ed554c8f5b3184556d84d0dfa8ad3f32f02b7ed63384ea916581e633d14dac13a392b9adb69168aef9115fd7408da5708717da44bf85356dea18840da36c1c741ef881edb9c36786b159317f6ea522fc0a1dbcef7c353abf3e28d880d76ea72163acad90a3d85e2366920dfe9250ae18c872945cce84fb29cb470d62a92d24dc6f65addbb6a2984fd422855969fc45221076ed6fb750a65ad495c5d26004be87be04128e4623a2bfe1e57e1ad96a9068e7a846c23dfcbb0d7115f6a6ef924dd404cf9ed23d2f0d8ffb2ee464164905c0ba92a12598ab6a6494f91ebd360e2239712a2c30340d284256f363a39f0327b1c7b71a6f0007528edcc6b09e12edbbcbd3f693728d5d38e9a4762d0682af6baed45f38978e6a3844074bc6c5891808e131672029644f00fadaa73de00c2c730f0e9c3e6987c3f45f62a640db583dbaf9617cb4a6d1332e7f5a5cbfa24a1c1f378ccc30cca6f513dfb90eb7807ec3265d7892d2085f8a6202ee1399b248e75b29be622b7a8104503649a197166d0cce23db0f750f08b789af34fba751146f56a4b8ae5c58c8ed7ae383b6d023a09fdb50431ee8fe98b2e7701daf5433eed519c37a2f7ed8e121f29f1fa18680cf513722b0df117d40e0123398d4f8bc58e457f1a3ab3a281df326dcf4b4839b4f755371fa5e472c5249017758bfbd6aa09bd9c5fe542ca9f3ab250ff1a597f5c158f23b5ba0cf20acb5125ef3e5c58c898d9753e51c72ab2d774e842d04b616f39abfafcfad1aba088b7b454a68045ecc9eaeffca2cf860c6fbaefe39bc58aade01286a3ae9857ddf099f45c5b97e4118dd1ac4ac5ccffb344cc80875f74d979d3c8e0c8dd95c8cfe2a4b81648aee5f2ebdf51688f668058c491bc884d5466a00f5fbffbb7810e10beab24a47a879d7a4137c563bb65334943e2574c8b9094bbd30e3759d3a9c151b30732c3db5363fc8c39be66d000d6434d3712598f62f2ba196f67c7027bf22b03f4559312c9f18d07e69ff95443cdf013b0add7aa637a2e97cc0c6575086f1cbb643fbff790ded97949863e8e8ceff7cf8a4d60c1e921e6e5f2298ca11e372cc966b06f56fbf716051c1dae4a1630c1d68c38373ea8cb51ed6619c2283efb0da3b0649b21168cc60f85b794171d3b36572ef0f3f68263a6ceed81f29f75d2c6eee3d05f29d5ff8ad06b3f0225458858431977c0c7657912ed4a9edba40ce5c596c366c7fa2fdcf4608ea626cc570eaf7376f53cd2a4f7778379f277da920cc558d44f66fc1b553977304099bf9e197a5004914f08784d2155e0cded3ef5c2568c2be80d1875c5467dd686f42ce07420b"}}, &(0x7f0000002780)) io_uring_setup(0x723a, &(0x7f00000027c0)={0x0, 0xbb24, 0x8, 0x2, 0x145, 0x0, r6}) r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002840), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r8, 0x4008af03, &(0x7f0000002940)={0x1, 0x0, [{0xf000, 0x9b, &(0x7f0000002880)=""/155}]}) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000002980)={0x1e, {0xe, 0x3, 0x1, 0x4, 0x3, 0x9}}) pwrite64(r4, &(0x7f00000029c0)="c749e9c493be358aa77cf08fc2977371baf51fa3ed2f9b5c586ba6e49976c804475cab0ca30117fafe35adb742b36a55d8889d25fc67ea48cffdd3c6d546b4d67455a050d893fe2eaa89922051a0410e90f174043a96908b61d102e11fc6278e0a2debfcd4a7f1637035b9f16a05b7b90f877f7875727db9bbd1881b1527366a53760ae6c8038b7db2c86b9455c0de3ef22076c1a044460fce6fc99db0", 0x9d, 0x6) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r8, 0x80089419, &(0x7f0000002a80)) r9 = fspick(r1, &(0x7f0000002ac0)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000002b00)='}\x00', &(0x7f0000002b40)=':\x00', 0x0) shutdown(r6, 0x1) r10 = accept4$inet(0xffffffffffffffff, 0x0, &(0x7f0000002b80), 0x800) setsockopt$inet_mreq(r10, 0x0, 0x24, &(0x7f0000002bc0)={@multicast2, @remote}, 0x8) r11 = socket(0x29, 0x9, 0x1) ioctl$MTDFILEMODE(r7, 0x4d13, 0x3) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r12, &(0x7f0000002d00)={&(0x7f0000002c00)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c40)={0x5c, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x119a}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x1217}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xfc4}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x5c}}, 0x50004) ioctl$MEMUNLOCK(r4, 0x40084d06, &(0x7f0000002d40)={0x7, 0x5}) sendfile(r4, r9, &(0x7f0000002d80)=0x100, 0xbc) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$tipc(&(0x7f0000002e00), r12) sendmsg$TIPC_CMD_ENABLE_BEARER(r13, &(0x7f0000002ec0)={&(0x7f0000002dc0)={0x10, 0x0, 0x0, 0x80014}, 0xc, &(0x7f0000002e80)={&(0x7f0000002e40)={0x3c, r14, 0x200, 0x70bd2b, 0x25dfdbfd, {{}, {}, {0x20, 0x17, {0x20, 0x1, @l2={'eth', 0x3a, 'veth0_to_hsr\x00'}}}}, ["", "", "", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000000) rmdir(&(0x7f0000002f00)='./file0\x00') ioctl$FS_IOC_RESVSP(r10, 0x40305828, &(0x7f0000002f40)={0x0, 0x3, 0x1, 0x8}) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r11, &(0x7f0000003080)={&(0x7f0000002f80)={0x10, 0x0, 0x0, 0xa0000088}, 0xc, &(0x7f0000003040)={&(0x7f0000002fc0)={0x5c, 0x2, 0x7, 0x201, 0x0, 0x0, {0xa, 0x0, 0x88}, [@NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x17}, @NFACCT_FILTER={0x24, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x7}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x2}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xd}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x8000}, @NFACCT_PKTS={0xc}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4008005}, 0x24000001) r15 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000030c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r15, &(0x7f0000003100), 0x12) setsockopt$IP_VS_SO_SET_STARTDAEMON(r11, 0x0, 0x48b, &(0x7f0000003140)={0x1, 'gre0\x00', 0x1}, 0x18) socket$nl_netfilter(0x10, 0x3, 0xc) 3.678803222s ago: executing program 3 (id=3073): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x9, 0x31, 0xffffffffffffffff, 0x20497000) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, &(0x7f00000000c0)=[0x0], &(0x7f00000001c0)=[0x0, 0x0], 0x0, 0x2a, &(0x7f0000000240)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000400), &(0x7f0000000440), 0x8, 0x82, 0x8, 0x8, &(0x7f0000000480)}}, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='file0\x00', 0x0, 0x0) read(r1, &(0x7f0000000000), 0x12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000fdffffff0000000000000500180100002020782500000000002020007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000010000007a0000000600008095"], &(0x7f0000000040)='GPL\x00', 0x8, 0x25, &(0x7f0000000280)=""/37, 0x41100, 0x6, '\x00', r0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xeb}, 0x94) remap_file_pages(&(0x7f000051c000/0x400000)=nil, 0x400d10, 0x0, 0x51c, 0x0) r2 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040501d4d610000000000010902190001010080fa0904000001ff00000007050202"], 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="40011e0000004d61501d0100000000000000000050000000500000005000000050"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.545535911s ago: executing program 4 (id=3074): socket$packet(0x11, 0x2, 0x300) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_DIRTYFB(r2, 0xc01864b1, &(0x7f0000000180)={0x0, 0x2, 0xfd, 0x0, 0x0}) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_proto_private(r5, 0x89ef, &(0x7f0000000240)="e3451cc89c51640347ddedde1d5e3cd9b501292a5a17b324336676e775a3f1627bd26052813ad62c2452805ffc4394200db8cd83b5639da2db456fdde1ba0fa1280228c833aaa011ef690903a5cb7b40e995dec5") sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@deltaction={0x80, 0x31, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x10}}]}, @TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}, @TCA_ACT_TAB={0x34, 0x1, [{0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6d82}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x10000}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xa}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}]}, 0x80}}, 0x0) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000440)=""/196, 0xc4, 0x100, &(0x7f0000000540)={0x2, 0x4e20, @broadcast}, 0x10) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000186dd061000a0586593fffffffc010000000000000000000000000001ffff0715fafffc0141000000000000000000000000007caad9b84f2acf870fce5412848d80665e17c804f75ea5580f846b2e86ac5399ab449da6cc671ce356329e1fdc1cac9b92f8f360b012762fdfe6a1fb14af49f565ee3e291b98ec15566acf1b5de6c9dece44c2f62c1e56e3f378be3d87ddbf8f7f91e8ff"], 0x34) syz_open_procfs(0x0, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) bind$unix(r6, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet_smc(0x2b, 0x1, 0x0) listen(0xffffffffffffffff, 0x6) socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r7 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x7a22, 0xc000, 0x7, 0x337}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='9', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0) r8 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0xff4a) 3.453924238s ago: executing program 1 (id=3075): socketpair$unix(0x1, 0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x1, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000000c0)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x0, 0x0, 0xfffffffe, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0xfffffc, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe64a, 0x2, 0x20000000, 0x327, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x20, 0x3, 0xffffffff}}], 0x1, &(0x7f0000000340)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r4, '\x00', {0xfff9, 0x5, 0x200000, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x2a, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89802) 3.015484541s ago: executing program 0 (id=3076): r0 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @empty}, {0xa, 0x4e22, 0x0, @dev}, 0x0, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}}, 0x5c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d43afffe800000000000000000000d00000010ff020000000000000000000000000001"], 0x340a) 2.834203025s ago: executing program 0 (id=3077): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8}}}}}}]}}, 0x0) (rerun: 32) syz_usb_control_io$rtl8150(r1, &(0x7f0000000580)={0x14, 0x0, &(0x7f0000000480)={0x0, 0x3, 0x3}}, 0x0) syz_usb_control_io$rtl8150(r1, &(0x7f0000002980)={0x14, 0x0, &(0x7f00000028c0)={0x0, 0x3, 0x3}}, 0x0) (async, rerun: 32) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) (rerun: 32) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000500)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1f}}, @in6={0xa, 0x4e20, 0xffff, @empty, 0x101}], 0x2c) (async, rerun: 32) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f0000004280)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004240)={0x40, 0x5, 0x2, "2bd8"}}) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r3, 0x11, 0x64, &(0x7f0000000140)=0x4, 0x4) (async) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)={0x1c, 0x3f, 0x9, 0x70bd29, 0x0, {0x2}, [@generic="aa56ff28a4"]}, 0x1c}}, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r5, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000440)={0x1c8, r6, 0x100, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_FRAME={0x177, 0x33, @mgmt_frame=@probe_request={{{}, {}, @device_b, @device_a, @from_mac=@device_b, {0x0, 0x3}}, @void, @val={0x1, 0x7, [{0x5}, {0x5, 0x1}, {0x9}, {0x5}, {0x1}, {0x4}, {0x9}]}, @val={0x3, 0x1, 0x2c}, @void, @void, [{0xdd, 0x1e, "7e0219418b29da84c8861a1eadd7b688746d5df3b465bf9b1f16a3a9e07e"}, {0xdd, 0x2e, "d403101e65eba74e5af01a9707000000d158734dbb8ec21277ec1f4da8380be91751d9049903320134581c6e4d08"}, {0xdd, 0x17, "b57e73ad78e17bdf0e9cc1a6134b96314b1147bc958e4d"}, {0xdd, 0x62, "74c59ad30d67cd4cc56a4974d8cbb49e0bb47515bee00b5925848d2daa3100d66fca170684eadd9670e584906d77f08104286c375f767484ec8a72de275135f6009c9e219544e923331bad61c230f88e09689cc37c08c3d1635511f954b327b8064e"}, {0xdd, 0x80, "fd1599e3c17c77a90a80b3683c0b524839e4e68a21d0a9aa30de388a4f3910ebe2b6d147501d9912e6fc3e5a1ef52cd06bcdeda99cae8ea9a3ebe98ee38b8bcdd73940ba990a5deace21d0c65f0ca4b8224dff10caf0b5352ae350e2df574f6a587eba6427cd64bfe00c14fca600e732dc3fffc60a33a05f470433cd25c2bd8c"}]}}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0xa00}]}, 0x1c8}, 0x1, 0x0, 0x0, 0x20}, 0x8001) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYRES16=r4, @ANYRES32=0x0, @ANYBLOB="6000000000000000240012800b0001006d61637365630000140002800500030010"], 0x44}, 0x1, 0xd, 0x0, 0x480c5}, 0x0) 2.731894929s ago: executing program 4 (id=3078): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00U\x00=\t\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00', @ANYRES32, @ANYBLOB="20000280", @ANYRES32=r0, @ANYBLOB="0000000000000000000000000a0000000000ff0f0000001420000100", @ANYRES32], 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x15, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b70000000100000bbfa300000000000007030000e8ffffff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000007f44000000000000630a04fe000000007933ff80000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f0000000040)='syzkaller\x00', 0x1000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x9}, 0x8, 0x10, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x11b}, 0x10}, 0x94) 2.579262132s ago: executing program 2 (id=3079): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x8000}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x5c}}, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="12010000e09d7040460a2196324f01020301090224000100000000090400000206d3", @ANYRES8], 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x1c02, 0x0) r3 = epoll_create1(0x80000) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) io_setup(0x1, &(0x7f0000000040)=0x0) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x4810}, 0x8000) io_submit(r5, 0x1, &(0x7f0000000440)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, 0x1, r4, 0x0, 0x0, 0x8000}]) ppoll(&(0x7f0000000200), 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000000c0)) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}}, 0x0) sendmsg$NFT_MSG_GETSET(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000006c0)={0x14, 0xa, 0xa, 0x3, 0x0, 0x0, {0x5, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x40c0040}, 0x408c4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) sendmsg$IPSET_CMD_LIST(r6, 0x0, 0x48810) recvmsg(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000c080)=[{&(0x7f0000002180)=""/4089, 0xff9}, {0x0}, {&(0x7f00000005c0)=""/237, 0xed}], 0x3}, 0x40000020) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_connect(0x2, 0x91e, &(0x7f0000000580)={{0x12, 0x1, 0x110, 0xbd, 0x97, 0x84, 0x10, 0xc45, 0x602e, 0x4ea0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x90c, 0x2, 0x3, 0x0, 0x60, 0x3, "", [{{0x9, 0x4, 0x63, 0x9, 0xd, 0x83, 0xdc, 0x65, 0x5, [@generic={0xf6, 0xb, "caa146950fe0d2985d75343074411fd4c281a4821c361f8251a1a234695483926781e51eeb48731ed4d3a02084d1503bca763c85d95c197e23903ca6d81006643b881f042702a1e431d21714faeed1ce17cc9b5dab5531e347f878e39ec4790c2d0ac7621f79495afb1454d028da1044f6685dfb950e0ef9edab9e398adc49400b13d340af5d80af9daa45de59bba1b3863fa814164babcdf0853c42e93fca18bf6ab7b84d0e531cf95935c11152cf8a875bfe239bc81651fdff5fb9df3f9538290446d334ccdeea305860d858cbe57390ce5dfc2bbed936b856e5ac1c1e94297565de2af1755bd55d8ea604e982d73b50f88142"}, @uac_as={[@as_header={0x7, 0x24, 0x1, 0x1, 0xa}, @as_header={0x7, 0x24, 0x1, 0x5, 0x3, 0x3}, @as_header={0x7, 0x24, 0x1, 0x9, 0xf3, 0x4}]}], [{{0x9, 0x5, 0x2, 0x0, 0x3ff, 0xa9, 0x6, 0x2, [@generic={0x93, 0x24, "5af98ac234c8cadc7774e635217b52046906efc8bbbe1ecab315ba66f740d4ca969055dc6e430632eedd89c7e7237179d9902ba72256ea2d95576fb691cc47cb67b6318ac1b2063faa9c29f35291a50476d97ed35e555c008c34cf1b44f8c89f078c38082fba81e1839a74c390fb8e2c4c20c66845572e5114d4a6adbb34c0225b76825e67858bf37f300b62343dbe765c"}]}}, {{0x9, 0x5, 0x4, 0x10, 0x200, 0x3, 0x6, 0x3, [@generic={0xde, 0x22, "0e40156bd70e78b0be55313ff631fc081178090ecd3681fa3e1e24dd902106d5741e68eba242c2e601902e2936089ede55dd5986352cb948884940d33344ba8cea7425cf7169eb88f9eb40b38f0441f443184d36f3c542bc22936b230c84c708b9d9c8399a7a31e89080a06f3631f1867a91756dcaf9aa5f01ab87180dc9d23a05f84419fa15fdf85e20616a1a31cbcf10f0d8070e8f429026ed8f5eaec32b9536c3771c8ad36da52d6c289ce9e0244c2840c018ea2bfc813be78ba9e6baed0cebf6a3801d48a079894e97af0f69b5bcb5216bc095005fa8a8909fc6"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x2, 0x8}]}}, {{0x9, 0x5, 0xc, 0x2, 0x40, 0x9, 0x1, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x39, 0x3}]}}, {{0x9, 0x5, 0x8, 0x0, 0x20, 0x9f, 0xfa, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x1, 0xf4}, @generic={0xd4, 0xa, "d842c2167c8e9d8ae11ec431ec97d2fb91261b0f40136b81972a77c1a5246f7ecd360ababa1d390a3f625f6a88f0e9f9c94d5a04c9ca1dce1df1173e96e684b46eafabddc2612796a4189161cc4e013319fd275ad79a37d4b34ad292d0c40a5b02640445e4e5a7e73b2c7d0c538f2bc4f8203e5750d76521f3d6506dc79a40886dd56933aea2117e64d034acc46bf763b7e3ee1ec5fb8103808921f21fc211aee73b3cefb333fa88e850413a0f511eabb2b9c8a28feb0602280ccbfad58feeabf27c42fc9bbc34d3acf5b3f1289bcb7a819c"}]}}, {{0x9, 0x5, 0xa, 0x0, 0x8, 0x1, 0x51, 0x8}}, {{0x9, 0x5, 0x7, 0x8, 0x20, 0xb, 0x60, 0x2}}, {{0x9, 0x5, 0x0, 0x2, 0x20, 0x3, 0x6, 0xff}}, {{0x9, 0x5, 0x4, 0x4, 0x40, 0x6, 0x1, 0x31, [@generic={0xce, 0x5, "ef984e4b9cbb748afb4c5448ec73cd8d2b9ccbdd4f21e93e97d48de69ec72670880ced9e80af74c7f73d3c1fac6467566f48d651f79760a04a18279ceb0f85e23205e8a709c37dca49aabdca17c421fe1fe9950b72dc8897b034afe8fe3d46e9001b486abd0004db15a8b47e8bd34fa3a8c7dc1346c340f7f6f756cad5369b63fdeaa8a72b762c12fc92a125191131abc273482ce80c25fcb7572cc76338a2266beb5842150125db5c3fe2d7d5506aa22253a3fff9d753834a7621c7933c696ffe728a0cd5c8d571089552f5"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x210, 0x3, 0x3, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0xa5, 0x1}, @generic={0xe, 0x11, "9d5cd268282f46f489624710"}]}}, {{0x9, 0x5, 0x4, 0x10, 0x200, 0x79, 0x7, 0x9}}, {{0x9, 0x5, 0x4, 0x10, 0x400, 0x3, 0x3, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x6, 0x7}]}}, {{0x9, 0x5, 0xa, 0x0, 0x10, 0x3, 0x32, 0x7}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0x0, 0xc, 0xe}}]}}, {{0x9, 0x4, 0xa5, 0x8, 0xe, 0xf8, 0x5c, 0x9c, 0x7, [@uac_as], [{{0x9, 0x5, 0x2, 0x10, 0x8, 0x6, 0x7, 0x7, [@generic={0x45, 0x9, "08a4e12f425808a02be861d931c2d30d21a16968fd9945afa33a0355737c51b261d2d5e4dd79583bca7adea87f5be847bfcf6f390c8a642293568904ca7913b1e89b82"}]}}, {{0x9, 0x5, 0x0, 0x10, 0x400, 0x0, 0x8, 0xd5, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x10, 0x3}, @generic={0xab, 0xc, "5e71069b26ca208d7526cf51cb9fcca68ff49a91514dd3e31f084258f9692accacb4913e441192202c06ae242ccaf44357e72178e77c87a5dc2830cd0d83ba6624e24b3bb8acf28d6f551fed0ceb2453df0233020fb2a3f2ff70ddb26127eff8025e75a1ad7b9d4b22bc556e420e4406f48f63c138bdaa203368007993283f685d8b308516b7b57ad0d85a708825d75073548bd74dca5a81565b7052ae8f5f3f71fcdd19a293738025"}]}}, {{0x9, 0x5, 0x4, 0x0, 0x40, 0x7, 0x38, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0xf5, 0xfff}]}}, {{0x9, 0x5, 0x2, 0x2, 0x10, 0x8, 0x3, 0x5, [@generic={0x41, 0x8, "405578b01e2b4d21485d92d3049ce32a6457fdcad748e61bac50f6d3be37c6d14b0136b1443cd219087b8671202e882752ab9e4654ffab6615802ab0e43e79"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x1, 0x8}]}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x0, 0x1, 0x21}}, {{0x9, 0x5, 0x1, 0xc, 0x200, 0x8, 0x0, 0x1f}}, {{0x9, 0x5, 0x0, 0x8, 0x20, 0x4, 0x0, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x68}]}}, {{0x9, 0x5, 0xe, 0x10, 0x20, 0x65, 0x8, 0x8, [@generic={0x24, 