last executing test programs: 1m15.621777218s ago: executing program 3 (id=560): r0 = syz_open_dev$vbi(0x0, 0x1, 0x2) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000001c0)=0x80000) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)={0x14, 0x5f, 0x1}, 0x14}}, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e, 0x8}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r3, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0xaf, 0x5e}) r4 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x40) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r4, 0xc034564b, &(0x7f00000000c0)={0xc00, 0x20323159, 0x500, 0x2d0, 0x4, @stepwise={{0x1, 0xfffffffb}, {0x4, 0x4c7}, {0xa9}}}) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000040)={0x1ff, 0x3, 0x0, 0x0, 0x3, 0x8002, 0x10000}) 1m14.162577386s ago: executing program 3 (id=564): madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(0xffffffffffffffff, 0xc0186445, &(0x7f0000000140)={0x9, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000180)={r2}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) ioctl$KVM_SET_IRQCHIP(r3, 0x4048aec9, &(0x7f0000000600)={0x6, 0x0, @pic={0x4, 0x45, 0x6, 0xc, 0xfe, 0x2, 0x3, 0x4, 0x0, 0x7f, 0x7, 0x4, 0x4, 0x17, 0xfc}}) r4 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x3, 0x0, @val=@netkit}, 0x1c) pread64(r4, &(0x7f0000000240)=""/162, 0xa2, 0x7) write$sysctl(r0, &(0x7f0000000580)='1\x00', 0x2) r5 = getuid() sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)=@newpolicy={0x108, 0x13, 0x2, 0x70bd28, 0x25dfdbfd, {{@in6=@mcast1, @in6=@rand_addr=' \x01\x00', 0x4e21, 0x0, 0x4e21, 0x0, 0xa, 0x40, 0x0, 0xc, 0x0, r5}, {0x7e, 0x5, 0xe0, 0x400, 0x2, 0x1, 0xf0c, 0x1800000000000}, {0x9, 0x7, 0x7b7, 0x7ff}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@replay_esn_val={0x40, 0x17, {0x9, 0x70bd27, 0x70bd26, 0x70bd2d, 0x70bd28, 0x2, [0x4, 0x10000, 0xc2f, 0xe73b, 0x1, 0x200, 0x9, 0x3, 0xfffffffb]}}, @replay_val={0x10, 0xa, {0x70bd29, 0x70bd28, 0x9}}]}, 0x108}, 0x1, 0x0, 0x0, 0x40448c0}, 0xc8080) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004011070009000101020301090220", @ANYRES16=r0], 0x0) write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x2) r6 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r6, &(0x7f00000018c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001800)=""/146, 0x92}}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r6, 0x29, 0x4d, &(0x7f0000000000)=0x8, 0x4) 1m6.586565572s ago: executing program 3 (id=585): r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x1, 0x3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) fsopen(&(0x7f0000000140)='ext4\x00', 0x1) r5 = fsopen(&(0x7f0000000100)='mqueue\x00', 0x1) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8102, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) fchdir(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) mincore(&(0x7f0000123000/0x2000)=nil, 0x2000, &(0x7f0000000180)=""/24) lseek(r7, 0x1, 0x1) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000940)=ANY=[@ANYBLOB="3600000200000000000030bbe7cc4107193fbfc3", @ANYRES32=0x0, @ANYRES8=r4], 0x4c}, 0x1, 0x0, 0x0, 0x50}, 0x40800) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a300000000008000540000000020800084000000001140000000e0a010200000000000000000100000030010000140a010100000000000000000200000508000340000000020900020073797a31000000000900020073797a3100000000f4000800eae0c34204d4f8582d59e4f4bc2ace0161ea28e836c0463e81eb244346a163dc1ac5cc916503838e87d7388ba5f4b02aff458c2896d0ecff6d5d5b090feadb2448f1df69e1611d3ceed4b75eae33da4aade7bbf41a1bd24ea5dc3747d4c4a7ddce2c9b44eef483947722b765d61cb967f2175e42b79e2c98208ea27733c12f1ec387c8516efd532099084d2c05e8af5b00c2685d1f12bec05a8421a28e04c5ff4faf843c72261a66cc852f82f0d2d5492cb58d2770039ae0871578b64935ef9aee039c3beec9edc3f6a73dc558c10815af26f4e1f252119e055eee77927c3e3366ebca8f08f072e38edb6203a22eb2130800034000000007140000001000010000000000000000000300000a586e3f0a54ce29460d13c7a3737e743e83459ef1041413797f90f41cabee188b02fd8e97080cdc2fab01d813fc814f43d1c3b380149384442772f5ca5761a18f91049b614ae33619edb9d5fd10dc2f8582ec407e794eecad8893fe2ae4edbb26adb53288208b501f9d69523208c047370813d68b60dbabeba2ba40d98d400876"], 0x1d0}}, 0x24008080) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f0000000280)={&(0x7f0000000040)=@id={0x1e, 0x3, 0x1, {0x4e24, 0x3}}, 0x10, 0x0, 0x16, 0x0, 0x0, 0x600c091}, 0x603ca0114ad58eb3) 1m5.022567833s ago: executing program 4 (id=587): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) syz_usb_connect(0x0, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000200)=""/26, 0x1a) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000440), 0x800) fcntl$getflags(r2, 0x401) close_range(r0, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$video4linux(&(0x7f0000000000), 0x7f, 0x349a40) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e00010000000000000000", @ANYRESOCT], 0xb8}}, 0x20040014) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/pm_trace', 0x2, 0x0) write$FUSE_NOTIFY_STORE(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB='-'], 0x28) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r3, 0xc0189373, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x5}}, './file0\x00'}) openat2(r1, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x80000, 0x23, 0xc}, 0x18) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1a3c82) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r5, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, 0x4, 0x1, 0x301, 0x0, 0x0, {0x5, 0x0, 0x4004}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x40) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="64000000020605"], 0x64}, 0x1, 0x0, 0x0, 0x8840}, 0x4000090) r6 = landlock_create_ruleset(&(0x7f0000000040)={0x15113, 0x3, 0x3, 0x20, 0x7, 0x3}, 0x30, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) landlock_restrict_self(r6, 0x9) 1m2.725579487s ago: executing program 3 (id=588): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c8e000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x1000, 0x3}) 1m1.913239071s ago: executing program 3 (id=592): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0000001800dd8d27bd7000fedbdf2502201000fd00fe0200000000080004"], 0x2c}, 0x1, 0x0, 0x0, 0x4a044}, 0x20004090) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{0x0, 0x4}, 'syz0\x00', 0x4b}) r2 = io_uring_setup(0x7a58, &(0x7f0000000080)={0x0, 0xc95e, 0x200, 0x2}) r3 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xf, 0xb}, {0x0, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40048b0}, 0x4890) r10 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r10, &(0x7f0000000240)="80", 0x1, 0x40, &(0x7f00000001c0)={0x11, 0x88a8, r8, 0x1, 0xd8, 0x6, @broadcast}, 0x14) getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8) getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8) ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x1ef6e3}], 0x100000000000011a) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x35) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) r11 = openat$binderfs_ctrl(0xffffff9c, &(0x7f0000002800)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r11, 0xc1086201, &(0x7f0000002780)={0x8, 0x0, 0x40, 0x3, 0x1}) ioctl$UI_DEV_CREATE(r1, 0x5501) 1m1.166566069s ago: executing program 3 (id=595): madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(0xffffffffffffffff, 0xc0186445, &(0x7f0000000140)={0x9, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000180)={r2}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) ioctl$KVM_SET_IRQCHIP(r3, 0x4048aec9, &(0x7f0000000600)={0x6, 0x0, @pic={0x4, 0x45, 0x6, 0xc, 0xfe, 0x2, 0x3, 0x4, 0x0, 0x7f, 0x7, 0x4, 0x4, 0x17, 0xfc}}) r4 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x3, 0x0, @val=@netkit}, 0x1c) pread64(r4, &(0x7f0000000240)=""/162, 0xa2, 0x7) write$sysctl(r0, &(0x7f0000000580)='1\x00', 0x2) r5 = getuid() sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)=@newpolicy={0x108, 0x13, 0x2, 0x70bd28, 0x25dfdbfd, {{@in6=@mcast1, @in6=@rand_addr=' \x01\x00', 0x4e21, 0x0, 0x4e21, 0x0, 0xa, 0x40, 0x0, 0xc, 0x0, r5}, {0x7e, 0x5, 0xe0, 0x400, 0x2, 0x1, 0xf0c, 0x1800000000000}, {0x9, 0x7, 0x7b7, 0x7ff}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@replay_esn_val={0x40, 0x17, {0x9, 0x70bd27, 0x70bd26, 0x70bd2d, 0x70bd28, 0x2, [0x4, 0x10000, 0xc2f, 0xe73b, 0x1, 0x200, 0x9, 0x3, 0xfffffffb]}}, @replay_val={0x10, 0xa, {0x70bd29, 0x70bd28, 0x9}}]}, 0x108}, 0x1, 0x0, 0x0, 0x40448c0}, 0xc8080) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004011070009000101020301090220", @ANYRES16=r0], 0x0) write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x2) r6 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r6, &(0x7f00000018c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001800)=""/146, 0x92}}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r6, 0x29, 0x4d, &(0x7f0000000000)=0x8, 0x4) 1m0.619944223s ago: executing program 4 (id=597): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002ec0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x21) ioctl$KVM_GET_SREGS2(r2, 0x8140aecc, &(0x7f00000005c0)) (fail_nth: 1) 58.966460953s ago: executing program 4 (id=606): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) timer_settime(0x0, 0x1, 0x0, 0x0) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x8, 0x40, 0x7fff0000}]}) unshare(0x100000) r2 = fanotify_init(0x200, 0x0) fanotify_mark(r2, 0x80, 0x800, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect(0x2, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xad, 0xb8, 0x8a, 0x20, 0x572, 0x41, 0xa7d5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0x75, 0xc0, 0x4, "", [{{0x9, 0x4, 0x55, 0x6, 0x0, 0x22, 0xf2, 0x59, 0xbf}}]}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) mkdir(&(0x7f0000000400)='./file0\x00', 0x3f) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYBLOB]) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r3, 0x942e, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) tkill(r5, 0x7) mremap(&(0x7f0000011000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000001000/0x1000)=nil) mbind(&(0x7f00000c3000/0x4000)=nil, 0x4000, 0x3, 0x0, 0x6, 0x3) syz_usb_connect$uac1(0x3, 0xdc, 0x0, 0x0) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x11, &(0x7f00000001c0)=ANY=[@ANYRESOCT, @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a5000000184a00000100"/40], &(0x7f0000000240)='GPL\x00', 0x81, 0x0, &(0x7f0000000180), 0x40f00, 0x42, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000002c0)={0x8, 0x4}, 0x8, 0x10, &(0x7f0000000100)={0x4, 0x4, 0x3, 0x7ff}, 0x10, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000180)=[{0x3, 0x2, 0x8, 0xb}, {0x1, 0x4, 0x4, 0x7}, {0x4, 0x2, 0xa, 0x7}, {0x1, 0x3, 0x1, 0x1}], 0x10, 0x6}, 0x94) ioctl$XFS_IOC_FSGROWFSDATA(r7, 0x4010586e, &(0x7f0000000480)={0x4, 0x7}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) 54.386404916s ago: executing program 4 (id=610): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x8, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x3ff}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100a1000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 50.634699226s ago: executing program 1 (id=612): syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYRES8], 0x5c}}, 0x48090) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) r1 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16abf8d77", 0x8, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) r6 = memfd_create(&(0x7f0000000980)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7\xc6yE\xa8\xd6A\xe8*\xedEd\x14m|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6E&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa\x00'/717, 0x2) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r6, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) fcntl$addseals(r6, 0x409, 0x19) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) r7 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000d00)={0x0, &(0x7f0000000880)=[@nested_vmresume={0x130, 0x18, 0x2}, @rdmsr={0x66, 0x18, {0x930}}, @nested_vmlaunch={0x12f, 0x18}, @nested_amd_set_intercept={0x181, 0x30, {0x2, 0x7, 0x2, 0x1}}, @wr_crn={0x67, 0x20, {0x2, 0x80000000}}, @uexit={0x0, 0x18, 0x10}, @nested_load_code={0x12e, 0x52, {0x1, "0f08f02171f1c482fd45e1f30f2d5514c481f9626ea066b88c000f00d066ba2000b005ee66ba200066b8000066ef67420f01fc66b840000f00d0"}}, @nested_amd_set_intercept={0x181, 0x30, {0x0, 0x0, 0xb84}}, @nested_amd_clgi={0x17f, 0x10}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_load_code={0x12e, 0x4f, {0x2, "2e66460f3880b806a20000450f218267430f0dadbd2f4e0e0f08440f78e4650f01d1420f0199beacab9fc4c3edcfea1767430f18cb0f07"}}, @nested_amd_set_intercept={0x181, 0x30, {0x0, 0x8, 0xfffffffffffff000}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_invlpga={0x17d, 0x20, {0xdddd0000, 0x2768}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @save_area=0x5a3, 0x6, 0x5, 0x9}}, @nested_load_syzos={0x136, 0x18e, {0x3, 0x3, [@code={0xa, 0x67, {"43ed66ba2100ed460f01cf0f20e035010000000f22e066baf80cb8197f618cef66bafc0cb000eec744240037000000c744240262000000ff1c24f2ab470f352e2e65f044814c89000a0000008f4840ef9a0010000087"}}, @nested_amd_invlpga={0x17d, 0x20, {0x1ff8, 0x190b}}, @nested_amd_set_intercept={0x181, 0x30, {0x2, 0xb}}, @nested_amd_vmsave={0x183, 0x18, 0x2}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest32=0x482e, 0x2c4, 0x6, 0x29c}}, @code={0xa, 0x67, {"0feed18f88e0a2f300c4c1c17c3506000000660f55400066b8dd008ec8642e266765660f3821bead9e000048b800000000000000000f23c00f21f835010000000f23f8470f01f80fc7a913000000460f649206000000"}}]}}, @wrmsr={0x65, 0x20, {0x269, 0x5}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_invlpga={0x17d, 0x20, {0xa000, 0xee4d}}, @nested_amd_invlpga={0x17d, 0x20, {0x9000, 0xd873}}], 0x467}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_RUN(r7, 0xae80, 0x0) 50.554185187s ago: executing program 2 (id=614): syz_mount_image$fuse(0x0, &(0x7f0000000580)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) syz_usb_connect$cdc_ecm(0x0, 0x0, 0x0, 0x0) ioctl$I2C_RDWR(r2, 0x707, &(0x7f00000000c0)={&(0x7f0000000180)=[{0x5, 0x4000, 0x1, &(0x7f0000000100)="9a"}], 0x1}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = syz_open_dev$tty1(0xc, 0x4, 0x3) r5 = dup(r4) write$UHID_INPUT(r5, &(0x7f0000000000)={0x7, {"a2e3ad21ed0d52f91b5d520987f70e06d038e7ff7fc6e5539b0d47078b089b3907376d090890e0878f0e1ac6e7049b334a959b669a240d5d67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07670936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70fe98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf1a34af674f3f39fe23491235c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e470dea05918b41243513f000800000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3e3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14d9fdb8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a19000000000000006f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69b15c9f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d44400009a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc01008cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c16c02ed4b5d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaab1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106d26658b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6b14effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c110000a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b51028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6815d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3f3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51090840517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4e004a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6ce1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c817e9177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d543902113c4c859465c3c115c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc248850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafcc009fc074bb6b68a1f0c4649820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948998cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2fd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5dc4ff8f0104000000000000df72279fdb0d2b9e936e5a983c12fded79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d3700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc642df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa6e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9f07b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e3ebb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3fec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4cddd5d0fc5a752f9000", 0x1000}}, 0x1006) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000002c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000001140)={0xec, r6, 0x2, 0x70bd2a, 0x25dfdbff, {{}, {@val, @void}}, [@NL80211_ATTR_IFTYPE={0x17, 0x5, 0x4}, @NL80211_ATTR_IFTYPE={0x8}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "6624db2491c706c0ef030260447ce9bfd7bb343917dbe313"}, @NL80211_ATTR_MNTR_FLAGS={0x24, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d2ab39e2e1bfc45dc31acc0e5fb2091dd6bfeb75913a7809"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "16362b466649d8c26821574cbb962bfcf0de40ae57844d09"}, @NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}], @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MNTR_FLAGS={0x24, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_ACTIVE]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b7465b12c002842dcf592be545594c1710b5ef84f4fa7f38"}], @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9825757f9795e6d2b64b979a524f0db2278ccdd4408045cc"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}], @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x180}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000009c0)=ANY=[@ANYBLOB="5801000010001307000000180300000080000000000000000000000000000001fe8000000000000000000000000000aa00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f000001000000000000000000000000000004d533000000e000000100000000000000000000000003000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000220000000000000027bd7000000000000200000000000000000000005c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000003509fe8fd57fd44aa5074c50bc700e530c001c00", @ANYRES32=0x0, @ANYBLOB="02000000"], 0x158}}, 0x0) read$FUSE(r0, &(0x7f0000006380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r0, &(0x7f00000083c0)="4e5350994ebf71ce3049a58c5d050078bf16b0757a4c27b455e2a547739587dd3380b5df8f40a0696c5bd6cdb672cffe4d870c5c90ca92095b9ebf3e92fe31d8cd74275d857d34a74f7eecc7fac15e2f148d4e9d47bb45b858bbf078999970d180f28d7b2cefd92635d45a563d9229c9fd770efdc0848e52fa5efd9ada5c94a1ba94b4b7c7507f8b0819bb20910f9f50a83a010abbe126dd9f6a7b84eab6b0d5ce78d2ade77a5f7e4e997df1d03ffab4b4c945d803e4457909013127a98769c938c237f37263bc509a42bc56ff2dbf80e847e2c407009eef94f18e1e59069d62298fdbadae007ffbdf403c5049a4530ac0abecceb5608da02754c9a575af52c0b7e41226e2d642a814861c4310c935bcbae413516dde2132652b39c7aa0218a6ce65dabb4494965209ce879ba7e7e59039db5c1d36d6a7f86d72dd59954fd6f46124a2506b245a0db11aa89d2feb312a6596ea2fecaa7b6021f37a255f628da7ff6b6c36b514d3b6be34e505f9dac6acfb888198004699fb350ac93431533554658c4957df36703591438d6488bc03dd8290a75ebb367a481a50e79a46b04d005649cabd79e5c6326c066bc2b6fc5febb87ef66d832ef31a16c2a450a0b990fb549a5d810c928d1a81fa1dc795db2607ac7d46cb5716b68acdeb00987e429fe6a394632c83b43336e7b51d9cfdb50e83d8c6ba1784d9f74c16b476e048e65e7ac0af683b347d7377ac1795422e00e5bd8da9b313af83abb3348861116de7a99959169b7dff9f7d9b7a6d107f2e76670a6214a419bf8298f80eb570fa29264ba57a383c5ec5836ce33104ecaf1aec76e311280a1d2c8bd7abff3a5a242e6a637f7db63038ef5d78aca9c680d72b60da4dbeb0e1e683ddc82898647c589a81b8f92db06711d8a0af05560cd77fa7005283db71e8da21713fccd450822062b994d152aaed2cdcf0dec9c60617e15ba4df628da4e71279bf9d1eee5c7f055c27cddfdd45f9225d5d5529ef7119e2e3c9838e7362971e069be487797e949b24297de19c61340d1cd7a2bfa3880b91a71e934720a59e1e0ea992d2a1633a0852ad8addfcab73a291e35745e694a6471f429b124305886c1f79f67c78de3f3ec998c91e7fc59d26766cd446f6f0de603f2c6892e13cdaa37d9e8e118d098b6986ccd991993ec152193e7d77394b05b99e7d310c506707f1be52249438fba9615f6dad2ec7244fedf36e34ec311b7d6bee64271d6491079e161190ded7e28e2ada4307a9b2986c267b1a30d2f720ff23408011f1d589ce9ee77f981c7833656ccf7df5b3a87ec253ff7c7ef1e67ceeb10c93e3fa683cdadad65850ffbc402b7744e94cdecef9db9d264c755c53d36278df23d4c9685fdefa69f7588a33b8a64b35191ee81abcb9765577d175cb06e31c582807ff7243bfef44961fbc0f8a235242f51ee991ea621803d4dcfed90d26f004b299425bf219f6d185fe6e088ae44601b03defada18794feac93787696a5d419f09f769bc590f43d2df6a131f6895da2de120c2644685e57b1d476c6aba5881e954fb2575356452b118b942cb02b4ea0fcf8f1bbb9a23b6e32c9d0accd3dd861452a3ad77b38fe709e216974932deb5397fd8033ff0e073d93ac0b4be762bca0424d69bd57b22ba914133f87671a29498b268c2911e793215463ca2164e38059456107dcb29beedfd6277e2b41a11d1c6f1361b19875c9384f04f9c53c1856d71f360a8fafe05f7aef750ec0cf2bfcfa971c017ad071b69a18fdaf970b384d4c889cfa5a0397dbe89543a5c6302645d6edf959aa60709ce0225fe6c3266c7ef62157ac8e78fddcd8a1f2ca5b58128218d19276885515775326aeeee0226cc810843eb05144bf8e2fe3340cf60b32cafd96d23cd7d0d3adcbdfec9a2a3d88307c362633b1c5637608ea8476d900b3f836a9734b5ecaf5e82983577128d3f74b903b0e3bf64326c1b564ae42aeeb0c07702b63a9ff74a2af6b45e5185a53f36c17bc29dfbc0ea28ca5cca43a15d751e9887ad3e6a87faacb6a278c4c8a8d21b9a77b9776f33102a6e645e99cc5cbc543ed0674282c2b9f8e5d14c2599aa9ac8f81438c77f2b9368bdac82edcdc5366f39adec9e9a3fbd55b79abc16d2ebff26b7d0c88f18b486e5836333575e3fc7808cb423b44781c57965767862922b4ff32d9bae76296843a46f430211c27ef9db168430026a5691623284dfd459dbdd1f1a6ec9bfad666507e6eacb1e2a7866da2e12e6d596d0bbb150500590013d9288af20596447f97bf1744eb9cfb244d8fca269b1fb71e14de664be4e95d83fff1b8abcfebcf3e78c1c66d28f260fb0c19f9fbcd2abbdd7dd7246e49dc25d954bf25f810a2ff6f9069dfdc62e7170fe3b0964b2ac95024256dfa3e7a426be5bb5f707fd82c2b3afec5d5dcf5bbb8fcb6dbc1b59f6c5330966c70d8b016956903a4278817414ba3652a102d7e7e37ecc79400267fc3bf7601c0731f87d479c33f100735e748874155267f708cea49d549e93cf7a398b20373dc90ad9afd56d9c77cd24e2c4a18f7130b366c7fe5b26bc4d11ca1ed1b98fa0b4d7396f82ae6593f4575d19f4d8fd586c991129e5cbe15c8bacc89c3ee15ca471dea966b5c48ede0d3ba2a7e28c75c04e6a4aa49a61f4e391ffe78eb5e40a5ef349f3aa4d15f2291cc86ec7e47ae301bf0b6083dae44b695820a893d46732553ef15ed1c16d28268d52a7e3a7e7c009d0c0708a356d3310c1ebcbcca4d7acf433e34bfc9fc115498142dcc725e7a16879c75e4c2f01c6c98b39619f3248bf530e6ee593467e38cf4026cfdc4db6296565722d587f3c580750b1453ecc141c0461495551297d88ae034acbd4f5e80ce198e6640c4c1e9501529988109cef006eb2090a6fcd974d7f60290b78f1a8ce3051ac2d69636c3219f0a6ad8c254764396a1684b2fd9805b1853525f2e640e513197283cc4d4073ac033e0539a88f08aabe1423cd40b8a7e073437d812b57a5d39a0531dcbe13f4466e89efc66c2a1e4b39a3e0b3073c9d44e6cf9b85f4df5c4e03628d05bc0f94ec04234c9eca4ed17463f190406834b02888728f625371cda75d15ec19efebd59f00ab659eb94eb88bcb2110862a369ad599610c1530fcc118f5b82205bc5215fe3623ac8ec297d8ff4eee75ace20731c5d505e6605c26203b7f754164c9463f0a6eefe3a2880b8e06e7bc66bb2adcc1a3f9b0325f5ec31d12a25f1f73c2aa6bb3a7680d786a082a63b13cce1822fa6a4b085a871ae3409eecbc1fd8661b5d52bb2b8b72f23e24a225075f272ed2ba0c6c5c693811a0ef8db6da7cfe7c966c647f0187ad223eedb1012a5b7af103e98464ac768c79b21ca45b12a52cf261de0d367442cda71c4b8ee39c94ded1b22ba06c13836cb467ebab4efea07bdf1e3de8da56a0ee6d4f848011253cc21fac10700003513d3167b7a73e0d752b861c49814bc5410ebe53a0264f76068c91ee6ec9e2daa343482b2f0f06e605c5aaf81f2a3cd570efc2094b4bc452f9526f1bbe7b22b694fb8109a5a987fabf6250912d6099e67da9cac79e8b6f2cce4702d1f17cbc5d06c38b8a48155ec758369c185ded839fb58cd736fbb74105fe5baf44e7e3ed06843f23601b60a43b1f88fd29e9b3f58479f9b95392a39d5ba1a31ee4441ca2d1fb57c0a8678a07a724b7a65b2ab16d1da197f435bce3ef003fce27fa2f0a67c9dd6c930a4bcf59e79e57b010000006fe34972958c28b56642d14ea89bf4d7d6f7fcbcf4fda8bd08fc9fe424de4359112b11f81fbdc1505658363697713ff6e1f8ca3c4be34a79993a9091f6017cda6c7489ae5c07062555231427c3eb42a049f42d22a060983b044a7d34ab5d2b5386cca79af72396a48aad6b8dcd7855410fc6106e4a165994f26efff1e7ea0aa8f560333b5dfdb2a0d899b0fda955155f90c75effd3c9535d88508e836feb7807d57b2a57cca42d3d08fe7de60d2a33376f49bdacdd3f814bd0927f417f15ad62a10b302f1cb390aaf82b0bc6af46bbf990b6ada45ef83ce13029d167c65134e7b82b59ddfdc367e61c40defd2732ccebb1d4000f6c742df964e1fb390c255d2b1dfc745c6ab34af8096b5b67aa179e3f341854f7a69f7bf47664c832037ec7a78f8e27209e3f20f833fb6e8c0fc4a40920a5ad2b0618982ff72540009d5db82f0f5bcaed2a27f35d1e50eaa0cf8e48c7a2d43c25d0264db750a7f33b44a4bfaae576cf9ee7594ed204513899566564ed8bbc97ed18b1d8868f926a5c70ac06fbac1eade46792186be7bf8ffa3301239edd093449b7d77192782b5111c14169d2b4a1b3443ad62e4abdf11aac6a5b89a5b20ab0ad0abd949b9d64582c67ffce018e7e46de4091fcc77a65b971fc67c8d9cbf0c341ca764b1056ee5014d9865059616a525a1d46ae2fad159afe86dd1df9b8246411827e19535ca0aa9f83050b06e70aa2737f27e93d584a9cef878a642e9361efaa5d20bd8da901fa2e064656f686d3b3ea31d1d850ae9196b7764548f5c6450a32a717e09b6b7e75d43fbbda76e43a24f186d5578933f408bfa28e0435cde525fb91e71d92d704cc5a9b5e3db7aaec46d2b1f8dcb3f921f69bd7397c96a1e132c39c8f1656cea4365c779abf76199cb5b6aada022edec5c901cdafa2e7f3765af9c8b20cb1a6785085fcb0dc901367b89051bdfdc6b68c5215fd04e2b3c7e1c454a4d21132953b25c50995af0f7159a5a8d0a1621f4808f126a5bd40ddc79fed90f49925ee367a57a05c070fbe39fe2c213e7c1724a907ecfa69efe6e021c06a262