last executing test programs: 25.121432922s ago: executing program 3 (id=2887): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x1c}}, 0x0) getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) set_mempolicy(0x4005, &(0x7f0000000200)=0x4, 0x8) r7 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl(r7, 0xfffff000, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r6], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000800)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=r6, @ANYRES16=r5, @ANYRES32=r6, @ANYBLOB="d24e2bed1540ce574ddd81bafb8a280099b1a8463feb38dd46feb321a10c988e316579680cb06b91a7b1a86fd54e2866089eb47e9ffff1f62fa6c9c1fd1246a6ac425d23ccca21d2dfa14d73b0465d909f692837f37801a2007c40f2915ec0987de080fd2bb2ef01759121822fb43107dc94a9c289bee0066d3b41ea32d84cbf795c318a8c288bac5a15568e3b78f3f00c091494665440dd4aa4e649a0b73da962cf6ffa761302755b447e6b3234bcb4c754e620d54d450943e1949cde157cf6765f0f59b3d07e"], 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) sendmsg$nl_route(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r6], 0x5c}}, 0x40) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f00000005c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000640)={&(0x7f0000000680)={0x14, 0x0, 0x20, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x24040004) syz_usb_connect(0x3, 0x2d, &(0x7f00000006c0)=ANY=[@ANYBLOB="12010202550a0308fd03beebc2380102030109021b00011c0150840904"], &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x100000b, 0x4000010, 0xffffffffffffffff, 0xfffff000) r8 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x1, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r9 = userfaultfd(0x80801) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000000740)={0xaa, 0x54}) ioctl$UFFDIO_REGISTER(r9, 0xc020aa00, &(0x7f0000000780)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r9, 0xc028aa03, &(0x7f00000007c0)={&(0x7f0000dd1000/0x2000)=nil, &(0x7f0000199000/0x800000)=nil, 0x2000, 0x3, 0xf4ffffff}) ioctl$F2FS_IOC_SEC_TRIM_FILE(0xffffffffffffffff, 0x4018f514, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) 22.815464347s ago: executing program 3 (id=2894): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r0, 0x0, 0x40000000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='pagemap\x00') pread64(r1, &(0x7f0000000a80)=""/4096, 0x1000, 0x7ffffffffffff8) socket(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000000c0)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000140), 0x318, 0x0) recvmmsg(r2, &(0x7f0000000180), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f00000001c0)={0xa0000004}) poll(&(0x7f0000000200)=[{r4, 0x80}, {r3, 0x2cfc08c20dafc34e}], 0x2, 0x101) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0x2, 0x0) close(r5) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r6, &(0x7f0000000a00)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r6, &(0x7f0000000a40)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r5, 0x6, 0x21, &(0x7f0000000040)="85eeecc6bf1894868e7c1cf7c4e13e52", 0x10) write$FUSE_NOTIFY_INVAL_ENTRY(r5, 0x0, 0x22) 18.402072397s ago: executing program 3 (id=2903): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000700)=ANY=[@ANYBLOB="480000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="1d060b00000000002800128008000100677470001c00028008000200", @ANYRES32, @ANYBLOB="08000300030000000800040000000000940674e6ad4157d75f97649acd88d1c01cacfb92091d881e23d461d2727bad2880b1902f3a53fa11b27db198ba445c886a3ad3406157bf18582a"], 0x48}, 0x1, 0x0, 0x0, 0x690}, 0x20008050) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r1 = syz_io_uring_setup(0x10f, &(0x7f0000000080)={0x0, 0x39c4, 0x2, 0x1, 0xfffffffe}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_IOWQ_AFF(r1, 0x11, &(0x7f00000001c0)='n', 0x1) io_pgetevents(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000240)={0x0, 0x0, 0xfd8b, 0x5}) timer_create(0x5, 0x0, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x2, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) connect$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$vcsu(&(0x7f0000000400), 0x8, 0x185000) write$P9_RWRITE(r2, &(0x7f00000005c0)={0xb, 0x77, 0x2, 0x3}, 0xb) set_mempolicy(0x8006, &(0x7f0000000280)=0xfff, 0x5) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) sendmsg$MPTCP_PM_CMD_SET_FLAGS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="01002bad7000fd79ed4c23c56839"], 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x20040000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x22401, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="ec0100000001050500000000000000000a0000003c0002802c00018014000300ff010000000000000000001f0000000114000400ff0200000000000000000000000000010c00028005000100000080003c0001800c00028005000100000000002c"], 0x1ec}}, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000004c0)=[@text64={0x40, &(0x7f0000000500)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000580)=[@textreal={0x8, 0x0}], 0x1, 0x38, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 17.311083762s ago: executing program 3 (id=2907): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000340)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x28, r3, 0x1, 0x70bd2c, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x20, r5, 0x7, 0x3, 0x1fff, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x48041}, 0x0) 10.589684709s ago: executing program 2 (id=2936): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000002c0)) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x3, @remote, 'ip6_vti0\x00'}}, 0x1e) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x20040400) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r1, 0x4008941a, &(0x7f0000000080)=0x2) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f00000000c0)) 9.726949242s ago: executing program 2 (id=2938): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) r1 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r1, 0x0, 0x20000080) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_dev$sg(0x0, 0x0, 0x401) socket$inet_smc(0x2b, 0x1, 0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f00000001c0)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000200)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$pppoe(0x18, 0x1, 0x0) r2 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80000) rt_sigprocmask(0x0, &(0x7f00000002c0)={[0xfffffffffffffffd]}, 0x0, 0x8) r3 = socket$unix(0x1, 0x2, 0x0) recvmmsg$unix(r3, &(0x7f0000008cc0)=[{{&(0x7f00000004c0), 0x6e, &(0x7f0000001580)=[{&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f0000001540)=""/15, 0xf}], 0x2, &(0x7f00000015c0)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}}, {{&(0x7f0000001680), 0x6e, &(0x7f0000001b40)=[{&(0x7f0000001700)=""/210, 0xd2}, {&(0x7f0000001800)=""/48, 0x30}, {&(0x7f0000001840)=""/106, 0x6a}, {&(0x7f00000018c0)=""/240, 0xf0}, {&(0x7f00000019c0)=""/59, 0x3b}, {&(0x7f0000001a00)=""/222, 0xde}, {&(0x7f0000001b00)=""/43, 0x2b}], 0x7, &(0x7f0000001bc0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}, {{&(0x7f0000001c00), 0x6e, &(0x7f00000044c0)=[{&(0x7f0000001c80)=""/7, 0x7}, {&(0x7f0000001cc0)=""/43, 0x2b}, {&(0x7f0000001d00)=""/37, 0x25}, {&(0x7f0000001d40)=""/192, 0xc0}, {&(0x7f0000001e00)=""/119, 0x77}, {&(0x7f0000001e80)=""/4096, 0x1000}], 0x6, &(0x7f0000002f00)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x28}}, {{&(0x7f0000002f40), 0x6e, &(0x7f0000003240)=[{&(0x7f0000002fc0)=""/229, 0xe5}, {&(0x7f00000030c0)=""/94, 0x5e}, {&(0x7f0000003140)=""/68, 0x44}, {&(0x7f00000031c0)=""/18, 0x12}, {&(0x7f0000003200)=""/64, 0x40}], 0x5, &(0x7f00000032c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f0000003340), 0x6e, &(0x7f0000004780)=[{&(0x7f00000033c0)=""/4096, 0x1000}, {&(0x7f00000043c0)=""/3, 0x3}, {&(0x7f0000004400)=""/137, 0x89}, {&(0x7f0000008f40)=""/183, 0xb7}, {&(0x7f0000004580)=""/203, 0xcb}, {&(0x7f0000004680)=""/75, 0x4b}, {&(0x7f0000004700)=""/78, 0x4e}], 0x7, &(0x7f0000004800)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb8}}, {{&(0x7f00000048c0)=@abs, 0x6e, &(0x7f0000005d80)=[{&(0x7f0000004940)=""/18, 0x12}, {&(0x7f0000004980)=""/206, 0xce}, {&(0x7f0000004a80)=""/71, 0x47}, {&(0x7f0000004b00)=""/172, 0xac}, {&(0x7f0000004bc0)=""/201, 0xfffffffffffffc58}, {&(0x7f0000004cc0)=""/4096, 0x1000}, {&(0x7f0000005cc0)=""/140, 0x8c}], 0x7, &(0x7f0000005e00)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x38}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x100}}, {{0x0, 0x0, &(0x7f0000007180)=[{&(0x7f0000005f00)=""/4096, 0x1000}, {&(0x7f0000006f00)=""/34, 0x22}, {&(0x7f0000006f40)=""/17, 0x11}, {&(0x7f0000006f80)=""/144, 0x90}, {&(0x7f0000007040)=""/248, 0xf8}, {&(0x7f0000007140)=""/4, 0x4}], 0x6, &(0x7f0000007200)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}, {{&(0x7f0000007240), 0x6e, &(0x7f0000008680)=[{&(0x7f00000072c0)=""/188, 0xbc}, {&(0x7f0000007380)=""/85, 0x55}, {&(0x7f0000007400)}, {&(0x7f0000007440)=""/69, 0x45}, {&(0x7f00000074c0)=""/4096, 0x1000}, {&(0x7f00000084c0)=""/29, 0x1d}, {&(0x7f0000008500)=""/143, 0x8f}, {&(0x7f00000085c0)=""/184, 0xb8}], 0x8, &(0x7f0000008700)=[@cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}}, {{&(0x7f00000087c0)=@abs, 0x6e, &(0x7f0000008c40)=[{&(0x7f0000008840)=""/13, 0xd}, {&(0x7f0000008880)=""/54, 0x36}, {&(0x7f00000088c0)=""/70, 0x46}, {&(0x7f0000008940)=""/95, 0x5f}, {&(0x7f00000089c0)=""/247, 0xf7}, {&(0x7f0000008ac0)=""/66, 0x42}, {&(0x7f0000008b40)=""/205, 0xcd}], 0x7}}], 0x9, 0x12000, &(0x7f0000008f00)={0x77359400}) pselect6(0x40, &(0x7f0000000300)={0x0, 0x2, 0x4, 0x8001, 0x3, 0x80, 0xfffffffffffffffd}, 0x0, &(0x7f0000000340)={0x3ff, 0x0, 0x8, 0x9, 0xf29, 0x663, 0x7fffffff, 0x3}, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) read$FUSE(r2, 0x0, 0x0) setsockopt$sock_attach_bpf(r1, 0x6, 0x19, &(0x7f0000000380)=r1, 0x21) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f00000003c0)=""/157) 8.771396545s ago: executing program 2 (id=2941): syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) r0 = syz_open_dev$I2C(0x0, 0x1, 0x402) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000006a00010000000000000000000000000000000000080001000200000008000e"], 0x28}}, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x208003, 0x0) close(r3) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000680)=0x2) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40107447, &(0x7f00000006c0)={0x1, &(0x7f0000000700)=[{0x6, 0xf9, 0xee, 0x16}]}) ioctl$TUNGETVNETLE(r3, 0x40107447, &(0x7f0000000740)) mq_open(&(0x7f0000000580)='kfree\x00', 0x40, 0x5, &(0x7f00000005c0)={0xffffffffffffff88, 0x3}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'gre0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000380)={0x0, 0xffffffffffffff2d, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0x88, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x1}, {}, {0x7, 0x4}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x5, 0x13c}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x27a, 0xe8a, 0x6, 0x7}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20041890}, 0x0) sendmsg$sock(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)="ec50d05b704748889d644ff1d82c9064a11e1ddfd8f34de3b916ced2f2e283", 0x1f}], 0x1, &(0x7f0000000240)}, 0x4000) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000100)={&(0x7f0000000140)=[{0xfffe, 0x1900, 0x0, 0x0}], 0x1}) 8.200708105s ago: executing program 1 (id=2942): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000005800)={0x0, 0x0, &(0x7f0000005840)={&(0x7f0000005880)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) 7.912863113s ago: executing program 1 (id=2943): poll(&(0x7f0000000440)=[{0xffffffffffffffff, 0x49}, {0xffffffffffffffff, 0x2}, {0xffffffffffffffff, 0x8021}, {0xffffffffffffffff, 0xd504}, {0xffffffffffffffff, 0x4}, {0xffffffffffffffff, 0x20}, {0xffffffffffffffff, 0x206c}, {0xffffffffffffffff, 0x100}, {0xffffffffffffffff, 0x801a}, {0xffffffffffffffff, 0x30}], 0xa, 0x400) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000880), 0x4386e1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000008c0)={'team_slave_0\x00', 0x2800}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth1_to_team\x00'}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12015002762961083a0811f5d43cc07b2e1842b8ca5923e24888b4815392030109000000040000000000000007010e01000309050a000004080804"], &(0x7f0000000180)={0x0, 0x0, 0x0, 0xfffffffffffffffc}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) dup(r3) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f00000003c0)={@loopback={0xa4}, 0x8000000, 0x0, 0x2, 0x1, 0x2}, 0x20) openat$nullb(0xffffffffffffff9c, &(0x7f0000000580), 0x40001, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000700), 0x400000000a882, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = dup(r6) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000740)={0x0, @in6={{0xa, 0x4e24, 0x7, @loopback, 0x401}}, 0x3, 0xfffe, 0xe652, 0x2, 0x1c, 0x8, 0xff}, 0x9c) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000800)=0x0) getresgid(&(0x7f0000000840), &(0x7f0000000940), &(0x7f0000000980)=0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000009c0)={{0x1, 0x1, 0x18, r5, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) write$P9_RSTATu(r7, &(0x7f0000000080)=ANY=[@ANYBLOB="710000007d01000000570005000700000002040000000100000000000004000000a9060000000c03000042c30000000000000c002f6465762f6e756c6c6230000c00050000002f6e756c6c62300000000c002f6465762f6e756c6c62300005007673447f0bb80000000000", @ANYRES32=r8, @ANYRES32=r9, @ANYRES32=r10], 0x71) r11 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r11, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f0000001c80)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r12 = signalfd(0xffffffffffffffff, &(0x7f0000001d00)={[0x7fffffff]}, 0x8) r13 = gettid() timer_create(0x0, &(0x7f0000001d40)={0x0, 0x11, 0x4, @tid=r13}, &(0x7f0000001d80)) read$FUSE(r12, &(0x7f0000001dc0)={0x2020}, 0xfffffef0) timer_settime(0x0, 0x0, &(0x7f0000003e00)={{0x0, 0x1}, {0x0, 0xe4c}}, 0x0) 6.350727393s ago: executing program 0 (id=2944): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000600)={0x1, &(0x7f0000000640)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) io_setup(0x8, &(0x7f00000006c0)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000380), 0x8202, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000007c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000800)={'syzkaller0\x00', 0x9102}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000840)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x1, 0x0, 0x1, 0x1}}]}}]}, 0x44}}, 0x4084) sendmsg$nl_route_sched(r2, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000b80)={'macvlan1\x00', 0x1001}) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000bc0)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000c00), 0x56) sendmsg$kcm(r5, &(0x7f0000000c40)={&(0x7f0000000c80)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000d00)=[{&(0x7f0000000d40)="27030200591114000600002fb96dbcf706e10500000088a8ffff86ddee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) mmap$binder(&(0x7f00001c2000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x8000000000000000) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x16, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c00000002030104000000000000000000000010081539d961000100010000004e59d224b84a97e51488a2ddb2112ecba1158ad9620bf45be99c3199af40d000732aca94a81ef06fa8afe8a49bdffc65f83ec2943a17649d9725ce97ef6a3b661ee79ca737855cb3d99c92432efb70f2aba576309d49605e79fe6eba29f34956f0c12aa440eef08b25ee886f7a95d82699decc0aa85450691bf8d771cb768aec63e207217279c91ab351"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=ANY=[@ANYBLOB="1c0000000203030000000000fe800000000000100800eb0001020000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) getdents(0xffffffffffffffff, 0xfffffffffffffffd, 0x58) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="400000001000ffff2dbd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="2100000004030000200012800b00010067726574617000001000028004001200b7000e0003000000"], 0x40}, 0x1, 0x0, 0x0, 0x8c851}, 0x40040) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000500), 0x208e24b) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="38010000100033062cbd7000000022007f00000100000000000000000000000000000000000000000000000000000000040000050000fffd000000003a000000efdfe08a99349b000000080000000000520e49c10e3cf69f906ee7518c565384fe1fc025c4f287efac614d4bc52b5cc12bf2075f15b418d775f4333084bd0fe2686f0a9accb996055ad0791acca4a32da8a29843608c9e2075e0e7be857007534327a9d08d567e328846", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd32000000ac1414aa0000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000000100000000000002000000230000000000000048000200656362286369706865725f6e756c6c2900"/240], 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80) socket$inet_udp(0x2, 0x2, 0x0) 5.703290145s ago: executing program 2 (id=2946): r0 = socket$netlink(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000000c0)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f00004ba000/0x2000)=nil, &(0x7f0000f4e000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f00001a7000/0x1000)=nil, &(0x7f0000ef5000/0x9000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0}, 0x68) r1 = io_uring_setup(0x9, &(0x7f0000000140)={0x0, 0x3c1c, 0xc002, 0x2000, 0x38}) io_uring_enter(r1, 0x2cbc, 0x366, 0x39, 0x0, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$can_raw(0x1d, 0x3, 0x1) sendmsg$ETHTOOL_MSG_WOL_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000040)={0x20, r2, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@ETHTOOL_A_WOL_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x80) 5.664375675s ago: executing program 0 (id=2947): syz_emit_ethernet(0x2a, &(0x7f0000000740)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x20, 0x0, 0x2, 0x0, @rand_addr, @multicast1=0xe0000300}, @address_request}}}}, 0x0) 5.488438772s ago: executing program 0 (id=2949): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$FUSE_NOTIFY_RESEND(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x7, 0x2000000}, 0x14) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x44000}, 0x20040844) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x6, 0x180, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x4, 0x6, 0x9, 0x8000000000000000, 0x3, 0x100000000, 0xbdb], 0xffff1001, 0x4000}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f, 0x2}) write$tun(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB="010040000104010009000000f866c85399bfb76a38000000000000000000000000000000000000000000003caa80351c871154"], 0x53) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.409784512s ago: executing program 2 (id=2950): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) r1 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r1, 0x0, 0x20000080) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_dev$sg(0x0, 0x0, 0x401) socket$inet_smc(0x2b, 0x1, 0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f00000001c0)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000200)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$pppoe(0x18, 0x1, 0x0) r2 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80000) rt_sigprocmask(0x0, &(0x7f00000002c0)={[0xfffffffffffffffd]}, 0x0, 0x8) r3 = socket$unix(0x1, 0x2, 0x0) recvmmsg$unix(r3, &(0x7f0000008cc0)=[{{&(0x7f00000004c0), 0x6e, &(0x7f0000001580)=[{&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f0000001540)=""/15, 0xf}], 0x2, &(0x7f00000015c0)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}}, {{&(0x7f0000001680), 0x6e, &(0x7f0000001b40)=[{&(0x7f0000001700)=""/210, 0xd2}, {&(0x7f0000001800)=""/48, 0x30}, {&(0x7f0000001840)=""/106, 0x6a}, {&(0x7f00000018c0)=""/240, 0xf0}, {&(0x7f00000019c0)=""/59, 0x3b}, {&(0x7f0000001a00)=""/222, 0xde}, {&(0x7f0000001b00)=""/43, 0x2b}], 0x7, &(0x7f0000001bc0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}, {{&(0x7f0000001c00), 0x6e, &(0x7f00000044c0)=[{&(0x7f0000001c80)=""/7, 0x7}, {&(0x7f0000001cc0)=""/43, 0x2b}, {&(0x7f0000001d00)=""/37, 0x25}, {&(0x7f0000001d40)=""/192, 0xc0}, {&(0x7f0000001e00)=""/119, 0x77}, {&(0x7f0000001e80)=""/4096, 0x1000}], 0x6, &(0x7f0000002f00)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x28}}, {{&(0x7f0000002f40), 0x6e, &(0x7f0000003240)=[{&(0x7f0000002fc0)=""/229, 0xe5}, {&(0x7f00000030c0)=""/94, 0x5e}, {&(0x7f0000003140)=""/68, 0x44}, {&(0x7f00000031c0)=""/18, 0x12}, {&(0x7f0000003200)=""/64, 0x40}], 0x5, &(0x7f00000032c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f0000003340), 0x6e, &(0x7f0000004780)=[{&(0x7f00000033c0)=""/4096, 0x1000}, {&(0x7f00000043c0)=""/3, 0x3}, {&(0x7f0000004400)=""/137, 0x89}, {&(0x7f0000008f40)=""/183, 0xb7}, {&(0x7f0000004580)=""/203, 0xcb}, {&(0x7f0000004680)=""/75, 0x4b}, {&(0x7f0000004700)=""/78, 0x4e}], 0x7, &(0x7f0000004800)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb8}}, {{&(0x7f00000048c0)=@abs, 0x6e, &(0x7f0000005d80)=[{&(0x7f0000004940)=""/18, 0x12}, {&(0x7f0000004980)=""/206, 0xce}, {&(0x7f0000004a80)=""/71, 0x47}, {&(0x7f0000004b00)=""/172, 0xac}, {&(0x7f0000004bc0)=""/201, 0xfffffffffffffc58}, {&(0x7f0000004cc0)=""/4096, 0x1000}, {&(0x7f0000005cc0)=""/140, 0x8c}], 0x7, &(0x7f0000005e00)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x38}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x100}}, {{0x0, 0x0, &(0x7f0000007180)=[{&(0x7f0000005f00)=""/4096, 0x1000}, {&(0x7f0000006f00)=""/34, 0x22}, {&(0x7f0000006f40)=""/17, 0x11}, {&(0x7f0000006f80)=""/144, 0x90}, {&(0x7f0000007040)=""/248, 0xf8}, {&(0x7f0000007140)=""/4, 0x4}], 