last executing test programs: 5m50.788505338s ago: executing program 1 (id=2145): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x1, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x4001, 0x3, 0x438, 0x0, 0x700001b, 0x148, 0x0, 0x148, 0x3a0, 0x206, 0x240, 0x3a0, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x1ea, 0x2c8, 0x2f0, 0x0, {0x390, 0x8f00}, [@inet=@rpfilter={{0x28}, {0x3}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00', {0x1000}}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x5, 0xff, {0x9184}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x498) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r4, 0x2, &(0x7f0000000100)={0x2}, 0x0) landlock_restrict_self(r4, 0x4) landlock_restrict_self(r4, 0x0) r5 = landlock_create_ruleset(&(0x7f0000000040)={0x4907, 0x2, 0x2}, 0x18, 0x0) landlock_restrict_self(r5, 0x0) connect$inet6(r3, &(0x7f0000000540)={0xa, 0x0, 0x0, @local}, 0x1c) mknod(&(0x7f0000000000)='./file0\x00', 0x100, 0x78) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$MEMGETREGIONINFO(r2, 0xc0104d08, &(0x7f0000000140)={0x7, 0xfff, 0x4, 0x8}) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r8, 0x4008ae90, &(0x7f0000000240)={0xfe, 0x0, [{0x7, 0xfffffffe, 0x444d4163, 0x9, 0x2, 0x6}, {0x40000000, 0x8001, 0x1, 0x3, 0x1000, 0x0, 0xd}]}) syz_clone3(&(0x7f0000000080)={0x180801600, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0xc}, 0x0, 0x0, 0x0, 0x0}, 0x58) waitid$P_PIDFD(0x3, r9, 0x0, 0x40000004, 0x0) 5m50.369253278s ago: executing program 1 (id=2146): r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000fd3f00000000000009000000850000002a000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0xe, 0x0, &(0x7f0000000480)="0000000000000000caee8fedca77", 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x40, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc1105518, &(0x7f0000000480)={{0x4, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x5, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x80000, 0xf, 0xfffffffffffffffb, 0x592a, 0x9, 0x0, 0xfffffffe, 0x4, 0x7, 0x1, 0x7, 0x803, 0x100000001, 0xfffffffffffffffe, 0x40, 0x0, 0x4, 0x6, 0x8, 0x1f, 0x3, 0x0, 0x1, 0x0, 0x9, 0x4, 0x7, 0x0, 0x1, 0x20000000, 0x0, 0x4000000000000002, 0x0, 0x2, 0x80000000000000, 0x0, 0xfffffffffffffffd, 0xfffffffd, 0x0, 0x0, 0x9, 0x4000, 0x3, 0x0, 0x0, 0x4, 0x80000000000000, 0x0, 0x4, 0x0, 0x0, 0x40, 0xfffffffffffffffc, 0x0, 0x0, 0x49, 0xfffffffffffffffa, 0x0, 0x401, 0x0, 0x8000000000000002, 0x0, 0x0, 0x0, 0x400000000000, 0x3, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x3, 0x7ff, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x2000000000000, 0xfffffffffffffffc, 0x1, 0xfffffffc, 0x1, 0x3, 0x3, 0x20000000, 0x10001, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x4000004, 0x2, 0xb5, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xde4, 0x7, 0x0, 0xfffffffe]}) 5m50.272164926s ago: executing program 1 (id=2147): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000001680)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001640)={&(0x7f00000013c0)={0xa8, 0xa, 0x6, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8}, [@IPSET_ATTR_ADT={0x94, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x6}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x4}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0x5, 0x1a, '\x00'}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_BYTES={0xc, 0x18, 0x1, 0x0, 0x100}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e24}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PROTO={0x5, 0x7, 0x8}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x39d6}}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x800}, 0x40011) sendmsg$inet(r0, &(0x7f0000001480)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010101}, 0x10, &(0x7f0000001340)=[{&(0x7f0000000100)="917bb2190907cdac16e27958ed4ed265f1145d60a57d38f17fb89564b56c49b1e3e689a3f53321806453738cede2ccb084117299eb05885d5956332209e21ef4e3f4995d0b966832f4d503f2c27ce89e293d4e0990fde81c1ba614cb95cfc877ddb58df662f33ff7e1a8bced2b81aaa0502e2bf4559db6d78bdcc361056a76d588e911701747b2ac150484d39f79b7ca1b3d82db129f514df8f6c267bd5787065ff3fecd3e253fdf540fe3f9513f7d2956a204653b32f29d1fbabfba2c3c36d443470b9d", 0xc4}, {&(0x7f0000000200)="336fbe64fb4a0c91163259bd495bf9786294f29628e7183720fe613804f82aff4d87afffce2ad4e2f507fb2b271cc9b1d0aafcb9b9c4a912ad57ae4535265ffdd39173c6209385e2094b6eacc84d6f207400a7bb83fc16d58a08e75334efc1829265447312b51b503c223733347fb94b24c83f04811808b84f0a965f20546045eaffff2dc6955f923b343e023464f67548d615a6b5eb8d22716784d31fda342a5f3b97ab721e29bddb065896726c9d1545c95439ddfea8af4285a240361fc2e2b40c93ee51b111ef4bc23fbb0bf1d1feb4103881f9c64bc8860d155b9803896882003664b23d97e597c0f3a688c9c04d8afb3db423412cfe232d3216d0526f8cf3c34cb6ec6c07950b1cc3231ba45389482e526016332fc4e34e33e55a98954128a5b0e14b9dd4f564bf97022f2581c71654ad0eeec2423e3e66f2bbea037dfe423f2fa0febfa0be83e487be6a192637076d241f7294519be0f63c5caa5ac7bdf8d21c459d1aebd014063b531bfb53a4ff8822164d89951042ec615e9cde1b184d1d5724e760aaf3eba35c21f92303ecb197bfe97e08e92424b6e7570c3b32a38c2a4f6e9404bdf21385c5e4789d1225a917d0fb61df68daa1c190fc8ba68d1d7a983de126bfca583454f83b2b3ba81f3b0a40b5f834cf05d23f5c9dc7a15a03f28a132b4376aee9f1c35b1fec96eba683291402fa82060fc24d4ee9087b09b82f32b82adfa4ebcc4f5159276b6d084618cf86aebc56e2dd1ef52e343a6257ff9e4cb225ff8feaf9df21d10ff8f9e9e2391f67179ea224db5458be65405565611b2638a65f2e3f6c94e16a58f61cf61a1efdfee9cc3bf57501cbef24e4940a59a7c6d2206a7e2668ce39b486b8a4d22a52ea69442cb6510bcf753e3f4b45fba02cae88f141226b8a173e17887b668febc249d710e99072584b9ae891475821d77d255edf7d03eaf3709363afa47c5ca7a334e6d36aabda48fbfbd8fad43a1fa58bed8be2b17d30a4fdd9f4c47b45f1b2e5b99dbffa2f781a63cab318908c81921f3b38064b57c60a3a11429002be17a2da0831c916d1981f5176967bf920c04ae11bd587202440e1161be3c056a6914e81836b952988532e51f29190462e4fbc53abbed85fcd462e9f5eb139250c600c0fd7ceaceb4b587007f57d691382616be270841a553587bc9c48ff462e00a2ef5c58da5be78c2d639ac7f73baa65a8e9de6ab3eb55d4d00091c5ee0ac9371e5288f926e8539a430ab6021f0e1e4de5fbcf02cbb4e201abb6cb67776e65cd0d12f5d9bd76b38460a9f10af9028cf865d22bf1ead6cf8a4ef63cd25852ab6d902944a245d074ce9fcae9acef0d096c39547ac07983ed567cee4f364ff3f627de1f2eae04d86c468d72915e3791a3975d3fcf3dde841fa42364bdbfecac3c94783229de25b60f347ceac121684ecb3561a3cd2976c5ced4c4aca4165a0e180b466962b217366688ffe2a3a6186e66e3c30be7be659255f3e18882492dbdccef4e8bc79361b60c2ed3196efbfb78db7f0f53962302112299344a34621469fffe28e594f7737e9c5c444a09ea3108c238b8d1221483baffd2587cb5f3ee63a9b3acc0b96518704238b1eff6bff9296c2137bc9e3b1e26773d93232b88111707072f1f1a361a695706dd000f89ccb7c3cb2e28382d801da5f3f1f58a5c62f01e831384cf2adab711c5ff50c12cf73de7b5c737ef16c2af4f9a366d049d32a7b2dc968c3fe304a6393e624b638d769a39f1c80bceb79f45fbd7d1a5b0a9e7b2f833821f89a74dc81592fc6efea55133055e6bf65787bea2baf927ec7d24d10dcb28dd05d7b3fde171a81cbfa77c102f4838b1d257ed95c8b3972dfcbb976b93b45895a9c4857e5fc2cd0e44533562bd494d816dc7ff9aad0ed3390d2ab08cfe37f222e95bc7ec18e3bbb985c0cade0d8abf490900697f93a2dd3e5b65ecab87ae53863a558eaaac435300aa6e46833591f870ff6c773d773e8867514da7f91f35cd2d47946ce70a71cfae9a18a8f125996973128f9e506f9fdec27a480ed0fbb866bb8a81138967a9d2578bbc82970d56c76cf1ef8315308be2c59116b036c17505084f3016ff154a93a5ed6f23ac50f497d7658e0b98e6a7e5f52db2dafcdc684603bde58b2d53c95b80c2afaaab74ab5e05ae10737d1d526488394157f8fca19587af989c58327059c411986d32db79057c57c55037ea38ed966bf5f67006572757e0805cc6010f4109be5bf3290e2a119765e6a2099d04e532cb033fe29e51c17fab4cecb6aae18abdfa2f93ff58349895f013d28dbbeca7675d9c1bd9f719d129acbc17a0e61ca1bfe1017d5b126b725e6ef9ba20ffa024dc83f49c044f24e0843793ce2e49a611a2d54d4920d59f4521c46a967e09a4a61ae2fd2d12f123c24e080a031cedcce428cc647a1792337137de9f05ce893a014f0c7faae640c10288255607f357693cd1bc5010d9a3e2acc2a78a4e3d7753ddb6d075813bb35824b6f29ca875efed85e505b77f92c0a8966f3ceb65a8d347ba500b1e129acaf7bee2d5d8eb2a8fe252b54a653994dfb269cc77c65b4ca7cda7c6c8aeca14e4b70f91bb3bcaf770299a39f9f96c91aaf81f33269720a1c1d8e0e6ba6743a62142ad31200c346b1f2f005430715573e7fcbdb8d7330a8f71a409773b1f00a0cb80119d6da411b3fe6308660fdaac4a222fcba3819a51e0547d499e7b796c110f6a011c23f3771ae3ccae682fb8565a4d9da64d4b362e7b3c1cdf1fcc86d94757c7c22f7d8b57ae61c45d2bdaaddb3a9cb16dcb4f718996bfca0a3f8eb81002c6e6baab8d6c49b111dd3aacbe5303df78393102f59d937f32e0d08d1f644a2f0f7110f356137259ae460178cf7967a6d51dcb374691ed1814cdafff2e13877a4a266321f15075cc51a59e460c8db620f19264b0d158ed1cb571a8e3cbfa9cfb09e4bbb8fc8ec671963a729436ec5b1b097c8f751fc6d3b09f551fc8ebd4f548f9f0fcdd18b1c5736b1d59a3956513b7517f475b42948a52bd84b83a95876951147c846d51748b3dffca681a0fa952db19d0fc6863bedbfbececf9735c064bb3a14a87ab24dd6052ef958708f96ea27b3c20016703c6fd151ec9ff7a6c6e9af5ac0e1c519a38edd85dc7dada4e5f86317bf05db3434f19129b092cbbc8f586d2536ddb1988671270b3608aec410c14226d394428a5488d485236b9bea15b57520358bd6996c3cbdd264382a6db68841fcf5492d45eec927bfd5460e375fc8b58ca976cd34149aedae4f9f67c64a82b1aadbb5e41c0f61ffe0753f4aac5b774f6e1f31a8a06d94c4586f2436434dcd440ddb5a762434bcb3dc474f1430ab7270f732e328211c83bc29d243b247f6b66b6f0906039c97d5998ba266e64c1a800deaf10621c332ebe1934103903a0cf1c49047e49fb33acc0330aa79131c9dabd37932961b8a32db54c248625f36dc897f5acc17dad42457f222bcf7b41703c14c4bdea52227337311c451f1d30ecc1e182f269c7f485a5c75e7c673e16fa4e0051b28d8eca5754031775a46f3c957540a9021e115cb4d94766edfdfe0565ae1d238c6f55681c1c627015019fe876f8b5a4efa9a609a0c43f08fa05624e2cb4afdce791840f60b59bf4405a803b90513628093763bb45cbe06da5ee39853574aaf1006767ecae0aa831dc41ffb3fec896ec3013f60f279a597e25568062c87f0ce4b2eea9fd75b5a57a84c5ecc0bc715dfd2c3f657813fee050904d23693707e5b0dd54b151893e4aab3d596c7af277c8f17013c03375214a748addf305fe3dca252dbf374689f91d576d7d3cc71e24f6c7b3229e817f76de54a2434f10c7631191e6a89e965f08b8ea40847211a783f46644054694b6fe8aefa1fe59b3b85513f6fe76d6186810e2c729e5814ebf4c2a1921aff5f188334fef036f18cc42e129e1f38aca363a152c36fb7405f874082a5a448ed6582e19328039147b0c5711ed61b30cfb40418d9c9cd0d5e0b1aeb3e62bcd4544c75f79c737fd6d16493017248a95e551eb22573b93ce2fdb7a914996182a45900c343b53fa679600a10e551b9a44ed7c8cd3f3787fc2a7fd5bca4d9fdb3844c207ea0831a2cfe4a862bc47ca27949813a6c1c1d9c54986c987116321936c3c967247a93d51fe32033232676ea9e58a9dc60dc166d166ce4228e1d27da8dad5227a925537e1cc5fc0467f46336af5e6a5af4abb397b78dd67cf7c2e19022247e16814b8a07311aee934baa761a476a7227ac27417bfffda01fa82d49e187448720ac42944ed6eba164b297d84be428367991f3e80747628628595dad7d5a370370d7bb937570677b6753588cce84596b04a905f3677a0574567cd3993e0cb7a0080e508eb19030febda00ae0498b85b109c1b63903ddb6da9acbe70c027a9a74105c56abe2890cd354028af6c228780adac2997ac68fb067e7699c3fa0b44eaf71c5112fc728524f62a0f7a2a876dbc5422bc86fc72fd502039b4f26fd45ff7545971a22e7eb4820cfffbbc5421fbd328447defda1993fee602fbc8539fbcdb9ac56166408c28e6300aa7edb62f9683d3973037cfbba6b81f7cb8dc4360aa5b5eb8ae2a0bc9c99c479fd661dff756d4986ba65e63decd7e29dcac8298d1b736da989b0de9a29cf2e0ff374df9ccd8ac8efc04e280b16aaa8235701f4537e1e104e610fd9222b8c6392ae8a66cbe7d4206961533a478dc78895df929ef11ee8b2b67481b4ed776f90afdbde1309256a1926991c7cf14fe855dab262ac82648ae4d99d06b5394acf33aeb8de752b3b173dd7c1af1a0ba9d96c5a948530ab1b15ed9dbc65b18e57d7712d6888625ad183f2b38aaedafcc4865d6a5ddf6a5f7ccb184b49c84bdfadf13995150d97d05b9b1e377b1ac35fdae8ffd9e4892d47f668bdf5d80d0ea41af939ff4571762988c39686db9d9e602342541fa5846c9ef74598bbda062d99ea04f1bdbc48304d7f9bd01207987f0555093245803f8f44b33ed47e014e4b06211d1b15b431b2c7d5c55fde85902de4f70de1bc1d2b4f5d3a2fa2720513bc34c112af1017ba4893a1d86914ea249790b002095b55902a88e055faa1b4fb5a7b626c6ac43045bce65b81005eddc5fda4eb277f48dd15cf9a5dac9ac5792d5b53ecf15d18728aae80ba9af476cd750e0c9bd0f78cfc664bcf624e88058365249a632540bfa32153b4f4761a86a3bfcd3b83cc2dfe00f1b67f02819c010419507b3db333fd654e18f5e53dc4ea0172cc2986889bf57c2100026adfbb6a8e16fd5c6cae4cf264db4b55bff143808f52c39e5482e0a38b75122a6828455b980b54c6b272a4f517582cd36acc97c48449dd4d7eec088d0ce345863cf4d1773c2a805a4d85c922015581aef1f5c31c4d0eefd4460f7d3ac2396bae959f71b5e4f9a8e0736a0e9c2af89e48c577592575720f66a0530a7a9debe0433967c3e3f79ad1242a747c06c1738f9ff629eca5079b39475344fa259c69d2d859b93a9a1fbc501764192772bdaca29d25169c5b13913871fe8524a42a66de2c9ecad96586969739890f73a607632223a382b7f958cdaca261fbcb10524212629da72c9f1858ad349b247c09dc13faebd92bb8252d811aa063939de66011d07d70ca0751f0b6bc16f8ca2754d3f15c4b1998a77d199812a735c8f8d1879586566bad9f0fe640d12b75d5a0592bfddff3be6adbc00a72f8294d1fdd02c481a7a9ae8317e18cc0197b4eb8811d8a94b3a1114b2c4c820", 0xff0}, {&(0x7f0000001200)="d800eb2bc3862f4722c165d437359cc22c789b4109797959e5e33232b931bf96b9210b6b2de296fdf1979db8c6690362d6cca0c3650b842decaa7fdf342a15a546e5aae674f21a89db987b03a3da1571555c544ae0cf9ecbcc788a16ecfd5f984ad953c6e630a800507efc38a1e37574b925ac94631fc1289ae246cf4b3491f1ecccffb660f287df3ae060a5505fd986c1a6d491f9bbe489", 0x98}, {&(0x7f00000012c0)="7f04713bb2fb0be99a19e2ad24e3285cc7688ac02db4a7adc862432cfa37c64e7a3c3b15ae26ce2854a7befe95aee25ec811d3240ed779cd7637d196458f9aff3daadfd3e9a971e70dcb5aa538f6be6f9803fb488f6745d795b407afdecea178dce238a37ce62db1cb787ae58a84a1c3ed7cca10c4d7af2623612b76cf8e", 0x7e}], 0x4, &(0x7f00000014c0)=ANY=[@ANYBLOB="1475c2d8850000000000000001000000fffffeff00000000110000000000000000000000010000000a00000000000000c000000000000000000000000700000008000021c600000100940401008923feac1414bb7f000001e00000010a01010164010102e0000001e0000002e000000194108d782272e3815c6a52d51a1838d14410e950000000010000553b000007ff8307dce0000005000000010001009153c8b6ce807883276700000000640101010a010100ac1414aaac141423ac1414bb64010101ac1414aaffffffff8317ff7f000001ffffffffac1414bbac14142fac1414aa01002b58068142b0b9449f9ff30177a345d0030bfee0467689445555ac75fe35e6cb2f0039f50fc3ae80287d4d1e41d973918913f67a2186d45db1141be955d6194784e0e916fce95c3cf7d0518a0bce454468eb9886fbabeb769ab86e17540000000000000000000000dd4987472ffcd0275be9fba31af711202d33971df304"], 0xf0}, 0x800) (async) sendmsg$NFT_BATCH(r0, 0x0, 0x4040850) (async, rerun: 64) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) (rerun: 64) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x100) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000000080)={{0x2, 0xcaa94196ebb29860, 0x0, 0x401, 'syz0\x00', 0xfffff001}, 0x0, [0x1000, 0x5d8, 0x1d, 0x2, 0x2, 0x554, 0x5, 0xf553, 0x4, 0xe4f, 0x100f27d, 0xfffffffffffffffb, 0x26, 0x6, 0xd43, 0x6, 0xff, 0x4, 0xffffffffffffffff, 0xf87, 0x8001, 0x83, 0xe0, 0x8, 0x7, 0x8, 0x9, 0x4, 0xd0, 0xad0, 0x80, 0x5, 0x101, 0x0, 0x4, 0x2, 0x3, 0x2, 0x110, 0x4, 0x3, 0x5, 0x7fff, 0x2, 0x2, 0x7, 0xfffffffffffff30a, 0x0, 0x8, 0x1, 0x1, 0x4, 0x7, 0x0, 0x4c9, 0x9000000000, 0x3, 0x0, 0x6, 0x8001, 0x0, 0x9, 0x9, 0x5, 0x1, 0xffffffff, 0x81, 0x80000001, 0x3, 0xc39, 0x10001, 0xc, 0x2, 0xc4bb, 0x5, 0xe000000, 0x8, 0x0, 0x3, 0x7ff, 0x8, 0x6, 0x7f, 0x3, 0x80, 0x7, 0x200, 0x5c6, 0x10001, 0xba2, 0x0, 0x2, 0x5, 0xffffffffffffa0e5, 0x8000000000000001, 0x5, 0x1e1, 0x6, 0x6, 0x0, 0x4, 0xffffffffffffffff, 0x1, 0x0, 0x1, 0x4, 0x9, 0x40, 0x8, 0x80, 0x1, 0xffffffffffffffff, 0x6, 0x0, 0x1be, 0x26, 0x3, 0x9, 0x80000000f, 0x9, 0x8, 0xf6, 0x200, 0x7, 0x7fffffffffffffff, 0xf5d, 0x3, 0x9]}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000500)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=ANY=[@ANYBLOB="200134000013eeaa1a"], 0x0}) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000002bc0)={0x0, 0x0, &(0x7f0000002b80)={&(0x7f0000002700)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000060a010200000000000000000a0000030940010073797a310000000008000b4000000001140000001100010000000000000000000a00000a"], 0x50}, 0x1, 0x0, 0x0, 0x4000040}, 0x200408d0) 5m49.385743473s ago: executing program 1 (id=2154): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x22) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r2, &(0x7f0000004200)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='net/route\x00') read$FUSE(r3, &(0x7f00000019c0)={0x2020}, 0x2020) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x94) 5m48.317891046s ago: executing program 1 (id=2158): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x143082, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x10000010}) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000140)=@generic={&(0x7f00000000c0)='./file0\x00', 0x0, 0x8}, 0x18) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21, 0x40001}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x7f}]}, 0x28}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000900), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r3, &(0x7f0000000a80)={0x0, 0xfffffffffffffc28, &(0x7f0000000a40)={&(0x7f0000000940)={0x4c, r4, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0xfffffffd}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0xa}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x10) close(r1) ioctl$SNDCTL_SEQ_RESET(r0, 0x5100) 5m47.845917623s ago: executing program 1 (id=2160): r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xf3, 0x14, @mcast1, 0x9}, 0x1c) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f00000003c0)={0xfffc, {0x10001, 0x7, 0x101, 0x6, 0x80000000, 0x924}}) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r2 = syz_open_dev$loop(&(0x7f0000000080), 0xa, 0x888e2) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000003c0)={r3, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1d, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e958c000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}}) mmap$KVM_VCPU(&(0x7f0000003000/0x4000)=nil, r1, 0x3, 0x40010, r3, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x1, 0x5, 0x9, 0x10008, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x5, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x4, 0x12a3, 0x6, 0xffffffff, 0x2, 0x6, 0x7, 0x81, 0x9, 0x79, 0x25713dc3, 0x10000, 0x0, 0x95, 0x4, 0x4, 0x16, 0x2, 0x5, 0x401, 0x5082, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x1000, 0xef1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0xa, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x4, 0x1c, 0x7, 0x1, 0xf40, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x7, 0xf1, 0x4, 0x1, 0xffff, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0xfffffff9, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0xfffffffe, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x808, 0x400, 0x2, 0x400, 0x3, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x5, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x8000, 0x400, 0x3e55, 0x5, 0xd3, 0x408, 0x3437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0x4, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x8, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0x40bfc, 0x8, 0x5, 0x7f, 0x2a29, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x1, 0x19d86, 0xd, 0xfffffff6, 0x8, 0x6, 0x5396, 0x3, 0x200006, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x8, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x201, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8008, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x3, 0xa8e, 0x14000, 0x1, 0x9]}, 0x45c) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xd01, 0x4, 0x7, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x5, 0x5, 0xb, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r8, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="1c020000000000000000000000000000080000000100009273960000620251f6060a234588a9c73dad0be37a5091921eb4a4a34e3da30beccb6bb2b62933a112745ed30f8397128e6d87189f15f54e9a9a0f0ca3d29373ae3e36f187e7e011086643aafcf9f37d00aa5b96dd4449a67d3979d429994dfa120152cd748450ba78cd13da6b786457c7a82a0bd1537cf7c2afc86f36cabecc904bcfe7d949277baeac22c38b42001ae22276c093152aafd08a2a81da1e6cf346"], 0x1c}], 0x1}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000200)=@ethtool_ringparam={0x10, 0x80000001, 0x3, 0x1, 0xd, 0xefe, 0x0, 0x0, 0x8}}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r9 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r10 = dup(r9) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r9, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000740)={0x0}, 0x1, 0x0, 0x0, 0x8}, 0x2004c000) r12 = dup2(r0, r0) write$tun(r12, &(0x7f00000000c0)=ANY=[], 0x46) 5m47.020805236s ago: executing program 32 (id=2160): r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xf3, 0x14, @mcast1, 0x9}, 0x1c) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f00000003c0)={0xfffc, {0x10001, 0x7, 0x101, 0x6, 0x80000000, 0x924}}) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r2 = syz_open_dev$loop(&(0x7f0000000080), 0xa, 0x888e2) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000003c0)={r3, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1d, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e958c000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}}) mmap$KVM_VCPU(&(0x7f0000003000/0x4000)=nil, r1, 0x3, 0x40010, r3, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x1, 0x5, 0x9, 0x10008, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x5, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x4, 0x12a3, 0x6, 0xffffffff, 0x2, 0x6, 0x7, 0x81, 0x9, 0x79, 0x25713dc3, 0x10000, 0x0, 0x95, 0x4, 0x4, 0x16, 0x2, 0x5, 0x401, 0x5082, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x1000, 0xef1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0xa, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x4, 0x1c, 0x7, 0x1, 0xf40, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x7, 0xf1, 0x4, 0x1, 0xffff, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0xfffffff9, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0xfffffffe, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x808, 0x400, 0x2, 0x400, 0x3, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x5, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x8000, 0x400, 0x3e55, 0x5, 0xd3, 0x408, 0x3437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0x4, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x8, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0x40bfc, 0x8, 0x5, 0x7f, 0x2a29, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x1, 0x19d86, 0xd, 0xfffffff6, 0x8, 0x6, 0x5396, 0x3, 0x200006, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x8, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x201, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8008, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x3, 0xa8e, 0x14000, 0x1, 0x9]}, 0x45c) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xd01, 0x4, 0x7, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x5, 0x5, 0xb, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r8, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="1c020000000000000000000000000000080000000100009273960000620251f6060a234588a9c73dad0be37a5091921eb4a4a34e3da30beccb6bb2b62933a112745ed30f8397128e6d87189f15f54e9a9a0f0ca3d29373ae3e36f187e7e011086643aafcf9f37d00aa5b96dd4449a67d3979d429994dfa120152cd748450ba78cd13da6b786457c7a82a0bd1537cf7c2afc86f36cabecc904bcfe7d949277baeac22c38b42001ae22276c093152aafd08a2a81da1e6cf346"], 0x1c}], 0x1}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000200)=@ethtool_ringparam={0x10, 0x80000001, 0x3, 0x1, 0xd, 0xefe, 0x0, 0x0, 0x8}}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r9 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r10 = dup(r9) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r9, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000740)={0x0}, 0x1, 0x0, 0x0, 0x8}, 0x2004c000) r12 = dup2(r0, r0) write$tun(r12, &(0x7f00000000c0)=ANY=[], 0x46) 11.256637667s ago: executing program 3 (id=3437): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xc0042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0xffffffff) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000001c40)=0x4) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110c230000) close(0x3) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x90002) ioctl$EVIOCGPROP(r3, 0x80404509, &(0x7f0000000180)=""/247) 10.642352862s ago: executing program 3 (id=3443): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03000000000000000000020000000900020073797a30000000000900010073797a30000000002c0003800800024000000000080001400000000018000380140001006d61630400633000000000000000000014000000110001"], 0x80}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 10.571066783s ago: executing program 3 (id=3444): r0 = socket$packet(0x11, 0x2, 0x300) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) read$FUSE(r1, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_IOCTL(r1, &(0x7f0000002240)={0x20, 0x0, r2, {0x1, 0x0, 0x6, 0x7}}, 0x20) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000022c0)={'wg1\x00', 0x0}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r5, 0x4068aea3, &(0x7f0000000080)={0xc0, 0x0, 0x2000}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x80) r6 = socket$inet6_sctp(0xa, 0x801, 0x84) shutdown(r6, 0x1) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r6, 0x84, 0x77, &(0x7f0000002300)=ANY=[@ANYBLOB="b8dae8b331ce116c87afea4d090709112104c891f54aaba3381285f27a042b4c1a456d5e3b49d1cc77066c216cbb91921e0309ef59c2952fd8dd3d07fa824e69ec15b311916677fbed86674a00b8a6e825c2ce99ecf0c1cc0438770551254f410858864d2fe55eea56db491e0bf62479bde8ceeab9dbe79417a5507943300000000000", @ANYRES8=r2], 0x8) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r8 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_int(r8, 0x29, 0x1000000000021, 0x0, 0x0) sendmmsg(r8, 0x0, 0x0, 0x4000000) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]}) ioctl$KVM_SET_LAPIC(r7, 0x4400ae8f, &(0x7f0000000100)={"b46474f815e8d5535f0887c44335cc824dc6121bc72a77f532ff5dad4d643a9cab29d2310e04be14eb26c0af4985fe45e3b3b0680b3ec92725d74b9716e0f7c3119a2c9a0ae65ff4772e2e12733cb013c4308fe40863480747c0a7ddb9361b1578015ca1bb2c1677ebae096f08345476f567443842946ed946434c75916d1db83fe305920de65bfaf9bd940672216846cb16b8ae67cd3affc61375381f91b3b9f1cc5e38cafe5239aee71dcd481fbe1ecd2547ffbaad4469a74697c28fb9beefa6a5d736712a55eb9110c2cf7964062ba8cbc1c038e84f0f5db7fc7053118bf5221e3efa6fc3edb5d0ca3cde7054dd0751a332520aa8478b1775d552c5cc24d3c2df9eb333e5ca3aa06c1c2cf8526714f5caff2f55b41976fc20b64f1fc61d5b44f50953582a1825d32130a31abfeafd1987317879e29ac51b93c9659e023fff3ddb5e39dd19cc3ef1d883c78b9e073d08a9197fb3717df238b9831831214b186693be9dd2568bb77272e80df5dfed03e8c467627bedfbd93359a9f79a3aa37e873dc1357b37b43d813ea85267b0dc8b1c4cc51bd985328833beb2679b7fb762555bbea2da936b36f8f1673fd5f606b2b6eb23b72bf947206e8dbfeb40ca6f265a3485c8446e0f0da652860b88328073d2282c14b48a7774e62754a968b60e92205e8fafcdd70a55c3c4d1a4821ff44e6e3681f15ae091262e3a3290a24d8ceae30ebbf9d24287bb8a5d73c608d47d287f9e716cf02b4796a83fb0c05e45b89de9ef8bce834e6d7a0be6e30d2c66cb6e640cb01898454ad361bc0701d8fe56113335ae6adec59300db04691cc4a689034272a8e086a32ce7061b4f79fa8afbb48a6ce4b62bdc44af013d78980457e1fa61eb9204818606f4c3b03c0f33cd2a841ac9bc2b73151a96e31ab99e6ec969b5f2c3edd5f9abc69845e487af992758ba445368da93dae1d44360d52a534a88276b8aaf349841d8a4788c60408618437c442308dbf70efeda2e54e9b9e4fe5f76997c9dcb945a26bd75748c85d19ca8b99264dce50580e8d4dbda401dad7df31e9a7a6a3a83bfbdfb5394abd581ac0824fbcd75d2f5205c0b7c9188e6f26bfd97734d9a20433f6cdba9d14a5f32a4d97a57f4603b21146fd1aebf082e863d463c224ad623c17d8043d3bf083f0322408dd6ead6915ac6a4222ab51480eb6e11a8913348219515170d9df90d72d7363bbda3e327d19f98c0a856f98076380e788e602e8a2ae0a1930786874dc21a2e99abda15f35457cf1dcb440c4b41350d0eda352aad7f57a0adc8a6914da06460635ed21c4c11cd1a8ec778064c9f62efba2927828b23f94b16619a5520731c2c40ab8583c9f2e73233d74b84f4877ce6b35bb1180300"}) syz_usb_connect$hid(0x2, 0x36, &(0x7f00000001c0)=ANY=[], 