last executing test programs: 6m40.886679518s ago: executing program 4 (id=3347): socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0xffffffff, 0x1000000, 0x102550, 0xffffffffffffffff, 0x20000000) r0 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) syz_io_uring_setup(0xf0c, 0x0, 0x0, 0x0, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) syz_clone(0x4021080, &(0x7f0000000240)="60d0b7eace8f6d442e1055f3e443d28bc8027c5144c72897d1f32405e0e069c44509b42438b715a590665e590a6afe8e693e18d7c55b8bcbf7dc64af448bc6bb3a494f8f3139209a5ec5f2d37cabed7347d824fcf3b148e3c57d5d20adc5910de0631258a1d7471c3100578167522380b9853e23f9c9bb2455892215c3c81a2a949e93c694b700a7b53f7c9a32447c2a09e7e9c9b2854cec23618668bbb606a9d86cd5c6c25f3a7458", 0xa9, &(0x7f0000000340), &(0x7f0000000380), &(0x7f0000000440)="84c53b104f9b24038ba592ef50e90f102b16f4f70f8e8d46598386645d415124a7d1dd294d59894e1185b21442f941a2e73d3dfdc9279383a889fdf7aad8be0553316f8b25f2501c6ee85f14588d94a72024ad61c9c39a95e7addb5c648b2f9b276a27244302150c581888e4337715ace1f45afd2c09bb933cb3b5f156f8d35d3930abd5b88464cbf3a6009cd5da18daa1dda1231376b535076bfee5894a40e393cdbf7355d4c6695a21dcd8d4c78089cafaf55ae71d63d5ad9d84370b51a2055a5cfaae2dcba670d5e387531317fa19bec34f3db0b480") r2 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r1, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24) listen(r1, 0xa) connect$rxrpc(r2, &(0x7f0000000100)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000200)={0x0, 0xffffffffffffff75, 0x0, 0x0, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100"}, {0x10, 0x110, 0xe}], 0xfffffffffffffeea}, 0x0) sendmsg(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=[{0x18, 0x110, 0x1, "02000000000000"}], 0x18}, 0x0) sendmsg(r1, 0x0, 0x8000) sendmsg(r1, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000001200)=[{&(0x7f0000001300)='re', 0x2}], 0x1, &(0x7f0000001400)=ANY=[@ANYBLOB="180000000000000010010040010000000100000000000000"], 0x18}, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r3 = socket$packet(0x11, 0x3, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) openat2$dir(0xffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x10d240, 0x0, 0x2}, 0x18) pipe(&(0x7f0000000080)) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x4d) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000180)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3", @ANYRES8=r4, @ANYRES64=r3], 0x0) recvmsg(r2, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001700)=""/100, 0x64}], 0x12, &(0x7f0000001800)=""/100, 0x64}, 0x0) 6m39.527269773s ago: executing program 4 (id=3352): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000640), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$sndpcmc(0x0, 0x5, 0x200000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, 0x0, 0x0, 0x0) r2 = syz_usb_connect$lan78xx(0x6, 0x0, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920001000109021b1901000000f30904150001da40df000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r4, 0x6, 0x17, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2b, 0x1, 0x1) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f0000000200)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x2000000000c0, 0x2000000000f0, 0x200000000120], 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000400000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000f852f4abe402b59c0f78be000000000000000000000000feffffff0000000000"]}, 0x10d) setsockopt$inet_int(r4, 0x0, 0x18, &(0x7f0000000080)=0x9, 0x4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) socket$inet(0xa, 0x801, 0x84) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000040)={{r6, r7+10000000}, {0x77359400}}, &(0x7f00000001c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x7, 0x40, 0x3, 0x4, {{0x5, 0x4, 0x2, 0x7, 0x14, 0x64, 0x0, 0x2, 0x29, 0x0, @remote, @remote}}}}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) 6m37.676120448s ago: executing program 4 (id=3362): r0 = socket(0x10, 0x3, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/46, 0x0, 0x100000}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000400)=0x4000000) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000380)) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000100)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x80, 0x80}, [@RTA_SRC={0x8, 0x2, @local}, @RTA_DST={0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x25}}]}, 0x2c}}, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000500)=0x1) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000480)={0x1, 0x0, [{0x7000, 0xa4, &(0x7f0000000000)=""/164}]}) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af04, &(0x7f0000000200)) close_range(r1, 0xffffffffffffffff, 0x2) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_expedited', 0x101a02, 0x0) sendfile(r4, r4, 0x0, 0x9) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0200000004000000040000000c"], 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0d000000040000000400000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000700), &(0x7f0000000880), 0xde9, r5}, 0x38) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0xb173, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f0000005c40)=[{{0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000140)="914c", 0x2}], 0x1, &(0x7f0000002380)=[@rights={{0x14, 0x1, 0x1, [r8]}}], 0x18, 0x40000}}], 0x1, 0x20000000) sendmsg$unix(r7, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="cc", 0x1}], 0x1, &(0x7f00000011c0)=[@rights={{0x14, 0x1, 0x1, [r8]}}], 0x18, 0x4040040}, 0x4000011) ioctl$vim2m_VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000000040)={0x48, 0x1, 0x0, "b49e1b6225be4279fa07fbde4749573e7c17e6e724ae09b9424f5ab23870ecd4", 0x38415261}) write(r0, &(0x7f0000000000)="240000001a005f0314f9f407000904000200000001000000000000000800040001000000", 0x24) 6m37.426085452s ago: executing program 4 (id=3365): ioctl$USBDEVFS_ALLOC_STREAMS(0xffffffffffffffff, 0x8008551c, &(0x7f00000000c0)={0x713b, 0x8, [{0xb}, {0xe}, {0x2, 0x1}, {0x1, 0x1}, {0x9}, {0x8, 0x1}, {0x2}, {0xf, 0x1}]}) syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x200202) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 6m37.253050333s ago: executing program 4 (id=3367): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x9}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x7000002, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = open(&(0x7f0000000080)='./file0\x00', 0x402000, 0x9d) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$setregs(0xd, r3, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r3, 0x8, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x6, 0x0, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) syz_emit_ethernet(0x1e, &(0x7f0000000100)={@random="762f7c3d8027", @empty, @void, {@can={0xc, {{0x0, 0x1}, 0x6, 0x1, 0x0, 0x0, "b94fe652300ac081"}}}}, &(0x7f0000000140)={0x1, 0x2, [0x2b9, 0xeb0, 0x468, 0xc52]}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) fremovexattr(r1, &(0x7f0000000000)=@known='system.posix_acl_default\x00') creat(&(0x7f00000005c0)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) 6m35.579153354s ago: executing program 4 (id=3372): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000640), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$sndpcmc(0x0, 0x5, 0x200000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, 0x0, 0x0, 0x0) r2 = syz_usb_connect$lan78xx(0x6, 0x0, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920001000109021b1901000000f30904150001da40df000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r4, 0x6, 0x17, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2b, 0x1, 0x1) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f0000000200)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x2000000000c0, 0x2000000000f0, 0x200000000120], 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000400000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000f852f4abe402b59c0f78be000000000000000000000000feffffff0000000000"]}, 0x10d) setsockopt$inet_int(r4, 0x0, 0x18, &(0x7f0000000080)=0x9, 0x4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) socket$inet(0xa, 0x801, 0x84) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000040)={{r6, r7+10000000}, {0x77359400}}, &(0x7f00000001c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x7, 0x40, 0x3, 0x4, {{0x5, 0x4, 0x2, 0x7, 0x14, 0x64, 0x0, 0x2, 0x29, 0x0, @remote, @remote}}}}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) 6m20.311602191s ago: executing program 32 (id=3372): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000640), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$sndpcmc(0x0, 0x5, 0x200000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, 0x0, 0x0, 0x0) r2 = syz_usb_connect$lan78xx(0x6, 0x0, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920001000109021b1901000000f30904150001da40df000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r4, 0x6, 0x17, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2b, 0x1, 0x1) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f0000000200)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x2000000000c0, 0x2000000000f0, 0x200000000120], 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000400000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000f852f4abe402b59c0f78be000000000000000000000000feffffff0000000000"]}, 0x10d) setsockopt$inet_int(r4, 0x0, 0x18, &(0x7f0000000080)=0x9, 0x4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) socket$inet(0xa, 0x801, 0x84) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000040)={{r6, r7+10000000}, {0x77359400}}, &(0x7f00000001c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x7, 0x40, 0x3, 0x4, {{0x5, 0x4, 0x2, 0x7, 0x14, 0x64, 0x0, 0x2, 0x29, 0x0, @remote, @remote}}}}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) 2m26.022345532s ago: executing program 3 (id=4343): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x338, 0x0, 0x1e8, 0xfeffffff, 0x1e8, 0x0, 0x2a0, 0x2a0, 0xffffffff, 0x338, 0x2a0, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'caif0\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@TCPMSS={0x28}}, {{@uncond, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @initdev={0xac, 0x1e, 0x40, 0x0}, @broadcast, @gre_key=0x6, @port=0x4e24}}}}, {{@ip={@loopback, @rand_addr, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00'}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @gre_key=0x1, @port=0x4e24}}}}, {{@ip={@local, @empty, 0x0, 0x0, 'pim6reg0\x00', 'wlan0\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv6=@private2, @ipv4=@multicast1, @port, @gre_key}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x398) 2m26.00952107s ago: executing program 3 (id=4344): alarm(0x67e) alarm(0x6) alarm(0x35c) alarm(0x5) syz_clone3(&(0x7f00000002c0)={0x400, &(0x7f0000000000)=0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080), {0x16}, &(0x7f00000000c0)=""/153, 0x99, &(0x7f0000000180)=""/194, &(0x7f0000000280)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x9}, 0x58) sendfile(r0, 0xffffffffffffffff, &(0x7f0000000340)=0xb, 0xfffffffffffffffb) mq_open(&(0x7f0000000380)=')@\x00', 