last executing test programs: 5.742131254s ago: executing program 1 (id=2754): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000031c0)={0x14, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}}, 0x14}}, 0x0) 5.680280893s ago: executing program 1 (id=2756): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000000), 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000600)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3b0800452000280265000000069078ac1414bbac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="acf78d17faa36adcff84a75d79cd2b4dacc49c644793e290c3de698aa08ab5b5e9a2106c3e06ca8d14bc01aeea580f2e17172ec0c2887cdceee91dad3ffeb1d73c131faa5ee1fa6150edc83468b59b13d39eecc012bcc57b794426d45d05a5604ed3e21e10fe490e57203dc765bfba4761b64b81aa0cafa79b8c51030bbd4bd4048a64f9f43f7fc7cc1f0092ba9a10e5c99d6b5a00"/162], 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) r6 = socket(0x10, 0x803, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000840)={{{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@dev}}, &(0x7f00000002c0)=0xfffffffffffffed8) quotactl_fd$Q_QUOTAOFF(r0, 0xffffffff80000302, r9, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newtfilter={0xb0, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x7c, 0x2, [@TCA_U32_ACT={0x54, 0x7, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xf, 0x3}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0x9, 0x20000000, 0x1, 0xd6}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}, @TCA_U32_SEL={0x24, 0x5, {0x8, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x2, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x1}, 0x24040084) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x5a}}}, &(0x7f0000000480)) r10 = io_uring_setup(0x4126, &(0x7f00000007c0)={0x0, 0x0, 0x800, 0x0, 0x1000000}) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r11 = socket$kcm(0xa, 0x2, 0x0) r12 = socket(0x2, 0x80805, 0x0) r13 = socket$inet_sctp(0x2, 0x5, 0x84) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r14, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r14, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000060a0b0400000000e24c32c4020000002400048020000180070001006374000014000280080002230000000f08000140000000140900010073797a300000000000020073797a32005e00010000000000000000000000000a00445fca1a60af26469439c635039eb428a170a08f3d97450280ea6fc116249eec498d7b4456e01075b2b384e13d92cfa9a34a6c0772368c0e38eb653776a394b7f893f6e56404cce6ad269e7ea8b61dd67da9d04e12a5acec0f98b77611579a39a7d725a7a85044bb3f175c708c048c6f44b8c231c1053216558fc7d7a3ae0cc13b7a389f196df6d5dae9e205d772d34d8220086d80575e72dd50e329cb4c25128af8fb749423e59232ea4cab96069c26e5a96b341d89b300000000000000e102e1b9c7fbba09e928ac1316b688068c4547ce"], 0x78}}, 0x0) setsockopt$IP_VS_SO_SET_ADD(r13, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x640100ff, 0x4e20, 0x3, 'lblc\x00', 0x20, 0xa7e, 0x400070}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r12, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e22, 0x3, 'lblcr\x00', 0x5, 0x8000, 0x100077}, {@remote, 0x4e20, 0x3, 0xcd}}, 0x44) sendmsg$sock(r11, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) io_uring_register$IORING_REGISTER_RING_FDS(r10, 0x13, &(0x7f0000001bc0), 0x2) syz_usb_connect$uac1(0x3, 0x82, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x3f19, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x70, 0x3, 0x1, 0x9, 0x10, 0x8, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x0, 0xf8, 0xa0, 0x2, 0x1}, @as_header={0x7, 0x24, 0x1, 0x9, 0x7, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x5, 0xf7, 0xd, {0x7, 0x25, 0x1, 0xc, 0x5, 0x40}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x5, 0x9, 0x4, {0x7, 0x25, 0x1, 0xc, 0x6, 0x4}}}}}}}}]}}, 0x0) 4.487385285s ago: executing program 0 (id=2771): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000010c0)=ANY=[@ANYBLOB="3401000010000100000000000200000000000000", @ANYRES32=r1, @ANYBLOB="000000000000000014011a80400002803c000180080021000000000008001800000000000800030000000000080009000000000008000c0064000000080012000000000008001f"], 0x134}}, 0x0) 4.436202898s ago: executing program 2 (id=2772): r0 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000040)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-sse2\x00'}, 0x80, 0x0, 0xfffffffffffffeb1, &(0x7f0000001580)=ANY=[@ANYBLOB="120000000000000029"], 0x108}}], 0x1, 0x2000c040) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, 0x0, 0x0) syz_io_uring_setup(0x239, 0x0, &(0x7f0000000180), 0x0, &(0x7f0000000000)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_type(r3, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r4, &(0x7f0000000280), 0x9) r5 = openat$cgroup_procs(r3, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000c40), 0x12) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) r8 = openat$cgroup_ro(r6, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r9, 0x5) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r11 = openat$cgroup_procs(r10, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r11, &(0x7f0000000080)=r7, 0x12) 4.393815062s ago: executing program 0 (id=2774): syz_emit_ethernet(0xfdef, &(0x7f00000003c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "000000050000001126000400"}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x18, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x2000000000000040, "f5000000000000000000000200000000000000000000000000008879e66485201a0015ca837400"/55}, {0x0, 0x14, "5e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c"}, {0x3, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) 4.321589497s ago: executing program 0 (id=2775): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt(r0, 0xff, 0x24, &(0x7f0000002d80)="f0c46000", 0x4) syz_emit_ethernet(0xd5, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaa110e78bef8478100000086dd60c6dd00009b3aff00000000020000000000ffffac141427ff020000000000000000000000000001"], 0x0) 4.196368002s ago: executing program 0 (id=2776): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x8) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r3, 0x29, 0x3b, &(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000400"], 0x8) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e26, 0x8, @mcast2, 0xa}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20115}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_RESEND_IGMP={0x8, 0xf, 0xb3e}]}}}]}, 0x3c}}, 0x0) setsockopt$SO_BINDTODEVICE_wg(r3, 0x1, 0x19, &(0x7f0000000000)='wg0\x00', 0x4) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_SET(r5, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="8c010000", @ANYRES16=r6, @ANYBLOB="000125bd7000fbdbdf2511000000e80001802c0004001400010002004e21ac1e000100000000000000001400020002004e20ac1414bb00000000000000003c0002800800030005000000080001001200000008000200050000000800020002000000080001001000000008000200068008000100160000000d0001007564703a73797a300000000044000400200001000a004e21000000072001000000000000000000000000000155ea0000200002000a004e200000000500000000000000000000ffff00000000050000001c0002800800040000000000080004000600000008000300f8ffffff640004800c000780080001001e0000001300010062726f6164636173742d6c696e6b00000c000700100000001300010062726f6164636173742d6c696e6b00000900010073797a31000000001300010062726f6164636173742d6c696e6b00002c0003800800010009000000080003000d0000000800030007000000080001005400000008000200399b00009349e60447378467eed98aa5788fdfd5159a256c27fc2e929c30cec32db1cbbc35c3b5f7285329585bc98754b2d4b82232ef023e9c7ef798677445eddcba0ed038831d0ced289714ab747676f000"/463], 0x18c}, 0x1, 0x0, 0x0, 0x14000}, 0x10) r7 = socket(0x1, 0x803, 0x0) sendmsg$SMC_PNETID_FLUSH(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x12f8221d412b462e}, 0x4048801) syz_usb_connect(0x3, 0x62, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050201020724070500000508240805040004960d240601e20302000100060006092403050503060581092403060103040505072404"], 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x24}, 0x1, 0x8000000, 0x0, 0x400c880}, 0x4000084) 4.166217863s ago: executing program 3 (id=2777): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, 0x0}) ioctl$KVM_RUN(r0, 0xae80, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) accept4(r2, 0x0, 0x0, 0x80000) sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, 0x0, 0x8000) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fc010000190001000000000000000000fc020000000000000000000000000000000000000000000000000000000000004e21000300000000020000202f000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="01000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000500000000000000000000000000000044010500fc02000000000000000000000000000100000000320000000000000064010101000000000000000000000000023500000001000000000000000000000000000000000000000000000000000000000001000000003c00000002000000ac1414bb0000000000000000000000000000000001030000000000000700000002000000ac1414bb000000000000000000000000000000002b0000000200000020010000000000000000000000000000000000000000000000000000030000009e0f000000000000000000000000000000000020000000003c00000002000000ff020000000000000000000000000001ffffffff01010000000000000000000000000000200100"/386], 0x1fc}}, 0x0) r3 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) listen(r1, 0xa) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'syztnl1\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x0, 0x0, 0xf9, 0x1, 0x50, @loopback, @loopback={0x0, 0xffff888101827518}, 0x80f, 0x20, 0x1, 0xfffffff8}}) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r4, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000140)=@ethtool_sset_info={0x2e, 0x9, 0x10000}}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9}) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f00000000c0)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)}) r6 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0xfffffffd, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr\x00') getdents(r10, &(0x7f0000000080)=""/60, 0x3c) getdents(r10, 0xffffffffffffffff, 0x5a) syz_io_uring_submit(r7, r8, r9, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r11, 0x6, 0xd, &(0x7f0000000380)='htcp', 0x4) io_uring_enter(r6, 0x2000, 0xfffffffd, 0x48, 0x0, 0x0) 4.011173085s ago: executing program 3 (id=2778): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000031c0)={0x14, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}}, 0x14}}, 0x0) 3.892363303s ago: executing program 4 (id=2779): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xf1, @empty, 0x19f49a9}], 0x1c) listen(r0, 0x100) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) (fail_nth: 52) close(0x3) 3.747301416s ago: executing program 3 (id=2780): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)={0x48, r2, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macvtap0\x00'}]}, 0x48}, 0x1, 0xcaffffffffffffff}, 0x20000034) 3.133455538s ago: executing program 2 (id=2781): timer_gettime(0x0, &(0x7f00000001c0)) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newspdinfo={0x1c, 0x24, 0x21, 0x0, 0x0, 0x0, [@XFRMA_SPD_IPV6_HTHRESH={0x6}]}, 0x1c}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="b80000001900674c00ff80000000000000000000000000000000000000000000e000000200000000000000000000000000000000000000000a"], 0xb8}}, 0x0) 2.988720347s ago: executing program 4 (id=2782): socket$kcm(0x29, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800, 0x8, 0x0, 0x3}, 0x0, &(0x7f0000000240)={0x1f, 0x3, 0x8, 0x0, 0x1000000}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 2.839739952s ago: executing program 2 (id=2783): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000004000000000000000000a26000000000a01040000000000000000050000000900010073797a3000000000080002400000000154000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000028000480080002400000001208000140000000001400030077"], 0xa4}, 0x1, 0x0, 0x0, 0x4c841}, 0x802) 2.605280165s ago: executing program 4 (id=2784): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x3, @mcast1, 0x2}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff810000400e227f000001925aa80020007b00090080007f000006e809000000ff0000f03ac71002000000ffffffffffffffffffe7ee00050000000000000200000005", 0x58}], 0x1) 2.599313272s ago: executing program 2 (id=2785): syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x88003) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) socket$igmp6(0xa, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000180)={0x1}) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000040)={0xf0f022}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r2}, 0xffffffffffffffb5) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x815) r4 = io_uring_setup(0x7, &(0x7f0000000100)={0x0, 0xcc5f, 0x2, 0x0, 0xc9}) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES64=0x0, @ANYRES64=r0], 0x50) io_uring_enter(r4, 0x2219, 0x7721, 0x33, 0x0, 0x0) r5 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) ioctl$VIDIOC_S_SELECTION(r5, 0xc040565f, &(0x7f0000000940)={0xa, 0x100, 0x3, {0x8000, 0x1000, 0x4, 0x2}}) socket$inet6(0xa, 0x3, 0x4) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) fsopen(&(0x7f0000000000)='cifs\x00', 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc01, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 2.527825842s ago: executing program 1 (id=2786): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) sendmmsg$unix(r1, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x9802}}, {{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x299, 0x0) (fail_nth: 57) 2.384887687s ago: executing program 3 (id=2787): r0 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x0, 0x0}, 0x10) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f00000000c0)=0x3, 0x4) syz_emit_ethernet(0x48, &(0x7f0000000640)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaaaa86dd6001070000121100fc010200000000000000000000000000ff02000000000000000000000000000100000e2200129078172c046f6aef8d2f4fa4"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x4, 0xe, &(0x7f0000000b80)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8e0400000000000000c61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b36db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece010000000100000010223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff814f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffff854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e92604e1026e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c36981edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ce852364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b00000000000000a5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) write$tun(r2, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd0000110005000000a60c6b63851e0f9829"], 0xfce) 2.159441853s ago: executing program 1 (id=2788): fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) syz_open_dev$vcsa(&(0x7f0000000380), 0x7b95b611, 0x802) select(0x40, &(0x7f0000000580)={0xf, 0x6, 0x6, 0x8, 0x3ff, 0x1, 0xfff, 0xac}, 0x0, 0x0, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCFLSH(r2, 0x5608, 0x0) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r3 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r5 = socket$l2tp6(0xa, 0x2, 0x73) recvmsg(r5, &(0x7f0000003140)={0x0, 0x0, 0x0}, 0x2020) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000500)=ANY=[@ANYBLOB="740000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000004c0012800c0001006d6163766c616e003c00028008000100100000001c0005800a000400aaaaaaaaaabb000002000400d8928afb7028000008000300030000000a000400aaaaaaaaaabb0000080005"], 0x74}, 0x1, 0x0, 0x0, 0x1}, 0x2044890) fchdir(0xffffffffffffffff) write$P9_RGETATTR(0xffffffffffffffff, 0x0, 0x0) r7 = socket$rds(0x15, 0x5, 0x0) bind$rds(r7, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r7, &(0x7f00000000c0)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) r8 = socket(0x15, 0x5, 0x0) getsockopt(r8, 0x200000000114, 0x271c, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, 0x0, 0x0) 2.051593585s ago: executing program 4 (id=2789): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'bond0\x00', 0x0}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x28a03, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{0xc0010010}]}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="400d0000001200002000128008000100687372001400028008000200", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x40010}, 0x4008044) sendmsg$nl_route_sched(r0, &(0x7f0000001080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001040)={&(0x7f0000000340)=@delchain={0xcc8, 0x65, 0x400, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x9, 0x2}, {0x1001e, 0xf}, {0xfff2, 0x10}}, [@TCA_CHAIN={0x8, 0xb, 0x81}, @filter_kind_options=@f_bpf={{0x8}, {0xc84, 0x2, [@TCA_BPF_POLICE={0x82c, 0x2, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x93bf}, @TCA_POLICE_RATE64={0xc, 0x8, 0xc982}, @TCA_POLICE_RATE={0x404, 0x2, [0x18, 0xfffff52d, 0x0, 0xa6bb, 0xd243, 0x3, 0x4, 0x44eb, 0xc7, 0xfffffffe, 0x4, 0xf, 0x2, 0x9, 0x1, 0x0, 0x80000001, 0x5, 0x101, 0x9, 0x5, 0x9, 0x6, 0x4, 0x101, 0xae7, 0x400, 0xf9, 0x8000, 0x2, 0x4, 0x5, 0xfc6, 0x4, 0x0, 0xb10, 0x0, 0x9, 0xa, 0x7, 0x200, 0x1, 0x0, 0x2, 0x9c0, 0x6, 0x81, 0x6, 0x2000000, 0x2, 0x8, 0x8fa, 0x0, 0x6f2, 0x6, 0x0, 0x8000, 0x0, 0x401, 0x0, 0x3, 0x20000000, 0xb, 0x1000, 0x5, 0x80000001, 0x9, 0xfffffffb, 0x9, 0x9, 0xffffffff, 0x8, 0x4, 0x2, 0x8000, 0x8, 0x1, 0x3, 0x0, 0x1, 0x6, 0x39f9e622, 0x2, 0x8001, 0xfff, 0x83c, 0x16, 0x18, 0x2, 0x8, 0x2, 0x8000, 0x3a8, 0x1, 0x2, 0x80, 0x4, 0x80, 0x401, 0x6e, 0x0, 0x477, 0x9, 0xa2c0, 0x10001, 0x3, 0x4, 0x413, 0x2, 0x5, 0xa, 0x444b, 0x0, 0x7, 0x6, 0x0, 0x80000000, 0x9, 0x4, 0x7, 0x0, 0x9, 0x455, 0x81, 0xc0000000, 0x0, 0xbf9, 0xfffffffd, 0xf, 0x5, 0x1, 0x4, 0x1ff, 0x6, 0xc3fa, 0x4, 0x3, 0x7, 0x1, 0x7ff, 0x2, 0x8, 0x3, 0x7, 0x0, 0x6, 0x40, 0x0, 0x6, 0xfffffe51, 0x7fff, 0x56, 0x2, 0x8a0a, 0x3, 0x7c, 0x57ba, 0x400, 0x6, 0x3ff, 0x1, 0x286c, 0x3, 0x2, 0x9, 0x3, 0xffffffff, 0x0, 0x8, 0xffffffff, 0x5, 0x3a1, 0x81, 0x2, 0x7fffffff, 0xffffffff, 0x8, 0xb, 0x4e, 0x1, 0x40, 0x8, 0x1ff, 0x2, 0x6, 0x2, 0x7, 0x2c, 0x6, 0x9, 0x10000, 0x80000000, 0x3, 0x5, 0x2, 0xc, 0x8, 0x81, 0x0, 0x9, 0x3, 0x6, 0x8, 0x3, 0x980b935, 0x7, 0x5, 0x4, 0x100, 0x9, 0x4, 0x4, 0x7dc, 0xb, 0x6, 0x0, 0x3, 0x6, 0x1, 0x361b, 0x6f, 0x6, 0x3ff, 0x1, 0x2, 0x100, 0x1, 0x3, 0x4, 0xab1a, 0x6, 0x3, 0x2, 0x4d16, 0x2, 0x2, 0x8, 0x9, 0x3, 0x22, 0x0, 0x10001, 0xc, 0x2, 0x7ff, 0x0, 0x4, 0x1, 0x0, 0x4, 0x3bb, 0x1, 0x1, 0xfffffffd, 0x10, 0xdaf1]}, @TCA_POLICE_AVRATE={0x8}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x2, 0x8001, 0x800, 0x63, 0x10, 0x6, 0xf19, 0xd, 0x7, 0x0, 0x10000, 0x5, 0x7000000, 0x7, 0x1, 0x2, 0x1000, 0x6, 0x400, 0x2, 0x80000001, 0x4, 0x5, 0x0, 0xccc2, 0xc9, 0x8, 0x9, 0x2, 0x800, 0x1, 0xada, 0x6, 0x2d4, 0x1, 0x9, 0x4bd, 0x73a1, 0x5, 0x800, 0xc, 0x8, 0x1d39f9c, 0x79, 0x200, 0x401, 0x9f, 0x9, 0xff04, 0x3, 0x7fff, 0xc7e4, 0x9, 0x56, 0xfff, 0x7, 0xffffffff, 0x7, 0x1000, 0x4, 0x7, 0x0, 0x3, 0x9, 0x5, 0x0, 0xd, 0x2, 0x9, 0x7ff, 0x1c, 0x7ff, 0x8, 0x431, 0x6, 0x7ff, 0x7, 0xffffffff, 0x83f5, 0x3, 0x933, 0x9, 0x4, 0x4d0, 0x9, 0x8000, 0x7ff, 0xa00000, 0x1, 0x5, 0x10, 0x5, 0x2, 0x0, 0x4e, 0x7, 0x3, 0x8, 0x3, 0x8, 0x7, 0x81, 0x40, 0x9, 0x0, 0x5, 0x0, 0x3ff, 0x4, 0x1, 0xfff, 0xfffffff8, 0x2, 0x4, 0xac, 0x100, 0x4036, 0x401, 0x8001, 0x4, 0x20410000, 0x7, 0x8, 0x0, 0xfffffffd, 0x6, 0xf, 0x9, 0x1, 0x2527, 0x5, 0x3, 0xc, 0x5, 0x100, 0x10000, 0x0, 0x1, 0x7, 0x6, 0x10, 0x1, 0x80000001, 0x1, 0xf6, 0x7, 0x9, 0x9, 0xf, 0x41be, 0x9, 0x9, 0x4, 0x8, 0x5, 0x8, 0x4, 0x8000, 0x1f62e6cc, 0x80000001, 0x7, 0x3, 0x7ff, 0x8, 0x1, 0xa5a, 0x7, 0xfffff53e, 0xc, 0x101, 0x1, 0x99a4, 0x0, 0x34111bee, 0x2, 0x6, 0x1, 0x9, 0x2, 0x7, 0x7fffffff, 0xff, 0xfa8, 0x0, 0x8de1, 0x0, 0x7fff, 0x9, 0x8c, 0x0, 0xb, 0xffffffff, 0x400, 0x2, 0xffff, 0x0, 0x101, 0x5, 0x181f5f31, 0x10000, 0x1, 0x6, 0xfff, 0x9, 0x6, 0x3, 0x8, 0x8, 0x10000, 0x6, 0x10000, 0x8, 0x7, 0x0, 0x800, 0x0, 0x400, 0xbd2, 0x7fd1, 0xe, 0x100, 0xe5c8, 0x1, 0xe45, 0x3, 0x6, 0x6, 0x4, 0xa, 0x3f99, 0x12d, 0xb, 0x7, 0x8, 0x1, 0xfffffff2, 0x27b, 0x80000dd4, 0xacaf, 0x3, 0xc, 0x7, 0x8b, 0x3, 0x2, 0x400, 0x2, 0x4, 0x63b, 0x6, 0x7, 0xffffff66, 0x1, 0xff, 0x3, 0x7]}]}, @TCA_BPF_POLICE={0x44c, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x5b57, 0x7, 0x3, 0x6, 0x7ff, 0x3, 0x100, 0x5, 0x4, 0x6, 0x7ff, 0x9, 0x0, 0x9, 0x6, 0x2, 0x4ce, 0x8, 0x38, 0x4, 0x8b1, 0x2, 0x0, 0x5e4, 0x3, 0x6, 0xfffffb5d, 0x2, 0x8, 0x9, 0x80000001, 0x6, 0x0, 0x6a5bbda5, 0xb1d, 0x2, 0x5, 0x2, 0xfffffe00, 0x0, 0x5e, 0x5, 0xd, 0x4, 0x9, 0x48dbbb72, 0x1000, 0x10c, 