last executing test programs: 1m22.30982315s ago: executing program 2 (id=3): socket$key(0xf, 0x3, 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000011c0)=ANY=[@ANYBLOB="38010000100033062cbd700000000000fc020000000000000000000000000000ac1414aa0000000000000000000000000000000900000008000000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd32000000000000000000000000000000000000000700000000000000fcffffffffffffff00000000000000000900000000000000030000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000100000000000002000000200000000000000048000200656362286369706865725f6e756c6c29"], 0x138}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000001300)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, 0x29) connect$inet(r1, &(0x7f0000001500)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001580)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@remote, 0x4e21, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xad, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x0, 0x32}, 0x0, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r1, 0x0, 0x0) 1m22.153870228s ago: executing program 2 (id=11): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="6005060000002328"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000780)={0x44, &(0x7f0000000500)={0x20, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 1m18.858538339s ago: executing program 0 (id=21): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xb4}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000001a00)={0x0, 0x0, &(0x7f0000001a40)={&(0x7f0000001a80)={0x28, 0x2, 0x3, 0x1, 0x0, 0x0, {0xa}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0xa}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}]}, 0x28}}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000001b00)={0xa, 0x4d2, 0x0, @remote}, 0x1c) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f0000001b40)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001bc0)={0x20, 0x1, 0x3, 0x1, 0x0, 0x0, {0xa}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x1, 0x1}}]}, 0x20}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000001780)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000001800)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0x5}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}}, 0x0) 1m18.849157506s ago: executing program 2 (id=22): socket$kcm(0x10, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) setns(0xc9, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/fib_triestat\x00') pread64(r1, &(0x7f0000000640)=""/4105, 0x137, 0x0) 1m18.714257744s ago: executing program 0 (id=25): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000001c0)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21}, &(0x7f0000000480)=0x0) timer_settime(r1, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0xfc, 0x0, 0x0, 0x40, 0xfd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x0, 0x0) 1m18.328204062s ago: executing program 1 (id=26): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000001c0)="b9800000c00f3235000400000f30440f20c03508000000440f22c036646665f36526f20f22a5430f01c566ba4000edc4a39979250b00000008b9800000c00f3235010000000f30f245ab48b800000000000000800f23c00f21f83500000b000f23f8c481e57dcd", 0x67}], 0x1, 0x10, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0xa1, 0x29a, 0x0, 0x5}, 0x10) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1m18.326762659s ago: executing program 2 (id=27): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000280)={0x0, &(0x7f0000000400)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_vmlaunch={0x12f, 0x18}], 0x48}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000008c0)={[0x9, 0x859, 0xb, 0x2fa, 0x100000001, 0x3, 0x100076c, 0xffffffffffffa594, 0x7, 0xfff, 0x3, 0x2, 0x3, 0x0, 0xbd, 0x6], 0x0, 0x4250}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1m18.099435025s ago: executing program 0 (id=28): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = open(&(0x7f0000000040)='./bus\x00', 0x80242, 0x0) lseek(r0, 0x8, 0x4) 1m17.938518345s ago: executing program 0 (id=29): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000880)={0x2c, &(0x7f0000000000)={0x20, 0x9, 0x17, {0x17, 0x31, "739986987f521f74bf4a52a266ac6b8ca245158690"}}, &(0x7f0000000300)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x860}}, &(0x7f0000000700)={0x0, 0xf, 0x38, {0x5, 0xf, 0x38, 0x3, [@wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x3, 0x1, 0x3, 0x4}, @ssp_cap={0xc, 0x10, 0xa, 0x7, 0x0, 0x1, 0xf000, 0x1}, @generic={0x1c, 0x10, 0xb, "81d4d116eaa9052312f786992abd5b9c8a1263bd8f4f8139b3"}]}}, &(0x7f0000000800)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7f, 0x3, 0x7, 0xd, "e98f8497", "ae4a9138"}}, &(0x7f0000000840)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x40, 0x10, 0x9, 0x1, 0x1, 0x0, 0x6}}}, &(0x7f0000000d40)={0x84, &(0x7f00000008c0)={0x0, 0x14, 0x77, "1706aa791734bffc62a9809ff4694a681a9f991f145125cb487387012ec077f9b99b2f573409dba36bc766607b4de9b5ec12b06dc451f0275a606b4421da803279848809e7abee89bc8704efdca4ece405c4e2c16119dcbebc3b016043da83728066f9981792e2297622860459a3b25965aa7464a0befd"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000011c0)={0x44, &(0x7f0000000f00)={0x40, 0xd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1m17.856129362s ago: executing program 3 (id=30): mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000004c0)='./proc\x00', &(0x7f0000000500)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000580)='100', 0x3) socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000b80)={'syz0\x00', {0x0, 0x4, 0x0, 0x1000}, 0x1c, [0x101, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xac, 0xff, 0xeb93], [0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x7, 0x0, 0x8, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0xfd], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf3, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0xb5, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) 1m17.236341223s ago: executing program 2 (id=31): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="6005060000002328"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000780)={0x44, &(0x7f0000000500)={0x20, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 1m16.894373492s ago: executing program 3 (id=32): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) socket$inet_udp(0x2, 0x2, 0x0) mount(0x0, &(0x7f0000000580)='./dev\x00', 0x0, 0x0, 0x0) close(0x3) 1m16.636163815s ago: executing program 1 (id=33): gettid() mremap(&(0x7f0000186000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) pipe(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2, &(0x7f0000001480)=0x7ff, 0xfdd5) bind$inet6(r1, &(0x7f00000014c0)={0xa, 0x8000002, 0x2004}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x22008041, &(0x7f0000001500)={0xa, 0x2, 0x2, @loopback, 0xfffffff9}, 0x1c) sendto$inet6(r1, &(0x7f0000001540)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090000006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x406f413, 0x0) 1m16.286035263s ago: executing program 3 (id=34): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) mkdir(&(0x7f0000000040)='dir0\x00', 0x0) mount(0x0, &(0x7f0000000080)='dir0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x34000}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x103a42, 0x4) read$FUSE(r1, &(0x7f00000018c0)={0x2020}, 0x2020) 1m15.842012028s ago: executing program 3 (id=35): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x40241, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newpolicy={0xfc, 0x13, 0x101, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@multicast2, 0x4e20, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0x0, 0x6, 0x3, 0x5, 0x8}, {0x0, 0x1, 0x0, 0x100}, 0x6, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@loopback, 0x4d4, 0x2b}, 0x2, @in6=@remote, 0x0, 0x5, 0x2, 0x3, 0x0, 