0x80, 0x8, &(0x7f00000003c0)={0x800, 0x42, 0xc, 0xb}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000580)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x5c, r2, 0x20, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0xf400000, 0x30}}}}, [@NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_FRAME={0x22, 0x33, @deauth={{{0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x438d}, @broadcast, @device_a, @random="dbd69de2d47f", {0xa, 0x4}, @value=@ver_80211n={0x0, 0x5, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}}, 0x9, @void}}, @NL80211_ATTR_DURATION={0x8, 0x57, 0xf83}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4000) alarm(0xa) r4 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000bfe000/0x400000)=nil) syz_kvm_add_vcpu$x86(r4, &(0x7f0000000b40)={0x0, &(0x7f00000005c0)=[@nested_amd_set_intercept={0x181, 0x30, {0x0, 0x8000000000000000, 0x5}}, @set_irq_handler={0xc8, 0x20, {0x91, 0x2}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @ro_nat=0x6408, 0x1, 0xb95, 0x2}}, @wr_drn={0x68, 0x20, {0x2, 0x7}}, @nested_amd_vmload={0x182, 0x18, 0x1}, @wr_crn={0x67, 0x20, {0x0, 0x1}}, @wrmsr={0x65, 0x20, {0xaa2, 0x8}}, @nested_amd_vmsave={0x183, 0x18, 0x1}, @nested_load_code={0x12e, 0xa0, {0x3, "efc7442400409d0ce5c744240200000000c7442406000000000f011c244e0faeb5304d000048b80c000000000000000f23c00f21f835030002000f23f8b9800000c00f3235000800000f3048b800700000000000000f23c80f21f8350c00f0000f23f866b82e018ed00f20d835080000000f22d86465d8db66baf80cb8e0f4b381ef66bafc0c66ed"}}, @uexit={0x0, 0x18, 0x7}, @in_dx={0x69, 0x20, {0x4feb, 0x4}}, @out_dx={0x6a, 0x28, {0x2363, 0x5, 0x7fff}}, @nested_load_code={0x12e, 0x6e, {0x3, "c744240068c325ccc7442402c6000000c7442406000000000f011424b8010000000f01d966baf80cb8b96bd98def66bafc0cec0f01cb64460f01cf400f0012c4e161d200440f9e6e530fc2b9752c00000c420f785eeb"}}, @wr_crn={0x67, 0x20, {0x4, 0x4}}, @nested_create_vm={0x12d, 0x18, 0x2}, @enable_nested={0x12c, 0x18}, @nested_load_syzos={0x136, 0xf1, {0x3, 0xffffffff, [@code={0xa, 0x60, {"26260f6ffdf30fa6d0c4217b128d2b3e000048b8f6060000000000000f23c00f21f83502000c000f23f8b805000000b90001c0fe0f01c12e660f35470f20420f78e5430f01b9f7a9000036450f01c2"}}, @nested_load_code={0x12e, 0x71, {0x2, "0fc79f005000000f20d835080000000f22d8450f22470f01dcf2420f01bdce66d2d10f20c035020000000f22c0b9cb0a0000b8fdffffffbaffff00000f303636360ffb02b9e4020000b800000000ba010000000f300fc76f79"}}]}}, @set_irq_handler={0xc8, 0x20, {0x2}}, @nested_vmresume={0x130, 0x18, 0x1}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @control_nat=0x600e, 0x8200, 0x6, 0x9}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @ro32=0x440e, 0x2, 0x1, 0x85f}}, @enable_nested={0x12c, 0x18}, @wr_drn={0x68, 0x20, {0x0, 0x1}}, @nested_create_vm={0x12d, 0x18}, @nested_vmresume={0x130, 0x18, 0x1}, @nested_amd_invlpga={0x17d, 0x20, {0x6000, 0x1499}}, @nested_vmresume={0x130, 0x18, 0x3}, @nested_load_code={0x12e, 0x49, {0x0, "c4e265ac5e000f08410f22c344743466baa10066ed450f011ca08f6978c3116765f3a7c443f9143800400f789300400000"}}], 0x558}) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000b80)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r5, 0xc01064bd, &(0x7f0000000c80)={&(0x7f0000000bc0)="4bd37e8728c846cd9797a2dbcd0c3c74b5726b18cc30e3dc4f5ed0010a35c5ecbf4fd4b272a5dcd6a3df7451261e06bb1ba31ccbe3e4438f8abecfa8bff383beeb8af1c63f7eb8fa73af79f9f3774841d79394a99f823ef437b1f9d67525254a644d1b3cee2f8338c17985956dbd6b0b03cea1b2db145fc901449426d952c515ec7dee76099092d679d7cde0421a9ea4f88a62576f927a431341a58bb0407fbcdcc5f63bca4492c4f2ca816561bb476f003715d04bac9c671cc4bfcf", 0xbc, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(r5, 0xc00464be, &(0x7f0000000cc0)={r6}) alarm(0x4) syz_open_dev$hidraw(&(0x7f0000000d00), 0x2, 0x28000) alarm(0x72) syz_open_dev$sndpcmp(&(0x7f0000000d40), 0x2, 0x783000) socket$kcm(0x29, 0x5, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000d80), 0x6, 0x12000) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000f00)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e00)={0x94, r2, 0xb01, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x800, 0x34}}}}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x14a0}, @NL80211_ATTR_CENTER_FREQ2={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}], @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3db}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7183}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x568}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}]}, 0x94}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000001) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000f40), 0x800, 0x0) ioctl$XFS_IOC_GET_RESBLKS(r7, 0x80105873, &(0x7f0000000f80)) r8 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSIG(r8, 0x40045436, 0x10) alarm(0x8) socket(0x0, 0x2, 0x5) 2m25.67729198s ago: executing program 3 (id=4347): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r0, 0x0, 0x3, &(0x7f0000000080)=0x90e, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x3000003) r1 = socket$inet6(0xa, 0x3, 0x87) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x1, 0x7fffffff}]}) msync(&(0x7f0000a97000/0x1000)=nil, 0x1000, 0x4) syz_emit_ethernet(0xef, &(0x7f0000000140)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @local, @val={@void, {0x8100, 0x0, 0x0, 0x3}}, {@generic={0x1c0, "6f27659fec6b16b16c5ef550b6c599650c7d2892df89693ac1ad2831db2a67b59c2926e923ea7e9c40da2e98b52000fe0f126f2d94efb8a2ae03aaf51b2ec6527f6537656f4f9078c5a744e67f98f814d8d8754286df1bca2e7a646f999d78e438f1b15e81acb3b13fb6763581977068ce03bd5025d46224a48cebe2f2b6f189a307fccf5ff0c3c7f141a3b02e181f35148680fec571a25685f95ef3559389222495ae8cd3fa4282926271352afb0e925cd84051f15fd5691b0a8142f0c071987c38fdff1d868208d3356cee317009d7e34a46283b4881444bcbf3956a"}}}, 0x0) setsockopt$inet6_int(r1, 0x29, 0x18, &(0x7f00000005c0)=0x7fff, 0x4) sendto$inet(r0, &(0x7f0000000100)="1ce0", 0xffeb, 0x90c, &(0x7f0000001100)={0x2, 0x0, @private}, 0x10) 2m25.578422207s ago: executing program 3 (id=4348): syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x80801) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000440)='./file0\x00') umount2(&(0x7f0000000000)='./file0\x00', 0x4000000000000000) 2m25.556271117s ago: executing program 3 (id=4349): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (fail_nth: 37) 2m24.602805584s ago: executing program 3 (id=4351): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r2, 0x403c6f2b, &(0x7f0000000000)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0xf9, 0x5}) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r3, &(0x7f0000000080)='transport=loop,nqn=n', 0x14) fcntl$notify(r1, 0x402, 0x80000004) ioctl$KVM_SET_CPUID2(r3, 0x4048aecb, &(0x7f00000006c0)={0x6, 0x0, [{0x7, 0xffffffff, 0x1, 0x3, 0x7, 0x6, 0x2}, {0x80000008, 0x4, 0x6, 0x8, 0x27, 0x7, 0x85}, {0xa, 0xe5f, 0x1, 0x6, 0xdf1, 0x6, 0x80000001}, {0x80000000, 0x23b, 0x7, 0xa, 0x3, 0x7ff, 0x25}, {0x80000000, 0x100, 0x4, 0x6, 0x3, 0x2, 0x3}, {0x80000001, 0x2, 0x3, 0x3, 0xfffffff9, 0xff, 0x8}]}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r7, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x58, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {}, {0xd}}, [@filter_kind_options=@f_fw={{0x7}, {0xfffffffffffffe21}}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}, @TCA_CHAIN={0x8, 0xb, 0xc}, @TCA_CHAIN={0x8, 0xb, 0x9}, @TCA_RATE={0x6, 0x5, {0x7, 0x4}}, @TCA_CHAIN={0x8, 0xb, 0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x400c040}, 0x4000000) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@getqdisc={0x3c, 0x26, 0x10, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x1, 0xf}, {0xfff2, 0x6}, {0xfff1, 0x9}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048815}, 0x801) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x8003, 0x8000, 0x8, 0x0, 0xffffffffffffffff, 0x80000002}, 0x50) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newsa={0x194, 0x10, 0x1, 0x70bc2c, 0x0, {{@in6=@mcast2, @in=@private=0xa0100fe, 0x0, 0xecdf, 0x0, 0x0, 0xa}, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x32}, @in6=@empty, {0xfffffffffffffffe, 0xfffffffffffffffc, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x9}, {0x1, 0x400800, 0x9, 0x292}, {0x1000}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x2c}, [@algo_crypt={0x58, 0x2, {{'cbc(twofish)\x00'}, 0x80, "00000000000000000100070000400000"}}, @algo_auth_trunc={0x4c, 0x14, {{'hmac(sha256)\x00'}, 0x0, 0x60}}]}, 0x194}}, 0x44050) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r8, &(0x7f00000005c0), 0x0}, 0x20) poll(&(0x7f0000000180)=[{r2}], 0x1, 0x15) r10 = syz_open_dev$usbfs(&(0x7f0000000700), 0x2000000000000, 0x141002) ioctl$USBDEVFS_DISCONNECT_CLAIM(r10, 0xc0185500, &(0x7f0000000040)={0x82, 0x0, "aa2fe1a243fcd9abf29cc3391c06b86f68e7f73d4f0bff9669a8e82040ccb44d75131fb06cade553a6bdc314438ce0af11c38cd724980b087a7a16f9295be0a69db51576e7a06ef6bcabc67b52ba82e73504fa842ec2f0c06bf006f3e5bcdd5057997bf171c60d96a538b02ee9f4b573457498ca09cb417b1fbe6dc3b0c27ab0693ac57aff136748f7740dfc33f3a902b670f8933aec28869e637c18379d6d0b4d844b732cb1932733dfcec2f69f8b6df76ba84e1f001ad29105230471f466b6f9d7d2b05a57fe16e7363e5ecebc2c74539ca55c7ce3a175061adedd20532a9de97379f4dd5baeeae835946311e6e4e2361355c54b3bd500"}) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000480)={0x0, 0x0, @pic={0xa0, 0x81, 0xb4, 0x1, 0x2, 0xfc, 0x0, 0x0, 0x18, 0xf8, 0x94, 0x40, 0x3, 0x1, 0x4, 0xc}}) 2m9.240185883s ago: executing program 33 (id=4351): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r2, 0x403c6f2b, &(0x7f0000000000)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0xf9, 0x5}) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r3, &(0x7f0000000080)='transport=loop,nqn=n', 0x14) fcntl$notify(r1, 0x402, 0x80000004) ioctl$KVM_SET_CPUID2(r3, 0x4048aecb, &(0x7f00000006c0)={0x6, 0x0, [{0x7, 0xffffffff, 0x1, 0x3, 0x7, 0x6, 0x2}, {0x80000008, 0x4, 0x6, 0x8, 0x27, 0x7, 0x85}, {0xa, 0xe5f, 0x1, 0x6, 0xdf1, 0x6, 0x80000001}, {0x80000000, 0x23b, 0x7, 0xa, 0x3, 0x7ff, 0x25}, {0x80000000, 0x100, 0x4, 0x6, 0x3, 0x2, 0x3}, {0x80000001, 0x2, 0x3, 0x3, 0xfffffff9, 0xff, 0x8}]}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r7, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x58, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {}, {0xd}}, [@filter_kind_options=@f_fw={{0x7}, {0xfffffffffffffe21}}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}, @TCA_CHAIN={0x8, 0xb, 0xc}, @TCA_CHAIN={0x8, 0xb, 0x9}, @TCA_RATE={0x6, 0x5, {0x7, 0x4}}, @TCA_CHAIN={0x8, 0xb, 0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x400c040}, 0x4000000) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@getqdisc={0x3c, 0x26, 0x10, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x1, 0xf}, {0xfff2, 0x6}, {0xfff1, 0x9}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048815}, 0x801) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x8003, 0x8000, 0x8, 0x0, 0xffffffffffffffff, 0x80000002}, 0x50) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newsa={0x194, 0x10, 0x1, 0x70bc2c, 0x0, {{@in6=@mcast2, @in=@private=0xa0100fe, 0x0, 0xecdf, 0x0, 0x0, 