0xa, "0006bdbbe10295515c980448d2c1b639e2c8ea76b846b45ef86313028d086c20a865"}]}}, {{0x9, 0x5, 0xc, 0x2, 0x20, 0x2, 0x3, 0x3}}, {{0x9, 0x5, 0x7, 0x1, 0x8, 0x3, 0xa, 0x5}}, {{0x9, 0x5, 0x6, 0x8, 0x10, 0x6, 0x3, 0x2, [@generic={0x6d, 0x22, "ce2ed382b61a1187f68464fd11d5f04e71751f9fb879919259ff5174386ece07cb28c8a14171dd0b383211182193f3284d596b1d0993cc04ffb0e0993969562b184a98ec8461ea588e308963e9870f9b340141d9c0fa860e65c3d69632916634aaab33a836cf5f57dc170a"}, @generic={0xd4, 0xc, "59bce314d2bc3521d56ca297cd5769c994bdabde2b2598c12387b2519a140575c0e4a8439fc47d8f548edc8a39f4676f13d9aa26fbda39e30ac1c1913cdf827a6f323e733e8650aacc4fdbbd22a3148cc863427a1c2c6aede4594072e0acecc3c6076c1b7df7d55528a1c97c9aae521c337a9b0ef516967cd5cf28c2ab4a5192f33c6a3bb7f3948bb3b24657659c8db13228819375149c96d1e5b0684a9670a81094dc6f7e771a5a6d01ea16effff1fb7c5bd23010f273c96bb6d121cbc2bc3ce48b866115dfa40f4819763ae5efa5e9bcfe"}]}}, {{0x9, 0x5, 0x7, 0x2, 0x610, 0x20, 0xdb, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x9}, @generic={0xef, 0x23, "0872607a9ef5d552867d6d70ea6a8f0da2ab5da8219771daf7ba869ab4dea381251d254e2a44067b126f153bd7a6409a6f8d163d12122aecb610e3e8c906125414f82b0730d01775a0a013265f67b47100eca558b6cda27dd897ba6de35727e4a9195e08ea430da0fd1c32b00cffca48c93bf3fcb2590e42adf922c47f1019034b04d3c28eb092495ead6610c20e86218ed1a79340afc2653a2cc8a9f2436c57b4db13124a491243d10c315f424ad3956167bcbf638c37ac1ba963aec89dce21af3b5659b19cd400e7e5d482e2a679e164bbe6caaffd8bef03269018582373de44d1317aac5fad0a2df2447a41"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x3ff, 0x6, 0x91, 0x1}}, {{0x9, 0x5, 0x1, 0x1d, 0x8, 0x5, 0xd, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x37, 0x8}]}}]}}]}}]}}, &(0x7f0000001140)={0xa, &(0x7f0000001040)={0xa, 0x6, 0x300, 0x1, 0xf5, 0x4, 0xf7, 0x9}, 0x53, &(0x7f0000001080)={0x5, 0xf, 0x53, 0x6, [@ptm_cap={0x3}, @ssp_cap={0xc, 0x10, 0xa, 0xe1, 0x0, 0xa81, 0xff0f, 0x1}, @ss_container_id={0x14, 0x10, 0x4, 0x9f, "6014eca69211a4315fb39a2b2be77e34"}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x66, "d6f863ef931ceed8ada1f9247908772f"}, @ssp_cap={0x14, 0x10, 0xa, 0x87, 0x2, 0x0, 0xf0f, 0x1180, [0x3f00, 0xffc030]}]}, 0x1, [{0x4, &(0x7f0000001100)=@lang_id={0x4, 0x3, 0x436}}]}) 2.499945931s ago: executing program 4 (id=3080): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/udp6\x00') socket$packet(0x11, 0x3, 0x300) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socket$inet_tcp(0x2, 0x1, 0x0) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x8, 0x2, 0xfffffffffffffffd, 0x1}, 0x0, &(0x7f0000000140)={0x1ff, 0x900, 0x0, 0x4, 0x0, 0x1136f858, 0x0, 0xffffffffffffffff}, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x401}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x18c6}, 0x0, 0x0) 2.402509819s ago: executing program 1 (id=3081): madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r0, 0x3ba0, &(0x7f0000000880)={0x48, 0x4, 0x0, 0x0, 0x1000, &(0x7f0000ffc000), 0x1}) r1 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0) ioctl$CEC_DQEVENT(r1, 0xc0506107, &(0x7f0000002440)={0x0, 0x0, 0x0, @raw}) 2.295467614s ago: executing program 1 (id=3082): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000004c80100000c0a010100000048000000000a0000060900020073797a31000000000900010073797a31000000009c010380180000800c00018006000100d103000008000340000000010c0000800800034000000002740100800900090073797a3100000000ec0001"], 0x234}, 0x1, 0x0, 0x0, 0x4000850}, 0x20004090) 2.10396745s ago: executing program 1 (id=3083): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ffffb00000ae04020000000000be400300000000006504030001ed00007b130000000000007f44000000000000630a04fe000000007933ff80000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffdbb, 0x0, 0xffffffffffffffff, 0xfc55}, 0x48) 1.771982457s ago: executing program 1 (id=3084): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) pipe(&(0x7f0000000000)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00005bd000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, &(0x7f00000000c0)="66b9a80900000f3266b9800000c00f326635008000000f300f30ba2100b80300ef66b8f19700000f23d80f21f86635400000100f23f80f2304b8c30a8ee8660f15290f0666b8004800000f23d00f21f86635300000060f23f8", 0x59}], 0x1, 0x18, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f00000000c0)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) setsockopt$inet6_opts(r5, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x18) connect$inet6(r5, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000001840), 0x3b, 0x0) ppoll(&(0x7f0000000080)=[{r0, 0x42c0}], 0x1, 0x0, 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) 1.332279641s ago: executing program 4 (id=3085): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000fefdff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000007f44000000000000630a04fe000000007933ff80000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffdbb, 0x0, 0xffffffffffffffff, 0xfc55}, 0x48) (fail_nth: 19) 1.302506869s ago: executing program 4 (id=3086): r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x101701) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x900, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000340)=ANY=[@ANYRESOCT=r1], 0x50) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000240)="8f0978d21b640fc79ca50000c0fe470f06430f01c2440f20c0ac0a0000e39d9d0f22c066460f38809bf77f00000f214a0fc73d0d0000003e653666400fc7775f400f01c4", 0x44}], 0x1, 0x10, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff4000/0x9000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x0, 0x42}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff000000009408000000001700638af0ff000000001fa900000000000007010000f8ffffffbfa400000000000007040000f0fffdffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000001000000b703000008000000850000006900000095"], &(0x7f0000005d80)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000000)=0x1) ioctl$USBDEVFS_GET_SPEED(r0, 0x551f) 1.054481632s ago: executing program 1 (id=3087): syz_usb_connect(0x5, 0x24, 0x0, 0x0) unshare(0xc020400) r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109022200010100803209040000010300000009211101000122350007058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0022350000000600ff0901a101851109021585210903150026ff0075089501810285910904150026ff00750895019102c00000000000000000000085f5b0e2a27a68716958e6201fbb912f708d308dccb8508a873f42d84d14a23cd7a9aa9897bfe6e2edfc6556036e7f"], 0x0}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pidfd_send_signal(0xffffffffffffffff, 0x400, 0x0, 0x3) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x1, {{@in=@empty, @in=@remote, 0x0, 0x2400, 0x1000, 0x0, 0x2, 0xa0, 0x20, 0x84}, {0x0, 0x0, 0x0, 0xd07}, {0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x20000, 0x0, 0x1, 0x0, 0x3}}, 0xb8}, 0x1, 0x0, 0x0, 0x40000}, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x0, 0xfffffffffffffffd}, 0x0) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) setitimer(0x2, 0x0, 0x0) r3 = epoll_create1(0x80000) r4 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f0000000040)={0x10000011}) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x2000002, 0xfffffffe}}, 0x10) sendmsg$tipc(r5, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x13c, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x20, 0x8}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0x0, 0x0, 0x2dd}}, [@tmpl={0x84, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x3b}, 0x0, 0x2b}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xc}, 0x0, 0x0, 0x0, 0xff}, {{@in6=@mcast2, 0x0, 0x3c}, 0x2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}]}, 0x13c}}, 0x0) ioctl$F2FS_IOC_DEFRAGMENT(r2, 0xc010f508, &(0x7f0000000100)={0x455b, 0xd}) ioctl$IOMMU_IOAS_UNMAP(0xffffffffffffffff, 0x3b86, &(0x7f00000003c0)={0x18, 0x0, 0x5, 0xfffffffffefffffb}) syz_usb_connect$uac3(0x1, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x0, 0x5, 0x0, 0x5, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x29, &(0x7f0000000400)=@string={0x29, 0x3, "b17190685c4721661014a2dd191426a400b9dd9d4beb5cecff13298675c762cae0c83d6654e4e7"}}, {0x2, &(0x7f0000000440)=@string={0x2}}]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000ca3000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f000094c000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r6 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x0) 394.845605ms ago: executing program 3 (id=3088): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x9, &(0x7f0000000300)=@framed={{0x18, 0x8, 0x0, 0x0, 0x7}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffe}, {0x85, 0x0, 0x0, 0x2f}, {0x7, 0x0, 0xb, 0x9}}, @call={0x85, 0x0, 0x0, 0xa0}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) 108.918865ms ago: executing program 3 (id=3089): syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_open_procfs(0x0, &(0x7f0000000140)='attr/sockcreate\x00') bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1, 0x6, 0x8, 0x8}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000700)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200060000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a0003"], 0x64}, 0x1, 0x10000000000000, 0x0, 0x8811}, 0x0) 0s ago: executing program 4 (id=3090): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050000fff50000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000054000000060a010400000000000000000100000008000b40000000000900010073797a30000000002c0004802800018008000100666962001c00028008000240000000030800034000000001080001400000001414000000110001"], 0xdc}}, 0x0) kernel console output (not intermixed with test programs): altsetting 1 has a duplicate endpoint with address 0xB, skipping [ 625.468985][ T5697] usb 3-1: config 2 interface 136 altsetting 1 has a duplicate endpoint with address 0x2, skipping [ 625.468998][ T5697] usb 3-1: config 2 interface 136 altsetting 1 has a duplicate endpoint with address 0x7, skipping [ 625.469012][ T5697] usb 3-1: config 2 interface 136 altsetting 1 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 625.469028][ T5697] usb 3-1: config 2 interface 136 altsetting 1 has a duplicate endpoint with address 0xB, skipping [ 625.469051][ T5697] usb 3-1: config 2 interface 165 altsetting 90 has a duplicate endpoint with address 0xB, skipping [ 625.469094][ T5697] usb 3-1: config 2 interface 165 altsetting 90 has a duplicate endpoint with address 0x6, skipping [ 625.469108][ T5697] usb 3-1: config 2 interface 165 altsetting 90 has a duplicate endpoint with address 0xB, skipping [ 625.469122][ T5697] usb 3-1: config 2 interface 165 altsetting 90 has a duplicate endpoint with address 0xD, skipping [ 625.469136][ T5697] usb 3-1: config 2 interface 165 altsetting 90 has an invalid descriptor for endpoint zero, skipping [ 625.469149][ T5697] usb 3-1: config 2 interface 165 altsetting 90 has a duplicate endpoint with address 0x7, skipping [ 625.469170][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has a duplicate endpoint with address 0xC, skipping [ 625.469184][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 625.469197][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 625.469212][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has a duplicate endpoint with address 0x7, skipping [ 625.469226][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 625.469240][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has a duplicate endpoint with address 0xA, skipping [ 625.469253][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 625.469265][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 625.469278][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 625.469292][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has a duplicate endpoint with address 0x1, skipping [ 625.469306][ T5697] usb 3-1: config 2 interface 137 altsetting 0 has a duplicate endpoint with address 0x6, skipping [ 625.469319][ T5697] usb 3-1: config 2 interface 104 has no altsetting 0 [ 625.469331][ T5697] usb 3-1: config 2 interface 136 has no altsetting 0 [ 625.469342][ T5697] usb 3-1: config 2 interface 165 has no altsetting 0 [ 625.619076][ T5697] usb 3-1: Dual-Role OTG device on HNP port [ 625.662955][ T5697] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.663017][ T5697] usb 3-1: Product: 䀊 [ 625.663034][ T5697] usb 3-1: Manufacturer: à “ [ 625.663049][ T5697] usb 3-1: SerialNumber: ⣃퓄êžïš²ãŽ‚ᇚꂽʗ᭬줘囆䄞墓벦äšæ˜¶é—´ê€Œê¦ â¢•èº‡å™¼â©ìªá—…倭ී红ë´ê’Ží†¶ã–樑櫴ᎉ巫凫ኃ핬ᡮå建 [ 626.044439][T11499] usb 5-1: USB disconnect, device number 5 [ 626.442013][T15202] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2862'. [ 626.531861][T15201] veth0_to_hsr: entered allmulticast mode [ 627.564115][T15210] netlink: 112 bytes leftover after parsing attributes in process `syz.0.2863'. [ 627.576197][T15210] netlink: 112 bytes leftover after parsing attributes in process `syz.0.2863'. [ 628.223417][ T5618] Bluetooth: hci1: command 0x0c1a tx timeout [ 628.224951][T15183] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 628.524681][T15183] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 628.524880][T15183] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 628.525073][T15183] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 628.525201][T15183] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 628.596183][T15183] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 628.638181][T15197] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 628.653915][T15197] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 628.682606][T15197] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2861'. [ 628.730686][ T5697] option 3-1:2.104: GSM modem (1-port) converter detected [ 628.771905][ T5697] option 3-1:2.136: GSM modem (1-port) converter detected [ 628.834204][ T5697] usb 3-1: USB disconnect, device number 40 [ 628.863623][ T5732] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 628.918014][ T5697] option 3-1:2.104: device disconnected [ 628.945844][ T5697] option 3-1:2.136: device disconnected [ 628.992340][T15221] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2865'. [ 629.016725][ T5732] usb 5-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 629.020786][ T5732] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 629.020820][ T5732] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 629.020856][ T5732] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.041391][ T5732] usb 5-1: config 0 descriptor?? [ 629.256013][ T5732] usbhid 5-1:0.0: can't add hid device: -71 [ 629.256150][ T5732] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 629.264831][ T5732] usb 5-1: USB disconnect, device number 6 [ 629.870723][T15238] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 629.883870][T15238] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 629.911108][T15238] tipc: Resetting bearer [ 630.303294][ T5697] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 630.311547][T12826] Bluetooth: hci2: command 0x0c1a tx timeout [ 630.454067][ T5697] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 630.464879][ T5697] usb 5-1: config 0 has an invalid interface number: 50 but max is 0 [ 630.464912][ T5697] usb 5-1: config 0 has no interface number 0 [ 630.465010][ T5697] usb 5-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 630.492714][ T5697] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.492736][ T5697] usb 5-1: Product: syz [ 630.492746][ T5697] usb 5-1: Manufacturer: syz [ 630.492755][ T5697] usb 5-1: SerialNumber: syz [ 630.524377][ T5697] usb 5-1: config 0 descriptor?? [ 630.543345][T12826] Bluetooth: hci3: command 0x0c1a tx timeout [ 630.543408][T12826] Bluetooth: hci5: command 0x0c1a tx timeout [ 630.557163][ T5697] yurex 5-1:0.50: USB YUREX device now attached to Yurex #0 [ 630.740947][T15245] kvm [15244]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x7 [ 630.741173][T15245] kvm [15244]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x7 [ 630.917609][T15207] syz.1.2861 (15207) used greatest stack depth: 19232 bytes left [ 631.178643][T15250] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 631.179986][T15250] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 631.237224][T15250] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 631.254240][T15250] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 631.258925][T15253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 631.267858][T15253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 631.316300][ T5697] usb 5-1: USB disconnect, device number 7 [ 631.348456][ T5697] yurex 5-1:0.50: USB YUREX #0 now disconnected [ 631.775917][T15267] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2879'. [ 631.793606][T15264] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2879'. [ 631.793870][T15264] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2879'. [ 631.794158][T15264] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2879'. [ 631.805952][T15264] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2879'. [ 631.843183][ T5697] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 631.983228][ T5697] usb 5-1: device descriptor read/64, error -71 [ 632.053305][ T5732] usb 3-1: new low-speed USB device number 41 using dummy_hcd [ 632.204124][ T5732] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 632.206393][ T5732] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 632.206441][ T5732] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 632.206467][ T5732] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 632.206491][ T5732] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 632.206515][ T5732] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 632.207567][ T5732] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 632.207608][ T5732] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 632.207632][ T5732] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 632.207654][ T5732] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 632.207678][ T5732] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 632.208623][ T5732] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 632.208665][ T5732] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 632.208688][ T5732] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 632.208712][ T5732] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 632.208735][ T5732] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 632.212434][ T5732] usb 3-1: string descriptor 0 read error: -22 [ 632.212571][ T5732] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 632.235147][ T5732] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 632.269782][ T5697] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 632.463241][ T5697] usb 5-1: device descriptor read/64, error -71 [ 632.495176][ T5732] usb 3-1: USB disconnect, device number 41 [ 632.573507][ T5697] usb usb5-port1: attempt power cycle [ 632.623204][ T5618] Bluetooth: hci5: command 0x0c1a tx timeout [ 632.836762][T15277] can: request_module (can-proto-4) failed. [ 632.893734][T11499] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 632.913242][ T5697] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 632.934205][ T5697] usb 5-1: device descriptor read/8, error -71 [ 633.046502][T11499] usb 4-1: not running at top speed; connect to a high speed hub [ 633.046568][T11499] usb 4-1: New USB device found, idVendor=0763, idProduct=2003, bcdDevice= 0.40 [ 633.048940][T11499] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 177, changing to 4 [ 633.048983][T11499] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 125, changing to 4 [ 633.055377][T11499] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 633.055411][T11499] usb 4-1: Product: syz [ 633.055426][T11499] usb 4-1: Manufacturer: syz [ 633.055439][T11499] usb 4-1: SerialNumber: syz [ 633.174078][ T5697] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 633.193850][ T5697] usb 5-1: device descriptor read/8, error -71 [ 633.303574][ T5697] usb usb5-port1: unable to enumerate USB device [ 633.547993][T15286] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 633.548601][T15286] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 633.661886][T15283] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2884'. [ 633.680574][T15283] syzkaller0: entered promiscuous mode [ 633.680618][T15283] syzkaller0: entered allmulticast mode [ 633.970253][T15293] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 633.970315][T15293] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 634.304933][T15301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 634.314925][T15301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 634.363960][ T5732] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 634.501747][T15307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 634.505056][T15307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 634.506350][T15307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 634.513742][ T5732] usb 3-1: Using ep0 maxpacket: 32 [ 634.514646][T15307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 634.524189][T15307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 634.531441][T15307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 634.542349][ T5732] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 634.546315][ T5732] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 634.546382][ T5732] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 634.546449][ T5732] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 634.546475][ T5732] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 634.546526][ T5732] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 634.546551][ T5732] usb 3-1: config 0 interface 0 has no altsetting 0 [ 634.590571][ T5732] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 634.590600][ T5732] usb 3-1: Product: syz [ 634.590640][ T5732] usb 3-1: Manufacturer: syz [ 634.590654][ T5732] usb 3-1: SerialNumber: syz [ 634.610249][ T5732] usb 3-1: config 0 descriptor?? [ 634.614082][T15295] raw-gadget.8 gadget.2: fail, usb_ep_enable returned -22 [ 634.624934][ T5732] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 634.660773][ T5732] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 634.703222][ T5618] Bluetooth: hci5: command 0x0c1a tx timeout [ 634.839177][T15295] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 634.851075][T15295] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 634.963836][ T5704] usb 3-1: USB disconnect, device number 42 [ 634.964005][ C0] ldusb 3-1:0.0: usb_submit_urb failed (-19) [ 634.995190][ T5704] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 635.150396][ T6220] pimreg: left allmulticast mode [ 635.653739][T11499] usb 4-1: 1:1 : format type 0 is detected, processed as PCM [ 635.653792][T11499] usb 4-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 635.655419][T11499] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 635.656312][T11499] usb 4-1: unit 1 not found! [ 635.656332][T11499] usb 4-1: unit 2 not found! [ 635.762104][T15329] netlink: 120 bytes leftover after parsing attributes in process `syz.2.2898'. [ 635.762301][T15329] netlink: 120 bytes leftover after parsing attributes in process `syz.2.2898'. [ 635.886216][T11499] usb 4-1: USB disconnect, device number 3 [ 636.031138][T11158] udevd[11158]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 636.383414][T11499] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 636.519619][ T6220] bond1 (unregistering): (slave gretap3): Releasing backup interface [ 636.533166][T11499] usb 3-1: Using ep0 maxpacket: 16 [ 636.534051][T11499] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 636.537288][T11499] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 636.537316][T11499] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 636.537336][T11499] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 636.537376][T11499] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 636.540360][T11499] usb 3-1: config 0 descriptor?? [ 636.779308][ T31] kauditd_printk_skb: 83 callbacks suppressed [ 636.785715][ T31] audit: type=1800 audit(1788506189.275:4930): pid=15331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2899" name="bus" dev="ramfs" ino=65202 res=0 errno=0 [ 636.895914][ T6220] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 636.912120][ T6220] bond_slave_0: left promiscuous mode [ 636.952273][ T6220] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 636.972931][ T6220] bond_slave_1: left promiscuous mode [ 636.983495][ T6220] bond0 (unregistering): Released all slaves [ 637.019976][ T6220] bond1 (unregistering): (slave bond2): Releasing backup interface [ 637.035535][ T6220] bond1 (unregistering): Released all slaves [ 637.087578][ T6220] bond2 (unregistering): Released all slaves [ 637.171037][ T6220] bond3 (unregistering): Released all slaves [ 637.236972][ T6220] bond4 (unregistering): Released all slaves [ 637.459539][ T6220] tipc: Disabling bearer [ 637.466249][ T6220] tipc: Left network mode [ 637.474446][T11501] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 637.627898][T11501] usb 4-1: Using ep0 maxpacket: 8 [ 637.630610][T11501] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 637.643500][T11501] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 637.643577][T11501] usb 4-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 637.643612][T11501] usb 4-1: config 179 has no interface number 0 [ 637.643657][T11501] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 637.643710][T11501] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 637.643739][T11501] usb 4-1: config 179 interface 65 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 23 [ 637.643767][T11501] usb 4-1: config 179 interface 65 has no altsetting 0 [ 637.643804][T11501] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.854166][ T6220] IPVS: stopping backup sync thread 8188 ... [ 637.884283][T11499] usbhid 3-1:0.0: can't add hid device: -71 [ 637.884423][T11499] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 637.912490][T11499] usb 3-1: USB disconnect, device number 43 [ 638.512271][T15360] bond0: (slave bond_slave_1): Releasing backup interface [ 638.668348][T15374] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 638.668877][T15374] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.907183][T15383] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 638.907691][T15383] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 639.116605][T15389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 639.117175][T15389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 639.166372][ T6220] hsr_slave_0: left promiscuous mode [ 639.172821][ T6220] hsr_slave_1: left promiscuous mode [ 639.174877][ T6220] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 639.174918][ T6220] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 639.180116][ T6220] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 639.180138][ T6220] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 639.486440][T15363] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2912'. [ 639.815413][T15397] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 639.826670][T15397] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 640.220335][T11501] usb 4-1: USB disconnect, device number 4 [ 641.446771][ T6220] team0 (unregistering): Port device team_slave_1 removed [ 641.465270][ T6220] team0 (unregistering): Port device team_slave_0 removed [ 642.368029][T12826] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 642.385439][T12826] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 642.387000][T12826] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 642.388087][T12826] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 642.388760][T12826] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 642.545384][T15417] netlink: 324 bytes leftover after parsing attributes in process `syz.0.2927'. [ 642.678882][T15420] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 642.678949][T15420] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 642.687283][T11499] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 642.838351][ T6220] IPVS: stop unused estimator thread 0... [ 642.853312][T11499] usb 4-1: Using ep0 maxpacket: 16 [ 642.859453][T11499] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 642.873397][T11499] usb 4-1: config 8 has an invalid interface number: 206 but max is 0 [ 642.873453][T11499] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 642.873489][T11499] usb 4-1: config 8 has no interface number 0 [ 642.873535][T11499] usb 4-1: config 8 interface 206 altsetting 1 has an endpoint descriptor with address 0xF7, changing to 0x87 [ 642.873569][T11499] usb 4-1: config 8 interface 206 altsetting 1 endpoint 0x87 has invalid maxpacket 33058, setting to 1024 [ 642.873601][T11499] usb 4-1: config 8 interface 206 altsetting 1 endpoint 0xC has invalid maxpacket 1737, setting to 1024 [ 642.873632][T11499] usb 4-1: config 8 interface 206 altsetting 1 bulk endpoint 0xC has invalid maxpacket 1024 [ 642.873660][T11499] usb 4-1: config 8 interface 206 has no altsetting 0 [ 642.890010][T15426] netlink: 112 bytes leftover after parsing attributes in process `syz.2.2930'. [ 642.890187][T15426] netlink: 112 bytes leftover after parsing attributes in process `syz.2.2930'. [ 643.030930][T11499] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 643.030980][T11499] usb 4-1: Product: syz [ 643.031013][T11499] usb 4-1: Manufacturer: syz [ 643.031033][T11499] usb 4-1: SerialNumber: syz [ 643.080067][T15411] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 643.282449][ T5697] usb 2-1: USB disconnect, device number 69 [ 643.338699][T11499] garmin_gps 4-1:8.206: Garmin GPS usb/tty converter detected [ 643.363859][T11499] usb 4-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 643.389087][T11499] usb 4-1: USB disconnect, device number 5 [ 643.477311][T11499] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 643.496202][T11499] garmin_gps 4-1:8.206: device disconnected [ 643.503779][T11501] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 643.657091][T11501] usb 3-1: Using ep0 maxpacket: 8 [ 643.663017][T11501] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 643.673934][T11501] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 643.673984][T11501] usb 3-1: config 179 has no interface number 0 [ 643.674049][T11501] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 643.674083][T11501] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 643.674114][T11501] usb 3-1: config 179 interface 65 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 23 [ 643.674145][T11501] usb 3-1: config 179 interface 65 has no altsetting 0 [ 643.674182][T11501] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.329288][T15445] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 644.463217][T12826] Bluetooth: hci0: command tx timeout [ 644.540946][T15446] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2935'. [ 644.881502][T15457] netlink: 'syz.3.2938': attribute type 11 has an invalid length. [ 644.915779][T15460] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2940'. [ 644.915851][T15460] netlink: 'syz.4.2940': attribute type 10 has an invalid length. [ 644.915872][T15460] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2940'. [ 644.979781][T15460] geneve0: entered promiscuous mode [ 644.979851][T15460] geneve0: entered allmulticast mode [ 645.038744][T15413] bridge0: port 1(bridge_slave_0) entered blocking state [ 645.039797][T15413] bridge0: port 1(bridge_slave_0) entered disabled state [ 645.039964][T15413] bridge_slave_0: entered allmulticast mode [ 645.049279][T15413] bridge_slave_0: entered promiscuous mode [ 645.084696][T15413] bridge0: port 2(bridge_slave_1) entered blocking state [ 645.084831][T15413] bridge0: port 2(bridge_slave_1) entered disabled state [ 645.084989][T15413] bridge_slave_1: entered allmulticast mode [ 645.089793][T15413] bridge_slave_1: entered promiscuous mode [ 645.126524][T15466] netlink: 120 bytes leftover after parsing attributes in process `syz.3.2942'. [ 645.136268][T15466] netlink: 120 bytes leftover after parsing attributes in process `syz.3.2942'. [ 645.434670][T15413] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 645.594184][T15413] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 645.623421][ T5704] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 645.654635][T15413] team0: Port device team_slave_0 added [ 645.691904][T15413] team0: Port device team_slave_1 added [ 645.734617][T15413] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 645.734660][T15413] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 645.734687][T15413] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 645.739125][T15413] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 645.739143][T15413] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 645.739170][T15413] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 645.796409][ T5704] usb 4-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 645.797536][ T5704] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 645.797557][ T5704] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 645.797591][ T5704] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.867854][T15413] hsr_slave_0: entered promiscuous mode [ 645.868974][T15413] hsr_slave_1: entered promiscuous mode [ 645.874742][T15413] debugfs: 'hsr0' already exists in 'hsr' [ 645.874768][T15413] Cannot create hsr debugfs directory [ 645.936588][T15476] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2945'. [ 646.199863][ T5697] usb 3-1: USB disconnect, device number 44 [ 646.358230][ T6220] pimreg3: left allmulticast mode [ 646.543164][T12826] Bluetooth: hci0: command tx timeout [ 646.641437][ T6220] team0: Port device xfrm0 removed [ 646.692081][T15495] input: syz0 as /devices/virtual/input/input41 [ 647.069049][ T6220] bond4 (unregistering): (slave gre4): Releasing backup interface [ 647.069092][ T6220] gre4 (unregistering): left promiscuous mode [ 647.277238][ T6220] bond0 (unregistering): Released all slaves [ 647.319585][ T6220] bond1 (unregistering): Released all slaves [ 647.396326][ T6220] bond2 (unregistering): Released all slaves [ 647.450917][ T6220] bond3 (unregistering): Released all slaves [ 647.529582][ T6220] bond4 (unregistering): Released all slaves [ 647.679453][ T6220] bond5 (unregistering): (slave veth9): Releasing active interface [ 647.710980][ T6220] bond5 (unregistering): (slave dummy0): Releasing active interface [ 647.777043][ T6220] bond5 (unregistering): Released all slaves [ 647.893768][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1 [ 648.299011][ T6220] tipc: Left network mode [ 648.557654][ T5697] usb 4-1: USB disconnect, device number 6 [ 648.623275][T12826] Bluetooth: hci0: command tx timeout [ 648.824245][ T31] audit: type=1326 audit(1788506201.315:4931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15536 comm="syz.3.2955" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f929519e159 code=0x0 [ 648.875392][T15543] FAULT_INJECTION: forcing a failure. [ 648.875392][T15543] name failslab, interval 1, probability 0, space 0, times 0 [ 648.875464][T15543] CPU: 1 UID: 0 PID: 15543 Comm: syz.0.2956 Tainted: G L syzkaller #0 PREEMPT(full) [ 648.875495][T15543] Tainted: [L]=SOFTLOCKUP [ 648.875504][T15543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 648.875516][T15543] Call Trace: [ 648.875526][T15543] [ 648.875535][T15543] dump_stack_lvl+0xe8/0x150 [ 648.875576][T15543] should_fail_ex+0x410/0x560 [ 648.875613][T15543] should_failslab+0xa8/0x100 [ 648.875637][T15543] __kmalloc_node_noprof+0x100/0x720 [ 648.875663][T15543] ? __get_vm_area_node+0x200/0x2f0 [ 648.875688][T15543] ? __get_vm_area_node+0x283/0x2f0 [ 648.875709][T15543] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 648.875732][T15543] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 648.875764][T15543] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 648.875814][T15543] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 648.875848][T15543] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 648.875873][T15543] __vmalloc_noprof+0xd2/0x120 [ 648.875899][T15543] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 648.875923][T15543] bpf_prog_alloc_no_stats+0x47/0x560 [ 648.875944][T15543] ? bpf_prog_alloc+0x2a/0x1a0 [ 648.875967][T15543] bpf_prog_alloc+0x3c/0x1a0 [ 648.875991][T15543] bpf_prog_load+0x7f8/0x1c20 [ 648.876052][T15543] ? __pfx_bpf_prog_load+0x10/0x10 [ 648.876097][T15543] __sys_bpf+0xd0d/0xd90 [ 648.876126][T15543] ? __pfx___sys_bpf+0x10/0x10 [ 648.876166][T15543] ? __fget_files+0x2a/0x420 [ 648.876207][T15543] ? ksys_write+0x242/0x270 [ 648.876236][T15543] ? __pfx_ksys_write+0x10/0x10 [ 648.876267][T15543] __x64_sys_bpf+0xba/0xd0 [ 648.876289][T15543] do_syscall_64+0x166/0x520 [ 648.876319][T15543] ? trace_irq_disable+0x3b/0x140 [ 648.876338][T15543] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.876359][T15543] ? clear_bhb_loop+0x70/0xc0 [ 648.876383][T15543] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.876403][T15543] RIP: 0033:0x7feb0a79e159 [ 648.876424][T15543] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 648.876441][T15543] RSP: 002b:00007feb0b6d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 648.876464][T15543] RAX: ffffffffffffffda RBX: 00007feb0aa25fa0 RCX: 00007feb0a79e159 [ 648.876479][T15543] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 648.876493][T15543] RBP: 00007feb0b6d1090 R08: 0000000000000000 R09: 0000000000000000 [ 648.876506][T15543] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 648.876519][T15543] R13: 00007feb0aa26038 R14: 00007feb0aa25fa0 R15: 00007feb0ab4fa48 [ 648.876550][T15543] [ 648.890422][T15543] syz.0.2956: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 648.890695][T15543] CPU: 1 UID: 0 