0x2, 0x6}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20048840}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000480)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000004c0)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 1m15.570663745s ago: executing program 1 (id=36): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x4000, 0x0) futex(0x0, 0x5, 0x0, 0x0, 0x0, 0x82020000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='270', 0x3) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, &(0x7f00000009c0)={0x4, 0x0, 0x0, 0x1b0, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@mirror={0x0, 0x6800, 0x0, 0x78, 'mirror\x00', {'core 1 64', 0x20, 0x2, [{0x20, {@ram={'/dev/ram', 0x1}, 0x20, '8191'}}, {0x20, {@ram={'/dev/ram', 0x1}, 0x20, '8191'}}], ' 1 handle_errors'}}]}) 1m15.527099443s ago: executing program 1 (id=37): ioctl$sock_bt_hidp_HIDPCONNDEL(0xffffffffffffffff, 0x400448c9, &(0x7f0000000040)={@any, 0xa24}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000001140)='./proc\x00', 0x1ff) mount(0x0, &(0x7f000001a480)='./proc\x00', &(0x7f000001a4c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000001a500)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r1, &(0x7f000001a540)='7', 0x1) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f000001a580)=0x1, 0x4) 1m15.517960569s ago: executing program 3 (id=38): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000180)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_vmlaunch={0x12f, 0x18}], 0x48}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x9, 0x859, 0xb, 0x2fa, 0x100000001, 0x3, 0x100076c, 0xffffffffffffa594, 0x7, 0xfff, 0x3, 0x2, 0x3, 0x0, 0xbd, 0x6], 0x0, 0x4250}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000140)=@arm64={0x7, 0xd, 0x2, '\x00', 0xb2}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1m15.145921275s ago: executing program 1 (id=39): write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000000)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x4, 0xffffffffd7110f4f, 0x9a64, 0x8000, 0x200, 0xffeffffa, 0x0, 0x0, 0x10, 0x103}}, 0x50) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f00000000c0)="0f001e0fc7ad0e000000f30f09660faef00f32670f001cea050000009f00c4c1d1e40445cf0000000f62a264000000c4e20d2f3c59", 0x35}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m14.869415938s ago: executing program 0 (id=40): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000140)="91f8a9849519def28691bbc4173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000", 0x41}, {&(0x7f0000000e80)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8000000000000000000000000000000001c8a9f7956583e26f6f0edc415851d0b8305fe66c2b7c114e3712d87744938848f24a13cb604000000000000000000000000000000c7aa5035897b20a6c23f1fc4af2990c07f784b985a3de7740bd33848702930", 0x122}, {&(0x7f00000003c0)="641a6a2b863c0dd898013a3f97a834ebb75a925ab48c844221841a232932fc2e37e327de21450df098c113e179a0", 0x2e}, {&(0x7f00000001c0)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c350637808dde804a048fd8696e524b2934126c443ce93d82e931eb9918e6c0827686e59209d2e02c9210fd8048f04ad6c48b3072092c483271361816bf21afb8473a064f1988536d4b5888807b3aaafa", 0x91}], 0x4}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5e911ef2ad63e849901d1001129dbacbfd4924d7545517fd18b5d29978f32a5b5c81755cb89cc0490958ba3211eb99df5cdbbc0f9c941aaa1495893dada02d8188acd26b5afd7476413f322c8f79de769debb56343f3eded2dca93ed6641e50fe595e1e0dbe84ed0f70abb4ed2dfb6648df7dbbd18fa5533a6b0acc138c81a8acbcb2fb79a7d7857d41bca238e0548c5e955d74bbb106fe965274cbb3a29b895df0b4e028b6d65c115b81328e0b660253f1c9a359dde67917fa232e2f566483ddbb93ff9b103c1cac356c9f0f6ab5fe77ea4610f71ec6dc988fddf29b8d0b6aaa82752580b62b5f51800d10077f07319b6ffeff06e4dea184fd7a0a0f4d441763e30d1bc475502a1de1ffbc0e30cb1", 0x161}, {&(0x7f0000000fc0)="31cef842d9c50636f60fc0cfdac56c75f1687f0c56287423f5eed69f117e766bdbad0c2171ad6227e1173ab6efa2fcb1c420a51a0917861009000000f049c606ccab7cda1f0e3490fbe385ea382294882839a22674037b8910bd8a1420e33eb1be6f10cfb24eb7cccdf1528ef33b34ab07cdb0909a9ba9547e1e343b451d9025c4e153612d4674b9411fb4de295499abbcb388d291aa83e93db6cf9ab0954e6a8dfc19c3c1533a11d81e0382999bd736f1caacc2bbf1194598a652677efb930a5b6ee292c57402e0cc07a9a26ee794e46e604a9aec550d12af09f782e1f6a996f0756604847689d37ee3047e61531a8672447cb501b2560bc0e0c5fb2c9f341ed3972b30190e930af94642ab1557e286442cfa6a84ad931e99549640705cd6261ca7094910df055747e2e2ae170e7850093bf0aa3370e03222b5de4597ca76f3193d4a45e424b540f292fd8b3523e5a2dd95177db84a801f0bc70819805a52b1b1b8f6c392056eb5f511d865324a88857277ce16e07bd12fc8b20b4c1b57b6ec2ca63497036679cad780c68628214c86c265e464c8c7715009f8b1c207e2cff5bfdeb2a9194a57901f7a40578f63146d41b7ceef1a2740c519952367f911ef0d1d0b64c39155939f0263567b73c924d61785096b4967d3c9633592df3b817bdff51482b284c4092dee98630814bb183b245b073fdb8927dd", 0x1f8}], 0x2}}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000640)="42e013913edbeb683c44e18a52b5a2462064ddd92caaba941de80d06047dedb7eeeff3a27eacf4c416b6979d6c918608807c44d01535dbaab3b390086e4fd43c6b5931187023646d6beac2340fdc7a0d81214ac76a818f64d287311e8828dfd3e3dd67efdb129a6e52745d1540e570891f6bf411cc16a18c4d34e522a1f003498f1a03ea1f8828b6c902286c71a9bc21923972dacfa74fef6a0fd3267e599c1dd33dff5d7b28f134bda4a29962fd5daa4fc9c515a1c3ee25ace1a9948c24b277d0c9c46f948f8a3f98b1a18eff685b7296457ba31632fea4d8f817817026eeb76460dad4f677de73043600e7", 0xec}, {&(0x7f0000000040)="7542473782798be019c27ed30b2b", 0xe}, {&(0x7f0000000300)="d6f6da22b14bf9ad2fbb765e446f21a90b8d398bc28c67ea1b14020f785656813f94f0a10a80cff62212b5842b9740c2e7c8cbc7ad801a6ec481d22ff828b1ba477f736c1712a1334158d7df5bc9584acb5112d5ca2ba8ac448a37a5347342781c320dd5dcb867490334b7231c", 0x6d}, {&(0x7f0000000740)="b176d469f44ff7e206a24a3a5f3a112da355134ae64fde53dc0e681885ead332aa45811c0070066fb0e5cf5a9a4965475953e2a028f7dd4a6ed8b33465fd161cd8dce309f6be32236cf8e07a5506", 0x4e}], 0x4}}], 0x3, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 1m14.649903509s ago: executing program 0 (id=41): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x5, 0x84) bind(r2, &(0x7f0000000100)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) listen(r2, 0x5) write$tun(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000a00001c"], 0x4a) 1m14.636676859s ago: executing program 3 (id=42): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0xc00000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000400)={0xa, 0x4e22, 0x1, @loopback, 0x7}, 0x1c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x24040004, &(0x7f00000004c0)={0xa, 0x4e22, 0x0, @empty, 0x7f}, 0x1c) close(0x3) 35.809606563s ago: executing program 1 (id=43): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000000)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='illinois', 0x8) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000140), 0x4) sendto$inet(r0, &(0x7f0000000180), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f00000001c0)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 0s ago: executing program 32 (id=41): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x5, 0x84) bind(r2, &(0x7f0000000100)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) listen(r2, 0x5) write$tun(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000a00001c"], 0x4a) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.12' (ED25519) to the list of known hosts. [ 78.739090][ T5630] cgroup: Unknown subsys name 'net' [ 78.815477][ T5630] cgroup: Unknown subsys name 'cpuset' [ 78.824514][ T5630] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 80.456333][ T5630] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 83.975565][ T5641] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 83.979162][ T5641] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 83.979756][ T5641] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 83.980932][ T5641] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 84.004023][ T5641] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 84.148119][ T5641] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 84.150308][ T5641] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 84.151137][ T5641] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 84.160115][ T5641] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 84.174264][ T5641] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 84.196816][ T55] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 84.222687][ T55] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 84.227082][ T5649] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 84.228501][ T5649] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 84.230866][ T5649] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 84.275681][ T5641] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 84.277924][ T5641] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 84.278515][ T5641] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 84.279552][ T5641] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 84.280344][ T5641] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 84.981483][ T5639] rxe_eth0 speed is unknown, defaulting to 1000 [ 84.986392][ T5639] rxe_eth0 speed is unknown, defaulting to 1000 [ 85.013271][ T5639] rxe_eth0 speed is unknown, defaulting to 1000 [ 85.016678][ T5651] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 85.087486][ T5646] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 85.167852][ T5647] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 85.358104][ T5639] infiniband rxe0: set active [ 85.360220][ T5639] infiniband rxe0: added rxe_eth0 [ 85.382990][ T5374] rxe_eth0 speed is unknown, defaulting to 1000 [ 85.394080][ T5639] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 85.394166][ T5639] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 85.394276][ T5639] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 85.462558][ T5639] RDS/IB: rxe0: added [ 85.466523][ T5639] smc: adding ib device rxe0 with port count 1 [ 85.466635][ T5639] smc: ib device rxe0 port 1 has no pnetid [ 85.479647][ T920] rxe_eth0 speed is unknown, defaulting to 1000 [ 85.509804][ T5639] rxe_eth0 speed is unknown, defaulting to 1000 [ 85.803916][ T5639] rxe_eth0 speed is unknown, defaulting to 1000 [ 86.062406][ T5653] Bluetooth: hci0: command tx timeout [ 86.115612][ T5639] rxe_eth0 speed is unknown, defaulting to 1000 [ 86.173090][ T5651] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.174035][ T5651] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.174798][ T5651] bridge_slave_0: entered allmulticast mode [ 86.176779][ T5651] bridge_slave_0: entered promiscuous mode [ 86.222097][ T5653] Bluetooth: hci1: command tx timeout [ 86.229341][ T5651] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.229449][ T5651] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.229924][ T5651] bridge_slave_1: entered allmulticast mode [ 86.236949][ T5651] bridge_slave_1: entered promiscuous mode [ 86.241085][ T5646] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.242275][ T5646] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.243817][ T5646] bridge_slave_0: entered allmulticast mode [ 86.246311][ T5646] bridge_slave_0: entered promiscuous mode [ 86.256920][ T5647] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.257198][ T5647] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.257522][ T5647] bridge_slave_0: entered allmulticast mode [ 86.268754][ T5647] bridge_slave_0: entered promiscuous mode [ 86.305224][ T5653] Bluetooth: hci2: command tx timeout [ 86.327405][ T5646] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.327516][ T5646] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.327916][ T5646] bridge_slave_1: entered allmulticast mode [ 86.329966][ T5646] bridge_slave_1: entered promiscuous mode [ 86.335923][ T5647] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.336213][ T5647] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.336574][ T5647] bridge_slave_1: entered allmulticast mode [ 86.343431][ T5647] bridge_slave_1: entered promiscuous mode [ 86.381708][ T5653] Bluetooth: hci3: command tx timeout [ 86.463560][ T5651] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.467790][ T5646] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.490678][ T5647] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.504749][ T5651] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.507536][ T5646] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.510333][ T5647] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.615699][ T5647] team0: Port device team_slave_0 added [ 86.618823][ T5651] team0: Port device team_slave_0 added [ 86.634971][ T5646] team0: Port device team_slave_0 added [ 86.638966][ T5647] team0: Port device team_slave_1 added [ 86.641123][ T5651] team0: Port device team_slave_1 added [ 86.665219][ T5646] team0: Port device team_slave_1 added [ 86.725405][ T5639] rxe_eth0 speed is unknown, defaulting to 1000 [ 86.727460][ T5647] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.727475][ T5647] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.727518][ T5647] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.730212][ T5651] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.730227][ T5651] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.730254][ T5651] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.840784][ T5647] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.840799][ T5647] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.840820][ T5647] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.885764][ T5651] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.885815][ T5651] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.885886][ T5651] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.905723][ T5646] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.905786][ T5646] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.905858][ T5646] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.025985][ T5646] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.026003][ T5646] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.026030][ T5646] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.264556][ T5651] hsr_slave_0: entered promiscuous mode [ 87.272223][ T5651] hsr_slave_1: entered promiscuous mode [ 87.316689][ T5647] hsr_slave_0: entered promiscuous mode [ 87.317818][ T5647] hsr_slave_1: entered promiscuous mode [ 87.318574][ T5647] debugfs: 'hsr0' already exists in 'hsr' [ 87.318604][ T5647] Cannot create hsr debugfs directory [ 87.365755][ T5646] hsr_slave_0: entered promiscuous mode [ 87.366890][ T5646] hsr_slave_1: entered promiscuous mode [ 87.367774][ T5646] debugfs: 'hsr0' already exists in 'hsr' [ 87.367790][ T5646] Cannot create hsr debugfs directory [ 87.843431][ T5651] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 87.861529][ T5651] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.868946][ T5651] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 87.883273][ T5651] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.891647][ T5651] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 87.913678][ T5651] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.914744][ T5651] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 87.918486][ T5651] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.057548][ T5647] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.061229][ T5647] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.073229][ T5647] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.085045][ T5647] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.118677][ T5647] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.128446][ T5647] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.129620][ T5647] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.145258][ T5653] Bluetooth: hci0: command tx timeout [ 88.150031][ T5647] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.188255][ T5639] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.188365][ T5639] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.188480][ T5639] bridge_slave_0: entered allmulticast mode [ 88.189815][ T5639] bridge_slave_0: entered promiscuous mode [ 88.221300][ T5639] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.222059][ T5639] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.222194][ T5639] bridge_slave_1: entered allmulticast mode [ 88.223454][ T5639] bridge_slave_1: entered promiscuous mode [ 88.281893][ T5639] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.301702][ T5653] Bluetooth: hci1: command tx timeout [ 88.306010][ T5639] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.348851][ T5639] team0: Port device team_slave_0 added [ 88.369583][ T5639] team0: Port device team_slave_1 added [ 88.381785][ T5653] Bluetooth: hci2: command tx timeout [ 88.398530][ T5646] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.408779][ T5646] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.409847][ T5646] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.419617][ T5646] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.451708][ T5646] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.455378][ T5646] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.456380][ T5646] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.459488][ T5646] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.460456][ T5639] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.460470][ T5639] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.460497][ T5639] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.462378][ T5653] Bluetooth: hci3: command tx timeout [ 88.515099][ T5639] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.515150][ T5639] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.515228][ T5639] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.646383][ T5639] hsr_slave_0: entered promiscuous mode [ 88.647141][ T5639] hsr_slave_1: entered promiscuous mode [ 88.647661][ T5639] debugfs: 'hsr0' already exists in 'hsr' [ 88.647678][ T5639] Cannot create hsr debugfs directory [ 88.784476][ T5651] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.889359][ T5651] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.899917][ T5647] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.919506][ T64] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.919647][ T64] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.959903][ T64] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.959977][ T64] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.990986][ T5647] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.035885][ T64] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.035995][ T64] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.074848][ T5639] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.078484][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.087456][ T64] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.087707][ T64] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.116756][ T5639] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.120044][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.120865][ T5639] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.139210][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.144664][ T5639] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.159701][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.183373][ T5646] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.254296][ T5646] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.305624][ T64] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.305740][ T64] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.348100][ T64] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.348247][ T64] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.627907][ T5639] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.669958][ T5639] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.699253][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.699381][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.742635][ T14] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.742737][ T14] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.140533][ T5651] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.222965][ T5653] Bluetooth: hci0: command tx timeout [ 90.328486][ T5651] veth0_vlan: entered promiscuous mode [ 90.379408][ T5651] veth1_vlan: entered promiscuous mode [ 90.388812][ T5653] Bluetooth: hci1: command tx timeout [ 90.462177][ T5653] Bluetooth: hci2: command tx timeout [ 90.487272][ T5647] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.518944][ T5651] veth0_macvtap: entered promiscuous mode [ 90.545051][ T5651] veth1_macvtap: entered promiscuous mode [ 90.551650][ T5653] Bluetooth: hci3: command tx timeout [ 90.617263][ T5651] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.660288][ T5651] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.702271][ T5647] veth0_vlan: entered promiscuous mode [ 90.726751][ T5647] veth1_vlan: entered promiscuous mode [ 90.763776][ T5646] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.894504][ T53] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.918583][ T5647] veth0_macvtap: entered promiscuous mode [ 90.959396][ T5647] veth1_macvtap: entered promiscuous mode [ 90.971837][ T451] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.975577][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.975609][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.024668][ T5639] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.061987][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.063874][ T5646] veth0_vlan: entered promiscuous mode [ 91.066011][ T5647] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.067460][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.067477][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.122692][ T5647] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.156895][ T5646] veth1_vlan: entered promiscuous mode [ 91.182379][ T451] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.205898][ T5651] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.306476][ T5639] veth0_vlan: entered promiscuous mode [ 91.333327][ T5795] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 91.375017][ T5639] veth1_vlan: entered promiscuous mode [ 91.407025][ T5646] veth0_macvtap: entered promiscuous mode [ 91.425598][ T191] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.425620][ T191] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.468548][ T5646] veth1_macvtap: entered promiscuous mode [ 91.518881][ T191] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.518904][ T191] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.563651][ T191] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.585476][ T5646] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.613422][ T5646] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.638793][ T5639] veth0_macvtap: entered promiscuous mode [ 91.663871][ T5639] veth1_macvtap: entered promiscuous mode [ 91.714532][ T451] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.769561][ T5639] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.795353][ T5799] syz.3.5 uses obsolete (PF_INET,SOCK_PACKET) [ 91.810343][ T5639] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.853655][ T191] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.853722][ T191] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.853759][ T191] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.853796][ T191] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.853832][ T191] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.853869][ T191] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.951438][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.951711][ T5802] FAULT_INJECTION: forcing a failure. [ 91.951711][ T5802] name failslab, interval 1, probability 0, space 0, times 1 [ 91.951753][ T5802] CPU: 1 UID: 0 PID: 5802 Comm: syz.1.2 Not tainted syzkaller #0 PREEMPT(full) [ 91.951776][ T5802] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 91.951809][ T5802] Call Trace: [ 91.951816][ T5802] [ 91.951825][ T5802] dump_stack_lvl+0xe8/0x150 [ 91.951860][ T5802] should_fail_ex+0x3eb/0x540 [ 91.951887][ T5802] should_failslab+0xa8/0x100 [ 91.951938][ T5802] ? ep_insert+0x2b1/0x1af0 [ 91.951970][ T5802] kmem_cache_alloc_noprof+0x9c/0x600 [ 91.952006][ T5802] ? __pfx___mutex_trylock_common+0x10/0x10 [ 91.952038][ T5802] ? ep_insert+0x2b1/0x1af0 [ 91.952076][ T5802] ep_insert+0x2b1/0x1af0 [ 91.952123][ T5802] ? __pfx_ep_insert+0x10/0x10 [ 91.952155][ T5802] ? __pfx___mutex_lock+0x10/0x10 [ 91.952188][ T5802] ? __pfx_futex_wait+0x10/0x10 [ 91.952229][ T5802] do_epoll_ctl_file+0x8c2/0xee0 [ 91.952272][ T5802] ? __pfx_do_epoll_ctl_file+0x10/0x10 [ 91.952308][ T5802] ? __fget_files+0x3a2/0x420 [ 91.952334][ T5802] ? __fget_files+0x2a/0x420 [ 91.952365][ T5802] ? fdget+0x1ac/0x250 [ 91.952394][ T5802] __se_sys_epoll_ctl+0x162/0x230 [ 91.952430][ T5802] ? __pfx___se_sys_epoll_ctl+0x10/0x10 [ 91.952475][ T5802] do_syscall_64+0x16a/0x530 [ 91.952505][ T5802] ? trace_irq_disable+0x3b/0x140 [ 91.952532][ T5802] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.952555][ T5802] ? clear_bhb_loop+0x70/0xc0 [ 91.952582][ T5802] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.952604][ T5802] RIP: 0033:0x7fa1ee7a8f19 [ 91.952632][ T5802] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.952650][ T5802] RSP: 002b:00007fa1ef6d0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 91.952679][ T5802] RAX: ffffffffffffffda RBX: 00007fa1eea25fa0 RCX: 00007fa1ee7a8f19 [ 91.952695][ T5802] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000005 [ 91.952708][ T5802] RBP: 00007fa1ee837f6d R08: 0000000000000000 R09: 0000000000000000 [ 91.952721][ T5802] R10: 0000200000000400 R11: 0000000000000246 R12: 0000000000000000 [ 91.952735][ T5802] R13: 00007fa1eea26038 R14: 00007fa1eea25fa0 R15: 00007fff0fe39348 [ 91.952769][ T5802] [ 92.081578][ T191] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.081847][ T191] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.104560][ T451] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.104614][ T451] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.248243][ T1231] cfg80211: failed to load regulatory.db [ 92.301882][ T5653] Bluetooth: hci0: command tx timeout [ 92.348142][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.348164][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.393725][ T14] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.394674][ T14] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.394691][ T14] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.457716][ T5808] FAULT_INJECTION: forcing a failure. [ 92.457716][ T5808] name failslab, interval 1, probability 0, space 0, times 0 [ 92.457749][ T5808] CPU: 0 UID: 0 PID: 5808 Comm: syz.1.7 Not tainted syzkaller #0 PREEMPT(full) [ 92.457775][ T5808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 92.457789][ T5808] Call Trace: [ 92.457797][ T5808] [ 92.457807][ T5808] dump_stack_lvl+0xe8/0x150 [ 92.457846][ T5808] should_fail_ex+0x3eb/0x540 [ 92.457874][ T5808] should_failslab+0xa8/0x100 [ 92.457910][ T5808] __kmalloc_cache_noprof+0x9e/0x600 [ 92.457938][ T5808] ? once_disable_jump+0x52/0x1a0 [ 92.457969][ T5808] ? once_disable_jump+0x52/0x1a0 [ 92.457993][ T5808] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 92.458025][ T5808] once_disable_jump+0x52/0x1a0 [ 92.458052][ T5808] __rds_conn_create+0x2258/0x2290 [ 92.458083][ T5808] ? copy_page_from_iter+0x27c/0x2d0 [ 92.458127][ T5808] ? __pfx___rds_conn_create+0x10/0x10 [ 92.458161][ T5808] ? __pfx_rds_message_copy_from_user+0x10/0x10 [ 92.458200][ T5808] rds_conn_create_outgoing+0x43/0x60 [ 92.458232][ T5808] rds_sendmsg+0x1048/0x21e0 [ 92.458281][ T5808] ? __pfx_rds_sendmsg+0x10/0x10 [ 92.458326][ T5808] ? lock_acquire+0x115/0x350 [ 92.458351][ T5808] ? __pfx_aa_sk_perm+0x10/0x10 [ 92.458387][ T5808] ? aa_sock_msg_perm+0x144/0x210 [ 92.458426][ T5808] ? apparmor_socket_sendmsg+0x98/0x360 [ 92.458459][ T5808] ? __pfx_rds_sendmsg+0x10/0x10 [ 92.458490][ T5808] sock_sendmsg_nosec+0x14e/0x190 [ 92.458527][ T5808] ____sys_sendmsg+0x54e/0x850 [ 92.458559][ T5808] ? __pfx_____sys_sendmsg+0x10/0x10 [ 92.458595][ T5808] ? import_iovec+0x73/0xa0 [ 92.458625][ T5808] ___sys_sendmsg+0x2a6/0x360 [ 92.458650][ T5808] ? __lock_acquire+0x747/0x2de0 [ 92.458679][ T5808] ? __pfx____sys_sendmsg+0x10/0x10 [ 92.458710][ T5808] ? futex_wait+0x2a2/0x390 [ 92.458776][ T5808] ? __fget_files+0x3a2/0x420 [ 92.458800][ T5808] ? __fget_files+0x2a/0x420 [ 92.458834][ T5808] __x64_sys_sendmsg+0x1b1/0x290 [ 92.458862][ T5808] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 92.458908][ T5808] do_syscall_64+0x16a/0x530 [ 92.458936][ T5808] ? trace_irq_disable+0x3b/0x140 [ 92.458968][ T5808] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.458989][ T5808] ? clear_bhb_loop+0x70/0xc0 [ 92.459014][ T5808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.459034][ T5808] RIP: 0033:0x7fa1ee7a8f19 [ 92.459053][ T5808] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.459070][ T5808] RSP: 002b:00007fa1ef6af028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 92.459093][ T5808] RAX: ffffffffffffffda RBX: 00007fa1eea26090 RCX: 00007fa1ee7a8f19 [ 92.459108][ T5808] RDX: 0000000004000000 RSI: 0000200000000480 RDI: 0000000000000004 [ 92.459121][ T5808] RBP: 00007fa1ee837f6d R08: 0000000000000000 R09: 0000000000000000 [ 92.459133][ T5808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.459145][ T5808] R13: 00007fa1eea26128 R14: 00007fa1eea26090 R15: 00007fff0fe39348 [ 92.459177][ T5808] [ 92.462270][ T5653] Bluetooth: hci1: command tx timeout [ 92.545559][ T5653] Bluetooth: hci2: command tx timeout [ 92.633051][ T5653] Bluetooth: hci3: command tx timeout [ 92.701262][ T451] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.701706][ T451] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.292323][ T5753] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 93.294090][ T27] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 93.444254][ T27] usb 4-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 93.446957][ T5753] usb 1-1: unable to get BOS descriptor or descriptor too short [ 93.446998][ T5753] usb 1-1: New USB device found: idVendor=6737, idProduct=0001, bcdDevice=91.80 [ 93.448117][ T27] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 93.448143][ T27] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.448163][ T27] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 93.448860][ T27] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.449011][ T5753] usb 1-1: config 142 has an invalid interface number: 251 but max is 0 [ 93.449028][ T5753] usb 1-1: config 142 has no interface number 0 [ 93.449054][ T5753] usb 1-1: config 142 interface 251 altsetting 11 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 93.449072][ T5753] usb 1-1: config 142 interface 251 altsetting 11 endpoint 0x8F is Bulk; changing to Interrupt [ 93.449156][ T5753] usb 1-1: config 142 interface 251 altsetting 11 endpoint 0x1 is Bulk; changing to Interrupt [ 93.449180][ T5753] usb 1-1: config 142 interface 251 has no altsetting 0 [ 93.450900][ T27] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 93.450924][ T27] usb 4-1: Product: syz [ 93.450939][ T27] usb 4-1: Manufacturer: syz [ 93.486348][ T1231] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 93.487931][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 93.489386][ T5753] usb 1-1: string descriptor 0 read error: -22 [ 93.489917][ T5753] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.625735][ T5815] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 93.630029][ T5815] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 93.650513][ T27] cdc_wdm 4-1:1.0: skipping garbage [ 93.650553][ T27] cdc_wdm 4-1:1.0: skipping garbage [ 93.669529][ T5753] cypress_m8 1-1:142.251: HID->COM RS232 Adapter converter detected [ 93.683975][ T27] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 93.684000][ T27] cdc_wdm 4-1:1.0: Unknown control protocol [ 93.689855][ T5753] usb 1-1: HID->COM RS232 Adapter converter now attached to ttyUSB0 [ 93.691455][ T1231] usb 2-1: Using ep0 maxpacket: 8 [ 93.698434][ T1231] usb 2-1: New USB device found: idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 93.709227][ T1231] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.709300][ T1231] usb 2-1: Product: syz [ 93.709356][ T1231] usb 2-1: Manufacturer: syz [ 93.709403][ T1231] usb 2-1: SerialNumber: syz [ 93.755014][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 93.757504][ T10] usb 3-1: New USB device found: idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 93.760819][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 93.760842][ T10] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 93.769003][ T1231] usb 2-1: config 0 descriptor?? [ 93.808029][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.808057][ T10] usb 3-1: Product: syz [ 93.808073][ T10] usb 3-1: Manufacturer: syz [ 93.808088][ T10] usb 3-1: SerialNumber: syz [ 93.838421][ T10] usb 3-1: config 0 descriptor?? [ 93.887269][ T5716] usb 4-1: USB disconnect, device number 2 [ 93.990744][ T1231] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 94.352874][ T999] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 94.503041][ T999] usb 4-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 94.504408][ T999] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 94.504438][ T999] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.504452][ T999] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 94.504483][ T999] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 94.506533][ T999] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 94.506550][ T999] usb 4-1: Product: syz [ 94.506577][ T999] usb 4-1: Manufacturer: syz [ 94.571418][ T999] cdc_wdm 4-1:1.0: skipping garbage [ 94.571439][ T999] cdc_wdm 4-1:1.0: skipping garbage [ 94.593937][ T999] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 94.593958][ T999] cdc_wdm 4-1:1.0: Unknown control protocol [ 94.595978][ C0] usb 1-1: cypress_write_int_callback - unexpected nonzero write status received: -71 [ 94.596027][ C0] cyphidcom ttyUSB0: cypress_m8 suspending failing port 0 - interval might be too short [ 94.596306][ C0] usb 1-1: cypress_read_int_callback - unexpected nonzero read status received: -71 [ 95.065745][ T5744] usb 1-1: USB disconnect, device number 2 [ 95.086957][ T5744] cyphidcom ttyUSB0: HID->COM RS232 Adapter converter now disconnected from ttyUSB0 [ 95.088363][ T5744] cypress_m8 1-1:142.251: device disconnected [ 95.130316][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -EPIPE [ 95.346608][ T5744] usb 4-1: USB disconnect, device number 3 [ 95.607266][ T1231] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 95.622861][ T1231] usb 2-1: USB disconnect, device number 2 [ 95.730595][ T5838] FAULT_INJECTION: forcing a failure. [ 95.730595][ T5838] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 95.730621][ T5838] CPU: 0 UID: 0 PID: 5838 Comm: syz.0.14 Not tainted syzkaller #0 PREEMPT(full) [ 95.730639][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 95.730648][ T5838] Call Trace: [ 95.730654][ T5838] [ 95.730660][ T5838] dump_stack_lvl+0xe8/0x150 [ 95.730689][ T5838] should_fail_ex+0x3eb/0x540 [ 95.730718][ T5838] strncpy_from_user+0x36/0x2c0 [ 95.730737][ T5838] do_getname+0x77/0x250 [ 95.730757][ T5838] __x64_sys_execveat+0xad/0xf0 [ 95.730782][ T5838] do_syscall_64+0x16a/0x530 [ 95.730805][ T5838] ? trace_irq_disable+0x3b/0x140 [ 95.730826][ T5838] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.730842][ T5838] ? clear_bhb_loop+0x70/0xc0 [ 95.730861][ T5838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.730876][ T5838] RIP: 0033:0x7efd71da8f19 [ 95.730891][ T5838] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.730903][ T5838] RSP: 002b:00007efd72b9f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 95.730920][ T5838] RAX: ffffffffffffffda RBX: 00007efd72025fa0 RCX: 00007efd71da8f19 [ 95.730931][ T5838] RDX: 0000000000000000 RSI: 0000200000009ec0 RDI: 0000000000000004 [ 95.730941][ T5838] RBP: 00007efd71e37f6d R08: 0000000000001000 R09: 0000000000000000 [ 95.730951][ T5838] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.730960][ T5838] R13: 00007efd72026038 R14: 00007efd72025fa0 R15: 00007fffad15abb8 [ 95.730984][ T5838] [ 96.207239][ T5852] FAULT_INJECTION: forcing a failure. [ 96.207239][ T5852] name failslab, interval 1, probability 0, space 0, times 0 [ 96.207275][ T5852] CPU: 1 UID: 0 PID: 5852 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full) [ 96.207300][ T5852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 96.207314][ T5852] Call Trace: [ 96.207323][ T5852] [ 96.207332][ T5852] dump_stack_lvl+0xe8/0x150 [ 96.207373][ T5852] should_fail_ex+0x3eb/0x540 [ 96.207404][ T5852] should_failslab+0xa8/0x100 [ 96.207440][ T5852] ? do_getname+0x2e/0x250 [ 96.207464][ T5852] kmem_cache_alloc_noprof+0x9c/0x600 [ 96.207493][ T5852] ? do_getname+0x2e/0x250 [ 96.207524][ T5852] do_getname+0x2e/0x250 [ 96.207549][ T5852] ? getname_flags+0x11/0x20 [ 96.207575][ T5852] __se_sys_acct+0xde/0x9d0 [ 96.207604][ T5852] ? __pfx___se_sys_acct+0x10/0x10 [ 96.207642][ T5852] do_syscall_64+0x16a/0x530 [ 96.207674][ T5852] ? trace_irq_disable+0x3b/0x140 [ 96.207703][ T5852] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.207727][ T5852] ? clear_bhb_loop+0x70/0xc0 [ 96.207755][ T5852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.207777][ T5852] RIP: 0033:0x7efd71da8f19 [ 96.207798][ T5852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.207816][ T5852] RSP: 002b:00007efd72b9f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 [ 96.207841][ T5852] RAX: ffffffffffffffda RBX: 00007efd72025fa0 RCX: 00007efd71da8f19 [ 96.207858][ T5852] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000240 [ 96.207873][ T5852] RBP: 00007efd71e37f6d R08: 0000000000000000 R09: 0000000000000000 [ 96.207888][ T5852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.207901][ T5852] R13: 00007efd72026038 R14: 00007efd72025fa0 R15: 00007fffad15abb8 [ 96.207938][ T5852] [ 96.335058][ T5849] netlink: 88 bytes leftover after parsing attributes in process `syz.3.18'. [ 96.451015][ T5744] usb 3-1: USB disconnect, device number 2 [ 96.667005][ T5864] FAULT_INJECTION: forcing a failure. [ 96.667005][ T5864] name failslab, interval 1, probability 0, space 0, times 0 [ 96.667038][ T5864] CPU: 1 UID: 0 PID: 5864 Comm: syz.1.24 Not tainted syzkaller #0 PREEMPT(full) [ 96.667063][ T5864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 96.667076][ T5864] Call Trace: [ 96.667084][ T5864] [ 96.667093][ T5864] dump_stack_lvl+0xe8/0x150 [ 96.667131][ T5864] should_fail_ex+0x3eb/0x540 [ 96.667160][ T5864] should_failslab+0xa8/0x100 [ 96.667197][ T5864] __kmalloc_noprof+0xf9/0x710 [ 96.667224][ T5864] ? __kmalloc_noprof+0x1a6/0x710 [ 96.667250][ T5864] ? vmci_handle_arr_create+0x71/0x140 [ 96.667274][ T5864] ? vmci_handle_arr_create+0x71/0x140 [ 96.667326][ T5864] vmci_handle_arr_create+0x71/0x140 [ 96.667357][ T5864] vmci_ctx_create+0x244/0x630 [ 96.667400][ T5864] vmci_host_unlocked_ioctl+0x1c25/0x2840 [ 96.667437][ T5864] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 96.667501][ T5864] ? kasan_quarantine_put+0xbb/0x1f0 [ 96.667542][ T5864] ? tomoyo_path_number_perm+0x219/0x5f0 [ 96.667576][ T5864] ? tomoyo_path_number_perm+0x219/0x5f0 [ 96.667612][ T5864] ? do_vfs_ioctl+0x11a7/0x1570 [ 96.667650][ T5864] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 96.667688][ T5864] ? lapic_next_event+0x11/0x20 [ 96.667713][ T5864] ? clockevents_program_event+0x491/0x630 [ 96.667757][ T5864] ? do_futex+0x3e7/0x4e0 [ 96.667818][ T5864] ? __fget_files+0x2a/0x420 [ 96.667850][ T5864] ? __fget_files+0x2a/0x420 [ 96.667879][ T5864] ? __fget_files+0x2a/0x420 [ 96.667911][ T5864] ? bpf_lsm_file_ioctl+0x9/0x20 [ 96.667942][ T5864] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 96.667972][ T5864] __se_sys_ioctl+0xfc/0x170 [ 96.668009][ T5864] do_syscall_64+0x16a/0x530 [ 96.668041][ T5864] ? trace_irq_disable+0x3b/0x140 [ 96.668070][ T5864] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.668092][ T5864] ? clear_bhb_loop+0x70/0xc0 [ 96.668121][ T5864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.668144][ T5864] RIP: 0033:0x7fa1ee7a8f19 [ 96.668164][ T5864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.668183][ T5864] RSP: 002b:00007fa1ef6d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 96.668207][ T5864] RAX: ffffffffffffffda RBX: 00007fa1eea25fa0 RCX: 00007fa1ee7a8f19 [ 96.668224][ T5864] RDX: 0000200000002640 RSI: 00000000000007a0 RDI: 0000000000000004 [ 96.668239][ T5864] RBP: 00007fa1ee837f6d R08: 0000000000000000 R09: 0000000000000000 [ 96.668254][ T5864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.668267][ T5864] R13: 00007fa1eea26038 R14: 00007fa1eea25fa0 R15: 00007fff0fe39348 [ 96.668303][ T5864] [ 97.553383][ T5881] input: syz0 as /devices/virtual/input/input5 [ 97.558523][ T5881] FAULT_INJECTION: forcing a failure. [ 97.558523][ T5881] name failslab, interval 1, probability 0, space 0, times 0 [ 97.558557][ T5881] CPU: 1 UID: 0 PID: 5881 Comm: syz.3.30 Not tainted syzkaller #0 PREEMPT(full) [ 97.558583][ T5881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 97.558597][ T5881] Call Trace: [ 97.558606][ T5881] [ 97.558615][ T5881] dump_stack_lvl+0xe8/0x150 [ 97.558654][ T5881] should_fail_ex+0x3eb/0x540 [ 97.558684][ T5881] should_failslab+0xa8/0x100 [ 97.558721][ T5881] ? __kernfs_new_node+0xe6/0x980 [ 97.558746][ T5881] kmem_cache_alloc_noprof+0x9c/0x600 [ 97.558776][ T5881] ? __kernfs_new_node+0xe6/0x980 [ 97.558807][ T5881] __kernfs_new_node+0xe6/0x980 [ 97.558840][ T5881] ? __pfx___kernfs_new_node+0x10/0x10 [ 97.558865][ T5881] ? kernfs_root+0x1c/0x230 [ 97.558894][ T5881] ? kernfs_root+0x1c/0x230 [ 97.558915][ T5881] ? kernfs_root+0x1c/0x230 [ 97.558934][ T5881] ? kernfs_root+0x1c/0x230 [ 97.558961][ T5881] kernfs_new_node+0xea/0x140 [ 97.558990][ T5881] __kernfs_create_file+0x4b/0x2e0 [ 97.559023][ T5881] sysfs_add_file_mode_ns+0x237/0x300 [ 97.559084][ T5881] sysfs_merge_group+0x183/0x320 [ 97.559110][ T5881] ? __pfx_sysfs_merge_group+0x10/0x10 [ 97.559130][ T5881] ? device_add_attrs+0x5c5/0x600 [ 97.559158][ T5881] ? __pfx_device_add_attrs+0x10/0x10 [ 97.559187][ T5881] dpm_sysfs_add+0xd2/0x270 [ 97.559219][ T5881] device_add+0x4ca/0xb80 [ 97.559245][ T5881] cdev_device_add+0x1c6/0x380 [ 97.559272][ T5881] evdev_connect+0x354/0x400 [ 97.559303][ T5881] input_register_device+0xd6d/0x11b0 [ 97.559337][ T5881] uinput_create_device+0x53e/0x690 [ 97.559377][ T5881] uinput_ioctl_handler+0x433/0x15a0 [ 97.559413][ T5881] ? __pfx_uinput_ioctl_handler+0x10/0x10 [ 97.559460][ T5881] ? __fget_files+0x2a/0x420 [ 97.559495][ T5881] ? bpf_lsm_file_ioctl+0x9/0x20 [ 97.559526][ T5881] ? __pfx_uinput_ioctl+0x10/0x10 [ 97.559556][ T5881] __se_sys_ioctl+0xfc/0x170 [ 97.559593][ T5881] do_syscall_64+0x16a/0x530 [ 97.559624][ T5881] ? trace_irq_disable+0x3b/0x140 [ 97.559652][ T5881] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.559676][ T5881] ? clear_bhb_loop+0x70/0xc0 [ 97.559704][ T5881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.559726][ T5881] RIP: 0033:0x7f52fa5a8f19 [ 97.559746][ T5881] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.559764][ T5881] RSP: 002b:00007f52fb47d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 97.559788][ T5881] RAX: ffffffffffffffda RBX: 00007f52fa825fa0 RCX: 00007f52fa5a8f19 [ 97.559805][ T5881] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000006 [ 97.559818][ T5881] RBP: 00007f52fa637f6d R08: 0000000000000000 R09: 0000000000000000 [ 97.559831][ T5881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.559844][ T5881] R13: 00007f52fa826038 R14: 00007f52fa825fa0 R15: 00007ffe3c5c87c8 [ 97.559880][ T5881] [ 97.745011][ T1231] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 97.750835][ T5744] rxe_eth0 speed is unknown, defaulting to 1000 [ 98.124685][ T1231] usb 1-1: Using ep0 maxpacket: 8 [ 98.125411][ T1231] usb 1-1: New USB device found: idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 98.136782][ T1231] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.136807][ T1231] usb 1-1: Product: syz [ 98.136822][ T1231] usb 1-1: Manufacturer: syz [ 98.136837][ T1231] usb 1-1: SerialNumber: syz [ 98.147553][ T5881] input: failed to attach handler evdev to device input5, error: -12 [ 98.290267][ T1231] usb 1-1: config 0 descriptor?? [ 98.577741][ T1231] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 98.801859][ T5374] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 98.951394][ T5374] usb 3-1: Using ep0 maxpacket: 8 [ 98.952267][ T5374] usb 3-1: New USB device found: idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 98.953627][ T5374] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 98.953650][ T5374] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 98.956266][ T5374] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.956292][ T5374] usb 3-1: Product: syz [ 98.956307][ T5374] usb 3-1: Manufacturer: syz [ 98.956322][ T5374] usb 3-1: SerialNumber: syz [ 99.055138][ T5374] usb 3-1: config 0 descriptor?? [ 99.300274][ T1231] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 99.924420][ T5915] FAULT_INJECTION: forcing a failure. [ 99.924420][ T5915] name failslab, interval 1, probability 0, space 0, times 0 [ 99.924455][ T5915] CPU: 1 UID: 0 PID: 5915 Comm: syz.1.37 Not tainted syzkaller #0 PREEMPT(full) [ 99.924480][ T5915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 99.924494][ T5915] Call Trace: [ 99.924503][ T5915] [ 99.924513][ T5915] dump_stack_lvl+0xe8/0x150 [ 99.924553][ T5915] should_fail_ex+0x3eb/0x540 [ 99.924584][ T5915] should_failslab+0xa8/0x100 [ 99.924621][ T5915] __kmalloc_noprof+0xf9/0x710 [ 99.924650][ T5915] ? netlink_realloc_groups+0xf4/0x310 [ 99.924673][ T5915] ? netlink_realloc_groups+0xf4/0x310 [ 99.924706][ T5915] netlink_realloc_groups+0xf4/0x310 [ 99.924737][ T5915] netlink_setsockopt+0x367/0x710 [ 99.924760][ T5915] ? __pfx_aa_sk_perm+0x10/0x10 [ 99.924797][ T5915] ? __pfx_netlink_setsockopt+0x10/0x10 [ 99.924827][ T5915] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 99.924856][ T5915] ? __pfx_netlink_setsockopt+0x10/0x10 [ 99.924882][ T5915] do_sock_setsockopt+0x17c/0x1b0 [ 99.924914][ T5915] __x64_sys_setsockopt+0x13d/0x1b0 [ 99.924947][ T5915] do_syscall_64+0x16a/0x530 [ 99.924979][ T5915] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.925008][ T5915] ? clear_bhb_loop+0x70/0xc0 [ 99.925036][ T5915] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.925059][ T5915] RIP: 0033:0x7fa1ee7a8f19 [ 99.925080][ T5915] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.925099][ T5915] RSP: 002b:00007fa1ef6d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 99.925124][ T5915] RAX: ffffffffffffffda RBX: 00007fa1eea25fa0 RCX: 00007fa1ee7a8f19 [ 99.925141][ T5915] RDX: 0000000000000001 RSI: 