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000680)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000540)=0x934, 0x4) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000001", @ANYRES32=r3, @ANYRESDEC=r0], 0x3c}, 0x1, 0x0, 0x0, 0x20000855}, 0x4004800) 8.248155898s ago: executing program 4 (id=3461): r0 = openat$urandom(0xffffffffffffff9c, &(0x7f00000001c0), 0x400, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0xa5dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0x7}, {0x1, 0xb}, {0xfff2, 0x4}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240448a0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@newqdisc={0x2c, 0x24, 0x1, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0xffe0, 0x4}, {0xffff, 0x6}, {0x3, 0x10}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x80000000}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x91) ioctl$RNDADDTOENTCNT(r0, 0x40045201, 0x0) 8.120924039s ago: executing program 4 (id=3462): r0 = socket(0x1e, 0x4, 0x0) recvmmsg(r0, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000440)=""/127, 0x7f}], 0x1}, 0x8000}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=""/3, 0x3}, 0xfffffff7}], 0x2, 0x12000, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x48811}, 0x4000000) sendmsg$NFT_BATCH(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x270, 0x6, 0xa, 0x403, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x240, 0x4, 0x0, 0x1, [{0x23c, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x22c, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0xb, 0x1, 'cgroup\x00'}, @NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_MATCH_INFO={0x214, 0x3, "06275c852770226714b06026799504d26462d0f7a66ead44d6899e1445d97832ad457d06138b69af69d529be95f1911eab1846eb51bda151a6b0736302fdfb9f2c903fa06bb26b5a1ce76b17878e8174d345499079f1da597f0326854d62b1f5d97f2de35a9cb60da0764d08dbaf74939de34af914a3ea3f02ca57df07e9ed10aecb90bdbabcfcdd62e3ef6913b29a63fd42d9276dc54b68f9bc26a02bfec3c72f303f719fe6ca141e405417118a3316ef2a473417d47a2c37cecc2f4333caf9b5d8096a71bc60c57dd3fc882043377d4140b7f4580a622043a0da245a977be1af6ec12bf2ec5c7ed50e1b4f9e144fe641036e5673089a6707b709515c62734ab864914ef7e6e82143b0f6a3a6ec884fb0ecb0567dff30ef656a1316898954a71db76db8b74d4749e35b33481ad897934c4c5b1ca2f8b7e93e8dadaa1d2c96c5f1e9ce253fc6f3335b981003f183afc65a3618d2ac05c2a557154862dc7805bf408ec8c74aef836fff2e2caf6925c8bb1f460cc68d410733bd2ff5d15c60bfd8c080839e416b589d51e18c402e0282aa1918d13aadca89120112ba089e9925a0b4cbf9441a2e63268c0b2fc90c38b840eb48e9800d6f4d731051bcae4924d5a7176d83d5951cf4dbd6108032b6a35b67d6c585ee1c047b1fea250f941fccce0210922b1d9f6c6a0da7e9bf3704c31afdf08438c1021cbe05fb24ec20dc9630f8c92a4f833f431b8ac1b0cc0a19fbf942"}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_COMPAT={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x298}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) futex_waitv(&(0x7f0000002c00)=[{0x7, 0x0, 0x2}, {0x8, 0x0, 0x82}, {0x101, 0x0, 0x82}, {0x2, 0x0, 0x2}, {0x7, 0x0, 0x2}, {0xfffffffffffffffe, 0x0, 0x82}, {0x7b34, 0x0, 0x2}, {0x2, 0x0, 0x82}, {0x8, 0x0, 0x2}, {0xa, 0x0, 0x2}, {0x80000001, 0x0, 0x2}, {0x2200, 0x0, 0x82}, {0x3, 0x0, 0x82}, {0x235c00000000, 0x0, 0x2}, {0xe, 0x0, 0x2}, {0x0, 0x0, 0x82}, {0x81, 0x0, 0x82}, {0x47c9, 0x0, 0x82}, {0x0, 0x0, 0x82}, {0x3, 0x0, 0x2}, {0xd0, 0x0, 0x2}, {0x5, 0x0, 0x2}, {0x4, 0x0, 0x2}, {0x877, 0x0, 0x2}, {0xfff, 0x0, 0x82}, {0x80000000, 0x0, 0x82}, {0x9, 0x0, 0x82}, {0x9, 0x0}, {0x1000, 0x0, 0x82}, {0x101, 0x0, 0x82}, {0x2, 0x0, 0x2}, {0x7f, 0x0, 0x82}, {0xffffffffffffffff, 0x0}, {0x1, 0x0, 0x2}, {0xab0, 0x0, 0x82}, {0x5, 0x0, 0x2}, {0x36, 0x0, 0x82}, {0x2, 0x0, 0x2}, {0xfffa, 0x0, 0x2}, {0x1, 0x0, 0x82}, {0x3530000, 0x0, 0x2}, {0x4, 0x0, 0x2}, {0x3e, 0x0, 0x2}, {0x0, 0x0, 0x2}, {0x2, 0x0}, {0x10000, 0x0, 0x77428aa6761ad2}, {0xab, 0x0, 0x82}, {0x9, 0x0, 0x82}, {0xfffffffffffffffa, 0x0, 0x82}, {0x8000000000000001, 0x0, 0x80}, {0x7f51, 0x0, 0x2}, {0x6, 0x0, 0x82}, {0x3b, 0x0, 0x2}, {0x3, 0x0, 0x82}], 0x36, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000080a05000000000000000000050000000900010073797a300000000040000000030a010100000000000000000500000009f5000073797a30000000000900030073797a300000000014000480080001400000000008000240521deb0b6c000000060a010400000000000000000500000008000b400000000044000480240001800b00010072656a656374000014000280080001400000000005000200810000001c0001800a00010071756575650000000c00028006000140000e00000900010073797a3000000000140000001100010000000000000000000000000a"], 0xf4}}, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) write$UHID_INPUT(r2, &(0x7f0000001040)={0x9, {"a2e3ad21ed0d09f90e3d090987f70e06d038e7ff7fc6e5539b0d5b0e8b099b3f36006c090890e0878f0e1ac6e7f89b334d959b3a9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0a6193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000400000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617679314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec230911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918c91243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac5a4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4b333bd5bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3be3b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ce0700c7e658828163e2d25c4aa348561f927eff7f3aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f05004b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d486046b2c0e2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee6157eb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de225727aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d78749a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29c60acebdbe8ddbd75c2f998d8a57f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95ff80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8870b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513007000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae8489d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60299473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d946a2daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810300000000000000a12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf000000800000000007b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae0e797e8bd1f4108b7807fb36207685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ad50dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b9048017848416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1db44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b00f1000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de9c0587c2cb5fe36d7d3e5db21b013b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cf4b23329072e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06810002000000000000957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f3e90d5943dbc10360a1a49700d1dfbf66d69f6fbafe1e83cdde8bb0d872a02238926407a4eddd5d0fc5a752f900000000000000100", 0x35e}}, 0x1006) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x140, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110c230000) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x42340, 0x0) ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110c230006) close(r5) 7.213886176s ago: executing program 3 (id=3468): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRES16=0x0, @ANYRES32], 0x0, 0x9, 0x0, 0x0, 0x0, 0x13, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x4, 0x2001) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r2, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902"], 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000a00)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000940)=""/3, 0x3, 0x3, 0x4, 0x0, 0x0, 0xc08}}, 0x11c) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.events\x00', 0x275a, 0x0) write$binfmt_misc(r6, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r6, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 7.046720382s ago: executing program 4 (id=3471): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) set_mempolicy(0x4005, &(0x7f0000000080)=0x4, 0x8) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xa0}}, 0x0) r1 = gettid() timer_create(0x1, &(0x7f0000000180)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x3000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x84, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_NG_TYPE={0x8}]}}}, {0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0xffffffffffff30a3}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "1c"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0xac}, 0x1, 0x0, 0x0, 0x6040850}, 0x20000040) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x80000) ioctl$int_in(r4, 0x5452, &(0x7f0000000f80)=0xd) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r4) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_HV_CPUID_sys(r5, 0xc008aec1, &(0x7f0000000400)) 6.320213094s ago: executing program 2 (id=3475): r0 = socket$inet_udp(0x2, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b4562d117fffffff81004e230e227f000001925aa80020007b", 0x27}], 0x1) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x1058, [{0xa00, 0xe0000000}, {0x0, 0x100000000000000}]}, 0xa50) 5.982026911s ago: executing program 4 (id=3477): syz_usb_connect(0x5, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="120110019ae8c94079092702506f0102030109021b00010607500e09040eda0129019105090503"], 0x0) r0 = userfaultfd(0x80001) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x1000)=nil, 0x4000, 0x3}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000040)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x11, 0x1, 0x0, 0x7}, @IPSET_ATTR_BUCKETSIZE={0x5}]}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x60}}, 0x0) unshare(0x4000400) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x33, 0x0, 0x0) r3 = syz_open_dev$mouse(0x0, 0x0, 0x2) socket(0x2, 0x800, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="44000000100001060000000000000000000000000000000001000000010000000e00030076736f636b6d6f6e30000000140012800d00010076736f636b6d6f6e"], 0x44}}, 0x0) ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f0000000080)={0x2}) 5.816171022s ago: executing program 0 (id=3478): r0 = memfd_create(&(0x7f00000013c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9b5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\\\xb0:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85l\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7y`~7\x16\x02\x00(v\xe6`\"6\xfcgC\xb5\xf0\x13.zj\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1exQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+\xa0\x1c\x14\x01\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1.E\b1\xcb\xa2\xbe}\xb2\xe4y\xbb\xe6\x1f\x10\x95y\x8e\xa6\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x82\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc00x0}) bind$packet(r4, &(0x7f0000000080)={0x11, 0x6, r5}, 0x14) bind$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) close(0x3) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000000)={0x0, 0xd, 0x4, "f8484778"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=ANY=[@ANYBLOB="200134000000002bab"], 0x0}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f00000009c0)=@nat={'nat\x00', 0x670, 0x5, 0x678, 0x0, 0x0, 0xfeffffff, 0x330, 0x0, 0x5e0, 0x5e0, 0xffffffff, 0x5e0, 0x5e0, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, 0x0, 0x0, 'wlan1\x00', 'veth1_to_team\x00', {}, {}, 0x6}, 0x0, 0x308, 0x330, 0x0, {}, [@common=@unspec=@physdev={{0x68}, {'veth0_vlan\x00', {0xff}, 'team0\x00', {0xff}, 0xe, 0x1c}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00', {0x6}}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@uncond, 0x0, 0xf0, 0x128, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x4000000, 0x4000000, 0x1000002]}}}, @common=@set={{0x40}, {{0x0, [0x4, 0x0, 0x0, 0x3]}}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @icmp_id}}}}, {{@ip={@multicast2, @rand_addr, 0x0, 0x0, 'veth0\x00', 'ip6tnl0\x00', {}, {}, 0x73}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@ttl={{0x28}}]}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x8, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @gre_key=0x1, @gre_key=0x80}}}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@private=0xa010100, @ipv4=@dev, @port=0xfffd}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x6d8) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000001300)={0x84, &(0x7f0000000e40)={0x0, 0x0, 0x3, "0b3b81"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) renameat2(r1, &(0x7f00000000c0)='./cgroup\x00', r1, &(0x7f0000000440)='./cgroup\x00', 0x2) 5.712464376s ago: executing program 2 (id=3479): r0 = open(&(0x7f0000000340)='./bus\x00', 0x4c27e, 0x2) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17ffff7, 0x12, r0, 0x0) fallocate(r0, 0x0, 0x9, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r1 = syz_open_procfs(0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc0686611, &(0x7f0000000040)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) 5.585729576s ago: executing program 5 (id=3480): openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x121c02, 0x0) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="f8000000160000012bbd7000fedbdf25ffffffff000000000000000000000000ac14144e2300004e240000020000201d1e00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000004d533000000ac1414380000000000000000000000000800000000000000b507000000000000000000000000000006000000000000000900000000000000faffffffffffffff"], 0xf8}, 0x1, 0x0, 0x0, 0x10}, 0x400c8c0) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010409000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @multicast}) (async) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a120000140000006c07010033d43afffe800000000000000000000000000010ff02000000000000000000000000000189"], 0x340a) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) (async, rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_route(0x10, 0x3, 0x0) fsopen(&(0x7f0000000680)='mqueue\x00', 0x0) (async) r3 = signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) write$eventfd(r3, &(0x7f0000000140)=0x8, 0x8) epoll_create1(0x80000) (async) memfd_create(&(0x7f0000000300)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00', 0x7) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) (async, rerun: 32) socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) (async, rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x10) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) r4 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000010001ffe00989837a182138b00268f1c", @ANYRESOCT, @ANYBLOB="ff7f000080000000140012800a00010076786c616e0000000400028008000a00", @ANYRES16=r4], 0x3c}, 0x1, 0x8000a0ffffffff, 0x0, 0x8086}, 0x0) 5.557768166s ago: executing program 2 (id=3481): syz_usb_connect(0x5, 0x27, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b75c7f40470501026411010203010902120001000000000904"], 0x0) socket$alg(0x26, 0x5, 0x0) r0 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r2, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r3, 0x84, 0x84, &(0x7f0000000080)=""/4096, &(0x7f0000001200)=0x1000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="01ff"], 0x30}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, 0x0, r4}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r5 = io_uring_setup(0x14cf, &(0x7f0000000040)={0x0, 0xc8a2, 0xc000, 0x80008, 0xc0}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0xfffffffffffffda2, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600100004"], 0x50) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0xa1300) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x20042) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, &(0x7f0000000340)={0x0, 0x0, {0x0, 0x1, 0x7f, 0x3, 0x7}, 0x1005}) write$sndseq(r7, &(0x7f0000000140)=[{0x1f, 0x0, 0x0, 0xfd, @tick=0x5ab7, {0xff}, {}, @raw32}], 0x1c) r8 = syz_open_dev$I2C(&(0x7f0000000040), 0x20000000001, 0x2003) ioctl$I2C_SMBUS(r8, 0x720, &(0x7f00000005c0)={0x11, 0xca, 0x3, &(0x7f0000000000)={0x6, "ee48b71ad5608a40000000ca09b87de261050000000000a4a300"}}) 5.136979233s ago: executing program 5 (id=3482): ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) mbind(&(0x7f0000008000/0x7000)=nil, 0x7000, 0x1, 0x0, 0x2, 0x1) r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r0, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x4000, @multicast2}, 0x10, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90841835ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {0x0}], 0x2, &(0x7f00000010c0)=[@ip_tos_int={{0x14, 0x29, 0x34}}, @ip_tos_u8={{0x11, 0x29, 0x4}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @remote}}}], 0x50}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@ipv4_newroute={0x1c, 0x1a, 0x1, 0x1, 0x25dfdbff, {0xa, 0x0, 0x80, 0x80, 0x0, 0x0, 0x0, 0x1}}, 0x1c}}, 0x0) 4.779841109s ago: executing program 5 (id=3483): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="1201410148134420240400756e69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="380000001800010027bd70000200000001fd0600030000060015000400000014001680100008800c0003800500010001000000"], 0x38}, 0x1, 0x0, 0x0, 0x4001}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x40, 0xa, 0x4, "a0e763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000340)={0x1d, r3, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r2, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}], 0x1}}], 0x40000000000014f, 0x20008004) bind$can_j1939(r2, &(0x7f0000000200)={0x1d, r3, 0x2, {0x2, 0xf0, 0x1}, 0x2}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'batadv0\x00', 0x0}) sendmsg$inet(r2, &(0x7f0000000b00)={&(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000080)="d5a7440e59953f4aee340ba672b6916c20d82c02236bfa320329e69cece64e14f33169c211100e5b81475f5932c2a9443612213befedfaee0907fc4169dcaba0bd52cfcca84fbbc2116921f8fab557488d39c274bae635b6d9e0eb22ccd069dcee59", 0x62}, {&(0x7f0000000140)="0cf67c2580f25f9877084bc1138846865e573729bead7aa62ba6abc6d9968a9c1c61c6e9833e9c5522519e1ec727b5cc9cc6a7ec5f4bb5507e19aeddf1ed", 0x3e}, {&(0x7f0000000180)="596aa1a23521abfbdf398de794d78877e4a4272976f77b57013a3b52b675bd329b73679223035b2bfe89b0", 0x2b}], 0x3, &(0x7f0000000980)=[@ip_retopts={{0xe8, 0x0, 0x7, {[@timestamp_addr={0x44, 0x1c, 0x32, 0x1, 0x0, [{@local, 0x4}, {@multicast2, 0x7}, {@broadcast, 0x800}]}, @generic={0x82, 0xe, "193f4f7b1415ba08dc559e0a"}, @timestamp_addr={0x44, 0x34, 0x9, 0x1, 0xf, [{@local, 0x4}, {@local, 0x8}, {@rand_addr=0x64010100, 0xffff013c}, {@multicast1, 0x1}, {@rand_addr=0x64010102}, {@dev={0xac, 0x14, 0x14, 0x13}, 0x2}]}, @cipso={0x86, 0x77, 0x3, [{0x5, 0xd, "4d62e51b40e91ec3483405"}, {0x5, 0xd, "4ca2c52de24ca9fb44a6df"}, {0x7, 0x2}, {0x2, 0x10, "754bff64c137e55ecfcef09b7810"}, {0x6, 0xa, "83eee4a235da3fd2"}, {0x1, 0x12, "cd28b15db04996ab6c51128b71cd0dd3"}, {0x1, 0xf, "b858260bfa5c96259479f01963"}, {0x0, 0x8, "9c5b03cc94b9"}, {0x0, 0x3, '$'}, {0x6, 0xf, "cbc8aff3704263e5e8c645bc3d"}]}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x51}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xe2c}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @local, @multicast2}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x16}}}}], 0x170}, 0x8010) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000200)={0x0, 0xc, 0x4, "ca258375"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r5, 0x4008af00, &(0x7f0000000300)=0x1000000) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="601004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000005c0)={0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="205aba"], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f00000007c0)={0x20, 0x17, 0x4, "549b3e82"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) socket(0x1e, 0x6, 0x3) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000002c0)={0x2c, &(0x7f0000000380)=ANY=[@ANYBLOB="a20b8217b32a938b4be4"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) r6 = socket$igmp(0x2, 0x3, 0x2) listen(r6, 0x7) syz_usb_control_io$uac1(r0, 0x0, 0x0) 4.109107111s ago: executing program 4 (id=3484): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x60, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000040)={0x40, 0x8, 0x52, {0x52, 0x30, "a53e37ca91e9f5b82e65c890405452611e35f96999d56ce0fc0d8cacb70701f54208adcc1e4504a5001920f221335caa5f657694b65643be82ac99d459ea7e0816bf412f6718886c8596cf80d5ff7515"}}, &(0x7f0000000140)={0x0, 0x3, 0x44, @string={0x44, 0x3, "25c321470dadb702016880c0221c4f42d4aa6301f1bf636db1706a23b505b6c89f2606dddbc05e53b4956a38053fe2f38b2b6919288837e5b54800bf4aca5befff15"}}}, &(0x7f00000005c0)={0x44, &(0x7f0000000240)={0x0, 0x17, 0x2c, "2963006bc132f6368a8116026cbfcfec5e1adab1009c2867aabfdf519bf4a6184585f3b6e0b658a79ffa6654"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x2}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000300)={0x20, 0x81, 0x2, "bb2c"}, &(0x7f0000000400)={0x20, 0x82, 0x1, "ea"}, &(0x7f0000000480)={0x20, 0x83, 0x1, "dd"}, &(0x7f00000004c0)={0x20, 0x84, 0x1, 'y'}, &(0x7f0000000500)={0x20, 0x85, 0x3, "2b13d1"}}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000200)={0x20, 0x11, 0x8, "0c5bfbd8c79b3161"}, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="207c0200000007bb"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) 4.053864222s ago: executing program 2 (id=3485): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, '\x00', 0x34}}}, 0xf, 0x6, 0x4a8b4a0d, 0x6, 0x7ff}, &(0x7f0000000300)=0x98) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xa8282, 0x0) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd86) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000000)=0x2) 2.827975517s ago: executing program 3 (id=3486): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c831, 0xffffffffffffffff, 0x0) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @cgroup_skb=0x1}, 0x94) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x20) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) (async) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040), 0x1e) (async) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "dce02de9d7bd466b", "72e64b3892cb7025848c9f40363cf916", "cfff3c66", "e2b768b4bb9e0d9b"}, 0x28) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) syz_emit_ethernet(0x46, &(0x7f0000000780)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x10, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[@hopopts={0x2c, 0x1, '\x00', [@generic={0x3, 0x6, "00b793f13357"}]}]}}}}}, 0x0) (async) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r4 = socket$packet(0x11, 0xa, 0x300) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x200000, 0x0) ioctl$TUNSETFILTEREBPF(r5, 0x800454e1, &(0x7f0000000140)) (async) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10) (async) syz_emit_ethernet(0x66, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaa58fffe0000002f9078ac1414bbe0000001248088a800000003"], 0x0) (async, rerun: 32) connect$unix(r2, 0x0, 0x0) (async, rerun: 32) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 32) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async, rerun: 32) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r6 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) (async) r7 = fsmount(r6, 0x0, 0x1) unlinkat(r7, &(0x7f0000000700)='./file0\x00', 0x0) (async, rerun: 64) sendmsg$nl_crypto(r7, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)=@getstat={0xe0, 0x15, 0x400, 0x70bd2d, 0x25dfdbff, {{'drbg_nopr_sha256\x00'}, '\x00', '\x00', 0x400, 0x400}, ["", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x41}, 0x20000000) (rerun: 64) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYRES16=r0], 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 2.766571223s ago: executing program 2 (id=3487): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000002c0)={@mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev={0xfe, 0x80, '\x00', 0x25}, 0x1, 0x6, 0x0, 0x400, 0x81, 0x540000, r1}) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0, 0x0, 0x6, 0x0, 0x100, 0x6, 0x2180107, r1}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00'}, 0x48) r5 = socket$kcm(0x2, 0x1, 0x0) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000bdf7130870270c936a8d010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r6, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="001306000000ec19d02303f6"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$IP_VS_SO_SET_FLUSH(r4, 0x0, 0x485, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r6, 0x0, 0x0) munlockall() syz_usb_connect$cdc_ecm(0x4, 0x58, &(0x7f0000000880)=ANY=[@ANYBLOB="12011001020000082505a1a44000010203010902460001010710040904000d02020600030724060000b06e052400ff000d240f015d1500003a0f05000809058103100004077f090582024000075300090503020004016c05be2830e35c6043ccd83f4ec1361e75c0b713f3a448d4e3cc943de6c74c897008"], &(0x7f0000000740)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x110, 0x3, 0x4, 0x9, 0x40, 0x1}, 0x26, &(0x7f0000000480)={0x5, 0xf, 0x26, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x1, 0x5, 0x2}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9575fcebb21690ff5d3303e878fee90c"}, @ptm_cap={0x3}]}, 0x5, [{0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x42b}}, {0x2e, &(0x7f0000000500)=@string={0x2e, 0x3, "f10e6fae6178799a79e1f76a6711f5a6889c27fda5b00e4348f9f59f1a44e654be1c4ee3f3aaa931e298c408"}}, {0xf3, &(0x7f00000005c0)=@string={0xf3, 0x3, "ece87688e9494e51b27ac2f0280581a27de37a3569153c32c504720895111262530baeacc6df4ce746918ed411b0bfe7b58bc9364a7d36b993c134c236c73478d979d0a8f0e5e6ae3ca5a05a984fda4c0f82133038639be017dbadc2bcbab624750694f04882b4d430fc81c5111913941d67b1245ece63a18f3d351352d1bf3fec9cc0b6148efa6f686152e091afe58a7b969c40968e29f21f5e4e77759686877268ee0013c9f7c4a12fe9c1c30f5d419a753a7a3e7e83dc9d78c9068d6f3d07d2061957ab45a4c1b1617ac2c57f9fe3e0947ec21ed1e1e13d17bfb61538a3eabe29db530004545c4d4b8f05e699895f2e"}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x4ff}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x812}}]}) sendmsg$inet(r5, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000b00)={r5, r4}) setsockopt$sock_attach_bpf(r5, 0x1, 0x7, &(0x7f0000000000), 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r9, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r9) splice(r10, 0x0, r9, 0x0, 0x10000008ebc, 0x0) sendmsg(r11, 0x0, 0x4) splice(r8, 0x0, r11, 0x0, 0x25a5, 0x0) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000240)={@mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @dev={0xfe, 0x80, '\x00', 0x36}, 0x1, 0x6, 0x0, 0x100, 0x4, 0x86020086, r7}) r12 = socket$nl_route(0x10, 0x3, 0x0) r13 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r13, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {0x0, 0xffff}, {0x4, 0xfff3}, {0x0, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x48080}, 0x0) 2.653470087s ago: executing program 0 (id=3488): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x5, 0xfffa}, 0xa, [0x6, 0xc95a, 0xfffffff3, 0x9, 0x7f, 0x0, 0xfffffffd, 0x8, 0x6, 0xfffffff9, 0xfffffff2, 0x5f, 0xa, 0x3, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x69a4, 0x80000001, 0x4, 0x5, 0x100000, 0x3c5b, 0x1, 0x24, 0xffffffff, 0xfffffffe, 0x1f461e2c, 0x24000, 0xe661, 0x4, 0x9, 0x3, 0x7fff, 0x4, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x404, 0x7, 0x10103, 0x0, 0x5, 0x3c, 0x91, 0x2, 0xfffffffd, 0x3, 0x5, 0x0, 0x8, 0x4, 0x80, 0x0, 0x5, 0x2, 0x8, 0x4, 0xfffffffd, 