0x6, &(0x7f0000007200)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}, {{&(0x7f0000007240), 0x6e, &(0x7f0000008680)=[{&(0x7f00000072c0)=""/188, 0xbc}, {&(0x7f0000007380)=""/85, 0x55}, {&(0x7f0000007400)}, {&(0x7f0000007440)=""/69, 0x45}, {&(0x7f00000074c0)=""/4096, 0x1000}, {&(0x7f00000084c0)=""/29, 0x1d}, {&(0x7f0000008500)=""/143, 0x8f}, {&(0x7f00000085c0)=""/184, 0xb8}], 0x8, &(0x7f0000008700)=[@cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}}, {{&(0x7f00000087c0)=@abs, 0x6e, &(0x7f0000008c40)=[{&(0x7f0000008840)=""/13, 0xd}, {&(0x7f0000008880)=""/54, 0x36}, {&(0x7f00000088c0)=""/70, 0x46}, {&(0x7f0000008940)=""/95, 0x5f}, {&(0x7f00000089c0)=""/247, 0xf7}, {&(0x7f0000008ac0)=""/66, 0x42}, {&(0x7f0000008b40)=""/205, 0xcd}], 0x7}}], 0x9, 0x12000, &(0x7f0000008f00)={0x77359400}) pselect6(0x40, &(0x7f0000000300)={0x0, 0x2, 0x4, 0x8001, 0x3, 0x80, 0xfffffffffffffffd}, 0x0, &(0x7f0000000340)={0x3ff, 0x0, 0x8, 0x9, 0xf29, 0x663, 0x7fffffff, 0x3}, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) read$FUSE(r2, 0x0, 0x0) setsockopt$sock_attach_bpf(r1, 0x6, 0x19, &(0x7f0000000380)=r1, 0x21) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f00000003c0)=""/157) 5.333488328s ago: executing program 0 (id=2951): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000000)=0x79, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0xfc, 0x0}}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000100)={0x2, 0x4e23, @local}, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd78}, 0x94) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xf0ffffff) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f00000002c0)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)="91f8a9848519def38491bbc4173c3c6f357d0272b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b788f8a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d500891e58a3f851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd905a", 0xc6}], 0x1}}], 0x1, 0x2090) r3 = socket$kcm(0x2, 0x200000000000001, 0x106) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, 0x0, 0x0) sendto(r0, 0x0, 0x0, 0x4000041, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpu.stat\x00', 0x275a, 0x0) timer_create(0x0, &(0x7f0000000500)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000540)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000580)={0x0, 0x0, 0xfd8b, 0x101}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f00000005c0)={{}, {0x77359400}}, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) listen(0xffffffffffffffff, 0x8) accept$inet(r6, 0x0, 0x0) accept4(r6, 0x0, 0x0, 0x80000) pipe2(0x0, 0x0) ioctl$TUNSETCARRIER(r4, 0x400454e2, &(0x7f0000000300)=0x1) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r4, 0xbc18a000) 4.722692473s ago: executing program 1 (id=2952): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000005800)={0x0, 0x0, &(0x7f0000005840)={&(0x7f0000005880)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) 4.493023659s ago: executing program 1 (id=2953): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x4000000) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x14, 0x4, &(0x7f0000000200)=ANY=[@ANYRES64=r0, @ANYRES32=r0], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) syz_usb_connect(0x5, 0xfffffffffffffec7, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11}, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x2e, 0x15, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000380), 0x88002, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000003c0)=0xd) r2 = open(&(0x7f0000000400)='./bus\x00', 0x143142, 0xc0) ftruncate(r2, 0x2007ffb) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000440), 0x88800, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000480)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000004c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000500)={0x28, 0x5, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000, 0x100000000000006}) sendfile(r1, r2, 0x0, 0x1000000201002) dup(0xffffffffffffffff) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000580)) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000005c0)={0x73622a85, 0x100, 0x1}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000cc0)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0xffe0}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x9, 0x3, 0x5}}}}]}, 0x44}}, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000600)=@o_path={&(0x7f00000002c0)='./bus\x00', 0x0, 0x18, r3}, 0x18) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x10, 0x8, 0x2, 0xd7b7, {{0x1b, 0x4, 0x1, 0x30, 0x6c, 0x68, 0x0, 0x4, 0x2f, 0x0, @rand_addr=0x64010102, @multicast1, {[@rr={0x7, 0xb, 0x7f, [@remote, @broadcast]}, @noop, @timestamp_addr={0x44, 0x14, 0x84, 0x1, 0x3, [{@broadcast, 0xffff0000}, {@multicast2, 0x4}]}, @end, @generic={0x88, 0x6, "e636ba75"}, @cipso={0x86, 0x22, 0x1, [{0x7, 0x2}, {0x7, 0x5, '\x00\x00\x00'}, {0x0, 0xf, "b32d46c04db525e58cb7d29c16"}, {0x0, 0x6, "b4fa36ba"}]}, @noop, @ssrr={0x89, 0xb, 0x32, [@multicast1, @empty]}]}}}}}) sendmsg$nl_route_sched(r6, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000780)=@deltaction={0x134, 0x31, 0x10, 0x70bd28, 0x25dfdbfc, {}, [@TCA_ACT_TAB={0x34, 0x1, [{0xc, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffffffff}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd}}]}, @TCA_ACT_TAB={0x4}, @TCA_ACT_TAB={0x70, 0x1, [{0xc, 0x0, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x80}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x10, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x10, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x10}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}, @TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xaeab}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}]}, @TCA_ACT_TAB={0x4c, 0x1, [{0xc, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1484000}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8000}}]}]}, 0x134}}, 0x4000010) 4.359553044s ago: executing program 2 (id=2954): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='oom_score\x00') r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') r2 = syz_mount_image$fuse(&(0x7f0000000500), &(0x7f0000000600)='./file0\x00', 0x880, &(0x7f00000006c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x400}}, {@allow_other}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x1400}}, {@blksize={'blksize', 0x3d, 0x400}}, {@allow_other}, {@allow_other}, {@default_permissions}], [{@subj_user}]}}, 0x4, 0x0, &(0x7f0000000800)="9e3e58209c569dd1b47cbeac879749777c49d7212ceb705e353abe0333d8351705658a7c3dad33c06f4b9b53debfedab0c190e5a434dac0c1fd14961dce0f528b396f85efc2170776193a0a66e599564e72cc604e13a287362aca20852e108a91ee07727333b187527906ef9d7dc67e0798a384a90dff173f490da6f01383b68f769279970666d1a9c4c797b263729abf0e3f55ea636a7dac6de") ioctl$XFS_IOC_FSINUMBERS(r2, 0xc0205867, &(0x7f0000000a00)={0x0, 0x9, &(0x7f0000000900)=[{}], &(0x7f00000009c0)}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) r5 = ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f00000002c0)={0x1000000}) ioctl$KVM_SET_USER_MEMORY_REGION2(r4, 0x40a0ae49, &(0x7f0000000300)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r5}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r4, 0x4020aed2, &(0x7f00000003c0)={0x10000, 0x1000000, 0x8}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) syz_open_pts(r0, 0x420842) ioctl$KVM_PRE_FAULT_MEMORY(r6, 0xc040aed5, &(0x7f0000000400)={0x10000, 0x1000000}) mbind(&(0x7f000005b000/0x4000)=nil, 0x4000, 0x6002, &(0x7f0000000240)=0xa, 0x5c00, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000440)) connect$unix(r0, &(0x7f0000000480)=@abs, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) write$rfkill(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x2, 0x3, 0xfe, 0x1}, 0x8) fchdir(r1) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000a40), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000ac0)=0x7) ioctl$VIDIOC_S_HW_FREQ_SEEK(0xffffffffffffffff, 0x40305652, &(0x7f0000000b00)={0x0, 0x1, 0x0, 0x0, 0x0, 0x28fc0, 0x9f8c}) sendfile(r7, r7, 0x0, 0x20000005) 4.229331983s ago: executing program 0 (id=2955): syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) r0 = syz_open_dev$I2C(0x0, 0x1, 0x402) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000006a00010000000000000000000000000000000000080001000200000008000e"], 0x28}}, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x208003, 0x0) close(r3) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000680)=0x2) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40107447, &(0x7f00000006c0)={0x1, &(0x7f0000000700)=[{0x6, 0xf9, 0xee, 0x16}]}) ioctl$TUNGETVNETLE(r3, 0x40107447, &(0x7f0000000740)) mq_open(&(0x7f0000000580)='kfree\x00', 0x40, 0x5, &(0x7f00000005c0)={0xffffffffffffff88, 0x3}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'gre0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000380)={0x0, 0xffffffffffffff2d, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0x88, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x1}, {}, {0x7, 0x4}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x5, 0x13c}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x27a, 0xe8a, 0x6, 0x7}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20041890}, 0x0) sendmsg$sock(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)="ec50d05b704748889d644ff1d82c9064a11e1ddfd8f34de3b916ced2f2e283", 0x1f}], 0x1, &(0x7f0000000240)}, 0x4000) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000100)={&(0x7f0000000140)=[{0xfffe, 0x1900, 0x0, 0x0}], 0x1}) 3.764078912s ago: executing program 4 (id=2956): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000480)) mkdir(&(0x7f0000000580)='./file0\x00', 0x83) name_to_handle_at(0xffffffffffffff9c, &(0x7f00000005c0)='./file0\x00', &(0x7f00000006c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000700), 0xfffffff2) 3.181548828s ago: executing program 4 (id=2957): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x0, &(0x7f00000002c0)}) r1 = syz_open_procfs(0x0, &(0x7f0000000d40)='ns\x00') mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16, @ANYBLOB="0502fcfffffffddbdf251200000008000700010000001800018014000200626f6e645f736c6176655f31000000000800060000000000", @ANYRESHEX=r1, @ANYRES32=r1, @ANYRESHEX=r0], 0x3c}}, 0x0) 2.740393165s ago: executing program 3 (id=2914): syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000dae11c105e0484028fa4010203010902240001000000000904"], 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000640)={0x2, 0xfffe, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) setsockopt$sock_int(r0, 0x1, 0xb, &(0x7f0000000680)=0x7ff, 0x4) sendto$inet(r0, 0x0, 0x0, 0x8000, &(0x7f0000000700)={0x2, 0x4e1f, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x4004084, 0x0, 0x0) connect$inet(r0, &(0x7f0000000840)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x41}}, 0x10) r1 = syz_open_dev$vbi(&(0x7f00000006c0), 0x3, 0x2) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000000)={0x2, 0x0, 0x3, 0x0, 0xfc}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x1b96, 0x1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x6, 0x60, 0x1, "", [{{0x9, 0x4, 0x0, 0xc6, 0x2, 0x3, 0x1, 0x3, 0xc0, {0x9, 0x21, 0x9, 0x2, 0x1, {0x22, 0xbe5}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0xff, 0xf1, 0x5}}}}}]}}]}}, &(0x7f00000005c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x110, 0x6, 0x40, 0xc, 0x10, 0xbb}, 0x10, &(0x7f0000000100)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x3, 0x6, 0xfffa, 0x81}]}, 0x8, [{0xd8, &(0x7f0000000140)=@string={0xd8, 0x3, "0645fc8ace6ba667a7ff877c1855895a6c43693e02183fb010589e7882af7617101f86f1091a739f6eab24e391cd278d80d7e0390060fac1c5e23839d41402156da1a438aef5baac4828d6296d4e0a7fad56086012265b0dae182b7f0f44fdf4da41f8431ebd26ee5929da5a84f38da69cb09fbabf91c250037b70f53ba351485e4b1475a105df9a689ab10975c648d234c1e158f89f5d50fce9f5c2e979621ff99decbcd460e90d45984ffb0dda3d273ed8333a3195d9093c73315043761c3c375bca850305b9b13d6ce3e1d47bad795c20cf563360"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x1409}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x426}}, {0x56, &(0x7f00000002c0)=@string={0x56, 0x3, "0a9e85e10a6f65c05606ae39e81fcc2d006316624b9cb44ae80edeab4ca3576eaf5e34b847f8d11d8e0198b9d169c417f0f859a32c50f8906fbf39710d2c2267e1f4aaa1fbf0406050f1eaf5520952465a53e4c0"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x861}}, {0xca, &(0x7f0000000380)=@string={0xca, 0x3, "d15530257e8875fc1c6176986556311f4e608b59cfd149cefe0acd717b4e8a33428f50e35fda6e10f145784c706bb66589a4290d86dcd9b8d4089fc882c99ff1b558a95652258f85384f80cd2865acaf5e1d782f255fadb06f824c17993c1e17a2d9f3ae1222c7babdb76b3c01331c2d64fc248c82330733292886a1fa8b276d8eb2262c22f2f86700c5b25d75ae7d5a9a8d15a2006b360b8b61ba2ffb442bfc3c8bfdc63671810749903452003bc71ac665faa45b2145a18525a77174b7f8571733d26d58f372f6"}}, {0xc9, &(0x7f0000000480)=@string={0xc9, 0x3, "9dfd9ee2bbde9adad069b4d156f57232febc999d21ad923160db012c91abbdb3dd17875ddbdfcd7891fc267140049d07c047980606df93859d3cf67e841cafb30f1adb6871aa9c70e72c9b4822a6732334c1d887f66012d6e726d3286b4d37b07e66c9e352e8ef5ce189e4280165fe3e79852905f8504df117a9014654e07f0283299ab37b3ae190273a929ba5f02505d65a675ba6464f5993adb82f1cd95578ac63792550f21f2e2166c5ae97f9637f20f1421cbd25ffe6062795dac6d9265cb91deabd922e97"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x438}}]}) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000740)={0x7, @pix_mp={0x6, 0x1, 0x3831354f, 0x2, 0x4, [{0x8, 0x37cb09ff}, {0x200, 0x3}, {0x4, 0x6}, {0xfffff359, 0x9}, {0x8, 0x7}, {0x4, 0x1}, {0x2, 0x46}, {0xfffffff1, 0x5}], 0x2, 0xb9, 0x8, 0x1, 0x3}}) 2.721246368s ago: executing program 4 (id=2958): syz_emit_ethernet(0x2a, &(0x7f0000000740)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x20, 0x0, 0x2, 0x0, @rand_addr, @multicast1=0xe0000300}, @address_request}}}}, 0x0) 2.301187282s ago: executing program 4 (id=2960): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$FUSE_NOTIFY_RESEND(0xffffffffffffffff, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x44000}, 0x20040844) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x6, 0x180, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x4, 0x6, 0x9, 0x8000000000000000, 0x3, 0x100000000, 0xbdb], 0xffff1001, 0x4000}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f, 0x2}) write$tun(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB="010040000104010009000000f866c85399bfb76a38000000000000000000000000000000000000000000003caa80351c871154"], 0x53) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.3721136s ago: executing program 4 (id=2961): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r1, 0x0, 0x0, 0x1}) syz_open_dev$dvb_frontend(0x0, 0x0, 0x882) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040000}, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000001c0)={0x1, @win={{0x2, 0x9, 0xef1a, 0x80000000}, 0x0, 0x2, &(0x7f0000000400)={{0x8c, 0xd1, 0x81, 0x200}, &(0x7f00000003c0)={{0x4, 0x5, 0x80, 0x9}, &(0x7f0000000300)={{0x2b1, 0x3, 0xb788, 0x14}, &(0x7f0000000100)={{0x8, 0x4, 0x69a, 0x5}}}}}, 0x6, &(0x7f0000000440)="6fb317d6fab058999ada0f4056bae6d33b8adc4d704ee98f5fedd39dcec1414adbfdbc4efb31dc9affbeda69083a403c469b2bdbecc98bb95f53a927714d57cf7e0d28954dbd0a707ac0e3b4fdcb11fa54394b8ddf644081fae893dfe6ec9450f4e81a33eac48e03c3ccd74928958d51a9ee4680f7baaba3ced869de63356b09bde5643de81249ef4069c1c1206c35d468b52109de4309f696c75f8f5d4fd63f695099b74de3f5904bdd41f6dabd9bf050a78e6bb12c41898c4cbc89cafd8c8dceb26f20f992b3e55d", 0x9}}) ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0285628, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_clone(0x0, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/igmp6\x00') preadv(r3, &(0x7f0000000380)=[{&(0x7f0000000a40)=""/4085, 0xff5}], 0x1, 0x3ab3, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r4 = openat(0xffffffffffffff9c, &(0x7f0000001a40)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000001a80)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000a00)={0x70, 0x7, r1, 0x0, 0xfffffffffffffffc, 0x1000}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000140)={0x48, 0x7, r2, 0x0, 0x10000, 0x0, 0x9, 0x147586, 0x287cb2}) 1.315703026s ago: executing program 1 (id=2962): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x40000, 0x0) r1 = syz_clone(0x40000080, &(0x7f0000000080)="3d3e489f992280d85f10065a3a14862e8a7ba19f0b8eef", 0x17, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="29c35e0420b76cbb1321d2980ff478a2b0658052f6925edb6d4450198bd7") r2 = socket(0xa, 0x5, 0x0) r3 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000003c0)={0x10000004}) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, r1, 0x2, 0x0) r4 = syz_open_procfs(r1, &(0x7f0000000000)='net/igmp\x00') pread64(r4, &(0x7f0000000040)=""/43, 0xfd8a, 0x3c) syz_open_dev$admmidi(&(0x7f00000001c0), 0x20, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/3\x00') r6 = epoll_create1(0x0) r7 = fsopen(&(0x7f0000000240)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, 0x0, &(0x7f0000000280)='\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f00000002c0)={0x6000000d}) poll(&(0x7f0000000300)=[{r6, 0x5f4b8f9e57b39c22}], 0x1, 0x80) syz_open_procfs(0x0, &(0x7f0000000340)='fd/3\x00') r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000380), 0x80383, 0x0) ioctl$SNDCTL_SEQ_RESET(r8, 0x5100) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x4) 1.18576423s ago: executing program 3 (id=2963): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) r1 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r1, 0x0, 0x20000080) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_dev$sg(0x0, 0x0, 0x401) socket$inet_smc(0x2b, 0x1, 0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f00000001c0)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000200)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$pppoe(0x18, 0x1, 0x0) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000280)={[0x2]}, 0x8, 0x80000) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) recvmmsg$unix(r3, &(0x7f0000008cc0)=[{{&(0x7f00000004c0), 0x6e, &(0x7f0000001580)=[{&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f0000001540)=""/15, 0xf}], 0x2, &(0x7f00000015c0)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}}, {{&(0x7f0000001680), 0x6e, &(0x7f0000001b40)=[{&(0x7f0000001700)=""/210, 0xd2}, {&(0x7f0000001800)=""/48, 0x30}, {&(0x7f0000001840)=""/106, 0x6a}, {&(0x7f00000018c0)=""/240, 0xf0}, {&(0x7f00000019c0)=""/59, 0x3b}, {&(0x7f0000001a00)=""/222, 0xde}, {&(0x7f0000001b00)=""/43, 0x2b}], 0x7, &(0x7f0000001bc0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}, {{&(0x7f0000001c00), 0x6e, &(0x7f00000044c0)=[{&(0x7f0000001c80)=""/7, 0x7}, {&(0x7f0000001cc0)=""/43, 0x2b}, {&(0x7f0000001d00)=""/37, 0x25}, {&(0x7f0000001d40)=""/192, 0xc0}, {&(0x7f0000001e00)=""/119, 0x77}, {&(0x7f0000001e80)=""/4096, 0x1000}], 0x6, &(0x7f0000002f00)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x28}}, {{&(0x7f0000002f40), 0x6e, &(0x7f0000003240)=[{&(0x7f0000002fc0)=""/229, 0xe5}, {&(0x7f00000030c0)=""/94, 0x5e}, {&(0x7f0000003140)=""/68, 0x44}, {&(0x7f00000031c0)=""/18, 0x12}, {&(0x7f0000003200)=""/64, 0x40}], 0x5, &(0x7f00000032c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f0000003340), 0x6e, &(0x7f0000004780)=[{&(0x7f00000033c0)=""/4096, 0x1000}, {&(0x7f00000043c0)=""/3, 0x3}, {&(0x7f0000004400)=""/137, 0x89}, {&(0x7f0000008f40)=""/183, 0xb7}, {&(0x7f0000004580)=""/203, 0xcb}, {&(0x7f0000004680)=""/75, 0x4b}, {&(0x7f0000004700)=""/78, 0x4e}], 0x7, &(0x7f0000004800)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb8}}, {{&(0x7f00000048c0)=@abs, 0x6e, &(0x7f0000005d80)=[{&(0x7f0000004940)=""/18, 0x12}, {&(0x7f0000004980)=""/206, 0xce}, {&(0x7f0000004a80)=""/71, 0x47}, {&(0x7f0000004b00)=""/172, 0xac}, {&(0x7f0000004bc0)=""/201, 0xfffffffffffffc58}, {&(0x7f0000004cc0)=""/4096, 0x1000}, {&(0x7f0000005cc0)=""/140, 0x8c}], 0x7, &(0x7f0000005e00)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x38}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x100}}, {{0x0, 0x0, &(0x7f0000007180)=[{&(0x7f0000005f00)=""/4096, 0x1000}, {&(0x7f0000006f00)=""/34, 0x22}, {&(0x7f0000006f40)=""/17, 0x11}, {&(0x7f0000006f80)=""/144, 0x90}, {&(0x7f0000007040)=""/248, 0xf8}, {&(0x7f0000007140)=""/4, 0x4}], 0x6, &(0x7f0000007200)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}, {{&(0x7f0000007240), 0x6e, &(0x7f0000008680)=[{&(0x7f00000072c0)=""/188, 0xbc}, {&(0x7f0000007380)=""/85, 0x55}, {&(0x7f0000007400)}, {&(0x7f0000007440)=""/69, 0x45}, {&(0x7f00000074c0)=""/4096, 0x1000}, {&(0x7f00000084c0)=""/29, 0x1d}, {&(0x7f0000008500)=""/143, 0x8f}, {&(0x7f00000085c0)=""/184, 0xb8}], 0x8, &(0x7f0000008700)=[@cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}}, {{&(0x7f00000087c0)=@abs, 0x6e, &(0x7f0000008c40)=[{&(0x7f0000008840)=""/13, 0xd}, {&(0x7f0000008880)=""/54, 0x36}, {&(0x7f00000088c0)=""/70, 0x46}, {&(0x7f0000008940)=""/95, 0x5f}, {&(0x7f00000089c0)=""/247, 0xf7}, {&(0x7f0000008ac0)=""/66, 0x42}, {&(0x7f0000008b40)=""/205, 0xcd}], 0x7}}], 0x9, 0x12000, &(0x7f0000008f00)={0x77359400}) pselect6(0x40, &(0x7f0000000300)={0x0, 0x2, 0x4, 0x8001, 0x3, 0x80, 0xfffffffffffffffd}, 0x0, &(0x7f0000000340)={0x3ff, 0x0, 0x8, 0x9, 0xf29, 0x663, 0x7fffffff, 0x3}, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) read$FUSE(r2, 0x0, 0x0) setsockopt$sock_attach_bpf(r1, 0x6, 0x19, &(0x7f0000000380)=r1, 0x21) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f00000003c0)=""/157) 895.409061ms ago: executing program 0 (id=2964): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x4000000004002, 0x0) r1 = dup(r0) syz_usb_connect$hid(0x3, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xb, 