471a4377f3c9809e9fee4f375e27c31b6afbb2151da86b7cab63c7b4fa4b77fb30172b9d0d78b1c0535ec0639c4910b5eeecbb5b8b5c8aa74c140e7ad347812e36db3097a7ff85c09ab2c0020202307f50efefcdb497b9c060ca68c4be54a9165b4cebc6b2e2e14e5ffb9213142418faedcdf26fd326b7672399e71cfffe3ed712ced5317c254f9199ee10c24c802d102bd8749513d3145201ca4e01bc7c8bbcf430afa541ec5665f86dfb143be648521bb0f2b029018201444787f644f8c88b79e754e6ea9c797babdaec72a9680abadf3a41684cdd57c2b6e833acc0846be5aa927f1b1b36562d2acb9ecfb758455230d050daec6748ba280a5edc86d48e3f8af0f8f4ffb18ae3cd3c19a82d504a4fd52bb62289ae8026572a497fe268f87ef4b4b5886aa07eeb698b7cbf99683f710afc9ed1f8a488883ce0eb8f7fd055b82a9fe21a409caa231c41ba151008e9658919c611e157d7f3926a5e4248532a6860e615b9c86e9fea212128d96ed58c9b84ef22706071eb69f492e4d8321ed9faf6c6a8928f86172bdc930244583ea15be497d9ce4ae79cb3e6293a8512ffaa9e8e358f3c7c7117001fb92891a40b84f9126cc3def5cde67f463bbac9668b9f56c3e4ee72fceebb47e52fc226bab213d8193516e7064459fd1365350a95c5a1c3ac44a73bbba2a4c17ebe49dd781bff1995cd706b77bb533117594ad63566f4c0730beab85ff4c713b7f10b95480fe99a0f676c51ca11116b21e87887b462aa9770e85509e4e60f198148115f0a3ce6028516a946178d1acacf7767f6be7277891369eff67762aa58f928d48b7231e44d899cea8289003349117a53d61bc27b207fdc91c9db61e677d1e1a1bc6a1b6e8564130b335233db4b5de8d62324e6d0ccb2b08c2ff922324eb8c506711142d4b8d7a21223ef0a3d534fdb0de58be95cd827152f71bdd0a82766b62b4c87536f0b7e7df343c4263187da887de6e65d11d0360e2376c1d71c367ae85edeed8f767d24c644b1a9b455ded1dc3cc224f99936a6ee66931c45e5e3db2427719ab2d5cd9c20d9bb0ec004b69bccb00649f3d8e34a3572c257de114b9f027d76bc7db9007175cc03b9e2061b6b3fe7409e009b5371544e56fe438cbd361e5b11efbf2d79d1c250a1e73ca8c601c4f4d1e3761290950421c48c7daa45965e472f5ef3c4b8597444dc5dc01cd25358055b5000617f3e7291da3413e3f0853b1271366612405c35ff1b785b984d921b518425628a533a29ab65d3c11f44c6daa86f8b6457ebb9419274c481aa6f3fa4547641670aff58b9cc62c0993d49a509f02dee755ee5f1fd2710c995c43a91c4f873afa1bbdff19427cba2641052a8f361ecbc72e8a6cf587e83f8bd3110c95fb080edc77a6d43cd58c447b0e02261e4109500c6458dce70acb17aa8f9dc1d15b94a61354164031b5d563c25d0246fc45e6401cefceb501e1468903e5d677759dbe3f24bd48ce55ff8b8f26529fb3b2d669202a1e8a498984b449b4830a0126b18f0e78182c9ce78fe0c448c0e27845b926cfde28fa85e156fa98fefaeb19ed1247c9643b447b4342c94c114d3c4c35eed4d5b49aa70e6aad45bfb557f15e8fdb2d6e3d10d8338a13fe3f187751985b37a5bb10b750f79e36fc2e2ee9bdecc3ed156e202ed7b45a94809d77edaa398042fc6a825a4848c334c557303d24eb3f8e01be06995ceb283c70272b00da61c3381628f0e372fe2fcc779ff7daf7e4b7f2686c39d3fab674b8867b62b0bf9d5cfd0c1d3b270521f55f147de75142ffd7fc9ac7e5dae7ca2fdf26a9222d060823852409dd040cfd1f66f218c6dbdaaacddab34b123af22f97384d64fac64d84fd638c96378c8f9532a11927d48440bc777ff8b8b9be88f930f3b579a713c0bc449dca3a3bd5f2efa98240ccc594299e44451dc60c6c5c9edd0d7b777912b3dc40c57e0ea5f4425cd7047e686c7304f04ba9f7b5de6ad2bd524f1d29f8802a524441fa286015adf4589431710aa4d76de8a956dc1d39c0a13abb7fc309d24222d036e204ab6bb46ef8a7595d9e4512e0b9d5f8fd719a4e3072e1d806967045789c67a1681f2a9f1f4b19f4f5e1afdafc17db7a6d5196161499e62ab4b0ec27648f3eeb1fb2b78f8ecf9b05cf9509a3b9e2a361238deb1c91bdbc8b1d11bbeb939fd9da811cd439069da0ecc00665d72357aac01f259a0325409b201859cc0569e0eba67a7a9ca7e8b78078d9370bd3e37f0571680ede60cb6bbfe69435d6ab5efd80cf051d119a7004fc0b600844d49218d844de8f521524a47ee50229c7da25e42a8639b5db225e7f23967f5d4f8a297aff04a3cbedc2985b6393a5ba0b26b6c7b4ca22d369b35b410799d1ad02825104d34f73408db1948438597931ed1c1c260e78340517bfa2f734537dbdf5ec303518ff4640efe7f7b1c2f46babdb9247ce8eabad9718a8b9ddb7a18d5e87ced554c9d6de78f85d293349590c6c32483534bc968b24a28eb54b9515589d6dd8eb51a5ad0b4d896ce92250397cbc404323fcdf0ee47ed634e0c58213bc5b35a72b21a098e11b79c061430dc817c1e0c79a5b6ed3b002979933f1b83a17f250b1bd5c4958df4d75531ca03efbda89f6a92fe08c23ad9014ff562a7f3dcde578d6825b9847b5df04dbca4f2aa52d8e0f4cf8183ce121e39b50358a9796acde0372a8ff97769874a80ab997cd889145aad4888c06963c2f5b82f53a748a6729fbc79d35c06d84e05c62e44ff78040e56ebfc6efcf0d8b49337d5a17c4041f0d5a8b616244d585a162b69db073accd9071d12df5b326a43b834bbffc2f2a60deafcbddf1c6438a1769d6fb09fbe1990e89da12164ef237f326edb5be64bb64b143a030de8a99b3c5e543c871cb581e2be090a92134aa587701f864907cadd7c1ce20fcf8f5dc7f7ecd06a6c19d89a92ca0ad4393c208b80bba990c7a3702a9c79bddde75d5db244719ac32191b6ceb041ab541fb47680a97dc0422b8a50d91e32cb08cd341b0b099aca5bd12b69d4f89d10b755b351a6489180b786a3bebac926532a4a2d85b07bce6c090d1aaaff079e36d5394a612f1351b90c13a0fa6bf9d188d548dfe6fa51a9026edb52009c03ed45ac51d05c58a957bcc67e05a588985ba00d79f33ae9cdd5f5721d9fdc72ee6e880708be87e8a60c3c035c146f2091d1b9a4c2cfa56f292fe1ba62290d4e56c05669291bbe917f3cac51802a2cc8e9c90dadfe666c233c5a5bb71ee17deec51ce60c73f57bf9ecb84873afcc44815131810c6c1217bea485ef9aa2785e859b25315ef8aa3a274982786e45d622ae831fb76010d69a181b069e4cc55d4436edb10d1119b0c6000c6d5cff7c72f740a59dc0507e7a952b69403c62673f122c9d1264fac6ce2262e86cd8d6a402672f88530fc2d16f31736dd497a4e853253ac8d5aff8d1376895e9f5519b2490cc2a2412ba0c99cec855f668837310035e92fb646486de1b0acffb91ae7516df3eeef381456b55e65baa58e71461c928687e699d2b21814805591382e95e1b970aaa53259917f070281f2336b7d570249d838b3f1a32753c336864e15f4561badf8fee034a29c52ff3fca7456ae140f83e3b2fd5b57c9aef3f20c664200d235f236ec47dd2fc20b14dc6000812237aea992d987e5460679e8c5b76d931ef6d951e6c7087e3106b6ce2db9de6f228fdf3ffc38710c0e8d5000a195a79d1fa2301038f5b27c40b09c34c025e5099d40c2204ea0eae985263c9101cab88d6857a320c9e497f22348a24861a5fb8d734e08cad09f9933748ff01eab22f17756f58688dc1b486a397563ee9ad0784b8833cdb5f7c6bcf76d9c1105f71c3c6aabefd70dc6cd5c66d31caf916145ac5ed7fa070b4277c0448ab1eb78c943be9aeab0587d321a4bcb7754f070881178f8be668b686124899fac252519f4b60ec42db766a908755040463125c26850177402a977246d36d23afac0a11889d54640bd8f6f670d686cfd33f6fc5d90cf6cbd63d9d0fd201dd4c74dbbab899f3c23c0b7e37ea0b2aff421327200d0da58b5893a4186ae3652cc6e11c2c2a0e52184a3872532acce98c94cebf4f31333663a620f0dba0ffd89c3124380075bd28caa6d449a050b3661b8fbaf4747b77c4928b1378fdc8c7a7b38ade1aeec44bdfacc8271d0b132b2029b0f3582f9919f5c8cd543abc9caf6b82b197cd482c3ef61a64743506342bf50a3c1ff544563bb8b2002911ee1fad698f4ac133ffed5bfe81239c918207a03c7a8bd71a0a502aea78d38e970e3ab2abf754b598acb79cf276792aa08724d0ba24f2a694912ab795b3f45f52dec50d9bfbc99ae27e1d2c2216afec6709d6513a64b29ef58255bbe18478c5d4f15f74ea63a1e15487752eec8fd019f1d4a7aa25277664754bd2d7cd3a7a018b92c56d965a1974885363757286da9e055ef7fac17876f0a64c1026a597733b897a9155ecbf420159ae8e5209aa83a3544fff1fb4566f2d54f95e3bbd30dcca5f24397e4bd47ff01292f0d6fe9dd47a810e0c25382fa69b4987d1afd9b69ef125110ad6b240eaa9c85829a2646f9ab7874bc02bfa8346cc9190943e9d46b44880670b1e2aa3a29e83be5472d7418885a353faade6e8b18f4b588607bbb758588d1e2f11a9dfa1c4d61be50249f1ee32e6ff8c0c7722aaec1bc79654a4772efc578bd6a14c79abcc77a4e09c8b6c6ea35cd3ab31e35268fb55db843176f8042f8ce7be0ddd4ead6dbdad0ef9e7cb2323db5cc48119a72b27306b8ff6366c0bc682a85ab9e2cf2238b6d6eb2e38a97d5577e6334cb2aa6e7c86e489e876f9d7053577a5cb57f52812fab7c4bd7b19a34c228ffb67dcac9281612f778b58c580c140542200fd00cb3ad81d93420df93c5af2493f646d8de797102fa0a65247317882fbf171520f00b2c7638623b823ff11444fdde453570f99f9099b60061a908b83383ba8b82bb78edd074dccf9342afdf8d11a6129ba6ea7030f3629056264f1736c2b926171b6dc7e1fa455a473de656390495f3b6ad2f9f46f35eacb075628ff739ef78f28ba683448068c7f18fb63f28ba7dbbb78999100dde0a94e8b8570817c7114c13e139ceb333782b29a84a5b19497fa785915c7680dd7f972cb59ba22161f60886e5cb3c3e808726cbf96bc4da78914eee565c6d9d18e70d22cf8c0244cf3cf488c3550eaa400bc0f26d64e0f1bc8d0301a841d954073a641f3ef883d81f4d5db8e9df708e64e640b38df7295f7fe573863653086bae5507c880ab7fdb7a6c5ce77027ffa7395233d3ce536d77ae6c2e9c8ffb6fee78a3bcb3b5f888bd595caa3a5586948776b950a89cde4db8247ffff27491c882b430afdd60e7a22324f6635a9aa7139f3e624c6d9ece60f7f8153b2080cf0544fbf8e1c436503766e670b902604ab521e11aa5a65cedd64cfaf898ac5f55c08c87693c323517bcb0d99c28f5e072d4f6540c7ead70138d47c1a67fd72bd6ef5613af33a0af311c3d0a631ca2a2dfbe35d1021eb610e40b9be128683235a788b5a4cacf99babee382458d59e8aa1dd7bba7e09dd30c055a3df8ed721a1778b2c6ed587a403566325cd19962edd7831caa44a6b716517bad502130e7cf6a5ce5288dc84c0170f622ae0b1e1166a9c2c0771d91df9f9dd82ae210469602ce38964746c1c1d04321aae7d464eb801dbea7ec39505457e778208774d72673626c998b002c46a9b4b1e390d9344f0ca62212a1b6d41043a2100b35196bce42d40caa0ea9a486bf8526fd1f0f0d362c2cac463ea7377a20b54b9435442ca529fc00da4fd7e27c4eaf14215a06857b54254c26346956fd7fe215a5ce57ec38cedf50a3c759e563a4fd87494f00e7bd9b44f3b7e99c6ef67187056a21d2fe1ac9d24125b1947eb293189fdc448b591af4d9b8eb091d6bbb5e50fae79d000044e282bb2ab6c63cc9562b151c214e45015354e62be63e1881238b907f7bdb791ff44a4e03fa29dbd26db2f49d0f4729b7cd9ba69a65b0b493466d35d09b3f590c67c31660d95e2ab4af2c9f1df91f04ce5a57dde2d75206b42e3423126774d76593c2f713ae279d7092506b513fd5d18f0f52d3fafd7141dfd4a0de1063754dba865faf8dc0f6be9d90ef21ec86a275533f6ad4b4e360dc775413f29eab8b3daac6279b9abfe163ea2f183e09ed91ef67fbb090875109288a182cfdcc46d90678efe5edceda6518335e678438cac4bb47d376f3f0e12aa55301735d7f42653c073d6a4a37b2e17d332dc1be6b50918c007b14886307cc39250e81efecd63d24067a49994572725a9df1760caac13a28f5255556b27ec245e93969b85cdec7cd1c2d2a433d3f9572b93054a7ce8adff81bc1d30884d5fc4791e251bd907e37af5bec74235c3e2f804e4e0450b715289942b7859ad207bafcfec1b586dc15e7911fe6d20aa3d02fcd47e9956780e300d7c53c17dfa15754deb4c20efebc7270bda0fa6b37fc88c6be4250cac38c1b8186b364482026ab52d65d3a691903fccc39772277011bfaa421adba76bed9731077bec885ce88d40f36bbd2a839c67dc4b862c968491b877d4fd13fc90f8da57a29121e12f78e85af765cd66e72ba513593fe1cdf20019985b065d828707d8e509c6834eab188deea5c9ee97955f4b07d37b6fc7beed73be94887d423a349f35bb8782bc670ceaec870d97f061bda02ae73f6d575f81e0b6326eae6c1b3085cc584686120e12dd9ad8ce44036bec8a189f9", 0x2000, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x90, 0x0, 0x3, {0x0, 0x200000000, 0x1, 0x4, 0xb, 0x1, {0x1, 0x10001, 0x1fffffffffff, 0x2, 0x0, 0x100, 0x10000, 0x2, 0xc88, 0x0, 0xd, r8, 0x0, 0xffff, 0x3}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x19, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000004000000000000feffffff18110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b70200001400ffb0b703000000000000850000008300000081000000000000005509010000000000950000000000000018110000", @ANYRES32=r9, @ANYRESOCT=r1], &(0x7f00000000c0)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000001040), &(0x7f0000001080)=0x4) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000b80)=[@in_dx={0x69, 0x20, {0x5e82, 0x2}}, @wrmsr={0x65, 0x20, {0xf6, 0x1}}, @rdmsr={0x66, 0x18, {0x9c2}}, @rdmsr={0x66, 0x18, {0x90d}}, @wr_crn={0x67, 0x20, {0x8, 0x80}}, @wrmsr={0x65, 0x20, {0x9be, 0x3ff}}, @in_dx={0x69, 0x20, {0xf22b, 0x7}}, @nested_load_code={0x12e, 0x78, {0x2, "45f6037366410f62f066ba430066edc4e26198e8c744240003000000c74424022f7c0000c7442406000000000f01142465f34e0f1ecf260f001465050000000f01df48b800500000000000000f23d80f21f835800000700f23f866b840008ec0"}}, @nested_amd_vmsave={0x183, 0x18}], 0x160}) ioctl$KVM_RUN(r12, 0xae80, 0x0) ioctl$KVM_RUN(r12, 0xae80, 0x0) write$FUSE_INIT(r0, &(0x7f0000004300)={0x50, 0x0, r7, {0x7, 0x26, 0x8, 0xfffffffff323ca46, 0x0, 0xfffc, 0x6, 0x5d3186cc, 0x0, 0x0, 0x1, 0x10001}}, 0x50) creat(&(0x7f00000001c0)='./file0/file0\x00', 0x108) stat(&(0x7f0000000100)='./file0/file0/file0\x00', 0x0) 50.114973086s ago: executing program 1 (id=615): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c8e000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x1000, 0x3}) 50.005229151s ago: executing program 1 (id=616): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/tcp6\x00') socket$inet(0x2, 0x3, 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x490, 0x0, 0x800}]}) getpeername$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r2, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0xe00, r7}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0xfd}], 0x1}}], 0x1, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x18, 0x42, 0x107, 0x70bd2d, 0x0, {0x3, 0x7c}, [@generic="f25d43"]}, 0x18}, 0x1, 0x0, 0x0, 0x4048011}, 0x400c004) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r1, 0xc1004110, &(0x7f0000000500)={0x7, [0x4, 0x10, 0x9], [{0x2, 0x3, 0x1, 0x1, 0x0, 0x1}, {0x3ff, 0x3, 0x1, 0x0, 0x1}, {0x80000001, 0x5ad, 0x1}, {0x9, 0x10001, 0x0, 0x1, 0x0, 0x1}, {0x5, 0xd9, 0x1, 0x0, 0x1}, {0x0, 0xfffffff8, 0x0, 0x0, 0x1}, {0x6, 0x5, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1, 0x0, 0x1}, {0x1, 0x9, 0x0, 0x1, 0x1, 0x1}, {0x9, 0xe, 0x0, 0x0, 0x0, 0x1}, {0xfffffffb, 0x6, 0x1, 0x0, 0x1}, {0x83, 0xc, 0x0, 0x1, 0x1}], 0xfffffff9}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000001300002008000300", @ANYRES32=r10, @ANYBLOB="0a00060008021100000100000600120064000000"], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x0) 47.387756889s ago: executing program 0 (id=617): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x402, 0x2a) write(r0, &(0x7f0000000180)='100', 0x3) r1 = syz_ublk_setup_io_uring(0x81d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x373}, &(0x7f00000005c0)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb351, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5e8, 0x0, 0x0}}, 0x0) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r8, &(0x7f0000000280)='0', 0x1) 47.254526051s ago: executing program 0 (id=618): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0xfffffffb) syz_emit_ethernet(0xd6, &(0x7f00000008c0)={@local, @random="c82063dca13f", @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0xa0, 0x6, 0xff, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x28, 0xc2, 0x0, 0x0, 0x0, {[@mss={0x1e, 0x4, 0xa101}, @exp_smc={0xfe, 0x6}, @exp_fastopen={0xfe, 0x4}, @md5sig={0x13, 0x12, "7224407c80fe8a3616b4bf3400c800"}, @sack_perm={0x4, 0x2}, @mptcp=@remove_addr={0x1e, 0x67, 0x7, 0x0, "fc506a7b44fabd274ad44a3679cb353349f8bd6a4b41090ca4cdcd0ceb83f95ca1d072d23f1c487489953f688eee5fcda9f580522e75c6f0e6e4325d59c52bfedc69cc442dc28a0156ad2125d165ae98e5931c36440e9948bdcf3ec1c3600a08dced2f01"}]}}}}}}}}, 0x0) 47.231484341s ago: executing program 0 (id=619): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='oom_adj\x00') (async) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='oom_adj\x00') read$FUSE(r1, 0x0, 0x0) (async) read$FUSE(r1, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1000003, 0x13, r2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r4 = gettid() sigaltstack(&(0x7f0000000480)={&(0x7f0000002340)=""/4126, 0x80000001, 0x101e}, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) rt_sigqueueinfo(r4, 0x21, &(0x7f0000000100)={0x1e}) (async) rt_sigqueueinfo(r4, 0x21, &(0x7f0000000100)={0x1e}) socket$inet_smc(0x2b, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 46.108503901s ago: executing program 32 (id=595): madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(0xffffffffffffffff, 0xc0186445, &(0x7f0000000140)={0x9, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000180)={r2}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) ioctl$KVM_SET_IRQCHIP(r3, 0x4048aec9, &(0x7f0000000600)={0x6, 0x0, @pic={0x4, 0x45, 0x6, 0xc, 0xfe, 0x2, 0x3, 0x4, 0x0, 0x7f, 0x7, 0x4, 0x4, 0x17, 0xfc}}) r4 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x3, 0x0, @val=@netkit}, 0x1c) pread64(r4, &(0x7f0000000240)=""/162, 0xa2, 0x7) write$sysctl(r0, &(0x7f0000000580)='1\x00', 0x2) r5 = getuid() sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)=@newpolicy={0x108, 0x13, 0x2, 0x70bd28, 0x25dfdbfd, {{@in6=@mcast1, @in6=@rand_addr=' \x01\x00', 0x4e21, 0x0, 0x4e21, 0x0, 0xa, 0x40, 0x0, 0xc, 0x0, r5}, {0x7e, 0x5, 0xe0, 0x400, 0x2, 0x1, 0xf0c, 0x1800000000000}, {0x9, 0x7, 0x7b7, 0x7ff}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@replay_esn_val={0x40, 0x17, {0x9, 0x70bd27, 0x70bd26, 0x70bd2d, 0x70bd28, 0x2, [0x4, 0x10000, 0xc2f, 0xe73b, 0x1, 0x200, 0x9, 0x3, 0xfffffffb]}}, @replay_val={0x10, 0xa, {0x70bd29, 0x70bd28, 0x9}}]}, 0x108}, 0x1, 0x0, 0x0, 0x40448c0}, 0xc8080) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004011070009000101020301090220", @ANYRES16=r0], 0x0) write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x2) r6 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r6, &(0x7f00000018c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001800)=""/146, 0x92}}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r6, 0x29, 0x4d, &(0x7f0000000000)=0x8, 0x4) 43.212955704s ago: executing program 5 (id=620): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = gettid() r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x48000) read(r0, &(0x7f0000000000)=""/174, 0xae) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x4058534c, &(0x7f00000003c0)={0x80, 0x2, {0x1, 0x3, 0x8b2c, 0x3, 0x2c3}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f0000000300)={0x3ff, 0x1, {0x2, 0x0, 0x207b, 0x2, 0x9}, 0x100}) tkill(r1, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000080000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d300000000000001c0008800c0002400000000000007fff0c00014000000001000000000800054000000000140000001100010000"], 0xc8}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) gettid() (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x48000) (async) read(r0, &(0x7f0000000000)=""/174, 0xae) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x4058534c, &(0x7f00000003c0)={0x80, 0x2, {0x1, 0x3, 0x8b2c, 0x3, 0x2c3}}) (async) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f0000000300)={0x3ff, 0x1, {0x2, 0x0, 0x207b, 0x2, 0x9}, 0x100}) (async) tkill(r1, 0x10) (async) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000080000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d300000000000001c0008800c0002400000000000007fff0c00014000000001000000000800054000000000140000001100010000"], 0xc8}}, 0x0) (async) 42.962348466s ago: executing program 4 (id=621): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) syz_usb_connect(0x0, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000200)=""/26, 0x1a) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000440), 0x800) fcntl$getflags(r2, 0x401) close_range(r0, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$video4linux(&(0x7f0000000000), 0x7f, 0x349a40) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e00010000000000000000", @ANYRESOCT], 0xb8}}, 0x20040014) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/pm_trace', 0x2, 0x0) write$FUSE_NOTIFY_STORE(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB='-'], 0x28) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r3, 0xc0189373, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x5}}, './file0\x00'}) openat2(r1, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x80000, 0x23, 0xc}, 0x18) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000100)={'\x00', 0x800, 0x1, 0x4000003, 0x0, 0x76}) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r5, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, 0x4, 0x1, 0x301, 0x0, 0x0, {0x5, 0x0, 0x4004}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x40) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="64000000020605"], 0x64}, 0x1, 0x0, 0x0, 0x8840}, 0x4000090) r6 = landlock_create_ruleset(&(0x7f0000000040)={0x15113, 0x3, 0x3, 0x20, 0x7, 0x3}, 0x30, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) landlock_restrict_self(r6, 0x9) 42.961985609s ago: executing program 0 (id=622): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000000)="0323cf21eedb7b8c54de9898bd7c574f2da527110fc8b4a0ef88ada248bfee83251bf68a6b3642a3008e8b5ec9a8764cf4221cfbdfbfcb62f65b8c21c2d64fc78fc8abf4be398365b02e14786b3705e9e0910119fa4869df79cdc9d2157cbc0bd226f5496fc17b238bb4c9948618917f7df083f16d0f0c1ed35c8cb87e65c59492", 0x81}, {&(0x7f00000000c0)="f562ed2f0a5e52d73f8225989c3dab080faf6a793f1df0fb5ae23c0d87eae8bfaeab226811b918aef170193bb27f8207448ef6a0301516bf821e549743fc1338274b3d5ae06962ae5762850382ef7f20241cf4dce9fba2d64b8483ef505bf10adbea59ecf91c7416a47cfe82137366248ca3d7859b42d18996ea4ff6b3", 0x7d}, {&(0x7f0000000180)="4cb7d5ee5ee8473ed35ed974ae80d00a761e4491494bd260ab2687d8f9f09f6a084f65829e4e405708c36a816abf2d3723ecab407edc8c11fbf99ed02c4bd5baad06f88f6e74f45cc55c6e7db2c1ff9bac77b1ca7ab25965e84d93d3181020794dabe4330ab1bfe5a8db977ed4d549a12adbc5d1ddb3670d8e9123daf9a4b55507fa11965764d199a5dfee0f", 0x8c}, {&(0x7f0000000240)="d49745b413b319c3792d8fe023c25c63cdbe3b33a02b642a01af52c3ea525ab26f57abe7227a69f59db893671b685ab92330365146f7582f0b52fd4557cf79fbff8a64d36a6cb0", 0x47}, {&(0x7f0000000600)="88b2651c47be9812f532dd7c17459b43c683cfabf591bf81792384f428272e2c9e9e2abbd903fb674648a6652f8fb52c22c66b0fdd62cfa19a2370a016e23846d885f9ee994b61e4a8c4ddcbb72115d5ed7fbccddd502541fe5df7d193a31c0821c177eb33a1ff367529387fbe574e9b5e16e7b718eac6752aebf1589264678934de72a081e2ee76270305a9124b16e13f9dc07840223042024cd4bbb85408a5965ebd99cb5fb4d76c7fc55f681231b505dd18fd15a09414d35c07f1e48694", 0xbf}, {&(0x7f0000000400)="7dd80528060d1aab6541c7912eb13278c1b4c4755e16281bac6df4373f7e6b5d951048a32231d3ce72d644fe7cb64a12e40beb4c27333c5524a38311ae711892d899d3f6f1627794ddc8be87328fe4204ea3c750ce487c6e72fb6c129f7d7fd40ab993b5406ba3e1343d0dd7189f46da51aa3ee0488a5ee779bc7cee12d381ba096722158a1adff504da02c5399accdc08e96dba707dd985add96e8e6c9959dccf17bfe72b109a", 0xa7}, {&(0x7f00000004c0)="46a9489806a4d5ea51572ea20efbc47b5147ed", 0x13}], 0x7) syz_open_procfs(0x0, &(0x7f00000000c0)='fd\x00') mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000001, 0x401d132, 0xffffffffffffffff, 0x0) r1 = openat2(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x800, 0x25, 0x4}, 0x18) ioctl$FIBMAP(r1, 0x1, 0x0) syz_clone(0x2180100, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r3 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r2) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000000)={r3, 0x1c, 0x900}, &(0x7f0000000040)={'enc=', 'pkcs1', ' hash=', {'sha512\x00'}}, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4, 0x2}}}}}}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) 42.952049409s ago: executing program 2 (id=623): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000003100), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000003140)) (fail_nth: 1) 42.934603319s ago: executing program 1 (id=624): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="edcd1a9a3fc36e961ed00fe41b0cd695", 0x10) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x100403, 0x0) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000140)=0xfffffdfb) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000000)={0xffffffff, 0xc9a, 0x8007fffd, 0x0, 0xe, "dce4f0020100000000001b347d5c00010200"}) openat$vcsu(0xffffffffffffff9c, 0x0, 0x40100, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000001300)={0x2, 0x4f, 0x1000, 0xa2b, 0x18, "16a12379904418f759c3e93343f083cbdb4176"}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) chdir(0x0) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f0000000280)={0x81ff, 0x4, 0x4, 0xfffff6a8, 0x6, "c1d846f1120224c70b82426319d4c37ee7e4c0", 0x1, 0x4004}) open_tree(0xffffffffffffff9c, 0x0, 0x89901) unshare(0x22020600) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae03, 0x36) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x4, 0x200000005c831, 0xffffffffffffffff, 0x0) syz_clone(0x281011, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r3, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000000140)="a92e81d0991808e33c2330164cf023df", 0x10}, {&(0x7f00000001c0)="e1483f4367ab", 0x6}, {&(0x7f0000004100)="e3557f895e05a2343c3699c89ad9fba45686ea06f91ac993fe14db27561e761f26fe121cb4e7c08c20a687708ac3ee4eb5b56d5067144007c070916893507a43899c245ad9fb95618b43ca241f473f464d9e1cbcdb9e4dc7c91fb62b772cc36dd45aa9cba351dac56d9f1217b5faaa4fc9f6a5c7d8db5f48f40b7c0f39604add559bba8225ac7b5d54dddcae1417c6154057c7fd64ff03dfe14a7b84f58d69a91bed43c0e42beda9af872b05f51786c5f71b24f0a1786049bb49e789f03238713b961eaa22e4854d2131440e3c9a59928d7c94caf9f47d57712523798e0d3f2132b621337578bd7cc633664b908c4732a5ad4dd2b86bbc100896e34a013a181800f7269e9a84aa5c2c8419b89cb83c30098b15cbd9ceabed98221485c975919c69d8479a6c2d97c015577b", 0x12b}], 0x3, 0x0, 0x0, 0x4080}], 0x1, 0x80001) recvmmsg(r3, &(0x7f0000007080)=[{{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000a40)=""/107, 0x6b}, {&(0x7f0000000b00)=""/108, 0x6c}], 0x2}, 0xfffffff8}, {{0x0, 0x0, &(0x7f0000003240)=[{0x0}, {&(0x7f0000000cc0)=""/74, 0x4a}], 0x2}, 0x3}], 0x2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, r3, {0x1}}, './file0\x00'}) ioctl$TIOCGDEV(r4, 0x80045432, 0x0) 42.118538343s ago: executing program 2 (id=625): write(0xffffffffffffffff, &(0x7f0000000180)='10', 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x81d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x373}, &(0x7f00000005c0)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x1da}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x700, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb351, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5e8, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) write(r0, 0x0, 0x0) 42.115458277s ago: executing program 5 (id=626): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380), 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c8e000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x1000, 0x3}) 41.356275417s ago: executing program 5 (id=627): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB="020300000e0000000000000000000000050006003aff80000a00000400000000fc00000000000000000000000000000000000000000000000200010000000000000003180000000005000500000000000a"], 0x70}}, 