0x2, 0xb000, 0xcc94, 0x3, 0x6, 0x7f, 0xe5, 0x5, 0xc6ca, 0x9, 0xe5b, 0x9, 0x6, 0x9, 0x1, 0x1, 0xfffffff9, 0xb7c, 0x2, 0x2, 0x2, 0x6b7, 0x31d, 0x5, 0x3, 0x3, 0x8, 0x0, 0xd, 0x10001, 0x3e8, 0x6, 0x33, 0x3, 0x2, 0xe438, 0x1, 0x9, 0x20, 0xffffffbd, 0x3, 0x10000, 0x68fc, 0xa, 0xfffffffa, 0x7f, 0x7, 0x7ff, 0xf, 0xffffff4f, 0x3, 0x4, 0x7, 0x80000001, 0x8, 0x1, 0x7, 0x7fffffff, 0x8, 0x800, 0x4, 0x6ad1, 0x80, 0x6, 0x1f, 0xf484, 0x8, 0x0, 0x2, 0x4, 0x2, 0x5, 0x8, 0x7, 0x0, 0xfffffe00, 0xffff, 0x6, 0xffffffff, 0x80000001, 0x7, 0x2, 0x5, 0x7f, 0x2, 0x1, 0xc56b, 0x5, 0x4, 0x100, 0x68b80f4b, 0xffff8000, 0x74, 0x40, 0x7, 0x3, 0x3, 0x1, 0x7, 0x5, 0x7ff, 0xe, 0x5, 0xffff, 0x10001, 0x200, 0x7, 0x6, 0x7fff, 0x73fe, 0xcde, 0x8, 0x5, 0xfffff760, 0x1, 0xa26, 0x3ff, 0x9, 0x5, 0x1, 0x6, 0xc00000, 0x0, 0x36, 0x2ed6718d, 0x2, 0x5, 0x5, 0x7f, 0x2, 0xb, 0x401, 0x7f1, 0xd61, 0x393a, 0x5, 0x200, 0x9, 0x3, 0x3, 0x6, 0x2, 0x1, 0xe, 0x0, 0x1, 0x8001, 0x3, 0x3, 0x1, 0x2, 0x0, 0x821, 0x8000, 0x9, 0x5519dd50, 0x42, 0xffffffa4, 0x5, 0x7fff, 0x7, 0x784f, 0x8, 0x8, 0xfffffffd, 0x5, 0xff, 0x34, 0x6, 0x2, 0x1, 0x7, 0xfffffff9, 0x19a, 0x3, 0x1, 0x4, 0x3ff, 0x4, 0x6, 0x8, 0xfffffffc, 0x4, 0x8001, 0x8, 0xffff, 0x5, 0x2, 0x7, 0x8f, 0xab, 0x2, 0x400, 0x0, 0x7, 0xfffffffd, 0x4, 0xf0f, 0xb82, 0x82f, 0x8, 0xbad3, 0x5, 0x5, 0x6, 0x1, 0x3, 0x1]}, @TCA_POLICE_RESULT={0x8, 0x5, 0xa9}, @TCA_POLICE_TBF={0x3c, 0x1, {0x3, 0x2, 0xa79, 0x80000001, 0x7fffffff, {0x6, 0x2, 0x5, 0xf, 0x200, 0x101}, {0x0, 0x0, 0xb187, 0xed, 0xb}, 0x8001, 0x8, 0xffff}}]}, @TCA_BPF_CLASSID={0x8, 0x3, {0x10, 0xd}}]}}, @TCA_CHAIN={0x8, 0xb, 0x2}, @TCA_RATE={0x6, 0x5, {0x9, 0xad}}]}, 0xcc8}, 0x1, 0x0, 0x0, 0x20000000}, 0x48084) 1.888412227s ago: executing program 2 (id=2790): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001300)=ANY=[@ANYBLOB="12010000000000205804115000000000000109022400010000000009040000050300000009210000000122940309058103"], 0x0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x80800) fanotify_init(0x200, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x183341, 0x0) r0 = inotify_init1(0x80000) inotify_add_watch(r0, &(0x7f0000000040)='./file1\x00', 0x7f7) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141b42, 0x8) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r3, 0x0, 0x3b, 0x9) splice(r1, 0x0, r5, 0x0, 0x80, 0x8) write$tun(r2, &(0x7f0000000980)=ANY=[], 0x107c) syz_open_dev$dri(0x0, 0x800000d21, 0x1c180) 1.630721892s ago: executing program 3 (id=2791): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) modify_ldt$write(0x1, &(0x7f0000000000)={0x3fd, 0xffffffffffffffff, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) syz_clone(0x648c7000, 0x0, 0x0, 0x0, 0x0, 0x0) inotify_init() r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x321}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) 1.544204455s ago: executing program 4 (id=2792): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) modify_ldt$write(0x1, &(0x7f0000000000)={0x3fd, 0xffffffffffffffff, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) syz_clone(0x648c7000, 0x0, 0x0, 0x0, 0x0, 0x0) inotify_init() r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x321}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) 1.243971201s ago: executing program 1 (id=2793): socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_dev$vbi(&(0x7f00000039c0), 0x2, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_proto_private(r2, 0x8929, &(0x7f0000000900)="b35f8e67ff3a") ioctl$VIDIOC_S_STD(r1, 0x40085618, &(0x7f0000003a00)=0x800000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = syz_ublk_setup_io_uring(0x26c8, &(0x7f00000003c0)={0x0, 0x4000, 0x4000, 0x0, 0xf}, 0x0, 0x0, 0x0) syz_ublk_add_dev(r3, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_open_dev$media(0x0, 0x0, 0x0) r6 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x80, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) r12 = dup(r11) syz_ublk_setup_queues(r12, r10, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x0, 0x255}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x27ffffe, 0x4000, 0x2100, 0x2d8, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0xfffffffc, 0x1f0, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0x3, 0xe0b, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) write$char_usb(r5, &(0x7f0000000500)="f380fd4e0195d731230bd490e20598ed458a71e83368ad14eb9f5a65f1e97ae9a50e2b66ffe6cdc7ccb8478eadd3d41beee69d644c8653ef3f753d6ae8167e1f30a5de446c259d87de673d144b40fbdb4fc850856715dbae09fe5aaf3c03c4f1162bffa0cb65a3d94619a51601ead713abf04a9e88111cecc1be0cb06a33ad8eb816f599f201696d9fdf5bc25435d09008ec528905cfa7565530f7756f03a49568a3a05ab94b99322596cf011cbee5d8ad74a56c33b071cb12ead879de03f5b7c88d0de4530b", 0xc6) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0e"], 0x48) 1.004070024s ago: executing program 0 (id=2794): unshare(0x2c020400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0xe, 0x0, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000140)={@random="2050efbd04dd", @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "1e1907", 0xc, 0x2f, 0xff, @remote, @mcast2, {[], {0x0, 0x22eb, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}}, 0x0) 707.739185ms ago: executing program 0 (id=2795): openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000080), 0x3, 0x8ac02) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x10, 0x1, 0x1, 0x2, 0x0, 0x7}, 0x0, &(0x7f0000000240)={0x1f, 0x3, 0x0, 0xb1bd, 0x64000000, 0xfffffffffffffffc, 0x0, 0x1b}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 239.925976ms ago: executing program 3 (id=2796): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x24, 0x1, 0x4, 0x101, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x3}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000004) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_int(r1, 0x0, 0x15, &(0x7f0000000340)=0x200, 0x4) pipe2(&(0x7f0000000000), 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x181440) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f00000000c0)={0x7ff, 0x1c, 0xfffc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000002c0)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000300)=0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000680)=@newsa={0x1cc, 0x10, 0x1, 0x7fffffc, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0xfffc, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in=@multicast2, 0x4, 0x6c}, @in6=@remote, {0x200000000, 0x0, 0x0, 0x0, 0x2000000000, 0x0, 0x1000000000000000}, {0x5, 0x4, 0xd, 0xa}, {0x0, 0x400}, 0xfffffffc, 0x0, 0xa, 0x1, 0x6}, [@algo_comp={0xad, 0x3, {{'deflate\x00'}, 0x328, "ab085288e59d088a62bd699fa1e1c4fea63868036e4e4926ec9d8faf0ad6dfcd6e02f20a4a133cc71a64bd09da795ebe2cbe7664573110ef99ecf71db24d3f6e3d66f725f55ce00e682a661a6c36b512244637e3e60a637dd0a11d2340e8ee8731e2d291cc"}}, @lifetime_val={0x24, 0x9, {0x3, 0x10, 0x1, 0x1}}, @etimer_thresh={0x8, 0xc, 0x6}]}, 0x1cc}}, 0x20000000) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, 0x0, &(0x7f0000000000)) r5 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup\x00', 0x0, 0x2) setsockopt$inet6_tcp_int(r5, 0x6, 0x1b, &(0x7f0000000040)=0x8001, 0x4) r6 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_FILTER(r6, 0x6b, 0x1, &(0x7f0000000180)=[{0x3, 0x2, {0x1c420a57b8743854, 0x70}, {0x1, 0xff, 0x4}, 0x1}, {0x3, 0x1, {0x2, 0xff, 0x3}, {0x1, 0xf0, 0x3}, 0xfd, 0x2}, {0x1, 0x0, {0x1, 0xf0, 0x4}, {0x3, 0x0, 0x4}, 0xff, 0x2}], 0x60) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000100), &(0x7f0000000140)=0x30) getdents64(r5, &(0x7f0000000000)=""/52, 0x34) getdents64(r5, 0xfffffffffffffffe, 0x29) ioctl$MON_IOCX_MFETCH(r2, 0xc0109207, 0x0) ioctl$FIONCLEX(r2, 0x5450) 158.934853ms ago: executing program 4 (id=2797): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) sendmmsg$unix(r1, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x9802}}, {{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x299, 0x0) (fail_nth: 57) 105.035497ms ago: executing program 2 (id=2798): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000000)=0x1ff, 0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x38}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f00000000c0)={&(0x7f0000000080)=[{0xffff, 0x1, 0x1, &(0x7f0000000140)='<'}], 0x1}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=@framed={{0xdb, 0xa, 0xa, 0xfe00, 0xa0, 0x71, 0x10, 0x1d}}, 0x0, 0xb, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) close_range(r1, r0, 0x0) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_GETMODE(r3, 0x5601, 0x0) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x4, 0x7, 0x50000}]}) syz_clone(0xdc884b80, 0x0, 0x0, 0x0, 0x0, 0x0) setitimer(0x1, &(0x7f0000000080)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) r5 = signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) read$FUSE(r5, &(0x7f00000008c0)={0x2020}, 0xfffffef0) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYRESOCT=r4], 0x1c}}, 0x0) ioctl$EXT4_IOC_CHECKPOINT(r5, 0x4004662b, &(0x7f0000000140)) 0s ago: executing program 1 (id=2799): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) fchdir(0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a0302000200000000000002000000090002"], 0x80}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000100010000000900010073797a30000000000900020073797a3000000000400003800800014000000000080002400000fbff2b0003801400010067656e6576653000000000000000000014000100776732000000000000000000c6e49c0f5c000000180a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380140001"], 0x110}}, 0x0) (fail_nth: 33) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = open(0x0, 0x0, 0x112) getdents64(r1, &(0x7f00000002c0)=""/237, 0xed) kernel console output (not intermixed with test programs): oogle Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 491.025558][T13730] Call Trace: [ 491.025564][T13730] [ 491.025571][T13730] dump_stack_lvl+0xe8/0x150 [ 491.025596][T13730] should_fail_ex+0x40c/0x560 [ 491.025623][T13730] should_failslab+0xa8/0x100 [ 491.025644][T13730] __kmalloc_noprof+0xfe/0x720 [ 491.025662][T13730] ? nft_pernet+0x23/0x240 [ 491.025759][T13730] ? nf_tables_newrule+0x1524/0x28a0 [ 491.025799][T13730] ? nf_tables_newrule+0x1524/0x28a0 [ 491.025821][T13730] nf_tables_newrule+0x1524/0x28a0 [ 491.025851][T13730] ? __pfx_nf_tables_newrule+0x10/0x10 [ 491.025868][T13730] ? nfnl_pernet+0x23/0x240 [ 491.025940][T13730] ? nfnl_pernet+0x23/0x240 [ 491.025970][T13730] ? __nla_parse+0x40/0x60 [ 491.025994][T13730] nfnetlink_rcv+0x1288/0x28c0 [ 491.026040][T13730] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 491.026091][T13730] ? netlink_deliver_tap+0x2e/0x1b0 [ 491.026113][T13730] ? netlink_deliver_tap+0x2e/0x1b0 [ 491.026126][T13730] ? netlink_deliver_tap+0x2e/0x1b0 [ 491.026143][T13730] netlink_unicast+0x7bb/0x940 [ 491.026173][T13730] netlink_sendmsg+0x813/0xb40 [ 491.026193][T13730] ? __pfx_netlink_sendmsg+0x10/0x10 [ 491.026208][T13730] ? aa_sock_msg_perm+0xf1/0x1b0 [ 491.026231][T13730] ? __pfx_netlink_sendmsg+0x10/0x10 [ 491.026243][T13730] sock_sendmsg_nosec+0x13a/0x180 [ 491.026264][T13730] ____sys_sendmsg+0x54e/0x850 [ 491.026284][T13730] ? __pfx_____sys_sendmsg+0x10/0x10 [ 491.026313][T13730] ? import_iovec+0x73/0xa0 [ 491.026335][T13730] ___sys_sendmsg+0x2a5/0x360 [ 491.026349][T13730] ? __lock_acquire+0x683/0x2cf0 [ 491.026373][T13730] ? __pfx____sys_sendmsg+0x10/0x10 [ 491.026415][T13730] ? __fget_files+0x2a/0x420 [ 491.026431][T13730] ? __fget_files+0x3a2/0x420 [ 491.026455][T13730] __x64_sys_sendmsg+0x1b1/0x290 [ 491.026471][T13730] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 491.026500][T13730] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.026514][T13730] do_syscall_64+0x174/0x580 [ 491.026530][T13730] ? trace_irq_disable+0x3b/0x140 [ 491.026549][T13730] ? clear_bhb_loop+0x40/0x90 [ 491.026569][T13730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.026585][T13730] RIP: 0033:0x7faf3d39e0d9 [ 491.026602][T13730] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 491.026616][T13730] RSP: 002b:00007faf3e309028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 491.026634][T13730] RAX: ffffffffffffffda RBX: 00007faf3d625fa0 RCX: 00007faf3d39e0d9 [ 491.026647][T13730] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 491.026658][T13730] RBP: 00007faf3e309090 R08: 0000000000000000 R09: 0000000000000000 [ 491.026669][T13730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 491.026680][T13730] R13: 00007faf3d626038 R14: 00007faf3d625fa0 R15: 00007faf3d74fa48 [ 491.026709][T13730] [ 491.323881][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 491.471833][ T5702] hid_parser_main: 7 callbacks suppressed [ 491.471854][ T5702] hid-generic 0000:0CEA:0063.0033: unknown main item tag 0x0 [ 491.512470][ T5702] hid-generic 0000:0CEA:0063.0033: unknown main item tag 0x0 [ 491.565634][ T5702] hid-generic 0000:0CEA:0063.0033: unknown main item tag 0x0 [ 491.604939][ T5702] hid-generic 0000:0CEA:0063.0033: unknown main item tag 0x0 [ 491.620450][ T5702] hid-generic 0000:0CEA:0063.0033: unknown main item tag 0x0 [ 491.636690][ T5702] hid-generic 0000:0CEA:0063.0033: unknown main item tag 0x0 [ 491.684422][ T5702] hid-generic 0000:0CEA:0063.0033: unknown main item tag 0x0 [ 491.698507][ T5702] hid-generic 0000:0CEA:0063.0033: unknown main item tag 0x0 [ 491.723455][ T5702] hid-generic 0000:0CEA:0063.0033: unknown main item tag 0x0 [ 491.745361][ T5702] hid-generic 0000:0CEA:0063.0033: unknown main item tag 0x0 [ 491.777479][ T5702] hid-generic 0000:0CEA:0063.0033: hidraw0: HID v0.08 Device [syz0] on syz1 [ 491.997472][T13754] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2386'. [ 492.028974][T13755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 492.055883][T13755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 492.111163][T13762] netlink: 'syz.4.2390': attribute type 10 has an invalid length. [ 492.156516][T13762] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2390'. [ 492.159371][T13747] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2384'. [ 492.364215][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 492.444261][ T24] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 492.514103][ T5694] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 492.594202][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 492.601041][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 492.613436][ T24] usb 1-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 492.623037][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.631275][ T24] usb 1-1: Product: syz [ 492.636331][ T24] usb 1-1: Manufacturer: syz [ 492.641006][ T24] usb 1-1: SerialNumber: syz [ 492.648827][ T24] usb 1-1: config 0 descriptor?? [ 492.686727][ T5694] usb 3-1: Using ep0 maxpacket: 32 [ 492.707234][ T5694] usb 3-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 492.724427][ T5694] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.733795][ T5694] usb 3-1: Product: syz [ 492.738710][ T5694] usb 3-1: Manufacturer: syz [ 492.743478][ T5694] usb 3-1: SerialNumber: syz [ 492.752280][ T5694] usb 3-1: config 0 descriptor?? [ 492.768098][T13778] fuse: fd is not a fuse device [ 493.109388][T13788] netlink: 240 bytes leftover after parsing attributes in process `syz.3.2398'. [ 493.171651][ T5694] airspy 3-1:0.0: Board ID: 00 [ 493.182683][ T5694] airspy 3-1:0.0: Firmware version: [ 493.298192][T13794] FAULT_INJECTION: forcing a failure. [ 493.298192][T13794] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 493.314798][T13794] CPU: 0 UID: 0 PID: 13794 Comm: syz.4.2401 Tainted: G L syzkaller #0 PREEMPT(full) [ 493.314826][T13794] Tainted: [L]=SOFTLOCKUP [ 493.314832][T13794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 493.314843][T13794] Call Trace: [ 493.314849][T13794] [ 493.314857][T13794] dump_stack_lvl+0xe8/0x150 [ 493.314886][T13794] should_fail_ex+0x40c/0x560 [ 493.314917][T13794] _copy_from_user+0x2d/0xb0 [ 493.314940][T13794] ___sys_sendmsg+0x1c6/0x360 [ 493.314963][T13794] ? __pfx____sys_sendmsg+0x10/0x10 [ 493.314978][T13794] ? __lock_acquire+0x683/0x2cf0 [ 493.315045][T13794] __sys_sendmmsg+0x273/0x4d0 [ 493.315067][T13794] ? __pfx___sys_sendmmsg+0x10/0x10 [ 493.315092][T13794] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 493.315121][T13794] ? ksys_write+0x242/0x270 [ 493.315147][T13794] ? __pfx_ksys_write+0x10/0x10 [ 493.315184][T13794] __x64_sys_sendmmsg+0xa0/0xc0 [ 493.315202][T13794] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.315221][T13794] do_syscall_64+0x174/0x580 [ 493.315238][T13794] ? trace_irq_disable+0x3b/0x140 [ 493.315258][T13794] ? clear_bhb_loop+0x40/0x90 [ 493.315279][T13794] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.315297][T13794] RIP: 0033:0x7ff81919e0d9 [ 493.315314][T13794] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 493.315329][T13794] RSP: 002b:00007ff819fe2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 493.315348][T13794] RAX: ffffffffffffffda RBX: 00007ff819425fa0 RCX: 00007ff81919e0d9 [ 493.315361][T13794] RDX: 0000000000000299 RSI: 0000200000003dc0 RDI: 0000000000000004 [ 493.315372][T13794] RBP: 00007ff819fe2090 R08: 0000000000000000 R09: 0000000000000000 [ 493.315383][T13794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 493.315394][T13794] R13: 00007ff819426038 R14: 00007ff819425fa0 R15: 00007ff81954fa48 [ 493.315422][T13794] [ 493.434180][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 493.539451][T13796] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.550002][T13796] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.565301][T13796] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.626987][T13796] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.688441][T13803] FAULT_INJECTION: forcing a failure. [ 493.688441][T13803] name failslab, interval 1, probability 0, space 0, times 0 [ 493.701711][T13803] CPU: 0 UID: 0 PID: 13803 Comm: syz.4.2404 Tainted: G L syzkaller #0 PREEMPT(full) [ 493.701728][T13803] Tainted: [L]=SOFTLOCKUP [ 493.701732][T13803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 493.701738][T13803] Call Trace: [ 493.701743][T13803] [ 493.701748][T13803] dump_stack_lvl+0xe8/0x150 [ 493.701779][T13803] should_fail_ex+0x40c/0x560 [ 493.701811][T13803] should_failslab+0xa8/0x100 [ 493.701837][T13803] __kmalloc_cache_noprof+0xa8/0x660 [ 493.701854][T13803] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 493.701870][T13803] ? __kmalloc_cache_noprof+0x150/0x660 [ 493.701881][T13803] ? sctp_add_bind_addr+0x8c/0x370 [ 493.701894][T13803] ? sctp_add_bind_addr+0x8c/0x370 [ 493.701916][T13803] sctp_add_bind_addr+0x8c/0x370 [ 493.701944][T13803] sctp_copy_local_addr_list+0x31a/0x4e0 [ 493.701970][T13803] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 493.701995][T13803] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 493.702014][T13803] ? sctp_v6_is_any+0x64/0x80 [ 493.702029][T13803] ? sctp_copy_one_addr+0x93/0x360 [ 493.702044][T13803] sctp_bind_addr_copy+0xb3/0x3c0 [ 493.702059][T13803] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 493.702083][T13803] sctp_connect_new_asoc+0x2ff/0x6b0 [ 493.702105][T13803] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 493.702131][T13803] ? __local_bh_enable_ip+0xd0/0x130 [ 493.702155][T13803] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 493.702169][T13803] ? security_sctp_bind_connect+0x7e/0x2c0 [ 493.702192][T13803] sctp_sendmsg+0x159b/0x2d00 [ 493.702223][T13803] ? __pfx_sctp_sendmsg+0x10/0x10 [ 493.702247][T13803] ? aa_sk_perm+0x6d5/0x900 [ 493.702283][T13803] ? sock_rps_record_flow+0x19/0x350 [ 493.702310][T13803] ? inet_sendmsg+0x298/0x320 [ 493.702329][T13803] ? __pfx_inet_sendmsg+0x10/0x10 [ 493.702341][T13803] sock_sendmsg_nosec+0x10e/0x180 [ 493.702359][T13803] ____sys_sendmsg+0x54e/0x850 [ 493.702381][T13803] ? __pfx_____sys_sendmsg+0x10/0x10 [ 493.702417][T13803] ? import_iovec+0x73/0xa0 [ 493.702443][T13803] ___sys_sendmsg+0x2a5/0x360 [ 493.702455][T13803] ? __lock_acquire+0x683/0x2cf0 [ 493.702474][T13803] ? __pfx____sys_sendmsg+0x10/0x10 [ 493.702500][T13803] ? __fget_files+0x2a/0x420 [ 493.702517][T13803] ? __fget_files+0x3a2/0x420 [ 493.702548][T13803] __x64_sys_sendmsg+0x1b1/0x290 [ 493.702568][T13803] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 493.702602][T13803] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.702615][T13803] do_syscall_64+0x174/0x580 [ 493.702625][T13803] ? trace_irq_disable+0x3b/0x140 [ 493.702640][T13803] ? clear_bhb_loop+0x40/0x90 [ 493.702653][T13803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.702664][T13803] RIP: 