0x514], [0x10000007, 0x8, 0x12f, 0x8000, 0x10, 0x4, 0x129432e2, 0xcb, 0xf9, 0xd, 0xffff, 0x6c9, 0x9, 0xfffffffe, 0x7, 0x0, 0x10007, 0x5, 0x2f, 0xb99, 0x312, 0x78, 0xea4, 0xa, 0x6, 0x4000, 0x8000, 0x9, 0x400, 0x1, 0x6, 0xff7ffffd, 0x8, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x4ecf, 0x7f, 0x9, 0x5, 0xd, 0x80004, 0x1, 0x7, 0xb, 0x9, 0x48c93690, 0x3, 0xff], [0x7, 0x800004, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x9, 0x1, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x4, 0x5, 0xcf, 0x1ef, 0x5, 0x8, 0x85, 0x6, 0x10000009, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x7, 0x7c, 0xffffffff, 0x4, 0x2, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d6, 0xbf, 0x200, 0x3, 0x400002, 0xfffffff9, 0x0, 0x0, 0x0, 0x0, 0x6, 0x6, 0x120000, 0x3, 0x6, 0x9, 0x4], [0x9, 0xbb30, 0x3, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x8ad, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x4, 0x5, 0xffffffff, 0x7ffffffe, 0x5, 0x2, 0x100c8, 0x3, 0x2, 0xffff, 0x3, 0x9, 0x100, 0x9602, 0xa, 0x2, 0x4, 0x493, 0x1, 0x10003, 0x5, 0x8, 0x2b91, 0xa1f, 0x108, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x100005, 0xb1c, 0x1, 0x200, 0xffff3445, 0xfff]}, 0x45c) r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) ppoll(&(0x7f00000000c0)=[{r0, 0x80}], 0x1, 0x0, 0x0, 0x0) write$char_usb(r1, &(0x7f0000000040)="e2", 0x918) (fail_nth: 34) 1.825988347s ago: executing program 3 (id=3489): bpf$PROG_LOAD(0x5, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0xca, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) syz_usb_connect(0x0, 0x56, &(0x7f0000000080)=ANY=[], 0x0) 1.762638471s ago: executing program 0 (id=3490): openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101302, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x29dbfff9750a3073, 0xffffffffffffffff, 0x1}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r2) (async) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) (async) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000040)=[{0x20, 0x4, 0x0, 0xfffff038}, {0x6, 0x0, 0x0, 0x2}]}) ioctl$TUNGETVNETLE(r2, 0x40107446, &(0x7f0000000180)) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r4, 0x4004743d, 0x110e22fff6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xd, 0x4008033, r3, 0xaab09000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) (async) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') (async, rerun: 32) r6 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c000180060006006558000014000280100014800c00", @ANYRES8=r6], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$LOOP_CHANGE_FD(r5, 0x4c06, r4) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) syz_kvm_setup_cpu$x86(r8, r9, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, &(0x7f00000000c0)="c4e27d787900c42221a6093e0f080159fcb9900d0000b8fe40c6e0ba26d5887e0f3040da1ccac4e1fa2c13f04520030f01c9b805000000b9754b00000f01c1", 0x3f}], 0x1, 0x1, 0x0, 0x0) (async) ioctl$KVM_RUN(r9, 0xae80, 0x0) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) read$FUSE(r5, &(0x7f0000002140)={0x2020}, 0x2020) (async) write$cgroup_type(r8, &(0x7f0000000200), 0x9) (async) socket$inet6_sctp(0xa, 0x5, 0x84) 1.145488845s ago: executing program 0 (id=3491): r0 = open(&(0x7f0000000340)='./bus\x00', 0x4c27e, 0x2) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17ffff7, 0x12, r0, 0x0) fallocate(r0, 0x0, 0x9, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc0686611, 0x0) 1.117589923s ago: executing program 0 (id=3492): r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = syz_open_dev$rtc(&(0x7f0000000000), 0x10000, 0x1000) (async) r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r3 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000080), 0xc00, 0x0) (async) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) ppoll(&(0x7f00000000c0)=[{r0, 0x40}, {r1, 0x1000}, {r2, 0x101}, {r3, 0x4040}, {r4, 0x2080}], 0x5, &(0x7f0000000100)={0x77359400}, &(0x7f0000000140)={[0x7]}, 0x8) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x800, 0x0, 0xff, 0x5, 0x0, 0x5}, 0x20) (async) ioctl$BTRFS_IOC_TREE_SEARCH(r4, 0xd0009411, &(0x7f00000001c0)={{0x0, 0x7fffffff, 0x80000000, 0x8000, 0x3, 0x1, 0x40, 0x5, 0x9010, 0x3, 0x40, 0x9, 0x2, 0x0, 0x9e}}) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001340)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001300)={&(0x7f0000001200)=@deltaction={0xe8, 0x31, 0x100, 0x70bd27, 0x25dfdbff, {}, [@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}]}, @TCA_ACT_TAB={0x34, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}, @TCA_ACT_TAB={0x54, 0x1, [{0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xedf}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}, @TCA_ACT_TAB={0x2c, 0x1, [{0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0xdb712d3c5cd117fe}, 0x0) r5 = socket$tipc(0x1e, 0x2, 0x0) (async) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x5, 0x810, r0, 0x414bf000) (async) r6 = syz_open_dev$usbfs(&(0x7f0000001380), 0x5, 0x80000) ioctl$USBDEVFS_RESETEP(r6, 0x80045503, &(0x7f00000013c0)={0xf, 0x1}) (async) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000001400)={0x0, 0x3e, "a282d016f74d050dceb05dcbb57b5560be3729cc55378387fac17c8e4d3835732bca7a8adf2cf292b80d26e2a4676b9c4bce48b94d5f17be0f628ac49e87"}, &(0x7f0000001480)=0x46) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r5, 0x84, 0x78, &(0x7f00000014c0)=r7, 0x4) (async) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r4, 0x8008f511, &(0x7f0000001500)) (async) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000001540)=@usbdevfs_connect={0x7fffffff}) getsockname$packet(0xffffffffffffffff, &(0x7f0000001580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000015c0)=0x14) (async) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001600)={{{@in6=@local, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@mcast1}}, &(0x7f0000001700)=0xe8) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001740)={{{@in6=@private0, @in6=@remote, 0x4e23, 0x0, 0x4e20, 0x8000, 0x2, 0x80, 0x80, 0x16, r8, r9}, {0xa0000000000000, 0x9, 0x4261, 0x5, 0x1, 0x7, 0x0, 0x3}, {0xe, 0x270, 0x1e, 0x800}, 0x6, 0x6e6bbf, 0x1, 0x1, 0x1, 0x1}, {{@in6=@private1, 0x4d4, 0x3c}, 0x2, @in=@loopback, 0x3502, 0x0, 0x3, 0x9, 0xfffffffe, 0x401, 0x9ead}}, 0xe8) (async) r10 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000001840), 0x121840, 0x0) ioctl$SOUND_OLD_MIXER_INFO(r10, 0x80304d65, &(0x7f0000001880)) (async) ioctl$TIOCMSET(r1, 0x5418, &(0x7f00000018c0)=0x6) (async) r11 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r11, &(0x7f00000019c0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001980)={&(0x7f0000001940)={0x3c, 0x1407, 0x8, 0x37b1c81a, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz2\x00'}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20040000}, 0x800) (async) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, &(0x7f0000001a40)={0xa, 0x0, &(0x7f0000001a00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) (async) r12 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$SO_ATTACH_FILTER(r12, 0x1, 0x1a, &(0x7f0000001ac0)={0x8, &(0x7f0000001a80)=[{0x200, 0x0, 0x9, 0x7c}, {0xd9aa, 0xf, 0xec, 0x9}, {0x3, 0x4, 0x2, 0x3a}, {0x3, 0x2, 0x2, 0x7}, {0x9, 0x6, 0xf3, 0x6}, {0x800, 0x3, 0x5, 0x976}, {0xe, 0xca, 0x1, 0x4}, {0x1ff, 0x0, 0x6, 0x3}]}, 0x10) (async) syz_open_pts(r3, 0x800) (async) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r10, 0x50009417, &(0x7f0000001b80)={{r6}, 0x0, 0x14, @inherit={0x48, &(0x7f0000001b00)={0x1, 0x0, 0x7fffffff, 0x4, {0x4, 0xc, 0x5d39, 0x3, 0x3}}}, @devid}) 1.052714956s ago: executing program 0 (id=3493): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000005ec0)) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x80c42) read(r2, 0x0, 0x0) 816.39572ms ago: executing program 2 (id=3494): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101401, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r1, 0xc0bc5310, &(0x7f0000000300)) r2 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x1, 0x18) symlinkat(&(0x7f0000000000)='.\x00', r3, &(0x7f0000000140)='./file0\x00') openat2(r3, &(0x7f00000008c0)='./file0/../file0\x00', &(0x7f0000000380)={0x100, 0x0, 0x8}, 0x18) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES8], 0x50) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c00000000000010902220001010080320904000001030000000921110100012244000705810308000a"], 0x0) r6 = syz_open_dev$sndpcmp(&(0x7f0000000500), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r6, 0xc2604110, &(0x7f0000000000)={0x1, [[0x7fff, 0x40, 0x0, 0xd, 0xffffffff, 0x3, 0x0, 0x800], [0x0, 0x8000000, 0x0, 0x0, 0xc000, 0x444d, 0x4], [0x800, 0x5, 0xfffffffe, 0x7, 0xfffffffe, 0xa, 0xffffffff]], '\x00', [{}, {0x0, 0x400}, {0xffffffff}, {0x0, 0x1}, {0xb0a, 0x6}, {0xffffffff, 0x9}, {0x20004, 0x8}, {0x9}, {0x5, 0x200000}, {0x164, 0xffff}, {0x8, 0x80001}], '\x00', 0x80000001, 0x0, 0x0, 0x2, 0x0, 0x35}) setsockopt$sock_int(0xffffffffffffffff, 0x29, 0x1f, 0x0, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000440)={0x2, 0x2, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) ioctl$sock_inet_SIOCGIFPFLAGS(0xffffffffffffffff, 0x8935, &(0x7f00000002c0)={'veth0_vlan\x00'}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x7, &(0x7f0000000500)=0x0) read$FUSE(r8, &(0x7f0000001740)={0x2020}, 0x2020) close(0x3) io_submit(r10, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r9, 0x0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r9, &(0x7f00000001c0)='m', 0xffffff4c}]) connect$inet(r7, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) 582.083321ms ago: executing program 5 (id=3495): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) (async) recvmmsg(r0, &(0x7f0000005280)=[{{0x0, 0x0, 0x0}, 0x10009}], 0x1, 0x10000, 0x0) (async) sendmmsg$inet6(r0, &(0x7f0000000c00)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="000000f5b8ac2bb9920100c7b3ba4f60bfed002da6445dac98280c91950619c2", 0x20}], 0x1}}, {{0x0, 0x0, &(0x7f0000000b00)}}], 0x2, 0x20e8086) (async) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x40, 0x700, 0x40, 0x1, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x67, 0x0, 0x0, 0x29, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000140)={'gretap0\x00', r2, 0x10, 0x80, 0x20000, 0x2, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x64, 0x0, 0x10, 0x0, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1}}}}) (async) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_buf(r3, 0x0, 0x23, 0x0, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8b15, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYRES16=r5, @ANYRESHEX=r5, @ANYRES16=r5, @ANYBLOB="5e47437c867e1974231b0368d48f44a23b4b42856815d1b4afd5fd0e6a97b36a9fb2196688e01133b69a9b43670725a91235ff3e746ca9b3fd0560a68038c1d5eb6130057e3826ef0dd4d8b900bc36a4095f33c6dc4abe72b12aacbe118840bdef064508d44b0d0fa8e49f41bfafc3c9b228c130", @ANYRESHEX=r6], 0xd0}}, 0x94c25743bd50fa6d) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0xa0000, 0x0) (async) r8 = syz_open_dev$sndpcmc(&(0x7f00000000c0), 0x33, 0x800) ioctl$SNDRV_PCM_IOCTL_UNLINK(r8, 0x4161, 0x0) (async) r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r10, 0x4068aea3, &(0x7f0000000000)={0xbe, 0x0, 0x1}) (async) ioctl$KVM_SET_MSRS(r10, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x12, 0x0, 0x81}]}) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x14, 0x39, 0x301, 0x70bd2d, 0xfffffffc, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x448c3}, 0x4c084) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x8081, 0x0) (async) r12 = syz_pidfd_open(0xffffffffffffffff, 0x0) (async) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) tkill(r13, 0x20) process_madvise(r12, 0x0, 0x0, 0x14, 0x0) 416.937561ms ago: executing program 4 (id=3496): r0 = socket$inet_udp(0x2, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000500)="66b8e8db3f3b0f23c80f21f86635000030000f23f82666f30fc772000fd5870a00baf80c66b8d500888d66efbafc0cecb85e098ec8660f57f62e0f01cfb800008ed00f3805d365f3d25c26", 0x4b}], 0x1, 0x7c, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000200)=ANY=[], 0x0, 0x9}, 0x94) syz_open_dev$I2C(&(0x7f0000000340), 0x8, 0x115080) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x102280}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r4, &(0x7f0000000400)={&(0x7f0000000040)={0xa, 0x4e20, 0x7a, @mcast2, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="3000000000000000290000000400000084020904000c00000402000304"], 0x30}, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000280)={@broadcast, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "ecff80", 0x48, 0x11, 0x0, @remote, @mcast2, {[], {0x0, 0x4e22, 0x48, 0x0, @wg=@cookie={0x4, 0x0, "7d91b3ccaf4c63521df8f969a9a3ef8377d86e2c440fb055", "8fc99fa615e832d5f00ce4a5807ebb53fbfc8fbe4761a7cfe44dcf957dbdc946"}}}}}}}, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000000380)=ANY=[@ANYRES8=r5, @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r0]) statx(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x4000, 0x1, &(0x7f0000000fc0)) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @multicast2, 0x4, 0x17}}) writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="2cb607a9fb80d88bfc9c0a0369d2fe5adb8d2e152f707955798e9827224eb6f741cec3c63645c63214fcf4a2f0a1cd4412b4e66b60af6707f9b2ad792038f67792b23d898bc1ed999f5cd52a1b12eda8986a6a2b9c2968f475813b77fc785112dba26176dcd4a3ca71c56575a50b2348ce867132887eaf2cf2e1e224bb91c72b029cd6ab9a6fe9313e71d7d24dcf5ed14ef9bc95", 0x94}, {&(0x7f00000001c0)="d3813428398c5e63a8f979bd", 0xc}], 0x2) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x4, [{0xa00}, {0x0, 0x100000000000000}]}, 0x68) 118.34559ms ago: executing program 5 (id=3497): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x4b102) ioctl$SG_BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000000c0)={'\x00', 0x21fd, 0xdd36, 0x80, 0x1df, 0x81}) (async) ioctl$SG_BLKTRACESTART(r0, 0x1274, 0x0) (async) ioctl$SG_BLKTRACETEARDOWN(r0, 0x1276, 0x3800) 0s ago: executing program 5 (id=3498): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x4b291000) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = fanotify_init(0x200, 0x0) r2 = dup(r1) write$binfmt_elf32(r2, 0x0, 0x4d) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000000)={'mangle\x00', 0x5, "f47e6aeb88"}, &(0x7f0000000100)=0x2d) kernel console output (not intermixed with test programs): 000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 828.701638][T16733] R13: 00007f9e8fc26038 R14: 00007f9e8fc25fa0 R15: 00007f9e8fd4fa48 [ 828.701668][T16733] [ 828.702657][T16733] syz.2.3181: vmalloc error: size 544, align 0x1, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 828.702725][T16733] CPU: 1 UID: 0 PID: 16733 Comm: syz.2.3181 Tainted: G L syzkaller #0 PREEMPT(full) [ 828.702754][T16733] Tainted: [L]=SOFTLOCKUP [ 828.702762][T16733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 828.702773][T16733] Call Trace: [ 828.702781][T16733] [ 828.702788][T16733] dump_stack_lvl+0xe8/0x150 [ 828.702817][T16733] warn_alloc+0x24d/0x270 [ 828.702846][T16733] ? lockdep_hardirqs_on+0x7b/0x110 [ 828.702875][T16733] ? __pfx_warn_alloc+0x10/0x10 [ 828.702900][T16733] ? kfree+0x1c5/0x650 [ 828.702930][T16733] ? __get_vm_area_node+0x219/0x2f0 [ 828.702962][T16733] __vmalloc_node_range_noprof+0x36b/0x1540 [ 828.702990][T16733] ? rcu_is_watching+0x16/0xb0 [ 828.703038][T16733] ? bpf_check+0x106b/0x2e10 [ 828.703060][T16733] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 828.703091][T16733] ? bpf_diag_init+0x87/0x140 [ 828.703110][T16733] ? bpf_diag_init+0x87/0x140 [ 828.703133][T16733] ? bpf_check+0x10ee/0x2e10 [ 828.703150][T16733] __vmalloc_noprof+0xd2/0x120 [ 828.703175][T16733] ? bpf_check+0x10ee/0x2e10 [ 828.703197][T16733] bpf_check+0x10ee/0x2e10 [ 828.703227][T16733] ? ktime_get_with_offset+0x93/0x2d0 [ 828.703250][T16733] ? __pfx_bpf_check+0x10/0x10 [ 828.703273][T16733] ? bpf_obj_name_cpy+0x194/0x1e0 [ 828.703301][T16733] bpf_prog_load+0x14d6/0x1c20 [ 828.703334][T16733] ? __pfx_bpf_prog_load+0x10/0x10 [ 828.703379][T16733] __sys_bpf+0xd0d/0xd90 [ 828.703408][T16733] ? __pfx___sys_bpf+0x10/0x10 [ 828.703439][T16733] ? __fget_files+0x2a/0x420 [ 828.703479][T16733] ? ksys_write+0x242/0x270 [ 828.703506][T16733] ? __pfx_ksys_write+0x10/0x10 [ 828.703537][T16733] __x64_sys_bpf+0xba/0xd0 [ 828.703559][T16733] do_syscall_64+0x166/0x520 [ 828.703585][T16733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.703604][T16733] ? clear_bhb_loop+0x70/0xc0 [ 828.703627][T16733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.703646][T16733] RIP: 0033:0x7f9e8f99e159 [ 828.703662][T16733] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 828.703678][T16733] RSP: 002b:00007f9e908cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 828.703697][T16733] RAX: ffffffffffffffda RBX: 00007f9e8fc25fa0 RCX: 00007f9e8f99e159 [ 828.703712][T16733] RDX: 0000000000000094 RSI: 00002000000001c0 RDI: 0000000000000005 [ 828.703724][T16733] RBP: 00007f9e908cf090 R08: 0000000000000000 R09: 0000000000000000 [ 828.703736][T16733] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 828.703748][T16733] R13: 00007f9e8fc26038 R14: 00007f9e8fc25fa0 R15: 00007f9e8fd4fa48 [ 828.703778][T16733] [ 828.703811][T16733] Mem-Info: [ 828.703821][T16733] active_anon:10696 inactive_anon:0 isolated_anon:0 [ 828.703821][T16733] active_file:1 inactive_file:61880 isolated_file:0 [ 828.703821][T16733] unevictable:0 dirty:225 writeback:0 [ 828.703821][T16733] slab_reclaimable:7378 slab_unreclaimable:103599 [ 828.703821][T16733] mapped:35662 shmem:5030 pagetables:1367 [ 828.703821][T16733] sec_pagetables:0 bounce:0 [ 828.703821][T16733] kernel_misc_reclaimable:0 [ 828.703821][T16733] free:1285384 free_pcp:13814 free_cma:0 [ 828.703870][T16733] Node 0 active_anon:42784kB inactive_anon:0kB active_file:4kB inactive_file:247296kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:142620kB dirty:896kB writeback:0kB shmem:20120kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14048kB pagetables:5332kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 828.703920][T16733] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:224kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 828.703993][T16733] Node 0 DMA free:15356kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 828.704054][T16733] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 828.704089][T16733] Node 0 DMA32 free:1213024kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:42784kB inactive_anon:0kB active_file:4kB inactive_file:247296kB unevictable:0kB writepending:896kB zspages:0kB present:3129332kB managed:2546704kB mlocked:0kB bounce:0kB free_pcp:33256kB local_pcp:10212kB free_cma:0kB [ 828.704165][T16733] lowmem_reserve[]: 0 0 0 0 0 [ 828.704198][T16733] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 828.704248][T16733] lowmem_reserve[]: 0 0 0 0 0 [ 828.706065][T16733] Node 1 Normal free:3913156kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:224kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:22000kB local_pcp:6340kB free_cma:0kB [ 828.706129][T16733] lowmem_reserve[]: 0 0 0 0 0 [ 828.706193][T16733] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 828.706364][T16733] Node 0 DMA32: 1092*4kB (UME) 594*8kB (UME) 718*16kB (UME) 1139*32kB (UME) 544*64kB (UME) 222*128kB (UME) 102*256kB (UME) 41*512kB (UME) 25*1024kB (ME) 20*2048kB (UM) 239*4096kB (UME) = 1212896kB [ 828.706543][T16733] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 828.706664][T16733] Node 1 Normal: 7*4kB (UM) 17*8kB (UM) 12*16kB (UM) 17*32kB (UM) 5*64kB (UM) 4*128kB (UM) 7*256kB (UM) 2*512kB (M) 3*1024kB (UM) 1*2048kB (M) 953*4096kB (UM) = 3913156kB [ 828.706838][T16733] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 828.706854][T16733] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 828.706870][T16733] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 828.706910][T16733] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 828.706925][T16733] 66907 total pagecache pages [ 828.706934][T16733] 0 pages in swap cache [ 828.706941][T16733] Free swap = 124996kB [ 828.706949][T16733] Total swap = 124996kB [ 828.706957][T16733] 2097051 pages RAM [ 828.706965][T16733] 0 pages HighMem/MovableOnly [ 828.706972][T16733] 428759 pages reserved [ 828.706980][T16733] 0 pages cma reserved [ 829.212942][T13262] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 829.213094][T13262] command write [95] error -8 [ 829.258475][T13262] usb 5-1: USB disconnect, device number 22 [ 829.786897][T16744] binder_alloc: 16743: binder_alloc_buf, no vma [ 829.801234][T16749] usb usb8: usbfs: process 16749 (syz.4.3185) did not claim interface 0 before use [ 829.853903][T16751] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3184'. [ 830.186921][T16757] FAULT_INJECTION: forcing a failure. [ 830.186921][T16757] name failslab, interval 1, probability 0, space 0, times 0 [ 830.186967][T16757] CPU: 0 UID: 0 PID: 16757 Comm: syz.0.3189 Tainted: G L syzkaller #0 PREEMPT(full) [ 830.186996][T16757] Tainted: [L]=SOFTLOCKUP [ 830.187005][T16757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 830.187016][T16757] Call Trace: [ 830.187024][T16757] [ 830.187033][T16757] dump_stack_lvl+0xe8/0x150 [ 830.187066][T16757] should_fail_ex+0x410/0x560 [ 830.187100][T16757] should_failslab+0xa8/0x100 [ 830.187123][T16757] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 830.187162][T16757] kmem_cache_alloc_noprof+0xa1/0x600 [ 830.187188][T16757] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 830.187213][T16757] ? kmem_cache_alloc_noprof+0x156/0x600 [ 830.187238][T16757] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 830.187272][T16757] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 830.187310][T16757] mmu_topup_memory_caches+0x21/0x170 [ 830.187342][T16757] kvm_mmu_load+0x9d/0x21e0 [ 830.187364][T16757] ? kvm_msr_allowed+0x9a/0x490 [ 830.187383][T16757] ? kvm_msr_allowed+0x9a/0x490 [ 830.187402][T16757] ? kvm_msr_allowed+0x9a/0x490 [ 830.187420][T16757] ? kvm_msr_allowed+0x3f4/0x490 [ 830.187438][T16757] ? kvm_msr_allowed+0x9a/0x490 [ 830.187456][T16757] ? kvm_apic_has_interrupt+0x740/0x770 [ 830.187492][T16757] vcpu_run+0x4f68/0x79b0 [ 830.187537][T16757] ? trace_pelt_se_tp+0x3b/0x150 [ 830.187615][T16757] ? __pfx_vcpu_run+0x10/0x10 [ 830.187642][T16757] ? lock_acquire+0x115/0x350 [ 830.187677][T16757] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 830.187708][T16757] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 830.187737][T16757] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 830.187762][T16757] kvm_vcpu_ioctl+0xa61/0xfd0 [ 830.187788][T16757] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 830.187806][T16757] ? hook_file_ioctl+0x1f2/0x600 [ 830.187846][T16757] ? __fget_files+0x2a/0x420 [ 830.187881][T16757] ? __fget_files+0x2a/0x420 [ 830.187903][T16757] ? __fget_files+0x3a2/0x420 [ 830.187926][T16757] ? __fget_files+0x2a/0x420 [ 830.187952][T16757] ? bpf_lsm_file_ioctl+0x9/0x20 [ 830.187977][T16757] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 830.187997][T16757] __se_sys_ioctl+0xfc/0x170 [ 830.188020][T16757] do_syscall_64+0x166/0x520 [ 830.188047][T16757] ? trace_irq_disable+0x3b/0x140 [ 830.188065][T16757] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 830.188085][T16757] ? clear_bhb_loop+0x70/0xc0 [ 830.188108][T16757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 830.188127][T16757] RIP: 0033:0x7efda019e159 [ 830.188145][T16757] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 830.188161][T16757] RSP: 002b:00007efda1005028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 830.188183][T16757] RAX: ffffffffffffffda RBX: 00007efda0425fa0 RCX: 00007efda019e159 [ 830.188198][T16757] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000084 [ 830.188210][T16757] RBP: 00007efda1005090 R08: 0000000000000000 R09: 0000000000000000 [ 830.188222][T16757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 830.188234][T16757] R13: 00007efda0426038 R14: 00007efda0425fa0 R15: 00007efda054fa48 [ 830.188265][T16757] [ 830.527503][ T6543] usb 6-1: USB disconnect, device number 55 [ 830.573522][T16762] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3190'. [ 830.899922][T16773] syzkaller0: entered promiscuous mode [ 830.899967][T16773] syzkaller0: entered allmulticast mode [ 831.188781][T13262] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 831.271740][ T48] usb 3-1: new full-speed USB device number 34 using dummy_hcd [ 831.305523][T16782] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3197'. [ 831.350321][T13262] usb 6-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 831.362654][T13262] usb 6-1: config 6 has an invalid interface number: 14 but max is 0 [ 831.371384][T13262] usb 6-1: config 6 has no interface number 0 [ 831.377690][T13262] usb 6-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 831.388713][T13262] usb 6-1: config 6 interface 14 has no altsetting 0 [ 831.398846][T13262] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 831.407454][T13262] usb 6-1: Product: syz [ 831.412309][T13262] usb 6-1: Manufacturer: syz [ 831.418229][T13262] usb 6-1: SerialNumber: syz [ 831.430109][ T48] usb 3-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 831.443122][ T48] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 831.443235][ T48] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 831.443276][ T48] usb 3-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 831.443354][ T48] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 831.622217][T16792] FAULT_INJECTION: forcing a failure. [ 831.622217][T16792] name failslab, interval 1, probability 0, space 0, times 0 [ 831.622278][T16792] CPU: 0 UID: 0 PID: 16792 Comm: syz.0.3202 Tainted: G L syzkaller #0 PREEMPT(full) [ 831.622309][T16792] Tainted: [L]=SOFTLOCKUP [ 831.622318][T16792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 831.622330][T16792] Call Trace: [ 831.622339][T16792] [ 831.622348][T16792] dump_stack_lvl+0xe8/0x150 [ 831.622384][T16792] should_fail_ex+0x410/0x560 [ 831.622434][T16792] should_failslab+0xa8/0x100 [ 831.622462][T16792] __kmalloc_cache_noprof+0xa3/0x600 [ 831.622494][T16792] ? nf_tables_newtable+0x43e/0x1990 [ 831.622582][T16792] ? nf_tables_newtable+0x43e/0x1990 [ 831.622613][T16792] nf_tables_newtable+0x43e/0x1990 [ 831.622659][T16792] nfnetlink_rcv+0x1288/0x28c0 [ 831.622724][T16792] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 831.622766][T16792] ? ref_tracker_free+0x689/0x830 [ 831.622814][T16792] ? skb_clone+0x246/0x3a0 [ 831.622844][T16792] ? __netlink_deliver_tap+0x811/0x860 [ 831.622882][T16792] ? netlink_deliver_tap+0x2e/0x1b0 [ 831.622907][T16792] ? netlink_deliver_tap+0x2e/0x1b0 [ 831.622937][T16792] netlink_unicast+0x7bd/0x940 [ 831.622975][T16792] netlink_sendmsg+0x813/0xb40 [ 831.623013][T16792] ? __pfx_netlink_sendmsg+0x10/0x10 [ 831.623049][T16792] ? apparmor_socket_sendmsg+0x98/0x360 [ 831.623082][T16792] ? __pfx_netlink_sendmsg+0x10/0x10 [ 831.623107][T16792] sock_sendmsg_nosec+0x13a/0x180 [ 831.623138][T16792] ____sys_sendmsg+0x54e/0x850 [ 831.623163][T16792] ? __pfx_____sys_sendmsg+0x10/0x10 [ 831.623192][T16792] ? import_iovec+0x73/0xa0 [ 831.623217][T16792] ___sys_sendmsg+0x2a5/0x360 [ 831.623237][T16792] ? __lock_acquire+0x6df/0x2e50 [ 831.623261][T16792] ? __pfx____sys_sendmsg+0x10/0x10 [ 831.623316][T16792] ? __fget_files+0x2a/0x420 [ 831.623339][T16792] ? __fget_files+0x3a2/0x420 [ 831.623372][T16792] __x64_sys_sendmsg+0x1b1/0x290 [ 831.623396][T16792] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 831.623446][T16792] do_syscall_64+0x166/0x520 [ 831.623472][T16792] ? trace_irq_disable+0x3b/0x140 [ 831.623490][T16792] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.623510][T16792] ? clear_bhb_loop+0x70/0xc0 [ 831.623533][T16792] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.623551][T16792] RIP: 0033:0x7efda019e159 [ 831.623571][T16792] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 831.623587][T16792] RSP: 002b:00007efda1005028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 831.623609][T16792] RAX: ffffffffffffffda RBX: 00007efda0425fa0 RCX: 00007efda019e159 [ 831.623623][T16792] RDX: 0000000000000040 RSI: 0000200000009b40 RDI: 0000000000000003 [ 831.623635][T16792] RBP: 00007efda1005090 R08: 0000000000000000 R09: 0000000000000000 [ 831.623648][T16792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 831.623659][T16792] R13: 00007efda0426038 R14: 00007efda0425fa0 R15: 00007efda054fa48 [ 831.623690][T16792] [ 831.951145][ T6543] usb 5-1: new full-speed USB device number 23 using dummy_hcd [ 831.980219][ T48] dvb_ttusb_budget: ttusb_init_controller: error [ 831.987349][ T48] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 832.081252][ T48] DVB: Unable to find symbol stv0299_attach() [ 832.101412][ T6543] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 832.108361][ T6543] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 0, changing to 4 [ 832.108403][ T6543] usb 5-1: config 0 interface 0 has no altsetting 0 [ 832.131568][ T6543] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 832.131624][ T6543] usb 5-1: Product: syz [ 832.131642][ T6543] usb 5-1: Manufacturer: syz [ 832.131666][ T6543] usb 5-1: SerialNumber: syz [ 832.173007][ T6543] usb 5-1: config 0 descriptor?? [ 832.212984][ T6543] usb 5-1: selecting invalid altsetting 0 [ 832.219530][T16806] fuse: Unknown parameter '' [ 832.304053][ T48] DVB: Unable to find symbol tda8083_attach() [ 832.310329][ T48] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 832.416898][T16793] snd-usb-audio 5-1:0.0: Runtime PM usage count underflow! [ 832.438689][ T6543] usb 5-1: USB disconnect, device number 23 [ 832.552331][ T48] usb 3-1: USB disconnect, device number 34 [ 832.733189][T16814] udevd[16814]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 832.796918][T13262] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 832.797091][T13262] command write [95] error -8 [ 832.837769][T13262] usb 6-1: USB disconnect, device number 56 [ 833.124530][T16825] FAULT_INJECTION: forcing a failure. [ 833.124530][T16825] name failslab, interval 1, probability 0, space 0, times 0 [ 833.138652][T16825] CPU: 1 UID: 0 PID: 16825 Comm: syz.3.3208 Tainted: G L syzkaller #0 PREEMPT(full) [ 833.138689][T16825] Tainted: [L]=SOFTLOCKUP [ 833.138697][T16825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 833.138710][T16825] Call Trace: [ 833.138718][T16825] [ 833.138728][T16825] dump_stack_lvl+0xe8/0x150 [ 833.138766][T16825] should_fail_ex+0x410/0x560 [ 833.138802][T16825] ? __alloc_skb+0x1db/0x7a0 [ 833.138823][T16825] should_failslab+0xa8/0x100 [ 833.138864][T16825] ? __alloc_skb+0x1db/0x7a0 [ 833.138882][T16825] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 833.138912][T16825] ? __alloc_skb+0x18d/0x7a0 [ 833.138932][T16825] ? __alloc_skb+0x1db/0x7a0 [ 833.138958][T16825] __alloc_skb+0x1db/0x7a0 [ 833.138982][T16825] alloc_skb_with_frags+0xc6/0x760 [ 833.139005][T16825] ? __lock_acquire+0x6df/0x2e50 [ 833.139035][T16825] sock_alloc_send_pskb+0x878/0x990 [ 833.139066][T16825] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 833.139097][T16825] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 833.139126][T16825] ? dev_get_by_index+0x22/0x2d0 [ 833.139151][T16825] ? dev_get_by_index+0x22/0x2d0 [ 833.139183][T16825] packet_sendmsg+0x31bb/0x4f80 [ 833.139211][T16825] ? up_write+0x19d/0x4a0 [ 833.139254][T16825] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 833.139286][T16825] ? __pfx_process_measurement+0x10/0x10 [ 833.139320][T16825] ? lock_acquire+0x115/0x350 [ 833.139342][T16825] ? __lock_acquire+0x6df/0x2e50 [ 833.139371][T16825] ? __pfx_packet_sendmsg+0x10/0x10 [ 833.139396][T16825] ? aa_sk_perm+0x713/0x900 [ 833.139415][T16825] ? __lock_acquire+0x6df/0x2e50 [ 833.139440][T16825] ? lockdep_unlock+0x60/0xd0 [ 833.139467][T16825] ? __pfx_aa_sk_perm+0x10/0x10 [ 833.139491][T16825] ? aa_sock_msg_perm+0x144/0x210 [ 833.139518][T16825] ? apparmor_socket_sendmsg+0x26d/0x360 [ 833.139549][T16825] ? __pfx_packet_sendmsg+0x10/0x10 [ 833.139575][T16825] sock_sendmsg_nosec+0x13a/0x180 [ 833.139606][T16825] ____sys_sendmsg+0x54e/0x850 [ 833.139635][T16825] ? __pfx_____sys_sendmsg+0x10/0x10 [ 833.139667][T16825] ? import_iovec+0x73/0xa0 [ 833.139693][T16825] ___sys_sendmsg+0x2a5/0x360 [ 833.139714][T16825] ? __lock_acquire+0x6df/0x2e50 [ 833.139738][T16825] ? __pfx____sys_sendmsg+0x10/0x10 [ 833.139795][T16825] ? __fget_files+0x2a/0x420 [ 833.139821][T16825] ? __fget_files+0x3a2/0x420 [ 833.139866][T16825] __x64_sys_sendmsg+0x1b1/0x290 [ 833.139892][T16825] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 833.139936][T16825] do_syscall_64+0x166/0x520 [ 833.139964][T16825] ? trace_irq_disable+0x3b/0x140 [ 833.139989][T16825] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.140011][T16825] ? clear_bhb_loop+0x70/0xc0 [ 833.140037][T16825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.140056][T16825] RIP: 0033:0x7fd012b9e159 [ 833.140077][T16825] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 833.140096][T16825] RSP: 002b:00007fd013a3f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 833.140120][T16825] RAX: ffffffffffffffda RBX: 00007fd012e26270 RCX: 00007fd012b9e159 [ 833.140135][T16825] RDX: 0000000020004014 RSI: 00002000000000c0 RDI: 0000000000000008 [ 833.140149][T16825] RBP: 00007fd013a3f090 R08: 0000000000000000 R09: 0000000000000000 [ 833.140162][T16825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 833.140175][T16825] R13: 00007fd012e26308 R14: 00007fd012e26270 R15: 00007fd012f4fa48 [ 833.140209][T16825] [ 833.218179][T16826] syzkaller0: entered promiscuous mode [ 833.218204][T16826] syzkaller0: entered allmulticast mode [ 833.540905][T16838] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3213'. [ 833.596769][T16843] netlink: 'syz.0.3214': attribute type 8 has an invalid length. [ 833.747974][T16838] 8021q: adding VLAN 0 to HW filter on device bond1 [ 836.001369][T13268] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 836.176530][T13268] usb 1-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 836.178152][T13268] usb 1-1: config 6 has an invalid interface number: 14 but max is 0 [ 836.178199][T13268] usb 1-1: config 6 has no interface number 0 [ 836.178245][T13268] usb 1-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 836.178272][T13268] usb 1-1: config 6 interface 14 has no altsetting 0 [ 836.181305][T13268] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.181338][T13268] usb 1-1: Product: syz [ 836.181367][T13268] usb 1-1: Manufacturer: syz [ 836.181386][T13268] usb 1-1: SerialNumber: syz [ 838.947113][ T6543] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 839.028835][T13262] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 839.101333][ T6543] usb 6-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 839.103904][ T6543] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 839.123211][ T6543] usb 6-1: config 0 descriptor?? [ 839.140268][ T6543] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 839.165670][T13268] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 839.175927][T13268] command write [95] error -8 [ 839.189063][T13268] usb 1-1: USB disconnect, device number 20 [ 839.200535][T13262] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00 [ 839.211903][T13262] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 839.211955][T13262] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 839.211996][T13262] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 839.254765][T13262] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 839.265286][T13262] usb 4-1: Product: syz [ 839.265337][T13262] usb 4-1: Manufacturer: syz [ 839.265357][T13262] usb 4-1: SerialNumber: syz [ 839.288280][T16870] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 839.297767][T16870] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 839.309063][T16883] netlink: ct_mark mask cannot be 0 [ 839.309125][T16883] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 839.334591][T13262] cyberjack 4-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 839.352319][T13262] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 839.395072][T16879] ip_tables: iptables: counters copy to user failed while replacing table [ 839.828814][T13268] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 840.009235][T13268] usb 1-1: Using ep0 maxpacket: 8 [ 840.015118][T13268] usb 1-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 840.026597][T13268] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 840.038149][T13268] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 840.050894][T13268] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 840.050970][T13268] usb 1-1: Product: syz [ 840.050987][T13268] usb 1-1: Manufacturer: syz [ 840.051000][T13268] usb 1-1: SerialNumber: syz [ 840.284596][T16883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 840.285344][T16883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 840.435937][T13268] usb 1-1: 6:0: cannot get min/max values for control 8 (id 6) [ 840.436723][T13268] usb 1-1: unit 4 not found! [ 840.663893][T13268] usb 1-1: USB disconnect, device number 21 [ 840.774447][T16820] udevd[16820]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 841.016010][ T6543] usb 6-1: USB disconnect, device number 57 [ 841.159219][T13268] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 841.268208][T16915] fuse: Bad value for 'fd' [ 841.308707][T13268] usb 5-1: Using ep0 maxpacket: 32 [ 841.310389][T13268] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 841.311908][T13268] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 841.311958][T13268] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 841.312011][T13268] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 841.312036][T13268] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 841.314854][T13268] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.314877][T13268] usb 5-1: Product: syz [ 841.314891][T13268] usb 5-1: Manufacturer: syz [ 841.314905][T13268] usb 5-1: SerialNumber: syz [ 841.328605][ T1816] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 841.333989][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 841.342831][T13268] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input67 [ 841.489588][ T1816] usb 3-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 841.491195][ T1816] usb 3-1: config 6 has an invalid interface number: 14 but max is 0 [ 841.491263][ T1816] usb 3-1: config 6 has no interface number 0 [ 841.491304][ T1816] usb 3-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 841.491326][ T1816] usb 3-1: config 6 interface 14 has no altsetting 0 [ 841.501097][ T1816] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.501125][ T1816] usb 3-1: Product: syz [ 841.501172][ T1816] usb 3-1: Manufacturer: syz [ 841.501186][ T1816] usb 3-1: SerialNumber: syz [ 841.578833][T13268] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 841.578923][T13268] (id 0x00) [ 841.748719][T13268] rc_core: IR keymap rc-imon-pad not found [ 841.748816][T13268] Registered IR keymap rc-empty [ 841.748901][T13268] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 841.748955][T13268] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 841.799500][T13268] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 841.804523][T13268] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input68 [ 841.819505][T13268] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:24> initialized [ 841.839604][ T6543] usb 1-1: new low-speed USB device number 22 using dummy_hcd [ 841.877474][T13242] usb 4-1: USB disconnect, device number 16 [ 841.969375][T13262] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 842.004407][ T6543] usb 1-1: New USB device found, idVendor=e471, idProduct=6859, bcdDevice=77.4f [ 842.025027][ T6543] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 842.025086][ T6543] usb 1-1: can't read configurations, error -61 [ 842.057081][T13242] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 842.070568][T13242] cyberjack 4-1:1.0: device disconnected [ 842.119558][T16929] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3243'. [ 842.142939][T13262] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 842.151842][T13262] usb 6-1: config index 0 descriptor too short (expected 65183, got 72) [ 842.163705][T13262] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.163752][T13262] usb 6-1: Product: syz [ 842.165995][T13262] usb 6-1: Manufacturer: syz [ 842.166013][T13262] usb 6-1: SerialNumber: syz [ 842.188202][ T6543] usb 1-1: new low-speed USB device number 23 using dummy_hcd [ 842.212427][T16927] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 842.213013][T16927] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 842.250161][T13264] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 842.340024][ T6543] usb 1-1: New USB device found, idVendor=e471, idProduct=6859, bcdDevice=77.4f [ 842.352002][ T6543] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 842.359762][ T6543] usb 1-1: can't read configurations, error -61 [ 842.366823][ T6543] usb usb1-port1: attempt power cycle [ 842.458600][T13242] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 842.465499][T16921] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 842.466272][T16921] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 842.493303][T13262] usb 6-1: USB disconnect, device number 58 [ 842.515957][ T1816] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 842.516302][ T1816] command write [95] error -8 [ 842.558005][ T1816] usb 3-1: USB disconnect, device number 35 [ 842.638661][T13242] usb 4-1: Using ep0 maxpacket: 32 [ 842.644875][T13242] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 842.656182][T13242] usb 4-1: config 0 has no interfaces? [ 842.665239][T13242] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.665309][T13242] usb 4-1: Product: syz [ 842.665375][T13242] usb 4-1: Manufacturer: syz [ 842.665394][T13242] usb 4-1: SerialNumber: syz [ 842.690812][T13242] usb 4-1: config 0 descriptor?? [ 842.720083][ T6543] usb 1-1: new low-speed USB device number 24 using dummy_hcd [ 842.750444][ T6543] usb 1-1: New USB device found, idVendor=e471, idProduct=6859, bcdDevice=77.4f [ 842.761330][ T6543] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 842.769707][ T6543] usb 1-1: can't read configurations, error -61 [ 842.898823][ T6543] usb 1-1: new low-speed USB device number 25 using dummy_hcd [ 842.909599][T13268] usb 4-1: USB disconnect, device number 17 [ 842.921761][ T6543] usb 1-1: New USB device found, idVendor=e471, idProduct=6859, bcdDevice=77.4f [ 842.937984][ T6543] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 842.938045][ T6543] usb 1-1: can't read configurations, error -61 [ 842.940580][ T1816] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 842.952685][ T6543] usb usb1-port1: unable to enumerate USB device [ 842.990925][T16938] imon:send_packet: task interrupted [ 842.990956][T16938] imon:send_packet: packet tx failed (-512) [ 842.995919][T16938] imon:vfd_write: send packet #3 failed [ 843.014221][ T6543] usb 5-1: USB disconnect, device number 24 [ 843.090539][ T1816] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 843.101299][ T1816] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 843.101345][ T1816] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 843.101572][ T1816] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 843.101620][ T1816] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 843.103245][ T1816] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 843.103267][ T1816] usb 3-1: Product: syz [ 843.103281][ T1816] usb 3-1: Manufacturer: syz [ 843.110476][ T1816] cdc_wdm 3-1:1.0: skipping garbage [ 843.110498][ T1816] cdc_wdm 3-1:1.0: skipping garbage [ 843.114202][ T1816] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 843.114224][ T1816] cdc_wdm 3-1:1.0: Unknown control protocol [ 843.298788][T13264] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 843.299040][T13264] ath9k_htc: Failed to initialize the device [ 843.304693][T13262] usb 6-1: ath9k_htc: USB layer deinitialized [ 843.329537][ T1816] usb 3-1: USB disconnect, device number 36 [ 843.605279][T16943] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 843.605315][T16943] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 843.613446][T13262] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 843.670458][T16945] FAULT_INJECTION: forcing a failure. [ 843.670458][T16945] name failslab, interval 1, probability 0, space 0, times 0 [ 843.670508][T16945] CPU: 1 UID: 0 PID: 16945 Comm: syz.3.3245 Tainted: G L syzkaller #0 PREEMPT(full) [ 843.670537][T16945] Tainted: [L]=SOFTLOCKUP [ 843.670546][T16945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 843.670556][T16945] Call Trace: [ 843.670563][T16945] [ 843.670571][T16945] dump_stack_lvl+0xe8/0x150 [ 843.670604][T16945] should_fail_ex+0x410/0x560 [ 843.670639][T16945] should_failslab+0xa8/0x100 [ 843.670664][T16945] kmem_cache_alloc_lru_noprof+0xa7/0x5f0 [ 843.670693][T16945] ? fuse_alloc_inode+0x2e/0x170 [ 843.670794][T16945] ? fuse_alloc_inode+0x2e/0x170 [ 843.670821][T16945] fuse_alloc_inode+0x2e/0x170 [ 843.670842][T16945] ? __pfx_fuse_alloc_inode+0x10/0x10 [ 843.670861][T16945] alloc_inode+0x6a/0x1b0 [ 843.670883][T16945] ? __pfx_fuse_inode_eq+0x10/0x10 [ 843.670901][T16945] ? __pfx_fuse_inode_set+0x10/0x10 [ 843.670918][T16945] iget5_locked+0x4a/0xa0 [ 843.670946][T16945] fuse_iget+0x37d/0x9d0 [ 843.670977][T16945] ? __pfx_fuse_iget+0x10/0x10 [ 843.671005][T16945] fuse_lookup_name+0x703/0x870 [ 843.671051][T16945] ? trace_contention_end+0x3d/0x140 [ 843.671086][T16945] ? __pfx_fuse_lookup_name+0x10/0x10 [ 843.671138][T16945] fuse_lookup+0x20b/0x4f0 [ 843.671157][T16945] ? __kasan_kmalloc+0x93/0xb0 [ 843.671183][T16945] ? __pfx_fuse_lookup+0x10/0x10 [ 843.671223][T16945] ? d_alloc+0x144/0x190 [ 843.671252][T16945] lookup_one_qstr_excl+0x12d/0x360 [ 843.671284][T16945] __start_renaming+0x185/0x410 [ 843.671319][T16945] filename_renameat2+0x3a0/0x9a0 [ 843.671364][T16945] ? __pfx_filename_renameat2+0x10/0x10 [ 843.671402][T16945] ? do_getname+0x151/0x250 [ 843.671427][T16945] __se_sys_rename+0x55/0x2c0 [ 843.671453][T16945] do_syscall_64+0x166/0x520 [ 843.671480][T16945] ? trace_irq_disable+0x3b/0x140 [ 843.671498][T16945] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.671517][T16945] ? clear_bhb_loop+0x70/0xc0 [ 843.671541][T16945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.671559][T16945] RIP: 0033:0x7fd012b9e159 [ 843.671578][T16945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 843.671594][T16945] RSP: 002b:00007fd013a60028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 843.671627][T16945] RAX: ffffffffffffffda RBX: 00007fd012e26180 RCX: 00007fd012b9e159 [ 843.671647][T16945] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000200000000100 [ 843.671660][T16945] RBP: 00007fd013a60090 R08: 0000000000000000 R09: 0000000000000000 [ 843.671671][T16945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 843.671683][T16945] R13: 00007fd012e26218 R14: 00007fd012e26180 R15: 00007fd012f4fa48 [ 843.671714][T16945] [ 843.769872][ T1816] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 843.788920][T13262] usb 6-1: Using ep0 maxpacket: 32 [ 843.789796][T13262] usb 6-1: New USB device found, idVendor=110a, idProduct=2210, bcdDevice= 1.08 [ 843.791121][T13262] usb 6-1: config index 0 descriptor too short (expected 65183, got 72) [ 843.793504][T13262] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 843.793527][T13262] usb 6-1: Product: syz [ 843.793541][T13262] usb 6-1: Manufacturer: syz [ 843.793555][T13262] usb 6-1: SerialNumber: syz [ 843.815578][T13262] mos7840 6-1:1.0: missing endpoints [ 843.919513][ T1816] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 843.920717][ T1816] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 843.920740][ T1816] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 843.920759][ T1816] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 843.920801][ T1816] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 843.922592][ T1816] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 843.922613][ T1816] usb 3-1: Product: syz [ 843.922626][ T1816] usb 3-1: Manufacturer: syz [ 843.935990][ T1816] cdc_wdm 3-1:1.0: skipping garbage [ 843.936011][ T1816] cdc_wdm 3-1:1.0: skipping garbage [ 843.943825][ T1816] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 843.943847][ T1816] cdc_wdm 3-1:1.0: Unknown control protocol [ 843.944484][ T6543] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 844.144007][T16937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 844.155666][T16937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 844.163662][ T6543] usb 5-1: Using ep0 maxpacket: 8 [ 844.176348][ T6543] usb 5-1: unable to get BOS descriptor or descriptor too short [ 844.176422][ T6543] usb 5-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 844.198451][ T6543] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 844.206842][ T6543] usb 5-1: Product: syz [ 844.211629][ T6543] usb 5-1: Manufacturer: syz [ 844.216322][ T6543] usb 5-1: SerialNumber: syz [ 844.366147][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 844.374585][T16937] syz_tun: entered allmulticast mode [ 844.418297][T16937] pimreg: entered allmulticast mode [ 844.462216][ T6543] usb 5-1: selecting invalid altsetting 1 [ 844.566250][ T6543] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 844.595439][ T6543] usb 5-1: USB disconnect, device number 25 [ 844.657459][T16820] udevd[16820]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 845.031441][ T6543] usb 3-1: USB disconnect, device number 37 [ 845.512316][ T6543] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 845.543480][T13264] usb 6-1: USB disconnect, device number 59 [ 845.603149][T16982] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3257'. [ 845.675020][ T6543] usb 3-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 845.687468][ T6543] usb 3-1: config 6 has an invalid interface number: 14 but max is 0 [ 845.687515][ T6543] usb 3-1: config 6 has no interface number 0 [ 845.687572][ T6543] usb 3-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 845.687600][ T6543] usb 3-1: config 6 interface 14 has no altsetting 0 [ 845.725667][ T6543] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 845.734126][ T6543] usb 3-1: Product: syz [ 845.738639][ T6543] usb 3-1: Manufacturer: syz [ 845.743452][ T6543] usb 3-1: SerialNumber: syz [ 845.998876][T13242] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 846.158675][T13242] usb 4-1: Using ep0 maxpacket: 32 [ 846.168052][T13242] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 846.181775][T13242] usb 4-1: config 0 has no interfaces? [ 846.199687][ T6538] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 846.212926][T13242] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.213013][T13242] usb 4-1: Product: syz [ 846.213050][T13242] usb 4-1: Manufacturer: syz [ 846.213071][T13242] usb 4-1: SerialNumber: syz [ 846.243712][T13242] usb 4-1: config 0 descriptor?? [ 846.372306][ T6538] usb 1-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 846.389666][ T6538] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.397947][ T6538] usb 1-1: Product: syz [ 846.397996][ T6538] usb 1-1: Manufacturer: syz [ 846.398007][ T6538] usb 1-1: SerialNumber: syz [ 846.418048][ T6538] usb 1-1: config 0 descriptor?? [ 846.446942][ T6538] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 846.463569][ T6538] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 846.473890][ T6538] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 846.473944][ T6538] usb 1-1: media controller created [ 846.518621][ T6538] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 846.726527][ T6538] DVB: Unable to find symbol mt352_attach() [ 846.799936][ T6538] DVB: Unable to find symbol nxt6000_attach() [ 846.799964][ T6538] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 846.811159][ T6538] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input69 [ 846.830189][ T6538] dvb-usb: schedule remote query interval to 1000 msecs. [ 846.830245][ T6538] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 846.830265][ T6538] dvb-usb: bulk message failed: -22 (7/0) [ 846.830281][ T6538] dvb-usb: bulk message failed: -22 (7/0) [ 846.843468][ T6538] usb 1-1: USB disconnect, device number 26 [ 846.991179][ T6543] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 846.997064][ T6543] command write [95] error -8 [ 847.036675][ T6543] usb 3-1: USB disconnect, device number 38 [ 847.107803][ T6538] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 847.317042][T17004] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3262'. [ 847.452308][T17008] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3263'. [ 847.474223][T17008] bridge_slave_1: left allmulticast mode [ 847.474299][T17008] bridge_slave_1: left promiscuous mode [ 847.474540][T17008] bridge0: port 2(bridge_slave_1) entered disabled state [ 847.495637][T17008] bridge_slave_0: left allmulticast mode [ 847.495948][T17008] bridge_slave_0: left promiscuous mode [ 847.498181][T17008] bridge0: port 1(bridge_slave_0) entered disabled state [ 848.359008][ T6538] usb 3-1: new full-speed USB device number 39 using dummy_hcd [ 848.510482][ T6538] usb 3-1: not running at top speed; connect to a high speed hub [ 848.510533][ T6538] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 848.514067][ T6538] usb 3-1: config index 0 descriptor too short (expected 161, got 153) [ 848.514095][ T6538] usb 3-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 848.514152][ T6538] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 848.548144][T13264] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 848.554621][ T6538] gspca_main: spca501-2.14.0 probing 0000:0000 [ 848.707086][T13264] usb 6-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 848.719056][T13264] usb 6-1: config 6 has an invalid interface number: 14 but max is 0 [ 848.719103][T13264] usb 6-1: config 6 has no interface number 0 [ 848.719150][T13264] usb 6-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 848.719180][T13264] usb 6-1: config 6 interface 14 has no altsetting 0 [ 848.756155][T13264] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 848.764435][T13264] usb 6-1: Product: syz [ 848.764460][T13264] usb 6-1: Manufacturer: syz [ 848.764477][T13264] usb 6-1: SerialNumber: syz [ 848.832428][ T1816] usb 4-1: USB disconnect, device number 18 [ 849.097850][ T49] IPVS: starting estimator thread 0... [ 849.188724][T17037] IPVS: using max 26 ests per chain, 62400 per kthread [ 849.301967][ T6538] gspca_spca501: reg write: error -110 [ 849.302009][ T6538] spca501 3-1:1.0: Reg write failed for 0x02,0xa048,0x00 [ 849.302125][ T6538] spca501 