0x13, r1, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000023c0)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000002400)={0x0, 0x0, &(0x7f0000002440)={&(0x7f0000002480)=@newqdisc={0x80, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x3, 0x1, 0x0, 0x2, 0x4}, 0xa4ca, 0x0, 0x0, 0x6, 0x0, 0x18, 0xb, 0xe, 0x3, 0x85, {0x10001, 0x7, 0x2, 0x7, 0x2, 0x7fffffff}}}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x4}]}, 0x80}, 0x1, 0x0, 0x0, 0x4c840}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000080)=ANY=[@ANYRESOCT], 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x400002) r4 = open_tree(0xffffffffffffff9c, 0x0, 0x1101) ioctl$VT_OPENQRY(r4, 0x5600, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, &(0x7f0000002580)={0xa, 0x4e25, 0x31e, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x4}, 0x1c) shutdown(r5, 0x2) connect$inet6(r5, &(0x7f00000025c0)={0xa, 0x4e24, 0x7, @dev={0xfe, 0x80, '\x00', 0x23}}, 0x18) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000240), 0x400, 0x0) openat$dsp1(0xffffffffffffff9c, &(0x7f0000002640), 0x0, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000002680)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xa, 0x148, 0x0, 0x10, 0x4c8, 0x2a8, 0x2a8, 0x4c8, 0x2a8, 0x3, 0x0, {[{{@ip={@private=0xa010102, @multicast1, 0x0, 0x0, 'bridge0\x00', 'veth0_virt_wifi\x00'}, 0x0, 0x220, 0x290, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'geneve0\x00', {0x0, 0xe2, 0x9, 0x0, 0x0, 0xfffffffb, 0x7}}}, @common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x400, 0x0, 0x44, 0x81, 0xff, 0xff, 0xfffffaf9, 0xe, 0x20, 0x8}, {0x9}}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x2, 0x0, 0x7f, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', 'veth0_to_team\x00', {}, {}, 0x20}, 0x0, 0x1f8, 0x238, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve0\x00', {0x4, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x240, 0x0, 0x8}, {0xfffffffffffffffc}}}, @common=@addrtype={{0x30}, {0xe84, 0x48}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0xf, 0x1, {0xe6}}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x5c0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f0000002c40)=0xf7a) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000002c80), 0x2000, 0x0) ioctl$TIOCSPTLCK(r8, 0x40045431, &(0x7f0000002cc0)) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r9, &(0x7f0000000140)={0x2, 0x4e23, @multicast1}, 0x10) fcntl$dupfd(r9, 0x406, r9) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x6, 0xfd, 0x4, 0xe4}]}, 0x10) sendto$inet(r9, 0x0, 0x0, 0x200007fd, &(0x7f0000000200)={0x2, 0x4e23, @local}, 0x10) 248.810602ms ago: executing program 1 (id=2965): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000700)=ANY=[@ANYBLOB="480000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="1d060b00000000002800128008000100677470001c00028008000200", @ANYRES32, @ANYBLOB="08000300030000000800040000000000940674e6ad4157d75f97649acd88d1c01cacfb92091d881e23d461d2727bad2880b1902f3a53fa11b27db198ba445c886a3ad3406157bf18582a"], 0x48}, 0x1, 0x0, 0x0, 0x690}, 0x20008050) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r1 = syz_io_uring_setup(0x10f, &(0x7f0000000080)={0x0, 0x39c4, 0x2, 0x1, 0xfffffffe}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_IOWQ_AFF(r1, 0x11, &(0x7f00000001c0)='n', 0x1) io_pgetevents(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f0000000200)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000240)={0x0, 0x0, 0xfd8b, 0x5}) timer_create(0x5, 0x0, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x2, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) connect$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$vcsu(&(0x7f0000000400), 0x8, 0x185000) write$P9_RWRITE(r2, &(0x7f00000005c0)={0xb, 0x77, 0x2, 0x3}, 0xb) set_mempolicy(0x8006, &(0x7f0000000280)=0xfff, 0x5) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) sendmsg$MPTCP_PM_CMD_SET_FLAGS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="01002bad7000fd79ed4c23c56839"], 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x20040000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x22401, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="ec0100000001050500000000000000000a0000003c0002802c00018014000300ff010000000000000000001f0000000114000400ff0200000000000000000000000000010c00028005000100000080003c0001800c00028005000100000000002c"], 0x1ec}}, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000004c0)=[@text64={0x40, &(0x7f0000000500)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000580)=[@textreal={0x8, 0x0}], 0x1, 0x38, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 0s ago: executing program 4 (id=2966): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a1740, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f00000000c0)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000140)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f41, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_PIT(r3, 0x8048ae66, &(0x7f0000000200)={[{0x6, 0x5, 0x93, 0x1, 0x0, 0x5f, 0xb, 0x20, 0xa6, 0x2, 0x5, 0x9, 0xfffffffe}, {0xfffffffd, 0xfffa, 0x0, 0x4, 0xfa, 0xf6, 0xce, 0x8, 0x4, 0xff, 0x1, 0xa6, 0x800000000000000}, {0xffffff01, 0x35, 0x80, 0x0, 0x4, 0x1, 0x19, 0xe, 0x7, 0x8, 0xfe, 0x4, 0x1000000000000004}], 0x7f}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0, 0x0) getdents(r5, 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, 0x0, 0x60) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x10}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8946, &(0x7f0000000380)={'vlan0\x00', @random='\x00\x00\x00\x00\x00 '}) sendmsg$IPSET_CMD_CREATE(r7, 0x0, 0x20004000) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000440)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x2e, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) write$char_usb(0xffffffffffffffff, &(0x7f0000000540)="04518f0ab17033035b302c874a76f3c2a371549de07a00f12fb7250079b66282bdcf", 0x22) r9 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$x86(r9, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=[@wrmsr={0x65, 0x20, {0xb66, 0x3f}}], 0x20}) ioctl$KVM_SET_CPUID2(r10, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) ioctl$KVM_RUN(r10, 0xae80, 0x0) kernel console output (not intermixed with test programs): 756.220724][T14134] active_anon 0 [ 756.220729][T14134] inactive_file 0 [ 756.220733][T14134] active_file 0 [ 756.220737][T14134] unevictable 0 [ 756.220742][T14134] hierarchical_memory_limit 0 [ 756.220747][T14134] hierarchical_memsw_limit 9223372036854771712 [ 756.220752][T14134] total_cache 0 [ 756.220756][T14134] total_rss 0 [ 756.220760][T14134] total_rss_huge 0 [ 756.220764][T14134] total_shmem 0 [ 756.220768][T14134] total_mapped_file 0 [ 756.220773][T14134] total_dirty 0 [ 756.220777][T14134] total_writeback 0 [ 756.220781][T14134] total_workingset_refault_anon 0 [ 756.220786][T14134] total_workingset_refault_file 0 [ 756.220791][T14134] total_swap 0 [ 756.220796][T14134] total_swapcached 0 [ 756.220809][T14134] total_pgpgin 0 [ 756.220813][T14134] total_pgpgout 0 [ 756.220817][T14134] total_pgfault 0 [ 756.220821][T14134] total_pgmajfault 0 [ 756.220826][T14134] total_inactive_anon 0 [ 756.220831][T14134] total_active_anon 0 [ 756.220836][T14134] total_inactive_file 0 [ 756.220840][T14134] total_active_file 0 [ 756.220845][T14134] total_unevictable 0 [ 756.220849][T14134] anon_cost 0 [ 756.220853][T14134] file_cost 0 [ 756.220859][T14134] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.2464,pid=14133,uid=0 [ 756.222782][T14134] Memory cgroup out of memory: Killed process 14133 (syz.1.2464) total-vm:104328kB, anon-rss:1456kB, file-rss:23032kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 756.914844][T14142] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 756.986771][T14144] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2469'. [ 756.986808][T14144] netlink: 'syz.2.2469': attribute type 5 has an invalid length. [ 756.986822][T14144] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2469'. [ 757.023612][T14144] geneve2: entered promiscuous mode [ 757.023639][T14144] geneve2: entered allmulticast mode [ 757.026213][ T7290] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 757.026429][ T7290] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 757.026483][ T7290] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 757.073705][ T7290] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 256 - 0 [ 758.195925][T14190] usb usb5: usbfs: interface 0 claimed by hub while 'syz.1.2488' sets config #-1 [ 758.745619][T14200] gtp5: entered allmulticast mode [ 759.339162][T13278] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 759.489867][T13278] usb 4-1: New USB device found: idVendor=0bda, idProduct=8150, bcdDevice=0.40 [ 759.490878][T13278] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 759.490910][T13278] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 759.490935][T13278] usb 4-1: config 1 interface 0 has no altsetting 0 [ 759.493378][T13278] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 759.493406][T13278] usb 4-1: Product: syz [ 759.493421][T13278] usb 4-1: Manufacturer: syz [ 759.493436][T13278] usb 4-1: SerialNumber: syz [ 759.568597][T14206] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 759.568691][T14206] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 759.887617][T14206] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 760.016956][T13278] rtl8150 4-1:1.0: couldn't reset the device [ 760.017293][T13278] rtl8150 4-1:1.0: probe with driver rtl8150 failed with error -5 [ 760.037549][T13278] usb 4-1: USB disconnect, device number 97 [ 760.432609][T14224] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2502'. [ 761.707719][T14253] netlink: 'syz.2.2513': attribute type 1 has an invalid length. [ 761.852220][T14253] 8021q: adding VLAN 0 to HW filter on device bond3 [ 761.924341][T14255] bond3: (slave dummy0): making interface the new active one [ 761.954722][T14255] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 762.006089][T14260] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2515'. [ 762.371810][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 762.371830][ T30] audit: type=1326 audit(1793119006.736:3231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14269 comm="syz.2.2520" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 762.374022][ T30] audit: type=1326 audit(1793119006.736:3232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14269 comm="syz.2.2520" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 762.385250][ T30] audit: type=1326 audit(1793119006.746:3233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14269 comm="syz.2.2520" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 762.385308][ T30] audit: type=1326 audit(1793119006.746:3234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14269 comm="syz.2.2520" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 762.385348][ T30] audit: type=1326 audit(1793119006.746:3235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14269 comm="syz.2.2520" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 762.385387][ T30] audit: type=1326 audit(1793119006.746:3236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14269 comm="syz.2.2520" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 762.385426][ T30] audit: type=1326 audit(1793119006.746:3237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14269 comm="syz.2.2520" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 762.385467][ T30] audit: type=1326 audit(1793119006.746:3238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14269 comm="syz.2.2520" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 762.385508][ T30] audit: type=1326 audit(1793119006.746:3239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14269 comm="syz.2.2520" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 762.385549][ T30] audit: type=1326 audit(1793119006.746:3240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14269 comm="syz.2.2520" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 763.641660][T14297] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2530'. [ 764.020228][T14316] ip_tables: iptables: counters copy to user failed while replacing table [ 764.053234][T14317] xt_policy: output policy not valid in PREROUTING and INPUT [ 764.129469][ T9] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 764.280339][ T9] usb 2-1: New USB device found: idVendor=0b05, idProduct=17a0, bcdDevice=0.40 [ 764.281382][ T9] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 764.283452][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.283480][ T9] usb 2-1: Product: syz [ 764.283495][ T9] usb 2-1: Manufacturer: syz [ 764.283511][ T9] usb 2-1: SerialNumber: syz [ 764.344783][T14328] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2543'. [ 764.528678][ T9] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 764.644336][ T9] usb 2-1: USB disconnect, device number 103 [ 764.760369][T10556] udevd[10556]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 765.159385][ T8185] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 765.309625][ T8185] usb 3-1: Using ep0 maxpacket: 16 [ 765.310823][ T8185] usb 3-1: New USB device found: idVendor=0763, idProduct=2001, bcdDevice=0.40 [ 765.364706][ T8185] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 765.364736][ T8185] usb 3-1: Product: syz [ 765.364751][ T8185] usb 3-1: Manufacturer: syz [ 765.364766][ T8185] usb 3-1: SerialNumber: syz [ 766.222131][T14361] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2557'. [ 766.224739][T14361] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2557'. [ 766.376508][ T8185] usb 3-1: 1:1: invalid format type 0x1002 is detected, processed as PCM [ 766.376530][ T8185] usb 3-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 766.377168][ T8185] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 766.503397][ T8185] usb 3-1: USB disconnect, device number 98 [ 766.616021][T10556] udevd[10556]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 767.289941][T14391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 767.290265][T14391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 767.382529][ T30] kauditd_printk_skb: 223 callbacks suppressed [ 767.382550][ T30] audit: type=1326 audit(1793119011.726:3464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14375 comm="syz.3.2564" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7ff4fb55fd8e code=0x7ffc0000 [ 767.424158][ T30] audit: type=1326 audit(1793119011.786:3465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14375 comm="syz.3.2564" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7ff4fb59f2c2 code=0x7ffc0000 [ 767.425358][ T30] audit: type=1326 audit(1793119011.786:3466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14375 comm="syz.3.2564" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7ff4fb59f387 code=0x7ffc0000 [ 767.487915][ T30] audit: type=1326 audit(1793119011.846:3467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14375 comm="syz.3.2564" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7ff4fb59f387 code=0x7ffc0000 [ 767.520389][ T30] audit: type=1326 audit(1793119011.886:3468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14375 comm="syz.3.2564" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7ff4fb59f357 code=0x7ffc0000 [ 767.524623][ T30] audit: type=1326 audit(1793119011.886:3469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14375 comm="syz.3.2564" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff4fb59f559 code=0x7ffc0000 [ 767.525123][ T30] audit: type=1326 audit(1793119011.886:3470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14375 comm="syz.3.2564" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff4fb59f559 code=0x7ffc0000 [ 768.549222][ T945] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 768.705240][ T945] usb 3-1: New USB device found: idVendor=0b05, idProduct=1abe, bcdDevice=0.00 [ 768.706190][ T945] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 768.706220][ T945] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 768.752915][ T945] usb 3-1: config 0 descriptor?? [ 768.757700][T14403] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 769.246768][ T945] asus 0003:0B05:1ABE.001D: unknown main item tag 0x0 [ 769.246802][ T945] asus 0003:0B05:1ABE.001D: unknown main item tag 0x0 [ 769.246818][ T945] asus 0003:0B05:1ABE.001D: unknown main item tag 0x0 [ 769.246833][ T945] asus 0003:0B05:1ABE.001D: unknown main item tag 0x0 [ 769.246848][ T945] asus 0003:0B05:1ABE.001D: unknown main item tag 0x0 [ 769.246863][ T945] asus 0003:0B05:1ABE.001D: unknown main item tag 0x0 [ 769.246878][ T945] asus 0003:0B05:1ABE.001D: unknown main item tag 0x0 [ 769.246895][ T945] asus 0003:0B05:1ABE.001D: unknown main item tag 0x0 [ 769.246910][ T945] asus 0003:0B05:1ABE.001D: unknown main item tag 0x0 [ 769.246925][ T945] asus 0003:0B05:1ABE.001D: unknown main item tag 0x0 [ 769.326315][ T945] asus 0003:0B05:1ABE.001D: reserved main item tag 0xd [ 769.345075][ T945] asus 0003:0B05:1ABE.001D: hidraw0: USB HID v7f.fd Device [HID 0b05:1abe] on usb-dummy_hcd.2-1/input0 [ 769.613617][ T945] asus 0003:0B05:1ABE.001D: Asus handshake 5a failed to receive ack: -71 [ 769.628485][ T945] usb 3-1: USB disconnect, device number 99 [ 769.678728][T14423] gtp2: entered allmulticast mode [ 769.920813][ T5366] usb 4-1: new full-speed USB device number 98 using dummy_hcd [ 770.082038][ T5366] usb 4-1: New USB device found: idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 770.101120][ T5366] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 770.101170][ T5366] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 770.101196][ T5366] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 10 [ 770.101222][ T5366] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 65535, setting to 64 [ 770.101249][ T5366] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 770.101273][ T5366] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 148, setting to 64 [ 770.101295][ T5366] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 770.148385][ T5366] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.148405][ T5366] usb 4-1: Product: syz [ 770.148413][ T5366] usb 4-1: Manufacturer: syz [ 770.148421][ T5366] usb 4-1: SerialNumber: syz [ 770.219625][ T5366] usb 4-1: config 0 descriptor?? [ 770.223092][T14424] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 770.223214][T14424] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 770.455204][T14424] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 770.460185][T14424] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 770.530506][T14424] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2576'. [ 770.532420][T14424] netlink: 'syz.3.2576': attribute type 10 has an invalid length. [ 770.560795][T14424] bond0: (slave team0): Enslaving as an active interface with a down link [ 770.949555][T14442] FAULT_INJECTION: forcing a failure. [ 770.949555][T14442] name failslab, interval 1, probability 0, space 0, times 0 [ 770.949580][T14442] CPU: 1 UID: 0 PID: 14442 Comm: syz.2.2580 Tainted: G L syzkaller #0 PREEMPT(full) [ 770.949597][T14442] Tainted: [L]=SOFTLOCKUP [ 770.949601][T14442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 770.949608][T14442] Call Trace: [ 770.949613][T14442] [ 770.949619][T14442] dump_stack_lvl+0xe8/0x150 [ 770.949642][T14442] should_fail_ex+0x410/0x560 [ 770.949661][T14442] should_failslab+0xa8/0x100 [ 770.949678][T14442] __kvmalloc_node_noprof+0x171/0x820 [ 770.949694][T14442] ? nf_hook_entries_grow+0x287/0x740 [ 770.949704][T14442] ? nf_hook_entries_grow+0x287/0x740 [ 770.949715][T14442] ? __pfx___mutex_lock+0x10/0x10 [ 770.949731][T14442] nf_hook_entries_grow+0x287/0x740 [ 770.949749][T14442] __nf_register_net_hook+0x26f/0x940 [ 770.949766][T14442] nf_register_net_hook+0xb2/0x190 [ 770.949786][T14442] nf_register_net_hooks+0x44/0x1b0 [ 770.949799][T14442] nf_defrag_ipv6_enable+0x87/0x120 [ 770.949818][T14442] nf_ct_netns_do_get+0x1e7/0x5c0 [ 770.949833][T14442] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 770.949845][T14442] ? trace_contention_end+0x3d/0x140 [ 770.949866][T14442] ? nf_ct_netns_get+0xe9/0x320 [ 770.949879][T14442] xt_cluster_mt_checkentry+0x138/0x290 [ 770.949895][T14442] xt_check_match+0x602/0xce0 [ 770.949913][T14442] ? __pfx_xt_check_match+0x10/0x10 [ 770.949927][T14442] ? pcpu_alloc_noprof+0x1036/0x1900 [ 770.949951][T14442] ? xt_find_match+0x213/0x260 [ 770.949969][T14442] translate_table+0x160e/0x2110 [ 770.949981][T14442] ? __lock_acquire+0x747/0x2de0 [ 770.950008][T14442] ? __pfx_translate_table+0x10/0x10 [ 770.950020][T14442] ? lock_acquire+0x115/0x350 [ 770.950045][T14442] ? _copy_from_user+0x94/0xb0 [ 770.950063][T14442] do_ip6t_set_ctl+0xa5c/0xe30 [ 770.950082][T14442] ? rcu_is_watching+0x16/0xb0 [ 770.950099][T14442] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 770.950132][T14442] ? __mutex_unlock_slowpath+0x731/0x900 [ 770.950160][T14442] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 770.950184][T14442] ? ksys_write+0x1e6/0x270 [ 770.950213][T14442] nf_setsockopt+0x26f/0x290 [ 770.950238][T14442] rawv6_setsockopt+0x276/0x5e0 [ 770.950265][T14442] ? __pfx_rawv6_setsockopt+0x10/0x10 [ 770.950291][T14442] ? sock_common_setsockopt+0x36/0xc0 [ 770.950315][T14442] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 770.950344][T14442] do_sock_setsockopt+0x17c/0x1b0 [ 770.950368][T14442] __x64_sys_setsockopt+0x13d/0x1b0 [ 770.950383][T14442] do_syscall_64+0x166/0x520 [ 