0033:0x7ff81919e0d9 [ 493.702681][T13803] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 493.702696][T13803] RSP: 002b:00007ff819fe2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 493.702715][T13803] RAX: ffffffffffffffda RBX: 00007ff819425fa0 RCX: 00007ff81919e0d9 [ 493.702729][T13803] RDX: 0000000000048043 RSI: 0000200000000800 RDI: 0000000000000004 [ 493.702741][T13803] RBP: 00007ff819fe2090 R08: 0000000000000000 R09: 0000000000000000 [ 493.702751][T13803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 493.702760][T13803] R13: 00007ff819426038 R14: 00007ff819425fa0 R15: 00007ff81954fa48 [ 493.702776][T13803] [ 494.081675][T13797] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 494.446061][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 494.606114][ T5694] airspy 3-1:0.0: usb_control_msg() failed -110 request 0e [ 494.629015][ T5694] airspy 3-1:0.0: Registered as swradio24 [ 494.650535][ T5694] airspy 3-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 494.904332][ T191] usb 5-1: new full-speed USB device number 92 using dummy_hcd [ 494.922160][ T5694] usb 1-1: USB disconnect, device number 92 [ 495.093154][ T191] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 495.122191][ T191] usb 5-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 495.161111][ T191] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.194109][ T191] usb 5-1: Product: syz [ 495.196364][T13836] xt_socket: unknown flags 0xc [ 495.204657][T13834] netlink: 'syz.1.2414': attribute type 17 has an invalid length. [ 495.222810][ T191] usb 5-1: Manufacturer: syz [ 495.222816][T13834] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2414'. [ 495.222845][T13834] bond0: option all_slaves_active: invalid value (183) [ 495.278269][ T191] usb 5-1: SerialNumber: syz [ 495.323862][ T191] usb 5-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 495.391139][ T5702] usb 3-1: USB disconnect, device number 80 [ 495.484226][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 495.534469][ T5694] usb 2-1: new full-speed USB device number 89 using dummy_hcd [ 495.638740][T13849] bridge0: port 1(bridge_slave_0) entered disabled state [ 495.736345][ T5694] usb 2-1: unable to get BOS descriptor or descriptor too short [ 495.756848][ T5694] usb 2-1: not running at top speed; connect to a high speed hub [ 495.780138][ T5694] usb 2-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice= 0.40 [ 495.803258][ T5694] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.834040][ T5694] usb 2-1: Product: syz [ 495.845310][ T5694] usb 2-1: Manufacturer: syz [ 495.861908][ T5694] usb 2-1: SerialNumber: syz [ 496.110571][T13855] netlink: 'syz.2.2421': attribute type 1 has an invalid length. [ 496.188285][ T5694] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 496.304081][ T5705] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 496.316960][T13855] bond4: entered promiscuous mode [ 496.323745][ T5694] usb 2-1: USB disconnect, device number 89 [ 496.357457][T13855] 8021q: adding VLAN 0 to HW filter on device bond4 [ 496.373041][T13865] x_tables: unsorted entry at hook 2 [ 496.476063][ T5705] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 496.509750][ T5705] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 496.524136][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 496.550684][ T5705] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 496.551190][T13861] vlan3: entered allmulticast mode [ 496.624109][ T5705] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 496.662727][ T5705] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.701113][T13861] bond4: entered allmulticast mode [ 496.718507][ T5705] usb 1-1: config 0 descriptor?? [ 496.847295][T13862] bond4: (slave bridge1): making interface the new active one [ 496.874882][T13862] bridge1: entered promiscuous mode [ 496.883467][T13875] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2426'. [ 496.896577][T13862] bridge1: entered allmulticast mode [ 496.923395][T13862] bond4: (slave bridge1): Enslaving as an active interface with an up link [ 496.960627][T13864] tipc: Cannot configure node identity twice [ 497.141465][ T5705] hid_parser_main: 178 callbacks suppressed [ 497.141488][ T5705] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 497.186329][ T5705] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 497.211933][ T5705] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 497.249759][ T5705] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 497.272875][ T5705] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 497.302439][ T5705] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 497.330999][ T5705] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 497.357735][ T5705] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 497.382270][ T5705] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 497.412380][ T5705] plantronics 0003:047F:FFFF.0034: unknown main item tag 0x0 [ 497.474465][ T5705] plantronics 0003:047F:FFFF.0034: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 497.564143][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 497.872876][T13887] bond4: (slave vlan1): Opening slave failed [ 498.025435][ T191] usb 5-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 498.120568][ T191] usb 5-1: USB disconnect, device number 92 [ 498.378620][T13902] TC_ACT_REPEAT abuse ? [ 498.604149][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 498.769318][ T5705] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 498.782435][T13911] usb 1-1: USB disconnect, device number 93 [ 498.813705][ T29] kauditd_printk_skb: 19 callbacks suppressed [ 498.813720][ T29] audit: type=1326 audit(1786061206.511:3139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13910 comm="syz.3.2437" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5507f9e0d9 code=0x7ffc0000 [ 498.923025][ T29] audit: type=1326 audit(1786061206.511:3140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13910 comm="syz.3.2437" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5507f9e0d9 code=0x7ffc0000 [ 498.949614][ T29] audit: type=1326 audit(1786061206.511:3141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13910 comm="syz.3.2437" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5507f9e0d9 code=0x7ffc0000 [ 498.954103][ T5705] usb 2-1: Using ep0 maxpacket: 16 [ 499.070018][ T5705] usb 2-1: config 0 has an invalid interface number: 107 but max is 0 [ 499.100689][ T29] audit: type=1326 audit(1786061206.511:3142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13910 comm="syz.3.2437" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5507f9e0d9 code=0x7ffc0000 [ 499.128400][ T5705] usb 2-1: config 0 has no interface number 0 [ 499.178031][ T5705] usb 2-1: config 0 interface 107 altsetting 0 endpoint 0x88 has an invalid bInterval 55, changing to 9 [ 499.230599][ T5705] usb 2-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid maxpacket 8496, setting to 1024 [ 499.231968][ T29] audit: type=1326 audit(1786061206.511:3143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13910 comm="syz.3.2437" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f5507f9e0d9 code=0x7ffc0000 [ 499.272336][ T29] audit: type=1326 audit(1786061206.511:3144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13910 comm="syz.3.2437" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5507f9e0d9 code=0x7ffc0000 [ 499.327121][ T5705] usb 2-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 499.336539][ T5705] usb 2-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 499.345026][ T5705] usb 2-1: Product: syz [ 499.349364][ T5705] usb 2-1: Manufacturer: syz [ 499.354145][ T5705] usb 2-1: SerialNumber: syz [ 499.364547][ T5705] usb 2-1: config 0 descriptor?? [ 499.375385][ T5705] keyspan 2-1:0.107: Keyspan 4 port adapter converter detected [ 499.386479][ T5705] keyspan 2-1:0.107: found no endpoint descriptor for endpoint 81 [ 499.403400][ T5705] keyspan 2-1:0.107: found no endpoint descriptor for endpoint 1 [ 499.416719][ T29] audit: type=1326 audit(1786061206.511:3145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13910 comm="syz.3.2437" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5507f9e0d9 code=0x7ffc0000 [ 499.444839][ T29] audit: type=1326 audit(1786061206.511:3146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13910 comm="syz.3.2437" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5507f9e0d9 code=0x7ffc0000 [ 499.469988][ T5705] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 499.470283][ T29] audit: type=1326 audit(1786061206.511:3147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13910 comm="syz.3.2437" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f5507f9de42 code=0x7ffc0000 [ 499.572824][ T29] audit: type=1326 audit(1786061206.511:3148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13910 comm="syz.3.2437" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f5507f9e0d9 code=0x7ffc0000 [ 499.644133][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 499.678198][T13921] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 499.688051][ T5705] keyspan 2-1:0.107: found no endpoint descriptor for endpoint 2 [ 499.739068][ T5705] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 499.793929][ T5705] keyspan 2-1:0.107: found no endpoint descriptor for endpoint 4 [ 499.861785][ T5705] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 499.919056][ T5705] keyspan 2-1:0.107: found no endpoint descriptor for endpoint 6 [ 499.964306][ T5705] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 500.010611][T13927] could not allocate digest TFM handle crct10dif-arm64-ce [ 500.057186][T13928] could not allocate digest TFM handle crct10dif-arm64-ce [ 500.385215][T13943] Invalid logical block size (536870912) [ 500.471311][ T5705] usb 2-1: USB disconnect, device number 90 [ 500.523426][ T5705] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 500.549214][ T5705] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 500.567218][ T5705] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 500.592183][ T5705] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 500.603729][ T5705] keyspan 2-1:0.107: device disconnected [ 500.687934][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 501.327804][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.334315][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.404298][T13966] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 501.562413][T13968] xfrm0: left allmulticast mode [ 501.724135][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 501.731682][ T5705] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 501.901379][ T5705] usb 3-1: Using ep0 maxpacket: 32 [ 501.913378][ T5705] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 501.932664][ T5705] usb 3-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 501.945324][T13987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.955325][ T5705] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.987853][ T5705] usb 3-1: config 0 descriptor?? [ 501.997971][T13983] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2463'. [ 502.024574][T13987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.038702][T13987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 502.047804][T13987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.313922][T13994] fuse: Unknown parameter '' [ 502.402062][T13966] netlink: 212 bytes leftover after parsing attributes in process `syz.2.2455'. [ 502.440104][ T5705] input: HID 5543:0042 Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:5543:0042.0035/input/input61 [ 502.544559][ T5705] input: HID 5543:0042 Mouse as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:5543:0042.0035/input/input62 [ 502.598330][ T5705] uclogic 0003:5543:0042.0035: input,hidraw0: USB HID v7f.fd Mouse [HID 5543:0042] on usb-dummy_hcd.2-1/input0 [ 502.654515][ T10] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 502.774140][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 502.840688][ T5705] usb 3-1: USB disconnect, device number 81 [ 502.841776][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 502.891786][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.926502][ T10] usb 5-1: Product: syz [ 502.938010][ T10] usb 5-1: Manufacturer: syz [ 502.949452][ T10] usb 5-1: SerialNumber: syz [ 503.051061][T14012] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2473'. [ 503.080170][T14012] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 503.143501][T14012] bridge0: port 2(bridge_slave_1) entered disabled state [ 503.151065][T14012] bridge0: port 1(bridge_slave_0) entered disabled state [ 503.574121][ T24] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 503.724397][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 503.731845][ T24] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 503.741634][ T24] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 503.769545][ T24] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 503.801334][ T24] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 503.811481][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 503.829288][ T24] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 503.845518][ T24] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 503.854882][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.936259][T14038] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 504.041830][T13998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 504.063746][T13998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.086106][ T24] usb 2-1: GET_CAPABILITIES returned 0 [ 504.102076][ T10] cdc_ncm 5-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 504.104763][ T24] usbtmc 2-1:16.0: can't read capabilities [ 504.123104][ T10] cdc_ncm 5-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 504.139027][ T10] cdc_ncm 5-1:1.0: setting rx_max = 2048 [ 504.397756][ T10] cdc_ncm 5-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.4-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 504.457088][ T10] usb 5-1: USB disconnect, device number 93 [ 504.483022][ T10] cdc_ncm 5-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.4-1, CDC NCM (NO ZLP) [ 504.546408][ T24] usb 2-1: USB disconnect, device number 91 [ 504.664278][T14052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 504.689079][T14052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.705915][T14054] program syz.0.2488 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 504.844130][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 504.856213][T14056] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 505.022984][T14064] binder: 14063:14064 ioctl c018620b 0 returned -14 [ 505.148567][ T10] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 505.284582][ T10] usb 3-1: device descriptor read/64, error -71 [ 505.535402][ T10] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 505.644220][ T24] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 505.676329][ T10] usb 3-1: device descriptor read/64, error -71 [ 505.794555][ T10] usb usb3-port1: attempt power cycle [ 505.826149][ T24] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 505.859956][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 505.882938][ T24] usb 2-1: config 1 has no interface number 0 [ 505.889245][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 505.917701][ T24] usb 2-1: New USB device found, idVendor=041e, idProduct=3f04, bcdDevice= 0.40 [ 505.935244][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.951516][ T24] usb 2-1: Product: syz [ 505.960816][ T24] usb 2-1: Manufacturer: syz [ 505.967476][ T24] usb 2-1: SerialNumber: syz [ 506.035761][T14088] CUSE: unknown device info "n¸Þ|’zQC*¯" [ 506.054291][T14088] CUSE: unknown device info ">2¢“‰a"ëî V­Ä|ÿ#Úyï€S—ioåLåÎà”¢8†9ÔIÿèܥѮžÃ‡Å[¥<^ÎQÎÓ>”nHw Ý×'0KVÆ,†¹${\d+" [ 506.085749][T14088] CUSE: unknown device info "Ýÿÿÿ" [ 506.088729][T14093] netlink: 'syz.0.2502': attribute type 16 has an invalid length. [ 506.099112][T14088] CUSE: unknown device info "ÙLÐP§ô¿’t|%Í€IŸ¸èžOØÙäKu GìÂÏǪ|ÜQüUËœDv…F‰Ý,*pá(o9Ð{uáöº[§èµ¨‘²égIÁPÌÍYV" [ 506.099130][T14088] CUSE: DEVNAME unspecified [ 506.119976][T14093] netlink: 'syz.0.2502': attribute type 17 has an invalid length. [ 506.128070][T14093] netlink: 3 bytes leftover after parsing attributes in process `syz.0.2502'. [ 506.144166][ T10] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 506.165111][ T10] usb 3-1: device descriptor read/8, error -71 [ 506.190059][ T24] usb 2-1: 1:0 : does not exist [ 506.198660][ T24] usb 2-1: 1:2 : does not exist [ 506.203733][ T24] usb 2-1: 1:3 : does not exist [ 506.210258][ T24] usb 2-1: BAAD HEADPHONE p_chmask mismatch [ 506.288318][ T24] snd-usb-audio 2-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 506.310443][ T24] usb 2-1: USB disconnect, device number 92 [ 506.414853][ T10] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 506.455658][ T10] usb 3-1: device descriptor read/8, error -71 [ 506.578253][ T10] usb usb3-port1: unable to enumerate USB device [ 506.728522][T14110] netlink: 332 bytes leftover after parsing attributes in process `syz.1.2507'. [ 506.836761][T14113] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2508'. [ 506.924150][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 507.356208][T14120] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2510'. [ 507.490907][T14123] binder: 14122:14123 ioctl c018620b 0 returned -14 [ 507.964132][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 508.147684][T14133] input: syz0 as /devices/virtual/input/input63 [ 508.456353][ T191] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 508.624293][ T191] usb 3-1: Using ep0 maxpacket: 16 [ 508.639303][ T191] usb 3-1: config 0 has an invalid interface number: 107 but max is 0 [ 508.655469][ T191] usb 3-1: config 0 has no interface number 0 [ 508.665782][ T191] usb 3-1: config 0 interface 107 altsetting 0 endpoint 0x88 has an invalid bInterval 55, changing to 9 [ 508.688119][ T191] usb 3-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid maxpacket 8496, setting to 1024 [ 508.701643][T14144] kAFS: unable to lookup cell '.