3-1:1.0: probe with driver spca501 failed with error -22 [ 849.303217][ T6538] uvcvideo 3-1:1.0: Found UVC 1.00 device (0000:0000) [ 849.310344][ T6538] uvcvideo 3-1:1.0: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 849.312316][ T6538] uvcvideo 3-1:1.1: Failed to query (GET_CUR) UVC probe control : -32 (exp. 26). [ 849.312369][ T6538] uvcvideo 3-1:1.1: Failed to initialize the device (-5). [ 849.312992][ T6538] uvcvideo 3-1:1.0: probe with driver uvcvideo failed with error -5 [ 849.518151][T17025] could not allocate digest TFM handle xxhash64-generic [ 849.688741][ T6538] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 849.778847][T13272] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 849.799930][ T1816] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 849.838648][ T6538] usb 1-1: Using ep0 maxpacket: 8 [ 849.839416][ T6538] usb 1-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice= 0.40 [ 849.840596][ T6538] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 849.840618][ T6538] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 849.840681][ T6538] usb 1-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 849.842855][ T6538] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 849.842878][ T6538] usb 1-1: Product: syz [ 849.842891][ T6538] usb 1-1: Manufacturer: syz [ 849.842906][ T6538] usb 1-1: SerialNumber: syz [ 849.929508][T13272] usb 4-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 849.934247][T13272] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 849.934275][T13272] usb 4-1: Product: syz [ 849.934290][T13272] usb 4-1: Manufacturer: syz [ 849.934304][T13272] usb 4-1: SerialNumber: syz [ 849.937842][T13272] usb 4-1: config 0 descriptor?? [ 849.949289][T13272] usb 4-1: selecting invalid altsetting 1 [ 849.949311][T13272] technisat-usb2: could not set alternate setting to 0 [ 849.974584][ T1816] usb 5-1: Using ep0 maxpacket: 32 [ 849.989676][ T1816] usb 5-1: unable to get BOS descriptor or descriptor too short [ 849.989773][ T1816] usb 5-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 849.991405][ T1816] usb 5-1: config 128 has an invalid interface number: 127 but max is 3 [ 849.991429][ T1816] usb 5-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 849.991447][ T1816] usb 5-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 849.991467][ T1816] usb 5-1: config 128 has no interface number 0 [ 849.991530][ T1816] usb 5-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 52, changing to 9 [ 849.991556][ T1816] usb 5-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid maxpacket 1040, setting to 1024 [ 849.991581][ T1816] usb 5-1: config 128 interface 127 has no altsetting 0 [ 849.994687][ T1816] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 849.994710][ T1816] usb 5-1: Product: syz [ 849.994724][ T1816] usb 5-1: Manufacturer: syz [ 849.994738][ T1816] usb 5-1: SerialNumber: syz [ 850.000128][T17055] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 850.043895][T13264] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 850.044083][T13264] command write [95] error -8 [ 850.074046][T13264] usb 6-1: USB disconnect, device number 60 [ 850.142794][T13272] technisat-usb2: firmware version: 0.0 [ 850.148616][T13272] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 850.543276][ T1816] usb 5-1: USB disconnect, device number 26 [ 850.644210][T13272] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 850.647388][T13264] usb 3-1: USB disconnect, device number 39 [ 850.791784][T16464] udevd[16464]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 850.811382][T13272] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) error while loading driver (-19) [ 850.837784][T13272] usb 4-1: USB disconnect, device number 19 [ 851.105517][T17076] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3280'. [ 851.198866][T17076] tipc: Started in network mode [ 851.205138][T17076] tipc: Node identity ac1414aa, cluster identity 4711 [ 851.224760][T17076] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 851.232843][T17076] tipc: Enabled bearer , priority 10 [ 851.359179][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 851.498625][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 851.638762][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 851.778961][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 851.918662][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 851.921141][T17088] bridge0: port 1(bridge_slave_0) entered disabled state [ 851.927539][T17088] bridge0: port 2(bridge_slave_1) entered disabled state [ 852.058702][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 852.059144][ T1816] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 852.198613][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 852.209312][ T1816] usb 5-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 852.225523][ T1816] usb 5-1: config 6 has an invalid interface number: 14 but max is 0 [ 852.225580][ T1816] usb 5-1: config 6 has no interface number 0 [ 852.225961][ T1816] usb 5-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 852.225987][ T1816] usb 5-1: config 6 interface 14 has no altsetting 0 [ 852.231659][ T1816] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 852.231687][ T1816] usb 5-1: Product: syz [ 852.231701][ T1816] usb 5-1: Manufacturer: syz [ 852.231715][ T1816] usb 5-1: SerialNumber: syz [ 852.338803][ T6543] tipc: Node number set to 2886997162 [ 852.488697][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 852.598679][ T5714] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 852.618723][ T6543] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 852.750202][ T5714] usb 4-1: Using ep0 maxpacket: 8 [ 852.751114][ T5714] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 852.752568][ T5714] usb 4-1: config index 0 descriptor too short (expected 74, got 45) [ 852.752616][ T5714] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 852.752667][ T5714] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 852.752691][ T5714] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 852.752716][ T5714] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 852.752737][ T5714] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 852.752776][ T5714] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 852.764689][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 852.773187][ T6543] usb 3-1: Using ep0 maxpacket: 32 [ 852.795002][ T6543] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 852.817191][ T6543] usb 3-1: config 0 has no interfaces? [ 852.871850][ T6538] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 852.894529][ T6543] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 852.894576][ T6543] usb 3-1: Product: syz [ 852.894610][ T6543] usb 3-1: Manufacturer: syz [ 852.894629][ T6543] usb 3-1: SerialNumber: syz [ 852.920386][ T6538] usb 1-1: USB disconnect, device number 27 [ 852.930263][ T6543] usb 3-1: config 0 descriptor?? [ 852.973163][ T5714] usb 4-1: usb_control_msg returned -32 [ 852.973281][ T5714] usbtmc 4-1:16.0: can't read capabilities [ 853.017994][T16820] udevd[16820]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 853.216117][ T1816] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 853.216297][ T1816] command write [95] error -8 [ 853.258285][ T1816] usb 5-1: USB disconnect, device number 27 [ 853.341095][T17103] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3290'. [ 853.405461][T17108] usbtmc 4-1:16.0: send_request_dev_dep_msg_in returned -71 [ 853.406229][T17108] usbtmc 4-1:16.0: usb_control_msg returned -32 [ 853.458149][ T5714] usb 4-1: USB disconnect, device number 20 [ 853.494859][T17111] syz.5.3291: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 853.495052][T17111] CPU: 0 UID: 0 PID: 17111 Comm: syz.5.3291 Tainted: G L syzkaller #0 PREEMPT(full) [ 853.495091][T17111] Tainted: [L]=SOFTLOCKUP [ 853.495100][T17111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 853.495114][T17111] Call Trace: [ 853.495124][T17111] [ 853.495133][T17111] dump_stack_lvl+0xe8/0x150 [ 853.495170][T17111] warn_alloc+0x24d/0x270 [ 853.495203][T17111] ? kasan_save_track+0x4f/0x80 [ 853.495223][T17111] ? kasan_save_track+0x3e/0x80 [ 853.495245][T17111] ? __pfx_warn_alloc+0x10/0x10 [ 853.495274][T17111] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 853.495297][T17111] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 853.495337][T17111] __vmalloc_node_range_noprof+0x127/0x1540 [ 853.495388][T17111] ? rcu_is_watching+0x16/0xb0 [ 853.495418][T17111] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 853.495447][T17111] ? __kmalloc_cache_noprof+0x321/0x600 [ 853.495477][T17111] ? __kmalloc_cache_noprof+0x14d/0x600 [ 853.495506][T17111] ? xskq_create+0x56/0x220 [ 853.495646][T17111] xskq_create+0x148/0x220 [ 853.495678][T17111] ? xsk_init_queue+0x8a/0xe0 [ 853.495712][T17111] xsk_init_queue+0x8a/0xe0 [ 853.495741][T17111] xsk_setsockopt+0x52a/0x960 [ 853.495770][T17111] ? __pfx_xsk_setsockopt+0x10/0x10 [ 853.495796][T17111] ? __pfx_aa_sk_perm+0x10/0x10 [ 853.495829][T17111] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 853.495854][T17111] ? __pfx_xsk_setsockopt+0x10/0x10 [ 853.495884][T17111] do_sock_setsockopt+0x17c/0x1b0 [ 853.495913][T17111] __x64_sys_setsockopt+0x13d/0x1b0 [ 853.495942][T17111] do_syscall_64+0x166/0x520 [ 853.495971][T17111] ? trace_irq_disable+0x3b/0x140 [ 853.495992][T17111] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 853.496014][T17111] ? clear_bhb_loop+0x70/0xc0 [ 853.496050][T17111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 853.496071][T17111] RIP: 0033:0x7f781559e159 [ 853.496094][T17111] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 853.496112][T17111] RSP: 002b:00007f78163a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 853.496137][T17111] RAX: ffffffffffffffda RBX: 00007f7815826090 RCX: 00007f781559e159 [ 853.496154][T17111] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004 [ 853.496168][T17111] RBP: 00007f7815635024 R08: 0000000000000029 R09: 0000000000000000 [ 853.496182][T17111] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 853.496196][T17111] R13: 00007f7815826128 R14: 00007f7815826090 R15: 00007f781594fa48 [ 853.496229][T17111] [ 853.627819][T17111] Mem-Info: [ 853.627836][T17111] active_anon:9110 inactive_anon:0 isolated_anon:0 [ 853.627836][T17111] active_file:1 inactive_file:61890 isolated_file:0 [ 853.627836][T17111] unevictable:0 dirty:212 writeback:0 [ 853.627836][T17111] slab_reclaimable:7347 slab_unreclaimable:105002 [ 853.627836][T17111] mapped:33692 shmem:2970 pagetables:1518 [ 853.627836][T17111] sec_pagetables:0 bounce:0 [ 853.627836][T17111] kernel_misc_reclaimable:0 [ 853.627836][T17111] free:1283291 free_pcp:15588 free_cma:0 [ 853.627888][T17111] Node 0 active_anon:36440kB inactive_anon:0kB active_file:4kB inactive_file:247336kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:134740kB dirty:844kB writeback:0kB shmem:11880kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14468kB pagetables:5936kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 853.627942][T17111] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:224kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 853.627991][T17111] Node 0 DMA free:15356kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 853.628049][T17111] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 853.628087][T17111] Node 0 DMA32 free:1200668kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:36440kB inactive_anon:0kB active_file:4kB inactive_file:247336kB unevictable:0kB writepending:844kB zspages:0kB present:3129332kB managed:2546704kB mlocked:0kB bounce:0kB free_pcp:42344kB local_pcp:20772kB free_cma:0kB [ 853.628142][T17111] lowmem_reserve[]: 0 0 0 0 0 [ 853.628177][T17111] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 853.628228][T17111] lowmem_reserve[]: 0 0 0 0 0 [ 853.628262][T17111] Node 1 Normal free:3917140kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:224kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:20008kB local_pcp:4336kB free_cma:0kB [ 853.628316][T17111] lowmem_reserve[]: 0 0 0 0 0 [ 853.628350][T17111] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 853.637312][T17111] Node 0 DMA32: 1285*4kB (UME) 805*8kB (UME) 854*16kB (UME) 1023*32kB (UME) 525*64kB (UME) 214*128kB (UME) 99*256kB (UME) 45*512kB (UME) 25*1024kB (ME) 14*2048kB (UM) 239*4096kB (UME) = 1200572kB [ 853.637492][T17111] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 853.637598][T17111] Node 1 Normal: 8*4kB (UM) 9*8kB (UM) 8*16kB (UM) 21*32kB (UM) 8*64kB (UM) 8*128kB (UM) 12*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 2*2048kB (M) 953*4096kB (UM) = 3917192kB [ 853.637753][T17111] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 853.637770][T17111] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 853.637786][T17111] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 853.637802][T17111] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 853.637818][T17111] 64857 total pagecache pages [ 853.637827][T17111] 0 pages in swap cache [ 853.637835][T17111] Free swap = 123140kB [ 853.637843][T17111] Total swap = 124996kB [ 853.637851][T17111] 2097051 pages RAM [ 853.637859][T17111] 0 pages HighMem/MovableOnly [ 853.637867][T17111] 428759 pages reserved [ 853.637874][T17111] 0 pages cma reserved [ 854.040630][T17113] syzkaller0: entered promiscuous mode [ 854.040656][T17113] syzkaller0: entered allmulticast mode [ 854.532088][T17121] lo: Caught tx_queue_len zero misconfig [ 854.587382][ T30] audit: type=1800 audit(1788599628.517:5166): pid=17123 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3295" name="bus" dev="tmpfs" ino=372 res=0 errno=0 [ 855.039235][ T6543] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 855.188662][ T6543] usb 6-1: Using ep0 maxpacket: 8 [ 855.195187][ T6543] usb 6-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 855.207526][ T6543] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 855.207587][ T6543] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 855.207643][ T6543] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 855.207675][ T6543] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 855.207701][ T6543] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 855.243831][T17141] macsec1: entered promiscuous mode [ 855.243854][T17141] macsec0: entered promiscuous mode [ 855.248972][ T5714] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 855.287042][ T6543] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 855.287091][ T6543] usb 6-1: Product: syz [ 855.287125][ T6543] usb 6-1: Manufacturer: syz [ 855.287145][ T6543] usb 6-1: SerialNumber: syz [ 855.329514][ T6543] usb 6-1: config 0 descriptor?? [ 855.355929][ T6543] input: KB Gear Tablet as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input70 [ 855.400178][ T5714] usb 5-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 855.416933][ T5714] usb 5-1: config 6 has an invalid interface number: 14 but max is 0 [ 855.416976][ T5714] usb 5-1: config 6 has no interface number 0 [ 855.417038][ T5714] usb 5-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 855.417062][ T5714] usb 5-1: config 6 interface 14 has no altsetting 0 [ 855.440402][ T5714] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 855.440432][ T5714] usb 5-1: Product: syz [ 855.440446][ T5714] usb 5-1: Manufacturer: syz [ 855.440459][ T5714] usb 5-1: SerialNumber: syz [ 855.611114][T17128] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3298'. [ 855.652337][T13272] usb 6-1: USB disconnect, device number 61 [ 856.006105][T17152] netlink: 'syz.3.3308': attribute type 10 has an invalid length. [ 856.033361][T17152] team0 (unregistering): Port device team_slave_0 removed [ 856.050410][T17152] team0 (unregistering): Port device team_slave_1 removed [ 856.370963][T13262] usb 3-1: USB disconnect, device number 40 [ 856.418579][ C0] net_ratelimit: 3 callbacks suppressed [ 856.418701][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 856.482327][T13272] hid_parser_main: 30 callbacks suppressed [ 856.488728][T13272] hid-generic 0000:0000:0000.0038: unknown main item tag 0x0 [ 856.519977][T13272] hid-generic 0000:0000:0000.0038: hidraw0: HID v0.00 Device [syz1] on syz0 [ 856.540989][ T5714] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 856.541159][ T5714] command write [95] error -8 [ 856.574547][ T5714] usb 5-1: USB disconnect, device number 28 [ 856.881589][T17169] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3313'. [ 857.088609][ T6543] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 857.248626][ T6543] usb 1-1: Using ep0 maxpacket: 32 [ 857.251039][ T6543] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 857.268895][ T6543] usb 1-1: config 0 has no interfaces? [ 857.286364][ T6543] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 857.286412][ T6543] usb 1-1: Product: syz [ 857.286443][ T6543] usb 1-1: Manufacturer: syz [ 857.286464][ T6543] usb 1-1: SerialNumber: syz [ 857.316390][T17162] FAULT_INJECTION: forcing a failure. [ 857.316390][T17162] name fail_futex, interval 1, probability 0, space 0, times 1 [ 857.316442][T17162] CPU: 0 UID: 0 PID: 17162 Comm: syz.5.3309 Tainted: G L syzkaller #0 PREEMPT(full) [ 857.316471][T17162] Tainted: [L]=SOFTLOCKUP [ 857.316479][T17162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 857.316491][T17162] Call Trace: [ 857.316500][T17162] [ 857.316509][T17162] dump_stack_lvl+0xe8/0x150 [ 857.316546][T17162] should_fail_ex+0x410/0x560 [ 857.316584][T17162] get_futex_key+0x1b4/0x1580 [ 857.316626][T17162] ? perf_lock_task_context+0x79b/0x850 [ 857.316680][T17162] ? __pfx_get_futex_key+0x10/0x10 [ 857.316704][T17162] ? __pfx___mutex_trylock_common+0x10/0x10 [ 857.316737][T17162] futex_wake+0x119/0x5f0 [ 857.316782][T17162] ? __pfx_futex_wake+0x10/0x10 [ 857.316818][T17162] ? mm_exit_exec_release+0x20/0x290 [ 857.316851][T17162] do_futex+0x458/0x4e0 [ 857.316885][T17162] ? __pfx_do_futex+0x10/0x10 [ 857.316916][T17162] ? __might_fault+0xaf/0x130 [ 857.316947][T17162] mm_exit_exec_release+0x10d/0x290 [ 857.316976][T17162] exit_mm+0x4d/0x2d0 [ 857.317001][T17162] do_exit+0x6cd/0x2360 [ 857.317024][T17162] ? schedule+0x16e/0x2b0 [ 857.317057][T17162] ? schedule_hrtimeout_range_clock+0x1f2/0x330 [ 857.317084][T17162] ? __pfx_do_exit+0x10/0x10 [ 857.317110][T17162] ? do_raw_spin_lock+0x12b/0x2f0 [ 857.317148][T17162] do_group_exit+0x22d/0x2f0 [ 857.317178][T17162] ? _raw_spin_unlock_irq+0x23/0x50 [ 857.317219][T17162] get_signal+0x121b/0x12c0 [ 857.317266][T17162] arch_do_signal_or_restart+0xbb/0x860 [ 857.317297][T17162] ? __se_sys_rt_sigtimedwait+0x23f/0x300 [ 857.317327][T17162] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 857.317363][T17162] ? ksys_write+0x242/0x270 [ 857.317411][T17162] exit_to_user_mode_loop+0x10e/0x770 [ 857.317434][T17162] ? rcu_is_watching+0x16/0xb0 [ 857.317464][T17162] do_syscall_64+0x328/0x520 [ 857.317494][T17162] ? trace_irq_disable+0x3b/0x140 [ 857.317525][T17162] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 857.317553][T17162] ? clear_bhb_loop+0x70/0xc0 [ 857.317578][T17162] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 857.317599][T17162] RIP: 0033:0x7f781559e159 [ 857.317621][T17162] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 857.317639][T17162] RSP: 002b:00007f78163a5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000080 [ 857.317671][T17162] RAX: fffffffffffffffc RBX: 00007f7815826090 RCX: 00007f781559e159 [ 857.317687][T17162] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 857.317700][T17162] RBP: 00007f78163a5090 R08: 0000000000000000 R09: 0000000000000000 [ 857.317734][T17162] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 857.317753][T17162] R13: 00007f7815826128 R14: 00007f7815826090 R15: 00007f781594fa48 [ 857.317803][T17162] [ 857.409359][ T6543] usb 1-1: config 0 descriptor?? [ 857.461012][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 857.800455][T17184] FAULT_INJECTION: forcing a failure. [ 857.800455][T17184] name failslab, interval 1, probability 0, space 0, times 0 [ 857.800511][T17184] CPU: 1 UID: 0 PID: 17184 Comm: syz.5.3318 Tainted: G L syzkaller #0 PREEMPT(full) [ 857.800539][T17184] Tainted: [L]=SOFTLOCKUP [ 857.800546][T17184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 857.800558][T17184] Call Trace: [ 857.800567][T17184] [ 857.800577][T17184] dump_stack_lvl+0xe8/0x150 [ 857.800610][T17184] should_fail_ex+0x410/0x560 [ 857.800643][T17184] should_failslab+0xa8/0x100 [ 857.800678][T17184] __kmalloc_node_noprof+0x100/0x720 [ 857.800704][T17184] ? __get_vm_area_node+0x200/0x2f0 [ 857.800728][T17184] ? __get_vm_area_node+0x283/0x2f0 [ 857.800750][T17184] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 857.800775][T17184] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 857.800807][T17184] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 857.800843][T17184] ? vsnprintf+0xe42/0xef0 [ 857.800879][T17184] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 857.800904][T17184] ? bpf_verifier_vlog+0x3d1/0x900 [ 857.800939][T17184] ? bpf_prog_calc_tag+0x51/0x370 [ 857.800959][T17184] __vmalloc_noprof+0xd2/0x120 [ 857.800984][T17184] ? bpf_prog_calc_tag+0x51/0x370 [ 857.801008][T17184] bpf_prog_calc_tag+0x51/0x370 [ 857.801033][T17184] check_and_resolve_insns+0xbb/0x21d0 [ 857.801058][T17184] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 857.801078][T17184] ? add_subprog+0x2e2/0x3f0 [ 857.801101][T17184] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 857.801132][T17184] bpf_check+0x180a/0x2e10 [ 857.801163][T17184] ? ktime_get_with_offset+0x93/0x2d0 [ 857.801186][T17184] ? __pfx_bpf_check+0x10/0x10 [ 857.801209][T17184] ? bpf_obj_name_cpy+0x194/0x1e0 [ 857.801238][T17184] bpf_prog_load+0x14d6/0x1c20 [ 857.801274][T17184] ? __pfx_bpf_prog_load+0x10/0x10 [ 857.801319][T17184] __sys_bpf+0xd0d/0xd90 [ 857.801348][T17184] ? __pfx___sys_bpf+0x10/0x10 [ 857.801380][T17184] ? __fget_files+0x2a/0x420 [ 857.801421][T17184] ? ksys_write+0x242/0x270 [ 857.801449][T17184] ? __pfx_ksys_write+0x10/0x10 [ 857.801480][T17184] __x64_sys_bpf+0xba/0xd0 [ 857.801501][T17184] do_syscall_64+0x166/0x520 [ 857.801527][T17184] ? trace_irq_disable+0x3b/0x140 [ 857.801545][T17184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 857.801564][T17184] ? clear_bhb_loop+0x70/0xc0 [ 857.801588][T17184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 857.801606][T17184] RIP: 0033:0x7f781559e159 [ 857.801625][T17184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 857.801641][T17184] RSP: 002b:00007f78163c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 857.801673][T17184] RAX: ffffffffffffffda RBX: 00007f7815825fa0 RCX: 00007f781559e159 [ 857.801688][T17184] RDX: 0000000000000054 RSI: 0000200000000080 RDI: 0000000000000005 [ 857.801700][T17184] RBP: 00007f78163c8090 R08: 0000000000000000 R09: 0000000000000000 [ 857.801713][T17184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 857.801725][T17184] R13: 00007f7815826038 R14: 00007f7815825fa0 R15: 00007f781594fa48 [ 857.801755][T17184] [ 858.344474][ T30] audit: type=1326 audit(1788599632.277:5167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17191 comm="syz.3.3322" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd012b9e159 code=0x7ffc0000 [ 858.344559][ T30] audit: type=1326 audit(1788599632.277:5168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17191 comm="syz.3.3322" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd012b9e159 code=0x7ffc0000 [ 858.350304][ T30] audit: type=1326 audit(1788599632.287:5169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17191 comm="syz.3.3322" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd012b9e159 code=0x7ffc0000 [ 858.350355][ T30] audit: type=1326 audit(1788599632.287:5170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17191 comm="syz.3.3322" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd012b9e159 code=0x7ffc0000 [ 858.350746][ T30] audit: type=1326 audit(1788599632.287:5171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17191 comm="syz.3.3322" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=50 compat=0 ip=0x7fd012b9e159 code=0x7ffc0000 [ 858.350971][ T30] audit: type=1326 audit(1788599632.287:5172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17191 comm="syz.3.3322" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd012b9e159 code=0x7ffc0000 [ 858.351173][ T30] audit: type=1326 audit(1788599632.287:5173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17191 comm="syz.3.3322" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd012b9e159 code=0x7ffc0000 [ 858.351977][ T30] audit: type=1326 audit(1788599632.287:5174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17191 comm="syz.3.3322" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd012b9e159 code=0x7ffc0000 [ 858.353793][ T30] audit: type=1326 audit(1788599632.287:5175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17191 comm="syz.3.3322" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fd012b9e159 code=0x7ffc0000 [ 858.364822][T17192] netlink: 'syz.3.3322': attribute type 4 has an invalid length. [ 858.372077][ T1816] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 858.449275][T13262] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 858.471843][ T5714] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 858.520783][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 858.558791][ T1816] usb 5-1: Using ep0 maxpacket: 8 [ 858.560331][ T1816] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 858.561535][ T1816] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 858.561558][ T1816] usb 5-1: config 0 has no interface number 0 [ 858.561601][ T1816] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 858.599831][ T1816] usb 5-1: config 0 descriptor?? [ 858.600390][ T5714] usb 3-1: device descriptor read/64, error -71 [ 858.620027][T13262] usb 6-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 858.623092][T13262] usb 6-1: config 6 has an invalid interface number: 14 but max is 0 [ 858.623116][T13262] usb 6-1: config 6 has no interface number 0 [ 858.623155][T13262] usb 6-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 858.623218][T13262] usb 6-1: config 6 interface 14 has no altsetting 0 [ 858.654015][T13262] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 858.654044][T13262] usb 6-1: Product: syz [ 858.654058][T13262] usb 6-1: Manufacturer: syz [ 858.654072][T13262] usb 6-1: SerialNumber: syz [ 858.711193][ T1816] viperboard 5-1:0.143: version 0.00 found at bus 005 address 029 [ 858.789859][ T1816] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 858.789902][ T1816] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 858.838920][ T5714] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 858.969191][ T5714] usb 3-1: device descriptor read/64, error -71 [ 859.056413][T17187] usb 1-1: USB disconnect, device number 28 [ 859.079528][ T5714] usb usb3-port1: attempt power cycle [ 859.438752][ T5714] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 859.461521][ T5714] usb 3-1: device descriptor read/8, error -71 [ 859.538699][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 859.667049][T17209] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3326'. [ 859.699024][ T5714] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 859.731499][ T5714] usb 3-1: device descriptor read/8, error -71 [ 859.741632][ T1816] usb 5-1: USB disconnect, device number 29 [ 859.791467][T13262] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 859.798333][T13262] command write [95] error -8 [ 859.833200][T13262] usb 6-1: USB disconnect, device number 62 [ 859.846867][ T5714] usb usb3-port1: unable to enumerate USB device [ 860.578729][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 860.591595][T17221] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3329'. [ 860.591646][T17221] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3329'. [ 860.650910][T13272] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 860.779297][T13272] usb 4-1: device descriptor read/64, error -71 [ 861.018625][T13272] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 861.148640][T13272] usb 4-1: device descriptor read/64, error -71 [ 861.179293][ T1816] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 861.184411][T17233] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3334'. [ 861.259169][T13272] usb usb4-port1: attempt power cycle [ 861.338733][ T1816] usb 6-1: Using ep0 maxpacket: 16 [ 861.344897][ T1816] usb 6-1: New USB device found, idVendor=046d, idProduct=c227, bcdDevice= 0.00 [ 861.356239][ T1816] usb 6-1: too many endpoints for config 0 interface 0 altsetting 16: 254, using maximum allowed: 30 [ 861.356328][ T1816] usb 6-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 861.356362][ T1816] usb 6-1: config 0 interface 0 has no altsetting 0 [ 861.356401][ T1816] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 861.406498][ T1816] usb 6-1: config 0 descriptor?? [ 861.476459][T17245] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3337'. [ 861.608608][T13272] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 861.618591][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 861.623925][T17246] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3339'. [ 861.630065][T17246] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3339'. [ 861.634837][T17246] hsr_slave_0: left promiscuous mode [ 861.643416][T13272] usb 4-1: device descriptor read/8, error -71 [ 861.645704][T17246] hsr_slave_1: left promiscuous mode [ 861.872147][T17258] netlink: 'syz.4.3343': attribute type 1 has an invalid length. [ 861.872178][T17258] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3343'. [ 861.889593][T13272] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 861.911559][ T1816] lg-g15 0003:046D:C227.0039: unknown main item tag 0x3 [ 861.911669][ T1816] lg-g15 0003:046D:C227.0039: unknown main item tag 0x0 [ 861.911732][ T1816] lg-g15 0003:046D:C227.0039: unknown main item tag 0x0 [ 861.911763][ T1816] lg-g15 0003:046D:C227.0039: unknown main item tag 0x0 [ 861.911793][ T1816] lg-g15 0003:046D:C227.0039: unknown main item tag 0x0 [ 861.911823][ T1816] lg-g15 0003:046D:C227.0039: unknown main item tag 0x0 [ 861.911853][ T1816] lg-g15 0003:046D:C227.0039: unknown main item tag 0x0 [ 861.911883][ T1816] lg-g15 0003:046D:C227.0039: unknown main item tag 0x0 [ 861.911914][ T1816] lg-g15 0003:046D:C227.0039: unknown main item tag 0x0 [ 861.911944][ T1816] lg-g15 0003:046D:C227.0039: unknown main item tag 0x0 [ 861.934661][T13272] usb 4-1: device descriptor read/8, error -71 [ 861.981016][T13262] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 862.010313][ T1816] lg-g15 0003:046D:C227.0039: hidraw0: USB HID v0.01 Device [HID 046d:c227] on usb-dummy_hcd.5-1/input0 [ 862.039108][T13272] usb usb4-port1: unable to enumerate USB device [ 862.140094][T13262] usb 3-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 862.151658][T13262] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 862.162732][T13262] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 862.168640][T13242] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 862.179687][T13262] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 862.308879][T13242] usb 5-1: device descriptor read/64, error -71 [ 862.396214][T13272] usb 3-1: USB disconnect, device number 45 [ 862.568759][T13242] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 862.627862][T13262] usb 6-1: USB disconnect, device number 63 [ 862.668643][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 862.699045][T13242] usb 5-1: device descriptor read/64, error -71 [ 862.809086][T13242] usb usb5-port1: attempt power cycle [ 862.940482][T17269] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 862.952401][T17269] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 863.010207][ T1816] psmouse serio3: Failed to reset mouse on : -5 [ 863.168629][T13242] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 863.200479][T13242] usb 5-1: device descriptor read/8, error -71 [ 863.310708][ T6538] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 863.438993][T13242] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 863.458907][ T6538] usb 3-1: Using ep0 maxpacket: 8 [ 863.460494][ T6538] usb 3-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 863.460678][T13242] usb 5-1: device descriptor read/8, error -71 [ 863.461793][ T6538] usb 3-1: config 0 has an invalid interface number: 186 but max is 0 [ 863.461816][ T6538] usb 3-1: config 0 has no interface number 0 [ 863.461854][ T6538] usb 3-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 863.461875][ T6538] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x1 has an invalid bInterval 18, changing to 8 [ 863.461902][ T6538] usb 3-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 863.461926][ T6538] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 863.461950][ T6538] usb 3-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 863.467441][ T6538] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.467469][ T6538] usb 3-1: Product: syz [ 863.467483][ T6538] usb 3-1: Manufacturer: syz [ 863.467498][ T6538] usb 3-1: SerialNumber: syz [ 863.487065][ T6538] usb 3-1: config 0 descriptor?? [ 863.589218][T13242] usb usb5-port1: unable to enumerate USB device [ 863.698643][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 863.908757][T13272] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 864.060888][T13272] usb 4-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice= 1.00 [ 864.062316][T13272] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 864.062386][T13272] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 1024 [ 864.062410][T13272] usb 4-1: config 1 interface 1 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 864.062433][T13272] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 864.062468][T13272] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 864.069718][T17284] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 864.078785][T13272] ims_pcu 4-1:1.0: Second endpoint on data interface is not BULK IN [ 864.078890][T13272] ims_pcu 4-1:1.0: probe with driver ims_pcu failed with error -22 [ 864.187882][ T6538] iowarrior 3-1:0.186: IOWarrior product=0x1505, serial= interface=186 now attached to iowarrior0 [ 864.200761][ T6538] usb 3-1: USB disconnect, device number 46 [ 864.355871][ T5714] usb 4-1: USB disconnect, device number 25 [ 864.411334][T17288] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 864.411372][T17288] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 864.444620][T17288] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 864.451846][T17288] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 864.471630][T17288] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 864.477689][T17288] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 864.490412][T17288] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 864.496572][T17288] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 864.516287][T17288] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 864.516321][T17288] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 864.619661][T17293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 864.620110][T17293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 864.738629][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 865.287349][T17305] syzkaller0: entered promiscuous mode [ 865.287396][T17305] syzkaller0: entered allmulticast mode [ 865.435645][T17304] syzkaller0: entered promiscuous mode [ 865.435688][T17304] syzkaller0: entered allmulticast mode [ 865.738944][T13262] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 865.778720][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 865.875039][ T6538] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 865.888637][T13262] usb 3-1: Using ep0 maxpacket: 32 [ 865.890983][T13262] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 865.892498][T13262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 865.892528][T13262] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 865.892567][T13262] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 865.896046][T13262] usb 3-1: config 0 descriptor?? [ 865.903632][T13262] hub 3-1:0.0: USB hub found [ 865.966023][T17326] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3367'. [ 866.008665][ T6538] usb 4-1: device descriptor read/64, error -71 [ 866.126105][T17310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 866.131329][T17310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 866.204848][T17331] netlink: 'syz.2.3361': attribute type 39 has an invalid length. [ 866.259963][ T6538] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 866.287968][T10662] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 866.289226][T17310] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 866.410127][ T6538] usb 4-1: device descriptor read/64, error -71 [ 866.519104][ T6538] usb usb4-port1: attempt power cycle [ 866.556937][ T1816] misc userio: Buffer overflowed, userio client isn't keeping up [ 866.621817][T13262] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 866.627815][T13262] usbhid 3-1:0.0: can't add hid device: -71 [ 866.628113][T13262] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 866.669983][T13262] usb 3-1: USB disconnect, device number 47 [ 866.818735][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 866.869048][ T6538] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 866.889844][ T6538] usb 4-1: device descriptor read/8, error -71 [ 866.978884][T13268] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 867.128721][ T6538] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 867.139273][T13268] usb 5-1: Using ep0 maxpacket: 16 [ 867.140018][T13268] usb 5-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 867.140064][T13268] usb 5-1: too many configurations: 123, using maximum allowed: 8 [ 867.140995][T13268] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 867.141903][T13268] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 867.142815][T13268] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 867.143725][T13268] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 867.144646][T13268] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 867.145724][T13268] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 867.146675][T13268] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 867.147556][T13268] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 867.149276][T13268] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 867.149299][T13268] usb 5-1: SerialNumber: syz [ 867.152622][T13268] usb 5-1: config 0 descriptor?? [ 867.154778][ T6538] usb 4-1: device descriptor read/8, error -71 [ 867.179471][T13268] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input72 [ 867.286003][ T6538] usb usb4-port1: unable to enumerate USB device [ 867.373262][T17335] input: syz0 as /devices/virtual/input/input73 [ 867.431152][ T4971] bcm5974 5-1:0.0: could not read from device [ 867.438870][ T4971] bcm5974 5-1:0.0: could not read from device [ 867.464797][T13268] usb 5-1: USB disconnect, device number 34 [ 867.472083][ T4971] bcm5974 5-1:0.0: could not read from device [ 867.485116][ T4971] bcm5974 5-1:0.0: could not read from device [ 867.595143][T17346] syzkaller0: entered promiscuous mode [ 867.595177][T17346] syzkaller0: entered allmulticast mode [ 867.812844][ T1816] input: PS/2 Generic Mouse as /devices/serio3/input/input71 [ 867.868576][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 867.880986][T17353] fuse: Unknown parameter 'f¯ö0x0000000000000008' [ 868.038794][ T1816] psmouse serio3: Failed to enable mouse on [ 868.197716][T17365] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3378'. [ 868.309734][T13272] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 868.458775][T13272] usb 5-1: Using ep0 maxpacket: 32 [ 868.460237][T13272] usb 5-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=1e.fa [ 868.461244][T13272] usb 5-1: config 245 has an invalid interface number: 214 but max is 0 [ 868.461268][T13272] usb 5-1: config 245 has no interface number 0 [ 868.461296][T13272] usb 5-1: config 245 interface 214 has no altsetting 0 [ 868.463319][T13272] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 868.463340][T13272] usb 5-1: Product: syz [ 868.463354][T13272] usb 5-1: Manufacturer: syz [ 868.463367][T13272] usb 5-1: SerialNumber: syz [ 868.690205][T13272] f81534a_ctrl 5-1:245.214: probe with driver f81534a_ctrl failed with error -71 [ 868.708798][T13272] usb 5-1: USB disconnect, device number 35 [ 868.898616][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 869.136217][T17389] netlink: 'syz.0.3386': attribute type 4 has an invalid length. [ 869.238969][T13272] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 869.401704][T13272] usb 6-1: Using ep0 maxpacket: 32 [ 869.419146][T13272] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 869.429725][T13272] usb 6-1: config 0 has no interfaces? [ 869.440709][T13272] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 869.440756][T13272] usb 6-1: Product: syz [ 869.440787][T13272] usb 6-1: Manufacturer: syz [ 869.440807][T13272] usb 6-1: SerialNumber: syz [ 869.476028][T13272] usb 6-1: config 0 descriptor?? [ 869.527851][T17400] FAULT_INJECTION: forcing a failure. [ 869.527851][T17400] name failslab, interval 1, probability 0, space 0, times 0 [ 869.527902][T17400] CPU: 1 UID: 0 PID: 17400 Comm: syz.2.3390 Tainted: G L syzkaller #0 PREEMPT(full) [ 869.527931][T17400] Tainted: [L]=SOFTLOCKUP [ 869.527939][T17400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 869.527951][T17400] Call Trace: [ 869.527958][T17400] [ 869.527966][T17400] dump_stack_lvl+0xe8/0x150 [ 869.527999][T17400] should_fail_ex+0x410/0x560 [ 869.528033][T17400] should_failslab+0xa8/0x100 [ 869.528057][T17400] __kvmalloc_node_noprof+0x176/0x820 [ 869.528079][T17400] ? __kvmalloc_node_noprof+0x345/0x820 [ 869.528098][T17400] ? bpf_compute_scc+0xd2/0xb10 [ 869.528124][T17400] ? bpf_compute_scc+0xd2/0xb10 [ 869.528157][T17400] bpf_compute_scc+0xd2/0xb10 [ 869.528202][T17400] bpf_check+0x25c9/0x2e10 [ 869.528234][T17400] ? ktime_get_with_offset+0x93/0x2d0 [ 869.528258][T17400] ? __pfx_bpf_check+0x10/0x10 [ 869.528281][T17400] ? bpf_obj_name_cpy+0x194/0x1e0 [ 869.528309][T17400] bpf_prog_load+0x14d6/0x1c20 [ 869.528342][T17400] ? __pfx_bpf_prog_load+0x10/0x10 [ 869.528391][T17400] __sys_bpf+0xd0d/0xd90 [ 869.528420][T17400] ? __pfx___sys_bpf+0x10/0x10 [ 869.528451][T17400] ? __fget_files+0x2a/0x420 [ 869.528491][T17400] ? ksys_write+0x242/0x270 [ 869.528520][T17400] ? __pfx_ksys_write+0x10/0x10 [ 869.528550][T17400] __x64_sys_bpf+0xba/0xd0 [ 869.528581][T17400] do_syscall_64+0x166/0x520 [ 869.528607][T17400] ? trace_irq_disable+0x3b/0x140 [ 869.528625][T17400] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 869.528645][T17400] ? clear_bhb_loop+0x70/0xc0 [ 869.528667][T17400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 869.528686][T17400] RIP: 0033:0x7f9e8f99e159 [ 869.528705][T17400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 869.528721][T17400] RSP: 002b:00007f9e908cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 869.528743][T17400] RAX: ffffffffffffffda RBX: 00007f9e8fc25fa0 RCX: 00007f9e8f99e159 [ 869.528757][T17400] RDX: 0000000000000094 RSI: 00002000000001c0 RDI: 0000000000000005 [ 869.528770][T17400] RBP: 00007f9e908cf090 R08: 0000000000000000 R09: 0000000000000000 [ 869.528782][T17400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 869.528794][T17400] R13: 00007f9e8fc26038 R14: 00007f9e8fc25fa0 R15: 00007f9e8fd4fa48 [ 869.528824][T17400] [ 869.938621][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 870.323220][T17421] netlink: 'syz.0.3395': attribute type 10 has an invalid length. [ 870.341571][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.341645][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.437220][T17416] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3396'. [ 870.512505][T17421] team0 (unregistering): Port device team_slave_0 removed [ 870.599138][T17421] team0 (unregistering): Port device team_slave_1 removed [ 870.763000][T17419] loop4: detected capacity change from 0 to 7 [ 870.775938][T17419] Dev loop4: unable to read RDB block 7 [ 870.786889][T17419] loop4: unable to read partition table [ 870.787168][T17419] loop4: partition table beyond EOD, truncated [ 870.787221][T17419] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 870.988884][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 870.991771][T17426] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3392'. [ 871.232753][ T4986] Dev loop4: unable to read RDB block 7 [ 871.238690][ T4986] loop4: unable to read partition table [ 871.244819][ T4986] loop4: partition table beyond EOD, truncated [ 871.630357][T13268] usb 5-1: new low-speed USB device number 36 using dummy_hcd [ 871.784008][T13268] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 871.789051][T13268] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 871.789079][T13268] usb 5-1: config 0 has no interface number 0 [ 871.789119][T13268] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 871.789145][T13268] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 871.789185][T13268] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 871.816179][T13268] usb 5-1: config 0 descriptor?? [ 871.816962][T17433] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 871.888468][T13268] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 872.028708][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 872.108719][T13272] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 872.167470][T13264] usb 5-1: USB disconnect, device number 36 [ 872.231981][T17439] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 872.268593][T13272] usb 3-1: Using ep0 maxpacket: 32 [ 872.275508][T13272] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 872.287413][T13272] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 872.287462][T13272] usb 3-1: config 0 has no interface number 0 [ 872.312659][T13272] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 872.321083][T13272] usb 3-1: Product: syz [ 872.325476][T13272] usb 3-1: Manufacturer: syz [ 872.332751][T13272] usb 3-1: SerialNumber: syz [ 872.343225][T13272] usb 3-1: config 0 descriptor?? [ 872.343537][T17441] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 872.380095][T13272] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 872.389316][T13272] usb 3-1: selecting invalid altsetting 1 [ 872.389344][T13272] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 872.415490][T13272] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 872.428968][T13272] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 872.437480][T13272] usb 3-1: media controller created [ 872.462313][T13272] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 872.525433][T17442] netlink: 'syz.0.3402': attribute type 4 has an invalid length. [ 872.525470][T17442] netlink: 11575 bytes leftover after parsing attributes in process `syz.0.3402'. [ 872.792150][T13264] usb 6-1: USB disconnect, device number 64 [ 873.058604][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 873.200856][T13272] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 873.230674][T13272] zl10353_read_register: readreg error (reg=127, ret==-71) [ 873.239906][T13272] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 873.341289][T13272] usb 3-1: USB disconnect, device number 48 [ 873.705429][T17475] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3412'. [ 873.716202][T17475] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3412'. [ 873.716231][T17475] A link change request failed with some changes committed already. Interface bond_slave_1 may have been left with an inconsistent configuration, please check. [ 873.810652][T17478] fuse: Unknown parameter '00000000000000000000' [ 873.848702][ T6538] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 873.951882][ T30] kauditd_printk_skb: 96 callbacks suppressed [ 873.951939][ T30] audit: type=1326 audit(1788599647.877:5272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17479 comm="syz.0.3414" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efda019e159 code=0x7ffc0000 [ 873.951985][ T30] audit: type=1326 audit(1788599647.877:5273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17479 comm="syz.0.3414" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efda019e159 code=0x7ffc0000 [ 873.952035][ T30] audit: type=1326 audit(1788599647.887:5274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17479 comm="syz.0.3414" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efda019e159 code=0x7ffc0000 [ 873.952079][ T30] audit: type=1326 audit(1788599647.887:5275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17479 comm="syz.0.3414" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=447 compat=0 ip=0x7efda019e159 code=0x7ffc0000 [ 873.952117][ T30] audit: type=1326 audit(1788599647.887:5276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17479 comm="syz.0.3414" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efda019e159 code=0x7ffc0000 [ 873.952157][ T30] audit: type=1326 audit(1788599647.887:5277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17479 comm="syz.0.3414" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efda019e159 code=0x7ffc0000 [ 873.952198][ T30] audit: type=1326 audit(1788599647.887:5278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17479 comm="syz.0.3414" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efda019e159 code=0x7ffc0000 [ 873.981886][T13264] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 874.007517][ T6538] usb 6-1: device descriptor read/64, error -71 [ 874.076177][ T30] audit: type=1326 audit(1788599648.007:5279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17479 comm="syz.0.3414" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efda019e159 code=0x7ffc0000 [ 874.076230][ T30] audit: type=1326 audit(1788599648.007:5280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17479 comm="syz.0.3414" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efda019e159 code=0x7ffc0000 [ 874.076434][ T30] audit: type=1326 audit(1788599648.007:5281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17479 comm="syz.0.3414" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7efda019e159 code=0x7ffc0000 [ 874.106642][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 874.131247][T13264] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 874.132041][T13264] usb 4-1: config 0 has no interfaces? [ 874.132080][T13264] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 874.145971][T13264] usb 4-1: config 0 descriptor?? [ 874.278691][ T6538] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 874.348887][ T1816] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 874.365547][ T5617] usb 4-1: USB disconnect, device number 30 [ 874.419819][ T6538] usb 6-1: device descriptor read/64, error -71 [ 874.498721][ T1816] usb 5-1: Using ep0 maxpacket: 8 [ 874.504615][ T1816] usb 5-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c3.eb [ 874.509315][ T1816] usb 5-1: config 150 has an invalid interface number: 204 but max is 2 [ 874.509344][ T1816] usb 5-1: config 150 has an invalid descriptor of length 0, skipping remainder of the config [ 874.509362][ T1816] usb 5-1: config 150 has 1 interface, different from the descriptor's value: 3 [ 874.509383][ T1816] usb 5-1: config 150 has no interface number 0 [ 874.509408][ T1816] usb 5-1: config 150 interface 204 has no altsetting 0 [ 874.511428][ T1816] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.511450][ T1816] usb 5-1: Product: syz [ 874.511464][ T1816] usb 5-1: Manufacturer: syz [ 874.511478][ T1816] usb 5-1: SerialNumber: syz [ 874.548664][ T6538] usb usb6-port1: attempt power cycle [ 874.724434][T13268] usb 5-1: USB disconnect, device number 37 [ 874.799859][ T1816] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 874.868000][T17489] netlink: 'syz.0.3418': attribute type 1 has an invalid length. [ 874.928697][ T6538] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 874.948928][ T1816] usb 3-1: Using ep0 maxpacket: 8 [ 874.952583][ T1816] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 874.953716][ T1816] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 874.953740][ T1816] usb 3-1: config 16 has an invalid descriptor of length 102, skipping remainder of the config [ 874.953782][ T1816] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 874.953807][ T1816] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 874.953838][ T1816] usb 3-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 874.953878][ T1816] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 874.962366][ T1816] usbtmc 3-1:16.0: bulk endpoints not found [ 874.997297][ T6538] usb 6-1: device descriptor read/8, error -71 [ 875.148594][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 875.238729][ T6538] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 875.273014][ T6538] usb 6-1: device descriptor read/8, error -71 [ 875.350555][T17501] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3422'. [ 875.379159][ T6538] usb usb6-port1: unable to enumerate USB device [ 876.178584][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 876.749966][T17518] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3427'. [ 876.750022][T17518] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3427'. [ 877.228583][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 877.586781][T17542] kvm: pic: non byte write [ 877.605248][T13268] usb 3-1: USB disconnect, device number 49 [ 878.059930][T13268] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 878.105387][T17562] netlink: 'syz.4.3442': attribute type 1 has an invalid length. [ 878.114256][T17562] netlink: 'syz.4.3442': attribute type 2 has an invalid length. [ 878.114292][T17562] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3442'. [ 878.135857][T17561] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 878.210776][T13268] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 878.222372][T13268] usb 3-1: config index 0 descriptor too short (expected 65183, got 72) [ 878.236149][T13268] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.244450][T13268] usb 3-1: Product: syz [ 878.244484][T13268] usb 3-1: Manufacturer: syz [ 878.244501][T13268] usb 3-1: SerialNumber: syz [ 878.258700][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 878.287760][ T1816] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 878.382610][T13242] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 878.508676][T13242] usb 4-1: device descriptor read/64, error -71 [ 878.530294][T17551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 