0x0) socket$inet6(0xa, 0x80000, 0x100) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 41.250564939s ago: executing program 0 (id=628): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x402, 0x2a) write(r0, &(0x7f0000000180)='100', 0x3) r1 = syz_ublk_setup_io_uring(0x81d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x373}, &(0x7f00000005c0)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb351, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5e8, 0x0, 0x0}}, 0x0) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r8, &(0x7f0000000280)='0', 0x1) 40.642710134s ago: executing program 2 (id=629): ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, 0x0) socket(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_emit_ethernet(0x1379, &(0x7f0000000c80)=ANY=[@ANYBLOB="15420408cee3ffffffffffff86dd6099cea613432c03cb697a653e336f000000500000000000ff0200000000000000000000000000011600002e"], 0x0) syz_emit_ethernet(0x66, &(0x7f0000000000)=ANY=[@ANYBLOB="69e1629b6174391e7dd7a2d786dd60b6000000302c03cb697a653e336f000000500000000000ff0200000000000000000007ffffff013a000003"], 0x0) 40.372921896s ago: executing program 1 (id=630): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}, {0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044014) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000100)={0x1, 0x5}, 0x8) close_range(r2, 0xffffffffffffffff, 0x0) r3 = io_uring_setup(0x350, &(0x7f0000000580)={0x0, 0x826f, 0x40, 0x1, 0x117}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000140)) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x18, 0x41, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}]}, 0x18}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0xa1300) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x20042) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, &(0x7f0000000340)={0x0, 0x0, {0x0, 0x1, 0x7f, 0x3, 0x7}, 0x1005}) write$sndseq(r6, &(0x7f0000000140)=[{0x1f, 0x0, 0x0, 0xfd, @tick=0x5ab7, {0xff}, {}, @raw32}], 0x1c) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000640)=[{0x0}], 0x178) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6a0ac4ff02"], 0x0, 0x0, 0x5e}, 0x94) io_uring_register$IORING_REGISTER_FILES(r3, 0x1e, &(0x7f0000000000)=[r3], 0x1) 40.243849198s ago: executing program 5 (id=631): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)={0x6c, 0xb, 0x6, 0x801, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x44, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @dev={0xfe, 0x80, '\x00', 0x21}}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private1}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x1}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20008008}, 0x4800) (fail_nth: 5) 40.14580457s ago: executing program 2 (id=632): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x38, 0x140d, 0x300, 0x70bd2a, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_MRN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x40040}, 0x4001081) r0 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 40.145445287s ago: executing program 0 (id=633): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001240)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x4, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x8, 0x5, 0x0, 0x0, 0x0, 0x2c04, 0x0, 0x0, 0x25cf, 0x800000, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, 0x10000, 0x401, 0xfffffffe, 0x0, 0x0, 0xffffffff, 0x3, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0xfffffffe, 0x0, 0xffffffff, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0xfffffff7, 0x1ff, 0x0, 0x0, 0x0, 0x80000000, 0xfffffffa, 0x7, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x101, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10002, 0x0, 0xd5a9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x9, 0xfffffeff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, 0x0, 0x0, 0x0, 0x100000, 0x1000, 0x0, 0x0, 0x40000, 0x7fff25c8, 0x0, 0x0, 0x7, 0xd4, 0x8000c, 0x5, 0x0, 0xffffffff, 0xffffffff, 0x302e, 0x0, 0x1, 0x0, 0x6, 0x8, 0x0, 0x1, 0x0, 0xfffffffc, 0x0, 0x0, 0x8, 0x0, 0x1, 0x20000000, 0x4, 0x0, 0x0, 0x3, 0x3, 0x9, 0x2, 0x0, 0x1, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x3ff, 0xfffffffc, 0x0, 0xfffffffd, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x9, 0x0, 0x0, 0x40000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x10000, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x9]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x2}, {0x2, 0x0, 0x5, 0x0, 0x0, 0x40}}}]}}]}, 0x45c}}, 0x0) 39.900902581s ago: executing program 4 (id=634): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0xf) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xfffffeffffffffff]}, 0x0, 0x8) r1 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000000380)=0x0) r3 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x35, 0x4, @tid=r3}, &(0x7f0000000380)=0x0) timer_settime(r4, 0x1, &(0x7f0000000080)={{0x77359400}, {0x0, 0x989680}}, 0x0) timer_settime(r2, 0x1, &(0x7f0000000080)={{0x77359400}, {0x0, 0x989680}}, 0x0) r5 = gettid() tkill(r5, 0x16) timer_settime(0x0, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) r6 = socket(0x5, 0x0, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) socket$netlink(0x10, 0x3, 0xa) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) socket$nl_route(0x10, 0x3, 0x0) r8 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, 0x0) connect$can_bcm(r8, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000840)=ANY=[@ANYBLOB="050000000400000005000000", @ANYRESOCT=r8, @ANYBLOB="7f08e139263d11c82234ae19b262b6fd3b0ac322f58ae5037cfa9747442cedee21cd05eee2e906922db30cac19306b9ccb30b1cf08e3a593c00582408475b9840b16ea8d01adcfc025b3", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES32=r7], 0x48}, 0x1, 0x0, 0x0, 0x8008}, 0x40) sendmsg$can_bcm(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=ANY=[@ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) 39.763207172s ago: executing program 5 (id=635): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206050000000000000000000000000014000780080019400000000005001500000000000500010006000000050005000200000005000400000000000900020073797a31000000000d000300686173683a6e657400000000"], 0x5c}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x3, 0x2}, 0x18, 0x0) capset(0x0, &(0x7f0000000080)={0x0, 0x1, 0x8}) r1 = add_key$user(&(0x7f0000000080), &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)='5', 0x1, 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r1, 0xfffffffffffffffb, 0x0, 0x1) socket$inet6_sctp(0xa, 0x1, 0x84) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0) futex(0x0, 0x84, 0x0, 0x0, 0x0, 0xb0090199) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0x2, 0x0, 0x83, "00000000000000000000ffff00000000000002"}) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000080)={0xff, 0xfffffffd, 0xb8, 0x4, 0xc, "e3143c1cc267f7b7cdb242e1ff07a6905446b3"}) r3 = syz_open_pts(r2, 0x0) dup3(r3, r2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000080)="f30f09b800228ed00f20e06635080000000f22e00f21a1f30fc7b400000f20c06635100000000f22c0646664660f380817f2660f35bad104527c000000650fc7af95de8ec0", 0x45}], 0x1, 0x3, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000100)={0x3, 0x3, {0xffffffffffffffff}, {}, 0x9b47, 0x8001}) ptrace(0x8, r9) ioctl$KVM_NMI(r8, 0xae9a) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x80000000000, 0x9, 0x7, 0x0, 0x5, 0x20000100000000, 0x2, 0xffffffffffffffff], 0x0, 0x200}) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="44000000180001002cbd7000000000000a0000000002ff000000000008000400", @ANYRES32=r5, @ANYBLOB="0600150007000000180016801400010001"], 0x44}}, 0x2000c800) syz_emit_ethernet(0x112, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd603000bb00dc2b00fc020000000000000000000000000001fc"], 0x0) 39.643713301s ago: executing program 2 (id=636): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r3 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c8e000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x1000, 0x3}) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x268, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xa8, 0xc8, 0x0, {0x0, 0x2000000000000}}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2c8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000032073797a6b616c6c65723000001800128008000100767266000c00028008"], 0x48}}, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 39.534062517s ago: executing program 1 (id=637): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380), 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c8e000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x1000, 0x3}) 0s ago: executing program 33 (id=633): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001240)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x4, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x8, 0x5, 0x0, 0x0, 0x0, 0x2c04, 0x0, 0x0, 0x25cf, 0x800000, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, 0x10000, 0x401, 0xfffffffe, 0x0, 0x0, 0xffffffff, 0x3, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0xfffffffe, 0x0, 0xffffffff, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0xfffffff7, 0x1ff, 0x0, 0x0, 0x0, 0x80000000, 0xfffffffa, 0x7, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x101, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10002, 0x0, 0xd5a9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x9, 0xfffffeff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, 0x0, 0x0, 0x0, 0x100000, 0x1000, 0x0, 0x0, 0x40000, 0x7fff25c8, 0x0, 0x0, 0x7, 0xd4, 0x8000c, 0x5, 0x0, 0xffffffff, 0xffffffff, 0x302e, 0x0, 0x1, 0x0, 0x6, 0x8, 0x0, 0x1, 0x0, 0xfffffffc, 0x0, 0x0, 0x8, 0x0, 0x1, 0x20000000, 0x4, 0x0, 0x0, 0x3, 0x3, 0x9, 0x2, 0x0, 0x1, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x3ff, 0xfffffffc, 0x0, 0xfffffffd, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x9, 0x0, 0x0, 0x40000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x10000, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x9]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x2}, {0x2, 0x0, 0x5, 0x0, 0x0, 0x40}}}]}}]}, 0x45c}}, 0x0) kernel console output (not intermixed with test programs): 7] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 127.374490][ T6457] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 127.375878][ T6457] bond0 (unregistering): Released all slaves [ 127.411121][ T6462] netlink: 20 bytes leftover after parsing attributes in process `syz.4.248'. [ 127.427893][ T1150] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.428172][ T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.428330][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.429415][ T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.744685][ T6477] binder: 6475:6477 ioctl c0104d03 2000000003c0 returned -22 [ 127.876423][ T5709] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 128.038004][ T5709] usb 5-1: Using ep0 maxpacket: 16 [ 128.040645][ T5709] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 128.043580][ T5709] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 128.043606][ T5709] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 128.088677][ T5709] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.088708][ T5709] usb 5-1: Product: syz [ 128.088722][ T5709] usb 5-1: Manufacturer: syz [ 128.088736][ T5709] usb 5-1: SerialNumber: syz [ 128.132880][ T5709] usb 5-1: 0:2 : does not exist [ 128.296802][ T5712] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 128.342352][ T5709] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 128.444158][ T5709] usb 5-1: USB disconnect, device number 10 [ 128.456546][ T5712] usb 3-1: Using ep0 maxpacket: 8 [ 128.457422][ T5712] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 128.458436][ T5712] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 128.458459][ T5712] usb 3-1: config 0 has no interface number 0 [ 128.458499][ T5712] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 128.458525][ T5712] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 128.458551][ T5712] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 128.458576][ T5712] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 128.458617][ T5712] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.638832][ T5712] usb 3-1: config 0 descriptor?? [ 128.657293][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 128.667621][ T5712] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 128.948951][ T5709] usb 3-1: USB disconnect, device number 9 [ 128.948991][ C1] ldusb 3-1:0.55: usb_submit_urb failed (-19) [ 128.995438][ T6494] PM: Enabling pm_trace changes system date and time during resume. [ 128.995438][ T6494] PM: Correct system time has to be restored manually after resume. [ 129.019690][ T6494] netlink: 80 bytes leftover after parsing attributes in process `syz.2.256'. [ 129.226845][ T5712] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 129.247374][ T6498] openvswitch: netlink: Flow key attr not present in new flow. [ 129.326598][ T6502] FAULT_INJECTION: forcing a failure. [ 129.326598][ T6502] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 129.326630][ T6502] CPU: 0 UID: 0 PID: 6502 Comm: syz.4.260 Not tainted syzkaller #0 PREEMPT(full) [ 129.326656][ T6502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 129.326667][ T6502] Call Trace: [ 129.326675][ T6502] [ 129.326683][ T6502] dump_stack_lvl+0xe8/0x150 [ 129.326716][ T6502] should_fail_ex+0x410/0x560 [ 129.326745][ T6502] _copy_from_iter+0x1d3/0x1660 [ 129.326770][ T6502] ? __alloc_skb+0x27a/0x7a0 [ 129.326797][ T6502] ? __alloc_skb+0x27a/0x7a0 [ 129.326823][ T6502] ? __alloc_skb+0x27a/0x7a0 [ 129.326848][ T6502] ? __pfx__copy_from_iter+0x10/0x10 [ 129.326869][ T6502] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 129.326888][ T6502] ? __alloc_skb+0x27a/0x7a0 [ 129.326920][ T6502] ? __alloc_skb+0x27a/0x7a0 [ 129.326949][ T6502] ? netlink_sendmsg+0x650/0xb40 [ 129.326970][ T6502] ? skb_put+0x112/0x210 [ 129.326998][ T6502] netlink_sendmsg+0x6c0/0xb40 [ 129.327027][ T6502] ? __pfx_netlink_sendmsg+0x10/0x10 [ 129.327055][ T6502] ? apparmor_socket_sendmsg+0x98/0x360 [ 129.327081][ T6502] ? __pfx_netlink_sendmsg+0x10/0x10 [ 129.327101][ T6502] sock_sendmsg_nosec+0x13a/0x180 [ 129.327125][ T6502] ____sys_sendmsg+0x54e/0x850 [ 129.327158][ T6502] ? __pfx_____sys_sendmsg+0x10/0x10 [ 129.327194][ T6502] ? import_iovec+0x73/0xa0 [ 129.327222][ T6502] ___sys_sendmsg+0x2a5/0x360 [ 129.327249][ T6502] ? __lock_acquire+0x747/0x2de0 [ 129.327274][ T6502] ? __pfx____sys_sendmsg+0x10/0x10 [ 129.327300][ T6502] ? __lock_acquire+0x747/0x2de0 [ 129.327325][ T6502] ? kstrtouint+0x6e/0xe0 [ 129.327382][ T6502] __sys_sendmmsg+0x273/0x4d0 [ 129.327415][ T6502] ? __pfx___sys_sendmmsg+0x10/0x10 [ 129.327452][ T6502] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 129.327496][ T6502] ? ksys_write+0x242/0x270 [ 129.327523][ T6502] ? __pfx_ksys_write+0x10/0x10 [ 129.327548][ T6502] __x64_sys_sendmmsg+0xa0/0xc0 [ 129.327578][ T6502] do_syscall_64+0x166/0x520 [ 129.327604][ T6502] ? trace_irq_disable+0x3b/0x140 [ 129.327625][ T6502] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.327645][ T6502] ? clear_bhb_loop+0x70/0xc0 [ 129.327668][ T6502] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.327687][ T6502] RIP: 0033:0x7f2fdeb9e159 [ 129.327706][ T6502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.327722][ T6502] RSP: 002b:00007f2fdf9ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 129.327744][ T6502] RAX: ffffffffffffffda RBX: 00007f2fdee25fa0 RCX: 00007f2fdeb9e159 [ 129.327758][ T6502] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 129.327771][ T6502] RBP: 00007f2fdf9ac090 R08: 0000000000000000 R09: 0000000000000000 [ 129.327783][ T6502] R10: 00000000000000fc R11: 0000000000000246 R12: 0000000000000001 [ 129.327795][ T6502] R13: 00007f2fdee26038 R14: 00007f2fdee25fa0 R15: 00007f2fdef4fa48 [ 129.327824][ T6502] [ 129.381524][ T5712] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 129.385384][ T5712] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 129.385409][ T5712] usb 2-1: config 0 has no interfaces? [ 129.391667][ T5712] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.391693][ T5712] usb 2-1: Product: syz [ 129.391706][ T5712] usb 2-1: Manufacturer: syz [ 129.391720][ T5712] usb 2-1: SerialNumber: syz [ 129.419087][ T5712] usb 2-1: config 0 descriptor?? [ 129.756030][ T30] audit: type=1326 audit(1790590266.263:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6487 comm="syz.1.257" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f38f499e159 code=0x0 [ 130.196537][ T25] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 130.356491][ T25] usb 5-1: Using ep0 maxpacket: 32 [ 130.357352][ T25] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 130.368170][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.368197][ T25] usb 5-1: Product: syz [ 130.368211][ T25] usb 5-1: Manufacturer: syz [ 130.368225][ T25] usb 5-1: SerialNumber: syz [ 130.605542][ T6522] binder: 6520:6522 ioctl c0104d03 2000000003c0 returned -22 [ 130.650887][ T25] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 130.651297][ T25] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 130.827830][ T25] usb 5-1: USB disconnect, device number 11 [ 130.940924][ T5636] udevd[5636]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 131.063187][ T5709] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 131.400367][ T25] usb 2-1: USB disconnect, device number 15 [ 131.817100][ T6535] openvswitch: netlink: Flow key attr not present in new flow. [ 132.187934][ T9] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 132.226706][ T5709] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 132.376676][ T5709] usb 4-1: Using ep0 maxpacket: 16 [ 132.379815][ T5709] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 132.385609][ T5709] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 132.385649][ T5709] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 132.440369][ T5709] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.440412][ T5709] usb 4-1: Product: syz [ 132.440428][ T5709] usb 4-1: Manufacturer: syz [ 132.440465][ T5709] usb 4-1: SerialNumber: syz [ 132.502198][ T5709] usb 4-1: 0:2 : does not exist [ 132.698973][ T5709] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 132.789152][ T5709] usb 4-1: USB disconnect, device number 10 [ 132.888142][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 132.921079][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 132.921135][ T9] usb 2-1: New USB device found, idVendor=7475, idProduct=652f, bcdDevice=65.76 [ 132.921171][ T9] usb 2-1: no configurations [ 132.921183][ T9] usb 2-1: can't read configurations, error -22 [ 132.946854][ T5712] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 132.975667][ T25] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 133.126475][ T25] usb 3-1: Using ep0 maxpacket: 8 [ 133.127380][ T25] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 133.130023][ T25] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 133.130048][ T25] usb 3-1: config 0 has no interface number 0 [ 133.130086][ T25] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 133.130135][ T25] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 133.130158][ T25] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 133.130181][ T25] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 133.130221][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.133631][ T25] usb 3-1: config 0 descriptor?? [ 133.167881][ T25] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 133.420203][ T25] usb 3-1: USB disconnect, device number 10 [ 133.420318][ C1] ldusb 3-1:0.55: usb_submit_urb failed (-19) [ 133.491138][ T6562] PM: Enabling pm_trace changes system date and time during resume. [ 133.491138][ T6562] PM: Correct system time has to be restored manually after resume. [ 133.535129][ T6562] netlink: 80 bytes leftover after parsing attributes in process `syz.2.279'. [ 133.602130][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.602185][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.735131][ T5712] usb 5-1: unable to get BOS descriptor or descriptor too short [ 133.735216][ T5712] usb 5-1: New USB device found, idVendor=7475, idProduct=652f, bcdDevice=65.76 [ 133.735253][ T5712] usb 5-1: no configurations [ 133.735264][ T5712] usb 5-1: can't read configurations, error -22 [ 134.057205][ T10] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 134.097763][ T6575] openvswitch: netlink: Flow key attr not present in new flow. [ 134.207102][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 134.225360][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 134.225414][ T10] usb 4-1: New USB device found, idVendor=0b3c, idProduct=c003, bcdDevice=70.55 [ 134.245923][ T10] usb 4-1: config 9 has an invalid interface number: 245 but max is 0 [ 134.245962][ T10] usb 4-1: config 9 has no interface number 0 [ 134.246010][ T10] usb 4-1: config 9 interface 245 altsetting 17 has an invalid descriptor for endpoint zero, skipping [ 134.246033][ T10] usb 4-1: config 9 interface 245 has no altsetting 0 [ 134.294830][ T10] usb 4-1: string descriptor 0 read error: -22 [ 134.294969][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.341088][ T10] option 4-1:9.245: GSM modem (1-port) converter detected [ 134.549454][ T5681] usb 4-1: USB disconnect, device number 11 [ 134.560568][ T5681] option 4-1:9.245: device disconnected [ 134.632194][ T6585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.632642][ T6585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.796526][ T9] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 134.957280][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 134.958250][ T9] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 134.962522][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.962549][ T9] usb 2-1: Product: syz [ 134.962563][ T9] usb 2-1: Manufacturer: syz [ 134.962796][ T9] usb 2-1: SerialNumber: syz [ 135.229322][ T6596] syzkaller0: entered promiscuous mode [ 135.229347][ T6596] syzkaller0: entered allmulticast mode [ 135.310347][ T6597] simple: /dev/video#_74 [ 135.311266][ T6597] simple: /dev/video#_148 [ 135.311282][ T6597] simple: /dev/video#_222 [ 135.311292][ T6597] simple: /dev/video#_296 [ 135.311303][ T6597] simple: /dev/video#_370 [ 135.311312][ T6597] simple: /dev/video#_444 [ 135.311322][ T6597] simple: /dev/video#_518 [ 135.311332][ T6597] simple: /dev/video#_592 [ 135.311341][ T6597] simple: /dev/video#_666 [ 135.311351][ T6597] simple: /dev/video#_740 [ 135.311361][ T6597] simple: /dev/video#_814 [ 135.311370][ T6597] simple: /dev/video#_888 [ 135.311380][ T6597] simple: /dev/video#_962 [ 135.311390][ T6597] simple: /dev/video#_1036 [ 135.311399][ T6597] simple: /dev/video#_1110 [ 135.311409][ T6597] simple: /dev/video#_1184 [ 135.311419][ T6597] simple: /dev/video#_1258 [ 135.311426][ T6597] simple: /dev/video#_1332 [ 135.311434][ T6597] simple: /dev/video#_1406 [ 135.311441][ T6597] simple: /dev/video#_1480 [ 135.311449][ T6597] simple: /dev/video#_1554 [ 135.311456][ T6597] simple: /dev/video#_1628 [ 135.311465][ T6597] simple: /dev/video#_1702 [ 135.311473][ T6597] simple: /dev/video#_1776 [ 135.311483][ T6597] simple: /dev/video#_1850 [ 135.311492][ T6597] simple: /dev/video#_1924 [ 135.311501][ T6597] simple: /dev/video#_1998 [ 135.311509][ T6597] simple: /dev/video#_2072 [ 135.311518][ T6597] simple: /dev/video#_2146 [ 135.311527][ T6597] simple: /dev/video#_2220 [ 135.311537][ T6597] simple: /dev/video#_2294 [ 135.311547][ T6597] simple: /dev/video#_2368 [ 135.311557][ T6597] TC_ACT_REPEAT abuse ? [ 135.456008][ T9] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 135.527653][ T9] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 135.679435][ T25] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 135.683660][ T9] usb 2-1: USB disconnect, device number 18 [ 136.193843][ T5636] udevd[5636]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 136.363843][ T6604] netlink: 8 bytes leftover after parsing attributes in process `syz.2.295'. [ 137.132179][ T6624] netlink: 80 bytes leftover after parsing attributes in process `syz.1.302'. [ 137.212943][ T6626] netlink: 12 bytes leftover after parsing attributes in process `syz.2.303'. [ 137.292262][ T30] audit: type=1326 audit(1790590273.803:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6627 comm="syz.1.305" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f38f499e159 code=0x7ffc0000 [ 137.292510][ T30] audit: type=1326 audit(1790590273.803:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6627 comm="syz.1.305" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f38f499e159 code=0x7ffc0000 [ 137.326079][ T30] audit: type=1326 audit(1790590273.833:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6627 comm="syz.1.305" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f38f499e159 code=0x7ffc0000 [ 137.326126][ T30] audit: type=1326 audit(1790590273.833:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6627 comm="syz.1.305" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f38f499e159 code=0x7ffc0000 [ 137.326172][ T30] audit: type=1326 audit(1790590273.833:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6627 