ñÏ(,c¾ûL' [ 508.718601][ T191] usb 3-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 508.757893][ T191] usb 3-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 508.782392][ T191] usb 3-1: Product: syz [ 508.801694][ T191] usb 3-1: Manufacturer: syz [ 508.813493][ T191] usb 3-1: SerialNumber: syz [ 508.832180][ T191] usb 3-1: config 0 descriptor?? [ 508.855704][ T191] keyspan 3-1:0.107: Keyspan 4 port adapter converter detected [ 508.879187][ T191] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 81 [ 508.907320][ T191] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 1 [ 508.920049][ T191] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 508.938155][ T191] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 2 [ 508.949117][ T191] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 508.964826][ T191] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 4 [ 508.977547][ T191] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 508.989915][ T191] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 6 [ 509.002585][ T191] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 509.014150][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 509.074350][ T5705] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 509.110827][T14153] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 509.123011][T14153] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 509.137294][T14153] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2522'. [ 509.265492][ T5705] usb 5-1: Using ep0 maxpacket: 16 [ 509.278086][ T5705] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 509.300508][ T5705] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 509.325205][ T5705] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 509.357704][ T5705] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 509.386566][ T5705] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 509.406756][ T5705] usb 5-1: config 0 descriptor?? [ 509.557022][ T191] usb 3-1: USB disconnect, device number 86 [ 509.596502][ T191] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 509.613047][ T191] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 509.637395][ T191] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 509.652239][T14148] syz.4.2520(14148): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 509.687901][ T191] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 509.716919][ T191] keyspan 3-1:0.107: device disconnected [ 509.767950][T14169] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2528'. [ 509.780210][T14168] binder: 14166:14168 ioctl c018620b 0 returned -14 [ 509.905167][ T5705] usbhid 5-1:0.0: can't add hid device: -71 [ 509.917657][ T5705] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 509.931470][T14177] netlink: 'syz.3.2531': attribute type 1 has an invalid length. [ 509.947285][ T5705] usb 5-1: USB disconnect, device number 94 [ 510.014519][T14177] 8021q: adding VLAN 0 to HW filter on device bond5 [ 510.044122][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 510.052068][T14181] netlink: 5 bytes leftover after parsing attributes in process `syz.1.2529'. [ 510.270453][T14184] team0: Port device syz_tun added [ 510.776847][T14201] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 511.094217][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 511.494149][ T10] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 511.654290][ T10] usb 5-1: device descriptor read/64, error -71 [ 511.754239][T14216] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 511.774768][T14216] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.880807][T14222] netlink: 6 bytes leftover after parsing attributes in process `syz.2.2546'. [ 511.894573][ T10] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 512.044446][ T10] usb 5-1: device descriptor read/64, error -71 [ 512.133829][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 512.154405][ T10] usb usb5-port1: attempt power cycle [ 512.328640][T14243] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2556'. [ 512.494267][ T10] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 512.515235][ T10] usb 5-1: device descriptor read/8, error -71 [ 512.574215][ T5702] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 512.725921][ T5702] usb 2-1: config 0 descriptor has 1 excess byte, ignoring [ 512.733376][ T5702] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 512.743827][ T5702] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 7 [ 512.756111][ T10] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 512.771563][ T5702] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 512.781062][ T5702] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.789184][ T5702] usb 2-1: Product: syz [ 512.793596][ T5702] usb 2-1: Manufacturer: syz [ 512.798789][ T5702] usb 2-1: SerialNumber: syz [ 512.803644][ T10] usb 5-1: device descriptor read/8, error -71 [ 512.812190][ T5702] usb 2-1: config 0 descriptor?? [ 512.918143][T14245] FAULT_INJECTION: forcing a failure. [ 512.918143][T14245] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 512.937671][T14245] CPU: 0 UID: 0 PID: 14245 Comm: syz.2.2557 Tainted: G L syzkaller #0 PREEMPT(full) [ 512.937692][T14245] Tainted: [L]=SOFTLOCKUP [ 512.937695][T14245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 512.937702][T14245] Call Trace: [ 512.937706][T14245] [ 512.937712][T14245] dump_stack_lvl+0xe8/0x150 [ 512.937734][T14245] should_fail_ex+0x40c/0x560 [ 512.937754][T14245] _copy_from_user+0x2d/0xb0 [ 512.937768][T14245] ___sys_sendmsg+0x1c6/0x360 [ 512.937781][T14245] ? __pfx____sys_sendmsg+0x10/0x10 [ 512.937790][T14245] ? __lock_acquire+0x683/0x2cf0 [ 512.937825][T14245] __sys_sendmmsg+0x273/0x4d0 [ 512.937837][T14245] ? __pfx___sys_sendmmsg+0x10/0x10 [ 512.937850][T14245] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 512.937868][T14245] ? ksys_write+0x242/0x270 [ 512.937884][T14245] ? __pfx_ksys_write+0x10/0x10 [ 512.937902][T14245] __x64_sys_sendmmsg+0xa0/0xc0 [ 512.937912][T14245] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.937922][T14245] do_syscall_64+0x174/0x580 [ 512.937933][T14245] ? clear_bhb_loop+0x40/0x90 [ 512.937945][T14245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.937955][T14245] RIP: 0033:0x7f615b99e0d9 [ 512.937965][T14245] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 512.937974][T14245] RSP: 002b:00007f615c7da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 512.937986][T14245] RAX: ffffffffffffffda RBX: 00007f615bc25fa0 RCX: 00007f615b99e0d9 [ 512.937993][T14245] RDX: 0000000000000299 RSI: 0000200000003dc0 RDI: 0000000000000004 [ 512.938000][T14245] RBP: 00007f615c7da090 R08: 0000000000000000 R09: 0000000000000000 [ 512.938006][T14245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 512.938012][T14245] R13: 00007f615bc26038 R14: 00007f615bc25fa0 R15: 00007f615bd4fa48 [ 512.938026][T14245] [ 512.938441][ T10] usb usb5-port1: unable to enumerate USB device [ 513.142158][ T5702] usb 2-1: 0:0 : invalid sync pipe. is_playback 1, ep 0b, bSynchAddress ff [ 513.164124][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 513.200742][ T5702] usb 2-1: USB disconnect, device number 93 [ 513.280962][T14255] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.291078][T14255] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 513.524127][ T5705] usb 3-1: new full-speed USB device number 87 using dummy_hcd [ 513.622070][T14259] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2561'. [ 513.679247][ T5705] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 513.688959][ T5705] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.697244][ T5705] usb 3-1: Product: syz [ 513.701676][ T5705] usb 3-1: Manufacturer: syz [ 513.706847][ T5705] usb 3-1: SerialNumber: syz [ 513.715282][ T5705] usb 3-1: config 0 descriptor?? [ 513.836618][T14262] Invalid logical block size (199600449) [ 513.922293][ T5705] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 514.094075][T14273] FAULT_INJECTION: forcing a failure. [ 514.094075][T14273] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 514.120237][T14273] CPU: 1 UID: 0 PID: 14273 Comm: syz.0.2567 Tainted: G L syzkaller #0 PREEMPT(full) [ 514.120267][T14273] Tainted: [L]=SOFTLOCKUP [ 514.120274][T14273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 514.120284][T14273] Call Trace: [ 514.120291][T14273] [ 514.120299][T14273] dump_stack_lvl+0xe8/0x150 [ 514.120328][T14273] should_fail_ex+0x40c/0x560 [ 514.120363][T14273] prepare_alloc_pages+0x230/0x650 [ 514.120393][T14273] __alloc_frozen_pages_noprof+0x12f/0x380 [ 514.120420][T14273] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 514.120446][T14273] ? __pfx_policy_nodemask+0x10/0x10 [ 514.120473][T14273] ? __lock_acquire+0x683/0x2cf0 [ 514.120498][T14273] alloc_pages_mpol+0x212/0x380 [ 514.120525][T14273] folio_alloc_mpol_noprof+0x39/0x160 [ 514.120550][T14273] vma_alloc_folio_noprof+0xe1/0x1e0 [ 514.120577][T14273] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 514.120600][T14273] ? __pte_offset_map+0x29/0x240 [ 514.120618][T14273] ? __pte_offset_map+0x29/0x240 [ 514.120637][T14273] do_pte_missing+0x173a/0x34b0 [ 514.120671][T14273] handle_mm_fault+0x1b36/0x3080 [ 514.120698][T14273] ? handle_mm_fault+0xec/0x3080 [ 514.120722][T14273] ? __pfx_handle_mm_fault+0x10/0x10 [ 514.120753][T14273] ? __lock_acquire+0x683/0x2cf0 [ 514.120778][T14273] ? lock_mm_and_find_vma+0xa7/0x340 [ 514.120802][T14273] do_user_addr_fault+0x744/0x1340 [ 514.120841][T14273] exc_page_fault+0x6a/0xc0 [ 514.120861][T14273] asm_exc_page_fault+0x26/0x30 [ 514.120879][T14273] RIP: 0010:rep_stos_alternative+0x40/0x80 [ 514.120900][T14273] Code: c9 75 f6 e9 02 74 04 00 48 89 07 48 83 c7 08 83 e9 08 74 ef 83 f9 08 73 ef eb de 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 <48> 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47 [ 514.120914][T14273] RSP: 0018:ffffc90003967958 EFLAGS: 00050202 [ 514.120930][T14273] RAX: 0000000000000000 RBX: 00007ffffffff001 RCX: 0000000000000380 [ 514.120941][T14273] RDX: 0000000000000000 RSI: ffffffff8e4ab42c RDI: 0000200000015000 [ 514.120953][T14273] RBP: ffffc90003967ab8 R08: ffffffff821be14f R09: 0000000000000000 [ 514.120964][T14273] R10: 0000000000000000 R11: ffff88807fb969b8 R12: 0000200000014380 [ 514.120975][T14273] R13: 0000000000001000 R14: 1ffff9200072cf3c R15: 0000000000013000 [ 514.120992][T14273] ? __might_fault+0xaf/0x130 [ 514.121024][T14273] iov_iter_zero+0x3bd/0x16b0 [ 514.121056][T14273] ? __pfx_iov_iter_zero+0x10/0x10 [ 514.121077][T14273] ? _parse_integer_limit+0x192/0x1e0 [ 514.121096][T14273] ? __pfx_aa_file_perm+0x10/0x10 [ 514.121121][T14273] ? kstrtoull+0x12f/0x1d0 [ 514.121140][T14273] read_iter_zero+0x96/0x2a0 [ 514.121172][T14273] do_iter_readv_writev+0x612/0x8c0 [ 514.121190][T14273] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 514.121218][T14273] ? bpf_lsm_file_permission+0x9/0x20 [ 514.121235][T14273] ? security_file_permission+0x75/0x260 [ 514.121255][T14273] ? rw_verify_area+0x24a/0x4c0 [ 514.121280][T14273] vfs_readv+0x28d/0x850 [ 514.121306][T14273] ? __pfx_vfs_readv+0x10/0x10 [ 514.121336][T14273] ? __fget_files+0x2a/0x420 [ 514.121384][T14273] ? __fget_files+0x3a2/0x420 [ 514.121402][T14273] ? __fget_files+0x2a/0x420 [ 514.121428][T14273] __se_sys_preadv2+0x177/0x2a0 [ 514.121448][T14273] ? __pfx___se_sys_preadv2+0x10/0x10 [ 514.121468][T14273] ? __x64_sys_preadv2+0x20/0xc0 [ 514.121483][T14273] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 514.121501][T14273] do_syscall_64+0x174/0x580 [ 514.121516][T14273] ? trace_irq_disable+0x3b/0x140 [ 514.121535][T14273] ? clear_bhb_loop+0x40/0x90 [ 514.121555][T14273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 514.121573][T14273] RIP: 0033:0x7faf3d39e0d9 [ 514.121590][T14273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 514.121603][T14273] RSP: 002b:00007faf3e309028 EFLAGS: 00000246 ORIG_RAX: 0000000000000147 [ 514.121620][T14273] RAX: ffffffffffffffda RBX: 00007faf3d625fa0 RCX: 00007faf3d39e0d9 [ 514.121632][T14273] RDX: 0000000000000002 RSI: 0000200000001540 RDI: 0000000000000003 [ 514.121643][T14273] RBP: 00007faf3e309090 R08: 0000000000000000 R09: 0000000000000000 [ 514.121653][T14273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 514.121663][T14273] R13: 00007faf3d626038 R14: 00007faf3d625fa0 R15: 00007faf3d74fa48 [ 514.121693][T14273] [ 514.539264][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 514.627652][T14277] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2568'. [ 514.665498][ T5705] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 514.812138][T14291] netlink: 'syz.3.2574': attribute type 2 has an invalid length. [ 514.836728][T14293] mac80211_hwsim hwsim9 syzkaller0: left promiscuous mode [ 514.844791][ T10] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 514.869214][T14293] mac80211_hwsim hwsim9 syzkaller0: left allmulticast mode [ 514.981071][T14300] Cannot find add_set index 2 as target [ 515.014620][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 515.026526][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 515.039568][ T10] usb 2-1: config 1 has an invalid interface number: 151 but max is 0 [ 515.049261][ T10] usb 2-1: config 1 has no interface number 0 [ 515.056100][ T10] usb 2-1: config 1 interface 151 has no altsetting 0 [ 515.075998][ T10] usb 2-1: string descriptor 0 read error: -22 [ 515.094216][ T10] usb 2-1: New USB device found, idVendor=093a, idProduct=260e, bcdDevice=18.85 [ 515.104798][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.122717][ T10] gspca_main: pac7311-2.14.0 probing 093a:260e [ 515.244151][ T5702] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 515.401159][ T191] usb 3-1: USB disconnect, device number 87 [ 515.429817][ T5702] usb 5-1: config 0 has an invalid descriptor of length 250, skipping remainder of the config [ 515.440728][ T5702] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 515.456056][ T5702] usb 5-1: New USB device found, idVendor=20a0, idProduct=4287, bcdDevice= 0.00 [ 515.465701][ T5702] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.477569][ T5702] usb 5-1: config 0 descriptor?? [ 515.564572][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 515.622413][T14313] netlink: 'syz.2.2582': attribute type 2 has an invalid length. [ 515.631007][T14313] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2582'. [ 515.633336][T14315] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2582'. [ 515.854317][ T10] gspca_pac7311: reg_w() failed index 0x78, value 0x40, error -110 [ 515.862691][ T10] pac7311 2-1:1.151: probe with driver pac7311 failed with error -110 [ 516.014459][ T5611] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 516.041266][T14321] xt_hashlimit: size too large, truncated to 1048576 [ 516.042342][T14324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 516.068075][T14324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.145694][T14324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 516.184085][ T5611] usb 3-1: Using ep0 maxpacket: 32 [ 516.187232][T14324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.215330][ T5611] usb 3-1: config 2 has an invalid interface number: 194 but max is 0 [ 516.252623][ T5611] usb 3-1: config 2 has no interface number 0 [ 516.263754][ T5611] usb 3-1: config 2 interface 194 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 833 [ 516.276075][ T5611] usb 3-1: config 2 interface 194 altsetting 0 endpoint 0xA has invalid maxpacket 1584, setting to 1024 [ 516.291088][ T5611] usb 3-1: config 2 interface 194 altsetting 0 endpoint 0x8 has invalid maxpacket 26565, setting to 1024 [ 516.292309][ T5702] usb 2-1: USB disconnect, device number 94 [ 516.304392][ T5611] usb 3-1: config 2 interface 194 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1024 [ 516.365931][ T5611] usb 3-1: New USB device found, idVendor=0499, idProduct=1025, bcdDevice=9c.f6 [ 516.376546][ T5611] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 516.442221][T14324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 516.446918][T14319] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 516.469321][T14324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.475984][T14319] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 516.488537][T14319] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 516.500661][T14324] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2576'. [ 516.506496][T14332] syz.3.2586 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=0, oom_score_adj=1000 [ 516.520933][T14332] CPU: 1 UID: 0 PID: 14332 Comm: syz.3.2586 Tainted: G L syzkaller #0 PREEMPT(full) [ 516.520970][T14332] Tainted: [L]=SOFTLOCKUP [ 516.520979][T14332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 516.520991][T14332] Call Trace: [ 516.520999][T14332] [ 516.521008][T14332] dump_stack_lvl+0xe8/0x150 [ 516.521041][T14332] dump_header+0xd3/0x4b0 [ 516.521070][T14332] oom_kill_process+0x3ab/0x970 [ 516.521095][T14332] out_of_memory+0x1064/0x1480 [ 516.521126][T14332] ? try_charge_memcg+0xbca/0x1590 [ 516.521165][T14332] ? __pfx_out_of_memory+0x10/0x10 [ 516.521195][T14332] ? do_raw_spin_unlock+0xf5/0x210 [ 516.521227][T14332] try_charge_memcg+0xc74/0x1590 [ 516.521269][T14332] ? __pfx_try_charge_memcg+0x10/0x10 [ 516.521301][T14332] ? percpu_ref_tryget+0x15/0x180 [ 516.521340][T14332] ? __memcg_slab_post_alloc_hook+0x710/0xf10 [ 516.521388][T14332] ? __memcg_slab_post_alloc_hook+0x710/0xf10 [ 516.521413][T14332] __memcg_slab_post_alloc_hook+0x909/0xf10 [ 516.521451][T14332] ? xt_alloc_table_info+0x40/0xb0 [ 516.521586][T14332] __kvmalloc_node_noprof+0x61c/0x860 [ 516.521618][T14332] ? __kvmalloc_node_noprof+0x35c/0x860 [ 516.521643][T14332] ? xt_alloc_table_info+0x40/0xb0 [ 516.521674][T14332] xt_alloc_table_info+0x40/0xb0 [ 516.521702][T14332] do_ipt_set_ctl+0x962/0xe20 [ 516.521774][T14332] ? rcu_is_watching+0x15/0xb0 [ 516.521803][T14332] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 516.521839][T14332] ? __mutex_unlock_slowpath+0x731/0x900 [ 516.521862][T14332] ? aa_sk_perm+0x6d5/0x900 [ 516.521892][T14332] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 516.521916][T14332] ? __pfx_aa_sk_perm+0x10/0x10 [ 516.521948][T14332] nf_setsockopt+0x26f/0x290 [ 516.521977][T14332] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 516.522005][T14332] do_sock_setsockopt+0x17c/0x1b0 [ 516.522039][T14332] __x64_sys_setsockopt+0x13d/0x1b0 [ 516.522070][T14332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.522092][T14332] do_syscall_64+0x174/0x580 [ 516.522110][T14332] ? trace_irq_disable+0x3b/0x140 [ 516.522135][T14332] ? clear_bhb_loop+0x40/0x90 [ 516.522158][T14332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.522177][T14332] RIP: 0033:0x7f5507f9e0d9 [ 516.522195][T14332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 516.522211][T14332] RSP: 002b:00007f5508f22028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 516.522232][T14332] RAX: ffffffffffffffda RBX: 00007f5508225fa0 RCX: 00007f5507f9e0d9 [ 516.522247][T14332] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000005 [ 516.522259][T14332] RBP: 00007f5508035024 R08: 0000000000000408 R09: 0000000000000000 [ 516.522272][T14332] R10: 0000200000000a80 R11: 0000000000000246 R12: 0000000000000000 [ 516.522285][T14332] R13: 00007f5508226038 R14: 00007f5508225fa0 R15: 00007f550834fa48 [ 516.522316][T14332] [ 516.522354][T14332] memory: usage 8kB, limit 8kB, failcnt 95 [ 516.607054][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 516.754199][ T5702] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 516.788210][T14332] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 516.788231][T14332] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 516.788244][T14332] Memory cgroup stats for /syz3/test: [ 516.850946][T14332] cache 0 [ 516.859711][T14332] rss 0 [ 516.862704][T14332] rss_huge 0 [ 516.866696][T14332] shmem 0 [ 516.869730][T14332] mapped_file 0 [ 516.873500][T14332] dirty 0 [ 516.876979][T14332] writeback 0 [ 516.886025][T14332] workingset_refault_anon 0 [ 516.892388][T14332] workingset_refault_file 0 [ 516.898618][T14332] swap 0 [ 516.903046][T14332] swapcached 0 [ 516.912904][T14332] pgpgin 0 [ 516.926475][T14332] pgpgout 0 [ 516.931641][T14332] pgfault 3 [ 516.937154][T14332] pgmajfault 0 [ 516.947424][T14332] inactive_anon 0 [ 516.955306][T14332] active_anon 0 [ 516.960481][T14332] inactive_file 0 [ 516.966117][T14332] active_file 0 [ 516.973778][T14332] unevictable 0 [ 516.979293][T14332] hierarchical_memory_limit 8192 [ 516.994177][T14332] hierarchical_memsw_limit 9223372036854771712 [ 517.001127][T14332] total_cache 0 [ 517.005582][T14332] total_rss 0 [ 517.014069][T14332] total_rss_huge 0 [ 517.022844][T14332] total_shmem 0 [ 517.026615][ T5702] usb 2-1: Using ep0 maxpacket: 32 [ 517.042149][T14332] total_mapped_file 0 [ 517.048221][ T5702] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 517.061376][ T5702] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 517.071911][T14332] total_dirty 0 [ 517.081863][T14332] total_writeback 0 [ 517.092006][ T5702] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 517.101635][T14332] total_workingset_refault_anon 0 [ 517.113244][T14332] total_workingset_refault_file 0 [ 517.120115][ T5702] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 517.134663][T14332] total_swap 0 [ 517.141226][T14332] total_swapcached 0 [ 517.141994][ T5702] usb 2-1: config 0 descriptor?? [ 517.148645][T14332] total_pgpgin 0 [ 517.156837][T14332] total_pgpgout 0 [ 517.161420][T14332] total_pgfault 3 [ 517.168216][T14332] total_pgmajfault 0 [ 517.168397][ T5702] hub 2-1:0.0: USB hub found [ 517.175248][T14332] total_inactive_anon 0 [ 517.177071][T14332] total_active_anon 0 [ 517.187302][T14332] total_inactive_file 0 [ 517.192599][T14332] total_active_file 0 [ 517.197921][T14332] total_unevictable 0 [ 517.203814][T14332] anon_cost 0 [ 517.207614][T14332] file_cost 0 [ 517.212387][T14332] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.2586,pid=14331,uid=0 [ 517.247399][T14332] Memory cgroup out of memory: Killed process 14331 (syz.3.2586) total-vm:102252kB, anon-rss:1432kB, file-rss:22676kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 517.366377][ T5702] hub 2-1:0.0: 1 port detected [ 517.572186][ T5702] hub 2-1:0.0: hub_hub_status failed (err = -71) [ 517.590014][ T5702] hub 2-1:0.0: config failed, can't get hub status (err -71) [ 517.602576][ T5702] usbhid 2-1:0.0: can't add hid device: -71 [ 517.609909][ T5702] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 517.644194][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 517.646572][ T5702] usb 2-1: USB disconnect, device number 95 [ 517.976348][T14342] netlink: 'syz.0.2592': attribute type 7 has an invalid length. [ 517.987589][T14342] netlink: 'syz.0.2592': attribute type 7 has an invalid length. [ 518.017087][ T24] usb 5-1: USB disconnect, device number 99 [ 