878.540087][T17551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 878.552224][T17551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 878.562675][T17551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 878.567168][T17551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 878.572503][T17551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 878.581212][ T6538] usb 3-1: USB disconnect, device number 50 [ 878.748917][T13242] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 878.878804][T13242] usb 4-1: device descriptor read/64, error -71 [ 878.989385][T13242] usb usb4-port1: attempt power cycle [ 878.998813][T13268] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 879.149315][T13268] usb 5-1: New USB device found, idVendor=056e, idProduct=00e6, bcdDevice= 0.00 [ 879.162088][T13268] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 879.162156][T13268] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 879.167954][T13268] usb 5-1: config 0 descriptor?? [ 879.183011][T17580] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 879.298857][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 879.328699][T13242] usb 4-1: new full-speed USB device number 33 using dummy_hcd [ 879.349354][T13242] usb 4-1: device descriptor read/8, error -71 [ 879.379032][ T1816] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 879.386258][ T1816] ath9k_htc: Failed to initialize the device [ 879.396115][ T6538] usb 3-1: ath9k_htc: USB layer deinitialized [ 879.487899][ T30] kauditd_printk_skb: 159 callbacks suppressed [ 879.487954][ T30] audit: type=1800 audit(1788599653.417:5441): pid=17588 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.3455" name="bus" dev="tmpfs" ino=1277 res=0 errno=0 [ 879.517319][T13268] usbhid 5-1:0.0: can't add hid device: -71 [ 879.523641][T13268] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 879.543677][T13268] usb 5-1: USB disconnect, device number 38 [ 879.599015][T13242] usb 4-1: new full-speed USB device number 34 using dummy_hcd [ 879.619532][T13242] usb 4-1: device descriptor read/8, error -71 [ 879.700201][ T6538] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 879.729001][T13242] usb usb4-port1: unable to enumerate USB device [ 879.848673][ T6538] usb 3-1: Using ep0 maxpacket: 32 [ 879.849575][ T6538] usb 3-1: New USB device found, idVendor=110a, idProduct=2210, bcdDevice=bd.da [ 879.850784][ T6538] usb 3-1: config index 0 descriptor too short (expected 241, got 72) [ 879.850835][ T6538] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 879.850884][ T6538] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 879.864786][ T6538] usb 3-1: config 0 descriptor?? [ 879.872689][ T6538] hub 3-1:0.0: bad descriptor, ignoring hub [ 879.872718][ T6538] hub 3-1:0.0: probe with driver hub failed with error -5 [ 879.877070][ T6538] mos7840 3-1:0.0: Moschip 7840/7820 USB Serial Driver converter detected [ 880.123422][T17598] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 880.340530][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 880.497120][T17551] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3439'. [ 880.638881][T17610] FAULT_INJECTION: forcing a failure. [ 880.638881][T17610] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 880.638970][T17610] CPU: 0 UID: 0 PID: 17610 Comm: syz.5.3463 Tainted: G L syzkaller #0 PREEMPT(full) [ 880.638999][T17610] Tainted: [L]=SOFTLOCKUP [ 880.639005][T17610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 880.639016][T17610] Call Trace: [ 880.639024][T17610] [ 880.639032][T17610] dump_stack_lvl+0xe8/0x150 [ 880.639069][T17610] should_fail_ex+0x410/0x560 [ 880.639103][T17610] _copy_from_user+0x2d/0xb0 [ 880.639125][T17610] ___sys_recvmsg+0x173/0x5a0 [ 880.639153][T17610] ? __pfx____sys_recvmsg+0x10/0x10 [ 880.639180][T17610] ? lock_acquire+0x115/0x350 [ 880.639214][T17610] ? __fget_files+0x3a2/0x420 [ 880.639248][T17610] __x64_sys_recvmsg+0x1ae/0x290 [ 880.639273][T17610] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 880.639313][T17610] do_syscall_64+0x166/0x520 [ 880.639340][T17610] ? trace_irq_disable+0x3b/0x140 [ 880.639358][T17610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.639378][T17610] ? clear_bhb_loop+0x70/0xc0 [ 880.639401][T17610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.639419][T17610] RIP: 0033:0x7f781559e159 [ 880.639447][T17610] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 880.639464][T17610] RSP: 002b:00007f78163c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 880.639487][T17610] RAX: ffffffffffffffda RBX: 00007f7815825fa0 RCX: 00007f781559e159 [ 880.639501][T17610] RDX: 0000000000002082 RSI: 00002000000006c0 RDI: 0000000000000009 [ 880.639514][T17610] RBP: 00007f78163c8090 R08: 0000000000000000 R09: 0000000000000000 [ 880.639526][T17610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 880.639538][T17610] R13: 00007f7815826038 R14: 00007f7815825fa0 R15: 00007f781594fa48 [ 880.639567][T17610] [ 880.784049][T17609] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3462'. [ 881.118141][ T6538] mos7840 ttyUSB0: probe with driver mos7840 failed with error -71 [ 881.136930][ T6538] mos7840 ttyUSB1: probe with driver mos7840 failed with error -71 [ 881.192644][ T6538] usb 3-1: USB disconnect, device number 51 [ 881.274837][ T6538] mos7840 3-1:0.0: device disconnected [ 881.283552][T17617] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3465'. [ 881.330720][ T30] audit: type=1800 audit(1788599655.267:5442): pid=17619 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3466" name="bus" dev="tmpfs" ino=618 res=0 errno=0 [ 881.378716][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 881.454101][ T30] audit: type=1800 audit(1788599655.387:5443): pid=17623 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3467" name="bus" dev="tmpfs" ino=446 res=0 errno=0 [ 882.107160][T17636] syzkaller0: entered promiscuous mode [ 882.107220][T17636] syzkaller0: entered allmulticast mode [ 882.418596][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 882.500475][T13242] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 882.650595][T17646] input: syz0 as /devices/virtual/input/input74 [ 882.651084][T13242] usb 4-1: Using ep0 maxpacket: 32 [ 882.665376][T13242] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 882.686617][T13242] usb 4-1: config 0 has no interfaces? [ 882.699657][T13242] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 882.699699][T13242] usb 4-1: Product: syz [ 882.699732][T13242] usb 4-1: Manufacturer: syz [ 882.699749][T13242] usb 4-1: SerialNumber: syz [ 882.722459][T13242] usb 4-1: config 0 descriptor?? [ 882.975806][ T30] audit: type=1800 audit(1788599656.907:5444): pid=17654 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3479" name="bus" dev="tmpfs" ino=639 res=0 errno=0 [ 882.997296][ T1816] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 883.129674][T17658] syzkaller1: entered promiscuous mode [ 883.129713][T17658] syzkaller1: entered allmulticast mode [ 883.159346][ T1816] usb 5-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 883.171765][ T1816] usb 5-1: config 6 has an invalid interface number: 14 but max is 0 [ 883.180149][ T1816] usb 5-1: config 6 has no interface number 0 [ 883.186470][ T1816] usb 5-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 883.186520][ T1816] usb 5-1: config 6 interface 14 has no altsetting 0 [ 883.208168][ T1816] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 883.216359][ T1816] usb 5-1: Product: syz [ 883.220752][ T1816] usb 5-1: Manufacturer: syz [ 883.225487][ T1816] usb 5-1: SerialNumber: syz [ 883.458583][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 883.469603][T13242] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 883.589549][T17666] loop4: detected capacity change from 0 to 7 [ 883.596116][T17666] Dev loop4: unable to read RDB block 7 [ 883.596202][T17666] loop4: unable to read partition table [ 883.611651][T17666] loop4: partition table beyond EOD, truncated [ 883.611727][T17666] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 883.620348][T13242] usb 3-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 883.647087][T13242] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 883.647136][T13242] usb 3-1: Product: syz [ 883.647170][T13242] usb 3-1: Manufacturer: syz [ 883.647190][T13242] usb 3-1: SerialNumber: syz [ 883.678956][T13242] usb 3-1: config 0 descriptor?? [ 883.700915][T13242] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 883.721016][T13242] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 883.737235][T13242] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 883.737342][T13242] usb 3-1: media controller created [ 883.782254][T13242] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 884.004413][T13242] DVB: Unable to find symbol mt352_attach() [ 884.066202][T13242] DVB: Unable to find symbol nxt6000_attach() [ 884.066252][T13242] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 884.087590][T13242] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input75 [ 884.106801][T13242] dvb-usb: schedule remote query interval to 1000 msecs. [ 884.114847][T13242] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 884.125442][T13242] dvb-usb: bulk message failed: -22 (7/0) [ 884.125503][T13242] dvb-usb: bulk message failed: -22 (7/0) [ 884.144851][T13242] usb 3-1: USB disconnect, device number 52 [ 884.209238][ T6538] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 884.257305][T13242] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 884.359693][ T6538] usb 6-1: Using ep0 maxpacket: 32 [ 884.366410][ T6538] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.6e [ 884.378036][ T6538] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 884.386642][ T6538] usb 6-1: config 0 has no interface number 0 [ 884.386681][ T6538] usb 6-1: config 0 interface 184 has no altsetting 0 [ 884.407463][ T6538] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 884.416138][ T6538] usb 6-1: Product: syz [ 884.420976][ T6538] usb 6-1: Manufacturer: syz [ 884.420990][ T6538] usb 6-1: SerialNumber: syz [ 884.421832][ T1816] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 884.421989][ T1816] command write [95] error -8 [ 884.451449][ T6538] usb 6-1: config 0 descriptor?? [ 884.465679][ T1816] usb 5-1: USB disconnect, device number 39 [ 884.498583][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 884.549901][ T4986] Dev loop4: unable to read RDB block 7 [ 884.549974][ T4986] loop4: unable to read partition table [ 884.550252][ T4986] loop4: partition table beyond EOD, truncated [ 884.928593][ T1816] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 885.091299][ T1816] usb 5-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 885.093166][ T1816] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 885.093193][ T1816] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 885.093232][ T1816] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 885.117435][ T1816] usb 5-1: probing VID:PID(0424:012C) [ 885.121731][ T1816] usb 5-1: vub300 testing BULK IN EndPoint(0) 81 [ 885.121757][ T1816] usb 5-1: vub300 testing BULK OUT EndPoint(1) 02 [ 885.121775][ T1816] usb 5-1: vub300 testing BULK IN EndPoint(2) 83 [ 885.121791][ T1816] usb 5-1: vub300 testing BULK OUT EndPoint(3) 04 [ 885.121808][ T1816] usb 5-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 885.172238][ T6538] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 885.172289][ T6538] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 885.203026][T17674] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 885.384496][ C1] vcan0: j1939_tp_rxtimer: 0xffff888035197000: rx timeout, send abort [ 885.502454][T13242] usb 4-1: USB disconnect, device number 35 [ 885.540522][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 885.543486][ T1816] usb 5-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 885.744205][ T1816] usb 5-1: USB vub300 remote SDIO host controller[0]connected with SD/SDIO card inserted [ 885.884687][ C1] vcan0: j1939_tp_rxtimer: 0xffff888052a7a400: rx timeout, send abort [ 885.886667][ C1] vcan0: j1939_tp_rxtimer: 0xffff888035197000: abort rx timeout. Force session deactivation [ 886.056212][T17694] FAULT_INJECTION: forcing a failure. [ 886.056212][T17694] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 886.056270][T17694] CPU: 1 UID: 0 PID: 17694 Comm: syz.0.3488 Tainted: G L syzkaller #0 PREEMPT(full) [ 886.056298][T17694] Tainted: [L]=SOFTLOCKUP [ 886.056305][T17694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 886.056315][T17694] Call Trace: [ 886.056323][T17694] [ 886.056332][T17694] dump_stack_lvl+0xe8/0x150 [ 886.056365][T17694] should_fail_ex+0x410/0x560 [ 886.056399][T17694] _copy_from_user+0x2d/0xb0 [ 886.056421][T17694] input_event_from_user+0xb1/0x290 [ 886.056455][T17694] ? __pfx_input_event_from_user+0x10/0x10 [ 886.056494][T17694] evdev_write+0x2c7/0x4c0 [ 886.056522][T17694] ? __lock_acquire+0x6df/0x2e50 [ 886.056546][T17694] ? __pfx_evdev_write+0x10/0x10 [ 886.056575][T17694] ? bpf_lsm_file_permission+0x9/0x20 [ 886.056599][T17694] ? security_file_permission+0x75/0x260 [ 886.056628][T17694] ? rw_verify_area+0x203/0x4c0 [ 886.056657][T17694] ? __pfx_evdev_write+0x10/0x10 [ 886.056693][T17694] vfs_write+0x296/0xba0 [ 886.056729][T17694] ? __pfx_vfs_write+0x10/0x10 [ 886.056757][T17694] ? __fget_files+0x2a/0x420 [ 886.056784][T17694] ? __fget_files+0x2a/0x420 [ 886.056807][T17694] ? __fget_files+0x3a2/0x420 [ 886.056831][T17694] ? __fget_files+0x2a/0x420 [ 886.056864][T17694] ksys_write+0x150/0x270 [ 886.056893][T17694] ? __pfx_ksys_write+0x10/0x10 [ 886.056930][T17694] do_syscall_64+0x166/0x520 [ 886.056957][T17694] ? trace_irq_disable+0x3b/0x140 [ 886.056977][T17694] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 886.056997][T17694] ? clear_bhb_loop+0x70/0xc0 [ 886.057020][T17694] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 886.057041][T17694] RIP: 0033:0x7efda019e159 [ 886.057060][T17694] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 886.057077][T17694] RSP: 002b:00007efda0fe4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 886.057100][T17694] RAX: ffffffffffffffda RBX: 00007efda0426090 RCX: 00007efda019e159 [ 886.057115][T17694] RDX: 0000000000000918 RSI: 0000200000000040 RDI: 0000000000000004 [ 886.057128][T17694] RBP: 00007efda0fe4090 R08: 0000000000000000 R09: 0000000000000000 [ 886.057142][T17694] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 886.057155][T17694] R13: 00007efda0426128 R14: 00007efda0426090 R15: 00007efda054fa48 [ 886.057185][T17694] [ 886.229590][T13262] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 886.384796][ C1] vcan0: j1939_tp_rxtimer: 0xffff888052a7a400: abort rx timeout. Force session deactivation [ 886.395636][T13262] usb 3-1: Using ep0 maxpacket: 8 [ 886.402250][T13262] usb 3-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 886.405407][T13262] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.405433][T13262] usb 3-1: Product: syz [ 886.405447][T13262] usb 3-1: Manufacturer: syz [ 886.405461][T13262] usb 3-1: SerialNumber: syz [ 886.410292][T13262] usb 3-1: config 0 descriptor?? [ 886.415904][T13262] gspca_main: sq930x-2.14.0 probing 2770:930c [ 886.452872][ T6538] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 886.452922][ T6538] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 886.452966][ T6538] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 886.453227][ T6538] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -61 [ 886.578583][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 886.949132][T17701] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 887.115144][T17689] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3487'. [ 887.115314][T17689] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 887.160479][T13242] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 887.187833][T17689] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 887.289256][T13242] usb 4-1: device descriptor read/64, error -71 [ 887.292281][T13262] gspca_sq930x: reg_w 0305 fd00 failed -71 [ 887.292379][T13262] sq930x 3-1:0.0: probe with driver sq930x failed with error -71 [ 887.299408][T13262] usb 3-1: USB disconnect, device number 53 [ 887.468412][ T30] audit: type=1800 audit(1788599661.397:5445): pid=17707 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3491" name="bus" dev="tmpfs" ino=482 res=0 errno=0 [ 887.548702][T13242] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 887.628856][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 887.700836][T13242] usb 4-1: device descriptor read/64, error -71 [ 887.809650][T13242] usb usb4-port1: attempt power cycle [ 888.036984][ T6543] usb 6-1: USB disconnect, device number 69 [ 888.098933][T13268] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 888.149200][T13242] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 888.169292][T13242] usb 4-1: device descriptor read/8, error -71 [ 888.249841][T13268] usb 3-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 888.262673][T13268] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 888.316731][T17728] fuse: Unknown parameter '0x0000000000000008' [ 888.439902][T13242] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 888.456462][ T6538] usb 5-1: USB disconnect, device number 40 [ 888.471501][T13242] usb 4-1: device descriptor read/8, error -71 [ 888.562236][ T6538] USB vub300 remote SDIO host controller[0] now disconnected [ 888.579820][T13242] usb usb4-port1: unable to enumerate USB device [ 888.658580][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 888.658793][ C1] [ 888.670878][ C1] ============================= [ 888.675756][ C1] WARNING: suspicious RCU usage [ 888.680971][ C1] syzkaller #0 Tainted: G L [ 888.686995][ C1] ----------------------------- [ 888.691992][ C1] kernel/sched/core.c:9196 Illegal context switch in RCU-sched read-side critical section! [ 888.702056][ C1] [ 888.702056][ C1] other info that might help us debug this: [ 888.702056][ C1] [ 888.712406][ C1] [ 888.712406][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 888.720544][ C1] locks held by syz-executor/12989: 9, last CPU#1: [ 888.727254][ C1] #0: ffffffff8ee35c10 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 [ 888.736382][ C1] #1: ffff8880255629f8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 888.746439][ C1] #2: ffff888025567678 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 888.756190][ C1] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 888.766168][ C1] #4: ffff88807c0ef3d8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 888.776940][ C1] #5: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 888.786532][ C1] #6: ffff888051a72a98 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x6fb/0x5c10 [ 888.797143][ C1] #7: ffffffff8ed5c7a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 888.806646][ C1] #8: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 888.817223][ C1] [ 888.817223][ C1] stack backtrace: [ 888.823288][ C1] CPU: 1 UID: 0 PID: 12989 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 888.835613][ C1] Tainted: [L]=SOFTLOCKUP [ 888.840150][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 888.850237][ C1] Call Trace: [ 888.853553][ C1] [ 888.856808][ C1] dump_stack_lvl+0xe8/0x150 [ 888.861524][ C1] lockdep_rcu_suspicious+0x140/0x1d0 [ 888.867083][ C1] __might_resched+0xbb/0x4c0 [ 888.871897][ C1] ? __cancel_work_sync+0x5c/0x110 [ 888.877233][ C1] __cancel_work_sync+0x6d/0x110 [ 888.882225][ C1] mmc_free_host+0x19/0x30 [ 888.886794][ C1] call_timer_fn+0x18d/0x5f0 [ 888.891530][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 888.899018][ C1] ? call_timer_fn+0xd5/0x5f0 [ 888.903740][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 888.908895][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 888.914130][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 888.920927][ C1] __run_timer_base+0x652/0x8b0 [ 888.925816][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 888.931228][ C1] ? ktime_get+0x1f5/0x220 [ 888.935754][ C1] ? lapic_next_event+0x11/0x20 [ 888.940727][ C1] run_timer_softirq+0xb7/0x170 [ 888.945612][ C1] handle_softirqs+0x226/0x860 [ 888.950506][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 888.955309][ C1] __irq_exit_rcu+0xcb/0x220 [ 888.959927][ C1] irq_exit_rcu+0x9/0x30 [ 888.964189][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 888.969888][ C1] [ 888.972829][ C1] [ 888.975866][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 888.981888][ C1] RIP: 0010:lock_acquire+0x232/0x350 [ 888.987290][ C1] Code: ff ff ff e8 20 29 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 72 64 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 2c 44 0a cc 48 8d 3d f7 32 da [ 889.007020][ C1] RSP: 0018:ffffc900050bf230 EFLAGS: 00000296 [ 889.013235][ C1] RAX: d5d271bbaf577600 RBX: 0000000000000000 RCX: 8000000000000003 [ 889.021245][ C1] RDX: 00000000c616f693 RSI: ffffffff8e6fceb0 RDI: ffffffff8c6d9480 [ 889.029281][ C1] RBP: ffff8880798cbe80 R08: 3d00000000000000 R09: 0000000000000000 [ 889.037325][ C1] R10: 0000000000000000 R11: ffffffff8ed5c7a0 R12: ffffffff8ed5c7a0 [ 889.045341][ C1] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 [ 889.053397][ C1] ? pfn_valid+0xba/0x490 [ 889.057771][ C1] pfn_valid+0xd6/0x490 [ 889.061970][ C1] ? pfn_valid+0xba/0x490 [ 889.066360][ C1] page_table_check_set+0x25/0x530 [ 889.071508][ C1] copy_pmd_range+0x4adc/0x5c10 [ 889.076459][ C1] ? __pfx_copy_pmd_range+0x10/0x10 [ 889.081865][ C1] ? __lock_acquire+0x6df/0x2e50 [ 889.086928][ C1] ? mas_wr_store_type+0xf80/0x1980 [ 889.092178][ C1] copy_page_range+0xc82/0x1290 [ 889.097073][ C1] ? __pfx_copy_page_range+0x10/0x10 [ 889.102397][ C1] ? __pfx___mapping_rmap_tree_augment_rotate+0x10/0x10 [ 889.109397][ C1] dup_mmap+0xf17/0x1dc0 [ 889.113710][ C1] ? __pfx_dup_mmap+0x10/0x10 [ 889.118438][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 889.123545][ C1] ? lock_acquire+0x115/0x350 [ 889.128304][ C1] copy_mm+0x11a/0x480 [ 889.132668][ C1] ? copy_process+0xd3c/0x43e0 [ 889.137452][ C1] copy_process+0x1e75/0x43e0 [ 889.142158][ C1] ? copy_process+0xd3c/0x43e0 [ 889.147047][ C1] ? __pfx_copy_process+0x10/0x10 [ 889.152281][ C1] kernel_clone+0x2d7/0x940 [ 889.156915][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 889.161979][ C1] __x64_sys_clone+0x1b6/0x230 [ 889.166771][ C1] ? __pfx___x64_sys_clone+0x10/0x10 [ 889.172092][ C1] ? do_user_addr_fault+0xc4c/0x1340 [ 889.177397][ C1] do_syscall_64+0x166/0x520 [ 889.182101][ C1] ? trace_irq_disable+0x3b/0x140 [ 889.187166][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.193272][ C1] ? clear_bhb_loop+0x70/0xc0 [ 889.197975][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.203884][ C1] RIP: 0033:0x7f78155c6bd2 [ 889.208404][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 889.228369][ C1] RSP: 002b:00007f781594fc60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 889.237062][ C1] RAX: ffffffffffffffda RBX: 00007f781594fc60 RCX: 00007f78155c6bd2 [ 889.245061][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 889.253043][ C1] RBP: 00007f781594fdec R08: 0000000000000000 R09: 0000000000000001 [ 889.261033][ C1] R10: 0000555574cd37d0 R11: 0000000000000246 R12: 0000000000000001 [ 889.269386][ C1] R13: 00000000000927c0 R14: 00000000000d8eec R15: 00007f781594fe40 [ 889.277816][ C1] [ 889.283245][ C1] BUG: slee ** replaying previous printk message ** [ 889.283245][ C1] BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 [ 889.283299][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 12989, name: syz-executor [ 889.283322][ C1] preempt_count: 103, expected: 0 [ 889.283332][ C1] RCU nest depth: 2, expected: 0 [ 889.283341][ C1] locks held by syz-executor/12989: 9, last CPU#1: [ 889.283356][ C1] #0: ffffffff8ee35c10 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 [ 889.283420][ C1] #1: ffff8880255629f8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 889.283476][ C1] #2: ffff888025567678 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 889.283535][ C1] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 889.283588][ C1] #4: ffff88807c0ef3d8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 889.283646][ C1] #5: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 889.283698][ C1] #6: ffff888051a72a98 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x6fb/0x5c10 [ 889.283763][ C1] #7: ffffffff8ed5c7a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 889.283813][ C1] #8: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 889.283866][ C1] Preemption disabled at: [ 889.283873][ C1] [<0000000000000000>] 0x0 [ 889.283899][ C1] CPU: 1 UID: 0 PID: 12989 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 889.283926][ C1] Tainted: [L]=SOFTLOCKUP [ 889.283934][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 889.283946][ C1] Call Trace: [ 889.283955][ C1] [ 889.283963][ C1] dump_stack_lvl+0xe8/0x150 [ 889.283993][ C1] __might_resched+0x36a/0x4c0 [ 889.284027][ C1] __cancel_work_sync+0x6d/0x110 [ 889.284058][ C1] mmc_free_host+0x19/0x30 [ 889.284088][ C1] call_timer_fn+0x18d/0x5f0 [ 889.284111][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 889.284137][ C1] ? call_timer_fn+0xd5/0x5f0 [ 889.284159][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 889.284193][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 889.284219][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 889.284247][ C1] __run_timer_base+0x652/0x8b0 [ 889.284291][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 889.284317][ C1] ? ktime_get+0x1f5/0x220 [ 889.284339][ C1] ? lapic_next_event+0x11/0x20 [ 889.284366][ C1] run_timer_softirq+0xb7/0x170 [ 889.284389][ C1] handle_softirqs+0x226/0x860 [ 889.284417][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 889.284449][ C1] __irq_exit_rcu+0xcb/0x220 [ 889.284475][ C1] irq_exit_rcu+0x9/0x30 [ 889.284499][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 889.284527][ C1] [ 889.284535][ C1] [ 889.284544][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 889.284565][ C1] RIP: 0010:lock_acquire+0x232/0x350 [ 889.284587][ C1] Code: ff ff ff e8 20 29 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 72 64 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 2c 44 0a cc 48 8d 3d f7 32 da [ 889.284604][ C1] RSP: 0018:ffffc900050bf230 EFLAGS: 00000296 [ 889.284622][ C1] RAX: d5d271bbaf577600 RBX: 0000000000000000 RCX: 8000000000000003 [ 889.284637][ C1] RDX: 00000000c616f693 RSI: ffffffff8e6fceb0 RDI: ffffffff8c6d9480 [ 889.284652][ C1] RBP: ffff8880798cbe80 R08: 3d00000000000000 R09: 0000000000000000 [ 889.284666][ C1] R10: 0000000000000000 R11: ffffffff8ed5c7a0 R12: ffffffff8ed5c7a0 [ 889.284680][ C1] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 [ 889.284708][ C1] ? pfn_valid+0xba/0x490 [ 889.284731][ C1] pfn_valid+0xd6/0x490 [ 889.284751][ C1] ? pfn_valid+0xba/0x490 [ 889.284774][ C1] page_table_check_set+0x25/0x530 [ 889.284802][ C1] copy_pmd_range+0x4adc/0x5c10 [ 889.284860][ C1] ? __pfx_copy_pmd_range+0x10/0x10 [ 889.284893][ C1] ? __lock_acquire+0x6df/0x2e50 [ 889.284919][ C1] ? mas_wr_store_type+0xf80/0x1980 [ 889.284954][ C1] copy_page_range+0xc82/0x1290 [ 889.284994][ C1] ? __pfx_copy_page_range+0x10/0x10 [ 889.285023][ C1] ? __pfx___mapping_rmap_tree_augment_rotate+0x10/0x10 [ 889.285058][ C1] dup_mmap+0xf17/0x1dc0 [ 889.285101][ C1] ? __pfx_dup_mmap+0x10/0x10 [ 889.285128][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 889.285186][ C1] ? lock_acquire+0x115/0x350 [ 889.285222][ C1] copy_mm+0x11a/0x480 [ 889.285249][ C1] ? copy_process+0xd3c/0x43e0 [ 889.285280][ C1] copy_process+0x1e75/0x43e0 [ 889.285313][ C1] ? copy_process+0xd3c/0x43e0 [ 889.285355][ C1] ? __pfx_copy_process+0x10/0x10 [ 889.285391][ C1] kernel_clone+0x2d7/0x940 [ 889.285423][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 889.285468][ C1] __x64_sys_clone+0x1b6/0x230 [ 889.285497][ C1] ? __pfx___x64_sys_clone+0x10/0x10 [ 889.285540][ C1] ? do_user_addr_fault+0xc4c/0x1340 [ 889.285570][ C1] do_syscall_64+0x166/0x520 [ 889.285598][ C1] ? trace_irq_disable+0x3b/0x140 [ 889.285618][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.285638][ C1] ? clear_bhb_loop+0x70/0xc0 [ 889.285663][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.285682][ C1] RIP: 0033:0x7f78155c6bd2 [ 889.285701][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 889.285717][ C1] RSP: 002b:00007f781594fc60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 889.285738][ C1] RAX: ffffffffffffffda RBX: 00007f781594fc60 RCX: 00007f78155c6bd2 [ 889.285752][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 889.285764][ C1] RBP: 00007f781594fdec R08: 0000000000000000 R09: 0000000000000001 [ 889.285777][ C1] R10: 0000555574cd37d0 R11: 0000000000000246 R12: 0000000000000001 [ 889.285790][ C1] R13: 00000000000927c0 R14: 00000000000d8eec R15: 00007f781594fe40 [ 889.285820][ C1] [ 889.286025][ C1] [ 889.708568][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 889.874413][ C1] ============================= [ 889.879354][ C1] WARNING: suspicious RCU usage [ 889.884243][ C1] syzkaller #0 Tainted: G W L [ 889.890323][ C1] ----------------------------- [ 889.895191][ C1] kernel/rcu/srcutree.c:1468 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! [ 889.907219][ C1] [ 889.907219][ C1] other info that might help us debug this: [ 889.907219][ C1] [ 889.917499][ C1] [ 889.917499][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 889.925608][ C1] locks held by syz-executor/12989: 9, last CPU#1: [ 889.932180][ C1] #0: ffffffff8ee35c10 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 [ 889.940955][ C1] #1: ffff8880255629f8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 889.950113][ C1] #2: ffff888025567678 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 889.959409][ C1] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 889.969071][ C1] #4: ffff88807c0ef3d8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 889.979615][ C1] #5: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 889.989207][ C1] #6: ffff888051a72a98 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x6fb/0x5c10 [ 889.999607][ C1] #7: ffffffff8ed5c7a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 890.009328][ C1] #8: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 890.019989][ C1] [ 890.019989][ C1] stack backtrace: [ 890.025922][ C1] CPU: 1 UID: 0 PID: 12989 Comm: syz-executor Tainted: G W L syzkaller #0 PREEMPT(full) [ 890.037148][ C1] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 890.042362][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 890.052416][ C1] Call Trace: [ 890.055697][ C1] [ 890.058540][ C1] dump_stack_lvl+0xe8/0x150 [ 890.063138][ C1] lockdep_rcu_suspicious+0x140/0x1d0 [ 890.068524][ C1] __synchronize_srcu+0x157/0x2f0 [ 890.073816][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 890.079385][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 890.084549][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 890.090365][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 890.095936][ C1] ? synchronize_srcu+0x20a/0x260 [ 890.101193][ C1] wakeup_source_unregister+0x129/0x3f0 [ 890.106905][ C1] mmc_host_classdev_release+0x47/0x100 [ 890.112484][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 890.118760][ C1] device_release+0xc4/0x1f0 [ 890.123429][ C1] kobject_put+0x222/0x550 [ 890.127955][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 890.132909][ C1] call_timer_fn+0x18d/0x5f0 [ 890.137540][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 890.144240][ C1] ? call_timer_fn+0xd5/0x5f0 [ 890.149030][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 890.154163][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 890.159379][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 890.166075][ C1] __run_timer_base+0x652/0x8b0 [ 890.170951][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 890.176342][ C1] ? ktime_get+0x1f5/0x220 [ 890.180771][ C1] ? lapic_next_event+0x11/0x20 [ 890.185688][ C1] run_timer_softirq+0xb7/0x170 [ 890.190642][ C1] handle_softirqs+0x226/0x860 [ 890.195430][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 890.200234][ C1] __irq_exit_rcu+0xcb/0x220 [ 890.204841][ C1] irq_exit_rcu+0x9/0x30 [ 890.209097][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 890.214747][ C1] [ 890.217685][ C1] [ 890.220708][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 890.226719][ C1] RIP: 0010:lock_acquire+0x232/0x350 [ 890.232023][ C1] Code: ff ff ff e8 20 29 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 72 64 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 2c 44 0a cc 48 8d 3d f7 32 da [ 890.251821][ C1] RSP: 0018:ffffc900050bf230 EFLAGS: 00000296 [ 890.257923][ C1] RAX: d5d271bbaf577600 RBX: 0000000000000000 RCX: 8000000000000003 [ 890.265903][ C1] RDX: 00000000c616f693 RSI: ffffffff8e6fceb0 RDI: ffffffff8c6d9480 [ 890.273889][ C1] RBP: ffff8880798cbe80 R08: 3d00000000000000 R09: 0000000000000000 [ 890.281874][ C1] R10: 0000000000000000 R11: ffffffff8ed5c7a0 R12: ffffffff8ed5c7a0 [ 890.289964][ C1] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 [ 890.297968][ C1] ? pfn_valid+0xba/0x490 [ 890.302330][ C1] pfn_valid+0xd6/0x490 [ 890.306498][ C1] ? pfn_valid+0xba/0x490 [ 890.311012][ C1] page_table_check_set+0x25/0x530 [ 890.316142][ C1] copy_pmd_range+0x4adc/0x5c10 [ 890.321046][ C1] ? __pfx_copy_pmd_range+0x10/0x10 [ 890.326265][ C1] ? __lock_acquire+0x6df/0x2e50 [ 890.331308][ C1] ? mas_wr_store_type+0xf80/0x1980 [ 890.336543][ C1] copy_page_range+0xc82/0x1290 [ 890.341424][ C1] ? __pfx_copy_page_range+0x10/0x10 [ 890.346726][ C1] ? __pfx___mapping_rmap_tree_augment_rotate+0x10/0x10 [ 890.353683][ C1] dup_mmap+0xf17/0x1dc0 [ 890.358045][ C1] ? __pfx_dup_mmap+0x10/0x10 [ 890.362828][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 890.367879][ C1] ? lock_acquire+0x115/0x350 [ 890.372663][ C1] copy_mm+0x11a/0x480 [ 890.376748][ C1] ? copy_process+0xd3c/0x43e0 [ 890.381525][ C1] copy_process+0x1e75/0x43e0 [ 890.386329][ C1] ? copy_process+0xd3c/0x43e0 [ 890.391136][ C1] ? __pfx_copy_process+0x10/0x10 [ 890.396201][ C1] kernel_clone+0x2d7/0x940 [ 890.400815][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 890.405983][ C1] __x64_sys_clone+0x1b6/0x230 [ 890.410774][ C1] ? __pfx___x64_sys_clone+0x10/0x10 [ 890.416211][ C1] ? do_user_addr_fault+0xc4c/0x1340 [ 890.421532][ C1] do_syscall_64+0x166/0x520 [ 890.426146][ C1] ? trace_irq_disable+0x3b/0x140 [ 890.431292][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.437671][ C1] ? clear_bhb_loop+0x70/0xc0 [ 890.442399][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.448338][ C1] RIP: 0033:0x7f78155c6bd2 [ 890.452771][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 890.472740][ C1] RSP: 002b:00007f781594fc60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 890.481280][ C1] RAX: ffffffffffffffda RBX: 00007f781594fc60 RCX: 00007f78155c6bd2 [ 890.489354][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 890.497348][ C1] RBP: 00007f781594fdec R08: 0000000000000000 R09: 0000000000000001 [ 890.505465][ C1] R10: 0000555574cd37d0 R11: 0000000000000246 R12: 0000000000000001 [ 890.513474][ C1] R13: 00000000000927c0 R14: 00000000000d8eec R15: 00007f781594fe40 [ 890.521612][ C1] [ 890.524773][ C1] BUG: slee ** replaying previous printk message ** [ 890.524773][ C1] BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1472 [ 890.524799][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 12989, name: syz-executor [ 890.524825][ C1] preempt_count: 103, expected: 0 [ 890.524843][ C1] RCU nest depth: 2, expected: 0 [ 890.524860][ C1] locks held by syz-executor/12989: 9, last CPU#1: [ 890.524883][ C1] #0: ffffffff8ee35c10 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 [ 890.524972][ C1] #1: ffff8880255629f8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 890.525055][ C1] #2: ffff888025567678 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 890.525162][ C1] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 890.525255][ C1] #4: ffff88807c0ef3d8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 890.525342][ C1] #5: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 890.525410][ C1] #6: ffff888051a72a98 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x6fb/0x5c10 [ 890.525510][ C1] #7: ffffffff8ed5c7a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 [ 890.525587][ C1] #8: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 890.525663][ C1] Preemption disabled at: [ 890.525674][ C1] [<0000000000000000>] 0x0 [ 890.525704][ C1] CPU: 1 UID: 0 PID: 12989 Comm: syz-executor Tainted: G W L syzkaller #0 PREEMPT(full) [ 890.525733][ C1] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 890.525741][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 890.525752][ C1] Call Trace: [ 890.525761][ C1] [ 890.525770][ C1] dump_stack_lvl+0xe8/0x150 [ 890.525798][ C1] __might_resched+0x36a/0x4c0 [ 890.525832][ C1] __synchronize_srcu+0x1a1/0x2f0 [ 890.525856][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 890.525875][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 890.525917][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 890.525947][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 890.525984][ C1] ? synchronize_srcu+0x20a/0x260 [ 890.526007][ C1] wakeup_source_unregister+0x129/0x3f0 [ 890.526044][ C1] mmc_host_classdev_release+0x47/0x100 [ 890.526079][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 890.526107][ C1] device_release+0xc4/0x1f0 [ 890.526134][ C1] kobject_put+0x222/0x550 [ 890.526160][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 890.526184][ C1] call_timer_fn+0x18d/0x5f0 [ 890.526207][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 890.526235][ C1] ? call_timer_fn+0xd5/0x5f0 [ 890.526264][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 890.526297][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 890.526323][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 890.526351][ C1] __run_timer_base+0x652/0x8b0 [ 890.526386][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 890.526413][ C1] ? ktime_get+0x1f5/0x220 [ 890.526434][ C1] ? lapic_next_event+0x11/0x20 [ 890.526462][ C1] run_timer_softirq+0xb7/0x170 [ 890.526486][ C1] handle_softirqs+0x226/0x860 [ 890.526515][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 890.526546][ C1] __irq_exit_rcu+0xcb/0x220 [ 890.526572][ C1] irq_exit_rcu+0x9/0x30 [ 890.526595][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 890.526623][ C1] [ 890.526632][ C1] [ 890.526641][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 890.526662][ C1] RIP: 0010:lock_acquire+0x232/0x350 [ 890.526684][ C1] Code: ff ff ff e8 20 29 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 72 64 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 2c 44 0a cc 48 8d 3d f7 32 da [ 890.526702][ C1] RSP: 0018:ffffc900050bf230 EFLAGS: 00000296 [ 890.526721][ C1] RAX: d5d271bbaf577600 RBX: 0000000000000000 RCX: 8000000000000003 [ 890.526736][ C1] RDX: 00000000c616f693 RSI: ffffffff8e6fceb0 RDI: ffffffff8c6d9480 [ 890.526750][ C1] RBP: ffff8880798cbe80 R08: 3d00000000000000 R09: 0000000000000000 [ 890.526764][ C1] R10: 0000000000000000 R11: ffffffff8ed5c7a0 R12: ffffffff8ed5c7a0 [ 890.526778][ C1] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 [ 890.526806][ C1] ? pfn_valid+0xba/0x490 [ 890.526830][ C1] pfn_valid+0xd6/0x490 [ 890.526849][ C1] ? pfn_valid+0xba/0x490 [ 890.526882][ C1] page_table_check_set+0x25/0x530 [ 890.526910][ C1] copy_pmd_range+0x4adc/0x5c10 [ 890.526968][ C1] ? __pfx_copy_pmd_range+0x10/0x10 [ 890.527001][ C1] ? __lock_acquire+0x6df/0x2e50 [ 890.527027][ C1] ? mas_wr_store_type+0xf80/0x1980 [ 890.527062][ C1] copy_page_range+0xc82/0x1290 [ 890.527102][ C1] ? __pfx_copy_page_range+0x10/0x10 [ 890.527131][ C1] ? __pfx___mapping_rmap_tree_augment_rotate+0x10/0x10 [ 890.527295][ C1] dup_mmap+0xf17/0x1dc0 [ 890.527356][ C1] ? __pfx_dup_mmap+0x10/0x10 [ 890.527386][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 890.527426][ C1] ? lock_acquire+0x115/0x350 [ 890.527474][ C1] copy_mm+0x11a/0x480 [ 890.527507][ C1] ? copy_process+0xd3c/0x43e0 [ 890.527530][ C1] copy_process+0x1e75/0x43e0 [ 890.527564][ C1] ? copy_process+0xd3c/0x43e0 [ 890.527611][ C1] ? __pfx_copy_process+0x10/0x10 [ 890.527648][ C1] kernel_clone+0x2d7/0x940 [ 890.527682][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 890.527735][ C1] __x64_sys_clone+0x1b6/0x230 [ 890.527767][ C1] ? __pfx___x64_sys_clone+0x10/0x10 [ 890.527811][ C1] ? do_user_addr_fault+0xc4c/0x1340 [ 890.527857][ C1] do_syscall_64+0x166/0x520 [ 890.527887][ C1] ? trace_irq_disable+0x3b/0x140 [ 890.527906][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.527937][ C1] ? clear_bhb_loop+0x70/0xc0 [ 890.527969][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.527989][ C1] RIP: 0033:0x7f78155c6bd2 [ 890.528011][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 890.528029][ C1] RSP: 002b:00007f781594fc60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 890.528053][ C1] RAX: ffffffffffffffda RBX: 00007f781594fc60 RCX: 00007f78155c6bd2 [ 890.528076][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 890.528089][ C1] RBP: 00007f781594fdec R08: 0000000000000000 R09: 0000000000000001 [ 890.528103][ C1] R10: 0000555574cd37d0 R11: 0000000000000246 R12: 0000000000000001 [ 890.528116][ C1] R13: 00000000000927c0 R14: 00000000000d8eec R15: 00007f781594fe40 [ 890.528147][ C1] [ 890.528167][ C1] ODEBUG: object ffffc90000a18a80 is NOT on stack ffffc900050b8000, but annotated. [ 890.528726][ C1] ------------[ cut here ]------------ [ 890.528737][ C1] 1 [ 890.528744][ C1] WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0, CPU#1: syz-executor/12989 [ 890.839076][ C0] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 891.196698][ C1] Modules linked in: [ 891.200610][ C1] CPU: 1 UID: 0 PID: 12989 Comm: syz-executor Tainted: G W L syzkaller #0 PREEMPT(full) [ 891.211732][ C1] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 891.216930][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 891.226991][ C1] RIP: 0010:__debug_object_init+0x2c4/0x3c0 [ 891.232903][ C1] Code: fd 06 cc 41 ff c7 44 89 3d a9 6a e8 15 48 c7 c1 80 9d 6d 8c 48 c7 c7 e0 9d 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 2d df 3d fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 01 b3 6e 0a 3b 05 ff [ 891.252612][ C1] RSP: 0018:ffffc90000a189b8 EFLAGS: 00010046 [ 891.258705][ C1] RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: d5d271bbaf577600 [ 891.266690][ C1] RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 [ 891.274764][ C1] RBP: ffff8880798cbea0 R08: 0000000000000100 R09: 0000000000080000 [ 891.282763][ C1] R10: 0000000000008000 R11: ffffffff8ec362b8 R12: 1ffff9200014314c [ 891.290949][ C1] R13: ffff888025bc1658 R14: dffffc0000000000 R15: 0000000000000001 [ 891.299117][ C1] FS: 0000555574cd3500(0000) GS:ffff888124dd8000(0000) knlGS:0000000000000000 [ 891.308059][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 891.314646][ C1] CR2: 00007f78163556c8 CR3: 000000007c164000 CR4: 00000000003526f0 [ 891.322716][ C1] Call Trace: [ 891.326011][ C1] [ 891.328864][ C1] ? __init_swait_queue_head+0xa8/0x150 [ 891.334520][ C1] __synchronize_srcu+0x1d5/0x2f0 [ 891.339565][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 891.345150][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 891.350807][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 891.356624][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 891.362191][ C1] ? synchronize_srcu+0x20a/0x260 [ 891.367218][ C1] wakeup_source_unregister+0x129/0x3f0 [ 891.372779][ C1] mmc_host_classdev_release+0x47/0x100 [ 891.378447][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 891.384700][ C1] device_release+0xc4/0x1f0 [ 891.389440][ C1] kobject_put+0x222/0x550 [ 891.393962][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 891.398829][ C1] call_timer_fn+0x18d/0x5f0 [ 891.403620][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 891.410505][ C1] ? call_timer_fn+0xd5/0x5f0 [ 891.415211][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 891.420517][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 891.425732][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 891.432684][ C1] __run_timer_base+0x652/0x8b0 [ 891.437685][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 891.443153][ C1] ? ktime_get+0x1f5/0x220 [ 891.447595][ C1] ? lapic_next_event+0x11/0x20 [ 891.452747][ C1] run_timer_softirq+0xb7/0x170 [ 891.457787][ C1] handle_softirqs+0x226/0x860 [ 891.463534][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 891.468319][ C1] __irq_exit_rcu+0xcb/0x220 [ 891.472920][ C1] irq_exit_rcu+0x9/0x30 [ 891.477169][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 891.482817][ C1] [ 891.485750][ C1] [ 891.488685][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 891.494674][ C1] RIP: 0010:lock_acquire+0x232/0x350 [ 891.499968][ C1] Code: ff ff ff e8 20 29 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 72 64 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 2c 44 0a cc 48 8d 3d f7 32 da [ 891.521231][ C1] RSP: 0018:ffffc900050bf230 EFLAGS: 00000296 [ 891.527474][ C1] RAX: d5d271bbaf577600 RBX: 0000000000000000 RCX: 8000000000000003 [ 891.535561][ C1] RDX: 00000000c616f693 RSI: ffffffff8e6fceb0 RDI: ffffffff8c6d9480 [ 891.543564][ C1] RBP: ffff8880798cbe80 R08: 3d00000000000000 R09: 0000000000000000 [ 891.551661][ C1] R10: 0000000000000000 R11: ffffffff8ed5c7a0 R12: ffffffff8ed5c7a0 [ 891.559743][ C1] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 [ 891.567824][ C1] ? pfn_valid+0xba/0x490 [ 891.572168][ C1] pfn_valid+0xd6/0x490 [ 891.576348][ C1] ? pfn_valid+0xba/0x490 [ 891.580927][ C1] page_table_check_set+0x25/0x530 [ 891.586082][ C1] copy_pmd_range+0x4adc/0x5c10 [ 891.590985][ C1] ? __pfx_copy_pmd_range+0x10/0x10 [ 891.596207][ C1] ? __lock_acquire+0x6df/0x2e50 [ 891.601172][ C1] ? mas_wr_store_type+0xf80/0x1980 [ 891.606425][ C1] copy_page_range+0xc82/0x1290 [ 891.611312][ C1] ? __pfx_copy_page_range+0x10/0x10 [ 891.616710][ C1] ? __pfx___mapping_rmap_tree_augment_rotate+0x10/0x10 [ 891.623763][ C1] dup_mmap+0xf17/0x1dc0 [ 891.628124][ C1] ? __pfx_dup_mmap+0x10/0x10 [ 891.632817][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 891.637872][ C1] ? lock_acquire+0x115/0x350 [ 891.642573][ C1] copy_mm+0x11a/0x480 [ 891.646659][ C1] ? copy_process+0xd3c/0x43e0 [ 891.651433][ C1] copy_process+0x1e75/0x43e0 [ 891.656147][ C1] ? copy_process+0xd3c/0x43e0 [ 891.661033][ C1] ? __pfx_copy_process+0x10/0x10 [ 891.666105][ C1] kernel_clone+0x2d7/0x940 [ 891.670631][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 891.675687][ C1] __x64_sys_clone+0x1b6/0x230 [ 891.680497][ C1] ? __pfx___x64_sys_clone+0x10/0x10 [ 891.685837][ C1] ? do_user_addr_fault+0xc4c/0x1340 [ 891.691185][ C1] do_syscall_64+0x166/0x520 [ 891.695816][ C1] ? trace_irq_disable+0x3b/0x140 [ 891.700851][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.706928][ C1] ? clear_bhb_loop+0x70/0xc0 [ 891.711618][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.717516][ C1] RIP: 0033:0x7f78155c6bd2 [ 891.721937][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 891.742080][ C1] RSP: 002b:00007f781594fc60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 891.750523][ C1] RAX: ffffffffffffffda RBX: 00007f781594fc60 RCX: 00007f78155c6bd2 [ 891.758511][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 891.766577][ C1] RBP: 00007f781594fdec R08: 0000000000000000 R09: 0000000000000001 [ 891.774739][ C1] R10: 0000555574cd37d0 R11: 0000000000000246 R12: 0000000000000001 [ 891.783096][ C1] R13: 00000000000927c0 R14: 00000000000d8eec R15: 00007f781594fe40 [ 891.791213][ C1] [ 891.794363][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 891.801708][ C1] CPU: 1 UID: 0 PID: 12989 Comm: syz-executor Tainted: G W L syzkaller #0 PREEMPT(full) [ 891.812853][ C1] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 891.818329][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 891.828391][ C1] Call Trace: [ 891.831679][ C1] [ 891.834557][ C1] vpanic+0x56d/0xa60 [ 891.838599][ C1] ? __pfx__printk+0x10/0x10 [ 891.843205][ C1] ? __pfx_vpanic+0x10/0x10 [ 891.847719][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 891.853014][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 891.858226][ C1] panic+0xc5/0xd0 [ 891.861961][ C1] ? __pfx_panic+0x10/0x10 [ 891.866406][ C1] __warn+0x315/0x4c0 [ 891.870495][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 891.875796][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 891.881088][ C1] __report_bug+0x276/0x570 [ 891.885684][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 891.890982][ C1] ? __pfx___report_bug+0x10/0x10 [ 891.896198][ C1] ? __wake_up_klogd+0xf0/0x130 [ 891.901265][ C1] ? vprintk_emit+0x4ee/0x560 [ 891.905966][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 891.911007][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 891.916393][ C1] report_bug+0x16b/0x220 [ 891.920736][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 891.926026][ C1] ? __debug_object_init+0x2c6/0x3c0 [ 891.931324][ C1] handle_bug+0x9c/0x200 [ 891.935577][ C1] exc_invalid_op+0x1a/0x50 [ 891.940178][ C1] asm_exc_invalid_op+0x1a/0x20 [ 891.945038][ C1] RIP: 0010:__debug_object_init+0x2c4/0x3c0 [ 891.950940][ C1] Code: fd 06 cc 41 ff c7 44 89 3d a9 6a e8 15 48 c7 c1 80 9d 6d 8c 48 c7 c7 e0 9d 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 2d df 3d fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 01 b3 6e 0a 3b 05 ff [ 891.970569][ C1] RSP: 0018:ffffc90000a189b8 EFLAGS: 00010046 [ 891.976648][ C1] RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: d5d271bbaf577600 [ 891.984623][ C1] RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 [ 891.992601][ C1] RBP: ffff8880798cbea0 R08: 0000000000000100 R09: 0000000000080000 [ 892.000591][ C1] R10: 0000000000008000 R11: ffffffff8ec362b8 R12: 1ffff9200014314c [ 892.008584][ C1] R13: ffff888025bc1658 R14: dffffc0000000000 R15: 0000000000000001 [ 892.017104][ C1] ? __debug_object_init+0x2c3/0x3c0 [ 892.022414][ C1] ? __init_swait_queue_head+0xa8/0x150 [ 892.027988][ C1] __synchronize_srcu+0x1d5/0x2f0 [ 892.033025][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 892.038596][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 892.043786][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 892.049628][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 892.055201][ C1] ? synchronize_srcu+0x20a/0x260 [ 892.060330][ C1] wakeup_source_unregister+0x129/0x3f0 [ 892.065899][ C1] mmc_host_classdev_release+0x47/0x100 [ 892.071463][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 892.077632][ C1] device_release+0xc4/0x1f0 [ 892.082235][ C1] kobject_put+0x222/0x550 [ 892.086656][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 892.091488][ C1] call_timer_fn+0x18d/0x5f0 [ 892.096090][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 892.102865][ C1] ? call_timer_fn+0xd5/0x5f0 [ 892.107552][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 892.112683][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 892.117896][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 892.124674][ C1] __run_timer_base+0x652/0x8b0 [ 892.129553][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 892.134938][ C1] ? ktime_get+0x1f5/0x220 [ 892.139712][ C1] ? lapic_next_event+0x11/0x20 [ 892.144609][ C1] run_timer_softirq+0xb7/0x170 [ 892.149478][ C1] handle_softirqs+0x226/0x860 [ 892.154271][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 892.159067][ C1] __irq_exit_rcu+0xcb/0x220 [ 892.163670][ C1] irq_exit_rcu+0x9/0x30 [ 892.168007][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 892.173661][ C1] [ 892.176598][ C1] [ 892.179536][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 892.185531][ C1] RIP: 0010:lock_acquire+0x232/0x350 [ 892.190823][ C1] Code: ff ff ff e8 20 29 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 72 64 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 2c 44 0a cc 48 8d 3d f7 32 da [ 892.210575][ C1] RSP: 0018:ffffc900050bf230 EFLAGS: 00000296 [ 892.216746][ C1] RAX: d5d271bbaf577600 RBX: 0000000000000000 RCX: 8000000000000003 [ 892.224812][ C1] RDX: 00000000c616f693 RSI: ffffffff8e6fceb0 RDI: ffffffff8c6d9480 [ 892.232972][ C1] RBP: ffff8880798cbe80 R08: 3d00000000000000 R09: 0000000000000000 [ 892.240954][ C1] R10: 0000000000000000 R11: ffffffff8ed5c7a0 R12: ffffffff8ed5c7a0 [ 892.248938][ C1] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 [ 892.257020][ C1] ? pfn_valid+0xba/0x490 [ 892.261365][ C1] pfn_valid+0xd6/0x490 [ 892.265558][ C1] ? pfn_valid+0xba/0x490 [ 892.269993][ C1] page_table_check_set+0x25/0x530 [ 892.275118][ C1] copy_pmd_range+0x4adc/0x5c10 [ 892.280015][ C1] ? __pfx_copy_pmd_range+0x10/0x10 [ 892.285234][ C1] ? __lock_acquire+0x6df/0x2e50 [ 892.290187][ C1] ? mas_wr_store_type+0xf80/0x1980 [ 892.295580][ C1] copy_page_range+0xc82/0x1290 [ 892.300454][ C1] ? __pfx_copy_page_range+0x10/0x10 [ 892.305841][ C1] ? __pfx___mapping_rmap_tree_augment_rotate+0x10/0x10 [ 892.312884][ C1] dup_mmap+0xf17/0x1dc0 [ 892.317697][ C1] ? __pfx_dup_mmap+0x10/0x10 [ 892.323212][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 892.329239][ C1] ? lock_acquire+0x115/0x350 [ 892.333961][ C1] copy_mm+0x11a/0x480 [ 892.338167][ C1] ? copy_process+0xd3c/0x43e0 [ 892.342972][ C1] copy_process+0x1e75/0x43e0 [ 892.347679][ C1] ? copy_process+0xd3c/0x43e0 [ 892.352508][ C1] ? __pfx_copy_process+0x10/0x10 [ 892.357584][ C1] kernel_clone+0x2d7/0x940 [ 892.362211][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 892.367305][ C1] __x64_sys_clone+0x1b6/0x230 [ 892.372100][ C1] ? __pfx___x64_sys_clone+0x10/0x10 [ 892.377503][ C1] ? do_user_addr_fault+0xc4c/0x1340 [ 892.382844][ C1] do_syscall_64+0x166/0x520 [ 892.387488][ C1] ? trace_irq_disable+0x3b/0x140 [ 892.392540][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.398632][ C1] ? clear_bhb_loop+0x70/0xc0 [ 892.403325][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.409232][ C1] RIP: 0033:0x7f78155c6bd2 [ 892.413658][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 892.433614][ C1] RSP: 002b:00007f781594fc60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 892.442126][ C1] RAX: ffffffffffffffda RBX: 00007f781594fc60 RCX: 00007f78155c6bd2 [ 892.450106][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 892.458176][ C1] RBP: 00007f781594fdec R08: 0000000000000000 R09: 0000000000000001 [ 892.466334][ C1] R10: 0000555574cd37d0 R11: 0000000000000246 R12: 0000000000000001 [ 892.474395][ C1] R13: 00000000000927c0 R14: 00000000000d8eec R15: 00007f781594fe40 [ 892.482393][ C1] [ 892.485744][ C1] Kernel Offset: disabled [ 892.490075][ C1] Rebooting in 86400 seconds..