0xa}, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x32}, @in6=@empty, {0xfffffffffffffffe, 0xfffffffffffffffc, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x9}, {0x1, 0x400800, 0x9, 0x292}, {0x1000}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x2c}, [@algo_crypt={0x58, 0x2, {{'cbc(twofish)\x00'}, 0x80, "00000000000000000100070000400000"}}, @algo_auth_trunc={0x4c, 0x14, {{'hmac(sha256)\x00'}, 0x0, 0x60}}]}, 0x194}}, 0x44050) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r8, &(0x7f00000005c0), 0x0}, 0x20) poll(&(0x7f0000000180)=[{r2}], 0x1, 0x15) r10 = syz_open_dev$usbfs(&(0x7f0000000700), 0x2000000000000, 0x141002) ioctl$USBDEVFS_DISCONNECT_CLAIM(r10, 0xc0185500, &(0x7f0000000040)={0x82, 0x0, "aa2fe1a243fcd9abf29cc3391c06b86f68e7f73d4f0bff9669a8e82040ccb44d75131fb06cade553a6bdc314438ce0af11c38cd724980b087a7a16f9295be0a69db51576e7a06ef6bcabc67b52ba82e73504fa842ec2f0c06bf006f3e5bcdd5057997bf171c60d96a538b02ee9f4b573457498ca09cb417b1fbe6dc3b0c27ab0693ac57aff136748f7740dfc33f3a902b670f8933aec28869e637c18379d6d0b4d844b732cb1932733dfcec2f69f8b6df76ba84e1f001ad29105230471f466b6f9d7d2b05a57fe16e7363e5ecebc2c74539ca55c7ce3a175061adedd20532a9de97379f4dd5baeeae835946311e6e4e2361355c54b3bd500"}) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000480)={0x0, 0x0, @pic={0xa0, 0x81, 0xb4, 0x1, 0x2, 0xfc, 0x0, 0x0, 0x18, 0xf8, 0x94, 0x40, 0x3, 0x1, 0x4, 0xc}}) 5.419320661s ago: executing program 0 (id=5113): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x80000004, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1, 0x8000, 0x10000}, 0x28) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, 0x0) r3 = syz_usb_connect$hid(0x1, 0x6e, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1b1c, 0x1b3e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x420, 0x8, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000040)={0x18, &(0x7f00000005c0)={0x20, 0x2, 0x28, {0x28, 0x23, "83efb930f0187ff0478fa22a61a54607950000e442359c479c37f525cde38bef0d15f9366b48"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000680)=ANY=[@ANYRES16, @ANYBLOB="01002dbd7000fddbdf256c00000008000300", @ANYRES32], 0x5c}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000940), 0x0, 0x40002021, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0x2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000008c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000388a83b0081000200080046010028007c00000b2190787f000001ac1414aa0703ac004e214e23040190782ca659e501dc91ac"], 0x0) 4.394316792s ago: executing program 6 (id=5123): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000009006000000000000000000000a44000000090a050600000000000000000100000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001405000d404600000014000000110001"], 0x6c}}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r4, 0x0, 0x6, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x427a7000) write$cgroup_devices(r4, 0x0, 0x6) write(r2, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r4, 0x0) r6 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f0000000040)) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f0000000080)) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000c000000000000000000008018110000", @ANYRES32, @ANYBLOB="0200000000000000b702000014000000b70300003f0000008500000083000000bf0920000000000055490100000000009500000000000000bf91000000000000b7020000000000008500"], 0x0, 0xb, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, 0x0, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r10, 0x0, 0x0, 0x50041, &(0x7f00000001c0)={0x11, 0x3, r9, 0x1, 0xd8}, 0x14) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e20, @rand_addr=0x64010100}, {0x2, 0x4a2c, @remote}, {0x2, 0x4e25, @multicast2}, 0x204, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x200003, 0x2, 0x2}) write$tun(r7, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) close_range(r2, r1, 0x0) 4.213614682s ago: executing program 2 (id=5125): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r2 = socket$tipc(0x1e, 0x5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ipv6_route\x00') preadv(r4, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000780)=""/4096, 0x1000}], 0x2, 0x12c, 0x0) ioctl$vim2m_VIDIOC_DQBUF(r4, 0xc0585611, &(0x7f0000000100)=@mmap={0x8, 0x1, 0x4, 0x2000, 0x1, {}, {0x1, 0xc, 0x7, 0x78, 0xd2, 0xf, "bc2d4ca6"}, 0x9, 0x1, {}, 0x9}) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000080011100fe8000000000000000000000000000bbac1e000100000000000000000000000020010000000000000000000000000000fe8800000000000000000000000001012b0200000135000002000200e0000001000000000000000000000000ac1414aa000000000000000000000000fc020000000000000000000000000000fe88000000000000000000000000000133040000ff34000002000200fc010000000000000000000000000001fe800000000000000000000000000035ac1414aa000000000000000000000000fc0200000000000000000000000000013c000000000000000a0008000a01010200000000000000000000000000000000000000000000000000000000ac1414aa000000000000000000000000fe80000000000000000000000000003f3c0000000535000002000a007f000001000000000000000000000000fe8000000000000000000000000000bbfc010000000000000000000000000001fc00000000000000000000000000000133040000033500000a"], 0x1d0}}, 0x0) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x40100001, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r5, 0xc02064b6, &(0x7f00000002c0)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r5, 0xc06864a2, &(0x7f0000000240)={&(0x7f0000000180)=[0x0], 0x1, r8, r9, 0x3, 0x0, 0x2, 0x1, {0xac7c, 0x1, 0x7, 0x69, 0xf4b, 0x2, 0x2, 0x45, 0x412f, 0xe154, 0x20, 0x7, 0xb2bf, 0x3, "fe1d00003413000000000000000caa000000090000000000000004b427180010"}}) bind$tipc(r2, 0x0, 0x0) r10 = socket$tipc(0x1e, 0x2, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000181100", @ANYRES32, @ANYBLOB="0000000000000000b7080000030000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000", @ANYRES32, @ANYBLOB="0000000000000000d5080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fcntl$setpipe(r11, 0x407, 0x5) setsockopt$TIPC_GROUP_JOIN(r10, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) 3.772557268s ago: executing program 6 (id=5126): writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000280)="390000001300090468fe0700000000001000ff3f04000000480100100000000004002b00", 0x24}], 0x1) mkdir(&(0x7f0000000000)='./gadget\x00', 0x1ff) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000080)=@buf) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)={0x3c, r5, 0x211, 0x4, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @remote}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x3c}}, 0x804) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r3, 0x1, 0x70bd2c, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x1c}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0) 3.633892963s ago: executing program 1 (id=5127): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$USBDEVFS_ALLOC_STREAMS(0xffffffffffffffff, 0x8008551c, &(0x7f00000000c0)={0x713b, 0x8, [{0xb}, {0xe}, {0x2, 0x1}, {0x1, 0x1}, {0x9}, {0x8, 0x1}, {0x2}, {0xf, 0x1}]}) syz_open_dev$cec(0x0, 0x0, 0x200202) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 3.633354938s ago: executing program 6 (id=5128): writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000280)="390000001300090468fe0700000000001000ff3f04000000480100100000000004002b00", 0x24}], 0x1) mkdir(&(0x7f0000000000)='./gadget\x00', 0x1ff) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000080)=@buf) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)={0x3c, r3, 0x211, 0x4, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @remote}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x3c}}, 0x804) 3.523625228s ago: executing program 5 (id=5129): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000005c0)={r2, @in={{0x2, 0x4e23, @multicast2}}, [0x5, 0x957f, 0x3ff, 0x8, 0xe, 0x1, 0x1, 0x21, 0x0, 0x100, 0x3a22c911, 0x9, 0x7, 0x6, 0xc3]}, &(0x7f00000006c0)=0xfc) 3.434249493s ago: executing program 5 (id=5130): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x34, 0x12, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}], {0x14}}, 0x5c}}, 0x0) 3.432557109s ago: executing program 1 (id=5131): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x10000) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x3, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}], {0x14}}, 0x54}, 0x1, 0x0, 0x0, 0x4c841}, 0x802) 3.396491954s ago: executing program 6 (id=5132): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x7e6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x163a42, 0x8) write(r2, &(0x7f0000000180)='10000', 0x5) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) write$dsp(0xffffffffffffffff, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) 3.314104808s ago: executing program 5 (id=5133): r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) sendfile(r1, r0, &(0x7f0000002080)=0x58, 0x12) pwritev(r1, &(0x7f0000000640)=[{&(0x7f0000000100)="ea8c82f9e77f8604d4a97969c43269745144ea6ca358208309446e4432d65e3088e0144d3735aee4c2c8c1868843bb4a531e2f601de9ea16ab32f828bd708e0ba154299ef44a672f5ba354ce727fd10f28d3ab8074653854571e486edbabf63a3cab900abf1d104966774a02290f9a069ef5205bde800a40c7f3cab43774455f5b92c226c0642242cc09d8556e13466adf3509584f20918f7b6a16bfe7a5dcd3bfad53be7d3fdc7df6d9c0c2", 0xac}, {0x0}], 0x2, 0x3815, 0x1) 3.300440106s ago: executing program 1 (id=5134): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) socket$tipc(0x1e, 0x5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ipv6_route\x00') preadv(r2, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000780)=""/4096, 0x1000}], 0x2, 0x12c, 0x0) 3.188850501s ago: executing program 5 (id=5135): socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_emit_ethernet(0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbb67960a2a35d3597b4500002800000000000690780a0101"], 0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5393, &(0x7f0000000000)) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = getpid() syz_clone3(&(0x7f0000001540)={0x300002c00, 0x0, 0x0, &(0x7f00000013c0)=0x0, {0x6}, 0x0, 0x0, &(0x7f0000001600)=""/216, &(0x7f0000001500)=[0x0, 0xffffffffffffffff, r2, 0xffffffffffffffff, 0x0], 0x5}, 0x58) prctl$PR_SCHED_CORE(0x3e, 0x0, r3, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r5 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r5, &(0x7f00000015c0), 0x0, 0xf2, 0x207fff) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000017c0), 0x2, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @remote, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x8, 0x3a, 0x40, @remote, @local, {[], "8000000000000000"}}}}}, 0x0) 3.086434598s ago: executing program 6 (id=5136): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x2010, r0, 0xa94000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) ioctl$CEC_TRANSMIT(0xffffffffffffffff, 0xc0386105, &(0x7f0000000280)={0x40000000001, 0x1, 0x100004, 0xfff, 0xfffffff5, 0x5, "0f6d00", 0x0, 0x5, 0x0, 0x4, 0x0, 0x4, 0xff}) fsopen(0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x8, 0xfffffffe}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x1c) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) 