770.950395][T14442] ? trace_irq_disable+0x3b/0x140 [ 770.950410][T14442] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.950421][T14442] ? clear_bhb_loop+0x70/0xc0 [ 770.950435][T14442] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.950446][T14442] RIP: 0033:0x7fe814f9f559 [ 770.950458][T14442] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 770.950468][T14442] RSP: 002b:00007fe815e66028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 770.950481][T14442] RAX: ffffffffffffffda RBX: 00007fe815225fa0 RCX: 00007fe814f9f559 [ 770.950489][T14442] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 770.950496][T14442] RBP: 00007fe815e66090 R08: 00000000000003d0 R09: 0000000000000000 [ 770.950503][T14442] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 770.950510][T14442] R13: 00007fe815226038 R14: 00007fe815225fa0 R15: 00007fe81534fa48 [ 770.950528][T14442] [ 770.953792][T14442] xt_cluster: cannot load conntrack support for proto=10 [ 771.923393][ T30] audit: type=1326 audit(1793119016.286:3471): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14454 comm="syz.3.2586" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff4fb59f559 code=0x7ffc0000 [ 771.958951][ T30] audit: type=1326 audit(1793119016.286:3472): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14454 comm="syz.3.2586" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff4fb59f559 code=0x7ffc0000 [ 771.963115][ T30] audit: type=1326 audit(1793119016.326:3473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14454 comm="syz.3.2586" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ff4fb59f559 code=0x7ffc0000 [ 772.395530][ T30] kauditd_printk_skb: 44 callbacks suppressed [ 772.395551][ T30] audit: type=1326 audit(1793119016.756:3518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14454 comm="syz.3.2586" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff4fb59f559 code=0x7ffc0000 [ 772.559554][ T5366] rc_core: IR keymap rc-snapstream-firefly not found [ 772.559574][ T5366] Registered IR keymap rc-empty [ 772.560787][ T5366] rc rc0: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 772.590329][ T5366] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input60 [ 772.620800][ T5366] input: syz syz mouse as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input61 [ 772.629101][ T945] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 772.678634][ C1] ati_remote 4-1:0.0: ati_remote_irq_in: usb_submit_urb()=-19 [ 772.678691][ T5366] usb 4-1: USB disconnect, device number 98 [ 772.799766][ T945] usb 2-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 772.802009][ T945] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 772.802037][ T945] usb 2-1: config 0 has no interface number 0 [ 772.806232][ T945] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 772.806261][ T945] usb 2-1: Product: syz [ 772.806275][ T945] usb 2-1: Manufacturer: syz [ 772.806290][ T945] usb 2-1: SerialNumber: syz [ 772.862841][ T945] usb 2-1: config 0 descriptor?? [ 773.064678][ T945] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 773.079119][ T945] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 773.079915][ T945] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 773.079965][ T945] usb 2-1: media controller created [ 773.124741][ T945] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 773.267194][T14477] FAULT_INJECTION: forcing a failure. [ 773.267194][T14477] name failslab, interval 1, probability 0, space 0, times 0 [ 773.267218][T14477] CPU: 1 UID: 0 PID: 14477 Comm: syz.1.2593 Tainted: G L syzkaller #0 PREEMPT(full) [ 773.267234][T14477] Tainted: [L]=SOFTLOCKUP [ 773.267238][T14477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 773.267245][T14477] Call Trace: [ 773.267251][T14477] [ 773.267256][T14477] dump_stack_lvl+0xe8/0x150 [ 773.267280][T14477] should_fail_ex+0x410/0x560 [ 773.267298][T14477] should_failslab+0xa8/0x100 [ 773.267314][T14477] __kmalloc_noprof+0xf9/0x710 [ 773.267327][T14477] ? tomoyo_encode+0x2ad/0x570 [ 773.267340][T14477] ? tomoyo_encode+0x2ad/0x570 [ 773.267356][T14477] tomoyo_encode+0x2ad/0x570 [ 773.267372][T14477] tomoyo_realpath_from_path+0x5fa/0x640 [ 773.267390][T14477] ? tomoyo_path_number_perm+0x219/0x5f0 [ 773.267402][T14477] tomoyo_path_number_perm+0x246/0x5f0 [ 773.267414][T14477] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 773.267425][T14477] ? __lock_acquire+0x747/0x2de0 [ 773.267458][T14477] ? __fget_files+0x2a/0x420 [ 773.267471][T14477] ? __fget_files+0x2a/0x420 [ 773.267482][T14477] ? __fget_files+0x2a/0x420 [ 773.267495][T14477] security_file_ioctl+0xc3/0x2a0 [ 773.267512][T14477] __se_sys_ioctl+0x47/0x170 [ 773.267527][T14477] do_syscall_64+0x166/0x520 [ 773.267540][T14477] ? trace_irq_disable+0x3b/0x140 [ 773.267558][T14477] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 773.267570][T14477] ? clear_bhb_loop+0x70/0xc0 [ 773.267583][T14477] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 773.267594][T14477] RIP: 0033:0x7f05b4f9f559 [ 773.267605][T14477] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 773.267615][T14477] RSP: 002b:00007f05b5e91028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 773.267627][T14477] RAX: ffffffffffffffda RBX: 00007f05b5225fa0 RCX: 00007f05b4f9f559 [ 773.267635][T14477] RDX: 0000200000000300 RSI: 0000000000000707 RDI: 0000000000000004 [ 773.267643][T14477] RBP: 00007f05b5e91090 R08: 0000000000000000 R09: 0000000000000000 [ 773.267649][T14477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 773.267656][T14477] R13: 00007f05b5226038 R14: 00007f05b5225fa0 R15: 00007f05b534fa48 [ 773.267673][T14477] [ 773.282006][T14477] ERROR: Out of memory at tomoyo_realpath_from_path. [ 774.212964][ T945] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 774.214460][T14477] usb 2-1: dvb_usb_ec168: I2C read not implemented [ 774.304299][ T945] usb 2-1: USB disconnect, device number 104 [ 774.456727][T14501] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 774.470193][T14501] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2601'. [ 774.583374][T14499] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 774.649202][T14499] hfs: unable to load iocharset "io#harset" [ 774.928622][ T30] audit: type=1800 audit(1793119019.286:3519): pid=14514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2604" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=-22 [ 775.270414][ T9] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 775.399082][ T9] usb 2-1: device descriptor read/64, error -71 [ 775.550205][T14530] sctp: [Deprecated]: syz.3.2607 (pid 14530) Use of struct sctp_assoc_value in delayed_ack socket option. [ 775.550205][T14530] Use struct sctp_sack_info instead [ 775.555411][T14530] sctp: [Deprecated]: syz.3.2607 (pid 14530) Use of struct sctp_assoc_value in delayed_ack socket option. [ 775.555411][T14530] Use struct sctp_sack_info instead [ 775.639892][ T9] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 775.780811][ T9] usb 2-1: device descriptor read/64, error -71 [ 775.889864][ T9] usb usb2-port1: attempt power cycle [ 776.240160][ T9] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 776.265001][ T9] usb 2-1: device descriptor read/8, error -71 [ 776.499137][ T9] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 776.532580][ T9] usb 2-1: device descriptor read/8, error -71 [ 776.645289][ T9] usb usb2-port1: unable to enumerate USB device [ 776.685757][ T30] audit: type=1326 audit(1793119021.046:3520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14543 comm="syz.2.2611" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 776.689534][ T30] audit: type=1326 audit(1793119021.046:3521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14543 comm="syz.2.2611" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 776.690041][ T30] audit: type=1326 audit(1793119021.056:3522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14543 comm="syz.2.2611" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 776.774615][T14548] xt_hashlimit: size too large, truncated to 1048576 [ 776.778363][ T30] audit: type=1326 audit(1793119021.136:3523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14543 comm="syz.2.2611" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 776.816652][ T30] audit: type=1326 audit(1793119021.176:3524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14543 comm="syz.2.2611" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 776.866656][ T30] audit: type=1326 audit(1793119021.226:3525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14543 comm="syz.2.2611" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 776.898694][ T30] audit: type=1326 audit(1793119021.226:3526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14543 comm="syz.2.2611" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 776.923757][ T30] audit: type=1326 audit(1793119021.256:3527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14543 comm="syz.2.2611" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 777.495944][T14553] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 778.277098][T14575] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 778.344137][T14572] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 778.344394][T14572] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 778.787361][T14582] netlink: 'syz.2.2625': attribute type 1 has an invalid length. [ 779.167640][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 779.167658][ T30] audit: type=1326 audit(1793119023.526:3536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14589 comm="syz.2.2629" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe814f9f559 code=0x0 [ 779.168109][T14588] IPVS: length: 26 != 24 [ 779.338989][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 779.459644][T14596] FAULT_INJECTION: forcing a failure. [ 779.459644][T14596] name failslab, interval 1, probability 0, space 0, times 0 [ 779.459668][T14596] CPU: 1 UID: 0 PID: 14596 Comm: syz.3.2631 Tainted: G L syzkaller #0 PREEMPT(full) [ 779.459692][T14596] Tainted: [L]=SOFTLOCKUP [ 779.459696][T14596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 779.459703][T14596] Call Trace: [ 779.459708][T14596] [ 779.459713][T14596] dump_stack_lvl+0xe8/0x150 [ 779.459737][T14596] should_fail_ex+0x410/0x560 [ 779.459756][T14596] should_failslab+0xa8/0x100 [ 779.459773][T14596] __kmalloc_noprof+0xf9/0x710 [ 779.459790][T14596] ? n_hdlc_alloc_buf+0x83/0x230 [ 779.459805][T14596] ? n_hdlc_alloc_buf+0x83/0x230 [ 779.459822][T14596] n_hdlc_alloc_buf+0x83/0x230 [ 779.459840][T14596] ? __raw_spin_lock_init+0x45/0x100 [ 779.459853][T14596] n_hdlc_tty_open+0x25a/0x4a0 [ 779.459870][T14596] tty_ldisc_open+0xa1/0x100 [ 779.459886][T14596] tty_set_ldisc+0x365/0x540 [ 779.459902][T14596] tty_ioctl+0xc30/0xde0 [ 779.459916][T14596] ? __pfx_tty_ioctl+0x10/0x10 [ 779.459931][T14596] __se_sys_ioctl+0xfc/0x170 [ 779.459946][T14596] do_syscall_64+0x166/0x520 [ 779.459959][T14596] ? trace_irq_disable+0x3b/0x140 [ 779.459973][T14596] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 779.459985][T14596] ? clear_bhb_loop+0x70/0xc0 [ 779.459999][T14596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 779.460009][T14596] RIP: 0033:0x7ff4fb59f559 [ 779.460021][T14596] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 779.460030][T14596] RSP: 002b:00007ff4fc3be028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 779.460043][T14596] RAX: ffffffffffffffda RBX: 00007ff4fb825fa0 RCX: 00007ff4fb59f559 [ 779.460051][T14596] RDX: 00002000000000c0 RSI: 0000000000005423 RDI: 0000000000000004 [ 779.460059][T14596] RBP: 00007ff4fc3be090 R08: 0000000000000000 R09: 0000000000000000 [ 779.460065][T14596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 779.460072][T14596] R13: 00007ff4fb826038 R14: 00007ff4fb825fa0 R15: 00007ff4fb94fa48 [ 779.460090][T14596] [ 780.880752][T14619] bridge0: port 1(bridge_slave_0) entered disabled state [ 781.529081][ T9] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 781.679514][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 781.680288][ T9] usb 4-1: New USB device found: idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 781.681355][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 781.681384][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 781.705400][ T9] usb 4-1: config 0 descriptor?? [ 781.942954][ T9] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 782.144540][T14615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 782.158248][T14615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 782.375237][ T945] usb 4-1: USB disconnect, device number 99 [ 782.940671][T14652] netlink: 'syz.1.2647': attribute type 9 has an invalid length. [ 782.940868][T14652] FAULT_INJECTION: forcing a failure. [ 782.940868][T14652] name failslab, interval 1, probability 0, space 0, times 0 [ 782.940887][T14652] CPU: 1 UID: 0 PID: 14652 Comm: syz.1.2647 Tainted: G L syzkaller #0 PREEMPT(full) [ 782.940902][T14652] Tainted: [L]=SOFTLOCKUP [ 782.940907][T14652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 782.940914][T14652] Call Trace: [ 782.940919][T14652] [ 782.940924][T14652] dump_stack_lvl+0xe8/0x150 [ 782.940955][T14652] should_fail_ex+0x410/0x560 [ 782.940974][T14652] should_failslab+0xa8/0x100 [ 782.940991][T14652] __kmalloc_cache_noprof+0x9e/0x600 [ 782.941004][T14652] ? alloc_netdev_mqs+0xc4a/0x1240 [ 782.941019][T14652] ? alloc_netdev_mqs+0xc4a/0x1240 [ 782.941032][T14652] ? __xdp_rxq_info_reg+0x171/0x280 [ 782.941048][T14652] alloc_netdev_mqs+0xc4a/0x1240 [ 782.941065][T14652] rtnl_create_link+0x321/0xd70 [ 782.941084][T14652] rtnl_newlink_create+0x258/0x7b0 [ 782.941100][T14652] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 782.941115][T14652] ? __pfx___mutex_lock+0x10/0x10 [ 782.941134][T14652] ? ns_capable+0x84/0xe0 [ 782.941150][T14652] rtnl_newlink+0x167a/0x1c30 [ 782.941169][T14652] ? __pfx_rtnl_newlink+0x10/0x10 [ 782.941179][T14652] ? __netlink_deliver_tap+0x4f1/0x6e0 [ 782.941193][T14652] ? netlink_deliver_tap+0x19c/0x1b0 [ 782.941206][T14652] ? netlink_unicast+0x8c1/0xa80 [ 782.941218][T14652] ? netlink_sendmsg+0x7f0/0xb20 [ 782.941231][T14652] ? sock_sendmsg_nosec+0x14e/0x190 [ 782.941245][T14652] ? ____sys_sendmsg+0x54e/0x850 [ 782.941255][T14652] ? ___sys_sendmsg+0x2a5/0x360 [ 782.941265][T14652] ? __sys_sendmmsg+0x273/0x4e0 [ 782.941275][T14652] ? __x64_sys_sendmmsg+0xa0/0xc0 [ 782.941285][T14652] ? do_syscall_64+0x166/0x520 [ 782.941296][T14652] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.941329][T14652] ? kasan_quarantine_put+0xbb/0x1f0 [ 782.941341][T14652] ? lockdep_hardirqs_on+0x7b/0x110 [ 782.941355][T14652] ? nlmon_xmit+0xb0/0x100 [ 782.941368][T14652] ? kmem_cache_free+0x182/0x650 [ 782.941385][T14652] ? __lock_acquire+0x747/0x2de0 [ 782.941402][T14652] ? __pfx_hook_capable+0x10/0x10 [ 782.941415][T14652] ? __dev_queue_xmit+0x29b/0x3920 [ 782.941430][T14652] ? __pfx_hook_capable+0x10/0x10 [ 782.941445][T14652] ? lockdep_hardirqs_on+0x7b/0x110 [ 782.941470][T14652] ? __pfx_rtnl_newlink+0x10/0x10 [ 782.941481][T14652] rtnetlink_rcv_msg+0x802/0xc00 [ 782.941493][T14652] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 782.941504][T14652] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 782.941516][T14652] ? __copy_skb_header+0xa3/0x4a0 [ 782.941534][T14652] netlink_rcv_skb+0x226/0x4a0 [ 782.941549][T14652] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 782.941561][T14652] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 782.941582][T14652] ? netlink_deliver_tap+0x2e/0x1b0 [ 782.941597][T14652] ? netlink_deliver_tap+0x2e/0x1b0 [ 782.941614][T14652] netlink_unicast+0x8ef/0xa80 [ 782.941636][T14652] netlink_sendmsg+0x7f0/0xb20 [ 782.941654][T14652] ? __pfx_netlink_sendmsg+0x10/0x10 [ 782.941670][T14652] ? aa_sock_msg_perm+0x144/0x210 [ 782.941686][T14652] ? apparmor_socket_sendmsg+0x98/0x360 [ 782.941698][T14652] ? __pfx_netlink_sendmsg+0x10/0x10 [ 782.941712][T14652] sock_sendmsg_nosec+0x14e/0x190 [ 782.941727][T14652] ____sys_sendmsg+0x54e/0x850 [ 782.941741][T14652] ? __pfx_____sys_sendmsg+0x10/0x10 [ 782.941757][T14652] ? import_iovec+0x73/0xa0 [ 782.941775][T14652] ___sys_sendmsg+0x2a5/0x360 [ 782.941785][T14652] ? __lock_acquire+0x747/0x2de0 [ 782.941800][T14652] ? __pfx____sys_sendmsg+0x10/0x10 [ 782.941814][T14652] ? kstrtouint+0x6e/0xe0 [ 782.941855][T14652] ? __fget_files+0x3a2/0x420 [ 782.941866][T14652] ? __fget_files+0x2a/0x420 [ 782.941882][T14652] __sys_sendmmsg+0x273/0x4e0 [ 782.941896][T14652] ? __pfx___sys_sendmmsg+0x10/0x10 [ 782.941913][T14652] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 782.941938][T14652] ? ksys_write+0x242/0x270 [ 782.941951][T14652] ? __pfx_ksys_write+0x10/0x10 [ 782.941967][T14652] __x64_sys_sendmmsg+0xa0/0xc0 [ 782.941979][T14652] do_syscall_64+0x166/0x520 [ 782.941991][T14652] ? trace_irq_disable+0x3b/0x140 [ 782.942005][T14652] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.942016][T14652] ? clear_bhb_loop+0x70/0xc0 [ 782.942029][T14652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.942040][T14652] RIP: 0033:0x7f05b4f9f559 [ 782.942052][T14652] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 782.942061][T14652] RSP: 002b:00007f05b5e91028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 782.942074][T14652] RAX: ffffffffffffffda RBX: 00007f05b5225fa0 RCX: 00007f05b4f9f559 [ 782.942082][T14652] RDX: 0400000000000235 RSI: 0000200000000000 RDI: 0000000000000003 [ 782.942090][T14652] RBP: 00007f05b5e91090 R08: 0000000000000000 R09: 0000000000000000 [ 782.942097][T14652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 782.942103][T14652] R13: 00007f05b5226038 R14: 00007f05b5225fa0 R15: 00007f05b534fa48 [ 782.942121][T14652] [ 783.675433][T14656] syzkaller0: entered promiscuous mode [ 783.675457][T14656] syzkaller0: entered allmulticast mode [ 783.883670][T14659] sg_write: data in/out 532520/136 bytes for SCSI command 0x0-- guessing data in; [ 783.883670][T14659] program syz.3.2649 not setting count and/or reply_len properly [ 784.009053][T14668] netlink: zone id is out of range [ 784.009070][T14668] netlink: set zone limit has 4 unknown bytes [ 784.009169][T14670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 784.010558][T14670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 785.146076][T14692] gtp2: entered allmulticast mode [ 786.079270][ T9] usb 2-1: new full-speed USB device number 109 using dummy_hcd [ 786.245130][ T9] usb 2-1: New USB device found: idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 786.246228][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 786.246253][ T9] usb 2-1: config 0 has no interfaces? [ 786.273518][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.273544][ T9] usb 2-1: Product: syz [ 786.273559][ T9] usb 2-1: Manufacturer: syz [ 786.273571][ T9] usb 2-1: SerialNumber: syz [ 786.294039][ T9] usb 2-1: config 0 descriptor?? [ 786.677774][ T30] audit: type=1326 audit(1793119031.036:3537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14711 comm="syz.0.2665" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc64699f559 code=0x0 [ 786.713119][T14715] IPVS: lblcr: FWM 3 0x00000003 - no destination available [ 786.829646][ T945] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 786.950253][ T9] usb 2-1: USB disconnect, device number 109 [ 786.979916][ T945] usb 3-1: Using ep0 maxpacket: 16 [ 786.980627][ T945] usb 3-1: New USB device found: idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 786.981801][ T945] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 786.981824][ T945] usb 3-1: config 0 has no interface number 0 [ 786.981862][ T945] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 786.981878][ T945] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 786.984492][ T945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.984509][ T945] usb 3-1: Product: syz [ 786.984517][ T945] usb 3-1: Manufacturer: syz [ 786.984525][ T945] usb 3-1: SerialNumber: syz [ 786.988293][ T945] usb 3-1: config 0 descriptor?? [ 787.021149][T14710] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 787.021261][T14710] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 787.279700][T14707] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 787.279839][T14707] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 787.487208][ T945] asix 3-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 788.123768][T14726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 788.124287][T14726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 788.412068][T14745] FAULT_INJECTION: forcing a failure. [ 788.412068][T14745] name failslab, interval 1, probability 0, space 0, times 0 [ 788.412102][T14745] CPU: 1 UID: 0 PID: 14745 Comm: syz.3.2674 Tainted: G L syzkaller #0 PREEMPT(full) [ 788.412132][T14745] Tainted: [L]=SOFTLOCKUP [ 788.412140][T14745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 788.412153][T14745] Call Trace: [ 788.412162][T14745] [ 788.412171][T14745] dump_stack_lvl+0xe8/0x150 [ 788.412207][T14745] should_fail_ex+0x410/0x560 [ 788.412240][T14745] should_failslab+0xa8/0x100 [ 788.412269][T14745] __kmalloc_node_track_caller_noprof+0xf6/0x720 [ 788.412293][T14745] ? kasprintf+0xe2/0x140 [ 788.412319][T14745] ? kasprintf+0xe2/0x140 [ 788.412352][T14745] kvasprintf+0xeb/0x1a0 [ 788.412377][T14745] ? sock_sendmsg_nosec+0x14e/0x190 [ 788.412401][T14745] ? ____sys_sendmsg+0x54e/0x850 [ 788.412420][T14745] ? ___sys_sendmsg+0x2a5/0x360 [ 788.412441][T14745] ? __pfx_kvasprintf+0x10/0x10 [ 788.412482][T14745] kasprintf+0xe2/0x140 [ 788.412516][T14745] ? __pfx_kasprintf+0x10/0x10 [ 788.412565][T14745] nf_tables_set_alloc_name+0x10e/0x710 [ 788.412585][T14745] ? trace_kmalloc+0x2a/0xf0 [ 788.412609][T14745] ? nf_tables_newset+0x134a/0x2570 [ 788.412634][T14745] ? __kmalloc_noprof+0x1a6/0x710 [ 788.412655][T14745] ? __pfx_nf_tables_set_alloc_name+0x10/0x10 [ 788.412675][T14745] ? nla_strdup+0xb8/0x140 [ 788.412704][T14745] nf_tables_newset+0x13aa/0x2570 [ 788.412741][T14745] ? __pfx_nf_tables_newset+0x10/0x10 [ 788.412771][T14745] ? lock_acquire+0x115/0x350 [ 788.412808][T14745] ? __nla_parse+0x40/0x60 [ 788.412831][T14745] nfnetlink_rcv+0x1288/0x28c0 [ 788.412885][T14745] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 788.412959][T14745] ? lock_acquire+0x115/0x350 [ 788.412991][T14745] ? netlink_deliver_tap+0x2e/0x1b0 [ 788.413019][T14745] ? netlink_deliver_tap+0x2e/0x1b0 [ 788.413052][T14745] netlink_unicast+0x8ef/0xa80 [ 788.413093][T14745] netlink_sendmsg+0x7f0/0xb20 [ 788.413127][T14745] ? __pfx_netlink_sendmsg+0x10/0x10 [ 788.413159][T14745] ? aa_sock_msg_perm+0x144/0x210 [ 788.413187][T14745] ? apparmor_socket_sendmsg+0x18b/0x360 [ 788.413210][T14745] ? __pfx_netlink_sendmsg+0x10/0x10 [ 788.413241][T14745] sock_sendmsg_nosec+0x14e/0x190 [ 788.413270][T14745] ____sys_sendmsg+0x54e/0x850 [ 788.413298][T14745] ? __pfx_____sys_sendmsg+0x10/0x10 [ 788.413326][T14745] ? import_iovec+0x73/0xa0 [ 788.413353][T14745] ___sys_sendmsg+0x2a5/0x360 [ 788.413370][T14745] ? __lock_acquire+0x747/0x2de0 [ 788.413399][T14745] ? __pfx____sys_sendmsg+0x10/0x10 [ 788.413461][T14745] ? __fget_files+0x3a2/0x420 [ 788.413481][T14745] ? __fget_files+0x2a/0x420 [ 788.413511][T14745] __x64_sys_sendmsg+0x1b1/0x290 [ 788.413535][T14745] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 788.413583][T14745] do_syscall_64+0x166/0x520 [ 788.413605][T14745] ? trace_irq_disable+0x3b/0x140 [ 788.413631][T14745] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.413651][T14745] ? clear_bhb_loop+0x70/0xc0 [ 788.413676][T14745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.413697][T14745] RIP: 0033:0x7ff4fb59f559 [ 788.413716][T14745] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 788.413733][T14745] RSP: 002b:00007ff4fc3be028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 788.413755][T14745] RAX: ffffffffffffffda RBX: 00007ff4fb825fa0 RCX: 00007ff4fb59f559 [ 788.413770][T14745] RDX: 0000000020050800 RSI: 0000200000000200 RDI: 0000000000000003 [ 788.413784][T14745] RBP: 00007ff4fc3be090 R08: 0000000000000000 R09: 0000000000000000 [ 788.413797][T14745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 788.413809][T14745] R13: 00007ff4fb826038 R14: 00007ff4fb825fa0 R15: 00007ff4fb94fa48 [ 788.413843][T14745] [ 789.109273][ T5366] usb 4-1: new full-speed USB device number 100 using dummy_hcd [ 789.235700][T14707] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2664'. [ 789.249846][ T945] asix 3-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 789.250084][ T945] asix 3-1:0.34: probe with driver asix failed with error -71 [ 789.284700][ T945] usb 3-1: USB disconnect, device number 100 [ 789.300973][ T5366] usb 4-1: not running at top speed; connect to a high speed hub [ 789.301011][ T5366] usb 4-1: New USB device found: idVendor=090a, idProduct=1050, bcdDevice=1.00 [ 789.303519][ T5366] usb 4-1: config 127 has an invalid interface number: 148 but max is 1 [ 789.303549][ T5366] usb 4-1: config 127 has an invalid interface number: 218 but max is 1 [ 789.303569][ T5366] usb 4-1: config 127 has no interface number 0 [ 789.303586][ T5366] usb 4-1: config 127 has no interface number 1 [ 789.303640][ T5366] usb 4-1: config 127 interface 148 altsetting 90 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 789.303666][ T5366] usb 4-1: config 127 interface 148 altsetting 90 has a duplicate endpoint with address 0x6, skipping [ 789.303690][ T5366] usb 4-1: config 127 interface 148 altsetting 90 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 789.303717][ T5366] usb 4-1: config 127 interface 148 altsetting 90 endpoint 0xD has invalid maxpacket 512, setting to 64 [ 789.303744][ T5366] usb 4-1: config 127 interface 148 altsetting 90 has an invalid descriptor for endpoint zero, skipping [ 789.303766][ T5366] usb 4-1: config 127 interface 148 altsetting 90 has a duplicate endpoint with address 0x9, skipping [ 789.303788][ T5366] usb 4-1: config 127 interface 148 altsetting 90 has an invalid descriptor for endpoint zero, skipping [ 789.303819][ T5366] usb 4-1: config 127 interface 218 altsetting 4 endpoint 0xB has invalid maxpacket 64520, setting to 64 [ 789.303845][ T5366] usb 4-1: config 127 interface 218 altsetting 4 has a duplicate endpoint with address 0xE, skipping [ 789.303867][ T5366] usb 4-1: config 127 interface 218 altsetting 4 has a duplicate endpoint with address 0xA, skipping [ 789.303888][ T5366] usb 4-1: config 127 interface 218 altsetting 4 has a duplicate endpoint with address 0xC, skipping [ 789.303910][ T5366] usb 4-1: config 127 interface 148 has no altsetting 0 [ 789.303926][ T5366] usb 4-1: config 127 interface 218 has no altsetting 0 [ 789.337809][ T5366] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 789.337836][ T5366] usb 4-1: Product: ⠁ [ 789.337851][ T5366] usb 4-1: Manufacturer: 퀠壧癙㨁믹캶嗷झ淰㟮⡌Ʌ㸏搂뮷嗊冥ᯐ≝㧋务컔㹤㞨㠐뗬骖닜Ꚙ湫嫏ꏔ䍖埫젫桘꾴ꡌ읲첕朓㎐靝蘘ォᖥ椾캣¹捁 [ 789.337874][ T5366] usb 4-1: SerialNumber: ࡠ [ 789.472045][T14760] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2676'. [ 790.033036][ T5366] usb-storage 4-1:127.148: USB Mass Storage device detected [ 790.231582][T14783] FAULT_INJECTION: forcing a failure. [ 790.231582][T14783] name failslab, interval 1, probability 0, space 0, times 0 [ 790.231618][T14783] CPU: 1 UID: 0 PID: 14783 Comm: syz.2.2685 Tainted: G L syzkaller #0 PREEMPT(full) [ 790.231648][T14783] Tainted: [L]=SOFTLOCKUP [ 790.231656][T14783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 790.231668][T14783] Call Trace: [ 790.231676][T14783] [ 790.231686][T14783] dump_stack_lvl+0xe8/0x150 [ 790.231722][T14783] should_fail_ex+0x410/0x560 [ 790.231752][T14783] ? create_io_worker+0x27/0x5c0 [ 790.231782][T14783] should_failslab+0xa8/0x100 [ 790.231810][T14783] __kmalloc_cache_noprof+0x9e/0x600 [ 790.231838][T14783] ? do_raw_spin_lock+0x12b/0x2f0 [ 790.231859][T14783] ? create_io_worker+0xab/0x5c0 [ 790.231884][T14783] ? create_io_worker+0xab/0x5c0 [ 790.231912][T14783] ? create_io_worker+0x27/0x5c0 [ 790.231944][T14783] create_io_worker+0xab/0x5c0 [ 790.231973][T14783] io_wq_enqueue+0x7ef/0xa30 [ 790.231998][T14783] ? __pfx_io_wq_work_match_item+0x10/0x10 [ 790.232027][T14783] ? __pfx_io_wq_enqueue+0x10/0x10 [ 790.232052][T14783] ? rcu_is_watching+0x16/0xb0 [ 790.232081][T14783] ? io_queue_iowq+0x56a/0x830 [ 790.232104][T14783] ? __pfx_io_req_task_submit+0x10/0x10 [ 790.232126][T14783] tctx_task_work_run+0x853/0xd10 [ 790.232163][T14783] ? __pfx_tctx_task_work_run+0x10/0x10 [ 790.232200][T14783] tctx_task_work+0x3f/0x60 [ 790.232228][T14783] task_work_run+0x1d9/0x260 [ 790.232256][T14783] ? __pfx_task_work_run+0x10/0x10 [ 790.232281][T14783] ? __mutex_unlock_slowpath+0x731/0x900 [ 790.232313][T14783] get_signal+0x117c/0x12c0 [ 790.232351][T14783] ? __se_sys_io_uring_enter+0x291/0x1bb0 [ 790.232380][T14783] arch_do_signal_or_restart+0xbb/0x860 [ 790.232405][T14783] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 790.232432][T14783] ? ksys_write+0x242/0x270 [ 790.232463][T14783] exit_to_user_mode_loop+0x10e/0x770 [ 790.232489][T14783] ? rcu_is_watching+0x16/0xb0 [ 790.232521][T14783] do_syscall_64+0x328/0x520 [ 790.232543][T14783] ? trace_irq_disable+0x3b/0x140 [ 790.232570][T14783] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.232589][T14783] ? clear_bhb_loop+0x70/0xc0 [ 790.232613][T14783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.232633][T14783] RIP: 0033:0x7fe814f9f559 [ 790.232653][T14783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 790.232669][T14783] RSP: 002b:00007fe815e66028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 790.232691][T14783] RAX: 0000000000000004 RBX: 00007fe815225fa0 RCX: 00007fe814f9f559 [ 790.232706][T14783] RDX: 0000000000007721 RSI: 0000000000004095 RDI: 0000000000000000 [ 790.232719][T14783] RBP: 00007fe815e66090 R08: 0000000000000000 R09: 0000000000000000 [ 790.232731][T14783] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000002 [ 790.232742][T14783] R13: 00007fe815226038 R14: 00007fe815225fa0 R15: 00007fe81534fa48 [ 790.232774][T14783] [ 790.326525][T14785] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(9) [ 790.326554][T14785] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 790.326642][T14785] vhci_hcd vhci_hcd.0: Device attached [ 790.509447][ T9] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 790.569013][ T9] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 790.721467][T14786] vhci_hcd: connection reset by peer [ 790.722014][ T6348] vhci_hcd vhci_hcd.3: stop threads [ 790.722039][ T6348] vhci_hcd vhci_hcd.3: release socket [ 790.722095][ T6348] vhci_hcd vhci_hcd.3: disconnect device [ 790.729089][ T5366] usb-storage 4-1:127.218: USB Mass Storage device detected [ 790.876229][ T5366] usb 4-1: USB disconnect, device number 100 [ 790.888646][T14801] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2689'. [ 791.053521][T14803] netlink: 75 bytes leftover after parsing attributes in process `syz.2.2690'. [ 791.187525][T14806] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2691'. [ 791.315921][T14815] xt_l2tp: v2 doesn't support IP mode [ 791.533325][T14821] gtp6: entered allmulticast mode [ 791.741675][T14834] netlink: 5740 bytes leftover after parsing attributes in process `syz.3.2701'. [ 791.871160][T14837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 791.887562][T14837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 792.906473][T14858] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 792.906473][T14858] Please contact the netfilter-devel mailing list or update your nftables rules. [ 793.120005][ T8185] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 793.289576][ T8185] usb 3-1: Using ep0 maxpacket: 32 [ 793.298790][ T8185] usb 3-1: New USB device found: idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 793.302027][ T8185] usb 3-1: config index 0 descriptor too short (expected 19, got 18) [ 793.306787][ T8185] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 793.306814][ T8185] usb 3-1: Product: syz [ 793.306828][ T8185] usb 3-1: Manufacturer: syz [ 793.306842][ T8185] usb 3-1: SerialNumber: syz [ 793.313754][ T8185] usb 3-1: config 0 descriptor?? [ 793.320731][ T8185] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 793.320782][ T8185] dvb-usb: bulk message failed: -22 (2/0) [ 793.415902][ T8185] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 793.425260][ T8185] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 793.425316][ T8185] usb 3-1: media controller created [ 793.473571][ T8185] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 793.535481][T14857] FAULT_INJECTION: forcing a failure. [ 793.535481][T14857] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 793.535505][T14857] CPU: 0 UID: 0 PID: 14857 Comm: syz.2.2710 Tainted: G L syzkaller #0 PREEMPT(full) [ 793.535521][T14857] Tainted: [L]=SOFTLOCKUP [ 793.535525][T14857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 793.535532][T14857] Call Trace: [ 793.535537][T14857] [ 793.535543][T14857] dump_stack_lvl+0xe8/0x150 [ 793.535565][T14857] should_fail_ex+0x410/0x560 [ 793.535583][T14857] _copy_from_user+0x2d/0xb0 [ 793.535599][T14857] i2cdev_ioctl+0x303/0x880 [ 793.535616][T14857] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 793.535633][T14857] ? __fget_files+0x2a/0x420 [ 793.535647][T14857] ? bpf_lsm_file_ioctl+0x9/0x20 [ 793.535663][T14857] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 793.535678][T14857] __se_sys_ioctl+0xfc/0x170 [ 793.535702][T14857] do_syscall_64+0x166/0x520 [ 793.535714][T14857] ? trace_irq_disable+0x3b/0x140 [ 793.535729][T14857] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.535740][T14857] ? clear_bhb_loop+0x70/0xc0 [ 793.535754][T14857] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.535764][T14857] RIP: 0033:0x7fe814f9f559 [ 793.535776][T14857] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 793.535786][T14857] RSP: 002b:00007fe815e66028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 793.535799][T14857] RAX: ffffffffffffffda RBX: 00007fe815225fa0 RCX: 00007fe814f9f559 [ 793.535807][T14857] RDX: 0000200000000440 RSI: 0000000000000707 RDI: 0000000000000004 [ 793.535814][T14857] RBP: 00007fe815e66090 R08: 0000000000000000 R09: 0000000000000000 [ 793.535821][T14857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 793.535827][T14857] R13: 00007fe815226038 R14: 00007fe815225fa0 R15: 00007fe81534fa48 [ 793.535844][T14857] [ 793.625209][ T8185] usb 3-1: selecting invalid altsetting 7 [ 793.625230][ T8185] cxusb: set interface failed [ 793.625243][ T8185] dvb-usb: bulk message failed: -22 (1/0) [ 793.894381][ T8185] DVB: Unable to find symbol lgdt330x_attach() [ 793.894401][ T8185] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 794.178967][ T8185] rc_core: IR keymap rc-dvico-portable not found [ 794.178986][ T8185] Registered IR keymap rc-empty [ 794.180243][ T8185] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 794.245364][ T8185] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input62 [ 794.263906][ T8185] dvb-usb: schedule remote query interval to 100 msecs. [ 794.263924][ T8185] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 794.295809][ T8185] usb 3-1: USB disconnect, device number 101 [ 794.409714][T14871] fuse: fd is not a fuse device [ 794.523753][ T8185] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 795.462084][T14878] netlink: 'syz.3.2716': attribute type 13 has an invalid length. [ 795.492090][T14882] netlink: 'syz.0.2717': attribute type 1 has an invalid length. [ 795.649426][ T9] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 795.681402][T14882] 8021q: adding VLAN 0 to HW filter on device bond2 [ 795.698161][T14885] Invalid argument reading file caps for ./file0 [ 795.814685][T14882] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2717'. [ 795.872559][T14882] vlan2: entered promiscuous mode [ 795.872577][T14882] bond2: entered promiscuous mode [ 796.023553][T14885] bond2: (slave geneve2): making interface the new active one [ 796.023583][T14885] geneve2: entered promiscuous mode [ 796.051927][T14885] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 796.270512][T14889] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 799.037053][T14906] xfrm0: entered promiscuous mode [ 799.037070][T14906] xfrm0: entered allmulticast mode [ 799.279841][T14914] gtp3: entered allmulticast mode [ 799.421445][T14918] fuse: fd is not a fuse device [ 799.886617][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 799.955884][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 799.957360][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 799.982125][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 799.982159][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.119495][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.119533][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.219395][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.219498][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.838152][T14925] __nla_validate_parse: 14 callbacks suppressed [ 800.838169][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.838185][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.887863][T14925] bridge0: port 2(bridge_slave_1) entered disabled state [ 800.888213][T14925] bridge0: port 1(bridge_slave_0) entered disabled state [ 800.919758][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.919800][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.925735][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.925770][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.988711][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 800.988749][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 801.027009][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 801.027043][T14925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2731'. [ 801.378836][T14925] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 801.413545][T14925] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 801.991430][T14953] FAULT_INJECTION: forcing a failure. [ 801.991430][T14953] name failslab, interval 1, probability 0, space 0, times 0 [ 801.991454][T14953] CPU: 0 UID: 0 PID: 14953 Comm: syz.1.2738 Tainted: G L syzkaller #0 PREEMPT(full) [ 801.991470][T14953] Tainted: [L]=SOFTLOCKUP [ 801.991474][T14953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 801.991481][T14953] Call Trace: [ 801.991485][T14953] [ 801.991491][T14953] dump_stack_lvl+0xe8/0x150 [ 801.991513][T14953] should_fail_ex+0x410/0x560 [ 801.991532][T14953] should_failslab+0xa8/0x100 [ 801.991549][T14953] __kmalloc_noprof+0xf9/0x710 [ 801.991561][T14953] ? tomoyo_encode+0x2ad/0x570 [ 801.991575][T14953] ? tomoyo_encode+0x2ad/0x570 [ 801.991591][T14953] tomoyo_encode+0x2ad/0x570 [ 801.991611][T14953] tomoyo_realpath_from_path+0x5fa/0x640 [ 801.991630][T14953] ? tomoyo_path_number_perm+0x219/0x5f0 [ 801.991641][T14953] tomoyo_path_number_perm+0x246/0x5f0 [ 801.991654][T14953] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 801.991664][T14953] ? __lock_acquire+0x747/0x2de0 [ 801.991698][T14953] ? __fget_files+0x2a/0x420 [ 801.991710][T14953] ? __fget_files+0x2a/0x420 [ 801.991723][T14953] ? __fget_files+0x2a/0x420 [ 801.991744][T14953] security_file_ioctl+0xc3/0x2a0 [ 801.991773][T14953] __se_sys_ioctl+0x47/0x170 [ 801.991797][T14953] do_syscall_64+0x166/0x520 [ 801.991817][T14953] ? trace_irq_disable+0x3b/0x140 [ 801.991842][T14953] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 801.991861][T14953] ? clear_bhb_loop+0x70/0xc0 [ 801.991883][T14953] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 801.991902][T14953] RIP: 0033:0x7f05b4f9f559 [ 801.991921][T14953] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 801.991938][T14953] RSP: 002b:00007f05b5e91028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 801.991960][T14953] RAX: ffffffffffffffda RBX: 00007f05b5225fa0 RCX: 00007f05b4f9f559 [ 801.991975][T14953] RDX: 0000200000000a80 RSI: 00000000c0185500 RDI: 0000000000000004 [ 801.991989][T14953] RBP: 00007f05b5e91090 R08: 0000000000000000 R09: 0000000000000000 [ 801.992002][T14953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 801.992014][T14953] R13: 00007f05b5226038 R14: 00007f05b5225fa0 R15: 00007f05b534fa48 [ 801.992053][T14953] [ 802.012360][T14953] ERROR: Out of memory at tomoyo_realpath_from_path. [ 802.059089][ T8185] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 802.271330][ T8185] usb 3-1: New USB device found: idVendor=046d, idProduct=0825, bcdDevice=1.00 [ 802.273063][ T8185] usb 3-1: config index 0 descriptor too short (expected 4257, got 161) [ 802.273115][ T8185] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 802.273176][ T8185] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 802.826719][T14972] gtp7: entered allmulticast mode [ 803.699024][ T945] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 803.859924][ T945] usb 4-1: New USB device found: idVendor=2c7c, idProduct=0125, bcdDevice=0.00 [ 803.867014][ T945] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 803.867065][ T945] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 804.039541][T14979] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 804.055270][T14979] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 804.253803][ T945] qmi_wwan 4-1:1.0: cdc-wdm0: USB WDM device [ 804.420481][ T945] wwan wwan0: port wwan0qmi0 attached [ 804.651937][ T8185] usb 3-1: string descriptor 0 read error: -71 [ 804.687180][ T8185] uvcvideo 3-1:1.1: Unknown video format 32595559-0008-0010-8000-00aa00389b71 [ 804.687297][ T8185] uvcvideo 3-1:1.0: Found UVC 1.00 device (046d:0825) [ 804.687358][ T8185] uvcvideo 3-1:1.1: No supported video formats found. [ 804.687371][ T8185] uvcvideo 3-1:1.1: Failed to initialize the device (-22). [ 804.743894][ T8185] uvcvideo 3-1:1.0: probe with driver uvcvideo failed with error -22 [ 804.783928][ T8185] usb 3-1: USB disconnect, device number 102 [ 804.799295][ T945] qmi_wwan 4-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.3-1, WWAN/QMI device, 76:8a:62:eb:63:6b [ 805.164517][T14999] gtp8: entered allmulticast mode [ 806.546688][ T8187] usb 4-1: USB disconnect, device number 101 [ 806.566901][ T8187] qmi_wwan 4-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.3-1, WWAN/QMI device [ 806.619157][ T945] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 806.799972][ T945] usb 3-1: New USB device found: idVendor=0489, idProduct=e057, bcdDevice=0.00 [ 806.802331][ T945] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 806.802358][ T945] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 806.802405][ T945] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 806.805366][ T945] usb 3-1: config 0 descriptor?? [ 806.852834][ T8187] wwan wwan0: port wwan0qmi0 disconnected [ 807.321307][T15037] vlan0: entered promiscuous mode [ 808.065303][T15048] netlink: 'syz.4.2762': attribute type 1 has an invalid length. [ 808.065329][T15048] __nla_validate_parse: 137 callbacks suppressed [ 808.065342][T15048] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2762'. [ 808.099259][T15048] netlink: 'syz.4.2762': attribute type 1 has an invalid length. [ 808.167363][T15026] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 808.168521][T15026] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 