comm="syz.1.305" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f38f499e159 code=0x7ffc0000 [ 137.333667][ T30] audit: type=1326 audit(1790590273.843:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6627 comm="syz.1.305" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f38f499e159 code=0x7ffc0000 [ 137.435385][ T30] audit: type=1326 audit(1790590273.943:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6627 comm="syz.1.305" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f38f499e159 code=0x7ffc0000 [ 137.443025][ T30] audit: type=1326 audit(1790590273.953:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6627 comm="syz.1.305" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f38f499e159 code=0x7ffc0000 [ 137.478920][ T30] audit: type=1326 audit(1790590273.993:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6627 comm="syz.1.305" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=233 compat=0 ip=0x7f38f499e159 code=0x7ffc0000 [ 137.478972][ T30] audit: type=1326 audit(1790590273.993:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6627 comm="syz.1.305" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f38f499e159 code=0x7ffc0000 [ 137.607009][ T25] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 137.743624][ T6639] netlink: 8 bytes leftover after parsing attributes in process `syz.1.309'. [ 137.757330][ T25] usb 3-1: Using ep0 maxpacket: 8 [ 137.758131][ T25] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 137.767341][ T25] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 137.767371][ T25] usb 3-1: config 0 has no interface number 0 [ 137.767406][ T25] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 137.767428][ T25] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 137.767451][ T25] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 137.767474][ T25] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 137.767514][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.778514][ T25] usb 3-1: config 0 descriptor?? [ 137.810741][ T25] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 137.946207][ T6642] mmap: syz.4.304 (6642) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 137.988126][ T44] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 138.064329][ T5712] usb 3-1: USB disconnect, device number 11 [ 138.064414][ C1] ldusb 3-1:0.55: usb_submit_urb failed (-19) [ 138.099065][ T6645] PM: Enabling pm_trace changes system date and time during resume. [ 138.099065][ T6645] PM: Correct system time has to be restored manually after resume. [ 138.113060][ T6645] netlink: 80 bytes leftover after parsing attributes in process `syz.2.306'. [ 138.136440][ T44] usb 4-1: Using ep0 maxpacket: 32 [ 138.137619][ T44] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 138.142199][ T44] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 138.142231][ T44] usb 4-1: config 0 has no interfaces? [ 138.144764][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.144790][ T44] usb 4-1: Product: syz [ 138.144804][ T44] usb 4-1: Manufacturer: syz [ 138.144817][ T44] usb 4-1: SerialNumber: syz [ 138.174956][ T44] usb 4-1: config 0 descriptor?? [ 138.356375][ T6630] netlink: 8 bytes leftover after parsing attributes in process `syz.4.304'. [ 138.358059][ T6630] usb usb1: usbfs: process 6630 (syz.4.304) did not claim interface 0 before use [ 138.384595][ T5681] usb 4-1: USB disconnect, device number 12 [ 138.430053][ T44] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 138.576448][ T44] usb 2-1: Using ep0 maxpacket: 32 [ 138.578836][ T44] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 138.607955][ T44] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.607983][ T44] usb 2-1: Product: syz [ 138.607997][ T44] usb 2-1: Manufacturer: syz [ 138.608012][ T44] usb 2-1: SerialNumber: syz [ 138.630330][ T1150] IPVS: starting estimator thread 0... [ 138.718114][ T6652] IPVS: using max 36 ests per chain, 86400 per kthread [ 138.739799][ T6656] FAULT_INJECTION: forcing a failure. [ 138.739799][ T6656] name failslab, interval 1, probability 0, space 0, times 0 [ 138.739832][ T6656] CPU: 0 UID: 0 PID: 6656 Comm: syz.4.314 Not tainted syzkaller #0 PREEMPT(full) [ 138.739855][ T6656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 138.739866][ T6656] Call Trace: [ 138.739874][ T6656] [ 138.739883][ T6656] dump_stack_lvl+0xe8/0x150 [ 138.739915][ T6656] should_fail_ex+0x410/0x560 [ 138.739944][ T6656] should_failslab+0xa8/0x100 [ 138.739971][ T6656] __kmalloc_noprof+0xfe/0x720 [ 138.739996][ T6656] ? io_cache_alloc_new+0x40/0x100 [ 138.740016][ T6656] ? io_cache_alloc_new+0x40/0x100 [ 138.740036][ T6656] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 138.740066][ T6656] io_cache_alloc_new+0x40/0x100 [ 138.740087][ T6656] __io_prep_rw+0x281/0xe70 [ 138.740119][ T6656] ? __pfx___io_prep_rw+0x10/0x10 [ 138.740142][ T6656] ? __pfx_task_work_add+0x10/0x10 [ 138.740167][ T6656] ? io_arm_poll_handler+0x1d4/0x2a0 [ 138.740197][ T6656] io_prep_write+0x36/0x110 [ 138.740218][ T6656] ? io_req_normal_work_add+0x1a7/0x290 [ 138.740248][ T6656] io_submit_sqes+0xbde/0x2310 [ 138.740299][ T6656] __se_sys_io_uring_enter+0x35b/0x1bb0 [ 138.740332][ T6656] ? __fget_files+0x3a2/0x420 [ 138.740362][ T6656] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 138.740386][ T6656] ? fput+0xa0/0xd0 [ 138.740410][ T6656] ? ksys_write+0x242/0x270 [ 138.740431][ T6656] ? __pfx_ksys_write+0x10/0x10 [ 138.740456][ T6656] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 138.740481][ T6656] do_syscall_64+0x166/0x520 [ 138.740506][ T6656] ? trace_irq_disable+0x3b/0x140 [ 138.740534][ T6656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.740554][ T6656] ? clear_bhb_loop+0x70/0xc0 [ 138.740578][ T6656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.740597][ T6656] RIP: 0033:0x7f2fdeb9e159 [ 138.740615][ T6656] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.740631][ T6656] RSP: 002b:00007f2fdf9ac028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 138.740652][ T6656] RAX: ffffffffffffffda RBX: 00007f2fdee25fa0 RCX: 00007f2fdeb9e159 [ 138.740667][ T6656] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 138.740680][ T6656] RBP: 00007f2fdf9ac090 R08: 0000000000000000 R09: 0000000000000000 [ 138.740692][ T6656] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 138.740704][ T6656] R13: 00007f2fdee26038 R14: 00007f2fdee25fa0 R15: 00007f2fdef4fa48 [ 138.740735][ T6656] [ 138.976760][ T44] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 138.977555][ T44] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 139.101362][ T6662] FAULT_INJECTION: forcing a failure. [ 139.101362][ T6662] name failslab, interval 1, probability 0, space 0, times 0 [ 139.101398][ T6662] CPU: 0 UID: 0 PID: 6662 Comm: syz.3.315 Not tainted syzkaller #0 PREEMPT(full) [ 139.101420][ T6662] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 139.101432][ T6662] Call Trace: [ 139.101440][ T6662] [ 139.101449][ T6662] dump_stack_lvl+0xe8/0x150 [ 139.101483][ T6662] should_fail_ex+0x410/0x560 [ 139.101510][ T6662] ? __alloc_skb+0x1db/0x7a0 [ 139.101534][ T6662] should_failslab+0xa8/0x100 [ 139.101562][ T6662] ? __alloc_skb+0x1db/0x7a0 [ 139.101584][ T6662] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 139.101605][ T6662] ? __alloc_skb+0x18d/0x7a0 [ 139.101627][ T6662] ? __alloc_skb+0x1db/0x7a0 [ 139.101665][ T6662] __alloc_skb+0x1db/0x7a0 [ 139.101689][ T6662] netlink_ack+0x136/0xb30 [ 139.101710][ T6662] ? kasan_quarantine_put+0xbb/0x1f0 [ 139.101729][ T6662] ? lockdep_hardirqs_on+0x7b/0x110 [ 139.101763][ T6662] nfnetlink_rcv+0x260c/0x28c0 [ 139.101817][ T6662] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 139.101859][ T6662] ? ref_tracker_free+0x689/0x830 [ 139.101907][ T6662] ? skb_clone+0x246/0x3a0 [ 139.101938][ T6662] ? __netlink_deliver_tap+0x811/0x860 [ 139.101966][ T6662] ? netlink_deliver_tap+0x2e/0x1b0 [ 139.101986][ T6662] ? netlink_deliver_tap+0x2e/0x1b0 [ 139.102013][ T6662] netlink_unicast+0x7bd/0x940 [ 139.102052][ T6662] netlink_sendmsg+0x813/0xb40 [ 139.102081][ T6662] ? __pfx_netlink_sendmsg+0x10/0x10 [ 139.102110][ T6662] ? apparmor_socket_sendmsg+0x98/0x360 [ 139.102136][ T6662] ? __pfx_netlink_sendmsg+0x10/0x10 [ 139.102231][ T6662] sock_sendmsg_nosec+0x13a/0x180 [ 139.102261][ T6662] ____sys_sendmsg+0x54e/0x850 [ 139.102295][ T6662] ? __pfx_____sys_sendmsg+0x10/0x10 [ 139.102332][ T6662] ? import_iovec+0x73/0xa0 [ 139.102362][ T6662] ___sys_sendmsg+0x2a5/0x360 [ 139.102389][ T6662] ? __lock_acquire+0x747/0x2de0 [ 139.102415][ T6662] ? __pfx____sys_sendmsg+0x10/0x10 [ 139.102476][ T6662] ? __fget_files+0x2a/0x420 [ 139.102503][ T6662] ? __fget_files+0x3a2/0x420 [ 139.102556][ T6662] __x64_sys_sendmsg+0x1b1/0x290 [ 139.102588][ T6662] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 139.102630][ T6662] do_syscall_64+0x166/0x520 [ 139.102721][ T6662] ? trace_irq_disable+0x3b/0x140 [ 139.102742][ T6662] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.102761][ T6662] ? clear_bhb_loop+0x70/0xc0 [ 139.102783][ T6662] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.102802][ T6662] RIP: 0033:0x7fb814d9e159 [ 139.102821][ T6662] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 139.102839][ T6662] RSP: 002b:00007fb815c56028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 139.102861][ T6662] RAX: ffffffffffffffda RBX: 00007fb815025fa0 RCX: 00007fb814d9e159 [ 139.102877][ T6662] RDX: 0000000004000800 RSI: 0000200000000000 RDI: 0000000000000003 [ 139.102891][ T6662] RBP: 00007fb815c56090 R08: 0000000000000000 R09: 0000000000000000 [ 139.102904][ T6662] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 139.102917][ T6662] R13: 00007fb815026038 R14: 00007fb815025fa0 R15: 00007fb81514fa48 [ 139.102946][ T6662] [ 139.219860][ T44] usb 2-1: USB disconnect, device number 19 [ 139.534265][ T5630] udevd[5630]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 140.303678][ T5712] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 140.736881][ T6697] tipc: Started in network mode [ 140.737357][ T6697] tipc: Node identity 7f000001, cluster identity 4711 [ 140.746621][ T44] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 140.756101][ T6697] tipc: Enabling of bearer rejected, failed to enable media [ 140.900643][ T44] usb 4-1: Using ep0 maxpacket: 16 [ 140.901377][ T44] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 140.912588][ T44] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 140.912613][ T44] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 140.919372][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.919397][ T44] usb 4-1: Product: syz [ 140.919411][ T44] usb 4-1: Manufacturer: syz [ 140.919424][ T44] usb 4-1: SerialNumber: syz [ 140.959622][ T44] usb 4-1: 0:2 : does not exist [ 140.961915][ T5712] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 141.137255][ T5712] usb 2-1: Using ep0 maxpacket: 32 [ 141.138115][ T5712] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 141.145430][ T5712] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.145463][ T5712] usb 2-1: Product: syz [ 141.145481][ T5712] usb 2-1: Manufacturer: syz [ 141.145525][ T5712] usb 2-1: SerialNumber: syz [ 141.179214][ T44] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 141.204858][ T6714] syzkaller1: entered promiscuous mode [ 141.204881][ T6714] syzkaller1: entered allmulticast mode [ 141.334092][ T44] usb 4-1: USB disconnect, device number 13 [ 141.386134][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 141.423932][ T6718] bond1: option updelay: invalid value (18446744073256566793) [ 141.423958][ T6718] bond1: option updelay: allowed values 0 - 2147483647 [ 141.443677][ T6718] bond1 (unregistering): Released all slaves [ 141.450438][ T5712] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 141.453025][ T5712] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 141.548210][ T6723] syzkaller1: entered promiscuous mode [ 141.548226][ T6723] syzkaller1: entered allmulticast mode [ 141.552769][ T6727] binder: 6725:6727 ioctl c0104d03 2000000003c0 returned -22 [ 141.564547][ T5712] usb 2-1: USB disconnect, device number 20 [ 141.653981][ T5636] udevd[5636]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 142.006541][ T44] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 142.156948][ T44] usb 5-1: Using ep0 maxpacket: 8 [ 142.157655][ T44] usb 5-1: New USB device found, idVendor=2b73, idProduct=000a, bcdDevice= 0.40 [ 142.158763][ T44] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 142.158785][ T44] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 142.160911][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.160935][ T44] usb 5-1: Product: syz [ 142.160949][ T44] usb 5-1: Manufacturer: syz [ 142.160961][ T44] usb 5-1: SerialNumber: syz [ 142.248908][ T6743] netlink: 36 bytes leftover after parsing attributes in process `syz.1.342'. [ 142.685087][ T6762] syzkaller0: entered promiscuous mode [ 142.685109][ T6762] syzkaller0: entered allmulticast mode [ 142.765806][ T44] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 142.800206][ T44] usb 5-1: USB disconnect, device number 14 [ 142.843550][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 143.266524][ T10] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 143.406999][ T44] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 143.436452][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 143.443384][ T10] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 143.444367][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 143.444417][ T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 143.462074][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.462101][ T10] usb 5-1: Product: syz [ 143.462116][ T10] usb 5-1: Manufacturer: syz [ 143.462130][ T10] usb 5-1: SerialNumber: syz [ 143.518038][ T10] usb 5-1: 0:2 : does not exist [ 143.557858][ T44] usb 4-1: Using ep0 maxpacket: 32 [ 143.566193][ T44] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 143.584286][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.584323][ T44] usb 4-1: Product: syz [ 143.584337][ T44] usb 4-1: Manufacturer: syz [ 143.584377][ T44] usb 4-1: SerialNumber: syz [ 143.724539][ T10] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 143.815203][ T10] usb 5-1: USB disconnect, device number 15 [ 143.866431][ T25] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 143.914338][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 143.926779][ T44] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 143.928799][ T44] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 144.024660][ T25] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 144.024704][ T25] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 144.041812][ T25] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 144.041861][ T25] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 144.041886][ T25] usb 2-1: config 0 interface 0 has no altsetting 0 [ 144.044265][ T25] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 144.044312][ T25] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 144.044337][ T25] usb 2-1: config 0 interface 0 has no altsetting 0 [ 144.046240][ T44] usb 4-1: USB disconnect, device number 14 [ 144.048567][ T25] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 144.048614][ T25] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 144.048639][ T25] usb 2-1: config 0 interface 0 has no altsetting 0 [ 144.051911][ T25] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 144.051957][ T25] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 144.051981][ T25] usb 2-1: config 0 interface 0 has no altsetting 0 [ 144.052960][ T25] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 144.053001][ T25] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 144.053026][ T25] usb 2-1: config 0 interface 0 has no altsetting 0 [ 144.060563][ T25] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 144.060612][ T25] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 144.060638][ T25] usb 2-1: config 0 interface 0 has no altsetting 0 [ 144.063073][ T25] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 144.063118][ T25] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 144.063144][ T25] usb 2-1: config 0 interface 0 has no altsetting 0 [ 144.065736][ T25] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 144.065787][ T25] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 144.065813][ T25] usb 2-1: config 0 interface 0 has no altsetting 0 [ 144.085024][ T25] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 144.085051][ T25] usb 2-1: Product: syz [ 144.085065][ T25] usb 2-1: Manufacturer: syz [ 144.085078][ T25] usb 2-1: SerialNumber: syz [ 144.090253][ T25] usb 2-1: config 0 descriptor?? [ 144.135323][ T25] yurex 2-1:0.0: USB YUREX device now attached to Yurex #0 [ 144.280255][ T5628] udevd[5628]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 144.364673][ T44] usb 2-1: USB disconnect, device number 21 [ 144.385283][ T44] yurex 2-1:0.0: USB YUREX #0 now disconnected [ 144.874027][ T6789] binder: BINDER_SET_CONTEXT_MGR already set [ 144.874044][ T6789] binder: 6788:6789 ioctl 4018620d 200000004a80 returned -16 [ 144.893077][ T6789] binder: 6788:6789 ioctl c0104d03 2000000003c0 returned -22 [ 145.242637][ T6806] netlink: 44 bytes leftover after parsing attributes in process `syz.1.361'. [ 145.466791][ T9] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 145.617799][ T9] usb 4-1: New USB device found, idVendor=1235, idProduct=8201, bcdDevice= 1.00 [ 145.619148][ T9] usb 4-1: config index 0 descriptor too short (expected 69, got 51) [ 145.619247][ T9] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 103, changing to 10 [ 145.619275][ T9] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 24948, setting to 1024 [ 145.623344][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.623362][ T9] usb 4-1: Product: syz [ 145.623370][ T9] usb 4-1: Manufacturer: syz [ 145.623384][ T9] usb 4-1: SerialNumber: syz [ 145.702260][ T9] usb 4-1: Focusrite Scarlett Gen 2 Mixer Driver enabled (pid=0x8201); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 145.904477][ T9] usb 4-1: Error initialising Scarlett Gen 2 Mixer Driver: -71 [ 145.962312][ T9] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 145.988162][ T9] usb 4-1: USB disconnect, device number 15 [ 146.003558][ T5688] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 146.015965][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 146.146920][ T5688] usb 3-1: Using ep0 maxpacket: 8 [ 146.148592][ T5688] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 146.149567][ T5688] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 146.149582][ T5688] usb 3-1: config 0 has no interface number 0 [ 146.149602][ T5688] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 146.149615][ T5688] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 146.149636][ T5688] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 146.149649][ T5688] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 146.149672][ T5688] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.153774][ T5688] usb 3-1: config 0 descriptor?? [ 146.250210][ T5688] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 146.318894][ T6833] binfmt_misc: register: failed to install interpreter ./cgroup [ 146.349097][ T25] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 146.436611][ T5712] usb 3-1: USB disconnect, device number 12 [ 146.437693][ C0] ldusb 3-1:0.55: usb_submit_urb failed (-19) [ 146.462450][ T6836] PM: Enabling pm_trace changes system date and time during resume. [ 146.462450][ T6836] PM: Correct system time has to be restored manually after resume. [ 146.480459][ T6836] netlink: 80 bytes leftover after parsing attributes in process `syz.2.366'. [ 146.497503][ T25] usb 5-1: Using ep0 maxpacket: 32 [ 146.498190][ T25] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 146.505216][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.505243][ T25] usb 5-1: Product: syz [ 146.505257][ T25] usb 5-1: Manufacturer: syz [ 146.505271][ T25] usb 5-1: SerialNumber: syz [ 146.577687][ T6841] capability: warning: `syz.3.374' uses deprecated v2 capabilities in a way that may be insecure [ 146.769399][ T25] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 146.770591][ T25] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 146.854888][ T25] usb 5-1: USB disconnect, device number 16 [ 146.959868][ T5622] udevd[5622]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 147.113341][ T6856] binder: 6852:6856 ioctl c0104d03 2000000003c0 returned -22 [ 147.709362][ T6866] FAULT_INJECTION: forcing a failure. [ 147.709362][ T6866] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 147.709384][ T6866] CPU: 1 UID: 0 PID: 6866 Comm: syz.4.381 Not tainted syzkaller #0 PREEMPT(full) [ 147.709397][ T6866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 147.709404][ T6866] Call Trace: [ 147.709408][ T6866] [ 147.709413][ T6866] dump_stack_lvl+0xe8/0x150 [ 147.709434][ T6866] should_fail_ex+0x410/0x560 [ 147.709451][ T6866] _copy_to_user+0x31/0xb0 [ 147.709467][ T6866] simple_read_from_buffer+0xe1/0x170 [ 147.709487][ T6866] proc_fail_nth_read+0x1bb/0x230 [ 147.709507][ T6866] ? common_file_perm+0x20e/0x2b0 [ 147.709530][ T6866] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 147.709551][ T6866] ? rw_verify_area+0x24a/0x4c0 [ 147.709582][ T6866] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 147.709602][ T6866] vfs_read+0x213/0xa80 [ 147.709626][ T6866] ? __pfx___mutex_lock+0x10/0x10 [ 147.709642][ T6866] ? __pfx_vfs_read+0x10/0x10 [ 147.709659][ T6866] ? __fget_files+0x2a/0x420 [ 147.709676][ T6866] ? __fget_files+0x3a2/0x420 [ 147.709690][ T6866] ? __fget_files+0x2a/0x420 [ 147.709709][ T6866] ksys_read+0x150/0x270 [ 147.709720][ T6866] ? __pfx_ksys_read+0x10/0x10 [ 147.709736][ T6866] do_syscall_64+0x166/0x520 [ 147.709751][ T6866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.709762][ T6866] ? clear_bhb_loop+0x70/0xc0 [ 147.709775][ T6866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.709786][ T6866] RIP: 0033:0x7f2fdeb5e98e [ 147.709797][ T6866] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 147.709807][ T6866] RSP: 002b:00007f2fdf9abfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 147.709819][ T6866] RAX: ffffffffffffffda RBX: 00007f2fdf9ac6c0 RCX: 00007f2fdeb5e98e [ 147.709827][ T6866] RDX: 000000000000000f RSI: 00007f2fdf9ac0a0 RDI: 000000000000000a [ 147.709834][ T6866] RBP: 00007f2fdf9ac090 R08: 0000000000000000 R09: 0000000000000000 [ 147.709840][ T6866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 147.709846][ T6866] R13: 00007f2fdee26038 R14: 00007f2fdee25fa0 R15: 00007f2fdef4fa48 [ 147.709863][ T6866] [ 148.339886][ T25] usb 5-1: new low-speed USB device number 17 using dummy_hcd [ 148.373242][ T6874] netlink: 108 bytes leftover after parsing attributes in process `syz.3.384'. [ 148.491509][ T25] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 148.492417][ T25] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 148.492441][ T25] usb 5-1: config 0 has no interface number 0 [ 148.492478][ T25] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 148.492492][ T25] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 148.492514][ T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.495757][ T25] usb 5-1: config 0 descriptor?? [ 148.543386][ T6868] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 148.572401][ T25] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 148.744392][ T5712] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 148.809177][ T5681] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 148.959550][ T5681] usb 4-1: Using ep0 maxpacket: 8 [ 148.960325][ T5681] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 148.963007][ T5681] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 148.963054][ T5681] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.018541][ T5681] usb 4-1: config 0 descriptor?? [ 149.289014][ T5681] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior1 [ 149.425914][ C0] iowarrior 5-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 149.452359][ T5681] usb 5-1: USB disconnect, device number 17 [ 149.757314][ T6904] binder: 6902:6904 ioctl c0104d03 2000000003c0 returned -22 [ 149.773878][ T10] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 149.878838][ T9] usb 4-1: USB disconnect, device number 16 [ 149.906661][ T10] usb 3-1: device descriptor read/64, error -71 [ 149.936491][ T5688] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 150.097860][ T5688] usb 5-1: New USB device found, idVendor=1235, idProduct=8201, bcdDevice= 1.00 [ 150.098727][ T5688] usb 5-1: config index 0 descriptor too short (expected 69, got 51) [ 150.098763][ T5688] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 150.098777][ T5688] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 150.100352][ T5688] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.100365][ T5688] usb 5-1: Product: syz [ 150.100373][ T5688] usb 5-1: Manufacturer: syz [ 150.100381][ T5688] usb 5-1: SerialNumber: syz [ 150.168719][ T10] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 150.177522][ T5688] usb 5-1: Focusrite Scarlett Gen 2 Mixer Driver enabled (pid=0x8201); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 150.311285][ T5688] usb 5-1: Error initialising Scarlett Gen 2 Mixer Driver: -90 [ 150.326961][ T10] usb 3-1: device descriptor read/64, error -71 [ 150.350193][ T5688] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -90 [ 150.380799][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 150.436713][ T10] usb usb3-port1: attempt power cycle [ 150.509254][ T6910] netlink: 'syz.3.396': attribute type 4 has an invalid length. [ 150.509310][ T6910] netlink: 24 bytes leftover after parsing attributes in process `syz.3.396'. [ 150.516184][ T5681] usb 5-1: USB disconnect, device number 18 [ 150.776466][ T10] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 150.798242][ T10] usb 3-1: device descriptor read/8, error -71 [ 150.926427][ T25] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 151.036575][ T10] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 151.068985][ T10] usb 3-1: device descriptor read/8, error -71 [ 151.087946][ T25] usb 2-1: Using ep0 maxpacket: 16 [ 151.089112][ T25] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 151.091661][ T25] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 151.091684][ T25] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 151.105951][ T25] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.105978][ T25] usb 2-1: Product: syz [ 151.105992][ T25] usb 2-1: Manufacturer: syz [ 151.106005][ T25] usb 2-1: SerialNumber: syz [ 151.140984][ T25] usb 2-1: 0:2 : does not exist [ 151.176615][ T10] usb usb3-port1: unable to enumerate USB device [ 151.202142][ T6921] ======================================================= [ 151.202142][ T6921] WARNING: The mand mount option has been deprecated and [ 151.202142][ T6921] and is ignored by this kernel. Remove the mand [ 151.202142][ T6921] option from the mount to silence this warning. [ 151.202142][ T6921] ======================================================= [ 151.202186][ T6921] fuse: Bad value for 'fd' [ 151.330313][ T25] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 151.379957][ T25] usb 2-1: USB disconnect, device number 22 [ 151.409847][ T5688] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 151.416995][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 151.447505][ T10] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 151.566558][ T5688] usb 5-1: Using ep0 maxpacket: 8 [ 151.567837][ T5688] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 151.568694][ T5688] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 151.568709][ T5688] usb 5-1: config 0 has no interface number 0 [ 151.568731][ T5688] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 151.568744][ T5688] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 151.568757][ T5688] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 151.568771][ T5688] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 151.568793][ T5688] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.571491][ T5688] usb 5-1: config 0 descriptor?? [ 151.587751][ T5688] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 151.615375][ T10] usb 4-1: New USB device found, idVendor=a94c, idProduct=75ab, bcdDevice=d6.e4 [ 151.618336][ T10] usb 4-1: config 1 interface 0 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 151.626946][ T10] usb 4-1: New USB device strings: Mfr=140, Product=10, SerialNumber=171 [ 151.626976][ T10] usb 4-1: Product: syz [ 151.626990][ T10] usb 4-1: Manufacturer: syz [ 151.627003][ T10] usb 4-1: SerialNumber: syz [ 151.832403][ T5688] usb 5-1: USB disconnect, device number 19 [ 151.832560][ C0] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 151.842213][ T6922] PM: Enabling pm_trace changes system date and time during resume. [ 151.842213][ T6922] PM: Correct system time has to be restored manually after resume. [ 151.853204][ T6922] netlink: 80 bytes leftover after parsing attributes in process `syz.4.399'. [ 151.883092][ T10] usb 4-1: USB disconnect, device number 17 [ 152.288132][ T6934] netlink: 40 bytes leftover after parsing attributes in process `syz.0.405'. [ 152.292201][ T6934] fuse: Bad value for 'fd' [ 152.294080][ T6934] netlink: 4 bytes leftover after parsing attributes in process `syz.0.405'. [ 152.525627][ T6942] binder: 6938:6942 ioctl c0104d03 2000000003c0 returned -22 [ 153.287436][ T10] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 153.436462][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 153.437167][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 153.438132][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 153.438152][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 153.443167][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.443203][ T10] usb 3-1: Product: syz [ 153.443219][ T10] usb 3-1: Manufacturer: syz [ 153.443233][ T10] usb 3-1: SerialNumber: syz [ 153.471344][ T10] usb 3-1: 0:2 : does not exist [ 153.675427][ T10] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 153.786238][ T10] usb 3-1: USB disconnect, device number 17 [ 153.849701][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 154.162017][ T5688] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 154.169210][ T5695] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 154.326487][ T5695] usb 2-1: Using ep0 maxpacket: 32 [ 154.327179][ T5695] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 154.338450][ T5695] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.338477][ T5695] usb 2-1: Product: syz [ 154.338491][ T5695] usb 2-1: Manufacturer: syz [ 154.338504][ T5695] usb 2-1: SerialNumber: syz [ 154.346797][ T6989] binder: 6985:6989 ioctl c0104d03 2000000003c0 returned -22 [ 154.581138][ T5695] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 154.581535][ T5695] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 154.589787][ T5688] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 154.673767][ T5695] usb 2-1: USB disconnect, device number 23 [ 154.736424][ T5688] usb 5-1: Using ep0 maxpacket: 16 [ 154.737081][ T5688] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 154.738250][ T5688] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 154.738279][ T5688] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 154.738302][ T5688] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 154.738341][ T5688] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.750423][ T5636] udevd[5636]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 154.755378][ T5688] usb 5-1: config 0 descriptor?? [ 155.201205][ T5688] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 155.201251][ T5688] microsoft 0003:045E:07DA.0002: item fetching failed at offset 28/34 [ 155.201983][ T5688] microsoft 0003:045E:07DA.0002: parse failed [ 155.202085][ T5688] microsoft 0003:045E:07DA.0002: probe with driver microsoft failed with error -22 [ 155.391700][ T6988] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.425857][ T6988] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.743525][ T7014] capability: warning: `syz.0.430' uses 32-bit capabilities (legacy support in use) [ 155.786061][ T7022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.786124][ T7019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.805420][ T7022] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.820895][ T7019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 156.006445][ T5688] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 156.106539][ T25] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 156.156380][ T5688] usb 2-1: Using ep0 maxpacket: 8 [ 156.156917][ T5688] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 156.157874][ T5688] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 156.157899][ T5688] usb 2-1: config 0 has no interface number 0 [ 156.157937][ T5688] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 156.157959][ T5688] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 156.157977][ T5688] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 156.157990][ T5688] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 156.158014][ T5688] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.160983][ T5688] usb 2-1: config 0 descriptor?? [ 156.170874][ T5688] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 156.316955][ T25] usb 4-1: Using ep0 maxpacket: 16 [ 156.323258][ T25] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 156.324311][ T25] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 156.324338][ T25] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 156.355378][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.355397][ T25] usb 4-1: Product: syz [ 156.355404][ T25] usb 4-1: Manufacturer: syz [ 156.355412][ T25] usb 4-1: SerialNumber: syz [ 156.373252][ T7027] binder: 7025:7027 ioctl c0104d03 2000000003c0 returned -22 [ 156.398031][ T25] usb 4-1: 0:2 : does not exist [ 156.431757][ T5681] usb 2-1: USB disconnect, device number 24 [ 156.431760][ C0] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 156.454732][ T7028] PM: Enabling pm_trace changes system date and time during resume. [ 156.454732][ T7028] PM: Correct system time has to be restored manually after resume. [ 156.601500][ T25] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 156.677155][ T25] usb 4-1: USB disconnect, device number 18 [ 156.710992][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 157.352111][ T5695] usb 5-1: USB disconnect, device number 20 [ 157.600497][ T7046] FAULT_INJECTION: forcing a failure. [ 157.600497][ T7046] name failslab, interval 1, probability 0, space 0, times 0 [ 157.600531][ T7046] CPU: 0 UID: 0 PID: 7046 Comm: syz.4.441 Not tainted syzkaller #0 PREEMPT(full) [ 157.600553][ T7046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 157.600566][ T7046] Call Trace: [ 157.600573][ T7046] [ 157.600581][ T7046] dump_stack_lvl+0xe8/0x150 [ 157.600614][ T7046] should_fail_ex+0x410/0x560 [ 157.600643][ T7046] should_failslab+0xa8/0x100 [ 157.600669][ T7046] __kmalloc_noprof+0xfe/0x720 [ 157.600689][ T7046] ? __kmalloc_cache_noprof+0x14d/0x600 [ 157.600708][ T7046] ? mpi_alloc+0x77/0x140 [ 157.600729][ T7046] ? mpi_alloc+0x77/0x140 [ 157.600757][ T7046] mpi_alloc+0x77/0x140 [ 157.600782][ T7046] mpi_read_raw_data+0x139/0x970 [ 157.600823][ T7046] dh_set_secret+0x200/0x320 [ 157.600850][ T7046] ? crypto_create_tfm_node+0x81/0x3c0 [ 157.600877][ T7046] ? __pfx_dh_set_secret+0x10/0x10 [ 157.600909][ T7046] ? crypto_alloc_tfm_node+0x3b5/0x3e0 [ 157.600939][ T7046] __keyctl_dh_compute+0x5ae/0xd10 [ 157.600979][ T7046] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 157.601034][ T7046] ? get_pid_task+0x20/0x1f0 [ 157.601056][ T7046] ? get_pid_task+0x20/0x1f0 [ 157.601078][ T7046] keyctl_dh_compute+0x124/0x180 [ 157.601108][ T7046] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 157.601150][ T7046] __se_sys_keyctl+0x44c/0x9d0 [ 157.601193][ T7046] ? __pfx___se_sys_keyctl+0x10/0x10 [ 157.601218][ T7046] ? __mutex_unlock_slowpath+0x731/0x900 [ 157.601248][ T7046] ? __fget_files+0x2a/0x420 [ 157.601277][ T7046] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 157.601305][ T7046] ? __fget_files+0x3a2/0x420 [ 157.601337][ T7046] ? fput+0xa0/0xd0 [ 157.601361][ T7046] ? ksys_write+0x242/0x270 [ 157.601382][ T7046] ? __pfx_ksys_write+0x10/0x10 [ 157.601407][ T7046] ? __x64_sys_keyctl+0x20/0xc0 [ 157.601431][ T7046] do_syscall_64+0x166/0x520 [ 157.601457][ T7046] ? trace_irq_disable+0x3b/0x140 [ 157.601477][ T7046] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.601497][ T7046] ? clear_bhb_loop+0x70/0xc0 [ 157.601521][ T7046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.601540][ T7046] RIP: 0033:0x7f2fdeb9e159 [ 157.601558][ T7046] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 157.601575][ T7046] RSP: 002b:00007f2fdf9ac028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 157.601597][ T7046] RAX: ffffffffffffffda RBX: 00007f2fdee25fa0 RCX: 00007f2fdeb9e159 [ 157.601612][ T7046] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000017 [ 157.601625][ T7046] RBP: 00007f2fdf9ac090 R08: 0000000000000000 R09: 0000000000000000 [ 157.601637][ T7046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 157.601648][ T7046] R13: 00007f2fdee26038 R14: 00007f2fdee25fa0 R15: 00007f2fdef4fa48 [ 157.601680][ T7046] [ 157.710478][ T44] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 157.908934][ T25] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 157.916848][ T44] usb 3-1: Using ep0 maxpacket: 16 [ 157.931073][ T44] usb 3-1: New USB device found, idVendor=056a, idProduct=0094, bcdDevice= 0.00 [ 157.932092][ T44] usb 3-1: too many endpoints for config 0 interface 0 altsetting 16: 254, using maximum allowed: 30 [ 157.932137][ T44] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 157.932165][ T44] usb 3-1: config 0 interface 0 has no altsetting 0 [ 157.932197][ T44] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.935145][ T44] usb 3-1: config 0 descriptor?? [ 158.076447][ T25] usb 4-1: Using ep0 maxpacket: 32 [ 158.078462][ T25] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 158.091875][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.091903][ T25] usb 4-1: Product: syz [ 158.091943][ T25] usb 4-1: Manufacturer: syz [ 158.091957][ T25] usb 4-1: SerialNumber: syz [ 158.375373][ T25] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 158.381791][ T25] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 158.389749][ T44] wacom 0003:056A:0094.0003: unknown main item tag 0x3 [ 158.389864][ T44] wacom 0003:056A:0094.0003: unknown main item tag 0x6 [ 158.389892][ T44] wacom 0003:056A:0094.0003: unknown main item tag 0x0 [ 158.389918][ T44] wacom 0003:056A:0094.0003: unknown main item tag 0x0 [ 158.389943][ T44] wacom 0003:056A:0094.0003: unknown main item tag 0x0 [ 158.389968][ T44] wacom 0003:056A:0094.0003: unknown main item tag 0x0 [ 158.389992][ T44] wacom 0003:056A:0094.0003: unknown main item tag 0x0 [ 158.390016][ T44] wacom 0003:056A:0094.0003: unknown main item tag 0x0 [ 158.391898][ T44] wacom 0003:056A:0094.0003: Using device in hidraw-only mode [ 158.568258][ T44] wacom 0003:056A:0094.0003: hidraw0: USB HID v0.01 Device [HID 056a:0094] on usb-dummy_hcd.2-1/input0 [ 158.589183][ T44] usb 3-1: USB disconnect, device number 18 [ 158.650965][ T25] usb 4-1: USB disconnect, device number 19 [ 158.753296][ T5681] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 158.975842][ T7052] fido_id[7052]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 159.040930][ T5626] udevd[5626]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 159.199308][ T7062] netlink: 16 bytes leftover after parsing attributes in process `syz.1.445'. [ 159.314836][ T7063] netlink: 14 bytes leftover after parsing attributes in process `syz.1.445'. [ 159.393576][ T7069] FAULT_INJECTION: forcing a failure. [ 159.393576][ T7069] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 159.393608][ T7069] CPU: 0 UID: 0 PID: 7069 Comm: syz.2.447 Not tainted syzkaller #0 PREEMPT(full) [ 159.393630][ T7069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 159.393641][ T7069] Call Trace: [ 159.393647][ T7069] [ 159.393655][ T7069] dump_stack_lvl+0xe8/0x150 [ 159.393685][ T7069] should_fail_ex+0x410/0x560 [ 159.393711][ T7069] _copy_from_user+0x2d/0xb0 [ 159.393737][ T7069] __se_sys_io_uring_setup+0x1b4/0x2c0 [ 159.393762][ T7069] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 159.393788][ T7069] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 159.393824][ T7069] ? __pfx_ksys_write+0x10/0x10 [ 159.393854][ T7069] do_syscall_64+0x166/0x520 [ 159.393878][ T7069] ? trace_irq_disable+0x3b/0x140 [ 159.393902][ T7069] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.393919][ T7069] ? clear_bhb_loop+0x70/0xc0 [ 159.393940][ T7069] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.393959][ T7069] RIP: 0033:0x7f02e999e159 [ 159.393975][ T7069] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.393991][ T7069] RSP: 002b:00007f02ea912ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 159.394012][ T7069] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007f02e999e159 [ 159.394026][ T7069] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e26 [ 159.394040][ T7069] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 159.394052][ T7069] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 159.394065][ T7069] R13: 0000200000000890 R14: 00007f02ea912fd8 R15: 0000000000000000 [ 159.394095][ T7069] [ 159.651264][ T7075] binder: 7064:7075 ioctl c0104d03 2000000003c0 returned -22 [ 160.266583][ T25] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 160.427194][ T25] usb 4-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice= 1.00 [ 160.431232][ T25] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 160.431262][ T25] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 160.434234][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.434260][ T25] usb 4-1: Product: syz [ 160.434275][ T25] usb 4-1: Manufacturer: syz [ 160.434289][ T25] usb 4-1: SerialNumber: syz [ 160.450539][ T25] kalmia 4-1:1.0 (unnamed net_device) (uninitialized): Error sending init packet. Status -90 [ 160.450794][ T25] kalmia 4-1:1.0: probe with driver kalmia failed with error -90 [ 160.467107][ T5688] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 160.596435][ T5681] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 160.662732][ T25] usb 4-1: USB disconnect, device number 20 [ 160.675593][ T5688] usb 3-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 160.688531][ T5688] usb 3-1: config index 0 descriptor too short (expected 800, got 32) [ 160.688562][ T5688] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 160.688589][ T5688] usb 3-1: config 0 has no interfaces? [ 160.695138][ T5688] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.695165][ T5688] usb 3-1: Product: syz [ 160.695179][ T5688] usb 3-1: Manufacturer: syz [ 160.695193][ T5688] usb 3-1: SerialNumber: syz [ 160.758164][ T5688] usb 3-1: config 0 descriptor?? [ 160.760642][ T5681] usb 5-1: Using ep0 maxpacket: 8 [ 160.763021][ T5681] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 160.764277][ T5681] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 160.764303][ T5681] usb 5-1: config 0 has no interface number 0 [ 160.764381][ T5681] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 160.764403][ T5681] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 160.764425][ T5681] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 160.764452][ T5681] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 160.764490][ T5681] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.774240][ T5681] usb 5-1: config 0 descriptor?? [ 160.799270][ T5681] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 161.051717][ T25] usb 5-1: USB disconnect, device number 21 [ 161.051776][ C0] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 161.087536][ T7099] netlink: 'syz.1.457': attribute type 3 has an invalid length. [ 161.087560][ T7099] netlink: 152 bytes leftover after parsing attributes in process `syz.1.457'. [ 161.087611][ T7099] netlink: 12 bytes leftover after parsing attributes in process `syz.1.457'. [ 161.090723][ T7097] PM: Enabling pm_trace changes system date and time during resume. [ 161.090723][ T7097] PM: Correct system time has to be restored manually after resume. [ 161.556400][ T10] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 161.706354][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 161.706931][ T10] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 161.709754][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.709778][ T10] usb 2-1: Product: syz [ 161.709792][ T10] usb 2-1: Manufacturer: syz [ 161.709806][ T10] usb 2-1: SerialNumber: syz [ 161.756607][ T44] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 161.916560][ T44] usb 4-1: Using ep0 maxpacket: 16 [ 161.917541][ T44] usb 4-1: New USB device found, idVendor=0e8d, idProduct=00a7, bcdDevice=b5.31 [ 161.919380][ T44] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 161.919402][ T44] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 161.924053][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.924075][ T44] usb 4-1: Product: syz [ 161.924088][ T44] usb 4-1: Manufacturer: syz [ 161.924099][ T44] usb 4-1: SerialNumber: syz [ 161.928937][ T10] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 161.929319][ T10] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 162.000376][ T10] usb 2-1: USB disconnect, device number 25 [ 162.000618][ T44] usb 4-1: config 0 descriptor?? [ 162.060972][ T5626] udevd[5626]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 162.204170][ T7111] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.204584][ T7111] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 162.224424][ T5712] usb 4-1: USB disconnect, device number 21 [ 162.666643][ T5712] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 162.817187][ T5712] usb 4-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=1f.38 [ 162.818368][ T5712] usb 4-1: config 0 has an invalid interface number: 229 but max is 0 [ 162.818394][ T5712] usb 4-1: config 0 has no interface number 0 [ 162.818434][ T5712] usb 4-1: config 0 interface 229 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 162.822253][ T5712] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.822277][ T5712] usb 4-1: Product: syz [ 162.822292][ T5712] usb 4-1: Manufacturer: syz [ 162.822306][ T5712] usb 4-1: SerialNumber: syz [ 162.872745][ T7121] binder: 7117:7121 ioctl c0104d03 2000000003c0 returned -22 [ 162.894245][ T5712] usb 4-1: config 0 descriptor?? [ 163.077591][ T5712] usb 3-1: USB disconnect, device number 19 [ 163.101059][ T5695] usb 4-1: USB disconnect, device number 22 [ 163.311244][ T25] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 163.494075][ T7134] sg_write: data in/out 987/14 bytes for SCSI command 0x0-- guessing data in; [ 163.494075][ T7134] program syz.2.469 not setting count and/or reply_len properly [ 163.494340][ T7133] sg_write: data in/out 987/14 bytes for SCSI command 0x0-- guessing data in; [ 163.494340][ T7133] program syz.2.469 not setting count and/or reply_len properly [ 164.157554][ T5695] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 164.306533][ T5695] usb 2-1: Using ep0 maxpacket: 32 [ 164.312081][ T5695] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 164.315055][ T5695] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.315082][ T5695] usb 2-1: Product: syz [ 164.315097][ T5695] usb 2-1: Manufacturer: syz [ 164.315112][ T5695] usb 2-1: SerialNumber: syz [ 164.486711][ T44] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 164.589257][ T5695] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 164.590862][ T5695] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 164.636506][ T44] usb 5-1: Using ep0 maxpacket: 16 [ 164.637328][ T44] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 164.638529][ T44] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 164.638552][ T44] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 164.640839][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.640864][ T44] usb 5-1: Product: syz [ 164.640878][ T44] usb 5-1: Manufacturer: syz [ 164.640892][ T44] usb 5-1: SerialNumber: syz [ 164.777414][ T44] usb 5-1: 0:2 : does not exist [ 164.791953][ T5695] usb 2-1: USB disconnect, device number 26 [ 164.930472][ T44] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 164.936440][ T9] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 165.039358][ T44] usb 5-1: USB disconnect, device number 22 [ 165.087384][ T9] usb 3-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 165.088720][ T9] usb 3-1: config index 0 descriptor too short (expected 800, got 32) [ 165.088746][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 165.088765][ T9] usb 3-1: config 0 has no interfaces? [ 165.093819][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.093846][ T9] usb 3-1: Product: syz [ 165.093861][ T9] usb 3-1: Manufacturer: syz [ 165.093876][ T9] usb 3-1: SerialNumber: syz [ 165.121218][ T9] usb 3-1: config 0 descriptor?? [ 165.154271][ T5628] udevd[5628]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 165.155477][ T5622] udevd[5622]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 165.198841][ T5688] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 165.326364][ T5688] usb 4-1: device descriptor read/64, error -71 [ 165.557370][ T25] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 165.576464][ T5688] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 165.688731][ T7173] binder: 7171:7173 ioctl c0104d03 2000000003c0 returned -22 [ 165.706398][ T25] usb 2-1: Using ep0 maxpacket: 8 [ 165.706878][ T25] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 165.707789][ T25] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 165.707805][ T25] usb 2-1: config 0 has no interface number 0 [ 165.707826][ T25] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 165.707839][ T25] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 165.707852][ T25] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 165.707865][ T25] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 165.707887][ T25] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 165.710373][ T25] usb 2-1: config 0 descriptor?? [ 165.729180][ T25] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 165.747742][ T5688] usb 4-1: device descriptor read/64, error -71 [ 165.856604][ T5688] usb usb4-port1: attempt power cycle [ 165.970602][ T25] usb 2-1: USB disconnect, device number 27 [ 165.970667][ C1] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 165.983417][ T7176] PM: Enabling pm_trace changes system date and time during resume. [ 165.983417][ T7176] PM: Correct system time has to be restored manually after resume. [ 166.206565][ T5688] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 166.229113][ T5688] usb 4-1: device descriptor read/8, error -71 [ 166.476386][ T5688] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 166.497844][ T5688] usb 4-1: device descriptor read/8, error -71 [ 166.606643][ T5688] usb usb4-port1: unable to enumerate USB device [ 166.957546][ T5688] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 167.126607][ T5688] usb 5-1: Using ep0 maxpacket: 32 [ 167.127175][ T5688] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 167.130213][ T5688] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.130239][ T5688] usb 5-1: Product: syz [ 167.130253][ T5688] usb 5-1: Manufacturer: syz [ 167.130267][ T5688] usb 5-1: SerialNumber: syz [ 167.346832][ T5688] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 167.347123][ T5688] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 167.387340][ T5688] usb 5-1: USB disconnect, device number 23 [ 167.425378][ T5626] udevd[5626]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 167.498041][ T6431] usb 3-1: USB disconnect, device number 20 [ 167.956641][ T6431] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 168.335024][ T25] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 168.526395][ T5712] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 168.661995][ T7221] netlink: 144 bytes leftover after parsing attributes in process `syz.1.498'. [ 168.676413][ T5712] usb 5-1: Using ep0 maxpacket: 8 [ 168.677134][ T5712] usb 5-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 168.678085][ T5712] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 168.682518][ T5712] usb 5-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 168.682544][ T5712] usb 5-1: Product: syz [ 168.682558][ T5712] usb 5-1: Manufacturer: syz [ 168.682571][ T5712] usb 5-1: SerialNumber: syz [ 168.959919][ T7228] binder: 7226:7228 ioctl c0104d03 2000000003c0 returned -22 [ 169.008060][ T5712] usb 5-1: palm_os_3_probe - error -110 getting connection information [ 169.008164][ T5712] visor 5-1:1.0: probe with driver visor failed with error -110 [ 169.727385][ T6431] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 169.877061][ T6431] usb 4-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 169.878132][ T6431] usb 4-1: config index 0 descriptor too short (expected 800, got 32) [ 169.878159][ T6431] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 169.878177][ T6431] usb 4-1: config 0 has no interfaces? [ 169.881382][ T6431] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.881410][ T6431] usb 4-1: Product: syz [ 169.881425][ T6431] usb 4-1: Manufacturer: syz [ 169.881439][ T6431] usb 4-1: SerialNumber: syz [ 169.887827][ T6431] usb 4-1: config 0 descriptor?? [ 169.946587][ T5681] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 170.097919][ T5681] usb 3-1: Using ep0 maxpacket: 32 [ 170.098710][ T5681] usb 3-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 170.103862][ T5681] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.103891][ T5681] usb 3-1: Product: syz [ 170.103906][ T5681] usb 3-1: Manufacturer: syz [ 170.103920][ T5681] usb 3-1: SerialNumber: syz [ 170.347235][ T5681] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 170.347640][ T5681] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 170.409069][ T5681] usb 3-1: USB disconnect, device number 22 [ 170.484173][ T5622] udevd[5622]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 170.776469][ T6431] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 170.926578][ T6431] usb 2-1: Using ep0 maxpacket: 32 [ 170.928578][ T6431] usb 2-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 170.931844][ T6431] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.931891][ T6431] usb 2-1: Product: syz [ 170.931906][ T6431] usb 2-1: Manufacturer: syz [ 170.931920][ T6431] usb 2-1: SerialNumber: syz [ 170.987928][ T6431] usb 2-1: config 0 descriptor?? [ 171.253062][ T5681] usb 5-1: USB disconnect, device number 24 [ 171.840041][ T7279] binder: 7275:7279 ioctl c0104d03 2000000003c0 returned -22 [ 172.343274][ T5688] usb 4-1: USB disconnect, device number 27 [ 172.357454][ T5695] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 172.506549][ T5695] usb 3-1: Using ep0 maxpacket: 16 [ 172.507300][ T5695] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 172.508448][ T5695] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 172.508472][ T5695] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 172.511048][ T5695] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.511073][ T5695] usb 3-1: Product: syz [ 172.511088][ T5695] usb 3-1: Manufacturer: syz [ 172.511103][ T5695] usb 3-1: SerialNumber: syz [ 172.593079][ T5695] usb 3-1: 0:2 : does not exist [ 172.794822][ T5695] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 172.868505][ T5688] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 172.913251][ T5695] usb 3-1: USB disconnect, device number 23 [ 172.967089][ T7295] netlink: 72 bytes leftover after parsing attributes in process `syz.0.522'. [ 172.967113][ T7295] netlink: 12 bytes leftover after parsing attributes in process `syz.0.522'. [ 172.967126][ T7295] netlink: 4 bytes leftover after parsing attributes in process `syz.0.522'. [ 172.972963][ T5622] udevd[5622]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 173.037167][ T5688] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 173.038455][ T5688] usb 4-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 173.038487][ T5688] usb 4-1: config 0 interface 0 altsetting 255 endpoint 0x8F has invalid wMaxPacketSize 0 [ 173.038509][ T5688] usb 4-1: config 0 interface 0 has no altsetting 0 [ 173.042116][ T5688] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 173.042141][ T5688] usb 4-1: Product: syz [ 173.042155][ T5688] usb 4-1: Manufacturer: syz [ 173.042169][ T5688] usb 4-1: SerialNumber: syz [ 173.046591][ T5681] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 173.077178][ T5688] usb 4-1: config 0 descriptor?? [ 173.128014][ T5688] usb 4-1: selecting invalid altsetting 0 [ 173.197038][ T5681] usb 5-1: Using ep0 maxpacket: 32 [ 173.197919][ T5681] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 173.208223][ T5681] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.208250][ T5681] usb 5-1: Product: syz [ 173.208286][ T5681] usb 5-1: Manufacturer: syz [ 173.208300][ T5681] usb 5-1: SerialNumber: syz [ 173.315493][ T25] usb 4-1: USB disconnect, device number 28 [ 173.454532][ T5681] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 173.459465][ T5681] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 173.607795][ T5681] usb 5-1: USB disconnect, device number 25 [ 173.663899][ T6431] peak_usb 2-1:0.0 can0: unable to request usb[type=0 value=0] err=-71 [ 173.663919][ T6431] peak_usb 2-1:0.0: unable to read PCAN-USB Pro bootloader info (err -71) [ 173.806241][ T5628] udevd[5628]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 173.905674][ T6431] peak_usb 2-1:0.0: probe with driver peak_usb failed with error -71 [ 173.924242][ T6431] usb 2-1: USB disconnect, device number 28 [ 174.408650][ T7324] binder: 7317:7324 ioctl c0104d03 2000000003c0 returned -22 [ 174.480959][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 174.480979][ T30] audit: type=1326 audit(1790590310.993:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7314 comm="syz.0.529" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f704979e159 code=0x7ffc0000 [ 174.493832][ T30] audit: type=1326 audit(1790590311.003:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7314 comm="syz.0.529" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f704979e159 code=0x7ffc0000 [ 174.596431][ T5681] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 174.728578][ T30] audit: type=1326 audit(1790590311.243:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7314 comm="syz.0.529" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=31 compat=0 ip=0x7f704979e159 code=0x7ffc0000 [ 174.728628][ T30] audit: type=1326 audit(1790590311.243:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7314 comm="syz.0.529" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f704979e159 code=0x7ffc0000 [ 174.728666][ T30] audit: type=1326 audit(1790590311.243:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7314 comm="syz.0.529" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f704979e159 code=0x7ffc0000 [ 174.809965][ T5681] usb 2-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 174.812615][ T5681] usb 2-1: config index 0 descriptor too short (expected 800, got 32) [ 174.812644][ T5681] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 174.812663][ T5681] usb 2-1: config 0 has no interfaces? [ 174.905254][ T5681] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.905284][ T5681] usb 2-1: Product: syz [ 174.905299][ T5681] usb 2-1: Manufacturer: syz [ 174.905313][ T5681] usb 2-1: SerialNumber: syz [ 174.939489][ T6431] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 174.989932][ T5681] usb 2-1: config 0 descriptor?? [ 175.086490][ T6431] usb 4-1: Using ep0 maxpacket: 8 [ 175.088034][ T6431] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 175.092365][ T6431] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 175.092390][ T6431] usb 4-1: config 0 has no interface number 0 [ 175.092427][ T6431] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 175.092450][ T6431] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 175.092474][ T6431] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 175.092499][ T6431] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 175.092548][ T6431] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.210760][ T6431] usb 4-1: config 0 descriptor?? [ 175.244179][ T6431] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 175.653440][ T5681] usb 4-1: USB disconnect, device number 29 [ 175.653540][ C1] ldusb 4-1:0.55: usb_submit_urb failed (-19) [ 175.788976][ T7331] IPVS: Scheduler module ip_vs_mh not found [ 175.823130][ T5681] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 176.516473][ T5681] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 176.667173][ T5681] usb 5-1: Using ep0 maxpacket: 16 [ 176.670430][ T5681] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 176.673967][ T5681] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 176.673994][ T5681] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 176.728960][ T5681] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.728990][ T5681] usb 5-1: Product: syz [ 176.729004][ T5681] usb 5-1: Manufacturer: syz [ 176.729018][ T5681] usb 5-1: SerialNumber: syz [ 176.813058][ T5681] usb 5-1: 0:2 : does not exist [ 176.995952][ T5681] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 177.006417][ T5712] usb 3-1: new low-speed USB device number 24 using dummy_hcd [ 177.158061][ T5712] usb 3-1: New USB device found, idVendor=1223, idProduct=0008, bcdDevice= 0.00 [ 177.158105][ T5712] usb 3-1: no configurations [ 177.158117][ T5712] usb 3-1: can't read configurations, error -22 [ 177.280223][ T5681] usb 5-1: USB disconnect, device number 26 [ 177.294228][ T5712] usb 3-1: new low-speed USB device number 25 using dummy_hcd [ 177.458401][ T5712] usb 3-1: New USB device found, idVendor=1223, idProduct=0008, bcdDevice= 0.00 [ 177.458443][ T5712] usb 3-1: no configurations [ 177.458456][ T5712] usb 3-1: can't read configurations, error -22 [ 177.459509][ T5712] usb usb3-port1: attempt power cycle [ 177.461044][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 177.765592][ T5681] usb 2-1: USB disconnect, device number 29 [ 177.797729][ T5712] usb 3-1: new low-speed USB device number 26 using dummy_hcd [ 177.830561][ T5712] usb 3-1: New USB device found, idVendor=1223, idProduct=0008, bcdDevice= 0.00 [ 177.830606][ T5712] usb 3-1: no configurations [ 177.830619][ T5712] usb 3-1: can't read configurations, error -22 [ 177.986914][ T5712] usb 3-1: new low-speed USB device number 27 using dummy_hcd [ 178.008741][ T5712] usb 3-1: New USB device found, idVendor=1223, idProduct=0008, bcdDevice= 0.00 [ 178.008782][ T5712] usb 3-1: no configurations [ 178.008795][ T5712] usb 3-1: can't read configurations, error -22 [ 178.009079][ T5712] usb usb3-port1: unable to enumerate USB device [ 178.960423][ T7373] binder: 7371:7373 ioctl c0104d03 2000000003c0 returned -22 [ 179.995463][ T7390] netlink: 20 bytes leftover after parsing attributes in process `syz.4.549'. [ 180.056505][ T5681] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 180.216656][ T5681] usb 3-1: Using ep0 maxpacket: 8 [ 180.217459][ T5681] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 180.220094][ T5681] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 180.220119][ T5681] usb 3-1: config 0 has no interface number 0 [ 180.220156][ T5681] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 180.220178][ T5681] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 180.220203][ T5681] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 180.220228][ T5681] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 180.220267][ T5681] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.223418][ T5681] usb 3-1: config 0 descriptor?? [ 180.331879][ T5681] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 180.747296][ T5681] usb 3-1: USB disconnect, device number 28 [ 180.767042][ T7386] PM: Enabling pm_trace changes system date and time during resume. [ 180.767042][ T7386] PM: Correct system time has to be restored manually after resume. [ 180.857769][ T5681] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 180.858671][ T7386] netlink: 80 bytes leftover after parsing attributes in process `syz.2.547'. [ 181.233283][ T5681] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 181.416410][ T5681] usb 3-1: Using ep0 maxpacket: 32 [ 181.432121][ T5681] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 181.442450][ T5681] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 181.442477][ T5681] usb 3-1: config 0 has no interface number 0 [ 181.442519][ T5681] usb 3-1: config 0 interface 184 has no altsetting 0 [ 181.472656][ T5681] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.472683][ T5681] usb 3-1: Product: syz [ 181.472697][ T5681] usb 3-1: Manufacturer: syz [ 181.472711][ T5681] usb 3-1: SerialNumber: syz [ 181.475618][ T5681] usb 3-1: config 0 descriptor?? [ 181.772920][ T5681] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 181.773238][ T5681] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 181.900080][ T5681] usb 3-1: USB disconnect, device number 29 [ 183.463890][ T7421] binder: 7415:7421 ioctl c0104d03 2000000003c0 returned -22 [ 183.736437][ T5681] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 183.909471][ T5681] usb 2-1: Using ep0 maxpacket: 16 [ 183.910758][ T5681] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 183.921774][ T5681] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 183.921800][ T5681] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 183.955948][ T5681] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.955976][ T5681] usb 2-1: Product: syz [ 183.955991][ T5681] usb 2-1: Manufacturer: syz [ 183.956005][ T5681] usb 2-1: SerialNumber: syz [ 184.103222][ T5681] usb 2-1: 0:2 : does not exist [ 184.341461][ T5681] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 185.264224][ T5681] usb 2-1: USB disconnect, device number 30 [ 185.468249][ T7431] netlink: 20 bytes leftover after parsing attributes in process `syz.0.562'. [ 185.541719][ T7432] netlink: 24 bytes leftover after parsing attributes in process `syz.4.563'. [ 185.770986][ T5639] udevd[5639]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 186.186410][ T5712] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 186.337274][ T5712] usb 4-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 186.340732][ T5712] usb 4-1: config index 0 descriptor too short (expected 800, got 32) [ 186.340762][ T5712] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 186.340781][ T5712] usb 4-1: config 0 has no interfaces? [ 186.343310][ T5712] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.343336][ T5712] usb 4-1: Product: syz [ 186.343349][ T5712] usb 4-1: Manufacturer: syz [ 186.343363][ T5712] usb 4-1: SerialNumber: syz [ 186.576465][ T6431] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 186.576695][ C1] raw-gadget.1 gadget.4: ignoring, device is not running [ 186.636757][ T5712] usb 4-1: config 0 descriptor?? [ 186.706688][ T6431] usb 5-1: device descriptor read/64, error -32 [ 186.744481][ T7447] fuse: Bad value for 'fd' [ 186.766846][ T7447] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.569'. [ 186.921490][ T7449] netlink: 24 bytes leftover after parsing attributes in process `syz.0.570'. [ 186.948454][ T6431] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 187.099197][ T6431] usb 5-1: Using ep0 maxpacket: 8 [ 187.100025][ T6431] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 187.101851][ T6431] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 187.101875][ T6431] usb 5-1: config 0 has no interface number 0 [ 187.101989][ T6431] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 187.102013][ T6431] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 187.102037][ T6431] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 187.102062][ T6431] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 187.102108][ T6431] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.105349][ T7453] binder: 7450:7453 ioctl c0104d03 2000000003c0 returned -22 [ 187.212981][ T6431] usb 5-1: config 0 descriptor?? [ 187.223364][ T6431] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 187.432541][ T5681] usb 5-1: USB disconnect, device number 28 [ 187.466980][ T7444] PM: Enabling pm_trace changes system date and time during resume. [ 187.466980][ T7444] PM: Correct system time has to be restored manually after resume. [ 187.469967][ T5681] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 187.531311][ T7444] netlink: 80 bytes leftover after parsing attributes in process `syz.4.568'. [ 188.227766][ T5681] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 188.404168][ T5681] usb 5-1: Using ep0 maxpacket: 32 [ 188.531861][ T5681] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 188.554215][ T5681] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 188.554245][ T5681] usb 5-1: config 0 has no interface number 0 [ 188.554291][ T5681] usb 5-1: config 0 interface 184 has no altsetting 0 [ 188.632963][ T5681] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.632992][ T5681] usb 5-1: Product: syz [ 188.633007][ T5681] usb 5-1: Manufacturer: syz [ 188.633020][ T5681] usb 5-1: SerialNumber: syz [ 188.722920][ T5681] usb 5-1: config 0 descriptor?? [ 189.076295][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 189.301307][ T5681] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 189.301568][ T5681] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 189.505540][ T5681] usb 5-1: USB disconnect, device number 29 [ 189.873014][ T5681] usb 4-1: USB disconnect, device number 30 [ 190.667227][ T5681] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 191.345607][ T5681] usb 3-1: unable to get BOS descriptor or descriptor too short [ 191.345660][ T5681] usb 3-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 191.364385][ T5681] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 191.364423][ T5681] usb 3-1: can't read configurations, error -71 [ 191.774134][ T7487] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 192.178877][ T7495] FAULT_INJECTION: forcing a failure. [ 192.178877][ T7495] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 192.178912][ T7495] CPU: 1 UID: 0 PID: 7495 Comm: syz.2.582 Tainted: G L syzkaller #0 PREEMPT(full) [ 192.178939][ T7495] Tainted: [L]=SOFTLOCKUP [ 192.178946][ T7495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 192.178958][ T7495] Call Trace: [ 192.178966][ T7495] [ 192.178974][ T7495] dump_stack_lvl+0xe8/0x150 [ 192.179006][ T7495] should_fail_ex+0x410/0x560 [ 192.179035][ T7495] _copy_from_user+0x2d/0xb0 [ 192.179067][ T7495] ___sys_sendmsg+0x1c6/0x360 [ 192.179095][ T7495] ? __lock_acquire+0x747/0x2de0 [ 192.179121][ T7495] ? __pfx____sys_sendmsg+0x10/0x10 [ 192.179180][ T7495] ? __fget_files+0x2a/0x420 [ 192.179204][ T7495] ? __fget_files+0x3a2/0x420 [ 192.179239][ T7495] __x64_sys_sendmsg+0x1b1/0x290 [ 192.179270][ T7495] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 192.179317][ T7495] do_syscall_64+0x166/0x520 [ 192.179343][ T7495] ? trace_irq_disable+0x3b/0x140 [ 192.179364][ T7495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.179384][ T7495] ? clear_bhb_loop+0x70/0xc0 [ 192.179408][ T7495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.179428][ T7495] RIP: 0033:0x7f02e999e159 [ 192.179446][ T7495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 192.179463][ T7495] RSP: 002b:00007f02ea913028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 192.179484][ T7495] RAX: ffffffffffffffda RBX: 00007f02e9c25fa0 RCX: 00007f02e999e159 [ 192.179499][ T7495] RDX: 00000000000080d0 RSI: 0000200000000380 RDI: 0000000000000003 [ 192.179512][ T7495] RBP: 00007f02ea913090 R08: 0000000000000000 R09: 0000000000000000 [ 192.179525][ T7495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 192.179537][ T7495] R13: 00007f02e9c26038 R14: 00007f02e9c25fa0 R15: 00007f02e9d4fa48 [ 192.179567][ T7495] [ 195.167226][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.167285][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.817173][ T0] NOHZ tick-stop error: local softirq work is pending, handler #28a!!! [ 195.996438][ T5712] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 196.178009][ T5712] usb 5-1: Using ep0 maxpacket: 8 [ 196.179059][ T5712] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 196.181911][ T5712] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 196.181936][ T5712] usb 5-1: config 0 has no interface number 0 [ 196.181973][ T5712] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 196.181997][ T5712] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 196.182020][ T5712] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 196.182046][ T5712] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 196.182087][ T5712] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.341947][ T5712] usb 5-1: config 0 descriptor?? [ 196.353265][ T5712] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 196.812189][ T9] usb 5-1: USB disconnect, device number 30 [ 196.812257][ C1] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 197.097129][ T7514] PM: Enabling pm_trace changes system date and time during resume. [ 197.097129][ T7514] PM: Correct system time has to be restored manually after resume. [ 197.098362][ T7514] netlink: 80 bytes leftover after parsing attributes in process `syz.4.587'. [ 197.112410][ T5631] Bluetooth: hci2: command 0x0406 tx timeout [ 197.112453][ T5631] Bluetooth: hci1: command 0x0406 tx timeout [ 197.112515][ T5631] Bluetooth: hci3: command 0x0406 tx timeout [ 197.112557][ T5631] Bluetooth: hci4: command 0x0406 tx timeout [ 197.112581][ T5631] Bluetooth: hci0: command 0x0406 tx timeout [ 197.694295][ T7525] netlink: 32 bytes leftover after parsing attributes in process `syz.2.590'. [ 197.719053][ T7522] netlink: 4 bytes leftover after parsing attributes in process `syz.2.590'. [ 197.951516][ T7531] netlink: 8 bytes leftover after parsing attributes in process `syz.3.592'. [ 198.003469][ T7531] syzkaller0: entered promiscuous mode [ 198.003493][ T7531] syzkaller0: entered allmulticast mode [ 198.046538][ T7531] input: syz0 as /devices/virtual/input/input5 [ 198.739117][ T9] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 199.227750][ T5712] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 199.377100][ T5712] usb 3-1: New USB device found, idVendor=046d, idProduct=8825, bcdDevice= 1.00 [ 199.379111][ T5712] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 199.379137][ T5712] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 199.379209][ T5712] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.448550][ T5712] uvcvideo 3-1:1.0: Found UVC 1.00 device (046d:8825) [ 199.448594][ T5712] uvcvideo 3-1:1.0: No valid video chain found. [ 199.556582][ T5681] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 199.640475][ T5712] usb 3-1: USB disconnect, device number 32 [ 199.708375][ T5681] usb 4-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 199.709944][ T5681] usb 4-1: config index 0 descriptor too short (expected 800, got 32) [ 199.709970][ T5681] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 199.709989][ T5681] usb 4-1: config 0 has no interfaces? [ 199.710782][ T7551] FAULT_INJECTION: forcing a failure. [ 199.710782][ T7551] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 199.710849][ T7551] CPU: 1 UID: 0 PID: 7551 Comm: syz.4.597 Tainted: G L syzkaller #0 PREEMPT(full) [ 199.710876][ T7551] Tainted: [L]=SOFTLOCKUP [ 199.710883][ T7551] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 199.710895][ T7551] Call Trace: [ 199.710902][ T7551] [ 199.710911][ T7551] dump_stack_lvl+0xe8/0x150 [ 199.710945][ T7551] should_fail_ex+0x410/0x560 [ 199.710976][ T7551] _copy_to_user+0x31/0xb0 [ 199.711006][ T7551] simple_read_from_buffer+0xe1/0x170 [ 199.711039][ T7551] proc_fail_nth_read+0x1bb/0x230 [ 199.711059][ T7551] ? common_file_perm+0x20e/0x2b0 [ 199.711087][ T7551] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 199.711112][ T7551] ? rw_verify_area+0x24a/0x4c0 [ 199.711150][ T7551] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 199.711170][ T7551] vfs_read+0x213/0xa80 [ 199.711204][ T7551] ? __pfx___mutex_lock+0x10/0x10 [ 199.711233][ T7551] ? __pfx_vfs_read+0x10/0x10 [ 199.711264][ T7551] ? __fget_files+0x2a/0x420 [ 199.711294][ T7551] ? __fget_files+0x3a2/0x420 [ 199.711320][ T7551] ? __fget_files+0x2a/0x420 [ 199.711356][ T7551] ksys_read+0x150/0x270 [ 199.711378][ T7551] ? __pfx_ksys_read+0x10/0x10 [ 199.711408][ T7551] do_syscall_64+0x166/0x520 [ 199.711433][ T7551] ? trace_irq_disable+0x3b/0x140 [ 199.711454][ T7551] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.711475][ T7551] ? clear_bhb_loop+0x70/0xc0 [ 199.711499][ T7551] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.711519][ T7551] RIP: 0033:0x7f2fdeb5e98e [ 199.711537][ T7551] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 199.711555][ T7551] RSP: 002b:00007f2fdf9abfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 199.711576][ T7551] RAX: ffffffffffffffda RBX: 00007f2fdf9ac6c0 RCX: 00007f2fdeb5e98e [ 199.711591][ T7551] RDX: 000000000000000f RSI: 00007f2fdf9ac0a0 RDI: 0000000000000005 [ 199.711603][ T7551] RBP: 00007f2fdf9ac090 R08: 0000000000000000 R09: 0000000000000000 [ 199.711616][ T7551] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 199.711628][ T7551] R13: 00007f2fdee26038 R14: 00007f2fdee25fa0 R15: 00007f2fdef4fa48 [ 199.711660][ T7551] [ 199.888849][ T5681] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.888878][ T5681] usb 4-1: Product: syz [ 199.888892][ T5681] usb 4-1: Manufacturer: syz [ 199.888906][ T5681] usb 4-1: SerialNumber: syz [ 200.040836][ T5681] usb 4-1: config 0 descriptor?? [ 200.075486][ T7554] xt_nfacct: accounting object `syz0' does not exist [ 200.369551][ T7558] netlink: 8 bytes leftover after parsing attributes in process `syz.1.601'. [ 201.013924][ T7574] FAULT_INJECTION: forcing a failure. [ 201.013924][ T7574] name failslab, interval 1, probability 0, space 0, times 0 [ 201.013960][ T7574] CPU: 1 UID: 0 PID: 7574 Comm: syz.1.608 Tainted: G L syzkaller #0 PREEMPT(full) [ 201.013986][ T7574] Tainted: [L]=SOFTLOCKUP [ 201.013994][ T7574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 201.014005][ T7574] Call Trace: [ 201.014013][ T7574] [ 201.014021][ T7574] dump_stack_lvl+0xe8/0x150 [ 201.014057][ T7574] should_fail_ex+0x410/0x560 [ 201.014085][ T7574] ? __alloc_skb+0x1db/0x7a0 [ 201.014110][ T7574] should_failslab+0xa8/0x100 [ 201.014145][ T7574] ? __alloc_skb+0x1db/0x7a0 [ 201.014167][ T7574] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 201.014191][ T7574] ? __alloc_skb+0x18d/0x7a0 [ 201.014216][ T7574] ? __alloc_skb+0x1db/0x7a0 [ 201.014247][ T7574] __alloc_skb+0x1db/0x7a0 [ 201.014277][ T7574] alloc_skb_with_frags+0xc6/0x760 [ 201.014307][ T7574] ? __lock_acquire+0x747/0x2de0 [ 201.014336][ T7574] sock_alloc_send_pskb+0x878/0x990 [ 201.014372][ T7574] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 201.014397][ T7574] ? j1939_sk_sendmsg+0x5c5/0x12d0 [ 201.014429][ T7574] ? __local_bh_enable_ip+0xd6/0x140 [ 201.014460][ T7574] j1939_sk_sendmsg+0x6ac/0x12d0 [ 201.014503][ T7574] ? __pfx_j1939_sk_sendmsg+0x10/0x10 [ 201.014536][ T7574] ? apparmor_socket_sendmsg+0x98/0x360 [ 201.014562][ T7574] ? __pfx_j1939_sk_sendmsg+0x10/0x10 [ 201.014589][ T7574] sock_sendmsg_nosec+0x13a/0x180 [ 201.014614][ T7574] ____sys_sendmsg+0x54e/0x850 [ 201.014648][ T7574] ? __pfx_____sys_sendmsg+0x10/0x10 [ 201.014685][ T7574] ? import_iovec+0x73/0xa0 [ 201.014715][ T7574] ___sys_sendmsg+0x2a5/0x360 [ 201.014742][ T7574] ? __lock_acquire+0x747/0x2de0 [ 201.014767][ T7574] ? __pfx____sys_sendmsg+0x10/0x10 [ 201.014829][ T7574] ? __fget_files+0x2a/0x420 [ 201.014855][ T7574] ? __fget_files+0x3a2/0x420 [ 201.014892][ T7574] __x64_sys_sendmsg+0x1b1/0x290 [ 201.014924][ T7574] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 201.014972][ T7574] do_syscall_64+0x166/0x520 [ 201.014998][ T7574] ? trace_irq_disable+0x3b/0x140 [ 201.015018][ T7574] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.015038][ T7574] ? clear_bhb_loop+0x70/0xc0 [ 201.015062][ T7574] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.015082][ T7574] RIP: 0033:0x7f38f499e159 [ 201.015100][ T7574] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 201.015123][ T7574] RSP: 002b:00007f38f5800028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 201.015144][ T7574] RAX: ffffffffffffffda RBX: 00007f38f4c25fa0 RCX: 00007f38f499e159 [ 201.015158][ T7574] RDX: 00000000000080d0 RSI: 0000200000000380 RDI: 0000000000000003 [ 201.015171][ T7574] RBP: 00007f38f5800090 R08: 0000000000000000 R09: 0000000000000000 [ 201.015184][ T7574] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 201.015196][ T7574] R13: 00007f38f4c26038 R14: 00007f38f4c25fa0 R15: 00007f38f4d4fa48 [ 201.015228][ T7574] [ 201.423560][ T30] audit: type=1326 audit(1790590337.933:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.2.604" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02e999e159 code=0x7ffc0000 [ 201.424961][ T30] audit: type=1326 audit(1790590337.933:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.2.604" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02e999e159 code=0x7ffc0000 [ 201.426214][ T30] audit: type=1326 audit(1790590337.933:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.2.604" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f02e999e159 code=0x7ffc0000 [ 201.515571][ T30] audit: type=1326 audit(1790590338.023:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.2.604" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02e999e159 code=0x7ffc0000 [ 201.515620][ T30] audit: type=1326 audit(1790590338.023:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.2.604" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02e999e159 code=0x7ffc0000 [ 201.597186][ T30] audit: type=1326 audit(1790590338.113:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.2.604" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f02e999e159 code=0x7ffc0000 [ 201.597546][ T7578] fuse: Unknown parameter 'id' [ 201.597749][ T30] audit: type=1326 audit(1790590338.113:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.2.604" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02e999e159 code=0x7ffc0000 [ 201.597954][ T30] audit: type=1326 audit(1790590338.113:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.2.604" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02e999e159 code=0x7ffc0000 [ 201.598458][ T30] audit: type=1326 audit(1790590338.113:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.2.604" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=192 compat=0 ip=0x7f02e999e159 code=0x7ffc0000 [ 201.598885][ T30] audit: type=1326 audit(1790590338.113:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7563 comm="syz.2.604" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f02e999e159 code=0x7ffc0000 [ 202.796360][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 205.541116][ T7587] syzkaller0: entered promiscuous mode [ 205.541141][ T7587] syzkaller0: entered allmulticast mode [ 205.568128][ T5681] usb 4-1: USB disconnect, device number 31 [ 205.611550][ T7587] tipc: Enabled bearer , priority 0 [ 208.784137][ T7585] tipc: Resetting bearer [ 209.147877][ T7585] tipc: Disabling bearer [ 209.312304][ T5681] tipc: Node number set to 456268858 [ 209.646742][ T5681] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 209.653503][ T7600] IPVS: set_ctl: invalid protocol: 41 224.0.0.1:20001 [ 209.796821][ T5681] usb 3-1: Using ep0 maxpacket: 8 [ 209.797666][ T5681] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 209.798906][ T5681] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.850723][ T5681] pvrusb2: Hardware description: Terratec Grabster AV400 [ 209.850743][ T5681] pvrusb2: ********** [ 209.850751][ T5681] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 209.850780][ T5681] pvrusb2: Important functionality might not be entirely working. [ 209.850802][ T5681] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 209.850814][ T5681] pvrusb2: ********** [ 210.050534][ T2344] pvrusb2: Invalid write control endpoint [ 210.154843][ T2344] pvrusb2: Invalid write control endpoint [ 210.154860][ T2344] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 210.154870][ T2344] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 210.154878][ T2344] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 210.154887][ T2344] pvrusb2: Device being rendered inoperable [ 210.213036][ T2344] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 210.227467][ T2344] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 210.231816][ T2344] pvrusb2: Attached sub-driver cx25840 [ 210.231833][ T2344] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 210.231844][ T2344] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 210.278696][ T7599] pvrusb2: Attempted to execute control transfer when device not ok [ 212.026272][ C0] sched: DL replenish lagged too much [ 213.702972][ T53] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 213.705847][ T53] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 213.721946][ T53] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 213.724715][ T53] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 213.725300][ T53] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 214.499130][ T7623] bridge0: port 1(bridge_slave_0) entered blocking state [ 214.499247][ T7623] bridge0: port 1(bridge_slave_0) entered disabled state [ 214.499401][ T7623] bridge_slave_0: entered allmulticast mode [ 214.505300][ T7623] bridge_slave_0: entered promiscuous mode [ 214.655196][ T7623] bridge0: port 2(bridge_slave_1) entered blocking state [ 214.655304][ T7623] bridge0: port 2(bridge_slave_1) entered disabled state [ 214.655461][ T7623] bridge_slave_1: entered allmulticast mode [ 214.683756][ T7623] bridge_slave_1: entered promiscuous mode [ 214.728397][ T7623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 214.732077][ T7623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 214.792636][ T7623] team0: Port device team_slave_0 added [ 214.795987][ T7623] team0: Port device team_slave_1 added [ 214.838122][ T7623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 214.838140][ T7623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 214.838165][ T7623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 214.840220][ T7623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 214.840234][ T7623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 214.840260][ T7623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 214.988512][ T7623] hsr_slave_0: entered promiscuous mode [ 214.989634][ T7623] hsr_slave_1: entered promiscuous mode [ 214.990370][ T7623] debugfs: 'hsr0' already exists in 'hsr' [ 214.990390][ T7623] Cannot create hsr debugfs directory [ 215.397505][ T7623] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 215.418706][ T7623] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 215.419872][ T7623] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 215.446194][ T7623] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 215.456073][ T7623] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 215.473359][ T7623] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 215.475786][ T7623] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 215.512661][ T7623] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 215.629883][ T7623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 215.661065][ T7623] 8021q: adding VLAN 0 to HW filter on device team0 [ 215.676836][ T75] bridge0: port 1(bridge_slave_0) entered blocking state [ 215.676945][ T75] bridge0: port 1(bridge_slave_0) entered forwarding state [ 215.684879][ T75] bridge0: port 2(bridge_slave_1) entered blocking state [ 215.684983][ T75] bridge0: port 2(bridge_slave_1) entered forwarding state [ 215.781719][ T7623] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 215.781743][ T7623] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 215.826659][ T5617] Bluetooth: hci5: command tx timeout [ 215.843165][ T7623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 215.882019][ T7623] veth0_vlan: entered promiscuous mode [ 215.960755][ T7623] veth1_vlan: entered promiscuous mode [ 216.019761][ T7623] veth0_macvtap: entered promiscuous mode [ 216.024780][ T7623] veth1_macvtap: entered promiscuous mode [ 216.055831][ T7623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 216.077606][ T7623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 216.151429][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.152323][ T7582] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.152782][ T7582] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.189069][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.292323][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 216.292347][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 216.340402][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 216.340423][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 216.460452][ T44] usb 3-1: USB disconnect, device number 33 [ 217.074782][ T7652] FAULT_INJECTION: forcing a failure. [ 217.074782][ T7652] name failslab, interval 1, probability 0, space 0, times 0 [ 217.074818][ T7652] CPU: 1 UID: 0 PID: 7652 Comm: syz.2.623 Tainted: G L syzkaller #0 PREEMPT(full) [ 217.074845][ T7652] Tainted: [L]=SOFTLOCKUP [ 217.074852][ T7652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 217.074863][ T7652] Call Trace: [ 217.074871][ T7652] [ 217.074880][ T7652] dump_stack_lvl+0xe8/0x150 [ 217.074912][ T7652] should_fail_ex+0x410/0x560 [ 217.074942][ T7652] should_failslab+0xa8/0x100 [ 217.074970][ T7652] __kmalloc_noprof+0xfe/0x720 [ 217.074990][ T7652] ? rcu_is_watching+0x16/0xb0 [ 217.075015][ T7652] ? tomoyo_realpath_from_path+0xef/0x640 [ 217.075042][ T7652] ? tomoyo_realpath_from_path+0xef/0x640 [ 217.075076][ T7652] tomoyo_realpath_from_path+0xef/0x640 [ 217.075122][ T7652] ? tomoyo_path_number_perm+0x219/0x5f0 [ 217.075147][ T7652] tomoyo_path_number_perm+0x246/0x5f0 [ 217.075174][ T7652] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 217.075196][ T7652] ? __lock_acquire+0x747/0x2de0 [ 217.075236][ T7652] ? hook_file_ioctl+0x1f2/0x600 [ 217.075280][ T7652] ? __fget_files+0x2a/0x420 [ 217.075311][ T7652] ? __fget_files+0x2a/0x420 [ 217.075336][ T7652] ? __fget_files+0x3a2/0x420 [ 217.075371][ T7652] ? __fget_files+0x2a/0x420 [ 217.075402][ T7652] security_file_ioctl+0xc3/0x2a0 [ 217.075427][ T7652] __se_sys_ioctl+0x47/0x170 [ 217.075453][ T7652] do_syscall_64+0x166/0x520 [ 217.075479][ T7652] ? trace_irq_disable+0x3b/0x140 [ 217.075500][ T7652] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.075521][ T7652] ? clear_bhb_loop+0x70/0xc0 [ 217.075545][ T7652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.075564][ T7652] RIP: 0033:0x7f02e999e159 [ 217.075583][ T7652] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.075600][ T7652] RSP: 002b:00007f02ea913028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 217.075622][ T7652] RAX: ffffffffffffffda RBX: 00007f02e9c25fa0 RCX: 00007f02e999e159 [ 217.075637][ T7652] RDX: 0000200000003140 RSI: 0000000040045402 RDI: 0000000000000003 [ 217.075650][ T7652] RBP: 00007f02ea913090 R08: 0000000000000000 R09: 0000000000000000 [ 217.075663][ T7652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 217.075675][ T7652] R13: 00007f02e9c26038 R14: 00007f02e9c25fa0 R15: 00007f02e9d4fa48 [ 217.075706][ T7652] [ 217.075727][ T7652] ERROR: Out of memory at tomoyo_realpath_from_path. [ 217.355031][ T5681] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 217.538081][ T5681] usb 5-1: Using ep0 maxpacket: 8 [ 217.546756][ T5681] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 217.575443][ T5681] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 217.575473][ T5681] usb 5-1: config 0 has no interface number 0 [ 217.575513][ T5681] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 217.575535][ T5681] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 217.575559][ T5681] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 217.575584][ T5681] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 217.575625][ T5681] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.674724][ T5681] usb 5-1: config 0 descriptor?? [ 217.758050][ T5681] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 217.909327][ T5617] Bluetooth: hci5: command tx timeout [ 218.008210][ T5681] usb 5-1: USB disconnect, device number 31 [ 218.100132][ T5681] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 218.102673][ T7646] PM: Enabling pm_trace changes system date and time during resume. [ 218.102673][ T7646] PM: Correct system time has to be restored manually after resume. [ 218.162075][ T7646] netlink: 80 bytes leftover after parsing attributes in process `syz.4.621'. [ 218.496463][ T5681] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 218.647520][ T5681] usb 5-1: Using ep0 maxpacket: 32 [ 218.650158][ T5681] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 218.652337][ T5681] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 218.652361][ T5681] usb 5-1: config 0 has no interface number 0 [ 218.652403][ T5681] usb 5-1: config 0 interface 184 has no altsetting 0 [ 218.748942][ T5681] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.748972][ T5681] usb 5-1: Product: syz [ 218.748987][ T5681] usb 5-1: Manufacturer: syz [ 218.749001][ T5681] usb 5-1: SerialNumber: syz [ 218.792128][ T5681] usb 5-1: config 0 descriptor?? [ 219.018022][ T5681] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 219.018250][ T5681] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 219.085890][ T5681] usb 5-1: USB disconnect, device number 32 [ 219.749198][ T7675] openvswitch: netlink: Flow key attr not present in new flow. [ 219.920237][ T60] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.988387][ T5617] Bluetooth: hci5: command tx timeout [ 220.265737][ T7682] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 222.192635][ T5617] Bluetooth: hci5: command tx timeout [ 256.946358][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.962252][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 295.670160][ T4983] udevd[4983]: worker [7593] /devices/virtual/block/loop2 is taking a long time [ 321.567479][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 321.583638][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 342.867860][ T53] Bluetooth: hci5: command 0x0406 tx timeout [ 376.883455][ T31] INFO: task kworker/u8:4:60 blocked for more than 144 seconds. [ 376.883485][ T31] Tainted: G L syzkaller #0 [ 376.883497][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 376.883512][ T31] task:kworker/u8:4 state:D stack:22568 pid:60 tgid:60 ppid:2 task_flags:0x4208160 flags:0x00080000 [ 376.883564][ T31] Workqueue: netns cleanup_net [ 376.883605][ T31] Call Trace: [ 376.883616][ T31] [ 376.883630][ T31] __schedule+0x17db/0x58f0 [ 376.883686][ T31] ? __pfx___schedule+0x10/0x10 [ 376.883720][ T31] ? schedule+0x90/0x2b0 [ 376.883749][ T31] schedule+0x164/0x2b0 [ 376.883776][ T31] schedule_preempt_disabled+0x13/0x30 [ 376.883800][ T31] __mutex_lock+0x7c1/0x1550 [ 376.883833][ T31] ? __mutex_lock+0x5d4/0x1550 [ 376.883863][ T31] ? rtnl_net_dev_lock+0x257/0x2f0 [ 376.883891][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 376.883929][ T31] ? rtnl_net_dev_lock+0x36/0x2f0 [ 376.883956][ T31] ? rtnl_net_dev_lock+0x36/0x2f0 [ 376.883990][ T31] rtnl_net_dev_lock+0x257/0x2f0 [ 376.884018][ T31] unregister_netdevice_notifier_dev_net+0x2f/0x1a0 [ 376.884046][ T31] ? nsim_destroy+0xe4/0x800 [ 376.884072][ T31] nsim_destroy+0x105/0x800 [ 376.884101][ T31] __nsim_dev_port_del+0x14e/0x200 [ 376.884132][ T31] nsim_dev_reload_destroy+0x288/0x490 [ 376.884165][ T31] nsim_dev_reload_down+0x8a/0xc0 [ 376.884192][ T31] devlink_reload+0x1c5/0x890 [ 376.884227][ T31] ? __pfx_devlink_reload+0x10/0x10 [ 376.884279][ T31] devlink_pernet_pre_exit+0x1ff/0x420 [ 376.884305][ T31] ? __pfx_devlink_pernet_pre_exit+0x10/0x10 [ 376.884331][ T31] ? _raw_spin_unlock+0x28/0x50 [ 376.884355][ T31] ? iput+0xb84/0xf00 [ 376.884392][ T31] ops_undo_list+0x17d/0x8d0 [ 376.884424][ T31] ? __pfx_ops_undo_list+0x10/0x10 [ 376.884454][ T31] ? idr_destroy+0x218/0x290 [ 376.884476][ T31] ? do_raw_spin_unlock+0xf5/0x200 [ 376.884509][ T31] cleanup_net+0x572/0x810 [ 376.884538][ T31] ? __pfx_cleanup_net+0x10/0x10 [ 376.884569][ T31] ? rcu_is_watching+0x16/0xb0 [ 376.884597][ T31] ? process_scheduled_works+0x97a/0x1630 [ 376.884623][ T31] process_scheduled_works+0xc3d/0x1630 [ 376.884679][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 376.884711][ T31] ? assign_work+0x3cf/0x5d0 [ 376.884743][ T31] worker_thread+0xa47/0xfb0 [ 376.884783][ T31] ? __kthread_parkme+0x71/0x1f0 [ 376.884822][ T31] kthread+0x38b/0x480 [ 376.884842][ T31] ? __pfx_worker_thread+0x10/0x10 [ 376.884867][ T31] ? __pfx_kthread+0x10/0x10 [ 376.884889][ T31] ret_from_fork+0x514/0xb70 [ 376.884912][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 376.884931][ T31] ? __switch_to+0xc89/0x1420 [ 376.884962][ T31] ? __pfx_kthread+0x10/0x10 [ 376.884992][ T31] ret_from_fork_asm+0x1a/0x30 [ 376.885037][ T31] [ 376.885200][ T31] [ 376.885200][ T31] Showing all locks held in the system: [ 376.885211][ T31] locks held by kworker/0:0/9: 2, last CPU#0: [ 376.885225][ T31] #0: ffff88805a064940 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.885287][ T31] #1: ffffc900000e7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.885354][ T31] locks held by kworker/0:1/10: 3, on CPU#0: [ 376.885368][ T31] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.885420][ T31] #1: ffffc900000f7c40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.885473][ T31] #2: ffffffff90254cc0 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 376.885529][ T31] locks held by kworker/u8:0/12: 3, last CPU#1: [ 376.885543][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.885596][ T31] #1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.885650][ T31] #2: ffff888058a80800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 376.885701][ T31] locks held by kworker/u8:1/13: 3, last CPU#1: [ 376.885715][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.885767][ T31] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.885820][ T31] #2: ffff8880580b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 376.885869][ T31] locks held by kworker/R-mm_pe/14: 1, on CPU#1: [ 376.885884][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 376.885942][ T31] locks held by kworker/1:0/25: 3, last CPU#1: [ 376.885954][ T31] #0: ffff88803206c940 ((wq_completion)wg-kex-wg2#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.886020][ T31] #1: ffffc900001f7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.886085][ T31] #2: ffff888029db5270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 376.886138][ T31] locks held by khungtaskd/31: 1, last CPU#1: [ 376.905756][ T31] #0: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 376.905823][ T31] locks held by kcompactd0/34: 2, last CPU#0: [ 376.905838][ T31] #0: ffff888034521848 (&mapping->i_mmap_rwsem){++++}-{4:4}, at: __rmap_walk_file+0x1a0/0x6a0 [ 376.905889][ T31] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 376.905943][ T31] locks held by kworker/u8:2/37: 3, last CPU#0: [ 376.905958][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.906021][ T31] #1: ffffc90000ad7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 376.906073][ T31] #2: ffff888058710800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 376.906124][ T31] locks held by kworker/1:1/44: 2, last CPU#1: [ 376.906138][ T31] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.025721][ T31] #1: ffffc90000b47c40 ((work_completion)(&(&tbl->gc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.025779][ T31] locks held by kworker/1:2/49: 2, on CPU#1: [ 379.025793][ T31] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.025845][ T31] #1: ffffc90000ba7c40 (key_gc_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.025895][ T31] locks held by kworker/u8:3/50: 3, last CPU#1: [ 379.025909][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.025958][ T31] #1: ffffc90000bb7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.026010][ T31] #2: ffff888057080800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 379.026062][ T31] locks held by kworker/u8:4/60: 6, on CPU#0: [ 379.026076][ T31] #0: ffff88801c2d6140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.026128][ T31] #1: ffffc9000201fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.045735][ T31] #2: ffffffff90246448 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 379.045801][ T31] #3: ffff88807c033128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420 [ 379.045855][ T31] #4: ffff88805956f258 (&devlink->lock_key#4){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420 [ 379.045912][ T31] #5: ffffffff90254cc0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0 [ 379.045963][ T31] locks held by kworker/u8:5/75: 3, last CPU#0: [ 379.045978][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.046033][ T31] #1: ffffc9000207fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.046086][ T31] #2: ffff888063a40800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 379.046134][ T31] locks held by kswapd0/88: 3, last CPU#1: [ 379.046148][ T31] #0: ffffffff8ee90400 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0xa08/0x32c0 [ 379.063922][ T31] #1: ffff888035d660e8 (&type->s_umount_key#56){.