2.694621963s ago: executing program 2 (id=5137): socket(0x2, 0x80805, 0x0) syz_usb_connect(0x5, 0x27, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b75c7f40470501026411010203010902120001000000000904"], 0x0) syz_emit_ethernet(0x86, 0x0, 0x0) r0 = syz_open_dev$I2C(&(0x7f00000000c0), 0x1, 0x2003) ioctl$I2C_FUNCS(r0, 0x705, &(0x7f0000000040)=0xfffffeff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=@ipv4_delroute={0x4c, 0x19, 0x901, 0x70bd29, 0x80, {0x2, 0x18, 0x10, 0x0, 0x0, 0x4, 0xfd, 0x1, 0x1000}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @private=0xa010102}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_SRC={0x14, 0x3, @private0}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) 2.286734797s ago: executing program 0 (id=5138): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000009006000000000000000000000a44000000090a050600000000000000000100000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001405000d404600000014000000110001"], 0x6c}}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r4, 0x0, 0x6, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x427a7000) write$cgroup_devices(r4, 0x0, 0x6) write(r2, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r4, 0x0) r6 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f0000000040)) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f0000000080)) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000c000000000000000000008018110000", @ANYRES32, @ANYBLOB="0200000000000000b702000014000000b70300003f0000008500000083000000bf0920000000000055490100000000009500000000000000bf91000000000000b7020000000000008500"], 0x0, 0xb, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, 0x0, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e20, @rand_addr=0x64010100}, {0x2, 0x4a2c, @remote}, {0x2, 0x4e25, @multicast2}, 0x204, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x200003, 0x2, 0x2}) write$tun(r7, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) close_range(r2, r1, 0x0) 2.256801868s ago: executing program 5 (id=5139): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x101640, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r1, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) syz_open_dev$I2C(&(0x7f0000000140), 0x6, 0x4843) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x4, 0x0, 0x1, 0x3, 0x5c, 0xfa11, 0xffffffff}, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = memfd_create(0x0, 0x3) write$binfmt_script(r4, 0x0, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f00000002c0)=@userptr={0x0, 0xa, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "d39bce7d"}, 0x4, 0x2, {0x0}}) r5 = add_key$user(&(0x7f0000000100), &(0x7f0000000180)={'syz', 0x1}, &(0x7f00000001c0)="00de3d08e78e80e65cde178644632c0237414825d17013fc2b2382ba1ac493d13c2dd17619c9d1ded6", 0x29, 0x0) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) r7 = fanotify_init(0x200, 0x0) fanotify_mark(r7, 0x201, 0x40000036, r6, 0x0) fanotify_mark(r7, 0x2, 0x48000001, r6, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r5, 0xffffffffffffffff, 0x5b) setrlimit(0x40000000000008, &(0x7f0000000000)) r8 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000e80)=@nat={'nat\x00', 0x8, 0x5, 0x628, 0x208, 0x2f8, 0xffffffff, 0x0, 0x0, 0x558, 0x558, 0xffffffff, 0x558, 0x558, 0x5, 0x0, {[{{@uncond, 0xb7030000, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x1d, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv6=@private0, @port, @gre_key}}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, [0x80000000, 0xffffffff, 0x0, 0xff000000], [0xff, 0x0, 0xffffff00, 0xffffffff], 'veth0_to_hsr\x00', 'nr0\x00', {}, {0xff}, 0x33, 0x4, 0x7, 0x42}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@unspec=@connlabel={{0x28}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x1, @ipv4=@remote, @ipv6=@dev={0xfe, 0x80, '\x00', 0xc}, @icmp_id, @icmp_id}}}, {{@ipv6={@mcast1, @local, [], [], 'wg1\x00', 'virt_wifi0\x00'}, 0x0, 0xa8, 0xf0}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x0, @ipv6=@mcast1, @ipv4=@empty, @gre_key=0x6, @gre_key=0x40}}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @empty}, [], [], 'dummy0\x00', 'pimreg1\x00', {}, {}, 0x0, 0x0, 0x7}, 0x0, 0x218, 0x260, 0x0, {}, [@common=@inet=@sctp={{0x148}, {[], [], [], 0x0, [{}, {}, {0x0, 0x0, 0x40}]}}, @common=@mh={{0x28}, {"0c06"}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x0, @ipv4=@multicast1, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id, @port=0x4e20}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x688) r9 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r9, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e20, 0x10, @mcast2}, 0x1c) sendmmsg$inet6(r9, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f0000001280)=[{&(0x7f00000014c0)='\x00', 0x1}], 0x1}}], 0x1, 0x400c405) 1.152506573s ago: executing program 0 (id=5140): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000005c0)={0x0, @in={{0x2, 0x4e23, @multicast2}}, [0x5, 0x957f, 0x3ff, 0x8, 0xe, 0x1, 0x1, 0x21, 0x0, 0x100, 0x3a22c911, 0x9, 0x7, 0x6, 0xc3]}, &(0x7f00000006c0)=0xfc) 1.027003441s ago: executing program 2 (id=5141): syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 889.36053ms ago: executing program 2 (id=5142): writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000280)="390000001300090468fe0700000000001000ff3f04000000480100100000000004002b00", 0x24}], 0x1) mkdir(&(0x7f0000000000)='./gadget\x00', 0x1ff) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000080)=@buf) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)={0x3c, r3, 0x211, 0x4, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @remote}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x3c}}, 0x804) 881.169291ms ago: executing program 0 (id=5143): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x34, 0x12, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}], {0x14}}, 0x5c}}, 0x0) 797.085532ms ago: executing program 1 (id=5144): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x10000) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x3, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0x4c841}, 0x802) 705.873857ms ago: executing program 2 (id=5145): r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) sendfile(r1, r0, &(0x7f0000002080)=0x58, 0x12) pwritev(r1, &(0x7f0000000640)=[{&(0x7f0000000100)="ea8c82f9e77f8604d4a97969c43269745144ea6ca358208309446e4432d65e3088e0144d3735aee4c2c8c1868843bb4a531e2f601de9ea16ab32f828bd708e0ba154299ef44a672f5ba354ce727fd10f28d3ab8074653854571e486edbabf63a3cab900abf1d104966774a02290f9a069ef5205bde800a40c7f3cab43774455f5b92c226c0642242cc09d8556e13466adf3509584f20918f7b6a16bfe7a5dcd3bfad53be7d3fdc7df6d9c0c2", 0xac}, {0x0}], 0x2, 0x3815, 0x1) 599.0912ms ago: executing program 0 (id=5146): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x7e6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x163a42, 0x8) write(r2, &(0x7f0000000180)='10000', 0x5) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) write$dsp(0xffffffffffffffff, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) 586.551375ms ago: executing program 6 (id=5147): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000009006000000000000000000000a44000000090a050600000000000000000100000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001405000d404600000014000000110001"], 0x6c}}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r3, 0x0, 0x6, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x427a7000) write$cgroup_devices(r3, 0x0, 0x6) write(r1, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r3, 0x0) r5 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000040)) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000080)) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000c000000000000000000008018110000", @ANYRES32, @ANYBLOB="0200000000000000b702000014000000b70300003f0000008500000083000000bf0920000000000055490100000000009500000000000000bf91000000000000b7020000000000008500"], 0x0, 0xb, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, 0x0, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r7 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket$packet(0x11, 0x2, 0x300) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000005900)={'gre0\x00', &(0x7f00000066c0)={'tunl0\x00', 0x0, 0x700, 0x8000, 0x81, 0x3, {{0x3d, 0x4, 0x2, 0x20, 0xf4, 0x68, 0x0, 0xf6, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, {[@timestamp_addr={0x44, 0x24, 0xc8, 0x1, 0x0, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}, {@multicast2, 0x8}, {@dev={0xac, 0x14, 0x14, 0x27}, 0x3592}, {@local, 0xf62b}]}, @timestamp_prespec={0x44, 0x1c, 0xf, 0x3, 0x6, [{@local, 0x1}, {@rand_addr=0x64010102, 0x7}, {@multicast2, 0x80000001}]}, @rr={0x7, 0x13, 0xa7, [@private=0xa010101, @local, @multicast1, @private=0xa010100]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x2c, 0x3a, 0x0, 0x0, [0x6, 0x6, 0x80, 0x8, 0x40, 0x200, 0x3552, 0x2, 0x8, 0xff]}, @timestamp_prespec={0x44, 0x24, 0x98, 0x3, 0x6, [{@local, 0x80000001}, {@local, 0xe797c3}, {@local, 0xc}, {@remote, 0x42}]}, @cipso={0x86, 0x34, 0x2, [{0x0, 0x2}, {0x5, 0xf, "a559cda35133d3428511233c33"}, {0x1, 0xf, "9827db67a76396fb3fef54f868"}, {0x2, 0x7, "787be8267f"}, {0x5, 0x7, "caec5f5a51"}]}, @noop, @ra={0x94, 0x4, 0x1}]}}}}}) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e20, @rand_addr=0x64010100}, {0x2, 0x4a2c, @remote}, {0x2, 0x4e25, @multicast2}, 0x204, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x200003, 0x2, 0x2}) write$tun(r6, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) 497.854216ms ago: executing program 2 (id=5148): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x80000004, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1, 0x8000, 0x10000}, 0x28) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, 0x0) r3 = syz_usb_connect$hid(0x1, 0x6e, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1b1c, 0x1b3e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x420, 0x8, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000040)={0x18, &(0x7f00000005c0)={0x20, 0x2, 0x28, {0x28, 0x23, "83efb930f0187ff0478fa22a61a54607950000e442359c479c37f525cde38bef0d15f9366b48"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000680)=ANY=[@ANYRES16, @ANYBLOB="01002dbd7000fddbdf256c00000008000300", @ANYRES32], 0x5c}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) r4 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000940), 0x0, 0x40002021, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0x2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000008c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000388a83b0081000200080046010028007c00000b2190787f000001ac1414aa0703ac004e214e23040190782ca659e501dc91ac"], 0x0) 496.401839ms ago: executing program 1 (id=5149): syz_io_uring_setup(0xf0c, 0x0, 0x0, 0x0, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0x2) r1 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24) listen(r0, 