518.241245][T14349] netlink: 'syz.4.2594': attribute type 1 has an invalid length. [ 518.291503][T14349] bond4: (slave geneve3): making interface the new active one [ 518.300531][T14349] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 518.321301][T14349] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2594'. [ 518.337891][ T43] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 518.371127][T14349] 8021q: adding VLAN 0 to HW filter on device bond4 [ 518.444453][ T43] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 518.489631][ T43] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 518.684303][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 518.777163][ T5611] usb 3-1: string descriptor 0 read error: -71 [ 518.831801][ T5611] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 518.872531][ T43] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 518.961640][T14376] FAULT_INJECTION: forcing a failure. [ 518.961640][T14376] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 518.993803][ T5611] usb 3-1: USB disconnect, device number 88 [ 519.004175][T14376] CPU: 0 UID: 0 PID: 14376 Comm: syz.2.2601 Tainted: G L syzkaller #0 PREEMPT(full) [ 519.004213][T14376] Tainted: [L]=SOFTLOCKUP [ 519.004219][T14376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 519.004229][T14376] Call Trace: [ 519.004237][T14376] [ 519.004244][T14376] dump_stack_lvl+0xe8/0x150 [ 519.004273][T14376] should_fail_ex+0x40c/0x560 [ 519.004306][T14376] prepare_alloc_pages+0x230/0x650 [ 519.004335][T14376] __alloc_frozen_pages_noprof+0x12f/0x380 [ 519.004362][T14376] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 519.004390][T14376] ? __pfx_policy_nodemask+0x10/0x10 [ 519.004416][T14376] ? __lock_acquire+0x683/0x2cf0 [ 519.004439][T14376] alloc_pages_mpol+0x212/0x380 [ 519.004467][T14376] folio_alloc_mpol_noprof+0x39/0x160 [ 519.004494][T14376] vma_alloc_folio_noprof+0xe1/0x1e0 [ 519.004518][T14376] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 519.004541][T14376] ? __pte_offset_map+0x29/0x240 [ 519.004558][T14376] ? __pte_offset_map+0x29/0x240 [ 519.004577][T14376] do_pte_missing+0x173a/0x34b0 [ 519.004613][T14376] handle_mm_fault+0x1b36/0x3080 [ 519.004645][T14376] ? handle_mm_fault+0xec/0x3080 [ 519.004672][T14376] ? __pfx_handle_mm_fault+0x10/0x10 [ 519.004690][T14376] ? follow_page_pte+0x6ce/0xe70 [ 519.004717][T14376] ? __pfx_follow_page_pte+0x10/0x10 [ 519.004747][T14376] __get_user_pages+0x1678/0x2720 [ 519.004804][T14376] populate_vma_page_range+0x2be/0x3c0 [ 519.004832][T14376] ? __pfx_populate_vma_page_range+0x10/0x10 [ 519.004861][T14376] ? down_read+0x2be/0x330 [ 519.004884][T14376] __mm_populate+0x25f/0x390 [ 519.004911][T14376] ? __pfx___mm_populate+0x10/0x10 [ 519.004944][T14376] vm_mmap_pgoff+0x353/0x4e0 [ 519.004974][T14376] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 519.004996][T14376] ? ksys_write+0x242/0x270 [ 519.005023][T14376] ? __pfx_ksys_write+0x10/0x10 [ 519.005049][T14376] ? ksys_mmap_pgoff+0xf3/0x760 [ 519.005068][T14376] ? __x64_sys_mmap+0x7f/0x140 [ 519.005093][T14376] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.005112][T14376] do_syscall_64+0x174/0x580 [ 519.005130][T14376] ? trace_irq_disable+0x3b/0x140 [ 519.005151][T14376] ? clear_bhb_loop+0x40/0x90 [ 519.005173][T14376] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.005198][T14376] RIP: 0033:0x7f615b99e0d9 [ 519.005215][T14376] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 519.005229][T14376] RSP: 002b:00007f615c7da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 519.005248][T14376] RAX: ffffffffffffffda RBX: 00007f615bc25fa0 RCX: 00007f615b99e0d9 [ 519.005261][T14376] RDX: 000000000000000f RSI: 0000000000b36000 RDI: 0000200000000000 [ 519.005273][T14376] RBP: 00007f615c7da090 R08: ffffffffffffffff R09: 000000001c5ed000 [ 519.005285][T14376] R10: 0000000004008032 R11: 0000000000000246 R12: 0000000000000002 [ 519.005297][T14376] R13: 00007f615bc26038 R14: 00007f615bc25fa0 R15: 00007f615bd4fa48 [ 519.005327][T14376] [ 519.519969][T14385] FAULT_INJECTION: forcing a failure. [ 519.519969][T14385] name failslab, interval 1, probability 0, space 0, times 0 [ 519.578120][T14385] CPU: 1 UID: 0 PID: 14385 Comm: syz.0.2604 Tainted: G L syzkaller #0 PREEMPT(full) [ 519.578152][T14385] Tainted: [L]=SOFTLOCKUP [ 519.578156][T14385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 519.578162][T14385] Call Trace: [ 519.578168][T14385] [ 519.578173][T14385] dump_stack_lvl+0xe8/0x150 [ 519.578192][T14385] should_fail_ex+0x40c/0x560 [ 519.578212][T14385] should_failslab+0xa8/0x100 [ 519.578228][T14385] __kmalloc_cache_noprof+0xa8/0x660 [ 519.578240][T14385] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 519.578257][T14385] ? __kmalloc_cache_noprof+0x150/0x660 [ 519.578268][T14385] ? sctp_add_bind_addr+0x8c/0x370 [ 519.578282][T14385] ? sctp_add_bind_addr+0x8c/0x370 [ 519.578298][T14385] sctp_add_bind_addr+0x8c/0x370 [ 519.578314][T14385] sctp_copy_local_addr_list+0x31a/0x4e0 [ 519.578330][T14385] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 519.578344][T14385] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 519.578359][T14385] ? sctp_v6_is_any+0x64/0x80 [ 519.578376][T14385] ? sctp_copy_one_addr+0x93/0x360 [ 519.578391][T14385] sctp_bind_addr_copy+0xb3/0x3c0 [ 519.578406][T14385] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 519.578420][T14385] sctp_connect_new_asoc+0x2ff/0x6b0 [ 519.578432][T14385] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 519.578443][T14385] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 519.578454][T14385] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 519.578464][T14385] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 519.578475][T14385] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 519.578494][T14385] ? security_sctp_bind_connect+0x7e/0x2c0 [ 519.578518][T14385] sctp_sendmsg+0x159b/0x2d00 [ 519.578538][T14385] ? __pfx_sctp_sendmsg+0x10/0x10 [ 519.578552][T14385] ? aa_sk_perm+0x6d5/0x900 [ 519.578572][T14385] ? sock_rps_record_flow+0x19/0x350 [ 519.578588][T14385] ? inet_sendmsg+0x298/0x320 [ 519.578602][T14385] ? __pfx_inet_sendmsg+0x10/0x10 [ 519.578615][T14385] sock_sendmsg_nosec+0x10e/0x180 [ 519.578633][T14385] ____sys_sendmsg+0x54e/0x850 [ 519.578645][T14385] ? __pfx_____sys_sendmsg+0x10/0x10 [ 519.578665][T14385] ? import_iovec+0x73/0xa0 [ 519.578681][T14385] ___sys_sendmsg+0x2a5/0x360 [ 519.578690][T14385] ? __lock_acquire+0x683/0x2cf0 [ 519.578705][T14385] ? __pfx____sys_sendmsg+0x10/0x10 [ 519.578717][T14385] ? kstrtouint+0x6e/0xe0 [ 519.578744][T14385] ? __fget_files+0x2a/0x420 [ 519.578757][T14385] ? __fget_files+0x3a2/0x420 [ 519.578774][T14385] __sys_sendmmsg+0x273/0x4d0 [ 519.578787][T14385] ? __pfx___sys_sendmmsg+0x10/0x10 [ 519.578801][T14385] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 519.578819][T14385] ? ksys_write+0x242/0x270 [ 519.578835][T14385] ? __pfx_ksys_write+0x10/0x10 [ 519.578853][T14385] __x64_sys_sendmmsg+0xa0/0xc0 [ 519.578863][T14385] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.578873][T14385] do_syscall_64+0x174/0x580 [ 519.578884][T14385] ? clear_bhb_loop+0x40/0x90 [ 519.578897][T14385] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.578906][T14385] RIP: 0033:0x7faf3d39e0d9 [ 519.578917][T14385] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 519.578925][T14385] RSP: 002b:00007faf3e309028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 519.578937][T14385] RAX: ffffffffffffffda RBX: 00007faf3d625fa0 RCX: 00007faf3d39e0d9 [ 519.578944][T14385] RDX: 0000000000000002 RSI: 00002000000029c0 RDI: 0000000000000004 [ 519.578950][T14385] RBP: 00007faf3e309090 R08: 0000000000000000 R09: 0000000000000000 [ 519.578971][T14385] R10: 0000000004040040 R11: 0000000000000246 R12: 0000000000000002 [ 519.578977][T14385] R13: 00007faf3d626038 R14: 00007faf3d625fa0 R15: 00007faf3d74fa48 [ 519.578993][T14385] [ 519.944616][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 520.010833][T14388] FAULT_INJECTION: forcing a failure. [ 520.010833][T14388] name failslab, interval 1, probability 0, space 0, times 0 [ 520.023552][T14388] CPU: 1 UID: 0 PID: 14388 Comm: syz.3.2603 Tainted: G L syzkaller #0 PREEMPT(full) [ 520.023579][T14388] Tainted: [L]=SOFTLOCKUP [ 520.023585][T14388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 520.023595][T14388] Call Trace: [ 520.023602][T14388] [ 520.023610][T14388] dump_stack_lvl+0xe8/0x150 [ 520.023638][T14388] should_fail_ex+0x40c/0x560 [ 520.023664][T14388] should_failslab+0xa8/0x100 [ 520.023684][T14388] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 520.023698][T14388] ? kstrdup+0x81/0x100 [ 520.023715][T14388] ? __kernfs_new_node+0xe6/0x980 [ 520.023732][T14388] ? __kernfs_new_node+0xe6/0x980 [ 520.023754][T14388] __kernfs_new_node+0xe6/0x980 [ 520.023778][T14388] ? __pfx___kernfs_new_node+0x10/0x10 [ 520.023796][T14388] ? kernfs_root+0x1c/0x230 [ 520.023818][T14388] ? kernfs_root+0x1c/0x230 [ 520.023834][T14388] ? kernfs_root+0x1c/0x230 [ 520.023849][T14388] ? kernfs_root+0x1c/0x230 [ 520.023868][T14388] kernfs_new_node+0xea/0x140 [ 520.023890][T14388] kernfs_create_link+0xa7/0x200 [ 520.023907][T14388] sysfs_do_create_link_sd+0x83/0x110 [ 520.023926][T14388] device_add_class_symlinks+0x1cf/0x240 [ 520.023948][T14388] device_add+0x467/0xb80 [ 520.023972][T14388] device_create+0x269/0x300 [ 520.023990][T14388] ? string+0x28a/0x2d0 [ 520.024011][T14388] ? widen_string+0x3b/0x2a0 [ 520.024029][T14388] ? string+0x28a/0x2d0 [ 520.024049][T14388] ? __pfx_device_create+0x10/0x10 [ 520.024077][T14388] bdi_register_va+0x9c/0x740 [ 520.024104][T14388] super_setup_bdi_name+0xf8/0x210 [ 520.024136][T14388] ? __pfx_super_setup_bdi_name+0x10/0x10 [ 520.024171][T14388] ? __init_waitqueue_head+0xa8/0x150 [ 520.024188][T14388] fuse_fill_super_common+0x624/0x10e0 [ 520.024210][T14388] ? __pfx_fuse_fill_super_common+0x10/0x10 [ 520.024225][T14388] ? __pfx_set_anon_super_fc+0x10/0x10 [ 520.024244][T14388] ? __pfx_sget_fc+0x10/0x10 [ 520.024268][T14388] fuse_fill_super+0x98/0x120 [ 520.024283][T14388] ? __pfx_fuse_fill_super+0x10/0x10 [ 520.024298][T14388] get_tree_nodev+0xbb/0x150 [ 520.024318][T14388] fuse_get_tree+0x29d/0x3b0 [ 520.024334][T14388] vfs_get_tree+0x92/0x2a0 [ 520.024355][T14388] do_new_mount+0x319/0xdc0 [ 520.024374][T14388] ? __pfx_do_new_mount+0x10/0x10 [ 520.024391][T14388] ? ns_capable+0x89/0xe0 [ 520.024406][T14388] ? path_mount+0x647/0x1040 [ 520.024424][T14388] ? user_path_at+0xd4/0x160 [ 520.024442][T14388] __se_sys_mount+0x31d/0x420 [ 520.024462][T14388] ? __pfx___se_sys_mount+0x10/0x10 [ 520.024486][T14388] ? __x64_sys_mount+0x20/0xc0 [ 520.024503][T14388] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.024517][T14388] do_syscall_64+0x174/0x580 [ 520.024530][T14388] ? trace_irq_disable+0x3b/0x140 [ 520.024546][T14388] ? clear_bhb_loop+0x40/0x90 [ 520.024562][T14388] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.024575][T14388] RIP: 0033:0x7f5507f9e0d9 [ 520.024588][T14388] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 520.024599][T14388] RSP: 002b:00007f5508f01028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 520.024614][T14388] RAX: ffffffffffffffda RBX: 00007f5508226090 RCX: 00007f5507f9e0d9 [ 520.024623][T14388] RDX: 00002000000020c0 RSI: 0000200000002080 RDI: 0000000000000000 [ 520.024632][T14388] RBP: 00007f5508f01090 R08: 0000200000000200 R09: 0000000000000000 [ 520.024641][T14388] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 520.024648][T14388] R13: 00007f5508226128 R14: 00007f5508226090 R15: 00007f550834fa48 [ 520.024671][T14388] [ 520.927317][T14405] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2611'. [ 521.004247][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 521.222695][T14415] tap0: tun_chr_ioctl cmd 1074025675 [ 521.241565][T14415] tap0: persist disabled [ 521.360389][T14442] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.374556][T14427] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 0 out of range (51000000..2150000000) [ 521.385655][T14442] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.584091][ T5611] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 521.746479][ T5611] usb 2-1: Using ep0 maxpacket: 8 [ 521.760751][ T5611] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 521.779728][ T5611] usb 2-1: New USB device found, idVendor=0421, idProduct=0335, bcdDevice=5f.0e [ 521.799400][ T5611] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 521.835837][ T5611] usb 2-1: config 0 descriptor?? [ 521.849557][ T5611] rndis_host 2-1:0.0: missing cdc header descriptor [ 521.867793][ T5611] cdc_acm 2-1:0.0: Control and data interfaces are not separated! [ 521.889427][ T5611] cdc_acm 2-1:0.0: This needs exactly 3 endpoints [ 521.917636][ T5611] cdc_acm 2-1:0.0: probe with driver cdc_acm failed with error -22 [ 522.044853][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 522.063169][ T5611] usb 2-1: USB disconnect, device number 96 [ 522.399901][T14481] vivid-000: ================= START STATUS ================= [ 522.410214][T14481] vivid-000: Test Pattern: 75% Colorbar [ 522.418797][T14481] vivid-000: Fill Percentage of Frame: 100 [ 522.427389][T14481] vivid-000: Horizontal Movement: No Movement [ 522.444172][T14481] vivid-000: Vertical Movement: No Movement [ 522.458294][T14481] vivid-000: OSD Text Mode: All [ 522.487292][T14481] vivid-000: Show Border: false [ 522.510744][T14481] vivid-000: Show Square: false [ 522.547868][T14481] vivid-000: Sensor Flipped Horizontally: false [ 522.579429][T14481] vivid-000: Sensor Flipped Vertically: false [ 522.604147][T14481] vivid-000: Insert SAV Code in Image: false [ 522.620360][T14481] vivid-000: Insert EAV Code in Image: false [ 522.648486][T14481] vivid-000: Insert Video Guard Band: false [ 522.678765][T14481] vivid-000: Reduced Framerate: true [ 522.708571][T14481] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 522.755960][T14481] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 522.783039][T14481] vivid-000: Enable Capture Cropping: true [ 522.799445][T14481] vivid-000: Enable Capture Composing: false [ 522.816063][T14481] vivid-000: Enable Capture Scaler: true [ 522.824064][T14481] vivid-000: Timestamp Source: End of Frame [ 522.835614][T14481] vivid-000: Colorspace: Rec. 709 [ 522.845773][T14481] vivid-000: Transfer Function: Default [ 522.857031][T14481] vivid-000: Y'CbCr Encoding: Default [ 522.868833][T14481] vivid-000: HSV Encoding: Hue 0-179 [ 522.882212][T14481] vivid-000: Quantization: Default [ 522.896397][T14481] vivid-000: Apply Alpha To Red Only: false [ 522.911232][T14481] vivid-000: Standard Aspect Ratio: 4x3 [ 522.925068][T14481] vivid-000: DV Timings Signal Mode: Current DV Timings [ 522.942015][T14481] vivid-000: DV Timings: 640x480p59 inactive [ 522.963485][T14481] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 522.993329][T14481] vivid-000: Maximum EDID Blocks: 2 [ 523.006319][T14481] vivid-000: Limited RGB Range (16-235): true [ 523.024235][T14481] vivid-000: Rx RGB Quantization Range: Automatic [ 523.035756][T14481] vivid-000: Power Present: 0x00000001 [ 523.047093][T14481] tpg source WxH: 1280x720 (R'G'B) [ 523.066716][T14481] tpg field: 1 [ 523.074353][T14481] tpg crop: (0,0)/64x64 [ 523.084475][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 523.097812][T14481] tpg compose: (0,0)/16x16 [ 523.102353][T14481] tpg colorspace: 3 [ 523.114096][T14481] tpg transfer function: 0/1 [ 523.124191][T14481] tpg quantization: 0/1 [ 523.132730][T14481] tpg RGB range: 0/1 [ 523.142844][T14481] vivid-000: ================== END STATUS ================== [ 523.362668][T14510] usb usb7: usbfs: process 14510 (syz.3.2640) did not claim interface 0 before use [ 523.403718][T14510] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2640'. [ 523.559079][T14519] FAULT_INJECTION: forcing a failure. [ 523.559079][T14519] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 523.582231][T14519] CPU: 1 UID: 0 PID: 14519 Comm: syz.3.2643 Tainted: G L syzkaller #0 PREEMPT(full) [ 523.582259][T14519] Tainted: [L]=SOFTLOCKUP [ 523.582265][T14519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 523.582274][T14519] Call Trace: [ 523.582281][T14519] [ 523.582288][T14519] dump_stack_lvl+0xe8/0x150 [ 523.582320][T14519] should_fail_ex+0x40c/0x560 [ 523.582352][T14519] _copy_to_user+0x31/0xb0 [ 523.582377][T14519] dev_ethtool+0x2571/0x29c0 [ 523.582464][T14519] ? __lock_acquire+0x683/0x2cf0 [ 523.582500][T14519] ? __pfx_dev_ethtool+0x10/0x10 [ 523.582523][T14519] ? kasan_quarantine_put+0xbb/0x1f0 [ 523.582547][T14519] ? dev_load+0x21/0x1f0 [ 523.582608][T14519] ? dev_load+0x21/0x1f0 [ 523.582638][T14519] ? dev_load+0x21/0x1f0 [ 523.582660][T14519] dev_ioctl+0x392/0x1150 [ 523.582685][T14519] sock_do_ioctl+0x23e/0x320 [ 523.582709][T14519] ? __pfx_sock_do_ioctl+0x10/0x10 [ 523.582726][T14519] ? hook_file_ioctl+0x1f0/0x5f0 [ 523.582762][T14519] sock_ioctl+0x57a/0x7e0 [ 523.582783][T14519] ? __pfx_sock_ioctl+0x10/0x10 [ 523.582802][T14519] ? __fget_files+0x2a/0x420 [ 523.582823][T14519] ? __fget_files+0x3a2/0x420 [ 523.582838][T14519] ? __fget_files+0x2a/0x420 [ 523.582852][T14519] ? bpf_lsm_file_ioctl+0x9/0x20 [ 523.582865][T14519] ? __pfx_sock_ioctl+0x10/0x10 [ 523.582876][T14519] __se_sys_ioctl+0xfc/0x170 [ 523.582885][T14519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.582897][T14519] do_syscall_64+0x174/0x580 [ 523.582909][T14519] ? trace_irq_disable+0x3b/0x140 [ 523.582922][T14519] ? clear_bhb_loop+0x40/0x90 [ 523.582934][T14519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.582944][T14519] RIP: 0033:0x7f5507f9e0d9 [ 523.582954][T14519] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 523.582963][T14519] RSP: 002b:00007f5508f22028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 523.582974][T14519] RAX: ffffffffffffffda RBX: 00007f5508225fa0 RCX: 00007f5507f9e0d9 [ 523.582982][T14519] RDX: 0000200000000040 RSI: 0000000000008946 RDI: 0000000000000016 [ 523.582988][T14519] RBP: 00007f5508f22090 R08: 0000000000000000 R09: 0000000000000000 [ 523.582994][T14519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 523.583000][T14519] R13: 00007f5508226038 R14: 00007f5508225fa0 R15: 00007f550834fa48 [ 523.583015][T14519] [ 524.124146][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 524.275818][T14543] tipc: Can't bind to reserved service type 1 [ 524.538538][T14553] binder: 14552:14553 unknown command 0 [ 524.559720][T14553] binder: 14552:14553 ioctl c0306201 2000000004c0 returned -22 [ 524.590807][T14556] binder: 14552:14556 ioctl 4001af72 200000000300 returned -22 [ 524.777153][T14564] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2659'. [ 524.791866][T14563] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2659'. [ 525.145823][T14577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 525.164147][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 525.215027][T14577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.230908][T14580] FAULT_INJECTION: forcing a failure. [ 525.230908][T14580] name failslab, interval 1, probability 0, space 0, times 0 [ 525.264174][T14580] CPU: 0 UID: 0 PID: 14580 Comm: syz.0.2665 Tainted: G L syzkaller #0 PREEMPT(full) [ 525.264202][T14580] Tainted: [L]=SOFTLOCKUP [ 525.264208][T14580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 525.264218][T14580] Call Trace: [ 525.264226][T14580] [ 525.264233][T14580] dump_stack_lvl+0xe8/0x150 [ 525.264263][T14580] should_fail_ex+0x40c/0x560 [ 525.264299][T14580] should_failslab+0xa8/0x100 [ 525.264325][T14580] __kmalloc_cache_noprof+0xa8/0x660 [ 525.264345][T14580] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 525.264371][T14580] ? __kmalloc_cache_noprof+0x150/0x660 [ 525.264391][T14580] ? sctp_add_bind_addr+0x8c/0x370 [ 525.264412][T14580] ? sctp_add_bind_addr+0x8c/0x370 [ 525.264442][T14580] sctp_add_bind_addr+0x8c/0x370 [ 525.264469][T14580] sctp_copy_local_addr_list+0x31a/0x4e0 [ 525.264495][T14580] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 525.264520][T14580] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 525.264545][T14580] ? sctp_v6_is_any+0x64/0x80 [ 525.264569][T14580] ? sctp_copy_one_addr+0x93/0x360 [ 525.264594][T14580] sctp_bind_addr_copy+0xb3/0x3c0 [ 525.264613][T14580] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 525.264632][T14580] sctp_connect_new_asoc+0x2ff/0x6b0 [ 525.264649][T14580] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 525.264669][T14580] ? __local_bh_enable_ip+0xd0/0x130 [ 525.264684][T14580] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 