808.341095][ T29] usb 2-1: new full-speed USB device number 110 using dummy_hcd [ 808.448671][ T945] Bluetooth: Can't get state to change to load ram patch err [ 808.448692][ T945] Bluetooth: Loading patch file failed [ 808.448720][ T945] ath3k 3-1:0.0: probe with driver ath3k failed with error -32 [ 808.501581][ T29] usb 2-1: New USB device found: idVendor=04d8, idProduct=f002, bcdDevice=0.00 [ 808.503202][ T29] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 808.503261][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 808.503276][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 808.503317][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 808.525915][ T8187] usb 3-1: USB disconnect, device number 103 [ 808.571363][ T29] usb 2-1: config 0 descriptor?? [ 808.692580][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.692617][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.877036][ T8185] logitech-hidpp-device 0003:046D:C082.001E: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 809.070607][ T29] hid-picolcd 0003:04D8:F002.001F: item fetching failed at offset 3/5 [ 809.070987][ T29] hid-picolcd 0003:04D8:F002.001F: device report parse failed [ 809.071044][ T29] hid-picolcd 0003:04D8:F002.001F: probe with driver hid-picolcd failed with error -22 [ 809.273072][T15063] fido_id[15063]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 810.088986][ T8185] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 810.152565][ T8187] usb 2-1: USB disconnect, device number 110 [ 810.252094][ T8185] usb 3-1: New USB device found: idVendor=046d, idProduct=0825, bcdDevice=1.00 [ 810.253024][ T8185] usb 3-1: config index 0 descriptor too short (expected 4257, got 161) [ 810.253070][ T8185] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 810.253104][ T8185] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 810.528793][T15076] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2765'. [ 811.559531][ T29] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 811.718955][ T29] usb 4-1: Using ep0 maxpacket: 16 [ 811.720545][ T29] usb 4-1: New USB device found: idVendor=1d6b, idProduct=0101, bcdDevice=0.40 [ 811.725631][ T29] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 811.725660][ T29] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 811.772434][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.772458][ T29] usb 4-1: Product: syz [ 811.772468][ T29] usb 4-1: Manufacturer: syz [ 811.772480][ T29] usb 4-1: SerialNumber: syz [ 811.845262][ T29] usb 4-1: 0:2 : does not exist [ 812.114319][T15103] No such timeout policy "syz1" [ 812.501732][T15105] tipc: Enabled bearer , priority 0 [ 812.531293][T15105] syzkaller0: entered promiscuous mode [ 812.531315][T15105] syzkaller0: entered allmulticast mode [ 812.630051][T15107] netlink: 112 bytes leftover after parsing attributes in process `syz.1.2773'. [ 812.712140][ T29] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 812.816028][ T8185] usb 3-1: string descriptor 0 read error: -71 [ 812.844244][ T29] usb 4-1: USB disconnect, device number 102 [ 812.893541][ T8185] uvcvideo 3-1:1.1: Unknown video format 32595559-0008-0010-8000-00aa00389b71 [ 812.893600][ T8185] uvcvideo 3-1:1.0: Found UVC 1.00 device (046d:0825) [ 812.893642][ T8185] uvcvideo 3-1:1.1: No supported video formats found. [ 812.893650][ T8185] uvcvideo 3-1:1.1: Failed to initialize the device (-22). [ 812.978567][ T8185] uvcvideo 3-1:1.0: probe with driver uvcvideo failed with error -22 [ 813.036982][T15105] tipc: Resetting bearer [ 813.053718][ T8185] usb 3-1: USB disconnect, device number 104 [ 813.086192][T15104] tipc: Resetting bearer [ 813.115961][T10556] udevd[10556]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 813.254815][T15114] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 813.303767][T15104] tipc: Disabling bearer [ 813.332367][T15112] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2775'. [ 813.332392][T15112] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2775'. [ 813.549997][T15112] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2775'. [ 813.550024][T15112] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2775'. [ 813.759032][ T29] usb 3-1: new full-speed USB device number 105 using dummy_hcd [ 814.069416][T15126] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 814.534896][ T30] audit: type=1326 audit(1793119058.896:3538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15143 comm="syz.1.2787" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b4f9f559 code=0x7ffc0000 [ 814.534931][ T30] audit: type=1326 audit(1793119058.896:3539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15143 comm="syz.1.2787" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b4f9f559 code=0x7ffc0000 [ 814.535652][ T30] audit: type=1326 audit(1793119058.896:3540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15143 comm="syz.1.2787" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f05b4f9f559 code=0x7ffc0000 [ 814.535846][ T30] audit: type=1326 audit(1793119058.896:3541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15143 comm="syz.1.2787" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b4f9f559 code=0x7ffc0000 [ 814.536623][ T30] audit: type=1326 audit(1793119058.896:3542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15143 comm="syz.1.2787" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05b4f9f559 code=0x7ffc0000 [ 814.675069][ T30] audit: type=1326 audit(1793119059.036:3543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15143 comm="syz.1.2787" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f05b4f9f559 code=0x7ffc0000 [ 814.973339][ T30] audit: type=1326 audit(1793119059.336:3544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15138 comm="syz.2.2785" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 814.975118][ T30] audit: type=1326 audit(1793119059.336:3545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15138 comm="syz.2.2785" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 815.045750][ T30] audit: type=1326 audit(1793119059.406:3546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15138 comm="syz.2.2785" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=450 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 815.045815][ T30] audit: type=1326 audit(1793119059.406:3547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15138 comm="syz.2.2785" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe814f9f559 code=0x7ffc0000 [ 815.559083][T15150] sctp: [Deprecated]: syz.1.2787 (pid 15150) Use of struct sctp_assoc_value in delayed_ack socket option. [ 815.559083][T15150] Use struct sctp_sack_info instead [ 815.669464][T15158] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 815.669713][T15158] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 816.518982][ T29] usb 2-1: new full-speed USB device number 111 using dummy_hcd [ 816.671939][ T29] usb 2-1: New USB device found: idVendor=04d8, idProduct=f002, bcdDevice=0.00 [ 816.672891][ T29] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 816.672921][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 816.672935][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 816.672956][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 816.700446][ T29] usb 2-1: config 0 descriptor?? [ 817.171550][ T29] hid-picolcd 0003:04D8:F002.0020: item fetching failed at offset 3/5 [ 817.172250][ T29] hid-picolcd 0003:04D8:F002.0020: device report parse failed [ 817.200726][ T29] hid-picolcd 0003:04D8:F002.0020: probe with driver hid-picolcd failed with error -22 [ 817.595419][T15181] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 817.903433][ T5726] usb 2-1: USB disconnect, device number 111 [ 818.417161][T15196] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2801'. [ 818.536962][T15198] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2801'. [ 820.161693][T15221] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 821.015781][ T29] usb 3-1: new full-speed USB device number 106 using dummy_hcd [ 822.003762][T15237] fuse: fd is not a fuse device [ 822.335013][T15241] netlink: 'syz.0.2815': attribute type 7 has an invalid length. [ 823.999191][ T8187] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 824.149917][ T8187] usb 4-1: New USB device found: idVendor=04d8, idProduct=0082, bcdDevice=1.00 [ 824.151045][ T8187] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 824.151081][ T8187] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 824.151125][ T8187] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 824.151167][ T8187] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 824.222112][ T8187] ims_pcu 4-1:1.0: Missing CDC union descriptor [ 824.222166][ T8187] ims_pcu 4-1:1.0: probe with driver ims_pcu failed with error -22 [ 824.254131][T15272] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2825'. [ 824.481903][ T8187] usb 4-1: USB disconnect, device number 103 [ 824.584768][T15278] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2827'. [ 824.790824][T15281] fuse: fd is not a fuse device [ 824.849487][ T8185] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 825.013360][ T8185] usb 3-1: New USB device found: idVendor=0a46, idProduct=0269, bcdDevice=d8.46 [ 825.014473][ T8185] usb 3-1: config 1 has an invalid interface number: 69 but max is 0 [ 825.014501][ T8185] usb 3-1: config 1 has no interface number 0 [ 825.014530][ T8185] usb 3-1: config 1 interface 69 has no altsetting 0 [ 825.050562][ T8185] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 825.050578][ T8185] usb 3-1: Product: syz [ 825.050587][ T8185] usb 3-1: Manufacturer: syz [ 825.050595][ T8185] usb 3-1: SerialNumber: syz [ 825.191178][T15284] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2830'. [ 825.325587][ T8185] dm9601 3-1:1.69: probe with driver dm9601 failed with error -22 [ 825.339989][ T8185] usb 3-1: USB disconnect, device number 107 [ 825.516622][T15288] fuse: fd is not a fuse device [ 825.522880][ T8187] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 825.668099][T15291] openvswitch: netlink: Actions may not be safe on all matching packets [ 825.679763][ T8187] usb 4-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 825.680929][ T8187] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 825.680956][ T8187] usb 4-1: config 0 has no interface number 0 [ 825.687677][ T8187] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 825.687694][ T8187] usb 4-1: Product: syz [ 825.687703][ T8187] usb 4-1: Manufacturer: syz [ 825.687711][ T8187] usb 4-1: SerialNumber: syz [ 825.738049][ T8187] usb 4-1: config 0 descriptor?? [ 825.973948][ T8187] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 825.998705][ T8187] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 826.011327][ T8187] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 826.011362][ T8187] usb 4-1: media controller created [ 826.070586][ T8187] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 826.189092][ T29] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 826.249148][T15297] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 826.251564][T15297] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 826.324506][T15297] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2831'. [ 826.345023][ T29] usb 2-1: New USB device found: idVendor=03f0, idProduct=0004, bcdDevice=0.40 [ 826.349137][ T29] usb 2-1: config 1 interface 0 altsetting 4 bulk endpoint 0x1 has invalid maxpacket 32 [ 826.349158][ T29] usb 2-1: config 1 interface 0 has no altsetting 0 [ 826.395063][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 826.395093][ T29] usb 2-1: Product: syz [ 826.395108][ T29] usb 2-1: Manufacturer: syz [ 826.395122][ T29] usb 2-1: SerialNumber: syz [ 826.411544][T15293] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 826.673748][ T29] usb 2-1: USB disconnect, device number 112 [ 826.815928][T15304] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2837'. [ 827.045996][T15309] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2840'. [ 827.113752][T15311] x_tables: ip6_tables: TCPOPTSTRIP target: only valid for protocol 6 [ 827.164512][T15314] syzkaller0: left promiscuous mode [ 827.164536][T15314] syz_tun: left promiscuous mode [ 827.164816][T15314] syzkaller0: left allmulticast mode [ 827.164831][T15314] syz_tun: left allmulticast mode [ 827.436822][T15322] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2842'. [ 827.501887][ T8187] usb 4-1: USB disconnect, device number 104 [ 828.085016][T15338] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2848'. [ 828.439009][ T8187] usb 2-1: new full-speed USB device number 113 using dummy_hcd [ 828.534844][T15346] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 828.588423][T15350] fuse: Unknown parameter 'Ë-NKr6v;Dyf-ES%idX|gBxdd@MkE;-FPE&12|lJx|s' [ 828.739053][ T8185] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 828.780878][T15356] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2854'. [ 828.906730][ T8185] usb 4-1: New USB device found: idVendor=0711, idProduct=0900, bcdDevice=1.00 [ 828.908124][ T8185] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 828.908151][ T8185] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 828.942008][ T8185] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 828.942035][ T8185] usb 4-1: Product: syz [ 828.942048][ T8185] usb 4-1: Manufacturer: syz [ 828.942060][ T8185] usb 4-1: SerialNumber: syz [ 829.168937][ T8185] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 105 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 829.421739][T15367] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2859'. [ 829.421791][T15367] netlink: get zone limit has 4 unknown bytes [ 829.542594][T15378] gtp9: entered allmulticast mode [ 829.585243][T15375] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2861'. [ 829.585385][T15375] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2861'. [ 829.585498][T15375] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2861'. [ 829.585574][T15375] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2861'. [ 829.585647][T15375] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2861'. [ 829.585724][T15375] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2861'. [ 829.585800][T15375] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2861'. [ 829.585887][T15375] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2861'. [ 829.585961][T15375] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2861'. [ 829.821285][ T945] usb 4-1: USB disconnect, device number 105 [ 829.847284][ T945] usblp0: removed [ 830.763947][T15394] kvm: vcpu 1: requested lapic timer restore with starting count register 0x390=3835797286 (7671594572 ns) > initial count (4918772610 ns). Using initial count to start timer. [ 830.766255][T15394] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 830.766500][T15394] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 831.075585][T15401] vlan0: left promiscuous mode [ 831.076119][T15401] batman_adv: batadv0: Interface deactivated: macsec1 [ 831.097136][T15401] syzkaller0: left promiscuous mode [ 831.097164][T15401] syzkaller0: left allmulticast mode [ 831.097746][T15401] ipip0: left promiscuous mode [ 831.097756][T15401] ipip0: left allmulticast mode [ 831.098223][T15401] gtp0: left allmulticast mode [ 831.193313][T15401] gtp1: left allmulticast mode [ 831.242289][T15401] geneve2: left promiscuous mode [ 831.242307][T15401] geneve2: left allmulticast mode [ 831.314223][T15407] netlink: 'syz.3.2867': attribute type 13 has an invalid length. [ 831.344678][T15401] gtp2: left allmulticast mode [ 831.363000][T15401] gtp3: left allmulticast mode [ 831.379197][ T62] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 256 - 0 [ 831.379362][ T62] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 256 - 0 [ 831.379429][ T62] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 256 - 0 [ 831.379486][ T62] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 256 - 0 [ 831.759235][ T9] usb 2-1: new full-speed USB device number 114 using dummy_hcd [ 831.910793][ T9] usb 2-1: New USB device found: idVendor=04d8, idProduct=f002, bcdDevice=0.00 [ 831.911942][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 831.911971][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 831.911986][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 831.912007][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 831.940663][ T9] usb 2-1: config 0 descriptor?? [ 832.393569][ T9] hid-picolcd 0003:04D8:F002.0021: item fetching failed at offset 3/5 [ 832.394041][ T9] hid-picolcd 0003:04D8:F002.0021: device report parse failed [ 832.394103][ T9] hid-picolcd 0003:04D8:F002.0021: probe with driver hid-picolcd failed with error -22 [ 832.444695][ T9] usb 5-1: USB disconnect, device number 32 [ 832.545011][T15421] syzkaller0: entered promiscuous mode [ 832.748585][ T9] usb 2-1: USB disconnect, device number 114 [ 833.008721][ T4951] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 833.019650][ T4951] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 833.034656][ T4951] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 833.046418][ T4951] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 833.046972][ T4951] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 833.098630][ T5632] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 833.099173][ T5632] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 833.115637][ T5632] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 833.120143][ T5632] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 833.122273][ T5632] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 833.989885][T15441] syzkaller0: entered allmulticast mode [ 834.006844][T15448] FAULT_INJECTION: forcing a failure. [ 834.006844][T15448] name failslab, interval 1, probability 0, space 0, times 0 [ 834.006881][T15448] CPU: 0 UID: 0 PID: 15448 Comm: syz.0.2877 Tainted: G L syzkaller #0 PREEMPT(full) [ 834.006908][T15448] Tainted: [L]=SOFTLOCKUP [ 834.006915][T15448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 834.006928][T15448] Call Trace: [ 834.006935][T15448] [ 834.006945][T15448] dump_stack_lvl+0xe8/0x150 [ 834.006982][T15448] should_fail_ex+0x410/0x560 [ 834.007014][T15448] should_failslab+0xa8/0x100 [ 834.007041][T15448] ? skb_ext_add+0x148/0x8e0 [ 834.007063][T15448] kmem_cache_alloc_noprof+0x9c/0x600 [ 834.007087][T15448] ? skb_ext_add+0x148/0x8e0 [ 834.007113][T15448] skb_ext_add+0x148/0x8e0 [ 834.007134][T15448] ? ah_esp_conn_in_get+0x132/0x1c0 [ 834.007162][T15448] secpath_set+0x58/0x1d0 [ 834.007189][T15448] xfrm_input+0x7bf/0x7600 [ 834.007214][T15448] ? lock_acquire+0x115/0x350 [ 834.007259][T15448] vti_input+0x21f/0x330 [ 834.007286][T15448] ? __pfx_vti_input+0x10/0x10 [ 834.007314][T15448] ? raw_local_deliver+0x345/0x1010 [ 834.007350][T15448] xfrm4_esp_rcv+0xa9/0x220 [ 834.007386][T15448] ? __pfx_xfrm4_esp_rcv+0x10/0x10 [ 834.007411][T15448] ip_protocol_deliver_rcu+0x2dc/0x440 [ 834.007439][T15448] ? ip_local_deliver_finish+0x2ae/0x6f0 [ 834.007466][T15448] ip_local_deliver_finish+0x3bb/0x6f0 [ 834.007500][T15448] NF_HOOK+0x336/0x3c0 [ 834.007525][T15448] ? __pfx_ipt_do_table+0x10/0x10 [ 834.007548][T15448] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 834.007572][T15448] ? NF_HOOK+0x9e/0x3c0 [ 834.007596][T15448] ? __pfx_NF_HOOK+0x10/0x10 [ 834.007623][T15448] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 834.007655][T15448] ? ip_local_deliver+0x113/0x190 [ 834.007682][T15448] NF_HOOK+0x336/0x3c0 [ 834.007708][T15448] ? __pfx_ip_rcv_finish+0x10/0x10 [ 834.007732][T15448] ? NF_HOOK+0x9e/0x3c0 [ 834.007756][T15448] ? __pfx_NF_HOOK+0x10/0x10 [ 834.007782][T15448] ? __pfx_ip_rcv_finish+0x10/0x10 [ 834.007814][T15448] ? netif_receive_skb+0x102/0xbf0 [ 834.007839][T15448] ? __pfx_ip_rcv+0x10/0x10 [ 834.007862][T15448] netif_receive_skb+0x45b/0xbf0 [ 834.007892][T15448] ? __pfx_netif_receive_skb+0x10/0x10 [ 834.007922][T15448] ? rcu_is_watching+0x16/0xb0 [ 834.007949][T15448] ? tun_rx_batched+0x185/0x790 [ 834.007975][T15448] tun_rx_batched+0x1de/0x790 [ 834.008004][T15448] ? __pfx_tun_rx_batched+0x10/0x10 [ 834.008028][T15448] ? lock_acquire+0x115/0x350 [ 834.008059][T15448] ? tun_get_user+0x1db7/0x4470 [ 834.008080][T15448] ? __local_bh_enable_ip+0xd6/0x140 [ 834.008112][T15448] tun_get_user+0x2b78/0x4470 [ 834.008143][T15448] ? tun_get_user+0x275c/0x4470 [ 834.008177][T15448] ? aa_file_perm+0x4ed/0x15f0 [ 834.008201][T15448] ? __pfx_tun_get_user+0x10/0x10 [ 834.008226][T15448] ? __lock_acquire+0x747/0x2de0 [ 834.008265][T15448] ? ref_tracker_alloc+0x172/0x530 [ 834.008295][T15448] ? lock_acquire+0x115/0x350 [ 834.008319][T15448] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 834.008350][T15448] ? lock_acquire+0x115/0x350 [ 834.008379][T15448] ? tun_get+0x1c/0x2f0 [ 834.008408][T15448] ? tun_get+0x1c/0x2f0 [ 834.008429][T15448] ? tun_get+0x1c/0x2f0 [ 834.008456][T15448] tun_chr_write_iter+0x113/0x200 [ 834.008482][T15448] vfs_write+0x612/0xba0 [ 834.008513][T15448] ? __pfx_vfs_write+0x10/0x10 [ 834.008538][T15448] ? __fget_files+0x3a2/0x420 [ 834.008557][T15448] ? __fget_files+0x2a/0x420 [ 834.008581][T15448] ? fdget+0x1ac/0x250 [ 834.008607][T15448] ksys_write+0x150/0x270 [ 834.008631][T15448] ? __pfx_ksys_write+0x10/0x10 [ 834.008665][T15448] do_syscall_64+0x166/0x520 [ 834.008687][T15448] ? trace_irq_disable+0x3b/0x140 [ 834.008712][T15448] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 834.008732][T15448] ? clear_bhb_loop+0x70/0xc0 [ 834.008757][T15448] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 