0xa) connect$rxrpc(r1, &(0x7f0000000100)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24) sendmsg(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "010000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0) sendmsg(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) sendmsg(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000001200)=[{&(0x7f0000001300)='re', 0x2}], 0x1, &(0x7f0000001400)=[{0x18, 0x110, 0x1, "0100000000"}], 0x18}, 0x0) recvmsg(r1, &(0x7f0000001500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001800)=""/100, 0x64}, 0x12) 282.684655ms ago: executing program 1 (id=5150): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x7, 0x0, 0x2, 0x89, 0x8, 0xb319, 0x3}, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x6000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e21, 0x2, @empty, 0x8ac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) r4 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x3c, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e1e, 0xfffffffe, 'wlc\x00', 0x1a, 0x401, 0x29}, 0x46) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, 0x0, &(0x7f0000000000)) r5 = socket$inet_smc(0x2b, 0x1, 0x0) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r1, 0x0) getsockopt$inet_mreqsrc(r5, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x8) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000580)="25aabe0b0e63b1483f97debcc7bf87289133fbfd204ca9a4b0f42bcb82c0409f07e5fce7d411983bc35d28ec66db94631af9035585a9a9d10392276a596f7963d598cee98a84feb35afb9ce9b9fcbbcce2f9d1de3cb3f5c8e907a1b9d6358022001c74f3ee957aea0263fc1cab498315656ad08fc09671128bc960f63deaed4851c8756de434649d26f9bc2573ffd39c32924c967518897ed558f81a23a0c349bfc620f5615ed1b55fd3b6716b64462c424bf168f59d23ce70919c27f1789b4b992a5e850cbc45b93078baf298c324dd9ba26b854107c377346e6f2a1f3e635674dc6c8c637d9d", 0xe7}], 0x1}}], 0x1, 0x40) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x9) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x9, 0x0, 0x3, 0x0, 0xa1d, 0x800000000068ff, 0x5, 0x1b, 0x3, 0xa, 0x0, 0x10000000000000], 0x30000, 0x4a006}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000200)={{0x84, @empty, 0x4e21, 0x3, 'lc\x00', 0xc, 0x9, 0x63}, {@private=0xa010102, 0x4623, 0x4, 0x100000cd, 0x12d5f, 0x3}}, 0x44) 254.281935ms ago: executing program 0 (id=5151): mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xfffffe14) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x8, 0x10208, 0x83, 0xffff, 0x4, 0xabe6, 0x0, 0x0, 0x8, 0x8001}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, 0x0) syz_fuse_handle_req(r0, &(0x7f0000004200)="a28096c80abf3543ecde7564abff5085d2227ebcb0f164ae92706ad0b083a3f469a3efd15b4921e9c3063b98b3082068e7c31950dde842eac55df0f991453cad62a6956b0b6f7b8cf49b506a3060fe1127eca99663ade8efa89ee189acb5f3b92f6bc4c46621c803eed0d0bb5f32384870ed08f89d4f74445762fb99715e083c4c92a8878be19ffacc30d0f2da64f971cd40563163adc15670ecf25cd3ad96138967c4b53ad9d04b5193ab5fb674aa0030a9d703d1baf810ce897f969121f142161919e583c275671b999e7f363891dfdfdf3556d01b86ee29eca8fccbfeaf1771395148706cc6e6be7ce29fc9ffef061b5420950c1a525bf75ad06edec51538d1c5bbc77da72dc90fd9998936fffdda2427e5a68966c7e2208f76304680182ec73007e482f034195712af922db2726195d997708734db9e7825a864be00b2a4f800881fc0363f5e618398454f35b148b4ccb88d418269fac868a8ba4a2d5b4f06a1ac01b5ad158b842e05adca22c7372585bf4ce95560b6c1e021a3ed2ff7bd3b6b3c7734c3b66d7e4c460096312082f89b16baa6e73814aa60925780cd92cd65087e260ec046fc363264366a9df2c849c0644911303946adad544521ceb469a3e193ecc9a7876403fac461a4a70d6193b2451189a5c5120b3535e9edf619108af7f517b58abd3fa7fb1ab832213430d2e6901076fba9c9e1acc6c6f48ff0e419bbc45589745a176f52a7407ad5e3dd49acb31b47862806f47077dda04905e45a80a12cbcd4d2dd9fe66c2d1f99394fed8ec60961cd2dc7115a96ece432fac86d51bebb08b95f447a83792fe80291fca7b298c9043ef2c26f0f7e42798d3f54c84b94c24c76c555d83ecc53b99bb22d71845e5cf21a5ba7fbeffeb6306e1730db14561b950a3f24bcfd78d4ab0d97de8054bb1a6077ae7cca6e45d846d3df82298d07212922742cb0facac3b77edfbab90e9ee2d4f7b0ee9b17bb11ec5e5721340d84cb6bd93428167e69b47759172557acda313c3decdfc6fe9336bfade459f43b39d0f2289f9142db280f4ee668e650e12858c577e12e2b9a57ee66c834be97979bcbe94747fa5d8d0b7d3a9f8f218df1bf960f828429a1efe838616b18faf6629236ddbded43a093efae163228e5c38fd7714743c2fcca47e3382bcfb1ab893fd7377527b4ec43f3fa60ebd338161d8de7cad65b15579e4af258f5fe3a63c2637a15703207029b0899b5427767647baef11e291358e6e54f6f13d3d2ca7a5e7969e04d2733b3b9ab822c69a3cfac097384de5071a9b74a656136d55eb190df08747b509fd610ff62b4950ef71c934fe21a48a4931d3d9458b415f112cee65c660f5490e982341da1c58634b3967ca6f3596d20cc90f508382156e36f16539093240ef5f2aa6a2c0dff2a67df30dcf50bf6e0b82a3d49f2d532a8dde1b3ceefcf0837190b74186090d1c18b59917d7efce1adfb238ef4a7b1d22c4cef09320221de883e97e6882466508de06fcdabad3b741bdca2cff879d57ddda52f42b3dcb8a78cfc05826af7e4ff155960ff8491194f4d321ef195990abaeeefdcb852d1e1e3703f317385a9458b6c2dd9db830f757ec29c9939fc7313e639fe485bc1e41ddaaef3fbf1f7cc527c8fad0d21b8082482caad7bee440e5097665f636c3dfec82f8c98afb6243bc3944939675a594277d278ba4361461f7da52e224e4ce5dee4a467bf6ae9f67b61ac6eb0a440406abac2016eec907e241c57f5f44be47290fd0fef785ff04df3810ccd637b4d97a84bae8486a36f75d872e645fe46625969fc2d1f032c56ed44bd98ea27bd9b6ddc8eb2dc2ec9f90f2f1ca1bd20e37ac58b03c84c872f4ba47310654986641460dfdd531ac62a76ad87b89c103ac5c9c2e7e70c66447b3412d4a1e5cbc30e16939505116c04de33ae054ed366de8d1f971c2de439957a194e22a488f58d7efd46439177f3f3c45a1475927eecd846d3d2e6a2ab5c7f8addd99062c2fc6b272d1f51bb8f22f1b6f8bb3faf8aa85e5eb9abf7df5cf8f26267323808b0833a987989cbe59205e7ad06556e2d1b8a4873ca1cbcbc8d43abc145fd4eb832e7a58ab2c793d003ce7b1850ce45eb7480417a1e9eb9d39a1028a2a04a2aa649c098c4f8eee514db5f6021173bb254b8e22b150b2ca01dc7ff235db46ed78d07f43d1adab13b8445d1b32069eb45f9d389fcf5a3f7d3ebe243c5b1fe17b1f5a3d571b65f21b9e471e818172554dc956749b99cb7a5f303ec480d7194a2ba86e204f06aa1becdddc8c49082c527e7064ac2ad77dc05639d3d2a7778f6943ed6105ebf6f0b9e94fddbe05c236ec000f4d1d4e496b10068211ab68ada4c7f7ac61f5f5ba5f1810d5bbe87ff4f8356af0d3f682baedb0ad8f8488b277421f0a03fc5e3095ee34bc4472d8f17e3f7013cf2f79f5ff3ea4b6bae56d1365a33b09bfa9a496323f7da923b7e29dce4beb81035f13130004c96e56d7ef6ca6c101d20c27a218e623227c33c9e488b17e7ae9ac20da8240501f7b614a1730f164553fe479ef149866e4ea47296814284a3d3eb7cbb294289ffb996e0eb053b9c16e54cf267832e3d360eb196ed51305630223309ea97215628f01ec9d3ea48096418d5e962cac5063460f0a18772ec7ce66d14a1cce14b52c40bbbfafccbf1e76f09e57ff0718048e5b993157a6cf4718826b1e09430413a3596a15c4a620fa8c8e1d1663e5739f9f790ddbb3be0e00187d43717d659242467d8681ac10303346157f894d9037641417010e9654c6a5b22263e73a5a37128f50078a980c30930321aa5c5e7851d5d392ddce3a14a96916fa8421ae6728f37f5de7c3e98feb4babd4e1bd2315d595e209d52748f70adc2284fcdaa6ad880470d2a071f3490aaf3491fb64b4547419e8eccdc491a8921156cb4811ad1e66514a32b0b31b641438881f28c1e6461b4f451938999af671e8c6a5cd0c072a9fe4cdbefe24ca616f3d0a15ac97cca835b1a440e04fa28340c6044176c8ecc8ee0d033d47db8a0aacfa0eabdfa1c9509fc2604008f01cbafeb5bd2b503b809ed672340b9a576593f1ef388391b54b605e7a15bef7b1345627a34fca57738b0f8f4f19eea93c903495274a4425a1a1cc6c4c6e335b631df5185c95b485e4257867b5347a40e4e14dcc560f061fd4fd265137dc68afd548adde778f1330f769acb1ccf5da14ff6992c24e210ea6e6179421881b803393bc6974e37106c5b5b3b5d0b3469f8969bffb7e4ceb2c98e928e74366492d27235ae4c74a2f48511aeeaa53a2beafa7a331b50e454c507af1b63350a5cef35668a5b9325014192277e509561008b3601088f79d42eaa8b1e4ae2000b31749e2b8094312ddb7f3c1cd625ef885c11fa22a66e374b52b3425e0b8016154e1fd8471339e32e7373d63ab646d893fbe09ae07b06074c01401ea76b3c382a9d32f24f93c789964e16bc4206ecd75c10917ab84ffd8d6cdf4cd28fd90375ff28518f8c1a3befc538e1b9e427fb671988d29f2fb2fcd039f4d341c84eb4d7cf600ddaba88bb094e4d87a1419180149f491368e648b69985b05ac39a4ecdd3c5135f3a5c8ad7792dacb6470144bb9e67805a211efb3ec9ccaf8e0901345fb19e4da579e1fbe86a1207f4f13c3436009c2c640b7cf3f8b77ca7bd994bf93308027359c6dd1b7db1e153fc0821968ef36c003b6c73fe890f4de24f5c6458dbaaf3819edeaa91783c3cfc7e773689236248195c7bbd60113f2476fa3687621d668d1728ee433d2f8f4db707345d30f1e52ab87a2a0afd547c6bb06500f59f17facde48f693490e22494b75d11df1a143b85068d143ef6a9bb5937a9df380c8948f1a01e9675e18409edb0f6b9605b68e34632fcce472dc50b90b0f6dcd57931f78e1e8861a0fb62e72b0baad6f9d23c1cfb0f19b25013c8d9fcd786a2f6f79768b5fb398f7b2baa31ce8156d1fc4a46c1c463fdf30360d42aeed2ef11611d0b7f654bb51052fd4dc39328f8ec4c58bbda05e6f1b3c8f6d8adca0268f2410e9a4a7d63b6616006d0e02f6edacc10e5c54fd85f15a8bd7648a293f23d6a699bd9a675250475a73a96d7475e4fabb89fb5e7de5d7a3479aa485c0befc60d0ac4fd5ac6dbecceb06cad86e219fc0ce4720758917811a3215f8d13e413bfb64fc065fc421aede0b56691797dac428c7e463479fa591b9072c309b7533e427c5cc11a1f6cf9a5b995d328d796d874c5b55dfc12a5039b413ce319cf5ba1f355c4e0717d32650b43e18010f37f048731931c52c4f36eb969dda702afe96c2a5241350a67ba2d026946189c5e281293c9a8e2cff3784776f1de78b917101b54e5ab00c045ea15f28a0e3f509962cf8bd3385d85250737eae5c34ece86b86669c13b00308a3b13c0ac3c83ff26fb52a4aa83c1233a9490cb9ca917a056908931751bddb88a62379a713395f0764e4a393faf253a4026d0472270e6036287d56850df1751543484d65b3062155b6300e0024241c59a862ae769c1a9232a2d9fb24705177a09cceb3eefbf9f106f67e01be14cdeb4d2fc7d8661df3e75de5ccd09a7e559f028fb9837c621ea0045b4d1b679067f246339c974631aa7134d4e910efb28d3c48929cef1df7e6c73668762d55086b6c59c36ac90154135fd7ca4e4047dd0aa161fa982d8edf9c0cb9666477e096c55718f6e4742415fefd4f696d1f1ccd6322bc19496ddebd36282a7c707d5b44113e30678e6e33ab7d34be04a59ac614d6a54134490998be02636fa91633d6294781c2b9a54c611c0045cfcfe81f49aa21b29d835cd2047c854486fd8e65a2ebf629f7ced602b9dd107bfde483e5c9b5cbba4a08cdce09920bda9978b7fc2b4a89bf1573a26389e52090fdf5dccf22111dc8c42fd3c8c477092895398086cc22cca665269e193fc650742a361a44b857d258429f701f22e9b7615bc3dab78c1479a41cf8575cdb17169470b347adfc03e03daea3e269725cfc72df5664b9df36d2f2b55013b71133e0b80577a47182511ebb308b6248d457bd2af7b28e77182c305241178c4124ab102771fd5a8c3dacb8775de881301d71587c76bcf0a97a72ad244d0c42fd71aceec32dd48bb5c9a95b391166c832ac5bac8c7cae4d18b3f7d9f2e4782fdf97732e3d51f67bbb57f989ee0d7589dbd0c2a5c63840e914b9d7d720fa120acbffebf816b588b2ccc052e7fa78992e0ea39dd21a122add41195f8e2e1acd777c1a4e8ef4362fef441feb4d9252c6bfbd2742152300a32027776e3341620d3c8d9365e10e81adcca7d87a0e555c98a0353c692557d90ee9be3fbaab766abf93e2462149fd99c92a5fc58d899ee75535cd1fe1386c5ab0b157c2102039d6015258f59cef3f15b951893a30ae839f740402a30b34e7be73796286403c5beb0853d856d83f1b00b48328f56dcb32e1faab08a3435b1482bf18b21c95aefeaafa7fd761c7f28d416fcde06bf7aee5c6e9eb50e55874253ba3f1d0ce2505b4fc7c3fc996bfbb8446bafe84f5bea94bfd7ca5aeaf237fe793b66e5c521d4092e4e1f9bde1dfcfe53fa55005d21cfa833a338fd9792614129336060e10d1911862070761aa20c2902eb7c5a355eff4cf6253d7102a2ca1fead4c53b57d576d104c081310d92797e4e2e8c269d19910d0d4cedf30fa28ba680c00137f83de940624229b6a125ce5233c6cf4a3640b74f58f288dad8451fbe37641c5559a5f3caf1299c8bfb230723652278fe378efd8e459b9da26cffeb58468a6301dbc06d713ba2d8d43d9038f5f2dc8b831ba58a88eeb5b1786b21e398aeeeb7c1f3d6f01d82b3947862fb9e7cbd7da5d04c5fcd34da28d53e2246e3ac1e3a619ad174efa6435eaa0fc94d610799ce0158421dce046306eb5042143daa336d52206b12610ea6389cdda49bf5af1d4ee42ac090a94ae7b7612073f3a5c36a2205eda887f41478f7d20f18667f941f71eebcfa76c1ab28f2a49a3bd56bd3f4e6bd079ab3fe2d94782236e83585a03e52907abaef7456a95d5d3f3d37efdc035dbfd7c41b8ba0af2df8adf1cf24f7ff0beccd3d26bc91caf42314ef7e466f74e19ae0df2e2298fc2f694a7ec134632035585d530e7e19f65c256f001d75382d9825