525.264698][T14580] ? security_sctp_bind_connect+0x7e/0x2c0 [ 525.264717][T14580] sctp_sendmsg+0x159b/0x2d00 [ 525.264742][T14580] ? __pfx_sctp_sendmsg+0x10/0x10 [ 525.264761][T14580] ? aa_sk_perm+0x6d5/0x900 [ 525.264788][T14580] ? sock_rps_record_flow+0x19/0x350 [ 525.264809][T14580] ? inet_sendmsg+0x298/0x320 [ 525.264832][T14580] ? __pfx_inet_sendmsg+0x10/0x10 [ 525.264850][T14580] sock_sendmsg_nosec+0x10e/0x180 [ 525.264870][T14580] ____sys_sendmsg+0x54e/0x850 [ 525.264887][T14580] ? __pfx_____sys_sendmsg+0x10/0x10 [ 525.264914][T14580] ? import_iovec+0x73/0xa0 [ 525.264934][T14580] ___sys_sendmsg+0x2a5/0x360 [ 525.264946][T14580] ? __lock_acquire+0x683/0x2cf0 [ 525.264967][T14580] ? __pfx____sys_sendmsg+0x10/0x10 [ 525.265006][T14580] ? __fget_files+0x2a/0x420 [ 525.265022][T14580] ? __fget_files+0x3a2/0x420 [ 525.265045][T14580] __x64_sys_sendmsg+0x1b1/0x290 [ 525.265060][T14580] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 525.265093][T14580] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.265108][T14580] do_syscall_64+0x174/0x580 [ 525.265122][T14580] ? trace_irq_disable+0x3b/0x140 [ 525.265138][T14580] ? clear_bhb_loop+0x40/0x90 [ 525.265154][T14580] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.265168][T14580] RIP: 0033:0x7faf3d39e0d9 [ 525.265181][T14580] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 525.265194][T14580] RSP: 002b:00007faf3e309028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 525.265209][T14580] RAX: ffffffffffffffda RBX: 00007faf3d625fa0 RCX: 00007faf3d39e0d9 [ 525.265219][T14580] RDX: 0000000000048043 RSI: 0000200000000800 RDI: 0000000000000004 [ 525.265228][T14580] RBP: 00007faf3e309090 R08: 0000000000000000 R09: 0000000000000000 [ 525.265236][T14580] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 525.265245][T14580] R13: 00007faf3d626038 R14: 00007faf3d625fa0 R15: 00007faf3d74fa48 [ 525.265267][T14580] [ 525.854275][ T5702] usb 3-1: new full-speed USB device number 89 using dummy_hcd [ 526.005842][ T5702] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 526.017671][ T5702] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 526.029529][ T5702] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 526.040979][ T5702] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 526.051508][ T5702] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 526.077189][ T5702] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 526.090467][ T5702] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 526.101761][ T5702] usb 3-1: Product: syz [ 526.122814][ T5702] usb 3-1: Manufacturer: syz [ 526.134385][ T5702] usb 3-1: SerialNumber: syz [ 526.155228][ T5702] usb 3-1: config 0 descriptor?? [ 526.189610][T14595] xt_hashlimit: size too large, truncated to 1048576 [ 526.214153][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 526.386567][ T5702] radio-si470x 3-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 526.393594][ T5702] radio-si470x 3-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 526.602257][ T5702] radio-si470x 3-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 526.619246][ T5702] radio-si470x 3-1:0.0: si470x_get_scratch: si470x_get_report returned -71 [ 526.649582][ T5702] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -5 [ 526.701451][ T5702] usb 3-1: USB disconnect, device number 89 [ 527.254150][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 527.268194][T14609] IPv6: NLM_F_CREATE should be specified when creating new route [ 527.276240][T14609] netlink: 6 bytes leftover after parsing attributes in process `syz.4.2675'. [ 527.395546][ T5611] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 527.417745][T14617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2678'. [ 527.427230][T14618] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2677'. [ 527.461026][T14617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2678'. [ 527.471747][T14619] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2678'. [ 527.485969][ T453] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 527.505171][ T453] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 527.513954][ T453] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 527.522939][ T453] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 527.543246][T14623] xt_hashlimit: size too large, truncated to 1048576 [ 527.551758][T14623] xt_hashlimit: invalid interval [ 527.599354][ T5611] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 527.612832][ T5611] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.623411][ T5611] usb 2-1: Product: syz [ 527.627789][ T5611] usb 2-1: Manufacturer: syz [ 527.632400][ T5611] usb 2-1: SerialNumber: syz [ 527.661879][T14628] xt_hashlimit: size too large, truncated to 1048576 [ 527.736698][ T5702] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 527.770237][ T5694] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 527.824309][ T24] usb 3-1: new full-speed USB device number 90 using dummy_hcd [ 527.904304][ T5702] usb 5-1: Using ep0 maxpacket: 8 [ 527.913757][ T5702] usb 5-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 527.923257][ T5702] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.931560][ T5702] usb 5-1: Product: syz [ 527.936504][ T5702] usb 5-1: Manufacturer: syz [ 527.941174][ T5702] usb 5-1: SerialNumber: syz [ 527.986256][ T24] usb 3-1: config 36 has an invalid descriptor of length 0, skipping remainder of the config [ 527.996814][ T24] usb 3-1: config 36 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 528.014538][ T24] usb 3-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 528.023825][ T24] usb 3-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 528.032179][ T24] usb 3-1: Manufacturer: syz [ 528.037120][ T24] usb 3-1: SerialNumber: syz [ 528.155626][T14621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 528.176350][T14621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.195039][ T5702] mxuport 5-1:254.0: mxuport_send_ctrl_data_urb - usb_control_msg failed (-71) [ 528.219934][ T5702] mxuport 5-1:254.0: mxuport_send_ctrl_data_urb - usb_control_msg failed (-71) [ 528.232822][T14637] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 528.238938][ T5702] mxuport 5-1:254.0: probe with driver mxuport failed with error -71 [ 528.245313][T14637] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.262449][ T5702] usb 5-1: USB disconnect, device number 100 [ 528.280854][ T24] usbhid 3-1:36.0: couldn't find an input interrupt endpoint [ 528.288585][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 528.303851][ T24] usb 3-1: USB disconnect, device number 90 [ 528.808876][T14644] openvswitch: netlink: Key 4 has unexpected len 4 expected 12 [ 528.836555][T14644] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2687'. [ 528.854766][ T5694] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 528.869494][ T5694] ath9k_htc: Failed to initialize the device [ 528.966296][ T5694] usb 2-1: ath9k_htc: USB layer deinitialized [ 528.969897][T14654] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2690'. [ 529.030979][T14656] FAULT_INJECTION: forcing a failure. [ 529.030979][T14656] name failslab, interval 1, probability 0, space 0, times 0 [ 529.044292][T14656] CPU: 1 UID: 0 PID: 14656 Comm: syz.0.2691 Tainted: G L syzkaller #0 PREEMPT(full) [ 529.044319][T14656] Tainted: [L]=SOFTLOCKUP [ 529.044326][T14656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 529.044335][T14656] Call Trace: [ 529.044343][T14656] [ 529.044350][T14656] dump_stack_lvl+0xe8/0x150 [ 529.044379][T14656] should_fail_ex+0x40c/0x560 [ 529.044411][T14656] should_failslab+0xa8/0x100 [ 529.044436][T14656] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 529.044458][T14656] ? __kernfs_new_node+0xe6/0x980 [ 529.044481][T14656] ? __kernfs_new_node+0xe6/0x980 [ 529.044509][T14656] __kernfs_new_node+0xe6/0x980 [ 529.044541][T14656] ? __pfx___kernfs_new_node+0x10/0x10 [ 529.044566][T14656] ? kernfs_root+0x1c/0x230 [ 529.044594][T14656] ? kernfs_root+0x1c/0x230 [ 529.044616][T14656] ? kernfs_root+0x1c/0x230 [ 529.044635][T14656] ? kernfs_root+0x1c/0x230 [ 529.044662][T14656] kernfs_new_node+0xea/0x140 [ 529.044689][T14656] __kernfs_create_file+0x4b/0x2e0 [ 529.044711][T14656] sysfs_add_file_mode_ns+0x237/0x300 [ 529.044740][T14656] sysfs_merge_group+0x183/0x320 [ 529.044766][T14656] ? __pfx_sysfs_merge_group+0x10/0x10 [ 529.044788][T14656] ? device_add_attrs+0x5c3/0x600 [ 529.044816][T14656] ? __pfx_device_add_attrs+0x10/0x10 [ 529.044838][T14656] ? kobject_put+0x50f/0x550 [ 529.044867][T14656] dpm_sysfs_add+0xd2/0x270 [ 529.044955][T14656] device_add+0x4ca/0xb80 [ 529.044983][T14656] input_register_device+0x9d7/0x1150 [ 529.045057][T14656] uinput_create_device+0x53e/0x690 [ 529.045149][T14656] uinput_ioctl_handler+0x433/0x15a0 [ 529.045178][T14656] ? __pfx_uinput_ioctl_handler+0x10/0x10 [ 529.045212][T14656] ? __fget_files+0x2a/0x420 [ 529.045240][T14656] ? __fget_files+0x3a2/0x420 [ 529.045264][T14656] ? bpf_lsm_file_ioctl+0x9/0x20 [ 529.045285][T14656] ? __pfx_uinput_ioctl+0x10/0x10 [ 529.045307][T14656] __se_sys_ioctl+0xfc/0x170 [ 529.045323][T14656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.045344][T14656] do_syscall_64+0x174/0x580 [ 529.045361][T14656] ? trace_irq_disable+0x3b/0x140 [ 529.045382][T14656] ? clear_bhb_loop+0x40/0x90 [ 529.045403][T14656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.045421][T14656] RIP: 0033:0x7faf3d39e0d9 [ 529.045437][T14656] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 529.045452][T14656] RSP: 002b:00007faf3e309028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 529.045472][T14656] RAX: ffffffffffffffda RBX: 00007faf3d625fa0 RCX: 00007faf3d39e0d9 [ 529.045484][T14656] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003 [ 529.045495][T14656] RBP: 00007faf3e309090 R08: 0000000000000000 R09: 0000000000000000 [ 529.045505][T14656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 529.045516][T14656] R13: 00007faf3d626038 R14: 00007faf3d625fa0 R15: 00007faf3d74fa48 [ 529.045545][T14656] [ 529.338994][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 529.366091][T14659] loop8: detected capacity change from 0 to 7 [ 529.373549][T14659] Dev loop8: unable to read RDB block 7 [ 529.379922][T14659] loop8: unable to read partition table [ 529.386423][T14659] loop8: partition table beyond EOD, truncated [ 529.392568][ T5694] usb 2-1: USB disconnect, device number 97 [ 529.393008][T14659] loop_reread_partitions: partition scan of loop8 (þ被xü^>æ) failed (rc=-5) [ 529.443360][T14661] FAULT_INJECTION: forcing a failure. [ 529.443360][T14661] name failslab, interval 1, probability 0, space 0, times 0 [ 529.457609][T14661] CPU: 1 UID: 0 PID: 14661 Comm: syz.2.2692 Tainted: G L syzkaller #0 PREEMPT(full) [ 529.457633][T14661] Tainted: [L]=SOFTLOCKUP [ 529.457639][T14661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 529.457648][T14661] Call Trace: [ 529.457655][T14661] [ 529.457662][T14661] dump_stack_lvl+0xe8/0x150 [ 529.457688][T14661] should_fail_ex+0x40c/0x560 [ 529.457716][T14661] should_failslab+0xa8/0x100 [ 529.457741][T14661] __kmalloc_cache_noprof+0xa8/0x660 [ 529.457762][T14661] ? fl_change+0x313/0x38d0 [ 529.457858][T14661] ? fl_change+0x313/0x38d0 [ 529.457879][T14661] fl_change+0x313/0x38d0 [ 529.457899][T14661] ? fl_get+0x9a/0x3b0 [ 529.457922][T14661] ? fl_get+0x9a/0x3b0 [ 529.457943][T14661] ? fl_get+0x9a/0x3b0 [ 529.457959][T14661] ? fl_get+0x9a/0x3b0 [ 529.457975][T14661] ? fl_get+0x9a/0x3b0 [ 529.457993][T14661] ? fl_get+0x336/0x3b0 [ 529.458029][T14661] ? __pfx_fl_change+0x10/0x10 [ 529.458046][T14661] ? fl_get+0x9a/0x3b0 [ 529.458064][T14661] ? __pfx_fl_get+0x10/0x10 [ 529.458089][T14661] tc_new_tfilter+0x10c4/0x1850 [ 529.458169][T14661] ? __pfx_tc_new_tfilter+0x10/0x10 [ 529.458210][T14661] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 529.458249][T14661] ? __pfx_tc_new_tfilter+0x10/0x10 [ 529.458267][T14661] rtnetlink_rcv_msg+0x802/0xc00 [ 529.458293][T14661] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 529.458315][T14661] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 529.458337][T14661] ? ref_tracker_free+0x689/0x830 [ 529.458359][T14661] ? __pfx_ref_tracker_free+0x10/0x10 [ 529.458378][T14661] ? __asan_memcpy+0x40/0x70 [ 529.458396][T14661] ? __skb_clone+0x5c/0x6c0 [ 529.458419][T14661] netlink_rcv_skb+0x226/0x4a0 [ 529.458438][T14661] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 529.458463][T14661] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 529.458491][T14661] ? netlink_deliver_tap+0x2e/0x1b0 [ 529.458508][T14661] ? netlink_deliver_tap+0x2e/0x1b0 [ 529.458530][T14661] netlink_unicast+0x7bb/0x940 [ 529.458564][T14661] netlink_sendmsg+0x813/0xb40 [ 529.458590][T14661] ? __pfx_netlink_sendmsg+0x10/0x10 [ 529.458612][T14661] ? aa_sock_msg_perm+0xf1/0x1b0 [ 529.458641][T14661] ? __pfx_netlink_sendmsg+0x10/0x10 [ 529.458657][T14661] sock_sendmsg_nosec+0x13a/0x180 [ 529.458681][T14661] ____sys_sendmsg+0x54e/0x850 [ 529.458703][T14661] ? __pfx_____sys_sendmsg+0x10/0x10 [ 529.458741][T14661] ? import_iovec+0x73/0xa0 [ 529.458767][T14661] ___sys_sendmsg+0x2a5/0x360 [ 529.458782][T14661] ? __lock_acquire+0x683/0x2cf0 [ 529.458808][T14661] ? __pfx____sys_sendmsg+0x10/0x10 [ 529.458858][T14661] ? __fget_files+0x2a/0x420 [ 529.458879][T14661] ? __fget_files+0x3a2/0x420 [ 529.458909][T14661] __x64_sys_sendmsg+0x1b1/0x290 [ 529.458929][T14661] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 529.458963][T14661] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.458982][T14661] do_syscall_64+0x174/0x580 [ 529.459000][T14661] ? trace_irq_disable+0x3b/0x140 [ 529.459021][T14661] ? clear_bhb_loop+0x40/0x90 [ 529.459043][T14661] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.459060][T14661] RIP: 0033:0x7f615b99e0d9 [ 529.459077][T14661] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 529.459092][T14661] RSP: 002b:00007f615c7da028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 529.459111][T14661] RAX: ffffffffffffffda RBX: 00007f615bc25fa0 RCX: 00007f615b99e0d9 [ 529.459124][T14661] RDX: 0000000020040014 RSI: 0000200000006040 RDI: 0000000000000004 [ 529.459136][T14661] RBP: 00007f615c7da090 R08: 0000000000000000 R09: 0000000000000000 [ 529.459147][T14661] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 529.459158][T14661] R13: 00007f615bc26038 R14: 00007f615bc25fa0 R15: 00007f615bd4fa48 [ 529.459192][T14661] [ 529.973262][T14667] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2698'. [ 530.043704][T14673] xt_CT: No such helper "snmp_trap" [ 530.286103][T14690] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2705'. [ 530.374171][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 530.631423][T14702] netlink: 148 bytes leftover after parsing attributes in process `syz.3.2709'. [ 530.701927][T14704] FAULT_INJECTION: forcing a failure. [ 530.701927][T14704] name failslab, interval 1, probability 0, space 0, times 0 [ 530.747609][T14704] CPU: 0 UID: 0 PID: 14704 Comm: syz.4.2710 Tainted: G L syzkaller #0 PREEMPT(full) [ 530.747628][T14704] Tainted: [L]=SOFTLOCKUP [ 530.747632][T14704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 530.747639][T14704] Call Trace: [ 530.747644][T14704] [ 530.747649][T14704] dump_stack_lvl+0xe8/0x150 [ 530.747668][T14704] should_fail_ex+0x40c/0x560 [ 530.747688][T14704] should_failslab+0xa8/0x100 [ 530.747704][T14704] __kmalloc_cache_noprof+0xa8/0x660 [ 530.747717][T14704] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 530.747732][T14704] ? __kmalloc_cache_noprof+0x150/0x660 [ 530.747743][T14704] ? sctp_add_bind_addr+0x8c/0x370 [ 530.747757][T14704] ? sctp_add_bind_addr+0x8c/0x370 [ 530.747773][T14704] sctp_add_bind_addr+0x8c/0x370 [ 530.747790][T14704] sctp_copy_local_addr_list+0x31a/0x4e0 [ 530.747805][T14704] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 530.747819][T14704] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 530.747834][T14704] ? sctp_v6_is_any+0x64/0x80 [ 530.747851][T14704] ? sctp_copy_one_addr+0x93/0x360 [ 530.747866][T14704] sctp_bind_addr_copy+0xb3/0x3c0 [ 530.747881][T14704] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 530.747895][T14704] sctp_connect_new_asoc+0x2ff/0x6b0 [ 530.747907][T14704] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 530.747922][T14704] ? __local_bh_enable_ip+0xd0/0x130 [ 530.747932][T14704] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 530.747943][T14704] ? security_sctp_bind_connect+0x7e/0x2c0 [ 530.747957][T14704] sctp_sendmsg+0x159b/0x2d00 [ 530.747975][T14704] ? __pfx_sctp_sendmsg+0x10/0x10 [ 530.747988][T14704] ? aa_sk_perm+0x6d5/0x900 [ 530.748005][T14704] ? __might_fault+0xaf/0x130 [ 530.748027][T14704] ? sock_rps_record_flow+0x19/0x350 [ 530.748044][T14704] ? inet_sendmsg+0x298/0x320 [ 530.748058][T14704] ? __pfx_inet_sendmsg+0x10/0x10 [ 530.748071][T14704] sock_sendmsg_nosec+0x10e/0x180 [ 530.748086][T14704] ____sys_sendmsg+0x54e/0x850 [ 530.748099][T14704] ? __pfx_____sys_sendmsg+0x10/0x10 [ 530.748119][T14704] ? import_iovec+0x73/0xa0 [ 530.748134][T14704] ___sys_sendmsg+0x2a5/0x360 [ 530.748143][T14704] ? __lock_acquire+0x683/0x2cf0 [ 530.748159][T14704] ? __pfx____sys_sendmsg+0x10/0x10 [ 530.748186][T14704] ? __fget_files+0x2a/0x420 [ 530.748199][T14704] ? __fget_files+0x3a2/0x420 [ 530.748216][T14704] __x64_sys_sendmsg+0x1b1/0x290 [ 530.748227][T14704] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 530.748245][T14704] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.748256][T14704] do_syscall_64+0x174/0x580 [ 530.748267][T14704] ? trace_irq_disable+0x3b/0x140 [ 530.748279][T14704] ? clear_bhb_loop+0x40/0x90 [ 530.748291][T14704] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.748301][T14704] RIP: 0033:0x7ff81919e0d9 [ 530.748312][T14704] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 530.748320][T14704] RSP: 002b:00007ff819fe2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 530.748331][T14704] RAX: ffffffffffffffda RBX: 00007ff819425fa0 RCX: 00007ff81919e0d9 [ 530.748338][T14704] RDX: 0000000024000052 RSI: 0000200000000140 RDI: 0000000000000003 [ 530.748345][T14704] RBP: 00007ff819fe2090 R08: 0000000000000000 R09: 0000000000000000 [ 530.748351][T14704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 530.748357][T14704] R13: 00007ff819426038 R14: 00007ff819425fa0 R15: 00007ff81954fa48 [ 530.748373][T14704] [ 530.814329][ T5694] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 531.017884][T14706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 531.170823][T14711] FAULT_INJECTION: forcing a failure. [ 531.170823][T14711] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 531.197459][T14711] CPU: 0 UID: 0 PID: 14711 Comm: syz.4.2713 Tainted: G L syzkaller #0 PREEMPT(full) [ 531.197492][T14711] Tainted: [L]=SOFTLOCKUP [ 531.197498][T14711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 531.197509][T14711] Call Trace: [ 531.197516][T14711] [ 531.197524][T14711] dump_stack_lvl+0xe8/0x150 [ 531.197553][T14711] should_fail_ex+0x40c/0x560 [ 531.197585][T14711] _copy_to_iter+0x1e4/0x1810 [ 531.197612][T14711] ? __asan_memset+0x22/0x50 [ 531.197637][T14711] ? __pfx__copy_to_iter+0x10/0x10 [ 531.197661][T14711] ? lockdep_hardirqs_on+0x7a/0x110 [ 531.197680][T14711] ? crng_make_state+0x36a/0x600 [ 531.197701][T14711] ? crng_make_state+0xb6/0x600 [ 531.197723][T14711] get_random_bytes_user+0x1d0/0x3d0 [ 531.197746][T14711] ? __pfx_get_random_bytes_user+0x10/0x10 [ 531.197773][T14711] ? __mutex_unlock_slowpath+0x731/0x900 [ 531.197802][T14711] ? import_ubuf+0xfb/0x1d0 [ 531.197826][T14711] __x64_sys_getrandom+0x17a/0x270 [ 531.197860][T14711] ? __pfx___x64_sys_getrandom+0x10/0x10 [ 531.197878][T14711] ? ksys_write+0x242/0x270 [ 531.197905][T14711] ? __pfx_ksys_write+0x10/0x10 [ 531.197936][T14711] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.197956][T14711] do_syscall_64+0x174/0x580 [ 531.197974][T14711] ? trace_irq_disable+0x3b/0x140 [ 531.197995][T14711] ? clear_bhb_loop+0x40/0x90 [ 531.198017][T14711] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.198035][T14711] RIP: 0033:0x7ff81919e0d9 [ 531.198052][T14711] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 531.198067][T14711] RSP: 002b:00007ff819fe2028 EFLAGS: 00000246 ORIG_RAX: 000000000000013e [ 531.198086][T14711] RAX: ffffffffffffffda RBX: 00007ff819425fa0 RCX: 00007ff81919e0d9 [ 531.198100][T14711] RDX: 0000000000000000 RSI: 00000000ffffff9a RDI: 0000200000000240 [ 531.198112][T14711] RBP: 00007ff819fe2090 R08: 0000000000000000 R09: 0000000000000000 [ 