PID: 15543 Comm: syz.0.2956 Tainted: G L syzkaller #0 PREEMPT(full) [ 648.890722][T15543] Tainted: [L]=SOFTLOCKUP [ 648.890730][T15543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 648.890742][T15543] Call Trace: [ 648.890750][T15543] [ 648.890758][T15543] dump_stack_lvl+0xe8/0x150 [ 648.890791][T15543] warn_alloc+0x24d/0x270 [ 648.890828][T15543] ? __pfx_warn_alloc+0x10/0x10 [ 648.890860][T15543] ? __kmalloc_node_noprof+0x4d7/0x720 [ 648.890885][T15543] ? __get_vm_area_node+0x200/0x2f0 [ 648.890908][T15543] ? __get_vm_area_node+0x283/0x2f0 [ 648.890930][T15543] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 648.890953][T15543] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 648.890985][T15543] __vmalloc_node_range_noprof+0x969/0x1540 [ 648.891034][T15543] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 648.891068][T15543] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 648.891088][T15543] __vmalloc_noprof+0xd2/0x120 [ 648.891112][T15543] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 648.891134][T15543] bpf_prog_alloc_no_stats+0x47/0x560 [ 648.891162][T15543] ? bpf_prog_alloc+0x2a/0x1a0 [ 648.891184][T15543] bpf_prog_alloc+0x3c/0x1a0 [ 648.891206][T15543] bpf_prog_load+0x7f8/0x1c20 [ 648.891238][T15543] ? __pfx_bpf_prog_load+0x10/0x10 [ 648.891281][T15543] __sys_bpf+0xd0d/0xd90 [ 648.891309][T15543] ? __pfx___sys_bpf+0x10/0x10 [ 648.891339][T15543] ? __fget_files+0x2a/0x420 [ 648.891378][T15543] ? ksys_write+0x242/0x270 [ 648.891405][T15543] ? __pfx_ksys_write+0x10/0x10 [ 648.891434][T15543] __x64_sys_bpf+0xba/0xd0 [ 648.891455][T15543] do_syscall_64+0x166/0x520 [ 648.891482][T15543] ? trace_irq_disable+0x3b/0x140 [ 648.891499][T15543] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.891518][T15543] ? clear_bhb_loop+0x70/0xc0 [ 648.891541][T15543] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.891559][T15543] RIP: 0033:0x7feb0a79e159 [ 648.891578][T15543] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 648.891594][T15543] RSP: 002b:00007feb0b6d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 648.891613][T15543] RAX: ffffffffffffffda RBX: 00007feb0aa25fa0 RCX: 00007feb0a79e159 [ 648.891627][T15543] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 648.891639][T15543] RBP: 00007feb0b6d1090 R08: 0000000000000000 R09: 0000000000000000 [ 648.891651][T15543] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 648.891663][T15543] R13: 00007feb0aa26038 R14: 00007feb0aa25fa0 R15: 00007feb0ab4fa48 [ 648.891693][T15543] [ 648.891730][T15543] Mem-Info: [ 648.891740][T15543] active_anon:8303 inactive_anon:71 isolated_anon:0 [ 648.891740][T15543] active_file:3820 inactive_file:54774 isolated_file:0 [ 648.891740][T15543] unevictable:4 dirty:285 writeback:0 [ 648.891740][T15543] slab_reclaimable:10377 slab_unreclaimable:101577 [ 648.891740][T15543] mapped:30866 shmem:2579 pagetables:2014 [ 648.891740][T15543] sec_pagetables:0 bounce:0 [ 648.891740][T15543] kernel_misc_reclaimable:0 [ 648.891740][T15543] free:1273661 free_pcp:10141 free_cma:0 [ 648.891789][T15543] Node 0 active_anon:33212kB inactive_anon:284kB active_file:15276kB inactive_file:218732kB unevictable:16kB isolated(anon):0kB isolated(file):0kB mapped:123296kB dirty:1132kB writeback:0kB shmem:10316kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13176kB pagetables:7928kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 648.891840][T15543] Node 1 active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:364kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:168kB dirty:8kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 648.891888][T15543] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 648.910526][T15543] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 648.910571][T15543] Node 0 DMA32 free:1126152kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:33212kB inactive_anon:284kB active_file:15276kB inactive_file:218732kB unevictable:16kB writepending:1132kB zspages:0kB present:3129332kB managed:2546712kB mlocked:0kB bounce:0kB free_pcp:40492kB local_pcp:21192kB free_cma:0kB [ 648.910629][T15543] lowmem_reserve[]: 0 0 0 0 0 [ 648.910663][T15543] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 648.910712][T15543] lowmem_reserve[]: 0 0 0 0 0 [ 648.910746][T15543] Node 1 Normal free:3953824kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:364kB unevictable:0kB writepending:8kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 648.910799][T15543] lowmem_reserve[]: 0 0 0 0 0 [ 648.910831][T15543] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (UM) = 15360kB [ 648.910940][T15543] Node 0 DMA32: 2538*4kB (UME) 2174*8kB (UME) 1314*16kB (UME) 1248*32kB (UME) 563*64kB (UME) 277*128kB (UME) 190*256kB (UME) 102*512kB (UME) 59*1024kB (UME) 11*2048kB (UME) 191*4096kB (U) = 1126136kB [ 648.911092][T15543] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 648.911193][T15543] Node 1 Normal: 10*4kB (UM) 9*8kB (UM) 13*16kB (UM) 17*32kB (UM) 11*64kB (UM) 11*128kB (UM) 5*256kB (UM) 6*512kB (UM) 4*1024kB (UM) 5*2048kB (UM) 960*4096kB (UM) = 3953824kB [ 648.911341][T15543] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 648.911358][T15543] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 648.911373][T15543] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 648.911388][T15543] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 648.911404][T15543] 61251 total pagecache pages [ 648.911412][T15543] 82 pages in swap cache [ 648.911419][T15543] Free swap = 124668kB [ 648.911427][T15543] Total swap = 124996kB [ 648.911436][T15543] 2097051 pages RAM [ 648.911443][T15543] 0 pages HighMem/MovableOnly [ 648.911451][T15543] 428757 pages reserved [ 648.911458][T15543] 0 pages cma reserved [ 649.209169][T15548] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2955'. [ 649.404525][ T5704] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 649.510765][ T5697] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 649.643464][ T5704] usb 5-1: Using ep0 maxpacket: 8 [ 649.644230][ T5704] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 649.645225][ T5704] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 649.645248][ T5704] usb 5-1: config 179 has no interface number 0 [ 649.645288][ T5704] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 649.645313][ T5704] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 649.645339][ T5704] usb 5-1: config 179 interface 65 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 23 [ 649.645363][ T5704] usb 5-1: config 179 interface 65 has no altsetting 0 [ 649.645394][ T5704] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.673978][ T5697] usb 3-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 649.674948][ T5697] usb 3-1: config 0 has an invalid interface number: 120 but max is 0 [ 649.674972][ T5697] usb 3-1: config 0 has no interface number 0 [ 649.675010][ T5697] usb 3-1: config 0 interface 120 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 649.675035][ T5697] usb 3-1: config 0 interface 120 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 649.675058][ T5697] usb 3-1: config 0 interface 120 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 649.675098][ T5697] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.710314][ T5697] usb 3-1: config 0 descriptor?? [ 649.711117][T15553] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 649.724562][ T5697] input: USB Touchscreen 16e3:f9e9 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.120/input/input42 [ 649.842621][ C1] usbtouchscreen 3-1:0.120: usbtouch_irq - usb_submit_urb failed with result: -1 [ 649.985880][ T5697] usb 5-1: USB disconnect, device number 12 [ 650.078777][T15553] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 650.079294][T15553] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 650.151725][T15553] netlink: 9916 bytes leftover after parsing attributes in process `syz.2.2959'. [ 650.157175][ T5704] usb 3-1: USB disconnect, device number 45 [ 650.252145][T15566] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 650.252990][T15566] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 650.314662][T15569] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 650.337429][T15569] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 650.714174][T12826] Bluetooth: hci0: command tx timeout [ 650.839436][T15580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 650.852662][T15580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 650.926298][T15578] ±ÿ‰P: renamed from lo (while UP) [ 651.066432][T11501] usb 3-1: new full-speed USB device number 46 using dummy_hcd [ 651.227488][T11501] usb 3-1: not running at top speed; connect to a high speed hub [ 651.227547][T11501] usb 3-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 651.272784][T11501] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 651.272833][T11501] usb 3-1: Product: syz [ 651.272867][T11501] usb 3-1: Manufacturer: syz [ 651.272887][T11501] usb 3-1: SerialNumber: syz [ 651.562953][T11501] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 651.580291][T11501] usb 3-1: MIDIStreaming interface descriptor not found [ 651.589248][ T6220] IPVS: stop unused estimator thread 0... [ 651.989279][T11501] usb 3-1: USB disconnect, device number 46 [ 652.273276][T15609] ip6t_rpfilter: unknown options [ 652.333690][T11499] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 652.432906][T14528] udevd[14528]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 652.493508][T11499] usb 5-1: Using ep0 maxpacket: 8 [ 652.499445][T11499] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 652.512946][T11499] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 652.512996][T11499] usb 5-1: config 179 has no interface number 0 [ 652.513105][T11499] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 652.513168][T11499] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 652.513200][T11499] usb 5-1: config 179 interface 65 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 23 [ 652.551553][T11499] usb 5-1: config 179 interface 65 has no altsetting 0 [ 652.551614][T11499] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.667827][T15413] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 652.675344][T11501] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 652.691848][T15413] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 652.699095][T15413] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 652.742906][T15413] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 652.747237][T15413] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 652.765709][T15618] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 652.766204][T15618] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 652.798388][T15413] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 652.799359][T15413] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 652.815986][T15413] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 652.843185][T11501] usb 3-1: Using ep0 maxpacket: 32 [ 652.849426][T11501] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 652.861821][T11501] usb 3-1: config index 0 descriptor too short (expected 27632, got 27) [ 652.861872][T11501] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 652.861916][T11501] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 652.861943][T11501] usb 3-1: config 1 has no interface number 0 [ 652.861991][T11501] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 652.862025][T11501] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 652.862071][T11501] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.944675][T11501] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 653.041547][T15413] 8021q: adding VLAN 0 to HW filter on device bond0 [ 653.103494][T15413] 8021q: adding VLAN 0 to HW filter on device team0 [ 653.126277][ T84] bridge0: port 1(bridge_slave_0) entered blocking state [ 653.126418][ T84] bridge0: port 1(bridge_slave_0) entered forwarding state [ 653.158218][ T84] bridge0: port 2(bridge_slave_1) entered blocking state [ 653.158368][ T84] bridge0: port 2(bridge_slave_1) entered forwarding state [ 653.189901][T11501] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now attached [ 653.352758][T15413] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 653.456509][T11496] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 653.486337][T15413] veth0_vlan: entered promiscuous mode [ 653.520886][T15636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 653.526360][T15636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 653.558316][T15413] veth1_vlan: entered promiscuous mode [ 653.613011][ T5697] usb 3-1: USB disconnect, device number 47 [ 653.617308][ T5697] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 653.629062][T11496] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 653.647753][T11496] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 653.647802][T11496] usb 4-1: Product: syz [ 653.647836][T11496] usb 4-1: Manufacturer: syz [ 653.647856][T11496] usb 4-1: SerialNumber: syz [ 654.127994][T15413] veth0_macvtap: entered promiscuous mode [ 654.196845][T15413] veth1_macvtap: entered promiscuous mode [ 654.251535][T15645] misc userio: The device must be registered before sending interrupts [ 654.321664][T15413] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 654.368999][T15413] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 654.468695][ T6263] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.469038][ T6263] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.469291][ T6263] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.469746][ T6263] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.471207][T15650] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2978'. [ 654.749779][ T6263] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 654.758651][ T6263] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 654.841043][ T6268] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 654.841105][ T6268] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 655.029102][ T25] usb 5-1: USB disconnect, device number 13 [ 655.478698][T11496] rtl8150 4-1:1.0: couldn't reset the device [ 655.479070][T11496] rtl8150 4-1:1.0: probe with driver rtl8150 failed with error -5 [ 655.490764][T15674] FAULT_INJECTION: forcing a failure. [ 655.490764][T15674] name failslab, interval 1, probability 0, space 0, times 0 [ 655.490800][T15674] CPU: 1 UID: 0 PID: 15674 Comm: syz.1.2924 Tainted: G L syzkaller #0 PREEMPT(full) [ 655.490827][T15674] Tainted: [L]=SOFTLOCKUP [ 655.490834][T15674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 655.490846][T15674] Call Trace: [ 655.490855][T15674] [ 655.490863][T15674] dump_stack_lvl+0xe8/0x150 [ 655.490901][T15674] should_fail_ex+0x410/0x560 [ 655.490934][T15674] should_failslab+0xa8/0x100 [ 655.490956][T15674] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 655.491007][T15674] kmem_cache_alloc_noprof+0xa1/0x600 [ 655.491033][T15674] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 655.491058][T15674] ? kmem_cache_alloc_noprof+0x156/0x600 [ 655.491083][T15674] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 655.491116][T15674] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 655.491154][T15674] mmu_topup_memory_caches+0x21/0x170 [ 655.491190][T15674] kvm_mmu_load+0x9d/0x21e0 [ 655.491212][T15674] ? kvm_msr_allowed+0x9a/0x490 [ 655.491231][T15674] ? kvm_msr_allowed+0x9a/0x490 [ 655.491250][T15674] ? kvm_msr_allowed+0x9a/0x490 [ 655.491268][T15674] ? kvm_msr_allowed+0x3f4/0x490 [ 655.491284][T15674] ? apic_find_highest_vector+0x45/0x2d0 [ 655.491307][T15674] ? kvm_apic_has_interrupt+0x4b1/0x770 [ 655.491342][T15674] vcpu_run+0x4f68/0x79b0 [ 655.491400][T15674] ? update_se+0x90/0x1020 [ 655.491469][T15674] ? __pfx_vcpu_run+0x10/0x10 [ 655.491496][T15674] ? lock_acquire+0x115/0x350 [ 655.491531][T15674] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 655.491563][T15674] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 655.491591][T15674] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 655.491616][T15674] kvm_vcpu_ioctl+0xa61/0xfd0 [ 655.491650][T15674] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 655.491668][T15674] ? hook_file_ioctl+0x1f2/0x600 [ 655.491711][T15674] ? __fget_files+0x2a/0x420 [ 655.491739][T15674] ? __fget_files+0x2a/0x420 [ 655.491762][T15674] ? __fget_files+0x3a2/0x420 [ 655.491785][T15674] ? __fget_files+0x2a/0x420 [ 655.491813][T15674] ? bpf_lsm_file_ioctl+0x9/0x20 [ 655.491840][T15674] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 655.491862][T15674] __se_sys_ioctl+0xfc/0x170 [ 655.491885][T15674] do_syscall_64+0x166/0x520 [ 655.491911][T15674] ? trace_irq_disable+0x3b/0x140 [ 655.491930][T15674] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 655.491950][T15674] ? clear_bhb_loop+0x70/0xc0 [ 655.491974][T15674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 655.491994][T15674] RIP: 0033:0x7fd63579e159 [ 655.492014][T15674] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 655.492031][T15674] RSP: 002b:00007fd6366e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 655.492054][T15674] RAX: ffffffffffffffda RBX: 00007fd635a26090 RCX: 00007fd63579e159 [ 655.492069][T15674] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 655.492082][T15674] RBP: 00007fd6366e0090 R08: 0000000000000000 R09: 0000000000000000 [ 655.492095][T15674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 655.492108][T15674] R13: 00007fd635a26128 R14: 00007fd635a26090 R15: 00007fd635b4fa48 [ 655.492140][T15674] [ 655.964412][T11500] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 656.124816][T11500] usb 3-1: Using ep0 maxpacket: 32 [ 656.130948][T11500] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 656.142159][T11500] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 656.152794][T11500] usb 3-1: config 0 has no interface number 0 [ 656.152918][T11500] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 656.152951][T11500] usb 3-1: config 0 interface 85 has no altsetting 0 [ 656.185789][T11500] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 656.194096][T11500] usb 3-1: Product: syz [ 656.194161][T11500] usb 3-1: Manufacturer: syz [ 656.194182][T11500] usb 3-1: SerialNumber: syz [ 656.213554][T11496] usb 1-1: USB disconnect, device number 119 [ 656.254190][T11500] usb 3-1: config 0 descriptor?? [ 656.424260][T11499] usb 4-1: USB disconnect, device number 7 [ 656.552618][ T5618] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 656.565420][ T5618] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 656.575318][ T5618] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 656.587703][ T5618] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 656.588417][ T5618] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 656.953569][ T25] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 657.114431][T15696] sg_write: data in/out 398301/274 bytes for SCSI command 0x0-- guessing data in; [ 657.114431][T15696] program syz.1.2986 not setting count and/or reply_len properly [ 657.115508][ T25] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 657.137293][ T25] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 657.137347][ T25] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 657.137370][ T25] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 657.137395][ T25] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 657.137436][ T25] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 657.614839][ T25] gud 4-1:1.0: Failed to add properties (error=-5) [ 657.614902][ T25] gud 4-1:1.0: probe with driver gud failed with error -5 [ 657.827958][T15692] netlink: 'syz.3.2985': attribute type 9 has an invalid length. [ 657.994674][ T5704] usb 4-1: USB disconnect, device number 8 [ 658.234668][T11500] appletouch 3-1:0.85: Failed to request geyser raw mode [ 658.234939][T11500] appletouch 3-1:0.85: probe with driver appletouch failed with error -5 [ 658.273573][T11500] usb 3-1: USB disconnect, device number 48 [ 658.357125][T15693] bridge0: port 1(bridge_slave_0) entered blocking state [ 658.357766][T15693] bridge0: port 1(bridge_slave_0) entered disabled state [ 658.358209][T15693] bridge_slave_0: entered allmulticast mode [ 658.369881][T15693] bridge_slave_0: entered promiscuous mode [ 658.440610][T15693] bridge0: port 2(bridge_slave_1) entered blocking state [ 658.440788][T15693] bridge0: port 2(bridge_slave_1) entered disabled state [ 658.440956][T15693] bridge_slave_1: entered allmulticast mode [ 658.450390][T15693] bridge_slave_1: entered promiscuous mode [ 658.704813][ T5618] Bluetooth: hci4: command tx timeout [ 658.745046][T15693] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 658.748698][T15693] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 658.836880][T15693] team0: Port device team_slave_0 added [ 658.849526][T15693] team0: Port device team_slave_1 added [ 658.892049][T15693] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 658.895239][T15693] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 658.895272][T15693] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 659.011252][T15693] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 659.011291][T15693] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 659.011340][T15693] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 659.194459][T15693] hsr_slave_0: entered promiscuous mode [ 659.201667][T15693] hsr_slave_1: entered promiscuous mode [ 659.210858][T15693] debugfs: 'hsr0' already exists in 'hsr' [ 659.216773][T15693] Cannot create hsr debugfs directory [ 659.353265][ T5704] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 659.506353][ T5704] usb 3-1: New USB device found, idVendor=041e, idProduct=4011, bcdDevice=af.98 [ 659.506430][ T5704] usb 3-1: too many configurations: 25, using maximum allowed: 8 [ 659.511652][ T5704] usb 3-1: config index 0 descriptor too short (expected 137, got 18) [ 659.511682][ T5704] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 659.516325][ T5704] usb 3-1: config index 1 descriptor too short (expected 137, got 18) [ 659.516355][ T5704] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 659.524613][ T5704] usb 3-1: config index 2 descriptor too short (expected 137, got 18) [ 659.524643][ T5704] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 659.526646][ T5704] usb 3-1: config index 3 descriptor too short (expected 137, got 18) [ 659.526672][ T5704] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 659.530339][ T5704] usb 3-1: config index 4 descriptor too short (expected 137, got 18) [ 659.530364][ T5704] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 659.534716][ T5704] usb 3-1: config index 5 descriptor too short (expected 137, got 18) [ 659.534741][ T5704] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 659.536616][ T5704] usb 3-1: config index 6 descriptor too short (expected 137, got 18) [ 659.536639][ T5704] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 659.547916][ T5704] usb 3-1: config index 7 descriptor too short (expected 137, got 18) [ 659.547947][ T5704] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 659.547998][ T5704] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 659.685990][T15728] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2995'. [ 659.717485][T15726] FAULT_INJECTION: forcing a failure. [ 659.717485][T15726] name failslab, interval 1, probability 0, space 0, times 0 [ 659.717571][T15726] CPU: 1 UID: 0 PID: 15726 Comm: syz.4.2994 Tainted: G L syzkaller #0 PREEMPT(full) [ 659.717598][T15726] Tainted: [L]=SOFTLOCKUP [ 659.717605][T15726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 659.717616][T15726] Call Trace: [ 659.717624][T15726] [ 659.717632][T15726] dump_stack_lvl+0xe8/0x150 [ 659.717663][T15726] should_fail_ex+0x410/0x560 [ 659.717699][T15726] should_failslab+0xa8/0x100 [ 659.717720][T15726] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 659.717746][T15726] kmem_cache_alloc_noprof+0xa1/0x600 [ 659.717770][T15726] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 659.717798][T15726] ? kmem_cache_alloc_noprof+0x156/0x600 [ 659.717822][T15726] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 659.717861][T15726] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 659.717896][T15726] mmu_topup_memory_caches+0x21/0x170 [ 659.717917][T15726] kvm_mmu_load+0x9d/0x21e0 [ 659.717937][T15726] ? kvm_msr_allowed+0x9a/0x490 [ 659.717954][T15726] ? kvm_msr_allowed+0x9a/0x490 [ 659.717973][T15726] ? kvm_msr_allowed+0x9a/0x490 [ 659.717989][T15726] ? kvm_msr_allowed+0x3f4/0x490 [ 659.718006][T15726] ? apic_find_highest_vector+0x45/0x2d0 [ 659.718025][T15726] ? kvm_apic_has_interrupt+0x4b1/0x770 [ 659.718058][T15726] vcpu_run+0x4f68/0x79b0 [ 659.718114][T15726] ? update_se+0x90/0x1020 [ 659.718170][T15726] ? __pfx_vcpu_run+0x10/0x10 [ 659.718194][T15726] ? lock_acquire+0x115/0x350 [ 659.718229][T15726] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 659.718258][T15726] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 659.718284][T15726] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 659.718308][T15726] kvm_vcpu_ioctl+0xa61/0xfd0 [ 659.718331][T15726] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 659.718348][T15726] ? hook_file_ioctl+0x1f2/0x600 [ 659.718387][T15726] ? __fget_files+0x2a/0x420 [ 659.718415][T15726] ? __fget_files+0x2a/0x420 [ 659.718436][T15726] ? __fget_files+0x3a2/0x420 [ 659.718465][T15726] ? __fget_files+0x2a/0x420 [ 659.718491][T15726] ? bpf_lsm_file_ioctl+0x9/0x20 [ 659.718516][T15726] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 659.718537][T15726] __se_sys_ioctl+0xfc/0x170 [ 659.718560][T15726] do_syscall_64+0x166/0x520 [ 659.718586][T15726] ? trace_irq_disable+0x3b/0x140 [ 659.718604][T15726] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 659.718624][T15726] ? clear_bhb_loop+0x70/0xc0 [ 659.718647][T15726] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 659.718665][T15726] RIP: 0033:0x7fc5e1d9e159 [ 659.718685][T15726] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 659.718701][T15726] RSP: 002b:00007fc5e2cb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 659.718723][T15726] RAX: ffffffffffffffda RBX: 00007fc5e2025fa0 RCX: 00007fc5e1d9e159 [ 659.718738][T15726] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 659.718750][T15726] RBP: 00007fc5e2cb4090 R08: 0000000000000000 R09: 0000000000000000 [ 659.718762][T15726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 659.718774][T15726] R13: 00007fc5e2026038 R14: 00007fc5e2025fa0 R15: 00007fc5e214fa48 [ 659.718806][T15726] [ 660.058359][ T5704] usb 3-1: string descriptor 0 read error: -71 [ 660.071506][ T5704] pwc: Creative Labs Webcam Pro Ex detected. [ 660.071554][ T5704] pwc: Warning: more than 1 configuration available. [ 660.072940][ T5704] pwc: Failed to set LED on/off time (-71) [ 660.076716][ T5704] pwc: send_video_command error -71 [ 660.076733][ T5704] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 660.076831][ T5704] Philips webcam 3-1:1.0: probe with driver Philips webcam failed with error -71 [ 660.083009][ T5704] usb 3-1: USB disconnect, device number 49 [ 660.253678][ T5697] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 660.260378][T15741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2997'. [ 660.312671][ T6267] veth1: left allmulticast mode [ 660.312724][ T6267] veth1: left promiscuous mode [ 660.315080][ T6267] bridge0: port 4(veth1) entered disabled state [ 660.337473][ T6267] veth0: left allmulticast mode [ 660.342478][ T6267] veth0: left promiscuous mode [ 660.350412][ T6267] bridge0: port 3(veth0) entered disabled state [ 660.359087][ T6267] bridge_slave_1: left allmulticast mode [ 660.359121][ T6267] bridge_slave_1: left promiscuous mode [ 660.359337][ T6267] bridge0: port 2(bridge_slave_1) entered disabled state [ 660.377917][ T6267] bridge_slave_0: left allmulticast mode [ 660.377944][ T6267] bridge_slave_0: left promiscuous mode [ 660.378214][ T6267] bridge0: port 1(bridge_slave_0) entered disabled state [ 660.413225][ T5697] usb 4-1: Using ep0 maxpacket: 32 [ 660.419356][ T5697] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 660.421947][ T6267] dvmrp6: left allmulticast mode [ 660.437748][ T5697] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 660.450029][ T5697] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 660.450064][ T5697] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 660.450091][ T5697] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 660.488909][ T5697] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 660.497306][ T5697] usb 4-1: Product: syz [ 660.497354][ T5697] usb 4-1: Manufacturer: syz [ 660.497372][ T5697] usb 4-1: SerialNumber: syz [ 660.514375][ T5697] usb 4-1: config 0 descriptor?? [ 660.523934][T15735] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 660.542909][ T5697] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input44 [ 660.554740][ T5704] usb 2-1: new full-speed USB device number 70 using dummy_hcd [ 660.578125][ C1] xpad 4-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 660.603873][ C1] xpad 4-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 660.647967][ C1] xpad 4-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 660.713950][ T5704] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 660.750137][ T5704] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 660.758600][ T5704] usb 2-1: Product: syz [ 660.758651][ T5704] usb 2-1: Manufacturer: syz [ 660.758672][ T5704] usb 2-1: SerialNumber: syz [ 660.783306][ T5618] Bluetooth: hci4: command tx timeout [ 660.822397][ T5704] usb 2-1: config 0 descriptor?? [ 660.824238][T15735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 660.824696][T15735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 660.833845][T15735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 660.836741][T15747] netlink: ct_mark mask cannot be 0 [ 660.836788][T15747] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 660.840047][T15735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 660.861574][T15735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 660.862056][T15735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 660.971654][ T6267] bond1 (unregistering): (slave gretap3): Releasing active interface [ 661.055459][ T6267] team0: Port device bridge1 removed [ 661.087023][ T6267] tipc: Disabling bearer [ 661.102094][ T5704] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 661.120823][T15735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 661.136275][T15735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.165796][ T5606] usb 4-1: USB disconnect, device number 9 [ 661.165887][ C1] xpad 4-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 661.315649][ T6267] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 661.325765][ T6267] bond_slave_0: left promiscuous mode [ 661.332295][ T6267] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 661.342124][ T6267] bond_slave_1: left promiscuous mode [ 661.342716][ T6267] .` (unregistering): Released all slaves [ 661.352514][ T6267] bond0 (unregistering): Released all slaves [ 661.371475][ T6267] bond1 (unregistering): Released all slaves [ 661.671951][T15753] netlink: 'syz.4.3000': attribute type 1 has an invalid length. [ 661.672024][T15753] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3000'. [ 661.806982][T15760] FAULT_INJECTION: forcing a failure. [ 661.806982][T15760] name failslab, interval 1, probability 0, space 0, times 0 [ 661.807039][T15760] CPU: 0 UID: 0 PID: 15760 Comm: syz.2.3001 Tainted: G L syzkaller #0 PREEMPT(full) [ 661.807065][T15760] Tainted: [L]=SOFTLOCKUP [ 661.807072][T15760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 661.807082][T15760] Call Trace: [ 661.807090][T15760] [ 661.807099][T15760] dump_stack_lvl+0xe8/0x150 [ 661.807134][T15760] should_fail_ex+0x410/0x560 [ 661.807163][T15760] ? __alloc_skb+0x1db/0x7a0 [ 661.807278][T15760] should_failslab+0xa8/0x100 [ 661.807300][T15760] ? __alloc_skb+0x1db/0x7a0 [ 661.807321][T15760] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 661.807345][T15760] ? __alloc_skb+0x18d/0x7a0 [ 661.807369][T15760] ? __alloc_skb+0x1db/0x7a0 [ 661.807399][T15760] __alloc_skb+0x1db/0x7a0 [ 661.807427][T15760] netlink_sendmsg+0x5d4/0xb40 [ 661.807460][T15760] ? __pfx_netlink_sendmsg+0x10/0x10 [ 661.807489][T15760] ? apparmor_socket_sendmsg+0x98/0x360 [ 661.807516][T15760] ? __pfx_netlink_sendmsg+0x10/0x10 [ 661.807535][T15760] sock_sendmsg_nosec+0x13a/0x180 [ 661.807560][T15760] ____sys_sendmsg+0x54e/0x850 [ 661.807583][T15760] ? __pfx_____sys_sendmsg+0x10/0x10 [ 661.807609][T15760] ? import_iovec+0x73/0xa0 [ 661.807657][T15760] ___sys_sendmsg+0x2a5/0x360 [ 661.807674][T15760] ? __lock_acquire+0x6df/0x2e50 [ 661.807696][T15760] ? __pfx____sys_sendmsg+0x10/0x10 [ 661.807746][T15760] ? __fget_files+0x2a/0x420 [ 661.807768][T15760] ? __fget_files+0x3a2/0x420 [ 661.807799][T15760] __x64_sys_sendmsg+0x1b1/0x290 [ 661.807820][T15760] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 661.807857][T15760] do_syscall_64+0x166/0x520 [ 661.807881][T15760] ? trace_irq_disable+0x3b/0x140 [ 661.807896][T15760] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.807914][T15760] ? clear_bhb_loop+0x70/0xc0 [ 661.807935][T15760] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.807961][T15760] RIP: 0033:0x7f88bff9e159 [ 661.807979][T15760] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 661.807995][T15760] RSP: 002b:00007f88c0e6f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 661.808017][T15760] RAX: ffffffffffffffda RBX: 00007f88c0225fa0 RCX: 00007f88bff9e159 [ 661.808031][T15760] RDX: 0000000000008800 RSI: 0000200000000180 RDI: 0000000000000003 [ 661.808043][T15760] RBP: 00007f88c0e6f090 R08: 0000000000000000 R09: 0000000000000000 [ 661.808054][T15760] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 661.808065][T15760] R13: 00007f88c0226038 R14: 00007f88c0225fa0 R15: 00007f88c034fa48 [ 661.808094][T15760] [ 662.053713][ T6267] tipc: Left network mode [ 662.863180][ T5618] Bluetooth: hci4: command tx timeout [ 662.900947][ T6267] hsr_slave_0: left promiscuous mode [ 662.907833][ T6267] hsr_slave_1: left promiscuous mode [ 662.911290][ T6267] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 662.920509][ T6267] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 663.424306][ T5704] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 663.690446][T11499] usb 2-1: USB disconnect, device number 70 [ 663.794846][ T6267] team0 (unregistering): Port device team_slave_1 removed [ 663.848218][ T6267] team0 (unregistering): Port device team_slave_0 removed [ 663.942192][T15792] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3007'. [ 664.422409][T15789] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3006'. [ 664.422558][T15789] netlink: 29 bytes leftover after parsing attributes in process `syz.4.3006'. [ 664.441771][T15789] tipc: Invalid UDP bearer configuration [ 664.441868][T15789] tipc: Enabling of bearer rejected, failed to enable media [ 664.734025][T15798] FAULT_INJECTION: forcing a failure. [ 664.734025][T15798] name failslab, interval 1, probability 0, space 0, times 0 [ 664.734083][T15798] CPU: 1 UID: 0 PID: 15798 Comm: syz.2.3009 Tainted: G L syzkaller #0 PREEMPT(full) [ 664.734114][T15798] Tainted: [L]=SOFTLOCKUP [ 664.734123][T15798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 664.734135][T15798] Call Trace: [ 664.734145][T15798] [ 664.734155][T15798] dump_stack_lvl+0xe8/0x150 [ 664.734191][T15798] should_fail_ex+0x410/0x560 [ 664.734229][T15798] should_failslab+0xa8/0x100 [ 664.734256][T15798] __kmalloc_node_noprof+0x100/0x720 [ 664.734285][T15798] ? __get_vm_area_node+0x200/0x2f0 [ 664.734310][T15798] ? __get_vm_area_node+0x283/0x2f0 [ 664.734335][T15798] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 664.734362][T15798] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 664.734400][T15798] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 664.734456][T15798] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 664.734492][T15798] ? bpf_diag_init+0x87/0x140 [ 664.734514][T15798] ? bpf_diag_init+0x87/0x140 [ 664.734540][T15798] ? bpf_check+0x10ee/0x2e10 [ 664.734559][T15798] __vmalloc_noprof+0xd2/0x120 [ 664.734597][T15798] ? bpf_check+0x10ee/0x2e10 [ 664.734620][T15798] bpf_check+0x10ee/0x2e10 [ 664.734649][T15798] ? ktime_get_with_offset+0x93/0x2d0 [ 664.734672][T15798] ? __pfx_bpf_check+0x10/0x10 [ 664.734693][T15798] ? bpf_obj_name_cpy+0x194/0x1e0 [ 664.734722][T15798] bpf_prog_load+0x14d6/0x1c20 [ 664.734755][T15798] ? __pfx_bpf_prog_load+0x10/0x10 [ 664.734800][T15798] __sys_bpf+0xd0d/0xd90 [ 664.734828][T15798] ? __pfx___sys_bpf+0x10/0x10 [ 664.734859][T15798] ? __fget_files+0x2a/0x420 [ 664.734899][T15798] ? ksys_write+0x242/0x270 [ 664.734928][T15798] ? __pfx_ksys_write+0x10/0x10 [ 664.734958][T15798] __x64_sys_bpf+0xba/0xd0 [ 664.734980][T15798] do_syscall_64+0x166/0x520 [ 664.735005][T15798] ? trace_irq_disable+0x3b/0x140 [ 664.735024][T15798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.735043][T15798] ? clear_bhb_loop+0x70/0xc0 [ 664.735067][T15798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.735086][T15798] RIP: 0033:0x7f88bff9e159 [ 664.735106][T15798] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 664.735123][T15798] RSP: 002b:00007f88c0e6f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 664.735145][T15798] RAX: ffffffffffffffda RBX: 00007f88c0225fa0 RCX: 00007f88bff9e159 [ 664.735159][T15798] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 664.735172][T15798] RBP: 00007f88c0e6f090 R08: 0000000000000000 R09: 0000000000000000 [ 664.735185][T15798] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 664.735196][T15798] R13: 