834.008776][T15448] RIP: 0033:0x7fc64695fd8e [ 834.008794][T15448] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 834.008811][T15448] RSP: 002b:00007fc647915fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 834.008833][T15448] RAX: ffffffffffffffda RBX: 00007fc6479166c0 RCX: 00007fc64695fd8e [ 834.008847][T15448] RDX: 0000000000000074 RSI: 0000200000002540 RDI: 00000000000000c8 [ 834.008861][T15448] RBP: 00007fc647916090 R08: 0000000000000000 R09: 0000000000000000 [ 834.008873][T15448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 834.008884][T15448] R13: 00007fc646c26038 R14: 00007fc646c25fa0 R15: 00007fc646d4fa48 [ 834.008916][T15448] [ 834.491835][ T9449] bridge_slave_1: left allmulticast mode [ 834.491879][ T9449] bridge_slave_1: left promiscuous mode [ 834.494111][ T9449] bridge0: port 2(bridge_slave_1) entered disabled state [ 834.528079][ T9449] bridge_slave_0: left allmulticast mode [ 834.528101][ T9449] bridge_slave_0: left promiscuous mode [ 834.528288][ T9449] bridge0: port 1(bridge_slave_0) entered disabled state [ 835.008020][ T9449] bond2 (unregistering): (slave erspan1): Releasing active interface [ 835.179061][ T5632] Bluetooth: hci5: command tx timeout [ 835.272613][ T9449] bond3 (unregistering): (slave geneve2): Releasing active interface [ 835.364231][ T9449] team0: Port device bridge1 removed [ 835.411264][ T9449] bond4 (unregistering): (slave bridge3): Releasing backup interface [ 835.445254][ T9449] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 835.480057][ T9449] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 835.481638][ T9449] bond0 (unregistering): Released all slaves [ 835.522532][ T9449] bond1 (unregistering): (slave lo): Releasing backup interface [ 835.524034][ T9449] bond1 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 835.528056][ T9449] bond1 (unregistering): Released all slaves [ 835.588444][ T9449] bond2 (unregistering): Released all slaves [ 835.635581][ T9449] bond3 (unregistering): Released all slaves [ 835.678750][ T9449] bond4 (unregistering): Released all slaves [ 835.754519][T15441] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 835.754887][T15441] syzkaller1: linktype set to 823 [ 836.003313][ T9449] tipc: Left network mode [ 836.830699][ T945] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 836.984421][ T945] usb 3-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 837.037726][ T945] usb 3-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 837.037752][ T945] usb 3-1: config 0 interface 0 altsetting 255 bulk endpoint 0x8F has invalid maxpacket 61 [ 837.037766][ T945] usb 3-1: config 0 interface 0 has no altsetting 0 [ 837.052824][ T945] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 837.052852][ T945] usb 3-1: Product: syz [ 837.052867][ T945] usb 3-1: Manufacturer: syz [ 837.052887][ T945] usb 3-1: SerialNumber: syz [ 837.087083][ T945] usb 3-1: config 0 descriptor?? [ 837.087877][T15472] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 837.122416][T15477] gtp10: entered allmulticast mode [ 837.123009][ T945] usb 3-1: selecting invalid altsetting 0 [ 837.259459][ T5632] Bluetooth: hci5: command tx timeout [ 837.986845][T15430] bridge0: port 1(bridge_slave_0) entered blocking state [ 837.986908][T15430] bridge0: port 1(bridge_slave_0) entered disabled state [ 837.987027][T15430] bridge_slave_0: entered allmulticast mode [ 837.987947][T15430] bridge_slave_0: entered promiscuous mode [ 837.999617][T15430] bridge0: port 2(bridge_slave_1) entered blocking state [ 837.999730][T15430] bridge0: port 2(bridge_slave_1) entered disabled state [ 837.999929][T15430] bridge_slave_1: entered allmulticast mode [ 838.006451][T15430] bridge_slave_1: entered promiscuous mode [ 838.152925][T15492] netlink: 'syz.3.2887': attribute type 1 has an invalid length. [ 838.261198][T15497] __nla_validate_parse: 59 callbacks suppressed [ 838.261212][T15497] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2887'. [ 838.475031][T15493] 8021q: adding VLAN 0 to HW filter on device bond7 [ 838.566823][T15493] bond6: (slave bond7): making interface the new active one [ 838.579698][T15493] bond6: (slave bond7): Enslaving as an active interface with an up link [ 838.639263][T15430] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 838.657892][T15430] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 838.728988][ T5726] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 838.780750][T15499] bond6: (slave gretap1): Enslaving as a backup interface with an up link [ 838.782335][ T9449] hsr_slave_0: left promiscuous mode [ 838.785225][ T9449] hsr_slave_1: left promiscuous mode [ 838.787084][ T9449] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 838.787117][ T9449] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 838.879176][ T5726] usb 4-1: Using ep0 maxpacket: 8 [ 838.880983][ T5726] usb 4-1: unable to get BOS descriptor or descriptor too short [ 838.881020][ T5726] usb 4-1: New USB device found: idVendor=03fd, idProduct=ebbe, bcdDevice=38.c2 [ 838.886178][ T5726] usb 4-1: config 28 has an invalid descriptor of length 0, skipping remainder of the config [ 838.887841][ T5726] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 838.887858][ T5726] usb 4-1: Product: syz [ 838.887866][ T5726] usb 4-1: Manufacturer: syz [ 838.887874][ T5726] usb 4-1: SerialNumber: syz [ 839.329601][ T5632] Bluetooth: hci5: command tx timeout [ 839.385297][ T5726] usb 4-1: USB disconnect, device number 106 [ 839.504228][ T9449] team0 (unregistering): Port device team_slave_1 removed [ 839.533615][ T9449] team0 (unregistering): Port device team_slave_0 removed [ 840.058549][T15430] team0: Port device team_slave_0 added [ 840.082660][T15430] team0: Port device team_slave_1 added [ 840.158523][ T5726] usb 3-1: USB disconnect, device number 108 [ 840.189223][T15430] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 840.189242][T15430] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 840.189268][T15430] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 840.192878][T15430] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 840.192896][T15430] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 840.192921][T15430] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 840.659486][T15430] hsr_slave_0: entered promiscuous mode [ 840.672608][T15430] hsr_slave_1: entered promiscuous mode [ 840.697977][T15430] debugfs: 'hsr0' already exists in 'hsr' [ 840.697996][T15430] Cannot create hsr debugfs directory [ 840.921143][ T5726] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 841.074376][ T5726] usb 3-1: Using ep0 maxpacket: 8 [ 841.079979][ T5726] usb 3-1: New USB device found: idVendor=046d, idProduct=c623, bcdDevice=0.00 [ 841.087887][ T5726] usb 3-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 841.087921][ T5726] usb 3-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 841.087943][ T5726] usb 3-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 841.087968][ T5726] usb 3-1: config 0 interface 0 has no altsetting 0 [ 841.088001][ T5726] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 841.153421][ T9449] IPVS: stop unused estimator thread 0... [ 841.174594][ T5726] usb 3-1: config 0 descriptor?? [ 841.409049][ T5632] Bluetooth: hci5: command tx timeout [ 841.545841][T15529] netlink: 'syz.2.2895': attribute type 9 has an invalid length. [ 841.545887][T15529] netlink: 134780 bytes leftover after parsing attributes in process `syz.2.2895'. [ 841.773758][T15522] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2892'. [ 842.345802][T15430] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 842.370320][T15430] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 842.371175][T15430] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 842.378232][T15430] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 842.431617][ T5726] usbhid 3-1:0.0: can't add hid device: -71 [ 842.431727][ T5726] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 842.469287][T15430] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 842.476608][ T5726] usb 3-1: USB disconnect, device number 109 [ 842.541589][T15430] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 842.544610][T15430] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 842.604070][T15430] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 842.605415][T15535] tun0: tun_chr_ioctl cmd 1074025677 [ 842.605497][T15535] tun0: linktype set to 769 [ 842.725137][T15547] fuse: fd is not a fuse device [ 843.236313][T15430] 8021q: adding VLAN 0 to HW filter on device bond0 [ 843.353440][T15430] 8021q: adding VLAN 0 to HW filter on device team0 [ 843.386129][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 843.386191][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 843.417940][T15433] bridge0: port 2(bridge_slave_1) entered blocking state [ 843.418005][T15433] bridge0: port 2(bridge_slave_1) entered forwarding state [ 843.492549][T15550] netlink: 'syz.1.2898': attribute type 4 has an invalid length. [ 843.492565][T15550] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2898'. [ 843.517062][T15550] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 843.870253][T15430] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 844.098147][T15430] veth0_vlan: entered promiscuous mode [ 844.156875][T15430] veth1_vlan: entered promiscuous mode [ 844.471888][T15430] veth0_macvtap: entered promiscuous mode [ 844.488767][T15558] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2902'. [ 844.556271][T15558] syzkaller1: entered promiscuous mode [ 844.556299][T15558] syzkaller1: entered allmulticast mode [ 844.580482][T15430] veth1_macvtap: entered promiscuous mode [ 844.721077][T15560] gtp2: entered allmulticast mode [ 844.744139][T15430] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 844.767674][T15430] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 844.889796][T15434] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 844.889832][T15434] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 844.889853][T15434] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 844.889873][T15434] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 845.161519][T15433] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 845.161543][T15433] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 845.528439][T15434] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 845.528461][T15434] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 845.671877][T15574] syzkaller0: left promiscuous mode [ 845.671896][T15574] syzkaller0: left allmulticast mode [ 845.937020][T15586] FAULT_INJECTION: forcing a failure. [ 845.937020][T15586] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 845.937052][T15586] CPU: 0 UID: 0 PID: 15586 Comm: syz.2.2910 Tainted: G L syzkaller #0 PREEMPT(full) [ 845.937069][T15586] Tainted: [L]=SOFTLOCKUP [ 845.937073][T15586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 845.937081][T15586] Call Trace: [ 845.937087][T15586] [ 845.937092][T15586] dump_stack_lvl+0xe8/0x150 [ 845.937118][T15586] should_fail_ex+0x410/0x560 [ 845.937136][T15586] _copy_to_iter+0x404/0x1810 [ 845.937159][T15586] ? __pfx__copy_to_iter+0x10/0x10 [ 845.937174][T15586] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 845.937187][T15586] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 845.937200][T15586] __skb_datagram_iter+0xf8/0x980 [ 845.937216][T15586] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 845.937232][T15586] skb_copy_datagram_iter+0xb5/0x240 [ 845.937247][T15586] netlink_recvmsg+0x2c8/0xa70 [ 845.937268][T15586] ? __pfx_netlink_recvmsg+0x10/0x10 [ 845.937290][T15586] ? __lock_acquire+0x747/0x2de0 [ 845.937307][T15586] ? __pfx_netlink_recvmsg+0x10/0x10 [ 845.937322][T15586] sock_recvmsg_nosec+0x130/0x170 [ 845.937338][T15586] ____sys_recvmsg+0x466/0x530 [ 845.937355][T15586] ? __pfx_____sys_recvmsg+0x10/0x10 [ 845.937374][T15586] ? import_iovec+0x73/0xa0 [ 845.937390][T15586] ___sys_recvmsg+0x213/0x5a0 [ 845.937405][T15586] ? __pfx____sys_recvmsg+0x10/0x10 [ 845.937418][T15586] ? lock_acquire+0x115/0x350 [ 845.937459][T15586] do_recvmmsg+0x31a/0x800 [ 845.937480][T15586] ? __pfx_do_recvmmsg+0x10/0x10 [ 845.937498][T15586] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 845.937513][T15586] ? fdget+0x1ac/0x250 [ 845.937529][T15586] __x64_sys_recvmmsg+0x198/0x250 [ 845.937542][T15586] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 845.937560][T15586] do_syscall_64+0x166/0x520 [ 845.937573][T15586] ? trace_irq_disable+0x3b/0x140 [ 845.937587][T15586] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.937599][T15586] ? clear_bhb_loop+0x70/0xc0 [ 845.937612][T15586] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.937623][T15586] RIP: 0033:0x7fe814f9f559 [ 845.937635][T15586] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 845.937645][T15586] RSP: 002b:00007fe815e66028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 845.937657][T15586] RAX: ffffffffffffffda RBX: 00007fe815225fa0 RCX: 00007fe814f9f559 [ 845.937665][T15586] RDX: 0000000000000004 RSI: 00002000000005c0 RDI: 0000000000000003 [ 845.937672][T15586] RBP: 00007fe815e66090 R08: 0000000000000000 R09: 0000000000000000 [ 845.937679][T15586] R10: 0000000040010000 R11: 0000000000000246 R12: 0000000000000002 [ 845.937686][T15586] R13: 00007fe815226038 R14: 00007fe815225fa0 R15: 00007fe81534fa48 [ 845.937704][T15586] [ 846.335719][T15588] netlink: 'syz.1.2911': attribute type 1 has an invalid length. [ 846.458550][T15594] netlink: 'syz.4.2913': attribute type 3 has an invalid length. [ 846.458567][T15594] netlink: 666 bytes leftover after parsing attributes in process `syz.4.2913'. [ 846.760968][ T4951] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 846.776561][ T4951] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 846.789068][ T4951] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 846.799646][ T4951] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 846.811346][ T4951] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 847.961837][T15600] bridge0: port 1(bridge_slave_0) entered blocking state [ 847.962222][T15600] bridge0: port 1(bridge_slave_0) entered disabled state [ 847.962372][T15600] bridge_slave_0: entered allmulticast mode [ 847.964684][T15600] bridge_slave_0: entered promiscuous mode [ 847.996968][T15600] bridge0: port 2(bridge_slave_1) entered blocking state [ 848.000384][T15600] bridge0: port 2(bridge_slave_1) entered disabled state [ 848.000563][T15600] bridge_slave_1: entered allmulticast mode [ 848.005198][T15628] openvswitch: netlink: ufid size 24 bytes exceeds the range (1, 16) [ 848.031068][T15600] bridge_slave_1: entered promiscuous mode [ 848.241988][T15600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 848.260392][T15600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 848.545033][T15600] team0: Port device team_slave_0 added [ 848.580730][T15600] team0: Port device team_slave_1 added [ 848.721358][T15600] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 848.721378][T15600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 848.721401][T15600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 848.849192][ T4951] Bluetooth: hci1: command tx timeout [ 848.858083][T15600] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 848.858099][T15600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 848.858125][T15600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 848.920583][T15634] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 848.920604][T15634] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 849.299736][T15634] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 849.299760][T15634] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 849.323962][ T29] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 849.469388][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 849.470113][ T29] usb 2-1: New USB device found: idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 849.470154][ T29] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 849.471649][ T29] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 849.471671][ T29] usb 2-1: can't read configurations, error -61 [ 849.599647][ T29] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 849.631521][T15600] hsr_slave_0: entered promiscuous mode [ 849.634731][T15600] hsr_slave_1: entered promiscuous mode [ 849.655957][T15600] debugfs: 'hsr0' already exists in 'hsr' [ 849.655985][T15600] Cannot create hsr debugfs directory [ 849.699005][ T5726] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 849.749788][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 849.750627][ T29] usb 2-1: New USB device found: idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 849.750689][ T29] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 849.752697][ T29] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 849.752732][ T29] usb 2-1: can't read configurations, error -61 [ 849.753309][ T29] usb usb2-port1: attempt power cycle [ 849.805978][ T945] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 849.949490][ T945] usb 3-1: Using ep0 maxpacket: 8 [ 849.950423][ T945] usb 3-1: New USB device found: idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 849.956630][ T945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 849.956659][ T945] usb 3-1: Product: syz [ 849.956674][ T945] usb 3-1: Manufacturer: syz [ 849.956688][ T945] usb 3-1: SerialNumber: syz [ 849.997416][ T945] usb 3-1: config 0 descriptor?? [ 850.018089][ T945] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 850.018157][ T945] pctv452e: pctv452e_power_ctrl: 1 [ 850.018157][ T945] [ 850.018201][ T945] usb 3-1: selecting invalid altsetting 3 [ 850.018216][ T945] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 850.018216][ T945] [ 850.018231][ T945] dvb-usb: bulk message failed: -22 (5/0) [ 850.064801][ T945] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 850.065427][ T945] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 850.065459][ T945] usb 3-1: media controller created [ 850.065485][ T945] dvb-usb: bulk message failed: -22 (8/0) [ 850.065493][ T945] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 850.065521][ T945] dvb-usb: MAC address reading failed. [ 850.114038][ T29] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 850.130654][ T945] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 850.132380][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 850.132921][ T29] usb 2-1: New USB device found: idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 850.132945][ T29] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 850.137583][ T29] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 850.137612][ T29] usb 2-1: can't read configurations, error -61 [ 850.259109][ T29] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 850.281935][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 850.286343][ T29] usb 2-1: New USB device found: idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 850.286408][ T29] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 850.320640][ T29] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 850.320680][ T29] usb 2-1: can't read configurations, error -61 [ 850.321003][ T29] usb usb2-port1: unable to enumerate USB device [ 850.373945][ T945] DVB: Unable to find symbol stb0899_attach() [ 850.373986][ T945] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 850.489002][ T945] rc_core: IR keymap rc-tt-1500 not found [ 850.489017][ T945] Registered IR keymap rc-empty [ 850.490571][ T945] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 850.493877][ T945] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input63 [ 850.497154][ T945] dvb-usb: schedule remote query interval to 100 msecs. [ 850.497180][ T945] pctv452e: pctv452e_power_ctrl: 0 [ 850.497180][ T945] [ 850.497192][ T945] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 850.599431][ T945] dvb-usb: bulk message failed: -22 (4/0) [ 850.599454][ T945] dvb-usb: error -22 while querying for an remote control event. [ 850.642427][ T8187] usb 3-1: USB disconnect, device number 110 [ 850.821542][ T8187] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 850.847422][T15666] gtp0: entered allmulticast mode [ 851.079732][ T50] pimreg: left allmulticast mode [ 852.037451][ T50] bond6 (unregistering): (slave gretap1): Releasing backup interface [ 852.536676][ T50] bond0 (unregistering): (slave team0): Releasing backup interface [ 852.567700][ T50] bond0 (unregistering): Released all slaves [ 852.601502][ T50] bond1 (unregistering): Released all slaves [ 852.684096][ T50] bond2 (unregistering): Released all slaves [ 852.740356][ T50] bond3 (unregistering): Released all slaves [ 852.793558][ T50] bond4 (unregistering): Released all slaves [ 852.844878][ T50] bond5 (unregistering): Released all slaves [ 852.883534][ T50] bond6 (unregistering): (slave bond7): Releasing backup interface [ 852.886048][ T50] bond6 (unregistering): Released all slaves [ 852.932922][ T50] bond7 (unregistering): Released all slaves [ 853.054411][T15708] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 853.110198][ T5295] 8021q: adding VLAN 0 to HW filter on device eth1 [ 854.442650][ T50] hsr_slave_0: left promiscuous mode [ 854.446666][ T50] hsr_slave_1: left promiscuous mode [ 854.559402][ T8185] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 854.711493][ T8185] usb 3-1: Using ep0 maxpacket: 8 [ 854.715258][ T8185] usb 3-1: New USB device found: idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 854.722185][ T8185] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.722213][ T8185] usb 