531.198124][T14711] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 531.198136][T14711] R13: 00007ff819426038 R14: 00007ff819425fa0 R15: 00007ff81954fa48 [ 531.198164][T14711] [ 531.415384][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 531.471446][T14706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 531.690130][T14723] ip_tables: iptables: counters copy to user failed while replacing table [ 531.692279][ T5694] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 531.727670][ T5694] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.744160][ T5694] usb 2-1: Product: syz [ 531.748477][ T5694] usb 2-1: Manufacturer: syz [ 531.775635][ T5694] usb 2-1: SerialNumber: syz [ 531.829226][ T24] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 531.885154][T14727] netlink: 'syz.4.2718': attribute type 10 has an invalid length. [ 531.903503][T14727] dummy0: entered promiscuous mode [ 531.914777][T14727] bridge0: port 1(dummy0) entered blocking state [ 531.934174][T14727] bridge0: port 1(dummy0) entered disabled state [ 531.954907][T14727] dummy0: entered allmulticast mode [ 532.012987][T14727] bridge0: port 1(dummy0) entered blocking state [ 532.019564][T14727] bridge0: port 1(dummy0) entered forwarding state [ 532.155910][T14734] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 532.172979][T14734] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 532.444215][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 532.456660][T14743] geneve3: entered promiscuous mode [ 532.639604][T14748] ipvlan0: entered promiscuous mode [ 532.652674][T14748] ipvlan0: left promiscuous mode [ 533.140657][T14757] ip_tables: iptables: counters copy to user failed while replacing table [ 533.244215][ T24] usb 2-1: Service connection timeout for: 256 [ 533.251134][ T24] ath9k_htc 2-1:1.0: ath9k_htc: Unable to initialize HTC services [ 533.304331][ T24] ath9k_htc: Failed to initialize the device [ 533.375825][ T24] usb 2-1: ath9k_htc: USB layer deinitialized [ 533.485103][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 533.640409][ T10] usb 2-1: USB disconnect, device number 98 [ 534.024241][ T24] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 534.216019][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 534.236320][ T24] usb 3-1: config 2 has an invalid interface number: 194 but max is 0 [ 534.253006][ T24] usb 3-1: config 2 has no interface number 0 [ 534.270779][ T24] usb 3-1: config 2 interface 194 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 833 [ 534.298506][ T24] usb 3-1: config 2 interface 194 altsetting 0 endpoint 0xA has invalid maxpacket 1584, setting to 1024 [ 534.328161][ T24] usb 3-1: config 2 interface 194 altsetting 0 endpoint 0x8 has invalid maxpacket 26565, setting to 1024 [ 534.364954][ T24] usb 3-1: config 2 interface 194 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1024 [ 534.396378][ T24] usb 3-1: New USB device found, idVendor=0499, idProduct=1025, bcdDevice=9c.f6 [ 534.440643][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 534.466393][T14771] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 534.478266][T14771] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 534.503268][T14771] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 534.524313][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 534.715282][ T24] usb 3-1: string descriptor 0 read error: -71 [ 534.736876][ T24] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 534.869937][ T24] usb 3-1: USB disconnect, device number 91 [ 535.301061][T14788] netlink: 'syz.0.2739': attribute type 4 has an invalid length. [ 535.564143][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 535.696635][T14795] FAULT_INJECTION: forcing a failure. [ 535.696635][T14795] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 535.742456][T14795] CPU: 0 UID: 0 PID: 14795 Comm: syz.2.2742 Tainted: G L syzkaller #0 PREEMPT(full) [ 535.742489][T14795] Tainted: [L]=SOFTLOCKUP [ 535.742495][T14795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 535.742506][T14795] Call Trace: [ 535.742514][T14795] [ 535.742522][T14795] dump_stack_lvl+0xe8/0x150 [ 535.742552][T14795] should_fail_ex+0x40c/0x560 [ 535.742591][T14795] _copy_from_user+0x2d/0xb0 [ 535.742615][T14795] snd_seq_oss_write+0x6e2/0x950 [ 535.742734][T14795] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 535.742752][T14795] ? apparmor_file_permission+0x1f4/0x300 [ 535.742771][T14795] ? security_file_permission+0x75/0x260 [ 535.742789][T14795] odev_write+0x5a/0x80 [ 535.742802][T14795] ? __pfx_odev_write+0x10/0x10 [ 535.742814][T14795] vfs_write+0x296/0xba0 [ 535.742839][T14795] ? __pfx_vfs_write+0x10/0x10 [ 535.742858][T14795] ? __fget_files+0x2a/0x420 [ 535.742877][T14795] ? __fget_files+0x2a/0x420 [ 535.742892][T14795] ? __fget_files+0x3a2/0x420 [ 535.742907][T14795] ? __fget_files+0x2a/0x420 [ 535.742928][T14795] ksys_write+0x150/0x270 [ 535.742949][T14795] ? __pfx_ksys_write+0x10/0x10 [ 535.742974][T14795] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.742989][T14795] do_syscall_64+0x174/0x580 [ 535.743004][T14795] ? trace_irq_disable+0x3b/0x140 [ 535.743022][T14795] ? clear_bhb_loop+0x40/0x90 [ 535.743039][T14795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.743053][T14795] RIP: 0033:0x7f615b99e0d9 [ 535.743070][T14795] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.743083][T14795] RSP: 002b:00007f615c7da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 535.743099][T14795] RAX: ffffffffffffffda RBX: 00007f615bc25fa0 RCX: 00007f615b99e0d9 [ 535.743110][T14795] RDX: 000000000000020e RSI: 0000200000000580 RDI: 0000000000000003 [ 535.743119][T14795] RBP: 00007f615c7da090 R08: 0000000000000000 R09: 0000000000000000 [ 535.743128][T14795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 535.743136][T14795] R13: 00007f615bc26038 R14: 00007f615bc25fa0 R15: 00007f615bd4fa48 [ 535.743161][T14795] [ 535.962001][T14793] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 536.277886][T14799] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 536.293359][T14801] FAULT_INJECTION: forcing a failure. [ 536.293359][T14801] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 536.314219][T14799] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 536.322821][T14801] CPU: 0 UID: 0 PID: 14801 Comm: syz.2.2745 Tainted: G L syzkaller #0 PREEMPT(full) [ 536.322847][T14801] Tainted: [L]=SOFTLOCKUP [ 536.322854][T14801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 536.322864][T14801] Call Trace: [ 536.322871][T14801] [ 536.322879][T14801] dump_stack_lvl+0xe8/0x150 [ 536.322911][T14801] should_fail_ex+0x40c/0x560 [ 536.322941][T14801] _copy_from_user+0x2d/0xb0 [ 536.322962][T14801] ___sys_sendmsg+0x1c6/0x360 [ 536.322979][T14801] ? __lock_acquire+0x683/0x2cf0 [ 536.323005][T14801] ? __pfx____sys_sendmsg+0x10/0x10 [ 536.323057][T14801] ? __fget_files+0x2a/0x420 [ 536.323078][T14801] ? __fget_files+0x3a2/0x420 [ 536.323107][T14801] __x64_sys_sendmsg+0x1b1/0x290 [ 536.323127][T14801] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 536.323158][T14801] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.323178][T14801] do_syscall_64+0x174/0x580 [ 536.323196][T14801] ? trace_irq_disable+0x3b/0x140 [ 536.323216][T14801] ? clear_bhb_loop+0x40/0x90 [ 536.323236][T14801] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.323251][T14801] RIP: 0033:0x7f615b99e0d9 [ 536.323262][T14801] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 536.323271][T14801] RSP: 002b:00007f615c7da028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 536.323283][T14801] RAX: ffffffffffffffda RBX: 00007f615bc25fa0 RCX: 00007f615b99e0d9 [ 536.323295][T14801] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 536.323305][T14801] RBP: 00007f615c7da090 R08: 0000000000000000 R09: 0000000000000000 [ 536.323315][T14801] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 536.323327][T14801] R13: 00007f615bc26038 R14: 00007f615bc25fa0 R15: 00007f615bd4fa48 [ 536.323350][T14801] [ 536.604137][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 536.641682][T14806] netlink: 'syz.2.2747': attribute type 1 has an invalid length. [ 536.685685][T14806] bond5: entered promiscuous mode [ 536.709551][T14806] 8021q: adding VLAN 0 to HW filter on device bond5 [ 536.719775][T14818] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 536.739721][T14807] ipvlan2: entered allmulticast mode [ 536.743152][T14818] FAULT_INJECTION: forcing a failure. [ 536.743152][T14818] name failslab, interval 1, probability 0, space 0, times 0 [ 536.745088][T14807] bond5: entered allmulticast mode [ 536.768909][T14818] CPU: 0 UID: 0 PID: 14818 Comm: syz.3.2751 Tainted: G L syzkaller #0 PREEMPT(full) [ 536.768937][T14818] Tainted: [L]=SOFTLOCKUP [ 536.768943][T14818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 536.768952][T14818] Call Trace: [ 536.768960][T14818] [ 536.768967][T14818] dump_stack_lvl+0xe8/0x150 [ 536.768995][T14818] should_fail_ex+0x40c/0x560 [ 536.769026][T14818] should_failslab+0xa8/0x100 [ 536.769051][T14818] __kmalloc_cache_noprof+0xa8/0x660 [ 536.769069][T14818] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 536.769091][T14818] ? __kmalloc_cache_noprof+0x150/0x660 [ 536.769109][T14818] ? sctp_add_bind_addr+0x8c/0x370 [ 536.769131][T14818] ? sctp_add_bind_addr+0x8c/0x370 [ 536.769159][T14818] sctp_add_bind_addr+0x8c/0x370 [ 536.769186][T14818] sctp_copy_local_addr_list+0x31a/0x4e0 [ 536.769209][T14818] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 536.769232][T14818] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 536.769255][T14818] ? sctp_v6_is_any+0x64/0x80 [ 536.769280][T14818] ? sctp_copy_one_addr+0x93/0x360 [ 536.769305][T14818] sctp_bind_addr_copy+0xb3/0x3c0 [ 536.769329][T14818] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 536.769354][T14818] sctp_connect_new_asoc+0x2ff/0x6b0 [ 536.769385][T14818] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 536.769411][T14818] ? __local_bh_enable_ip+0xd0/0x130 [ 536.769430][T14818] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 536.769448][T14818] ? security_sctp_bind_connect+0x7e/0x2c0 [ 536.769476][T14818] sctp_sendmsg+0x159b/0x2d00 [ 536.769505][T14818] ? __pfx_sctp_sendmsg+0x10/0x10 [ 536.769528][T14818] ? aa_sk_perm+0x6d5/0x900 [ 536.769555][T14818] ? __might_fault+0xaf/0x130 [ 536.769578][T14818] ? sock_rps_record_flow+0x19/0x350 [ 536.769604][T14818] ? inet_sendmsg+0x298/0x320 [ 536.769629][T14818] ? __pfx_inet_sendmsg+0x10/0x10 [ 536.769651][T14818] sock_sendmsg_nosec+0x10e/0x180 [ 536.769675][T14818] __sys_sendto+0x408/0x5a0 [ 536.769695][T14818] ? ksys_write+0x1e6/0x270 [ 536.769723][T14818] ? __pfx___sys_sendto+0x10/0x10 [ 536.769745][T14818] ? __mutex_unlock_slowpath+0x731/0x900 [ 536.769790][T14818] ? __pfx_ksys_write+0x10/0x10 [ 536.769819][T14818] __x64_sys_sendto+0xde/0x100 [ 536.769843][T14818] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.769861][T14818] do_syscall_64+0x174/0x580 [ 536.769877][T14818] ? trace_irq_disable+0x3b/0x140 [ 536.769897][T14818] ? clear_bhb_loop+0x40/0x90 [ 536.769916][T14818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.769932][T14818] RIP: 0033:0x7f5507f9e0d9 [ 536.769948][T14818] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 536.769961][T14818] RSP: 002b:00007f5508f22028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 536.769979][T14818] RAX: ffffffffffffffda RBX: 00007f5508225fa0 RCX: 00007f5507f9e0d9 [ 536.769992][T14818] RDX: 0000000000000001 RSI: 00002000000003c0 RDI: 0000000000000007 [ 536.770002][T14818] RBP: 00007f5508f22090 R08: 0000200000000480 R09: 000000000000001c [ 536.770012][T14818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 536.770023][T14818] R13: 00007f5508226038 R14: 00007f5508225fa0 R15: 00007f550834fa48 [ 536.770050][T14818] [ 537.147901][T14806] ipvlan3: entered allmulticast mode [ 537.502023][T14807] bond5: (slave bridge2): making interface the new active one [ 537.519144][T14807] bridge2: entered promiscuous mode [ 537.528369][T14807] bridge2: entered allmulticast mode [ 537.541238][T14807] bond5: (slave bridge2): Enslaving as an active interface with an up link [ 537.644083][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 537.847029][T14835] syzkaller1: entered allmulticast mode [ 537.903670][ T29] kauditd_printk_skb: 11 callbacks suppressed [ 537.903685][ T29] audit: type=1326 audit(1786061245.601:3160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14837 comm="syz.1.2756" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f78c179e0d9 code=0x0 [ 537.958629][T14842] __nla_validate_parse: 1 callbacks suppressed [ 537.958647][T14842] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2756'. [ 538.041271][T14844] xt_CT: You must specify a L4 protocol and not use inversions on it [ 538.096040][T14848] FAULT_INJECTION: forcing a failure. [ 538.096040][T14848] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 538.111558][T14848] CPU: 0 UID: 0 PID: 14848 Comm: syz.3.2760 Tainted: G L syzkaller #0 PREEMPT(full) [ 538.111575][T14848] Tainted: [L]=SOFTLOCKUP [ 538.111579][T14848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 538.111585][T14848] Call Trace: [ 538.111590][T14848] [ 538.111594][T14848] dump_stack_lvl+0xe8/0x150 [ 538.111614][T14848] should_fail_ex+0x40c/0x560 [ 538.111635][T14848] _copy_from_user+0x2d/0xb0 [ 538.111649][T14848] kstrtouint_from_user+0xd6/0x180 [ 538.111662][T14848] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 538.111680][T14848] proc_fail_nth_write+0x8e/0x210 [ 538.111696][T14848] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 538.111714][T14848] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 538.111727][T14848] vfs_write+0x296/0xba0 [ 538.111747][T14848] ? __pfx_vfs_write+0x10/0x10 [ 538.111762][T14848] ? __fget_files+0x2a/0x420 [ 538.111777][T14848] ? __fget_files+0x3a2/0x420 [ 538.111789][T14848] ? __fget_files+0x2a/0x420 [ 538.111805][T14848] ksys_write+0x150/0x270 [ 538.111821][T14848] ? __pfx_ksys_write+0x10/0x10 [ 538.111840][T14848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.111853][T14848] do_syscall_64+0x174/0x580 [ 538.111864][T14848] ? trace_irq_disable+0x3b/0x140 [ 538.111877][T14848] ? clear_bhb_loop+0x40/0x90 [ 538.111889][T14848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.111899][T14848] RIP: 0033:0x7f5507f5e90e [ 538.111909][T14848] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 538.111918][T14848] RSP: 002b:00007f5508f21fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 538.111929][T14848] RAX: ffffffffffffffda RBX: 00007f5508f226c0 RCX: 00007f5507f5e90e [ 538.111937][T14848] RDX: 0000000000000001 RSI: 00007f5508f220a0 RDI: 0000000000000004 [ 538.111943][T14848] RBP: 00007f5508f22090 R08: 0000000000000000 R09: 0000000000000000 [ 538.111949][T14848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 538.111954][T14848] R13: 00007f5508226038 R14: 00007f5508225fa0 R15: 00007f550834fa48 [ 538.111969][T14848] [ 538.347377][T14850] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 538.396700][T14852] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 538.454739][ T10] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 538.462962][ T191] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 538.495992][T14854] team0: Port device syz_tun added [ 538.628850][ T191] usb 2-1: New USB device found, idVendor=041e, idProduct=3f19, bcdDevice= 0.40 [ 538.650098][T14860] tipc: Failed to remove unknown binding: 66,0,0/0:482864920/482864922 [ 538.658451][ T191] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 538.678741][ T191] usb 2-1: Product: syz [ 538.681169][T14862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.691502][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 538.694368][ T191] usb 2-1: Manufacturer: syz [ 538.712772][T14860] tipc: Failed to remove unknown binding: 66,0,0/0:482864920/482864921 [ 538.726087][ T191] usb 2-1: SerialNumber: syz [ 538.747420][T14860] tipc: Failed to remove unknown binding: 66,0,0/0:482864920/482864922 [ 538.765034][T14862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.772967][T14860] tipc: Failed to remove unknown binding: 66,0,0/0:482864920/482864921 [ 538.808906][T14862] autofs4:pid:14862:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(0.0), cmd(0xc0189371) [ 538.843810][T14869] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2768'. [ 538.874191][T14862] autofs4:pid:14862:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc0189371) [ 538.942802][T14871] netlink: 'syz.3.2769': attribute type 1 has an invalid length. [ 538.971846][T14871] netlink: 'syz.3.2769': attribute type 2 has an invalid length. [ 538.999039][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 539.014842][ T10] usb 5-1: no configurations [ 539.023223][T14871] netlink: 244 bytes leftover after parsing attributes in process `syz.3.2769'. [ 539.036980][ T10] usb 5-1: can't read configurations, error -22 [ 539.720747][T14898] FAULT_INJECTION: forcing a failure. [ 539.720747][T14898] name failslab, interval 1, probability 0, space 0, times 0 [ 539.726581][ T0] NOHZ tick-stop error: local softirq work is pending, handler #182!!! [ 539.733524][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 539.762303][T14898] CPU: 1 UID: 0 PID: 14898 Comm: syz.4.2779 Tainted: G L syzkaller #0 PREEMPT(full) [ 539.762330][T14898] Tainted: [L]=SOFTLOCKUP [ 539.762336][T14898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 539.762345][T14898] Call Trace: [ 539.762352][T14898] [ 539.762358][T14898] dump_stack_lvl+0xe8/0x150 [ 539.762385][T14898] should_fail_ex+0x40c/0x560 [ 539.762417][T14898] should_failslab+0xa8/0x100 [ 539.762441][T14898] __kmalloc_cache_noprof+0xa8/0x660 [ 539.762463][T14898] ? __kmalloc_cache_noprof+0x150/0x660 [ 539.762481][T14898] ? sctp_add_bind_addr+0x8c/0x370 [ 539.762505][T14898] ? sctp_add_bind_addr+0x8c/0x370 [ 539.762541][T14898] sctp_add_bind_addr+0x8c/0x370 [ 539.762564][T14898] sctp_copy_local_addr_list+0x31a/0x4e0 [ 539.762588][T14898] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 539.762611][T14898] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 539.762636][T14898] ? sctp_v6_is_any+0x64/0x80 [ 539.762661][T14898] ? sctp_copy_one_addr+0x93/0x360 [ 539.762687][T14898] sctp_bind_addr_copy+0xb3/0x3c0 [ 539.762712][T14898] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 539.762735][T14898] sctp_connect_new_asoc+0x2ff/0x6b0 [ 539.762758][T14898] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 539.762784][T14898] ? __local_bh_enable_ip+0xd0/0x130 [ 539.762801][T14898] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 539.762820][T14898] ? security_sctp_bind_connect+0x7e/0x2c0 [ 539.762843][T14898] sctp_sendmsg+0x159b/0x2d00 [ 539.762874][T14898] ? __pfx_sctp_sendmsg+0x10/0x10 [ 539.762897][T14898] ? aa_sk_perm+0x6d5/0x900 [ 539.762928][T14898] ? sock_rps_record_flow+0x19/0x350 [ 539.762953][T14898] ? inet_sendmsg+0x298/0x320 [ 539.762978][T14898] ? __pfx_inet_sendmsg+0x10/0x10 [ 539.762999][T14898] sock_sendmsg_nosec+0x10e/0x180 [ 539.763023][T14898] ____sys_sendmsg+0x54e/0x850 [ 539.763044][T14898] ? __pfx_____sys_sendmsg+0x10/0x10 [ 539.763079][T14898] ? import_iovec+0x73/0xa0 [ 539.763104][T14898] ___sys_sendmsg+0x2a5/0x360 [ 539.763120][T14898] ? __lock_acquire+0x683/0x2cf0 [ 539.763146][T14898] ? __pfx____sys_sendmsg+0x10/0x10 [ 539.763197][T14898] ? __fget_files+0x2a/0x420 [ 539.763217][T14898] ? __fget_files+0x3a2/0x420 [ 539.763245][T14898] __x64_sys_sendmsg+0x1b1/0x290 [ 539.763265][T14898] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 539.763297][T14898] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.763316][T14898] do_syscall_64+0x174/0x580 [ 539.763333][T14898] ? trace_irq_disable+0x3b/0x140 [ 539.763354][T14898] ? clear_bhb_loop+0x40/0x90 [ 539.763376][T14898] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.763393][T14898] RIP: 0033:0x7ff81919e0d9 [ 539.763411][T14898] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 539.763425][T14898] RSP: 002b:00007ff819fe2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 539.763444][T14898] RAX: ffffffffffffffda RBX: 00007ff819425fa0 RCX: 00007ff81919e0d9 [ 539.763457][T14898] RDX: 0000000000048043 RSI: 0000200000000800 RDI: 0000000000000004 [ 539.763468][T14898] RBP: 00007ff819fe2090 R08: 0000000000000000 R09: 0000000000000000 [ 539.763479][T14898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 539.763489][T14898] R13: 00007ff819426038 R14: 00007ff819425fa0 R15: 00007ff81954fa48 [ 539.763518][T14898] [ 540.400114][T14892] bond3: option resend_igmp: invalid value (2878) [ 540.406649][T14892] bond3: option resend_igmp: allowed values 0 - 255 [ 540.638389][T14892] bond3 (unregistering): Released all slaves [ 540.774126][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 540.801536][T14908] netlink: 6 bytes leftover after parsing attributes in process `syz.2.2783'. [ 540.945778][ T191] usb 2-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 540.982148][ T191] usb 2-1: 1:1 : invalid channels 0 [ 541.026967][ T191] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 541.103952][T14910] FAULT_INJECTION: forcing a failure. [ 541.103952][T14910] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 541.124381][T14910] CPU: 1 UID: 0 PID: 14910 Comm: syz.1.2786 Tainted: G L syzkaller #0 PREEMPT(full) [ 541.124410][T14910] Tainted: [L]=SOFTLOCKUP [ 541.124416][T14910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 541.124425][T14910] Call Trace: [ 541.124431][T14910] [ 541.124437][T14910] dump_stack_lvl+0xe8/0x150 [ 541.124465][T14910] should_fail_ex+0x40c/0x560 [ 541.124495][T14910] _copy_from_user+0x2d/0xb0 [ 541.124517][T14910] ___sys_sendmsg+0x1c6/0x360 [ 541.124538][T14910] ? __pfx____sys_sendmsg+0x10/0x10 [ 541.124552][T14910] ? __lock_acquire+0x683/0x2cf0 [ 541.124611][T14910] __sys_sendmmsg+0x273/0x4d0 [ 541.124632][T14910] ? __pfx___sys_sendmmsg+0x10/0x10 [ 541.124656][T14910] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 541.124686][T14910] ? ksys_write+0x242/0x270 [ 541.124712][T14910] ? __pfx_ksys_write+0x10/0x10 [ 541.124737][T14910] __x64_sys_sendmmsg+0xa0/0xc0 [ 541.124752][T14910] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.124768][T14910] do_syscall_64+0x174/0x580 [ 541.124784][T14910] ? trace_irq_disable+0x3b/0x140 [ 541.124805][T14910] ? clear_bhb_loop+0x40/0x90 [ 541.124825][T14910] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.124842][T14910] RIP: 0033:0x7f78c179e0d9 [ 541.124860][T14910] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 541.124873][T14910] RSP: 002b:00007f78c2580028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 541.124891][T14910] RAX: ffffffffffffffda RBX: 00007f78c1a25fa0 RCX: 00007f78c179e0d9 [ 541.124904][T14910] RDX: 0000000000000299 RSI: 0000200000003dc0 RDI: 0000000000000004 [ 541.124926][T14910] RBP: 00007f78c2580090 R08: 0000000000000000 R09: 0000000000000000 [ 541.124936][T14910] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 541.124947][T14910] R13: 00007f78c1a26038 R14: 00007f78c1a25fa0 R15: 00007f78c1b4fa48 [ 541.124974][T14910] [ 541.409441][ T191] usb 2-1: USB disconnect, device number 99 [ 541.802397][T14927] bond0: entered promiscuous mode [ 541.805673][T14927] bond0: left promiscuous mode [ 541.814170][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 541.974107][ T5702] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 542.134286][ T5702] usb 3-1: Using ep0 maxpacket: 32 [ 542.151968][ T5702] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 542.175725][ T5702] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 542.199551][ T5702] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 542.246350][ T5702] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 542.298345][ T5702] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.360769][ T5702] usb 3-1: config 0 descriptor?? [ 542.831236][ T5702] usbhid 3-1:0.0: can't add hid device: -71 [ 542.844089][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 542.882548][ T5702] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 542.950055][ T5702] usb 3-1: USB disconnect, device number 92 [ 543.507885][T14959] FAULT_INJECTION: forcing a failure. [ 543.507885][T14959] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 543.568592][ T30] INFO: task kworker/1:6:5670 blocked for more than 143 seconds. [ 543.591585][ T30] Tainted: G L syzkaller #0 [ 543.606857][T14959] CPU: 1 UID: 0 PID: 14959 Comm: syz.4.2797 Tainted: G L syzkaller #0 PREEMPT(full) [ 543.606885][T14959] Tainted: [L]=SOFTLOCKUP [ 543.606892][T14959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 543.606902][T14959] Call Trace: [ 543.606909][T14959] [ 543.606917][T14959] dump_stack_lvl+0xe8/0x150 [ 543.606945][T14959] should_fail_ex+0x40c/0x560 [ 543.606977][T14959] _copy_from_user+0x2d/0xb0 [ 543.607000][T14959] ___sys_sendmsg+0x1c6/0x360 [ 543.607023][T14959] ? __pfx____sys_sendmsg+0x10/0x10 [ 543.607039][T14959] ? __lock_acquire+0x683/0x2cf0 [ 543.607105][T14959] __sys_sendmmsg+0x273/0x4d0 [ 543.607127][T14959] ? __pfx___sys_sendmmsg+0x10/0x10 [ 543.607152][T14959] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 543.607183][T14959] ? ksys_write+0x242/0x270 [ 543.607210][T14959] ? __pfx_ksys_write+0x10/0x10 [ 543.607239][T14959] __x64_sys_sendmmsg+0xa0/0xc0 [ 543.607256][T14959] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.607275][T14959] do_syscall_64+0x174/0x580 [ 543.607291][T14959] ? trace_irq_disable+0x3b/0x140 [ 543.607311][T14959] ? clear_bhb_loop+0x40/0x90 [ 543.607333][T14959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.607350][T14959] RIP: 0033:0x7ff81919e0d9 [ 543.607365][T14959] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.607379][T14959] RSP: 002b:00007ff819fe2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 543.607398][T14959] RAX: ffffffffffffffda RBX: 00007ff819425fa0 RCX: 00007ff81919e0d9 [ 543.607411][T14959] RDX: 0000000000000299 RSI: 0000200000003dc0 RDI: 0000000000000004 [ 543.607423][T14959] RBP: 00007ff819fe2090 R08: 0000000000000000 R09: 0000000000000000 [ 543.607434][T14959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 543.607445][T14959] R13: 00007ff819426038 R14: 00007ff819425fa0 R15: 00007ff81954fa48 [ 543.607473][T14959] [ 543.612214][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 543.831964][T14962] FAULT_INJECTION: forcing a failure. [ 543.831964][T14962] name failslab, interval 1, probability 0, space 0, times 0 [ 543.844834][T14962] CPU: 0 UID: 0 PID: 14962 Comm: syz.1.2799 Tainted: G L syzkaller #0 PREEMPT(full) [ 543.844851][T14962] Tainted: [L]=SOFTLOCKUP [ 543.844855][T14962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 543.844862][T14962] Call Trace: [ 543.844866][T14962] [ 543.844871][T14962] dump_stack_lvl+0xe8/0x150 [ 543.844891][T14962] should_fail_ex+0x40c/0x560 [ 543.844911][T14962] should_failslab+0xa8/0x100 [ 543.844926][T14962] __kmalloc_cache_noprof+0xa8/0x660 [ 543.844939][T14962] ? __kmalloc_cache_noprof+0x150/0x660 [ 543.844950][T14962] ? nft_netdev_hook_alloc+0x246/0x5a0 [ 543.844961][T14962] ? nft_netdev_hook_alloc+0x246/0x5a0 [ 543.844974][T14962] nft_netdev_hook_alloc+0x246/0x5a0 [ 543.844988][T14962] nf_tables_parse_netdev_hooks+0x14c/0xa10 [ 543.845003][T14962] nft_flowtable_parse_hook+0x551/0xab0 [ 543.845075][T14962] ? __pfx_nft_flowtable_parse_hook+0x10/0x10 [ 543.845088][T14962] ? nft_pernet+0x23/0x240 [ 543.845103][T14962] ? nft_pernet+0x23/0x240 [ 543.845119][T14962] nf_tables_delflowtable+0xa79/0x1ad0 [ 543.845141][T14962] ? __pfx_nf_tables_delflowtable+0x10/0x10 [ 543.845157][T14962] ? nfnl_pernet+0x23/0x240 [ 543.845179][T14962] ? __nla_parse+0x40/0x60 [ 543.845192][T14962] nfnetlink_rcv+0x1288/0x28c0 [ 543.845223][T14962] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 543.845244][T14962] ? ref_tracker_free+0x689/0x830 [ 543.845267][T14962] ? skb_clone+0x246/0x3a0 [ 543.845279][T14962] ? __netlink_deliver_tap+0x811/0x860 [ 543.845293][T14962] ? netlink_deliver_tap+0x2e/0x1b0 [ 543.845302][T14962] ? netlink_deliver_tap+0x2e/0x1b0 [ 543.845314][T14962] netlink_unicast+0x7bb/0x940 [ 543.845334][T14962] netlink_sendmsg+0x813/0xb40 [ 543.845348][T14962] ? __pfx_netlink_sendmsg+0x10/0x10 [ 543.845360][T14962] ? aa_sock_msg_perm+0xf1/0x1b0 [ 543.845377][T14962] ? __pfx_netlink_sendmsg+0x10/0x10 [ 543.845386][T14962] sock_sendmsg_nosec+0x13a/0x180 [ 543.845401][T14962] ____sys_sendmsg+0x54e/0x850 [ 543.845415][T14962] ? __pfx_____sys_sendmsg+0x10/0x10 [ 543.845445][T14962] ? import_iovec+0x73/0xa0 [ 543.845469][T14962] ___sys_sendmsg+0x2a5/0x360 [ 543.845488][T14962] ? __lock_acquire+0x683/0x2cf0 [ 543.845513][T14962] ? __pfx____sys_sendmsg+0x10/0x10 [ 543.845559][T14962] ? __fget_files+0x2a/0x420 [ 543.845580][T14962] ? __fget_files+0x3a2/0x420 [ 543.845607][T14962] __x64_sys_sendmsg+0x1b1/0x290 [ 543.845618][T14962] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 543.845634][T14962] ? arch_syscall_is_vdso_sigreturn+0x11f/0x1a0 [ 543.845657][T14962] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.845668][T14962] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.845678][T14962] do_syscall_64+0x174/0x580 [ 543.845688][T14962] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.845698][T14962] ? clear_bhb_loop+0x40/0x90 [ 543.845710][T14962] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.845720][T14962] RIP: 0033:0x7f78c179e0d9 [ 543.845731][T14962] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.845739][T14962] RSP: 002b:00007f78c2580028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 543.845750][T14962] RAX: ffffffffffffffda RBX: 00007f78c1a25fa0 RCX: 00007f78c179e0d9 [ 543.845758][T14962] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 543.845764][T14962] RBP: 00007f78c2580090 R08: 0000000000000000 R09: 0000000000000000 [ 543.845770][T14962] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 543.845776][T14962] R13: 00007f78c1a26038 R14: 00007f78c1a25fa0 R15: 00007f78c1b4fa48 [ 543.845791][T14962] [ 543.846585][ T30] task:kworker/1:6 state:D [ 543.894105][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 543.910077][ T30] stack:20736 pid:5670 tgid:5670 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 544.270135][ T30] Workqueue: usb_hub_wq hub_event [ 544.284761][ T30] Call Trace: [ 544.288684][ T30] [ 544.293601][ T30] __schedule+0x17d9/0x56c0 [ 544.302029][ T30] ? __driver_probe_device+0x1e8/0x360 [ 544.311217][ T30] ? driver_probe_device+0x4f/0x240 [ 544.319389][ T30] ? __device_attach_driver+0x270/0x410 [ 544.330165][ T30] ? usb_new_device+0x99d/0x1620 [ 544.343125][ T30] ? register_lock_class+0x31/0x2e0 [ 544.359042][ T30] ? __pfx___schedule+0x10/0x10 [ 544.368230][ T30] ? schedule+0x90/0x2b0 [ 544.381398][ T30] schedule+0x164/0x2b0 [ 544.394245][ T30] schedule_timeout+0xc0/0x2c0 [ 544.405848][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 544.419338][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 544.433140][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 544.439935][ T30] ? wait_for_completion+0x272/0x5e0 [ 544.449845][ T30] wait_for_completion+0x2ca/0x5e0 [ 544.455270][ T30] ? __pfx_wait_for_completion+0x10/0x10 [ 544.461003][ T30] ? kobject_put+0x50f/0x550 [ 544.466175][ T30] i2c_del_adapter+0x281/0x430 [ 544.471727][ T30] ? __pfx_i2c_del_adapter+0x10/0x10 [ 544.477184][ T30] ? kfree+0x4d/0x640 [ 544.481300][ T30] dvb_usb_i2c_exit+0x64/0xb0 [ 544.495778][ T30] dvb_usb_device_exit+0x1cb/0x350 [ 544.501400][ T30] ? __pfx_dvb_usb_device_exit+0x10/0x10 [ 544.507238][ T30] ? irqentry_exit+0x218/0x8f0 [ 544.513278][ T30] ? lockdep_hardirqs_on+0x7a/0x110 [ 544.519837][ T30] ? irqentry_exit+0x218/0x8f0 [ 544.525336][ T30] ? trace_irq_disable+0x3b/0x140 [ 544.530449][ T30] cxusb_probe+0x60f/0x710 [ 544.536321][ T30] ? __pfx_cxusb_probe+0x10/0x10 [ 544.541462][ T30] ? __pfx_cxusb_probe+0x10/0x10 [ 544.547099][ T30] usb_probe_interface+0x653/0xc60 [ 544.552623][ T30] ? __pfx_usb_probe_interface+0x10/0x10 [ 544.560787][ T30] really_probe+0x254/0xae0 [ 544.565454][ T30] __driver_probe_device+0x1e8/0x360 [ 544.570886][ T30] driver_probe_device+0x4f/0x240 [ 544.577082][ T30] __device_attach_driver+0x270/0x410 [ 544.582639][ T30] bus_for_each_drv+0x258/0x2f0 [ 544.587628][ T30] ? __pfx___device_attach_driver+0x10/0x10 [ 544.593629][ T30] ? __pfx_bus_for_each_drv+0x10/0x10 [ 544.599733][ T30] ? lockdep_hardirqs_on+0x7a/0x110 [ 544.605812][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 544.612331][ T30] __device_attach+0x2c4/0x450 [ 544.617369][ T30] ? __pfx___device_attach+0x10/0x10 [ 544.622847][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 544.628149][ T30] ? _raw_spin_unlock+0x28/0x50 [ 544.633127][ T30] device_initial_probe+0xa1/0xd0 [ 544.638934][ T30] bus_probe_device+0x12a/0x220 [ 544.643871][ T30] device_add+0x7d7/0xb80 [ 544.648358][ T30] usb_set_configuration+0x1ad8/0x2180 [ 544.653943][ T30] usb_generic_driver_probe+0x8d/0x150 [ 544.659865][ T30] usb_probe_device+0x1c3/0x3b0 [ 544.667412][ T30] ? __pfx_usb_probe_device+0x10/0x10 [ 544.672837][ T30] really_probe+0x254/0xae0 [ 544.677592][ T30] __driver_probe_device+0x1e8/0x360 [ 544.682933][ T30] driver_probe_device+0x4f/0x240 [ 544.688213][ T30] __device_attach_driver+0x270/0x410 [ 544.693650][ T30] bus_for_each_drv+0x258/0x2f0 [ 544.699851][ T30] ? __pfx___device_attach_driver+0x10/0x10 [ 544.706041][ T30] ? __pfx_bus_for_each_drv+0x10/0x10 [ 544.711902][ T30] ? lockdep_hardirqs_on+0x7a/0x110 [ 544.717295][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 544.723214][ T30] __device_attach+0x2c4/0x450 [ 544.728875][ T30] ? __pfx___device_attach+0x10/0x10 [ 544.734497][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 544.739663][ T30] ? _raw_spin_unlock+0x28/0x50 [ 544.744659][ T30] device_initial_probe+0xa1/0xd0 [ 544.749745][ T30] bus_probe_device+0x12a/0x220 [ 544.755793][ T30] device_add+0x7d7/0xb80 [ 544.761199][ T30] usb_new_device+0x99d/0x1620 [ 544.766406][ T30] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 544.772450][ T30] ? __pfx_usb_new_device+0x10/0x10 [ 544.779054][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 544.786084][ T30] hub_event+0x28e8/0x4d30 [ 544.790599][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 544.798924][ T30] ? __pfx_hub_event+0x10/0x10 [ 544.804989][ T30] ? process_scheduled_works+0xa20/0x14e0 [ 544.810859][ T30] ? rcu_is_watching+0x15/0xb0 [ 544.817420][ T30] ? process_scheduled_works+0xa20/0x14e0 [ 544.823633][ T30] process_scheduled_works+0xa8e/0x14e0 [ 544.829342][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 544.836882][ T30] ? assign_work+0x3cf/0x5d0 [ 544.842596][ T30] worker_thread+0xa47/0xfb0 [ 544.856953][ T30] ? __kthread_parkme+0x71/0x1f0 [ 544.863086][ T30] kthread+0x388/0x470 [ 544.867267][ T30] ? __pfx_worker_thread+0x10/0x10 [ 544.872415][ T30] ? __pfx_kthread+0x10/0x10 [ 544.878598][ T30] ret_from_fork+0x514/0xb70 [ 544.885028][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 544.890255][ T30] ? __switch_to+0xc89/0x1420 [ 544.897123][ T30] ? __pfx_kthread+0x10/0x10 [ 544.902940][ T30] ret_from_fork_asm+0x1a/0x30 [ 544.908182][ T30] [ 544.933796][ T30] [ 544.933796][ T30] Showing all locks held in the system: [ 544.934093][ C1] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 544.950978][ T30] 1 lock held by khungtaskd/30: [ 544.964677][ T30] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 544.974789][ T30] 4 locks held by kworker/u8:7/1138: [ 544.980139][ T30] 2 locks held by getty/5368: [ 544.985076][ T30] #0: ffff8880355de0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 544.999660][ T30] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 545.010283][ T30] 5 locks held by kworker/1:6/5670: [ 545.015732][ T30] #0: ffff8880232ee540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 545.028208][ T30] #1: ffffc90004997c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 545.040297][ T30] #2: ffff888029a781d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 545.049299][ T30] #3: ffff888032a281d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 545.060545][ T30] #4: ffff8880312fa1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 545.072158][ T30] 4 locks held by udevd/7363: [ 545.077005][ T30] #0: ffff8880785391b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 [ 545.086179][ T30] #1: ffff888021b7c080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 [ 545.097790][ T30] #2: ffff888057d1b4b8 (kn->active#27){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 545.109668][ T30] #3: ffff888032a281d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 545.119364][ T30] 3 locks held by syz.2.2772/14885: [ 545.124724][ T30] #0: ffff88807e55c450 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0x36ff/0x44b0 [ 545.134277][ T30] #1: ffff888077e3dcf8 (&mm->mmap_lock){++++}-{4:4}, at: shmem_file_write_iter+0x7f/0x120 [ 545.144911][ T30] #2: ffff8880b863b160 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb2/0x160 [ 545.155149][ T30] [ 545.168267][ T30] ============================================= [ 545.168267][ T30] [ 545.180837][ T30] NMI backtrace for cpu 0 [ 545.180855][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 545.180878][ T30] Tainted: [L]=SOFTLOCKUP [ 545.180884][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 545.180893][ T30] Call Trace: [ 545.180900][ T30] [ 545.180908][ T30] dump_stack_lvl+0xe8/0x150 [ 545.180936][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 545.181023][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 545.181048][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 545.181073][ T30] sys_info+0x135/0x170 [ 545.181094][ T30] watchdog+0xfd7/0x1030 [ 545.181119][ T30] ? watchdog+0x1c7/0x1030 [ 545.181143][ T30] kthread+0x388/0x470 [ 545.181163][ T30] ? __pfx_watchdog+0x10/0x10 [ 545.181180][ T30] ? __pfx_kthread+0x10/0x10 [ 545.181201][ T30] ret_from_fork+0x514/0xb70 [ 545.181224][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 545.181245][ T30] ? __switch_to+0xc89/0x1420 [ 545.181266][ T30] ? __pfx_kthread+0x10/0x10 [ 545.181289][ T30] ret_from_fork_asm+0x1a/0x30 [ 545.181329][ T30] [ 545.181349][ T30] Sending NMI from CPU 0 to CPUs 1: [ 545.299674][ C1] NMI backtrace for cpu 1 [ 545.299698][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 545.299719][ C1] Tainted: [L]=SOFTLOCKUP [ 545.299725][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 545.299734][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 545.299756][ C1] Code: 6c 80 02 e9 93 06 03 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 8e 1a 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 545.299769][ C1] RSP: 0018:ffffc90000197e40 EFLAGS: 00000242 [ 545.299783][ C1] RAX: 00000000005e7475 RBX: ffffffff819b4450 RCX: 0000000080000001 [ 545.299795][ C1] RDX: 0000000000000001 RSI: ffffffff8e226a0e RDI: ffffffff8c4bb880 [ 545.299806][ C1] RBP: ffffc90000197f10 R08: ffff8880b87338db R09: 1ffff110170e671b [ 545.299818][ C1] R10: dffffc0000000000 R11: ffffed10170e671c R12: 0000000000000000 [ 545.299830][ C1] R13: 1ffff11003c54000 R14: 1ffff92000032fd0 R15: dffffc0000000000 [ 545.299841][ C1] FS: 0000000000000000(0000) GS:ffff88812505e000(0000) knlGS:0000000000000000 [ 545.299854][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 545.299865][ C1] CR2: 00007f78c19ed158 CR3: 000000007a48c000 CR4: 00000000003526f0 [ 545.299880][ C1] Call Trace: [ 545.299886][ C1] [ 545.299893][ C1] default_idle+0x9/0x20 [ 545.299909][ C1] default_idle_call+0x72/0xb0 [ 545.299928][ C1] do_idle+0x2e0/0x540 [ 545.299948][ C1] ? __pfx_do_idle+0x10/0x10 [ 545.299969][ C1] cpu_startup_entry+0x43/0x60 [ 545.299987][ C1] start_secondary+0x101/0x110 [ 545.300006][ C1] common_startup_64+0x13e/0x157 [ 545.300029][ C1] [ 545.468661][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 545.475535][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 545.486196][ T30] Tainted: [L]=SOFTLOCKUP [ 545.490501][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 545.500554][ T30] Call Trace: [ 545.503819][ T30] [ 545.507172][ T30] vpanic+0x56c/0xa60 [ 545.511155][ T30] ? __pfx___schedule+0x10/0x10 [ 545.516010][ T30] ? __pfx_vpanic+0x10/0x10 [ 545.520534][ T30] ? nmi_trigger_cpumask_backtrace+0x207/0x380 [ 545.526714][ T30] panic+0xc5/0xd0 [ 545.530454][ T30] ? __pfx_panic+0x10/0x10 [ 545.534901][ T30] ? preempt_schedule_common+0x82/0xd0 [ 545.540351][ T30] ? preempt_schedule_thunk+0x16/0x40 [ 545.545708][ T30] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 545.551942][ T30] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 545.558096][ T30] watchdog+0x1030/0x1030 [ 545.562422][ T30] ? watchdog+0x1c7/0x1030 [ 545.566906][ T30] kthread+0x388/0x470 [ 545.570979][ T30] ? __pfx_watchdog+0x10/0x10 [ 545.575646][ T30] ? __pfx_kthread+0x10/0x10 [ 545.580232][ T30] ret_from_fork+0x514/0xb70 [ 545.584873][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 545.589978][ T30] ? __switch_to+0xc89/0x1420 [ 545.594676][ T30] ? __pfx_kthread+0x10/0x10 [ 545.599257][ T30] ret_from_fork_asm+0x1a/0x30 [ 545.604037][ T30] [ 545.607328][ T30] Kernel Offset: disabled [ 545.611642][ T30] Rebooting in 86400 seconds..