ef741bc213af186377d9ca10d3722354e1897ca5c23ac6a52c9ad0e6b686e1776f7ec65df033e8f4d5db80c1bc354093b319cb70df93d610667675816328c99322f14e636b95f04e6497f139d508b453f53ddb5c289d849fd5407c9bdcefd1642abd46e28cb4e94371bdc606eeb67c9fe17747c68f2d50e82711da4d3edb0eda06f41b7f93fa8fb4d83cf21c79da67000bac2275508217ade1659fa8d24e5f8efb9f4bd21073ebef3d06368eb03fa3cf0d638448bd055ed20d292033ffdba538559c8ff9a2a5c8f83b5c393643d6585d1df994c3be43e72b8f3f53114d2a5f6bcedb573842b23b6a3eb7fca8495bf03bd03fde7b19bd39a16cec49e01f38e671af33cae082d9788e3202799bc466babec2080528d0609c0b731964719093735b4c1e73bd0705637c47516922197c552baeaf3516b5e3bbc2cd1afa3ef8215196ed580d9561092f620b897e98e786a0c7cbb0eedda8063292ba6482497f5f6bb62fb5ab4c97cb7658dc6579718eb97b547fcf47ced1426561af93a15fb4dc6d3d93b868644943c2c94b23b0570bbb81df2666c24f5abccfcdd71e209f3bb43c01d17f9bc8b9af2c26762fc6a741a150b7d1186e4f35175f3c315243e1c11e92c43a1fc492eef5a13c77a81fcf514ebfd0f8e645dae15a07e86b2f01fda065db4505a5eea83cb616f744f6bee731be191c65449c02603556d5a51422cf9c2f19f8d6843e0c1091e0708aa271e91f71c8602b9fa72189e036b7cb6af1569f21269283de94a6d7fe5849fd433d5b719c80419873db0587fc29786cc598d896fb16360bddd2ce12e54d05418f4f5e5f2d7aafe9fcd6268cbe2e9e6329ffb6c67fab8f3ce673028cc06aaa6b857556bba3b44d3fab5b6e875e70a2f3ad4b2ff76f31ead3462d3801ba373b3c2f545e94f57021575e2947f81f53283fc0a5137fd44fa3d074c92de54a0a3465c858f5a7ef08313faddbc3663e4e0167f3cba39612057a7518fbfb031f5ad0f9f75831973ebd733b82e554bf3fdec84e51f65dab6028c6c51366d9d4700fdf255e4c7bd70766e7f2281b3f2a5363f85ce49f9135904d14bcb117ad754c2594dcdca2d30e40ff265b5accfb116f64ed99aad570c4c5a91efdbb984ac651d8721405a0342cf77f448c17a152eabf29e88950558a86d0074e1cefab1eb7c366682f686ee1338737e675ea58eb8b4c86b9f28a6f6e96459f29e3b4dc59ff044c61a0dcc5c31d803e6e98420e446229ccdec3d0f705e92ffe016bb3696373eadab7f35ccf65ab4d9be09a085ce21bbd7c0555376e4d7fe68b5e7a64f48b5127825fb2be598d991f9c1a54bf52713417dcc599e812d85513a537e6eafa738edc972b67e065595d11678449bce6cd3d69800a649b560d0e057c502ca3e72e97820829ecfea801192c3f4e2c8763c095a43ee6fe45fe8730130937668df1d4ee577ada28238be03286481f2d2a004cc4d48856e71fbd64f1a0043a4520ecbbf1b3abdc96b87a27be8495a20542967aa4cd3a44a11502419a083d84e97abfde0901b66dde48388649a0ed6d93b9f20c530e990c7c52370a114d800d6ab3f6687d6bbc105b63738fe05fa6cac98ad6663936bb18cb923264e44312c24c2ce8e642bb73c921012b68a26a70977446b8f15f9d62467d8b356560c183a6bd6cd76ec868c3bd94a595cd7bf996755a508a814980c5e588b275200c45afd900c8c2de329ec2484b0e3ecd7b0960e5e3425881d1ff7f8bd8b20f5cc98ffc3acb77f5e88775a4bd3ab9f9eb027e27d3af55ebdf4eebab48ea911128d668d00fc3f5b5480aa0d9a4af563ba577384448e5425157133d59e1cef3c722f33700bd372825046b1fa5824e405154a3af1440bc2b75acfbd07cf92e8c162587e74b5ab66b1c6aeab3ad5fa3ee91da4900ef30ad04baea326df912517dd96e1696b4a91faa66675978a375e81f25464a1073dc6737af08d7e25956bb31d438548a7da38662d49db812a8cf1d6cc65f5c63879fd9ee7fd2a66ca3fc1a768cb239aab88c87206470b4c60592afeb6d69ed97a8f990155862ba4e22b64804142c131a23792937aa8a8696e165c24d7692a04bb4471b0f0d2507fe7c8618421428fc7a0acc984ca5cc6bacb772e8a717bbaa646f9643275910a6037afaf5a80678d18edda138a4e13d06d04a5d06431eab48738225cf1567e960e765728dc12e91b91c6f2b33dfb6e033aa68c1c2334d24335abc4a7a1df5636dec29091da54d5f5a1fff41e4a35a0c2f04f968f7d78e2f51c73577e2192bb20f289aaba5a175c2ed533855bd9ed9a842ad482136dd5e0cf45eb5e2d31ff62a3be1cf8a94a58316e74f4ab9fc54f3a0bb83beef0f355993bdea2c83e61cdc796bf2564ae51fae616799e8711998cd88d35cd9824452fdd65226174b46792cb87f4dd282e4e6f67eb66da413ad877ed6ce775f7e19bc93f48bb9e5ec04009de3c042aeacf7f4b25ad6b30e017303f64fe07ac79e8744aab6926d117f13513d0469cef335fe1d0d787c2d0b2c031a9521786ac10e9f8b768271680337f2c3262abdccb5d3107c632bf1f74c83ee91f49988222fb080cc8faa9b1a02526d8b6087e0b2354173d29016b3309587c16f057dd812aa63c3169150de81f3af97d082a8f8da4ce4f909ff649821d7f96d97613552e8cc4902e046ecfa329b1d980ff5ece69b8f1615fdff5244f41cec0af924624ae1641ecae5fa26c5fb9006e57100ee71377ced7c255ae17a0845e2ee0287c62c1852f93877f9f86157ca9675d383fff5cd6f2b001ec0136c07cf37f5ace1853122c2baa1092d418e2a490c4a5c8f56b828ce1bafeef4e77f095d6b4ed99d56f66812cb19be540ebe5d52e7eff2d69cbb8477e11514f7e3604bf9999f78c2f1ca6f60a2216b87fa0f25269c425b7d50709b200912b3b7899c95e12d6e9c4dacc19e327721860e0477a53e6793fbb7fb9704a848f395f48c24a6e79b9e1358cc3497251de88b8d3a7b22c6d8af1a7fab81530d9f0cc98f62debb222b54780d89794238532717b447d71b46a60ed481c21db85b590b31720009695ecffd4ef029964e5d5149622233ac013e960a005c924f73ea82c318455546c53d74aa3f7e2ff26aa074c40a55aba8b08027fc19b596eec6c4f89bae39e74b9aad88344f7cc5ad3eefa5095f2ab47222e9a357ecd71c6700ac576025201490d9e446603dfd4bda7617dd500981b2d2ab8c43882a5208494cb3f8ebc720bca8a7cf6c80bd7aaaf89507bb3412ea490a78973f12cc30413e9df1458917ea3d68b438d424c1314bc8d01939c5a5a842438281e62d0c800dee704b2a6cd3e1e4b885a6b26b894a98765fa3308c9e4b87f93625faecdb17c29a27cd243bf6030a67874ec9f2443cf8154261ac2a834c01cbe1f314ee7aa3ca552e1648cf8b42a63f249e3538026e09e44d69dc259adb0d1a0cbccb5a5dd5d0dccc90d023da79d5634188ff060f7e35a5f9d7ad99546824d63975d4452de876093f4e997dc46eedcd80a9eebf5e4f077fbb10c7d9e19a3419e7b845972a3b62613c5404a209b16fa88e0ff49d7b4f21fecc1f773c5b4be61021e0cab8602c6e8257649303aaeafcbb178e7a460ff07f219c46eb6fe5bf8113723e454003bd707767c107daf4255751daaf8decf35262640058924eb6587868b2c08230b317e97396ebc928ba8d274ca0eed0bfcb637676003c64e8c1e1a0420b6c96a44226061ced41b8448382abd2f3d0c472afcde231fbc9ee90c2f1132f8e2391246f95ad93354c7460e20de996ad0f61b13b27646887a637cede90b94b7d8c3130f0fe060e8d955c711a2700b302a75bdeb32a0a6802ea795cb114f5f82a1a381a86bbff88b299e47728b746dff964c94c52b661b9429376b1320b46081426b7c340206dc0da151bf84be2a49e78b6b5938753d2b1be8d9e67c43c5d70e72519f5f90d0500e84ee38f82b191ac4d968b0a37901fd923cb289d585693ac3c3f8a94fca6df45e694e199a9cd0b1bc1fa7394bcc96aae670dca6605a998793b7e067ac410ba631057b8b76fcbe9524df820c02efef1608b743cd2aa6d60d3d8e476fa12d3acc329f8272b087d89471177ed531fec1f9c24a975ca2fcd8c246a33e291a3f00b7f234052067a0059c86762475256bb5e7dac6f121a0925506b18933c6e314915d4b3b2130aafc2483ef22ff8bb7b887565b1bd22fabca22037d8fc9437f675c5313526266f60bb7c7c47f30c7d567ed142ea5ec367c4298328d20e5344f01c0c90cf8a6302f4d84b6ba7495fba314a05ba29b63bb6d458fdb05a4411136958309f418fb178e19aa09ff9e62b29732fb2986c96e738f7a688cb2122dbb8f2ad9a5f28bc49ec0c462413552afee8e403259b55ad6dc334dde7f2d306929dd01f2aa6036cafd41874522689301b81c9e50e86828894140356db0a3317b081ed9d8148c41e77e6bda6287762532b86eb91f5480915680deb8a91fb8656b7f0109064865d2b846af0861f67d3f720d6e306540cd7b68f095ef3690b88ea93fb6a402ff5697597cda83171f159e85307d1a8c01611189bd4eb4f0453ab88d43ae181a562a76902a67c687514079d6f4304d9a7c0fa24b6e86074ea0a9fd8187c120312078f5ebfa674adc0303734bf8f6b5585943706594192ad24c9f7d9794fb83758924f862855ddd50bff58b522c43d73c03289baec628cd693cab93101b1e473b76532510e10f03e86812fea6f2d6f5467dcf29e6d7cf8524f383a0ded3f0951c3ffb171a6b8a6d97b5fa8899a19f1a3d0e934a1d4741076e4394ba225158f697bf7d5651717c6950229a0be22e8120d76a414edbcd03d505264b7ede8272ccbd6dbdcebaf11daf6a652f6f9eb74ba7a3ecc942892891388005ae5d971e4e79d696564906dffd44845b704a9abc2fa5ba1bb69a548423a08044ad6d0e365db7e6bea0f3844a452759716cb98dcf326001ec90c1c343174098cdf47ea2e13341058ca014d2a30e9ba3c526de72a6e387181bf76a278c9cbc518d8c374a3f1d9802a39464a100903dbec16f8f095f5d82d9d09507281e4f7fe0ce4fbeced193902a5f658af2a4c1d0952dabdc6ae5830b6b5a2c3f5b8d33a73665990822e5f4a7ce5366755a1615543bdf78299c71e890e0bedb6ec277b10a389d6a3ba9c037221421279e51ab50fb115de2076cc99444202e88ebd9d0fbe4e60234b7b761495ac6c9e615ddac8176164a88fb6d6cc2b52672c8949afe3efc1e87a598896bc93e421423844fcaafe65af898a015b3bcaf623ebeef9a57155af5278ceb52b995f7ca466d9e18b05e86380679e0257cff6d0c6750078462f2ee4701d6d8289ed848b877cf5918625b7937060d667c11119881c30809056892352c6c53c01e395af6866ea350e6f21fa3db772c1177c759999973b51e11ffc5908", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x78, 0x0, 0x80, {0xc, 0x3, 0x0, {0xfffffffffffffffd, 0x0, 0xfffffffffffffffc, 0x0, 0x8, 0xffffffff, 0xfffffffe, 0x0, 0x80000, 0x8000, 0x0, 0x0, r2, 0x1, 0x3}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) syz_fuse_handle_req(r0, &(0x7f0000006340)="7c7a6a069306f2c5ddf91f36944f207a1bd11284b4445fa3507bbc5def2e6fec4bb7c6001eafe381e277221f30085acd5d0c251f7c60c23874c04db6aa516f773dd2e57e746d1a085193c8b7664fceb1fe764d87f4395c66e5d4eee443a555692ebe80f3a11b8be74963f1a18c1d0cd71dec65e609e065e14615d2e8b283e55b4aa8b485f81ce52443d61fac9f08cf34f2997c05a63f98f988cfcea9a5650b37dff5817e5033b3912c226bd9bf68b528dec710584242fbdcf7dd0d55e394d3742039e6960bb589fb9ba18ac8e9e82cdbd08e9b584d0a8224cae3e9dd91e25699549007dc0d99165a73cda1c99fc48f6bfdb900c60e4481222505c58cc1108fbaf317d361d1f2d78f6db6e14b283ca9f1927f4f8a0f6f52818be03c7b257aec57f06a0a4279131a2bb0a13b23ab188ea50a686abb2f7e4d0f7a166f358e4cb886b7fbdf51cd9a153410dcc4cc5db7e8e94cc9ba2371a328480ad20f51d7fa012f367a0a8f9c882c47b5f714f0e1b35f72b2261989513c1428d648aa8ab8c12c87dfea38d5be0d49097fce804c9cd2ac8f61b68579853129351e3bcdbdae3371d2b12a150d94b3097161c226c50a1d2c1f8b4c10a986e21dbbb854ad1d26d0ce5d950835d14664ee8f58c537f5256b761b4707fe8d46cc1658798d285310a1cff127b1280cab3f1f633569391d5a7cc08aa1d108b93c38df397d90bbb81753930934df7dcaf8f960dff660fe239aa15cf48872668cacf4d664dc0809fe9d780ab202c3a968abb56655267c907eb3343809b2407105a5c14d53a3b17a9a1552314d27e13daf48a2bb7b2c9fc15aba9ae1d6325c11fbe8432c067efa72878ca56c6463b6cf4d29646905422908a4a1f7741d0049febed4fc2b7cc27154031e50a0ab297826383935bef6a0f968db92128e8a940509b5368146bdcacc852b9d0b4ae9624635f9e69f3a7bc8e6f3340c7de46f49feb20a46f11aef464fa6696a60865bdd0c40b1c411c9661fa9f6393a33a7eb4afaef3eb1ab4634a42baeea780ac6c0c4fc8cf7a92cf0592f993ac85bdfd6c18ba4b7cf4c4438a8330413de8365b4a080234f59edefca0c5ce9697b20cc7b71d04438c00cf3d557bd03b5e1b86e167d2d6e09714135ef720667d0f2e7ca54da419d1bf6722eda31381059216009cd8c99ba1d7f9ebc1bc021457a195fa5be2f0727a84cf4cac5e080f22c836a4955d5ed06bee2eec0d39abc5f459ac43596fee3b341dfbd7ce6f4e57ea42e1e8d4f65880b8b77d2ee27dc1efe95ff1bacf5aa14933456b68645380d0f2ef6284b9946857456d64f4cb656998e99e3e286f596b31c69a69d0ee8444ed838ca2f0ead1be9538e4e927239d0e65a3f871dcad33881f69592eed93a9fafc934aefa67bb87d582d0ae4cfbb5c50325774bbc259a277749751228d3610f95fd56e9fbccb288eca1b14c8255b6996a59c91efbb08440ed91cdd53b0aab82600906904cee2a117a06157e24fa822e1cf4f9db4c2e8a5e842cfc503e578e69002fbae194b6bc7c8b69aac7359292109b712eb49d21946f5ea2745ab77ef59950dcfd926df2aef20e85f2a14554aabb417f15c725c73edd4853926ad6c525afa2c65de213cee799c18d1ced9424d10d7076fc5862579702a5f91031381f41cb8d9899ab514cfa1c8c51437df9710271d8cf69e8900921cba296703f1a7b5234500c1625884fea594d836a930b06142a6e577cd9c2a32cae65e712624abeeffc423a5d5ed7bd75fcb1a82ecec8acd0da9918a5c7c189f14f8cdf37062f93b87f9188501556060ffc6eac435cb1624f2af688316366e03cfb869eacf83d9d45fce910c3347f810b614c2e4291e70471ca2b574241c3f3d9740c6a45c7296a2f275acbde72e513ef4e5a1123a57c2eb1bd023af716c16a7747204338f60b6e3ac514af50b21952c21592aefb6149828a5183ba581d5ee8647f374645ff941bab67bef760ce353b456c4b51c5d3a0c5372b1773b944ad67a92937dd838e1b6f550a1dca975d6230e430bcc278afed54e0621008b2f850107b0244359e3747be5282630452d432e5df0fd160795effed150f9396a7da5a1e4dce0c8f62280ff2fbfaa813859a671208b4b9f05fe450729b0efad83a790acd688a90e5fee5550de4ddeac70ecd125ad076c4e2b68652e6ea520e2b6b339b4b9dc219d853