3-1: Product: syz [ 854.722229][ T8185] usb 3-1: Manufacturer: syz [ 854.722243][ T8185] usb 3-1: SerialNumber: syz [ 854.740012][ T8185] usb 3-1: config 0 descriptor?? [ 854.799483][ T8185] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 854.799532][ T8185] pctv452e: pctv452e_power_ctrl: 1 [ 854.799532][ T8185] [ 854.799577][ T8185] usb 3-1: selecting invalid altsetting 3 [ 854.799592][ T8185] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 854.799592][ T8185] [ 854.799608][ T8185] dvb-usb: bulk message failed: -22 (5/0) [ 854.861905][ T8185] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 854.867251][ T8185] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 854.871584][ T8185] usb 3-1: media controller created [ 854.871646][ T8185] dvb-usb: bulk message failed: -22 (8/0) [ 854.871660][ T8185] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 854.871710][ T8185] dvb-usb: MAC address reading failed. [ 854.947748][ T8185] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 855.169269][ T8185] DVB: Unable to find symbol stb0899_attach() [ 855.169287][ T8185] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 855.280841][ T8185] rc_core: IR keymap rc-tt-1500 not found [ 855.280864][ T8185] Registered IR keymap rc-empty [ 855.282035][ T8185] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 855.294990][ T8185] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input64 [ 855.339686][ T8185] dvb-usb: schedule remote query interval to 100 msecs. [ 855.339710][ T8185] pctv452e: pctv452e_power_ctrl: 0 [ 855.339710][ T8185] [ 855.339721][ T8185] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 855.460910][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 855.460942][ T9] dvb-usb: error -22 while querying for an remote control event. [ 855.499355][ T5726] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 855.583923][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 855.583947][ T9] dvb-usb: error -22 while querying for an remote control event. [ 855.649148][ T5726] usb 2-1: Using ep0 maxpacket: 8 [ 855.653845][ T5726] usb 2-1: unable to get BOS descriptor or descriptor too short [ 855.653879][ T5726] usb 2-1: New USB device found: idVendor=083a, idProduct=f511, bcdDevice=3c.d4 [ 855.653900][ T5726] usb 2-1: too many configurations: 24, using maximum allowed: 8 [ 855.655991][ T5726] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 855.656013][ T5726] usb 2-1: can't read configurations, error -61 [ 855.698952][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 855.698991][ T9] dvb-usb: error -22 while querying for an remote control event. [ 855.780514][ T5726] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 855.798972][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 855.799005][ T9] dvb-usb: error -22 while querying for an remote control event. [ 855.909018][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 855.909054][ T9] dvb-usb: error -22 while querying for an remote control event. [ 855.932836][ T5726] usb 2-1: Using ep0 maxpacket: 8 [ 855.947357][ T5726] usb 2-1: unable to get BOS descriptor or descriptor too short [ 855.947393][ T5726] usb 2-1: New USB device found: idVendor=083a, idProduct=f511, bcdDevice=3c.d4 [ 855.947414][ T5726] usb 2-1: too many configurations: 24, using maximum allowed: 8 [ 855.976875][ T5726] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 855.976903][ T5726] usb 2-1: can't read configurations, error -61 [ 855.978725][ T5726] usb usb2-port1: attempt power cycle [ 856.019070][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 856.019133][ T9] dvb-usb: error -22 while querying for an remote control event. [ 856.129111][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 856.129146][ T9] dvb-usb: error -22 while querying for an remote control event. [ 856.239011][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 856.239045][ T9] dvb-usb: error -22 while querying for an remote control event. [ 856.338958][ T5726] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 856.361350][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 856.361382][ T9] dvb-usb: error -22 while querying for an remote control event. [ 856.361884][ T5726] usb 2-1: Using ep0 maxpacket: 8 [ 856.365003][ T5726] usb 2-1: unable to get BOS descriptor or descriptor too short [ 856.365055][ T5726] usb 2-1: New USB device found: idVendor=083a, idProduct=f511, bcdDevice=3c.d4 [ 856.365092][ T5726] usb 2-1: too many configurations: 24, using maximum allowed: 8 [ 856.366491][ T5726] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 856.366524][ T5726] usb 2-1: can't read configurations, error -61 [ 856.488986][ T5726] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 856.490035][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 856.490055][ T9] dvb-usb: error -22 while querying for an remote control event. [ 856.526259][ T5726] usb 2-1: Using ep0 maxpacket: 8 [ 856.536000][ T5726] usb 2-1: unable to get BOS descriptor or descriptor too short [ 856.536053][ T5726] usb 2-1: New USB device found: idVendor=083a, idProduct=f511, bcdDevice=3c.d4 [ 856.536088][ T5726] usb 2-1: too many configurations: 24, using maximum allowed: 8 [ 856.537585][ T5726] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 856.537637][ T5726] usb 2-1: can't read configurations, error -61 [ 856.538082][ T5726] usb usb2-port1: unable to enumerate USB device [ 856.585334][ T9] usb 3-1: USB disconnect, device number 111 [ 856.753695][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 856.753715][ T30] audit: type=1326 audit(1793119101.116:3555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15758 comm="syz.0.2944" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc64699f559 code=0x7ffc0000 [ 856.754481][ T30] audit: type=1326 audit(1793119101.116:3556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15758 comm="syz.0.2944" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc64699f559 code=0x7ffc0000 [ 856.839772][ T30] audit: type=1326 audit(1793119101.186:3557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15758 comm="syz.0.2944" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=206 compat=0 ip=0x7fc64699f559 code=0x7ffc0000 [ 856.839827][ T30] audit: type=1326 audit(1793119101.186:3558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15758 comm="syz.0.2944" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc64699f559 code=0x7ffc0000 [ 856.839871][ T30] audit: type=1326 audit(1793119101.186:3559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15758 comm="syz.0.2944" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc64699f559 code=0x7ffc0000 [ 856.839911][ T30] audit: type=1326 audit(1793119101.186:3560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15758 comm="syz.0.2944" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fc64699f559 code=0x7ffc0000 [ 856.839962][ T30] audit: type=1326 audit(1793119101.186:3561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15758 comm="syz.0.2944" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc64699f559 code=0x7ffc0000 [ 856.840004][ T30] audit: type=1326 audit(1793119101.186:3562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15758 comm="syz.0.2944" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc64699f559 code=0x7ffc0000 [ 856.840043][ T30] audit: type=1326 audit(1793119101.186:3563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15758 comm="syz.0.2944" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc64699f559 code=0x7ffc0000 [ 856.840083][ T30] audit: type=1326 audit(1793119101.186:3564): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15758 comm="syz.0.2944" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc64699f559 code=0x7ffc0000 [ 856.845474][T15760] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2944'. [ 856.861070][ T9] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 856.941986][T15760] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2944'. [ 857.058277][T15760] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2944'. [ 857.374099][ T50] IPVS: stop unused estimator thread 0... [ 857.573404][T15600] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 857.595132][T15600] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 857.595917][T15600] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 857.632705][T15600] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 857.633740][T15600] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 857.651561][T15600] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 857.655364][T15600] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 857.678340][T15600] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 857.939836][T15600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 857.983635][T15600] 8021q: adding VLAN 0 to HW filter on device team0 [ 858.013087][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 858.013152][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 858.068149][T15433] bridge0: port 2(bridge_slave_1) entered blocking state [ 858.068213][T15433] bridge0: port 2(bridge_slave_1) entered forwarding state [ 858.353185][T15600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 858.501528][T15600] veth0_vlan: entered promiscuous mode [ 858.532225][T15600] veth1_vlan: entered promiscuous mode [ 858.657447][T15600] veth0_macvtap: entered promiscuous mode [ 858.692317][T15600] veth1_macvtap: entered promiscuous mode [ 858.776695][T15600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 858.787536][T15808] fuse: fd is not a fuse device [ 858.805593][T15600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 858.899124][T15433] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 858.949680][ T9449] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 858.949733][ T9449] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 858.949770][ T9449] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.240274][ T8187] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 859.345499][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 859.345524][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 859.399078][ T8187] usb 2-1: Using ep0 maxpacket: 8 [ 859.404041][ T8187] usb 2-1: New USB device found: idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 859.405212][ T8187] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 859.405236][ T8187] usb 2-1: config 0 has no interface number 0 [ 859.405301][ T8187] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 859.405342][ T8187] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 859.433850][ T8187] usb 2-1: config 0 descriptor?? [ 859.520269][ T8187] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 859.621675][ T9449] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 859.621700][ T9449] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 860.599011][ T5366] usb 4-1: new full-speed USB device number 107 using dummy_hcd [ 860.749706][ T5366] usb 4-1: New USB device found: idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 860.751067][ T5366] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 860.754058][ T5366] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 860.754112][ T5366] usb 4-1: Product: syz [ 860.754128][ T5366] usb 4-1: Manufacturer: syz [ 860.754143][ T5366] usb 4-1: SerialNumber: syz [ 860.829568][ T5366] usb 4-1: config 0 descriptor?? [ 860.913272][ T5632] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 860.929268][ T5632] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 860.932096][ T5632] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 860.933108][ T5632] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 860.933687][ T5632] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 861.089762][T15832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 861.092794][T15832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 861.116972][ T5366] usb 4-1: USB disconnect, device number 107 [ 861.596401][ T5366] usb 2-1: USB disconnect, device number 123 [ 862.970395][T15862] gtp12: entered allmulticast mode [ 863.056626][T15852] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 863.057133][T15852] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 863.099013][ C0] ------------[ cut here ]------------ [ 863.099028][ C0] workqueue: cannot queue hci_cmd_timeout on wq hci3 [ 863.099065][ C0] WARNING: kernel/workqueue.c:2437 at __queue_work+0xdfc/0x1360, CPU#0: kworker/u8:1/15433 [ 863.121564][ C0] Modules linked in: [ 863.125471][ C0] CPU: 0 UID: 0 PID: 15433 Comm: kworker/u8:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 863.136659][ C0] Tainted: [L]=SOFTLOCKUP [ 863.140998][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 863.151048][ C0] Workqueue: bat_events batadv_dat_purge [ 863.156687][ C0] RIP: 0010:__queue_work+0xe1a/0x1360 [ 863.162061][ C0] Code: 28 78 01 00 00 4c 8d 35 74 0f 11 10 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 42 8c b0 00 49 8b 77 18 4c 89 f7 48 8b 54 24 28 <67> 48 0f b9 3a 4c 89 f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 [ 863.181678][ C0] RSP: 0018:ffffc90000007be8 EFLAGS: 00010046 [ 863.187737][ C0] RAX: 1ffff1100c5e194e RBX: dffffc0000000000 RCX: ffff888020fc3e80 [ 863.195705][ C0] RDX: ffff88803637e178 RSI: ffffffff8aee33b0 RDI: ffffffff919ffd90 [ 863.203697][ C0] RBP: 0000000000010000 R08: 0000000000000100 R09: 1ffffffff233a4f7 [ 863.211700][ C0] R10: dffffc0000000000 R11: ffffffff818ef750 R12: ffff88803637e1c0 [ 863.219713][ C0] R13: 0000000000000008 R14: ffffffff919ffd90 R15: ffff888062f0ca58 [ 863.227685][ C0] FS: 0000000000000000(0000) GS:ffff88812362d000(0000) knlGS:0000000000000000 [ 863.236646][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 863.243346][ C0] CR2: 00007fbb74c29ff8 CR3: 0000000060df4000 CR4: 00000000003526f0 [ 863.251367][ C0] Call Trace: [ 863.254662][ C0] [ 863.257502][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 863.262880][ C0] call_timer_fn+0x18d/0x5f0 [ 863.267479][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 863.273290][ C0] ? call_timer_fn+0xd5/0x5f0 [ 863.277986][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 863.283095][ C0] ? do_raw_spin_unlock+0xf5/0x200 [ 863.288200][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 863.294003][ C0] __run_timer_base+0x67e/0x8b0 [ 863.299120][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 863.304509][ C0] ? lapic_next_event+0x11/0x20 [ 863.309349][ C0] ? clockevents_program_event+0x491/0x630 [ 863.315154][ C0] run_timer_softirq+0xb7/0x170 [ 863.320008][ C0] handle_softirqs+0x265/0x8d0 [ 863.324783][ C0] __irq_exit_rcu+0xc6/0x220 [ 863.329367][ C0] irq_exit_rcu+0x9/0x30 [ 863.333601][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 863.339232][ C0] [ 863.342156][ C0] [ 863.345079][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 863.351075][ C0] RIP: 0010:__local_bh_enable_ip+0xdf/0x140 [ 863.356962][ C0] Code: e8 c6 cf 76 0a 65 66 8b 05 da da 35 13 66 85 c0 75 34 bf 01 00 00 00 e8 9f 63 0c 00 e8 9a 06 48 00 fb 65 48 8b 05 91 da 35 13 <48> 85 c0 75 05 e8 d7 0f aa ff 5b 41 5e e9 8f c4 79 0a cc 90 0f 0b [ 863.376558][ C0] RSP: 0018:ffffc9000651fa60 EFLAGS: 00000206 [ 863.382617][ C0] RAX: 8000000000000000 RBX: 0000000000000201 RCX: 0000000000000046 [ 863.390581][ C0] RDX: 0000000000000006 RSI: ffffffff8e69c891 RDI: ffffffff8c8e7180 [ 863.398568][ C0] RBP: dffffc0000000000 R08: ffffffff919d27bf R09: 1ffffffff233a4f7 [ 863.406547][ C0] R10: dffffc0000000000 R11: fffffbfff233a4f8 R12: ffff88802faa32c8 [ 863.414524][ C0] R13: ffff88807e794780 R14: ffffffff8bc83117 R15: 0000000000000000 [ 863.422518][ C0] ? batadv_dat_purge+0x2d7/0x3c0 [ 863.427578][ C0] batadv_dat_purge+0x2d7/0x3c0 [ 863.432433][ C0] ? process_scheduled_works+0x97a/0x1630 [ 863.438148][ C0] process_scheduled_works+0xc3d/0x1630 [ 863.443705][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 863.449683][ C0] ? assign_work+0x3cf/0x5d0 [ 863.454269][ C0] worker_thread+0xa47/0xfb0 [ 863.458881][ C0] kthread+0x38b/0x480 [ 863.462962][ C0] ? __pfx_worker_thread+0x10/0x10 [ 863.468079][ C0] ? __pfx_kthread+0x10/0x10 [ 863.472661][ C0] ret_from_fork+0x514/0xb70 [ 863.477244][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 863.482343][ C0] ? __switch_to+0xc78/0x1410 [ 863.487040][ C0] ? __pfx_kthread+0x10/0x10 [ 863.491640][ C0] ret_from_fork_asm+0x1a/0x30 [ 863.496408][ C0] [ 863.499428][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 863.506709][ C0] CPU: 0 UID: 0 PID: 15433 Comm: kworker/u8:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 863.517897][ C0] Tainted: [L]=SOFTLOCKUP [ 863.522209][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 863.532256][ C0] Workqueue: bat_events batadv_dat_purge [ 863.537890][ C0] Call Trace: [ 863.541160][ C0] [ 863.543993][ C0] vpanic+0x56d/0xa60 [ 863.547965][ C0] ? __pfx__printk+0x10/0x10 [ 863.552540][ C0] ? __pfx_vpanic+0x10/0x10 [ 863.557033][ C0] ? is_bpf_text_address+0x292/0x2b0 [ 863.562332][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 863.567524][ C0] panic+0xc5/0xd0 [ 863.571235][ C0] ? __pfx_panic+0x10/0x10 [ 863.575660][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 863.580603][ C0] __warn+0x315/0x4c0 [ 863.584654][ C0] ? __queue_work+0xdfc/0x1360 [ 863.589437][ C0] ? __queue_work+0xdfc/0x1360 [ 863.594223][ C0] __report_bug+0x276/0x570 [ 863.598731][ C0] ? insert_work+0x3d/0x330 [ 863.603240][ C0] ? __queue_work+0xbe8/0x1360 [ 863.608104][ C0] ? call_timer_fn+0x18d/0x5f0 [ 863.612899][ C0] ? __queue_work+0xdfc/0x1360 [ 863.617662][ C0] ? __pfx___report_bug+0x10/0x10 [ 863.622848][ C0] ? ret_from_fork+0x514/0xb70 [ 863.627623][ C0] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 863.632905][ C0] ? look_up_lock_class+0x57/0x110 [ 863.638004][ C0] ? register_lock_class+0x31/0x2e0 [ 863.643191][ C0] report_bug_entry+0x19b/0x290 [ 863.648052][ C0] ? __queue_work+0xe1a/0x1360 [ 863.652825][ C0] ? __queue_work+0xe1f/0x1360 [ 863.657606][ C0] handle_bug+0xce/0x200 [ 863.661851][ C0] exc_invalid_op+0x1a/0x50 [ 863.666346][ C0] asm_exc_invalid_op+0x1a/0x20 [ 863.671187][ C0] RIP: 0010:__queue_work+0xe1a/0x1360 [ 863.676556][ C0] Code: 28 78 01 00 00 4c 8d 35 74 0f 11 10 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 42 8c b0 00 49 8b 77 18 4c 89 f7 48 8b 54 24 28 <67> 48 0f b9 3a 4c 89 f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 [ 863.696156][ C0] RSP: 0018:ffffc90000007be8 EFLAGS: 00010046 [ 863.702228][ C0] RAX: 1ffff1100c5e194e RBX: dffffc0000000000 RCX: ffff888020fc3e80 [ 863.710189][ C0] RDX: ffff88803637e178 RSI: ffffffff8aee33b0 RDI: ffffffff919ffd90 [ 863.718146][ C0] RBP: 0000000000010000 R08: 0000000000000100 R09: 1ffffffff233a4f7 [ 863.726100][ C0] R10: dffffc0000000000 R11: ffffffff818ef750 R12: ffff88803637e1c0 [ 863.734081][ C0] R13: 0000000000000008 R14: ffffffff919ffd90 R15: ffff888062f0ca58 [ 863.742044][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 863.747844][ C0] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 863.753126][ C0] ? __queue_work+0xdcf/0x1360 [ 863.757901][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 863.763259][ C0] call_timer_fn+0x18d/0x5f0 [ 863.767840][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 863.773631][ C0] ? call_timer_fn+0xd5/0x5f0 [ 863.778323][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 863.783426][ C0] ? do_raw_spin_unlock+0xf5/0x200 [ 863.788523][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 863.794358][ C0] __run_timer_base+0x67e/0x8b0 [ 863.799294][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 863.804692][ C0] ? lapic_next_event+0x11/0x20 [ 863.809561][ C0] ? clockevents_program_event+0x491/0x630 [ 863.815364][ C0] run_timer_softirq+0xb7/0x170 [ 863.820224][ C0] handle_softirqs+0x265/0x8d0 [ 863.824994][ C0] __irq_exit_rcu+0xc6/0x220 [ 863.829573][ C0] irq_exit_rcu+0x9/0x30 [ 863.833800][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 863.839431][ C0] [ 863.842374][ C0] [ 863.845309][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 863.851311][ C0] RIP: 0010:__local_bh_enable_ip+0xdf/0x140 [ 863.857237][ C0] Code: e8 c6 cf 76 0a 65 66 8b 05 da da 35 13 66 85 c0 75 34 bf 01 00 00 00 e8 9f 63 0c 00 e8 9a 06 48 00 fb 65 48 8b 05 91 da 35 13 <48> 85 c0 75 05 e8 d7 0f aa ff 5b 41 5e e9 8f c4 79 0a cc 90 0f 0b [ 863.876846][ C0] RSP: 0018:ffffc9000651fa60 EFLAGS: 00000206 [ 863.882905][ C0] RAX: 8000000000000000 RBX: 0000000000000201 RCX: 0000000000000046 [ 863.890865][ C0] RDX: 0000000000000006 RSI: ffffffff8e69c891 RDI: ffffffff8c8e7180 [ 863.898849][ C0] RBP: dffffc0000000000 R08: ffffffff919d27bf R09: 1ffffffff233a4f7 [ 863.906846][ C0] R10: dffffc0000000000 R11: fffffbfff233a4f8 R12: ffff88802faa32c8 [ 863.914816][ C0] R13: ffff88807e794780 R14: ffffffff8bc83117 R15: 0000000000000000 [ 863.922783][ C0] ? batadv_dat_purge+0x2d7/0x3c0 [ 863.927815][ C0] batadv_dat_purge+0x2d7/0x3c0 [ 863.932659][ C0] ? process_scheduled_works+0x97a/0x1630 [ 863.938386][ C0] process_scheduled_works+0xc3d/0x1630 [ 863.943934][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 863.949904][ C0] ? assign_work+0x3cf/0x5d0 [ 863.954484][ C0] worker_thread+0xa47/0xfb0 [ 863.959073][ C0] kthread+0x38b/0x480 [ 863.963151][ C0] ? __pfx_worker_thread+0x10/0x10 [ 863.968250][ C0] ? __pfx_kthread+0x10/0x10 [ 863.972839][ C0] ret_from_fork+0x514/0xb70 [ 863.977462][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 863.982579][ C0] ? __switch_to+0xc78/0x1410 [ 863.987255][ C0] ? __pfx_kthread+0x10/0x10 [ 863.991833][ C0] ret_from_fork_asm+0x1a/0x30 [ 863.996636][ C0] [ 863.999964][ C0] Kernel Offset: disabled [ 864.004301][ C0] Rebooting in 86400 seconds..