+.+}-{4:4}, at: super_cache_scan+0x94/0x4a0 [ 379.063973][ T31] #2: ffffffff8f58c8c0 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: debug_object_activate+0x364/0x420 [ 379.064029][ T31] locks held by kworker/u8:6/432: 3, last CPU#1: [ 379.064044][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064093][ T31] #1: ffffc9000205fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064146][ T31] #2: ffff888057340800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 379.064198][ T31] locks held by kworker/u8:7/1107: 3, last CPU#1: [ 379.064212][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064263][ T31] #1: ffffc900053c7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064315][ T31] #2: ffff888057e40800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 379.064363][ T31] locks held by kworker/u8:8/1150: 4, last CPU#1: [ 379.064377][ T31] #0: ffff8880355d8940 ((wq_completion)wg-kex-wg2#7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064449][ T31] #1: ffffc90005627c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064503][ T31] #2: ffff888012141440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 379.064547][ T31] #3: ffff888029db5c58 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 379.064595][ T31] locks held by kworker/0:2/1226: 2, last CPU#0: [ 379.064609][ T31] #0: ffff88807ec78d40 ((wq_completion)wg-crypt-wg1#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064665][ T31] #1: ffffc90005857c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064730][ T31] locks held by kworker/u8:9/1377: 3, last CPU#1: [ 379.064745][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064798][ T31] #1: ffffc90005ad7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064851][ T31] #2: ffff888028e90800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 379.064911][ T31] locks held by kworker/R-ipv6_/3196: 3, on CPU#0: [ 379.064924][ T31] #0: ffff88802a0ad140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.064976][ T31] #1: ffffc9000dd3fc20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.065030][ T31] #2: ffffffff90254cc0 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 379.065085][ T31] locks held by kworker/R-bat_e/3227: 1, on CPU#1: [ 379.065099][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 379.065156][ T31] locks held by klogd/4972: 2, last CPU#1: [ 379.065170][ T31] #0: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.065218][ T31] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 379.065268][ T31] locks held by udevd/4983: 1, last CPU#1: [ 379.065282][ T31] #0: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.065330][ T31] locks held by dhcpcd/5277: 3, last CPU#0: [ 379.065344][ T31] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_number_perm+0x219/0x5f0 [ 379.065394][ T31] #1: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.065448][ T31] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 379.065498][ T31] locks held by dhcpcd/5278: 4, last CPU#1: [ 379.065512][ T31] #0: ffffffff8ee36650 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10a/0x480 [ 379.065564][ T31] #1: ffff88801b10c080 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 379.065609][ T31] #2: ffff888029bfe540 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 379.065660][ T31] #3: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.065707][ T31] locks held by kworker/1:3/5349: 2, last CPU#1: [ 379.065720][ T31] #0: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.065766][ T31] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 379.065816][ T31] locks held by crond/5357: 2, last CPU#1: [ 379.065829][ T31] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 379.065878][ T31] #1: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.065926][ T31] locks held by getty/5379: 2, on CPU#0: [ 379.065939][ T31] #0: ffff888031f750a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 379.065986][ T31] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 379.066040][ T31] locks held by syz-executor/5603: 2, last CPU#0: [ 379.066055][ T31] #0: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.066101][ T31] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: page_ext_get+0x22/0x2e0 [ 379.084024][ T31] locks held by kworker/u9:2/5617: 7, on CPU#0: [ 379.084046][ T31] #0: ffff888033aa0940 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.084108][ T31] #1: ffffc9000397fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.084160][ T31] #2: ffff8880494acea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 379.084209][ T31] #3: ffff8880494ac0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 379.084264][ T31] #4: ffffffff903dbd80 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 379.084317][ T31] #5: ffff888032495af8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x550 [ 379.084369][ T31] #6: ffffffff8ed62c68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 379.084431][ T31] locks held by kworker/0:4/5618: 4, on CPU#0: [ 379.084446][ T31] #0: ffff88807ec79540 ((wq_completion)wg-kex-wg1#12){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.084504][ T31] #1: ffffc9000398fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.084567][ T31] #2: ffff888029c95440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_response+0x22d/0xbd0 [ 379.084618][ T31] #3: ffff888029db2ad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_response+0x2d1/0xbd0 [ 379.084669][ T31] locks held by syz-executor/5635: 4, last CPU#1: [ 379.084684][ T31] #0: ffff8880584c8460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 379.084736][ T31] #1: ffff88803256cae8 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_unlinkat+0x2a7/0x610 [ 379.084798][ T31] #2: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 379.084847][ T31] #3: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.084896][ T31] locks held by syz-executor/5638: 4, last CPU#1: [ 379.084910][ T31] #0: ffff888029a98460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 379.084966][ T31] #1: ffff88803256c4e0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_unlinkat+0x2a7/0x610 [ 379.085026][ T31] #2: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 379.085075][ T31] #3: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.085149][ T31] locks held by kworker/R-wg-cr/5657: 1, on CPU#1: [ 379.085163][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 379.085219][ T31] locks held by kworker/R-wg-cr/5658: 1, on CPU#0: [ 379.085233][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 379.085288][ T31] locks held by kworker/R-wg-cr/5661: 1, on CPU#1: [ 379.085302][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 379.085356][ T31] locks held by kworker/R-wg-cr/5663: 1, on CPU#0: [ 379.085370][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 379.085434][ T31] locks held by kworker/R-wg-cr/5665: 1, on CPU#1: [ 379.085448][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 379.085504][ T31] locks held by kworker/R-wg-cr/5670: 1, on CPU#0: [ 379.085518][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 379.085573][ T31] locks held by kworker/R-wg-cr/5671: 1, on CPU#0: [ 379.085587][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 379.085643][ T31] locks held by kworker/R-wg-cr/5674: 1, on CPU#0: [ 379.085657][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 379.085712][ T31] locks held by kworker/1:4/5681: 3, last CPU#1: [ 379.085725][ T31] #0: ffff888031869940 ((wq_completion)wg-kex-wg1#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.085783][ T31] #1: ffffc9000468fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.085848][ T31] #2: ffff888059462ad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 379.085898][ T31] locks held by kworker/0:5/5688: 3, last CPU#0: [ 379.085912][ T31] #0: ffff888058947140 ((wq_completion)wg-kex-wg2#12){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.085970][ T31] #1: ffffc9000470fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.086033][ T31] #2: ffff888029db1700 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 379.086082][ T31] locks held by kworker/0:6/5695: 3, last CPU#0: [ 379.086096][ T31] #0: ffff8880351fa140 ((wq_completion)wg-kex-wg1#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.096799][ T31] #1: ffffc9000477fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.096879][ T31] #2: ffff888059465270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 379.096930][ T31] locks held by kworker/0:7/5708: 4, on CPU#0: [ 379.096941][ T31] #0: ffff888031869940 ((wq_completion)wg-kex-wg1#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.096989][ T31] #1: ffffc90004c5fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.097054][ T31] #2: ffff888029e21440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 379.097104][ T31] #3: ffff8880594634b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x59c/0x9b0 [ 379.097153][ T31] locks held by kworker/0:8/5709: 8, last CPU#0: [ 379.097167][ T31] #0: ffff88805a058940 ((wq_completion)wg-kex-wg0#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.097225][ T31] #1: ffffc90004c6fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.097289][ T31] #2: ffff88807fcb5440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x14e/0x9f0 [ 379.097338][ T31] #3: ffff88807cb7f028 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x15f/0x9f0 [ 379.097387][ T31] #4: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 [ 379.097453][ T31] #5: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 [ 379.097506][ T31] #6: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: __ip_vs_service_find+0x1c0/0x8d0 [ 379.097561][ T31] #7: ffff88802b1d4e38 (&t->seqc[i]){...-}-{0:0}, at: unwind_next_frame+0x8f/0x2550 [ 379.097612][ T31] locks held by kworker/1:5/5712: 4, last CPU#1: [ 379.097626][ T31] #0: ffff8880351fa140 ((wq_completion)wg-kex-wg1#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.097683][ T31] #1: ffffc90004c9fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.097748][ T31] #2: ffff88807cb7bea0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 379.097797][ T31] #3: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.097847][ T31] locks held by kworker/1:6/6431: 3, last CPU#1: [ 379.097861][ T31] #0: ffff888030c1b140 ((wq_completion)wg-kex-wg0#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.097918][ T31] #1: ffffc90002effc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.097982][ T31] #2: ffff88807fcb1440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 379.098033][ T31] locks held by kworker/u8:10/7582: 3, last CPU#1: [ 379.098047][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.098100][ T31] #1: ffffc90004edfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.098152][ T31] #2: ffff888058be0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 379.098200][ T31] locks held by kworker/u8:11/7592: 3, last CPU#1: [ 379.098215][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.098267][ T31] #1: ffffc90004fc7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.098320][ T31] #2: ffff8880583d0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 379.098369][ T31] locks held by udevd/7593: 4, last CPU#1: [ 379.098382][ T31] #0: ffff888012268460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 379.098441][ T31] #1: ffff88803217e308 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 [ 379.098498][ T31] #2: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path2_perm+0x299/0x760 [ 379.098549][ T31] #3: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.098597][ T31] locks held by syz-executor/7623: 3, last CPU#1: [ 379.098611][ T31] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 379.098660][ T31] #1: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.098707][ T31] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 379.098758][ T31] locks held by kworker/R-wg-cr/7628: 1, on CPU#0: [ 379.098772][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 379.098828][ T31] locks held by kworker/R-wg-cr/7629: 1, last CPU#0: [ 379.098842][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 379.098896][ T31] locks held by kworker/R-wg-cr/7630: 1, on CPU#1: [ 379.098911][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 379.098967][ T31] locks held by syz.0.622/7654: 1, on CPU#0: [ 379.098981][ T31] #0: ffffffff8ed62c68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 379.099036][ T31] locks held by syz.4.634/7683: 2, last CPU#1: [ 379.099050][ T31] #0: ffffffff90254cc0 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3da/0x1e70 [ 379.099101][ T31] #1: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.099149][ T31] locks held by kworker/u8:12/7696: 4, last CPU#1: [ 379.099163][ T31] #0: ffff888012283140 ((wq_completion)wg-kex-wg2#5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.099221][ T31] #1: ffffc90004197c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.099275][ T31] #2: ffff888079599440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 379.099324][ T31] #3: ffff88807cb79700 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 379.099373][ T31] locks held by kworker/u8:13/7697: 4, last CPU#1: [ 379.099387][ T31] #0: ffff8880551af940 ((wq_completion)wg-kex-wg1#11){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.099451][ T31] #1: ffffc900041c7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.099505][ T31] #2: ffff888029c95440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 379.099554][ T31] #3: ffff888029db2ad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 379.099602][ T31] locks held by kworker/u8:14/7698: 4, last CPU#1: [ 379.099617][ T31] #0: ffff88807f39c140 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.099673][ T31] #1: ffffc9000390fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 379.099727][ T31] #2: ffff888029e21440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 379.099775][ T31] #3: ffff8880594634b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 379.099824][ T31] locks held by kworker/u8:15/7699: 1, on CPU#1: [ 379.099838][ T31] #0: ffffffff8ebf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_thread+0x5c/0xfb0 [ 379.099898][ T31] locks held by kworker/0:9/7700: 2, last CPU#0: [ 379.099911][ T31] #0: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 379.099958][ T31] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 379.100014][ T31] [ 379.100020][ T31] ============================================= [ 379.100020][ T31] [ 379.100045][ T31] NMI backtrace for cpu 1 [ 379.100069][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 379.100120][ T31] Tainted: [L]=SOFTLOCKUP [ 379.100134][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 379.100157][ T31] Call Trace: [ 379.100171][ T31] [ 379.100188][ T31] dump_stack_lvl+0xe8/0x150 [ 379.100244][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 379.100272][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 379.100304][ T31] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 379.100330][ T31] sys_info+0x135/0x170 [ 379.100349][ T31] watchdog+0xfd7/0x1030 [ 379.100376][ T31] ? watchdog+0x1c7/0x1030 [ 379.100401][ T31] kthread+0x38b/0x480 [ 379.100428][ T31] ? __pfx_watchdog+0x10/0x10 [ 379.100447][ T31] ? __pfx_kthread+0x10/0x10 [ 379.100467][ T31] ret_from_fork+0x514/0xb70 [ 379.100488][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 379.100507][ T31] ? __switch_to+0xc89/0x1420 [ 379.100537][ T31] ? __pfx_kthread+0x10/0x10 [ 379.100558][ T31] ret_from_fork_asm+0x1a/0x30 [ 379.100600][ T31] [ 379.100607][ T31] Sending NMI from CPU 1 to CPUs 0: [ 379.100652][ C0] NMI backtrace for cpu 0 [ 379.100667][ C0] CPU: 0 UID: 0 PID: 5709 Comm: kworker/0:8 Tainted: G L syzkaller #0 PREEMPT(full) [ 379.100690][ C0] Tainted: [L]=SOFTLOCKUP [ 379.100696][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 379.100707][ C0] Workqueue: wg-kex-wg0 wg_packet_handshake_receive_worker [ 379.100731][ C0] RIP: 0010:unwind_next_frame+0xb77/0x2550 [ 379.100753][ C0] Code: 10 49 89 fc 49 c1 ec 03 48 b8 00 00 00 00 00 fc ff df 41 80 3c 04 00 74 09 e8 35 f3 bf 00 4c 8b 04 24 49 8d 50 f8 4d 8b 6e 10 <48> b8 00 00 00 00 00 fc ff df 48 8b 4c 24 10 0f b6 04 01 84 c0 0f [ 379.100768][ C0] RSP: 0018:ffffc90000006f60 EFLAGS: 00000246 [ 379.100783][ C0] RAX: dffffc0000000000 RBX: 1ffff92000000e02 RCX: ffffffff90f3f1d0 [ 379.100796][ C0] RDX: ffffc90000007618 RSI: 0000000000000002 RDI: ffffc90000007018 [ 379.100809][ C0] RBP: 1ffffffff2345bdb R08: ffffc90000007620 R09: 0000000000000000 [ 379.100821][ C0] R10: ffffc90000007058 R11: ffffffff81b2a320 R12: 1ffff92000000e03 [ 379.100835][ C0] R13: ffffc90000008000 R14: ffffc90000007008 R15: ffffc90000000000 [ 379.100848][ C0] FS: 0000000000000000(0000) GS:ffff888124cc8000(0000) knlGS:0000000000000000 [ 379.100862][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 379.100875][ C0] CR2: 00007fda42f4eccc CR3: 00000000123d6000 CR4: 00000000003526f0 [ 379.100891][ C0] DR0: 0000000000000000 DR1: 0000000000800400 DR2: 0000000000000000 [ 379.100902][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 379.100913][ C0] Call Trace: [ 379.100925][ C0] [ 379.100934][ C0] ? nft_synproxy_do_eval+0x389/0x5d0 [ 379.100958][ C0] ? unwind_next_frame+0x8f/0x2550 [ 379.100978][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 379.100997][ C0] arch_stack_walk+0x11b/0x150 [ 379.101018][ C0] ? nft_synproxy_do_eval+0x389/0x5d0 [ 379.101042][ C0] stack_trace_save+0xa9/0x100 [ 379.101059][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 379.101075][ C0] ? kfree+0x1c5/0x650 [ 379.101100][ C0] ? __lock_acquire+0x747/0x2de0 [ 379.101120][ C0] kasan_save_track+0x3e/0x80 [ 379.101139][ C0] ? kasan_save_track+0x3e/0x80 [ 379.101156][ C0] ? kasan_save_free_info+0x40/0x50 [ 379.101179][ C0] ? __kasan_slab_free+0x5c/0x80 [ 379.101197][ C0] ? kmem_cache_free+0x182/0x650 [ 379.101214][ C0] ? nft_synproxy_eval_v4+0x36a/0x4e0 [ 379.101236][ C0] ? nft_synproxy_do_eval+0x389/0x5d0 [ 379.101278][ C0] ? nft_synproxy_eval_v4+0x36a/0x4e0 [ 379.101300][ C0] kasan_save_free_info+0x40/0x50 [ 379.101324][ C0] __kasan_slab_free+0x5c/0x80 [ 379.101343][ C0] kmem_cache_free+0x182/0x650 [ 379.101364][ C0] nft_synproxy_eval_v4+0x36a/0x4e0 [ 379.101390][ C0] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 379.101413][ C0] ? nf_ip_checksum+0x13c/0x510 [ 379.101438][ C0] nft_synproxy_do_eval+0x389/0x5d0 [ 379.101463][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 379.101489][ C0] ? __ip_vs_service_find+0x8c3/0x8d0 [ 379.101516][ C0] nft_do_chain+0x48d/0x1b10 [ 379.101545][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 379.101571][ C0] ? __pfx_ip_vs_fill_iph_skb_off+0x10/0x10 [ 379.101606][ C0] nft_do_chain_inet+0x360/0x4b0 [ 379.101631][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 379.101657][ C0] ? nf_nat_ipv4_local_in+0x21f/0x720 [ 379.101677][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 379.101699][ C0] nf_hook_slow+0xc5/0x220 [ 379.101721][ C0] NF_HOOK+0x21f/0x3c0 [ 379.101743][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 379.101766][ C0] ? NF_HOOK+0x9e/0x3c0 [ 379.101787][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 379.101809][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 379.101835][ C0] ? ip_local_deliver+0x113/0x190 [ 379.101858][ C0] NF_HOOK+0x336/0x3c0 [ 379.101881][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 379.101903][ C0] ? NF_HOOK+0x9e/0x3c0 [ 379.101949][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 379.101972][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 379.101994][ C0] ? ip_rcv_core+0x88d/0xd50 [ 379.102018][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 379.102039][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 379.102061][ C0] process_backlog+0xa6b/0x18b0 [ 379.102084][ C0] ? process_backlog+0x3de/0x18b0 [ 379.102110][ C0] __napi_poll+0xaa/0x330 [ 379.102130][ C0] net_rx_action+0x61d/0xf50 [ 379.102155][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 379.102175][ C0] ? kvm_sched_clock_read+0x11/0x20 [ 379.102200][ C0] ? __pfx_sched_clock_cpu+0x10/0x10 [ 379.102225][ C0] handle_softirqs+0x226/0x860 [ 379.102248][ C0] ? do_softirq+0x77/0xd0 [ 379.102270][ C0] ? kernel_fpu_end+0x62/0x80 [ 379.102290][ C0] do_softirq+0x77/0xd0 [ 379.102310][ C0] [ 379.102316][ C0] [ 379.102322][ C0] __local_bh_enable_ip+0x100/0x140 [ 379.102341][ C0] blake2s_compress+0xfa/0x1c00 [ 379.102368][ C0] ? __pfx_chacha_block_generic+0x10/0x10 [ 379.102385][ C0] ? __pfx_blake2s_compress+0x10/0x10 [ 379.102401][ C0] ? __crypto_memneq+0x2fe/0x470 [ 379.102422][ C0] ? curve25519_generate_public+0x2fed/0x3050 [ 379.102450][ C0] blake2s_final+0x10f/0x260 [ 379.102468][ C0] message_ephemeral+0x1b2/0x310 [ 379.102486][ C0] ? __pfx_message_ephemeral+0x10/0x10 [ 379.102517][ C0] ? down_read+0x2be/0x330 [ 379.102541][ C0] wg_noise_handshake_create_response+0x297/0x9f0 [ 379.102562][ C0] ? __pfx_wg_noise_handshake_create_response+0x10/0x10 [ 379.102583][ C0] ? rcu_is_watching+0x16/0xb0 [ 379.102603][ C0] ? __up_read+0x29c/0x930 [ 379.102627][ C0] ? __pfx___up_read+0x10/0x10 [ 379.102653][ C0] ? wg_noise_handshake_consume_initiation+0x70c/0x9b0 [ 379.102672][ C0] ? __lock_acquire+0x747/0x2de0 [ 379.102695][ C0] ? __asan_memset+0x22/0x50 [ 379.102711][ C0] ? blake2s_final+0x145/0x260 [ 379.102730][ C0] ? lock_acquire+0x115/0x350 [ 379.102750][ C0] ? ktime_get_coarse_with_offset+0x8a/0x150 [ 379.102772][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 379.102793][ C0] ? ktime_get_coarse_with_offset+0x8a/0x150 [ 379.102812][ C0] ? ktime_get_coarse_with_offset+0x102/0x150 [ 379.102832][ C0] wg_packet_send_handshake_response+0x110/0x2d0 [ 379.102855][ C0] ? __pfx_wg_packet_send_handshake_response+0x10/0x10 [ 379.102876][ C0] ? wg_socket_set_peer_endpoint_from_skb+0xd7/0x130 [ 379.102903][ C0] ? __local_bh_enable_ip+0xd6/0x140 [ 379.102931][ C0] wg_packet_handshake_receive_worker+0x6a9/0x10c0 [ 379.102953][ C0] ? look_up_lock_class+0x57/0x110 [ 379.102981][ C0] ? __pfx_wg_packet_handshake_receive_worker+0x10/0x10 [ 379.103002][ C0] ? __kfree_rcu_sheaf+0x21/0x6c0 [ 379.103023][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 379.103049][ C0] ? lock_acquire+0x115/0x350 [ 379.103070][ C0] ? rcu_is_watching+0x16/0xb0 [ 379.103091][ C0] ? process_scheduled_works+0x97a/0x1630 [ 379.103112][ C0] process_scheduled_works+0xc3d/0x1630 [ 379.103146][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 379.103170][ C0] ? assign_work+0x3cf/0x5d0 [ 379.103193][ C0] worker_thread+0xa47/0xfb0 [ 379.103220][ C0] ? __kthread_parkme+0x71/0x1f0 [ 379.103247][ C0] kthread+0x38b/0x480 [ 379.103263][ C0] ? __pfx_worker_thread+0x10/0x10 [ 379.103284][ C0] ? __pfx_kthread+0x10/0x10 [ 379.103301][ C0] ret_from_fork+0x514/0xb70 [ 379.103319][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 379.103334][ C0] ? __switch_to+0xc89/0x1420 [ 379.103357][ C0] ? __pfx_kthread+0x10/0x10 [ 379.103374][ C0] ret_from_fork_asm+0x1a/0x30 [ 379.103404][ C0] [ 379.103653][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 382.354918][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 382.365617][ T31] Tainted: [L]=SOFTLOCKUP [ 382.369952][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 382.380016][ T31] Call Trace: [ 382.383303][ T31] [ 382.386241][ T31] vpanic+0x56d/0xa60 [ 382.390250][ T31] ? __pfx_vpanic+0x10/0x10 [ 382.394778][ T31] ? console_srcu_read_unlock+0x3a/0x60 [ 382.400348][ T31] panic+0xc5/0xd0 [ 382.404085][ T31] ? __pfx_panic+0x10/0x10 [ 382.408518][ T31] ? wq_watchdog_touch+0xf9/0x160 [ 382.413555][ T31] ? nmi_trigger_cpumask_backtrace+0x24d/0x390 [ 382.419725][ T31] watchdog+0x1030/0x1030 [ 382.424084][ T31] ? watchdog+0x1c7/0x1030 [ 382.428517][ T31] kthread+0x38b/0x480 [ 382.432596][ T31] ? __pfx_watchdog+0x10/0x10 [ 382.437279][ T31] ? __pfx_kthread+0x10/0x10 [ 382.441881][ T31] ret_from_fork+0x514/0xb70 [ 382.446482][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 382.451610][ T31] ? __switch_to+0xc89/0x1420 [ 382.456329][ T31] ? __pfx_kthread+0x10/0x10 [ 382.460932][ T31] ret_from_fork_asm+0x1a/0x30 [ 382.465726][ T31] [ 382.469033][ T31] Kernel Offset: disabled [ 382.473355][ T31] Rebooting in 86400 seconds..