e06b9aa79d022e53607213fc254e15ec3e6b776d2b562997e0fe52b98c58e1c0316b22a4219460053da87e7baff7dc1892c2de2f324dd1169b977f3a6698d0234c78de3e46ba5824f3e373f264e8d28fbb4cc108a41fdecd4b629d92b0a65f84366bf504eb5a894ba40c89f9df854dc469fa174ac85cb8d2adfdc099ca9848a1032b2e2f375bd1544dfb69e33492e1a4b921ad7ff17c4c7e357ff69f42d2301c302ee2ed313f0e9a20ebfe028a8737d6e38bf179940179cb779b70c2276264cb4f23249db7d5f179baa842b70f5b287cf74ce1ff6b70a56be8f2fe15aeadca229804923d28a793838bc605eaf5dcd362f757577ebdac54b09fd73326720d3522d002a41a3b5f2450f48286a5ea45836b5ee77fc415f47e0716049ec2610d607737fd5a73b066b4876f9d744f6b3486b088dd3bfc3d393a27c6c799ce078e2ee348257b5ec1ba9de76da2a67ca912dc2dd5afc70834ceecbb8bd41f6e790294cacd5891bef1b4e2124dcd6dffdedee8f16b3bddc030429dcb0f98e6fe0649cb14eed3293fa4933b2ab8c0ec0ff4dbbced1e32dceb317252e715b872b00478cbd7b0275b7394a0ccfe9887410b32f1ce9266b3b83470ec982cf908507d3ad0cc366bff3759388b624701b3e0dc0e7928386b155b50b42a8e352622516beeeddfb79866a2eb1d360802cd19d62fd171267a0fece5f54e315a8cd49c41072f2a7a0baab5aadae2c1ff28e285b642f8d3869321bd18b4aed107feaa12d055b179a8ab7b50e2796d287a196e280d527b526c45c8aa98696d88a02d923d06fedf51336c0695c218e70448073921971093ea44b5352e10ce6cec26d082b93f69958165bd986f56650a62224c2d9fd044bd8fefd33544c6bd141b4cc211a087fa57c09e195c8edffe559048db738d1395f5e2625dd7cd035b8c76aad6c238fb52a7c5ff0965fc7122a5899746ca88abd699d6078623722fff92726e18613519f2b1927504fd5cb7a38ffa373c3883022f0387953530834affb5f05e0f44c24caa75561b2b63994493ab857fdc30900586fed09298d846e5936869b43d81c4b91902028e57a8f2da16355ccb7a77d29ecc8e66015e979b2f3edc5b8d77c45348dea55c9ed6b7465acf899f4bc1a7edcae0b0daf69ff85c504eea1294620b6d3dbb004575044a5ae7c110010c2cf39827fbdab3b42ac35d147fc53bb5e7de6c47091dc80c14b8da494b2e913d1a52085e29af19edc4a417346c5a896a3851cb6132511e0627d190b77623c8a3bb6085eff22ede7127f7988a1d388fb70ea20d5c1b2424c5aa83532bc5162a5d177968b4a46583f2d4b92d04a5f19145221aeaf724d92ea1d4dfb53021b47585bbe5ce35f8d09a83e13fdb1de8e52dc646d41e810879ce9c830959c3ee93f11a16d030d141863244395e3f847505fe6d9594a34009fec9a743c033b9793335684cc5c3d0eb0ad094f40a60264b02cd88c583c850d99c5b9c6c5dcef467ca3ea38f2aa42f5657cd940aeb12960efa18d571e4f958b9cd90918e069a486d84f214617ce29c0f2c26bf84f12f5036f26a8de0c8359f572654bf5ee06d38f741c464976d95ae3fdda45c2ed2d08ef71d3590e82d235e0fa357c568158791a195d4a2d9615e1edc85be64cfd169f925ffc4f636f86783cf43624a77bdb9b172228097f02f391df00668dafbd9932298b23cfadfd1b8d14a25cb408a440f930f0813de73c1eb2eb4b3c802d718a672453d0038965c6dc98db96fb4e06f1fda72782d0839d4e8b477ebdb2c73510db44f643ec7dc4fcb837806853caa35cf622aff9d44381d3f7adae00650cbb6f0334ceca14ec982dfb5817d7fd49251c203b6463a09c14885f754603291ccf0a7ceaa57284ee751774fa5ad72f9f7a32fa542947af40601e98057895f2869d4ec2db0d73930962535fc9e12ba7e6777cb458592bee505b367012ebd27b256fa0fac1452cf3b28eab573549b7c7a13752ca0189768f738d5f8030fe999f7bdc466d67bb32937ae469f1a1e21fac2ae2ab92a0a260bf0e9ce20625e82f88d0ed4d13876aed768765d77433bb9137d92d622df502aef574de82fe28063128fe5a1787ced99734c2f3f221e80d3baefd367d01d950ee1bc981b4b5ff86b2a96ab78fa3c1201303cab473103d89bb185afc77dd2cb7ac1564045036fe9fcf85af5d73a7553bc45bf5e221564540982db2f81e612e7c1715d3498b8d7851c0160146d6eaae9e30c81dedfca8e7122fcb69b26b396629b723f1e1822b8d5d8f2ac583728a5ab40010f88aa42f37f2031a3e99d8d6661e63f86f65af521066ea6af89c89e1748521b8368cd03409e895a941025ee777653f55e66cd1a0cca21308666260c3b9a306ddadb322eb1d09f7b27fd570cd35b6ec88bb391e3ae4745e17fb4dd7aef1d75b4ebb91e6e7789b241566d7c0cc97a3a126ed50b0cb621e015414f62641afd85bad78470463f86d8287aa56d331911c23c4cae8e5dfea33f3789c03d61f51c590417b5ff9f1aa35ab6a15364296c5f9399216ce565210a4075ac5e43e916850774a127f9174d95b43d839e056b4a7d679bb8804951ca171c0b59f4d6f32c4fe8f908b9a1614591f5d1e1cf3348e02317ec4655c693417a4c4e7007a8db02faa1634f8eea9c9bbe5b149ce2279953a54884392dc7251dd38670fd59d9d1da5203340909d50f779e864339014bcb545d825cdcccedc558a1d01a2784b8f499ce9fa2ddb0dd1dc0b93d1b282a96cb4ecf152474dbc4b2853b30c8e5fcea85bdab949f5eb1e98d81c102c349f680230082db5aba9e20209c35b16598507d28211b49763b598a7e60519d5b28b67c027cb2657cf2ac7c7455291fcfe63f0b43afcd3afaea934da97c209d02e5b47a686c1c284aeee5d662fd9d9be7c576259d9f1a36fc0f7fe329a1da1dbe078381233940745fc28a56db98b1a8442325168158e3f0b3cbf8a368d19dd20cdfc1c4f3893a30a49223050159b0bb8b7c59ca705ae25453988d87ca6cdd2bd2fe37847ba67cbcf7a494925a8598b7b50a741c9ced10ea08e35c422b79265561a07f40ebb89bc46069a1c1ad95949fe757a76ff6b5386a043abc967c367a9d86b54d374e573540dfc1f6d396f398abe9735f523b778fd124ac1e1eb832a66dd4b1838a50e6a4eb1b95b8a60a94f067b24d1194976c539d5ec287a261bf25904575be3ff49e7411a8dc09739649828124c14fc2b89dad1f3f5725db2e45f5a447cd3e4bdf9e1e95c5ad7c76fcf0c1021cb6c32e6985e1d113030d534eecb0dff2554183ee18da2da5d21a8b994a81f05e0e6ae89b20bffb4be333d1956270da23e9905830921b1f3d615a56a20b11d45ccd1d22b910e33f475a92c31fa5b4675ddee18336d0ee7b75c07df2a9d4ad53d83142219a00aef15e1e9dace0f039d63a530fdf671a54aba3882dad0d439632af5576726c3aa095cc1a0a03063e8a6581b78bef501acc24b05a0150d8f683c90e8e5e283a49f898906dab926e544ead48cb9bf9a6e1bf140b5273443b8cb8166b2d8a5464a3e9d9f4246ac81ea91b33a0b399dde9f5efaf792bb04cfa028f40b7c92db2d9c33e16ef58b9263350879ea94e581a1187b2d1931b1cd7606a76bd8943b7c3098a33bdf476960af7bdf2854b1336e72feb603b8bb2242df0839d157843d369a50a615068ff5d99ecebe8dc19158a6c654e853cedf860a727bf8140c062f5d307fdcd150ad0af03d2c3a913b91047858ed6382d2d2d30f5c0bd419c2cd4047f225107ea8bf4a3a69384f16b5b5bb2655bdb750db4e975794592987df95f6a90374b0a08769b2c957faa16a21270196afba76b4527f01f0c5db7fa16e2da81fc49336e20bc3ee1ccbcb62255c84513d9ceb706f03c25000517070c03b7bce838e6b6cbc7f767959fbd62e11ab7ea6d760cff674a4296e6185eb348028b472290922160f3ea36c22c8375a016f505017c0a0e041dd8e52b4f19ccfc701109a19391a059d77db239d40a06d84a6f0ccd08aaad764e53ad1da19ee825a4d25ca7cd538289bffe135486ec1614e28b3682c7081a1b0a2c7272f4e36f6d0d9e68d84209126dc59312d48eed1c63c90efeadd472259392c28746abf394c5c6c97d3fb00b70a74c313a817ee1719c33f16d58f297fc7eacbca5803df115745079c5434e851ad6c1f0e8ba0bdbb66cbb6789b89a23526b476ad0f2cea0907e72702f93d37bdfe7b39fb9b33fb1111e58f5c45db8cc38afe4e03a318aa0690afb870a67aeda7da9640fdad1e1f551dd4757c69b4f523b616e502514a2e35495916f2e5ddab1ad9534644d99ec56e818caba173773aa5e45104deb869b23063eaea5542d3bc503a6948b83779aa46879443cad02477451b46429f1f67560c31d4377f96031ab94866a73be753c4ab91cc6576c3991c3423103ebae604e887c56cbacb9e95b8b46300b62e698a6456a0d175cf682eacabbe301e0b0ea34f963daed0dc6c1b75fa5e3870959913e69e61911d9ff646e9c6bab33fe566871027e861577c4d7fdfdf94ce7ac1a3f6d29daf28d660431a89c0b56c4b95090e2ca5df62c1e5c5dbf98f067751819d4c5914aa33883b7b521aab30d14e1cfae74fcf3ad4b2cf9448009d3223ad984e0c50f92d465573a6fc2894f8a5d4e855316738ecfd6a6c157d39b5c44d80a7cba944cf9f7a701899859821cf2bc248459f7a350fefba53c1481a7197f024f2eb74251455c06f4b82dfcf3ccf3e3b98b898fa1b16c310125e5e9fd4019acccbe91b4d842ddd52ee56f6d3112dec80159d6d3ef93bca70e7afcccb223361c39addbe3c429934cd0ae35f36a8f6309f08e36b27341db1f21fd8a148b239361b31a85f53bd1ad49fadace6c64d5f4363427fb2f268e8aec6d81cdb7f1252baa4652dc55881661114bf98cdf17190379591f0e22dc97e790f53f463bbb0ad0ead78ddf7dfe2e26052acc31cfe52b822afd5ec5c75957106cb5c368c09252ff3e4f624d90e599279fb985ecdb7d8880dfe05ac2d2da83e34e2b9b88f5dd60107a4509902fcddf4a36605e5c7a2606a4aea9fd4b5b24ca6b67d6945d133869cf9276d8c30b08c2a9f4bf03f4e0b956fd5f3c80b958ac5c41e4115b6708799c3102bd8b6c7fe17ff8c3f89c7437255faf69d1e16074086dd44d038bc0211ac74743169b462dbc085d77bf45eea72bf8348308bf48feea02d739a0fee9fbf71023ef8c6828da1aec8618cc2345ff663f88bc52a990e6b9591425435b0c7900ea4068f5aa6345e94254e259a71290fa23281658a6a165d1dee10dcb355518264824665ff2c5538de9ae4487782911f79e0bb09bc2c2d8e0d91b33cbec839075c9b38c848e9d2fad7368e96c1932042c3e85fd95b7d4500e6cae9e649082e9d5ca6f2cf91fc7ecaccc1049525d4325003424cacbd6eb5b8cc30b6893bd1ef46a8e7cbcc87dc2dda5c802ef1f8bb607c7457eb161254dc0feb60ed5ed0383fdb4db91d7e41d45c8eb80c1981e801ef05703f97f8710a2e00eb0559f854f700f946937b9e68c75ad6d0015d5d79be5423d0d846bc76f92ea7ebb0302b3d3c695c0aafa83b2bf029a444709cbf2cefbdcc7eaf3dd7a16f8ca8c861e883db10d433f7fec547be45e6829962e430bb3c93e8cdfb342c1cb7e53d8a6ea625d5574c4b4303f61c4338a658e652ab2bc0029c0a78a5114f495a439956909cf42128cb4348affbecb20b7fea98e22160e9a58e7666a00e7b37fbec4bd3860d66a39d1232a57e8cc50710c5c666f7efa98f16f9a02d843c94b0842a383945d06899998ff2fd01ffb58ab53ea89b2c93634c48d0420edb9791b8e451b35b534b8b2874c4859c684cd14afb5335a2555c75ad9df018635bb7131a7ef204ccecfed33a675fc51687e3f8818406fbf58e7b5fde1ca96153817e1b632e89a78d967eb6a34af1dac0d9ffa448b7b9bac27afc305a7b47febbe0a37036c18aef6852b1b2759d67479f9edb169e796d949844a1624b1e832a2eee9be36dc5866d6fde431cfcbd4e305d322c9dd07f83b5b361daaa74bfc9fbce8b447210c327468659ecbb0a5fc20d0cb79de7d1d70bf251c81d5f38711f3f4bd4752685b077058beb465711b1359d2a7d2f59216c5a807121bb97e7ccacc46526e4072f1d6de3b487d492fed0995e2273fa3bb115bd08d32d8e57eb2aa8f9d3b81babd1b8334c3a5e69422b75502ced3793d07b9bdf38e9d9fa1d2e48c7886dfc41985e8ffc49f09c4ba58ddc3b4cbf562b591f8939ced5d18214a77cc753075334a157373cc33cbc07a731cd6342492f5e05f78108e627bc88777203c76632bbe0120924c7a51bbfc9dc789a5695b7c95ef544935032fb81d499c454a2d78727875c20bc8a48a9f23cf6595c17c9cdaa8d04bab8ac567ebd3bbcdb40e11f1893fea3970f176f75f38d17d6ee1bd4ab76c660723a776bc72319199ab82c40ac4a9f4f475e8fd4643a4be8601cb5172e112c236c7c430078601bf183a59a03885e994c1116a9d4ef275790ff2417ffd85b43274fc57654466fa394958aeb11f343c3439604af13997011af70b67df1a9dfa4cdb751a2dc3e5bbf42f7b9ebc6dcebb2dbdc57d7a2cef7409dba307b7cf6eab148a924566341d035cabc877c68d0fbfaebdd39c16304b63a1bae376fb4650708bf5695dfd7ffc01f43f0021f622de0b116ea494454497337a0ec469963de7f9d2b1d6c5a7a0a7835777a78a2b9e16eec696446981d2fea550f011419b96f7b2018d027b87fc715521b0302bd7b5b3bc5f033346029eced73df07dd1bb1f91848376b40b9e9da7233e7832edcc7b54ef6fd320d19efce78d58ea7020fbbdf77612dc8a4f3281915ac9706f346e405b9f489f8f2e9a2decb8d18bec1e5f735a4ec69bba4dc5d36c9c1cc50b92fe67b2cdd53fa671c0cbe331abdf46787e7c9912b951aa20700dba6cf5a209fe5c9c61ef62a8e2e572ec774b2d0f42d570633fc44d44826e848d47a8f386a5704e0a3eaf1d06617181aeb166334ab55d5aedccb27abf19a42a480930e25465721336c70a2ea7799d21a3659124ac9503efc99c1b13ca2b9723e3e338055f9b3cef7502017ebbb09a64b06462db353a5c562101cb7fbf29e056deeb1ff0c7bc877210c941c87401ceae52bcecc83e87655069ab931bd813c1a87d67554f5d2cf435e6dd92a515c22f5d5a9a44ebc81e9c4849104343b80824005619312a9e349d996e366d381da42edad1a560bf5e31ecd049e92ceaf42954958600a7868599fe10e9b34587368d3044250c3d1a8ba6c8dcb6d318d4f9e71c2d33fc74cb57620a8343258d072f3aa767b4b178f3f66d5a713dae2426296c12edf9ee37636869e30df64cd3855fae20bc7602c1b7e6c8246ed4be71231a5ec7b5e7a9ebb08bf8667d8f2900ecdb0a0addc14a2328eebc448db13013e6a3c1a661065e5ac0a04b5171bd84c9d9d947a6c31257ed13a966530c5e20168c100117cf82b4c00ea3ad00ea65e1af89535b3f11a1418ddad33db8cec281543732d2ff4eab54b12cc95f7d872e75bc01bf6c580540b0e26413c6c2321ddfb0447bdb6acf05ddf2bb92534a3a5f37d6da882289f6fefc6a213cdfcf34902137fa3b982b2b4c27c611f08909a18405482f1e3a2bf3635d3e970457541da16e37bb3c422cceeb484bb64c78724431a543ecf4ca851914c1555e3b785ec87bba3769927f6c29f80e7ae8632bdb9acdddf7c3b5580740d9b2bfc25086c9566844136f3fac74f429121f86c378c68c20a194b0c98b1e92991954cbf60477e217a2e25297fc7b18972e40c531ec19e1eea193bbc8893392d8528c6a0375bcb4b082d20d5c47cb330