00007f88c0226038 R14: 00007f88c0225fa0 R15: 00007f88c034fa48 [ 664.735227][T15798] [ 664.755813][T15798] syz.2.3009: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 664.755907][T15798] CPU: 1 UID: 0 PID: 15798 Comm: syz.2.3009 Tainted: G L syzkaller #0 PREEMPT(full) [ 664.755933][T15798] Tainted: [L]=SOFTLOCKUP [ 664.755941][T15798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 664.755952][T15798] Call Trace: [ 664.755961][T15798] [ 664.755969][T15798] dump_stack_lvl+0xe8/0x150 [ 664.756001][T15798] warn_alloc+0x24d/0x270 [ 664.756035][T15798] ? __pfx_warn_alloc+0x10/0x10 [ 664.756068][T15798] ? __kmalloc_node_noprof+0x4d7/0x720 [ 664.756094][T15798] ? __get_vm_area_node+0x200/0x2f0 [ 664.756117][T15798] ? __get_vm_area_node+0x283/0x2f0 [ 664.756139][T15798] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 664.756162][T15798] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 664.756194][T15798] __vmalloc_node_range_noprof+0x969/0x1540 [ 664.756246][T15798] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 664.756277][T15798] ? bpf_diag_init+0x87/0x140 [ 664.756299][T15798] ? bpf_diag_init+0x87/0x140 [ 664.756322][T15798] ? bpf_check+0x10ee/0x2e10 [ 664.756339][T15798] __vmalloc_noprof+0xd2/0x120 [ 664.756363][T15798] ? bpf_check+0x10ee/0x2e10 [ 664.756385][T15798] bpf_check+0x10ee/0x2e10 [ 664.756415][T15798] ? ktime_get_with_offset+0x93/0x2d0 [ 664.756439][T15798] ? __pfx_bpf_check+0x10/0x10 [ 664.756462][T15798] ? bpf_obj_name_cpy+0x194/0x1e0 [ 664.756490][T15798] bpf_prog_load+0x14d6/0x1c20 [ 664.756523][T15798] ? __pfx_bpf_prog_load+0x10/0x10 [ 664.756568][T15798] __sys_bpf+0xd0d/0xd90 [ 664.756604][T15798] ? __pfx___sys_bpf+0x10/0x10 [ 664.756634][T15798] ? __fget_files+0x2a/0x420 [ 664.756674][T15798] ? ksys_write+0x242/0x270 [ 664.756702][T15798] ? __pfx_ksys_write+0x10/0x10 [ 664.756731][T15798] __x64_sys_bpf+0xba/0xd0 [ 664.756753][T15798] do_syscall_64+0x166/0x520 [ 664.756779][T15798] ? trace_irq_disable+0x3b/0x140 [ 664.756796][T15798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.756815][T15798] ? clear_bhb_loop+0x70/0xc0 [ 664.756838][T15798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.756856][T15798] RIP: 0033:0x7f88bff9e159 [ 664.756876][T15798] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 664.756893][T15798] RSP: 002b:00007f88c0e6f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 664.756913][T15798] RAX: ffffffffffffffda RBX: 00007f88c0225fa0 RCX: 00007f88bff9e159 [ 664.756928][T15798] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 664.756940][T15798] RBP: 00007f88c0e6f090 R08: 0000000000000000 R09: 0000000000000000 [ 664.756953][T15798] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 664.756965][T15798] R13: 00007f88c0226038 R14: 00007f88c0225fa0 R15: 00007f88c034fa48 [ 664.756995][T15798] [ 664.757003][T15798] Mem-Info: [ 664.757012][T15798] active_anon:8121 inactive_anon:71 isolated_anon:0 [ 664.757012][T15798] active_file:3821 inactive_file:54764 isolated_file:0 [ 664.757012][T15798] unevictable:0 dirty:86 writeback:0 [ 664.757012][T15798] slab_reclaimable:10154 slab_unreclaimable:99894 [ 664.757012][T15798] mapped:30876 shmem:2568 pagetables:1944 [ 664.757012][T15798] sec_pagetables:3 bounce:0 [ 664.757012][T15798] kernel_misc_reclaimable:0 [ 664.757012][T15798] free:1276921 free_pcp:9596 free_cma:0 [ 664.757077][T15798] Node 0 active_anon:32484kB inactive_anon:284kB active_file:15280kB inactive_file:218692kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:123336kB dirty:340kB writeback:0kB shmem:10272kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12684kB pagetables:7648kB sec_pagetables:12kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 664.757130][T15798] Node 1 active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:364kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:168kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 664.757176][T15798] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 664.757230][T15798] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 664.757265][T15798] Node 0 DMA32 free:1138868kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:32484kB inactive_anon:284kB active_file:15280kB inactive_file:218692kB unevictable:0kB writepending:340kB zspages:0kB present:3129332kB managed:2546712kB mlocked:0kB bounce:0kB free_pcp:37984kB local_pcp:21792kB free_cma:0kB [ 664.772765][T15798] lowmem_reserve[]: 0 0 0 0 0 [ 664.772813][T15798] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 664.772915][T15798] lowmem_reserve[]: 0 0 0 0 0 [ 664.772951][T15798] Node 1 Normal free:3953456kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:364kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:400kB local_pcp:0kB free_cma:0kB [ 664.773005][T15798] lowmem_reserve[]: 0 0 0 0 0 [ 664.773037][T15798] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (UM) = 15360kB [ 664.773259][T15798] Node 0 DMA32: 1930*4kB (UME) 1901*8kB (UME) 1263*16kB (UME) 1266*32kB (UME) 603*64kB (UME) 329*128kB (UME) 194*256kB (UME) 103*512kB (UME) 58*1024kB (UME) 13*2048kB (UME) 192*4096kB (U) = 1139200kB [ 664.773410][T15798] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 664.773502][T15798] Node 1 Normal: 10*4kB (UM) 9*8kB (UM) 6*16kB (M) 8*32kB (UM) 10*64kB (UM) 11*128kB (UM) 5*256kB (UM) 6*512kB (UM) 4*1024kB (UM) 5*2048kB (UM) 960*4096kB (UM) = 3953360kB [ 664.773657][T15798] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 664.773672][T15798] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 664.773688][T15798] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 664.773704][T15798] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 664.773719][T15798] 61231 total pagecache pages [ 664.773727][T15798] 82 pages in swap cache [ 664.773734][T15798] Free swap = 124668kB [ 664.773743][T15798] Total swap = 124996kB [ 664.773751][T15798] 2097051 pages RAM [ 664.773758][T15798] 0 pages HighMem/MovableOnly [ 664.773765][T15798] 428757 pages reserved [ 664.773772][T15798] 0 pages cma reserved [ 664.948801][ T5618] Bluetooth: hci4: command tx timeout [ 665.058322][T11499] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 665.253559][T11499] usb 2-1: Using ep0 maxpacket: 8 [ 665.282439][T11499] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 665.284082][ T863] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 665.376895][T11499] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 665.433212][ T6267] IPVS: stop unused estimator thread 0... [ 665.443856][ T863] usb 5-1: Using ep0 maxpacket: 8 [ 665.445421][ T863] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 665.450906][ T863] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 665.450935][ T863] usb 5-1: config 179 has no interface number 0 [ 665.450982][ T863] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 665.451007][ T863] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 665.451033][ T863] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 665.451054][ T863] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 665.451080][ T863] usb 5-1: config 179 interface 65 has no altsetting 0 [ 665.451112][ T863] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 665.550476][T11499] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 665.550508][T11499] usb 2-1: Product: syz [ 665.550524][T11499] usb 2-1: Manufacturer: syz [ 665.550539][T11499] usb 2-1: SerialNumber: syz [ 665.759995][T11499] usb 2-1: config 0 descriptor?? [ 665.770534][T11500] usb 5-1: USB disconnect, device number 14 [ 665.815690][T11499] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 665.815786][T11499] usb 2-1: setting power ON [ 665.815840][T11499] dvb-usb: bulk message failed: -22 (2/0) [ 665.870093][T11499] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 665.876387][T11499] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 665.876446][T11499] usb 2-1: media controller created [ 665.938131][T11499] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 666.022410][T15795] dvb-usb: bulk message failed: -22 (3/0) [ 666.022472][T15795] dvb-usb: bulk message failed: -22 (3/0) [ 666.029428][T11499] usb 2-1: selecting invalid altsetting 6 [ 666.029453][T11499] usb 2-1: digital interface selection failed (-22) [ 666.029467][T11499] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 666.031959][T11499] usb 2-1: setting power OFF [ 666.031987][T11499] dvb-usb: bulk message failed: -22 (2/0) [ 666.032001][T11499] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 666.032014][T11499] (NULL device *): no alternate interface [ 666.120117][T15816] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3012'. [ 666.156557][T11499] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 666.167646][T11499] usb 2-1: USB disconnect, device number 71 [ 666.318946][T15693] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 666.337593][T15693] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 666.346505][T15693] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 666.385624][T15693] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 666.459946][T15821] FAULT_INJECTION: forcing a failure. [ 666.459946][T15821] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 666.473758][T15821] CPU: 1 UID: 0 PID: 15821 Comm: syz.4.3013 Tainted: G L syzkaller #0 PREEMPT(full) [ 666.473794][T15821] Tainted: [L]=SOFTLOCKUP [ 666.473802][T15821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 666.473814][T15821] Call Trace: [ 666.473824][T15821] [ 666.473845][T15821] dump_stack_lvl+0xe8/0x150 [ 666.473883][T15821] should_fail_ex+0x410/0x560 [ 666.473920][T15821] _copy_from_iter+0x1d3/0x1660 [ 666.473962][T15821] ? __alloc_skb+0x27a/0x7a0 [ 666.473995][T15821] ? __alloc_skb+0x27a/0x7a0 [ 666.474028][T15821] ? __alloc_skb+0x27a/0x7a0 [ 666.474058][T15821] ? __pfx__copy_from_iter+0x10/0x10 [ 666.474086][T15821] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 666.474116][T15821] ? __alloc_skb+0x27a/0x7a0 [ 666.474143][T15821] ? __alloc_skb+0x27a/0x7a0 [ 666.474178][T15821] ? netlink_sendmsg+0x650/0xb40 [ 666.474202][T15821] ? skb_put+0x112/0x210 [ 666.474225][T15821] netlink_sendmsg+0x6c0/0xb40 [ 666.474259][T15821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 666.474291][T15821] ? apparmor_socket_sendmsg+0x98/0x360 [ 666.474321][T15821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 666.474345][T15821] sock_sendmsg_nosec+0x13a/0x180 [ 666.474375][T15821] ____sys_sendmsg+0x54e/0x850 [ 666.474405][T15821] ? __pfx_____sys_sendmsg+0x10/0x10 [ 666.474436][T15821] ? import_iovec+0x73/0xa0 [ 666.474462][T15821] ___sys_sendmsg+0x2a5/0x360 [ 666.474482][T15821] ? __lock_acquire+0x6df/0x2e50 [ 666.474509][T15821] ? __pfx____sys_sendmsg+0x10/0x10 [ 666.474572][T15821] ? __fget_files+0x2a/0x420 [ 666.474598][T15821] ? __fget_files+0x3a2/0x420 [ 666.474635][T15821] __x64_sys_sendmsg+0x1b1/0x290 [ 666.474660][T15821] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 666.474714][T15821] do_syscall_64+0x166/0x520 [ 666.474742][T15821] ? trace_irq_disable+0x3b/0x140 [ 666.474763][T15821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.474786][T15821] ? clear_bhb_loop+0x70/0xc0 [ 666.474811][T15821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.474833][T15821] RIP: 0033:0x7fc5e1d9e159 [ 666.474854][T15821] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 666.474874][T15821] RSP: 002b:00007fc5e2cb4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 666.474898][T15821] RAX: ffffffffffffffda RBX: 00007fc5e2025fa0 RCX: 00007fc5e1d9e159 [ 666.474914][T15821] RDX: 0000000000008800 RSI: 0000200000000180 RDI: 0000000000000003 [ 666.474928][T15821] RBP: 00007fc5e2cb4090 R08: 0000000000000000 R09: 0000000000000000 [ 666.474950][T15821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 666.474963][T15821] R13: 00007fc5e2026038 R14: 00007fc5e2025fa0 R15: 00007fc5e214fa48 [ 666.474996][T15821] [ 666.492160][T15693] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 666.515793][T15693] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 666.523223][T15693] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 666.573001][T15693] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 667.031235][T15839] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[14435] was attempted by "ci-upstream-kasan-gce/syz-executor exec"[15839] [ 667.052695][T15693] 8021q: adding VLAN 0 to HW filter on device bond0 [ 667.066244][T15846] tipc: Failed to remove unknown binding: 66,0,0/0:3257588676/3257588678 [ 667.066979][T15836] tipc: Failed to remove unknown binding: 66,0,0/0:1066393349/1066393350 [ 667.067005][T15836] tipc: Failed to remove unknown binding: 66,0,0/0:1066393349/1066393350 [ 667.137229][T15693] 8021q: adding VLAN 0 to HW filter on device team0 [ 667.211219][ T6267] bridge0: port 1(bridge_slave_0) entered blocking state [ 667.211390][ T6267] bridge0: port 1(bridge_slave_0) entered forwarding state [ 667.251581][ T5962] bridge0: port 2(bridge_slave_1) entered blocking state [ 667.251711][ T5962] bridge0: port 2(bridge_slave_1) entered forwarding state [ 667.427331][T15856] FAULT_INJECTION: forcing a failure. [ 667.427331][T15856] name failslab, interval 1, probability 0, space 0, times 0 [ 667.427381][T15856] CPU: 0 UID: 0 PID: 15856 Comm: syz.1.3020 Tainted: G L syzkaller #0 PREEMPT(full) [ 667.427423][T15856] Tainted: [L]=SOFTLOCKUP [ 667.427432][T15856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 667.427444][T15856] Call Trace: [ 667.427452][T15856] [ 667.427459][T15856] dump_stack_lvl+0xe8/0x150 [ 667.427491][T15856] should_fail_ex+0x410/0x560 [ 667.427524][T15856] should_failslab+0xa8/0x100 [ 667.427548][T15856] __kmalloc_node_noprof+0x100/0x720 [ 667.427575][T15856] ? __get_vm_area_node+0x200/0x2f0 [ 667.427599][T15856] ? __get_vm_area_node+0x283/0x2f0 [ 667.427620][T15856] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 667.427644][T15856] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 667.427676][T15856] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 667.427728][T15856] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 667.427759][T15856] ? bpf_diag_init+0x87/0x140 [ 667.427780][T15856] ? bpf_diag_init+0x87/0x140 [ 667.427802][T15856] ? bpf_check+0x10ee/0x2e10 [ 667.427820][T15856] __vmalloc_noprof+0xd2/0x120 [ 667.427844][T15856] ? bpf_check+0x10ee/0x2e10 [ 667.427866][T15856] bpf_check+0x10ee/0x2e10 [ 667.427896][T15856] ? ktime_get_with_offset+0x93/0x2d0 [ 667.427920][T15856] ? __pfx_bpf_check+0x10/0x10 [ 667.427943][T15856] ? bpf_obj_name_cpy+0x194/0x1e0 [ 667.427971][T15856] bpf_prog_load+0x14d6/0x1c20 [ 667.428003][T15856] ? __pfx_bpf_prog_load+0x10/0x10 [ 667.428048][T15856] __sys_bpf+0xd0d/0xd90 [ 667.428077][T15856] ? __pfx___sys_bpf+0x10/0x10 [ 667.428108][T15856] ? __fget_files+0x2a/0x420 [ 667.428148][T15856] ? ksys_write+0x242/0x270 [ 667.428176][T15856] ? __pfx_ksys_write+0x10/0x10 [ 667.428206][T15856] __x64_sys_bpf+0xba/0xd0 [ 667.428227][T15856] do_syscall_64+0x166/0x520 [ 667.428254][T15856] ? trace_irq_disable+0x3b/0x140 [ 667.428271][T15856] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.428290][T15856] ? clear_bhb_loop+0x70/0xc0 [ 667.428312][T15856] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.428331][T15856] RIP: 0033:0x7fd63579e159 [ 667.428349][T15856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 667.428366][T15856] RSP: 002b:00007fd636702028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 667.428388][T15856] RAX: ffffffffffffffda RBX: 00007fd635a25fa0 RCX: 00007fd63579e159 [ 667.428403][T15856] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 667.428423][T15856] RBP: 00007fd636702090 R08: 0000000000000000 R09: 0000000000000000 [ 667.428436][T15856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 667.428447][T15856] R13: 00007fd635a26038 R14: 00007fd635a25fa0 R15: 00007fd635b4fa48 [ 667.428478][T15856] [ 668.046375][T15693] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 668.113783][T11499] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 668.146445][T11496] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 668.159359][T15693] veth0_vlan: entered promiscuous mode [ 668.182644][T15693] veth1_vlan: entered promiscuous mode [ 668.272744][T11499] usb 2-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 668.278195][T11499] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 668.278243][T11499] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 668.282168][T11499] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.282197][T11499] usb 2-1: Product: syz [ 668.282212][T11499] usb 2-1: Manufacturer: syz [ 668.282226][T11499] usb 2-1: SerialNumber: syz [ 668.291090][T11499] usb 2-1: config 0 descriptor?? [ 668.293451][T11496] usb 5-1: Using ep0 maxpacket: 8 [ 668.308748][T11496] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 668.351760][T11496] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 668.351797][T11496] usb 5-1: config 179 has no interface number 0 [ 668.351871][T11496] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 668.351898][T11496] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 668.351925][T11496] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 668.351945][T11496] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 668.351971][T11496] usb 5-1: config 179 interface 65 has no altsetting 0 [ 668.352004][T11496] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.385752][T11499] dm9601 2-1:0.0: probe with driver dm9601 failed with error -22 [ 668.587572][T15693] veth0_macvtap: entered promiscuous mode [ 668.692911][T15693] veth1_macvtap: entered promiscuous mode [ 668.736255][T15693] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 668.776973][T15693] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 668.891083][ T1291] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.173761][T15868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 669.174252][T15868] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 669.304054][ T6220] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.340135][ T6267] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.340182][ T6267] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 669.350019][ T5962] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.350183][ T5962] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.551143][ T5962] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.551199][ T5962] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 669.945102][T15882] sctp: [Deprecated]: syz.0.2983 (pid 15882) Use of int in max_burst socket option deprecated. [ 669.945102][T15882] Use struct sctp_assoc_value instead [ 670.123338][T11499] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 670.282282][ T31] audit: type=1326 audit(1788506222.775:4932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15886 comm="syz.3.3027" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f929519e159 code=0x7ffc0000 [ 670.282558][ T31] audit: type=1326 audit(1788506222.775:4933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15886 comm="syz.3.3027" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f929519e159 code=0x7ffc0000 [ 670.307502][T11499] usb 3-1: Using ep0 maxpacket: 32 [ 670.308421][T11499] usb 3-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 670.324313][ T31] audit: type=1326 audit(1788506222.805:4934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15886 comm="syz.3.3027" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f929519e159 code=0x7ffc0000 [ 670.326471][ T31] audit: type=1326 audit(1788506222.805:4935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15886 comm="syz.3.3027" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f929519e159 code=0x7ffc0000 [ 670.336306][T11499] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.338676][ T31] audit: type=1326 audit(1788506222.835:4936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15886 comm="syz.3.3027" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7f929519e159 code=0x7ffc0000 [ 670.338731][ T31] audit: type=1326 audit(1788506222.835:4937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15886 comm="syz.3.3027" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f929519e159 code=0x7ffc0000 [ 670.338782][ T31] audit: type=1326 audit(1788506222.835:4938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15886 comm="syz.3.3027" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f929519e159 code=0x7ffc0000 [ 670.340393][T11499] usb 3-1: config 0 descriptor?? [ 670.341358][ T31] audit: type=1326 audit(1788506222.835:4939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15886 comm="syz.3.3027" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f929519e159 code=0x7ffc0000 [ 670.341403][ T31] audit: type=1326 audit(1788506222.835:4940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15886 comm="syz.3.3027" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f929519e159 code=0x7ffc0000 [ 670.351390][ T31] audit: type=1326 audit(1788506222.835:4941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15886 comm="syz.3.3027" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f929519e159 code=0x7ffc0000 [ 670.354431][T11499] as10x_usb: device has been detected [ 670.355383][T11499] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 670.476698][T11500] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 670.622995][T11499] usb 3-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 670.636131][T11500] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 670.649003][T11500] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 670.649095][T11500] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.675862][T11500] usb 1-1: config 0 descriptor?? [ 670.690777][T11500] pwc: Askey VC010 type 2 USB webcam detected. [ 670.706565][T11499] as10x_usb: error during firmware upload part1 [ 670.713044][T11499] Registered device nBox DVB-T Dongle [ 670.716009][T15878] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 670.728111][T15878] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 670.734708][T15878] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 670.741010][T15878] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 670.747273][T15878] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 670.760968][T15878] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 670.769261][T15878] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 670.776011][T15878] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 670.786119][T15878] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 670.856400][T11499] usb 5-1: USB disconnect, device number 15 [ 670.998243][ T5704] usb 2-1: USB disconnect, device number 72 [ 671.040745][ T5606] usb 3-1: USB disconnect, device number 50 [ 671.126927][ T5606] Unregistered device nBox DVB-T Dongle [ 671.132989][ T5606] as10x_usb: device has been disconnected [ 671.147912][T11500] pwc: recv_control_msg error -32 req 02 val 2b00 [ 671.160214][T11500] pwc: recv_control_msg error -32 req 02 val 2700 [ 671.173407][T11500] pwc: recv_control_msg error -32 req 02 val 2c00 [ 671.226810][T11500] pwc: recv_control_msg error -32 req 04 val 1000 [ 671.237265][T11500] pwc: recv_control_msg error -32 req 04 val 1300 [ 671.244910][T11500] pwc: recv_control_msg error -32 req 04 val 1400 [ 671.252842][T11500] pwc: recv_control_msg error -32 req 02 val 2000 [ 671.261141][T11500] pwc: recv_control_msg error -32 req 02 val 2100 [ 671.269957][T11500] pwc: recv_control_msg error -32 req 04 val 1500 [ 671.277355][T11500] pwc: recv_control_msg error -32 req 02 val 2500 [ 671.524257][ T5704] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 671.703673][ T5704] usb 2-1: unable to get BOS descriptor or descriptor too short [ 671.703751][ T5704] usb 2-1: New USB device found, idVendor=07d1, idProduct=3c0d, bcdDevice=9c.01 [ 671.705657][ T5704] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 671.705694][ T5704] usb 2-1: can't read configurations, error -71 [ 671.712944][T11500] pwc: recv_control_msg error -71 req 02 val 2900 [ 671.717741][T15904] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 671.717768][T15904] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 671.722644][T11500] pwc: recv_control_msg error -71 req 02 val 2800 [ 671.723461][T11500] pwc: recv_control_msg error -71 req 04 val 1100 [ 671.746855][T11500] pwc: recv_control_msg error -71 req 04 val 1200 [ 671.818900][T11500] pwc: Registered as video103. [ 671.840754][T15906] netlink: 160 bytes leftover after parsing attributes in process `syz.3.3033'. [ 671.864503][T11500] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input45 [ 671.884247][T11500] usb 1-1: USB disconnect, device number 120 [ 672.343844][ T5606] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 672.510343][ T5606] usb 4-1: unable to get BOS descriptor or descriptor too short [ 672.510411][ T5606] usb 4-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 672.511693][ T5606] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 672.511715][ T5606] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 672.511769][ T5606] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 672.516693][ T5606] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 672.516720][ T5606] usb 4-1: Product: syz [ 672.516759][ T5606] usb 4-1: Manufacturer: syz [ 672.516773][ T5606] usb 4-1: SerialNumber: syz [ 672.703355][ T5618] Bluetooth: hci1: command 0x0c1a tx timeout [ 672.783882][T12826] Bluetooth: hci0: command 0x0c1a tx timeout [ 672.784152][T12826] Bluetooth: hci5: command 0x0c1a tx timeout [ 672.784184][T12826] Bluetooth: hci3: command 0x0c1a tx timeout [ 672.784307][ T5618] Bluetooth: hci4: command 0x0c1a tx timeout [ 672.784440][ T5704] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 672.951416][ T5704] usb 2-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 672.952977][ T5704] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 672.953024][ T5704] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 672.956369][ T5704] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 672.956395][ T5704] usb 2-1: Product: syz [ 672.956409][ T5704] usb 2-1: Manufacturer: syz [ 672.956450][ T5704] usb 2-1: SerialNumber: syz [ 672.976051][ T5704] usb 2-1: config 0 descriptor?? [ 672.995183][ T5704] dm9601 2-1:0.0: probe with driver dm9601 failed with error -22 [ 673.315403][ T5606] usb 4-1: Can't get UAC3 power state for id 10 [ 673.319513][ T5606] usb 4-1: 2:0: failed to get current value for ch 0 (-71) [ 673.333671][ T5606] usb 4-1: 2:0: cannot get min/max values for control 2 (id 2) [ 673.333722][ T5606] usb 4-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 673.333758][ T5606] usb 4-1: [2] FU [Speaker Playback Volume] ch = 1, val = 0/1/1 [ 673.438097][ T5606] usb 4-1: 2:0: cannot get min/max values for control 2 (id 2) [ 673.468391][ T5606] usb 4-1: 2:0: cannot get min/max values for control 2 (id 2) [ 673.481160][ T5606] usb 4-1: USB disconnect, device number 10 [ 673.505559][T15946] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 673.564699][T14528] udevd[14528]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 673.722872][T15950] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3047'. [ 673.735437][T15951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.745296][T15951] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.820314][T15954] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 673.830030][T15954] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 673.879540][T15956] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3049'. [ 674.029683][T15962] netlink: 112 bytes leftover after parsing attributes in process `syz.4.3052'. [ 674.029888][T15962] netlink: 112 bytes leftover after parsing attributes in process `syz.4.3052'. [ 674.136204][T15966] netlink: 120 bytes leftover after parsing attributes in process `syz.4.3054'. [ 674.136410][T15966] netlink: 120 bytes leftover after parsing attributes in process `syz.4.3054'. [ 674.351165][T15973] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 674.498972][T15979] FAULT_INJECTION: forcing a failure. [ 674.498972][T15979] name failslab, interval 1, probability 0, space 0, times 0 [ 674.499015][T15979] CPU: 0 UID: 0 PID: 15979 Comm: syz.4.3059 Tainted: G L syzkaller #0 PREEMPT(full) [ 674.499045][T15979] Tainted: [L]=SOFTLOCKUP [ 674.499053][T15979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 674.499065][T15979] Call Trace: [ 674.499073][T15979] [ 674.499080][T15979] dump_stack_lvl+0xe8/0x150 [ 674.499112][T15979] should_fail_ex+0x410/0x560 [ 674.499146][T15979] should_failslab+0xa8/0x100 [ 674.499171][T15979] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 674.499201][T15979] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 674.499220][T15979] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 674.499243][T15979] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 674.499264][T15979] krealloc_node_align_noprof+0x19a/0x390 [ 674.499284][T15979] ? bpf_diag_init+0x87/0x140 [ 674.499305][T15979] ? bpf_diag_init+0x87/0x140 [ 674.499328][T15979] kvrealloc_node_align_noprof+0x7b/0xf0 [ 674.499350][T15979] bpf_iarray_realloc+0x34/0xa0 [ 674.499378][T15979] bpf_check+0x13d4/0x2e10 [ 674.499418][T15979] ? ktime_get_with_offset+0x93/0x2d0 [ 674.499441][T15979] ? __pfx_bpf_check+0x10/0x10 [ 674.499464][T15979] ? bpf_obj_name_cpy+0x194/0x1e0 [ 674.499493][T15979] bpf_prog_load+0x14d6/0x1c20 [ 674.499525][T15979] ? __pfx_bpf_prog_load+0x10/0x10 [ 674.499569][T15979] __sys_bpf+0xd0d/0xd90 [ 674.499598][T15979] ? __pfx___sys_bpf+0x10/0x10 [ 674.499629][T15979] ? __fget_files+0x2a/0x420 [ 674.499668][T15979] ? ksys_write+0x242/0x270 [ 674.499696][T15979] ? __pfx_ksys_write+0x10/0x10 [ 674.499725][T15979] __x64_sys_bpf+0xba/0xd0 [ 674.499748][T15979] do_syscall_64+0x166/0x520 [ 674.499773][T15979] ? trace_irq_disable+0x3b/0x140 [ 674.499791][T15979] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.499810][T15979] ? clear_bhb_loop+0x70/0xc0 [ 674.499834][T15979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.499852][T15979] RIP: 0033:0x7fc5e1d9e159 [ 674.499872][T15979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 674.499888][T15979] RSP: 002b:00007fc5e2cb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 674.499914][T15979] RAX: ffffffffffffffda RBX: 00007fc5e2025fa0 RCX: 00007fc5e1d9e159 [ 674.499929][T15979] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 674.499941][T15979] RBP: 00007fc5e2cb4090 R08: 0000000000000000 R09: 0000000000000000 [ 674.499954][T15979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 674.499966][T15979] R13: 00007fc5e2026038 R14: 00007fc5e2025fa0 R15: 00007fc5e214fa48 [ 674.499997][T15979] [ 674.656987][T15981] xt_hashlimit: max too large, truncated to 1048576 [ 674.875390][ T5625] Bluetooth: hci0: command 0x0c1a tx timeout [ 674.882467][ T5618] Bluetooth: hci4: command 0x0c1a tx timeout [ 674.901261][T15987] FAULT_INJECTION: forcing a failure. [ 674.901261][T15987] name failslab, interval 1, probability 0, space 0, times 0 [ 674.901318][T15987] CPU: 0 UID: 0 PID: 15987 Comm: syz.3.3063 Tainted: G L syzkaller #0 PREEMPT(full) [ 674.901347][T15987] Tainted: [L]=SOFTLOCKUP [ 674.901355][T15987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 674.901366][T15987] Call Trace: [ 674.901373][T15987] [ 674.901380][T15987] dump_stack_lvl+0xe8/0x150 [ 674.901413][T15987] should_fail_ex+0x410/0x560 [ 674.901446][T15987] should_failslab+0xa8/0x100 [ 674.901475][T15987] __kmalloc_noprof+0xfe/0x720 [ 674.901505][T15987] ? hash_ipmark_create+0x3a8/0x10c0 [ 674.901620][T15987] ? hash_ipmark_create+0x3a8/0x10c0 [ 674.901650][T15987] hash_ipmark_create+0x3a8/0x10c0 [ 674.901683][T15987] ? __pfx_hash_ipmark_create+0x10/0x10 [ 674.901708][T15987] ip_set_create+0xae8/0x1a50 [ 674.901731][T15987] ? ip_set_create+0x4ef/0x1a50 [ 674.901763][T15987] ? __pfx_ip_set_create+0x10/0x10 [ 674.901817][T15987] nfnetlink_rcv_msg+0xcc2/0x12b0 [ 674.901868][T15987] ? nfnetlink_rcv_msg+0x228/0x12b0 [ 674.901906][T15987] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 674.901971][T15987] netlink_rcv_skb+0x226/0x4a0 [ 674.901995][T15987] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 674.902018][T15987] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 674.902051][T15987] ? bpf_lsm_capable+0x9/0x20 [ 674.902076][T15987] ? security_capable+0x7e/0x2c0 [ 674.902103][T15987] nfnetlink_rcv+0x2b9/0x28c0 [ 674.902126][T15987] ? kernel_text_address+0xa5/0xe0 [ 674.902149][T15987] ? __kernel_text_address+0xd/0x30 [ 674.902168][T15987] ? unwind_get_return_address+0x4d/0x90 [ 674.902191][T15987] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 674.902219][T15987] ? arch_stack_walk+0xfb/0x150 [ 674.902253][T15987] ? stack_trace_save+0xa9/0x100 [ 674.902282][T15987] ? __lock_acquire+0x6df/0x2e50 [ 674.902310][T15987] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 674.902329][T15987] ? __lock_acquire+0x6df/0x2e50 [ 674.902351][T15987] ? kasan_save_track+0x4f/0x80 [ 674.902369][T15987] ? kasan_save_track+0x3e/0x80 [ 674.902386][T15987] ? __kasan_slab_alloc+0x6c/0x80 [ 674.902405][T15987] ? kmem_cache_alloc_node_noprof+0x354/0x610 [ 674.902429][T15987] ? __alloc_skb+0x27a/0x7a0 [ 674.902454][T15987] ? netlink_sendmsg+0x5d4/0xb40 [ 674.902475][T15987] ? sock_sendmsg_nosec+0x13a/0x180 [ 674.902497][T15987] ? ____sys_sendmsg+0x54e/0x850 [ 674.902524][T15987] ? __lock_acquire+0x6df/0x2e50 [ 674.902554][T15987] ? __netlink_lookup+0xc6/0x8b0 [ 674.902587][T15987] ? lock_acquire+0x115/0x350 [ 674.902606][T15987] ? netlink_deliver_tap+0x2e/0x1b0 [ 674.902635][T15987] ? netlink_deliver_tap+0x2e/0x1b0 [ 674.902656][T15987] ? netlink_deliver_tap+0x2e/0x1b0 [ 674.902684][T15987] netlink_unicast+0x7bd/0x940 [ 674.902715][T15987] netlink_sendmsg+0x813/0xb40 [ 674.902746][T15987] ? __pfx_netlink_sendmsg+0x10/0x10 [ 674.902777][T15987] ? apparmor_socket_sendmsg+0x98/0x360 [ 674.902807][T15987] ? __pfx_netlink_sendmsg+0x10/0x10 [ 674.902828][T15987] sock_sendmsg_nosec+0x13a/0x180 [ 674.902855][T15987] ____sys_sendmsg+0x54e/0x850 [ 674.902881][T15987] ? __pfx_____sys_sendmsg+0x10/0x10 [ 674.902910][T15987] ? import_iovec+0x73/0xa0 [ 674.902935][T15987] ___sys_sendmsg+0x2a5/0x360 [ 674.902954][T15987] ? __lock_acquire+0x6df/0x2e50 [ 674.902977][T15987] ? __pfx____sys_sendmsg+0x10/0x10 [ 674.903031][T15987] ? __fget_files+0x2a/0x420 [ 674.903054][T15987] ? __fget_files+0x3a2/0x420 [ 674.903087][T15987] __x64_sys_sendmsg+0x1b1/0x290 [ 674.903111][T15987] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 674.903152][T15987] do_syscall_64+0x166/0x520 [ 674.903178][T15987] ? trace_irq_disable+0x3b/0x140 [ 674.903196][T15987] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.903216][T15987] ? clear_bhb_loop+0x70/0xc0 [ 674.903239][T15987] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.903258][T15987] RIP: 0033:0x7f929519e159 [ 674.903278][T15987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 674.903294][T15987] RSP: 002b:00007f9296116028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 674.903324][T15987] RAX: ffffffffffffffda RBX: 00007f9295425fa0 RCX: 00007f929519e159 [ 674.903338][T15987] RDX: 0000000000008800 RSI: 0000200000000180 RDI: 0000000000000003 [ 674.903350][T15987] RBP: 00007f9296116090 R08: 0000000000000000 R09: 0000000000000000 [ 674.903362][T15987] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 674.903374][T15987] R13: 00007f9295426038 R14: 00007f9295425fa0 R15: 00007f929554fa48 [ 674.903405][T15987] [ 675.388468][T15989] netlink: 'syz.3.3064': attribute type 1 has an invalid length. [ 675.468881][T15989] 8021q: adding VLAN 0 to HW filter on device bond2 [ 675.569927][T15989] bond2: (slave geneve3): making interface the new active one [ 675.593943][T15989] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 675.617631][ T5606] usb 2-1: USB disconnect, device number 74 [ 675.654640][ T84] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.657649][ T5962] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.657692][ T5962] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.657724][ T5962] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.666820][T15998] netlink: 120 bytes leftover after parsing attributes in process `syz.4.3068'. [ 675.667001][T15998] netlink: 120 bytes leftover after parsing attributes in process `syz.4.3068'. [ 675.812675][T16005] FAULT_INJECTION: forcing a failure. [ 675.812675][T16005] name failslab, interval 1, probability 0, space 0, times 0 [ 675.828647][T16005] CPU: 1 UID: 0 PID: 16005 Comm: syz.4.3071 Tainted: G L syzkaller #0 PREEMPT(full) [ 675.828687][T16005] Tainted: [L]=SOFTLOCKUP [ 675.828696][T16005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 675.828708][T16005] Call Trace: [ 675.828718][T16005] [ 675.828728][T16005] dump_stack_lvl+0xe8/0x150 [ 675.828767][T16005] should_fail_ex+0x410/0x560 [ 675.828805][T16005] should_failslab+0xa8/0x100 [ 675.828833][T16005] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 675.828868][T16005] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 675.828889][T16005] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 675.828922][T16005] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 675.828945][T16005] krealloc_node_align_noprof+0x19a/0x390 [ 675.828966][T16005] ? bpf_diag_init+0x87/0x140 [ 675.828987][T16005] ? bpf_diag_init+0x87/0x140 [ 675.829009][T16005] kvrealloc_node_align_noprof+0x7b/0xf0 [ 675.829035][T16005] bpf_iarray_realloc+0x34/0xa0 [ 675.829065][T16005] bpf_check+0x13d4/0x2e10 [ 675.829097][T16005] ? ktime_get_with_offset+0x93/0x2d0 [ 675.829124][T16005] ? __pfx_bpf_check+0x10/0x10 [ 675.829150][T16005] ? bpf_obj_name_cpy+0x194/0x1e0 [ 675.829182][T16005] bpf_prog_load+0x14d6/0x1c20 [ 675.829220][T16005] ? __pfx_bpf_prog_load+0x10/0x10 [ 675.829272][T16005] __sys_bpf+0xd0d/0xd90 [ 675.829304][T16005] ? __pfx___sys_bpf+0x10/0x10 [ 675.829340][T16005] ? __fget_files+0x2a/0x420 [ 675.829386][T16005] ? ksys_write+0x242/0x270 [ 675.829418][T16005] ? __pfx_ksys_write+0x10/0x10 [ 675.829453][T16005] __x64_sys_bpf+0xba/0xd0 [ 675.829478][T16005] do_syscall_64+0x166/0x520 [ 675.829508][T16005] ? trace_irq_disable+0x3b/0x140 [ 675.829528][T16005] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.829549][T16005] ? clear_bhb_loop+0x70/0xc0 [ 675.829576][T16005] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.829596][T16005] RIP: 0033:0x7fc5e1d9e159 [ 675.829617][T16005] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 675.829635][T16005] RSP: 002b:00007fc5e2cb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 675.829660][T16005] RAX: ffffffffffffffda RBX: 00007fc5e2025fa0 RCX: 00007fc5e1d9e159 [ 675.829676][T16005] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 675.829689][T16005] RBP: 00007fc5e2cb4090 R08: 0000000000000000 R09: 0000000000000000 [ 675.829703][T16005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 675.829716][T16005] R13: 00007fc5e2026038 R14: 00007fc5e2025fa0 R15: 00007fc5e214fa48 [ 675.829751][T16005] [ 675.934251][T11500] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 676.118705][T11500] usb 3-1: unable to get BOS descriptor or descriptor too short [ 676.118782][T11500] usb 3-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 676.121068][T11500] usb 3-1: config index 0 descriptor too short (expected 63876, got 142) [ 676.121096][T11500] usb 3-1: config 73 has an invalid descriptor of length 0, skipping remainder of the config [ 676.121116][T11500] usb 3-1: config 73 has 1 interface, different from the descriptor's value: 6 [ 676.121147][T11500] usb 3-1: config 73 interface 0 has no altsetting 0 [ 676.126946][T11500] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 676.126973][T11500] usb 3-1: Product: syz [ 676.126988][T11500] usb 3-1: Manufacturer: syz [ 676.127001][T11500] usb 3-1: SerialNumber: syz [ 676.177424][T11500] usb 3-1: selecting invalid altsetting 1 [ 676.189951][T11500] usb 3-1: unit 6 not found! [ 676.189979][T11500] usb 3-1: unit 0 not found! [ 676.320804][T11500] snd-usb-audio 3-1:73.0: probe with driver snd-usb-audio failed with error -22 [ 676.367812][T11500] usb 3-1: USB disconnect, device number 51 [ 676.391165][T11158] udevd[11158]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:73.