000000000000010e RDI: 0000000000000003 [ 99.925155][ T5915] RBP: 00007fa1ee837f6d R08: 0000000000000004 R09: 0000000000000000 [ 99.925169][ T5915] R10: 000020000001a580 R11: 0000000000000246 R12: 0000000000000000 [ 99.925183][ T5915] R13: 00007fa1eea26038 R14: 00007fa1eea25fa0 R15: 00007fff0fe39348 [ 99.925219][ T5915] [ 100.447287][ T1231] usb 1-1: USB disconnect, device number 3 [ 105.911068][ C1] sched: DL replenish lagged too much [ 135.417234][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 135.425558][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.624375][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.632247][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 235.608573][ T32] usb 3-1: USB disconnect, device number 3 [ 256.065680][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.073551][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 266.786481][ T35] INFO: task kworker/1:2:1231 blocked for more than 145 seconds. [ 266.786515][ T35] Not tainted syzkaller #0 [ 266.786527][ T35] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 266.786537][ T35] task:kworker/1:2 state:D stack:22368 pid:1231 tgid:1231 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 266.786605][ T35] Workqueue: events_power_efficient crda_timeout_work [ 266.786645][ T35] Call Trace: [ 266.786653][ T35] [ 266.786668][ T35] __schedule+0x18a6/0x5c10 [ 266.786731][ T35] ? __pfx___schedule+0x10/0x10 [ 266.786771][ T35] ? schedule+0x90/0x2b0 [ 266.786803][ T35] schedule+0x164/0x2b0 [ 266.786835][ T35] schedule_preempt_disabled+0x13/0x30 [ 266.786864][ T35] __mutex_lock+0x7c4/0x15a0 [ 266.786901][ T35] ? __mutex_lock+0x5cd/0x15a0 [ 266.786938][ T35] ? crda_timeout_work+0x1f/0x90 [ 266.786965][ T35] ? __pfx___mutex_lock+0x10/0x10 [ 266.787014][ T35] ? rcu_is_watching+0x16/0xb0 [ 266.787046][ T35] ? process_scheduled_works+0x97a/0x1630 [ 266.787078][ T35] crda_timeout_work+0x1f/0x90 [ 266.787102][ T35] process_scheduled_works+0xc3d/0x1630 [ 266.787166][ T35] ? __pfx_process_scheduled_works+0x10/0x10 [ 266.787205][ T35] ? assign_work+0x3cf/0x5d0 [ 266.787241][ T35] worker_thread+0xa47/0xfb0 [ 266.787288][ T35] ? __kthread_parkme+0x71/0x1f0 [ 266.787343][ T35] kthread+0x38b/0x480 [ 266.787367][ T35] ? __pfx_worker_thread+0x10/0x10 [ 266.787396][ T35] ? __pfx_kthread+0x10/0x10 [ 266.787421][ T35] ret_from_fork+0x514/0xb70 [ 266.787447][ T35] ? __pfx_ret_from_fork+0x10/0x10 [ 266.787471][ T35] ? __switch_to+0xc78/0x1410 [ 266.787507][ T35] ? __pfx_kthread+0x10/0x10 [ 266.787531][ T35] ret_from_fork_asm+0x1a/0x30 [ 266.787585][ T35] [ 266.787685][ T35] INFO: task kworker/1:5:5744 blocked for more than 145 seconds. [ 266.787701][ T35] Not tainted syzkaller #0 [ 266.787712][ T35] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 266.787722][ T35] task:kworker/1:5 state:D stack:23752 pid:5744 tgid:5744 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 266.787786][ T35] Workqueue: events reg_todo [ 266.787809][ T35] Call Trace: [ 266.787816][ T35] [ 266.787830][ T35] __schedule+0x18a6/0x5c10 [ 266.787888][ T35] ? __pfx___schedule+0x10/0x10 [ 266.787928][ T35] ? schedule+0x90/0x2b0 [ 266.787960][ T35] schedule+0x164/0x2b0 [ 266.787992][ T35] schedule_preempt_disabled+0x13/0x30 [ 266.788020][ T35] __mutex_lock+0x7c4/0x15a0 [ 266.788056][ T35] ? __mutex_lock+0x5cd/0x15a0 [ 266.788093][ T35] ? reg_process_self_managed_hints+0xae/0x170 [ 266.788121][ T35] ? __pfx___mutex_lock+0x10/0x10 [ 266.788163][ T35] ? preempt_schedule_common+0x7f/0xd0 [ 266.788202][ T35] reg_process_self_managed_hints+0xae/0x170 [ 266.788228][ T35] reg_todo+0xe6e/0xff0 [ 266.788255][ T35] ? lock_acquire+0x115/0x350 [ 266.788285][ T35] ? __pfx_reg_todo+0x10/0x10 [ 266.788319][ T35] ? rcu_is_watching+0x16/0xb0 [ 266.788352][ T35] ? process_scheduled_works+0x97a/0x1630 [ 266.788384][ T35] process_scheduled_works+0xc3d/0x1630 [ 266.788448][ T35] ? __pfx_process_scheduled_works+0x10/0x10 [ 266.788487][ T35] ? assign_work+0x3cf/0x5d0 [ 266.788524][ T35] worker_thread+0xa47/0xfb0 [ 266.788585][ T35] kthread+0x38b/0x480 [ 266.788608][ T35] ? __pfx_worker_thread+0x10/0x10 [ 266.788638][ T35] ? __pfx_kthread+0x10/0x10 [ 266.788663][ T35] ret_from_fork+0x514/0xb70 [ 266.788689][ T35] ? __pfx_ret_from_fork+0x10/0x10 [ 266.788711][ T35] ? __switch_to+0xc78/0x1410 [ 266.788747][ T35] ? __pfx_kthread+0x10/0x10 [ 266.788772][ T35] ret_from_fork_asm+0x1a/0x30 [ 266.788824][ T35] [ 266.788850][ T35] [ 266.788850][ T35] Showing all locks held in the system: [ 266.788865][ T35] locks held by kthreadd/2: 2, on CPU#1: [ 266.788880][ T35] #0: ffffffff904b3910 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 266.788943][ T35] #1: ffffffff9035aa20 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 266.789001][ T35] locks held by kworker/R-kvfre/6: 1, last CPU#1: [ 266.789017][ T35] #0: ffffffff901f6520 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 266.789081][ T35] locks held by kworker/0:1/11: 6, on CPU#0: [ 266.789097][ T35] #0: ffff88807eb9b950 ((wq_completion)wg-kex-wg1#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.789163][ T35] #1: ffffc90000107c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.789243][ T35] #2: ffff888076e11480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x14e/0x9f0 [ 266.789313][ T35] #3: ffff88807c7ec888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x15f/0x9f0 [ 266.789377][ T35] #4: ffffffff9035aa20 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 [ 266.789432][ T35] #5: ffffffff9035aa20 (rcu_read_lock){....}-{1:3}, at: ip6_input+0x23/0x270 [ 266.789487][ T35] locks held by kworker/u8:0/13: 3, on CPU#1: [ 266.789502][ T35] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.789564][ T35] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.789625][ T35] #2: ffff88805ad90800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 266.789689][ T35] locks held by kworker/u8:1/14: 3, on CPU#1: [ 266.789704][ T35] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.789766][ T35] #1: ffffc90000137c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.789828][ T35] #2: ffff88805adc0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 266.789892][ T35] locks held by kworker/R-mm_pe/15: 1, last CPU#0: [ 266.789907][ T35] #0: ffffffff901f6520 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 266.789973][ T35] locks held by kworker/1:0/27: 4, on CPU#1: [ 266.789989][ T35] #0: ffff88805c5c0150 ((wq_completion)wg-kex-wg2#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.790056][ T35] #1: ffffc90000a1fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.790152][ T35] #2: ffff888076e15480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x14e/0x9f0 [ 266.790215][ T35] #3: ffff888078ff8d18 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x15f/0x9f0 [ 266.790279][ T35] locks held by kworker/1:1/32: 4, on CPU#1: [ 266.790302][ T35] #0: ffff888023a91150 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.790363][ T35] #1: ffffc90000a77c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.790425][ T35] #2: ffff88802b6001d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 266.790484][ T35] #3: ffffffff904b3910 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 266.790543][ T35] locks held by khungtaskd/35: 1, on CPU#1: [ 266.790558][ T35] #0: ffffffff9035aa20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 266.790617][ T35] locks held by kworker/u8:2/46: 3, on CPU#1: [ 266.790632][ T35] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.790693][ T35] #1: ffffc90000b67c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 266.790755][ T35] #2: ffff88805a6b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 266.790836][ T35] locks held by kworker/u8:3/53: 4, on CPU#1: [ 266.790851][ T35] #0: ffff88807c890150 ((wq_completion)wg-kex-wg0#3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630