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 676.423576][T11499] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 676.589485][T11499] usb 4-1: device descriptor read/64, error -71 [ 676.843300][T11499] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 676.944905][ T5618] Bluetooth: hci4: command 0x0c1a tx timeout [ 676.945276][ T5618] Bluetooth: hci0: command 0x0c1a tx timeout [ 676.983927][T11499] usb 4-1: device descriptor read/64, error -71 [ 677.105325][T11499] usb usb4-port1: attempt power cycle [ 677.123276][T11500] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 677.274177][T11500] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 677.275539][T11500] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 677.275570][T11500] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 677.275594][T11500] usb 1-1: config 1 interface 0 has no altsetting 0 [ 677.277589][T11500] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.277612][T11500] usb 1-1: Product: syz [ 677.277627][T11500] usb 1-1: Manufacturer: syz [ 677.277640][T11500] usb 1-1: SerialNumber: syz [ 677.297908][T16025] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 677.298048][T16025] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 677.362981][T11496] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 677.378396][T16037] netlink: 120 bytes leftover after parsing attributes in process `syz.1.3082'. [ 677.388692][T16037] netlink: 120 bytes leftover after parsing attributes in process `syz.1.3082'. [ 677.443285][T11499] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 677.472768][T11499] usb 4-1: device descriptor read/8, error -71 [ 677.514427][T11496] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 677.516736][T11496] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 677.516786][T11496] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 677.522586][T11496] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.522614][T11496] usb 3-1: Product: syz [ 677.522628][T11496] usb 3-1: Manufacturer: syz [ 677.522642][T11496] usb 3-1: SerialNumber: syz [ 677.536312][T11496] usb 3-1: config 0 descriptor?? [ 677.547645][T11496] dm9601 3-1:0.0: probe with driver dm9601 failed with error -22 [ 677.703247][T11499] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 677.724181][T11499] usb 4-1: device descriptor read/8, error -71 [ 677.830896][T16043] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3077'. [ 677.835001][T11499] usb usb4-port1: unable to enumerate USB device [ 677.984656][T11500] (unnamed net_device) (uninitialized): Assigned a random MAC address: d6:b8:c9:e9:99:cc [ 678.021852][T11500] rtl8150 1-1:1.0: eth1: rtl8150 is detected [ 678.232695][T16052] FAULT_INJECTION: forcing a failure. [ 678.232695][T16052] name failslab, interval 1, probability 0, space 0, times 0 [ 678.232771][T16052] CPU: 0 UID: 0 PID: 16052 Comm: syz.4.3085 Tainted: G L syzkaller #0 PREEMPT(full) [ 678.232802][T16052] Tainted: [L]=SOFTLOCKUP [ 678.232811][T16052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 678.232823][T16052] Call Trace: [ 678.232833][T16052] [ 678.232843][T16052] dump_stack_lvl+0xe8/0x150 [ 678.232881][T16052] should_fail_ex+0x410/0x560 [ 678.232919][T16052] should_failslab+0xa8/0x100 [ 678.232948][T16052] __kvmalloc_node_noprof+0x176/0x820 [ 678.232973][T16052] ? bpf_diag_init+0x87/0x140 [ 678.233000][T16052] ? bpf_check+0x15a9/0x2e10 [ 678.233021][T16052] ? bpf_check+0x15a9/0x2e10 [ 678.233054][T16052] bpf_check+0x15a9/0x2e10 [ 678.233088][T16052] ? ktime_get_with_offset+0x93/0x2d0 [ 678.233117][T16052] ? __pfx_bpf_check+0x10/0x10 [ 678.233144][T16052] ? bpf_obj_name_cpy+0x194/0x1e0 [ 678.233178][T16052] bpf_prog_load+0x14d6/0x1c20 [ 678.233216][T16052] ? __pfx_bpf_prog_load+0x10/0x10 [ 678.233341][T16052] __sys_bpf+0xd0d/0xd90 [ 678.233389][T16052] ? __pfx___sys_bpf+0x10/0x10 [ 678.233425][T16052] ? __fget_files+0x2a/0x420 [ 678.233472][T16052] ? ksys_write+0x242/0x270 [ 678.233506][T16052] ? __pfx_ksys_write+0x10/0x10 [ 678.233542][T16052] __x64_sys_bpf+0xba/0xd0 [ 678.233567][T16052] do_syscall_64+0x166/0x520 [ 678.233597][T16052] ? trace_irq_disable+0x3b/0x140 [ 678.233619][T16052] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.233641][T16052] ? clear_bhb_loop+0x70/0xc0 [ 678.233668][T16052] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.233690][T16052] RIP: 0033:0x7fc5e1d9e159 [ 678.233712][T16052] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 678.233732][T16052] RSP: 002b:00007fc5e2cb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 678.233756][T16052] RAX: ffffffffffffffda RBX: 00007fc5e2025fa0 RCX: 00007fc5e1d9e159 [ 678.233773][T16052] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 678.233788][T16052] RBP: 00007fc5e2cb4090 R08: 0000000000000000 R09: 0000000000000000 [ 678.233804][T16052] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 678.233817][T16052] R13: 00007fc5e2026038 R14: 00007fc5e2025fa0 R15: 00007fc5e214fa48 [ 678.233854][T16052] [ 678.419672][T16054] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 678.420104][T16054] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 678.441208][T16056] usb 1-1: USB disconnect, device number 121 [ 678.951704][T11496] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 679.106020][T11496] usb 2-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 679.107506][T11496] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 679.107538][T11496] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 679.107574][T11496] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 679.371607][T16061] hub 1-0:1.0: USB hub found [ 679.394684][T16061] hub 1-0:1.0: 1 port detected [ 679.551178][T11496] hid_parser_main: 28 callbacks suppressed [ 679.551520][T11496] hid-picolcd 0003:04D8:C002.001C: unknown main item tag 0x2 [ 679.551561][T11496] hid-picolcd 0003:04D8:C002.001C: unknown main item tag 0x0 [ 679.551695][T11496] hid-picolcd 0003:04D8:C002.001C: unknown main item tag 0x0 [ 679.551948][T11496] hid-picolcd 0003:04D8:C002.001C: unknown main item tag 0x0 [ 679.551973][T11496] hid-picolcd 0003:04D8:C002.001C: unknown main item tag 0x0 [ 679.551997][T11496] hid-picolcd 0003:04D8:C002.001C: unknown main item tag 0x0 [ 679.552021][T11496] hid-picolcd 0003:04D8:C002.001C: unknown main item tag 0x0 [ 679.552045][T11496] hid-picolcd 0003:04D8:C002.001C: unknown main item tag 0x0 [ 679.552069][T11496] hid-picolcd 0003:04D8:C002.001C: unknown main item tag 0x0 [ 679.552093][T11496] hid-picolcd 0003:04D8:C002.001C: unknown main item tag 0x0 [ 679.557277][ T5606] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 679.619719][T11496] hid-picolcd 0003:04D8:C002.001C: unsupported KEY_STATE report [ 679.626162][T11496] hid-picolcd 0003:04D8:C002.001C: probe with driver hid-picolcd failed with error -22 [ 679.700326][T16081] ================================================================== [ 679.700347][T16081] BUG: KASAN: slab-out-of-bounds in try_module_get+0x46/0xc0 [ 679.700387][T16081] Write of size 4 at addr ffff88802bd4a900 by task syz.3.3089/16081 [ 679.700406][T16081] [ 679.700421][T16081] CPU: 0 UID: 0 PID: 16081 Comm: syz.3.3089 Tainted: G L syzkaller #0 PREEMPT(full) [ 679.700450][T16081] Tainted: [L]=SOFTLOCKUP [ 679.700459][T16081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 679.700473][T16081] Call Trace: [ 679.700482][T16081] [ 679.700494][T16081] dump_stack_lvl+0xe8/0x150 [ 679.700526][T16081] print_address_description+0x55/0x1e0 [ 679.700577][T16081] ? try_module_get+0x46/0xc0 [ 679.700611][T16081] print_report+0x58/0x70 [ 679.700636][T16081] kasan_report+0x117/0x150 [ 679.700664][T16081] ? try_module_get+0x46/0xc0 [ 679.700697][T16081] kasan_check_range+0x264/0x2c0 [ 679.700723][T16081] try_module_get+0x46/0xc0 [ 679.700751][T16081] dvb_device_open+0xef/0x340 [ 679.700874][T16081] ? do_raw_spin_unlock+0xf5/0x200 [ 679.700905][T16081] chrdev_open+0x4d9/0x600 [ 679.700952][T16081] ? __pfx_chrdev_open+0x10/0x10 [ 679.700975][T16081] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 679.701009][T16081] ? __pfx_chrdev_open+0x10/0x10 [ 679.701028][T16081] do_dentry_open+0x816/0x1380 [ 679.701059][T16081] vfs_open+0x3b/0x340 [ 679.701081][T16081] ? path_openat+0x1428/0x1d60 [ 679.701114][T16081] path_openat+0x1443/0x1d60 [ 679.701154][T16081] do_file_open+0x23e/0x4a0 [ 679.701188][T16081] ? __pfx_do_file_open+0x10/0x10 [ 679.701228][T16081] ? _raw_spin_unlock+0x28/0x50 [ 679.701262][T16081] ? alloc_fd+0x651/0x6c0 [ 679.701292][T16081] do_sys_openat2+0x115/0x200 [ 679.701318][T16081] ? __pfx_do_sys_openat2+0x10/0x10 [ 679.701343][T16081] ? exc_page_fault+0x6a/0xc0 [ 679.701374][T16081] ? do_user_addr_fault+0xc4c/0x1340 [ 679.701397][T16081] __x64_sys_openat+0x138/0x170 [ 679.701424][T16081] do_syscall_64+0x166/0x520 [ 679.701453][T16081] ? trace_irq_disable+0x3b/0x140 [ 679.701473][T16081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 679.701495][T16081] ? clear_bhb_loop+0x70/0xc0 [ 679.701519][T16081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 679.701538][T16081] RIP: 0033:0x7f929515e98e [ 679.701557][T16081] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 679.701577][T16081] RSP: 002b:00007f9296115b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 679.701602][T16081] RAX: ffffffffffffffda RBX: 00007f92961166c0 RCX: 00007f929515e98e [ 679.701618][T16081] RDX: 0000000000000002 RSI: 00007f9296115c00 RDI: ffffffffffffff9c [ 679.701634][T16081] RBP: 00007f9296115c00 R08: 0000000000000000 R09: 0000000000000000 [ 679.701648][T16081] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 679.701663][T16081] R13: 00007f9295426038 R14: 00007f9295425fa0 R15: 00007f929554fa48 [ 679.701688][T16081] [ 679.701696][T16081] [ 679.701702][T16081] Allocated by task 1: [ 679.701713][T16081] kasan_save_track+0x3e/0x80 [ 679.701734][T16081] __kasan_kmalloc+0x93/0xb0 [ 679.701754][T16081] __kmalloc_cache_noprof+0x321/0x600 [ 679.701783][T16081] bus_add_driver+0x162/0x670 [ 679.701851][T16081] driver_register+0x23a/0x320 [ 679.701892][T16081] vidtv_bridge_init+0x3d/0x60 [ 679.702011][T16081] do_one_initcall+0x250/0x870 [ 679.702039][T16081] do_initcall_level+0x10a/0x1a0 [ 679.702104][T16081] do_initcalls+0x59/0xa0 [ 679.702126][T16081] kernel_init_freeable+0x29d/0x3e0 [ 679.702149][T16081] kernel_init+0x22/0x1d0 [ 679.702168][T16081] ret_from_fork+0x514/0xb70 [ 679.702185][T16081] ret_from_fork_asm+0x1a/0x30 [ 679.702214][T16081] [ 679.702220][T16081] The buggy address belongs to the object at ffff88802bd4a800 [ 679.702220][T16081] which belongs to the cache kmalloc-256 of size 256 [ 679.702248][T16081] The buggy address is located 48 bytes to the right of [ 679.702248][T16081] allocated 208-byte region [ffff88802bd4a800, ffff88802bd4a8d0) [ 679.702272][T16081] [ 679.702278][T16081] The buggy address belongs to the physical page: [ 679.702316][T16081] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bd4a [ 679.702337][T16081] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 679.702356][T16081] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 679.702377][T16081] page_type: f5(slab) [ 679.702397][T16081] raw: 00fff00000000040 ffff88801b041b40 dead000000000100 dead000000000122 [ 679.702415][T16081] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 679.702436][T16081] head: 00fff00000000040 ffff88801b041b40 dead000000000100 dead000000000122 [ 679.702455][T16081] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 679.702475][T16081] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 679.702494][T16081] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 679.702506][T16081] page dumped because: kasan: bad access detected [ 679.702519][T16081] page_owner tracks the page as allocated [ 679.702528][T16081] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 15922861040 [ 679.702563][T16081] post_alloc_hook+0x1f9/0x250 [ 679.702592][T16081] get_page_from_freelist+0x2209/0x2280 [ 679.702613][T16081] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 679.702634][T16081] allocate_slab+0x7d/0x620 [ 679.702658][T16081] refill_objects+0x2d5/0x350 [ 679.702680][T16081] __pcs_replace_empty_main+0x2c8/0x6c0 [ 679.702703][T16081] __kmalloc_cache_noprof+0x39b/0x600 [ 679.702732][T16081] bus_add_driver+0x162/0x670 [ 679.702763][T16081] driver_register+0x23a/0x320 [ 679.702783][T16081] usb_register_driver+0x1e4/0x390 [ 679.702836][T16081] uvc_init+0x22/0x40 [ 679.702861][T16081] do_one_initcall+0x250/0x870 [ 679.702888][T16081] do_initcall_level+0x10a/0x1a0 [ 679.702911][T16081] do_initcalls+0x59/0xa0 [ 679.702932][T16081] kernel_init_freeable+0x29d/0x3e0 [ 679.702956][T16081] kernel_init+0x22/0x1d0 [ 679.702975][T16081] page_owner free stack trace missing [ 679.702984][T16081] [ 679.702990][T16081] Memory state around the buggy address: [ 679.703023][T16081] ffff88802bd4a800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 679.703038][T16081] ffff88802bd4a880: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 679.703050][T16081] >ffff88802bd4a900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 679.703060][T16081] ^ [ 679.703071][T16081] ffff88802bd4a980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 679.703084][T16081] ffff88802bd4aa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 679.703095][T16081] ================================================================== [ 679.728656][T16081] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 680.392226][T16081] CPU: 0 UID: 0 PID: 16081 Comm: syz.3.3089 Tainted: G L syzkaller #0 PREEMPT(full) [ 680.403281][T16081] Tainted: [L]=SOFTLOCKUP [ 680.407623][T16081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 680.418206][T16081] Call Trace: [ 680.421658][T16081] [ 680.424615][T16081] vpanic+0x56d/0xa60 [ 680.428625][T16081] ? __pfx_vpanic+0x10/0x10 [ 680.433146][T16081] panic+0xc5/0xd0 [ 680.436964][T16081] ? __pfx_panic+0x10/0x10 [ 680.441390][T16081] ? preempt_schedule_thunk+0x16/0x40 [ 680.446791][T16081] ? preempt_schedule_thunk+0x16/0x40 [ 680.452177][T16081] ? try_module_get+0x46/0xc0 [ 680.456866][T16081] check_panic_on_warn+0x89/0xb0 [ 680.461808][T16081] ? try_module_get+0x46/0xc0 [ 680.466500][T16081] end_report+0x73/0x170 [ 680.470753][T16081] ? try_module_get+0x46/0xc0 [ 680.475448][T16081] kasan_report+0x128/0x150 [ 680.480002][T16081] ? try_module_get+0x46/0xc0 [ 680.484723][T16081] kasan_check_range+0x264/0x2c0 [ 680.489722][T16081] try_module_get+0x46/0xc0 [ 680.494262][T16081] dvb_device_open+0xef/0x340 [ 680.498950][T16081] ? do_raw_spin_unlock+0xf5/0x200 [ 680.504160][T16081] chrdev_open+0x4d9/0x600 [ 680.508594][T16081] ? __pfx_chrdev_open+0x10/0x10 [ 680.513544][T16081] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 680.519881][T16081] ? __pfx_chrdev_open+0x10/0x10 [ 680.525013][T16081] do_dentry_open+0x816/0x1380 [ 680.529818][T16081] vfs_open+0x3b/0x340 [ 680.533944][T16081] ? path_openat+0x1428/0x1d60 [ 680.538764][T16081] path_openat+0x1443/0x1d60 [ 680.543380][T16081] do_file_open+0x23e/0x4a0 [ 680.547926][T16081] ? __pfx_do_file_open+0x10/0x10 [ 680.552991][T16081] ? _raw_spin_unlock+0x28/0x50 [ 680.557876][T16081] ? alloc_fd+0x651/0x6c0 [ 680.562220][T16081] do_sys_openat2+0x115/0x200 [ 680.566909][T16081] ? __pfx_do_sys_openat2+0x10/0x10 [ 680.572148][T16081] ? exc_page_fault+0x6a/0xc0 [ 680.576839][T16081] ? do_user_addr_fault+0xc4c/0x1340 [ 680.582155][T16081] __x64_sys_openat+0x138/0x170 [ 680.587234][T16081] do_syscall_64+0x166/0x520 [ 680.591866][T16081] ? trace_irq_disable+0x3b/0x140 [ 680.596904][T16081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 680.602982][T16081] ? clear_bhb_loop+0x70/0xc0 [ 680.607668][T16081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 680.613570][T16081] RIP: 0033:0x7f929515e98e [ 680.618094][T16081] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 680.637887][T16081] RSP: 002b:00007f9296115b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 680.646317][T16081] RAX: ffffffffffffffda RBX: 00007f92961166c0 RCX: 00007f929515e98e [ 680.654329][T16081] RDX: 0000000000000002 RSI: 00007f9296115c00 RDI: ffffffffffffff9c [ 680.662315][T16081] RBP: 00007f9296115c00 R08: 0000000000000000 R09: 0000000000000000 [ 680.670325][T16081] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 680.678396][T16081] R13: 00007f9295426038 R14: 00007f9295425fa0 R15: 00007f929554fa48 [ 680.686478][T16081] [ 680.689746][T16081] Kernel Offset: disabled [ 680.694067][T16081] Rebooting in 86400 seconds..