bbb4b74b91ab55d4a0d3e1dee8182c581e8e70ac30108eeb7185c6ea3f786881ad124e1404651ee95cdb0fbb0d0f4a2b43c795ec1cd4e46234a88862d57903ce878b641004fb637341e5d6bf5163f1a3467b828f6eea96c3c2bb79503687867e11eec32dec452e0fdd2eaacfc0a477ee839ef049855da734d18212142dfe2a95ab9ad9bc4f98c3bfa34134c7e6c9f8669303314d4e8c1bc5475e8fcf418cbdb3246ebf393d911cdfee8f2550dc1593ece59ced81a4ffb2484f9c8ebed0aed8d418138445c4e96b209adcc4afd70f09901662daa2c8c557d6039768d97e6b9518f0de4ac2e0187ba08a4a9128d3e632fca102137338b5e568f12c7bd28db772c800fb5f4d4e683b201840731bb7c034235cd73313cde88891bbb31597bb537696e6c987302297f9717b8053779aed447d33ef9129e84d3031fa9b453bd5731fb010ffd19a9133e0ccbec2461cdd31ba294d68c60a8535b15584bab6e6d0ce6c1cef4755bd5f7d90f4debb40af1437a19a96ef9c0709692156152091c7efb58f2d39a65b96416dc09e8091ae08d9be5235a3c1ec062862baa1aab788f28e83ba4635cecc6671f2320f42b4f711e7d0fcad89d6727d3630da1ef35e32dee39eda665946abe6224f17f2acc29e62518fd51eb7f193d9bb16c38204069098c293fdce24c1c79229fd08622a4256b581cffce12e46c20248dc902753f0e3c91f9685b3d45f984620e262b3487d67d152f1c50de3fd2067a9d3debf715f346dd2f712c55545336a9036ba82bb06cfae59a48d083c3388f77790c9639fa0a9c33f4c66c7513042bffb765c2a4b3657dddf0ea094d8d79018f66c8ef8e9df980a89906275edf4a467a5db0a623976899f0efd167aab6ff385cdde59027a95a570277cb94ebce503906c28527e3114eb9ed739d0c2f4cf82786b35c0054718f47381ed8ce9b107e1f1019be5fc877166da667036f0c1b84e2b5118b5f4babc052d997e5f1e8c4cf45eb26430b74d9e1df3735b8d5df559903143d983e974bed6cc608c2580a991bdd3628ec676d348de8752cafa80c1661f162e35c25fc0ba0198423f83214fed800f9355ac8ea67951cfeeb3736b50c1e14d45d33aa25fc72c38702bd5dd217842e54114f4799c45ff1b7cec9729382ff7fc3ff80cbe1a13d03e19eecd7de676f6791fe34143ae30c97da9623907d974a37b65d0ef5d46b718d58541c6b1902814de71218ca7396ceb5fdacdc3cf4d110862402e7cc6254f1e44e28593fd443290262db75fd482ce1d305d6bf9fd3e5e0efbedac5a4d097650b111e6e9e1b2c66a23ac5bf27ed78d25d1a54c16ca4287126736c2f17ab73e683798c29d16481775ada8e20d94b00b6b29654b18f60e2853fdc7d3ba55d7df660db90288b6f440efd19f0478047b12c7b07ab2b1c9529597e6462d20612e6c3b6d1b1d11305f8ddc811860450504b7cbf9794edd0d07c25ab6307d74afdce958355eb919dcb1fcb8038c6dd5e774ee398dc8553a9ddeb551f", 0x2000, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x18}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) writev(r3, &(0x7f0000000200)=[{&(0x7f00000003c0)='n', 0xfdef}], 0x1) creat(&(0x7f0000000140)='./file0\x00', 0x34) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103", @ANYRES64], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) dup3(r0, r3, 0x6700000000000000) 0s ago: executing program 5 (id=5152): socket(0x2, 0x80805, 0x0) syz_usb_connect(0x5, 0x27, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b75c7f40470501026411010203010902120001000000000904"], 0x0) syz_emit_ethernet(0x86, &(0x7f0000000000)=ANY=[], 0x0) r0 = syz_open_dev$I2C(&(0x7f00000000c0), 0x1, 0x2003) ioctl$I2C_FUNCS(r0, 0x705, &(0x7f0000000040)=0xfffffeff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=@ipv4_delroute={0x4c, 0x19, 0x901, 0x70bd29, 0x80, {0x2, 0x18, 0x10, 0x0, 0x0, 0x4, 0xfd, 0x1, 0x1000}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @private=0xa010102}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_SRC={0x14, 0x3, @private0}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) kernel console output (not intermixed with test programs): ata Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1031.238701][ T30] audit: type=1326 audit(1785789696.601:2941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22389 comm="syz.2.4472" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f194315e84e code=0x7ffc0000 [ 1031.276297][ T30] audit: type=1326 audit(1785789696.601:2942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22389 comm="syz.2.4472" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f194319e019 code=0x7ffc0000 [ 1031.300971][ T30] audit: type=1326 audit(1785789696.611:2943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22389 comm="syz.2.4472" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f194319e019 code=0x7ffc0000 [ 1031.609081][T22400] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4473'. [ 1031.619005][T22381] bridge0: port 1(bridge_slave_0) entered blocking state [ 1031.633003][T22381] bridge0: port 1(bridge_slave_0) entered disabled state [ 1031.653044][T22381] bridge_slave_0: entered allmulticast mode [ 1031.674784][T22381] bridge_slave_0: entered promiscuous mode [ 1031.692185][T22404] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4475'. [ 1031.711194][T22404] bridge1: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 1031.724757][T22404] bridge1: entered promiscuous mode [ 1031.730915][T22381] bridge0: port 2(bridge_slave_1) entered blocking state [ 1031.747679][T22381] bridge0: port 2(bridge_slave_1) entered disabled state [ 1031.773147][T22381] bridge_slave_1: entered allmulticast mode [ 1031.781715][T22381] bridge_slave_1: entered promiscuous mode [ 1031.793859][T22406] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4475'. [ 1031.891548][T22406] bridge2: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 1031.914144][T22406] bridge2: entered promiscuous mode [ 1031.941831][T22381] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1031.959749][T22381] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1032.001481][T22381] team0: Port device team_slave_0 added [ 1032.014941][T22381] team0: Port device team_slave_1 added [ 1032.051303][T22381] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1032.059675][T22381] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1032.124368][T22381] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1032.151214][T22381] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1032.160768][T22381] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1032.188299][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1032.207126][T22381] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1032.364493][T22381] hsr_slave_0: entered promiscuous mode [ 1032.372067][T22381] hsr_slave_1: entered promiscuous mode [ 1032.379311][T22381] debugfs: 'hsr0' already exists in 'hsr' [ 1032.385935][T22381] Cannot create hsr debugfs directory [ 1032.722957][ T5621] Bluetooth: hci5: command tx timeout [ 1032.738509][ T6389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1033.126474][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1033.212291][ T9319] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1033.546206][T22381] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1033.568389][T22381] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1033.569444][T22381] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1033.584730][T22381] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1033.586979][T22381] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1033.595409][T22381] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1033.596125][T22381] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1033.606296][T22381] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1033.705069][T22438] FAULT_INJECTION: forcing a failure. [ 1033.705069][T22438] name failslab, interval 1, probability 0, space 0, times 0 [ 1033.705105][T22438] CPU: 0 UID: 0 PID: 22438 Comm: syz.2.4480 Tainted: G L syzkaller #0 PREEMPT(full) [ 1033.705129][T22438] Tainted: [L]=SOFTLOCKUP [ 1033.705136][T22438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1033.705146][T22438] Call Trace: [ 1033.705153][T22438] [ 1033.705160][T22438] dump_stack_lvl+0xe8/0x150 [ 1033.705191][T22438] should_fail_ex+0x40c/0x560 [ 1033.705219][T22438] should_failslab+0xa8/0x100 [ 1033.705246][T22438] __kmalloc_cache_noprof+0xa8/0x660 [ 1033.705267][T22438] ? tipc_node_create+0x109a/0x1d90 [ 1033.705288][T22438] ? tipc_crypto_key_init+0x6a/0x820 [ 1033.705409][T22438] ? tipc_crypto_key_init+0x6a/0x820 [ 1033.705440][T22438] tipc_crypto_key_init+0x6a/0x820 [ 1033.705480][T22438] tipc_nl_node_set_key+0x76a/0xa20 [ 1033.705509][T22438] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 1033.705537][T22438] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 1033.705555][T22438] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1033.705579][T22438] genl_family_rcv_msg_doit+0x233/0x340 [ 1033.705611][T22438] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1033.705649][T22438] ? bpf_lsm_capable+0x9/0x20 [ 1033.705678][T22438] ? security_capable+0x7e/0x2c0 [ 1033.705704][T22438] genl_rcv_msg+0x614/0x7a0 [ 1033.705734][T22438] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1033.705758][T22438] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 1033.705782][T22438] ? __pfx_ref_tracker_free+0x10/0x10 [ 1033.705814][T22438] netlink_rcv_skb+0x226/0x4a0 [ 1033.705836][T22438] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1033.705860][T22438] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1033.705896][T22438] ? down_read+0x2be/0x330 [ 1033.705923][T22438] genl_rcv+0x28/0x40 [ 1033.705945][T22438] netlink_unicast+0x7bb/0x940 [ 1033.705976][T22438] netlink_sendmsg+0x813/0xb40 [ 1033.706006][T22438] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1033.706032][T22438] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1033.706053][T22438] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1033.706070][T22438] sock_sendmsg_nosec+0x13a/0x180 [ 1033.706096][T22438] ____sys_sendmsg+0x54e/0x850 [ 1033.706123][T22438] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1033.706153][T22438] ? import_iovec+0x73/0xa0 [ 1033.706174][T22438] ___sys_sendmsg+0x2a5/0x360 [ 1033.706193][T22438] ? __lock_acquire+0x683/0x2cf0 [ 1033.706219][T22438] ? __pfx____sys_sendmsg+0x10/0x10 [ 1033.706276][T22438] ? __fget_files+0x2a/0x420 [ 1033.706299][T22438] ? __fget_files+0x3a2/0x420 [ 1033.706329][T22438] __x64_sys_sendmsg+0x1b1/0x290 [ 1033.706351][T22438] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1033.706390][T22438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1033.706410][T22438] do_syscall_64+0x174/0x580 [ 1033.706434][T22438] ? trace_irq_disable+0x3b/0x140 [ 1033.706456][T22438] ? clear_bhb_loop+0x40/0x90 [ 1033.706477][T22438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1033.706495][T22438] RIP: 0033:0x7f194319e019 [ 1033.706513][T22438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1033.706527][T22438] RSP: 002b:00007f19413d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1033.706545][T22438] RAX: ffffffffffffffda RBX: 00007f1943426090 RCX: 00007f194319e019 [ 1033.706558][T22438] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000005 [ 1033.706570][T22438] RBP: 00007f19413d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1033.706581][T22438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1033.706592][T22438] R13: 00007f1943426128 R14: 00007f1943426090 R15: 00007f194354fa48 [ 1033.706623][T22438] [ 1033.911845][T22381] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1033.998943][T22381] 8021q: adding VLAN 0 to HW filter on device team0 [ 1034.035359][T16819] bridge0: port 1(bridge_slave_0) entered blocking state [ 1034.035457][T16819] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1034.047633][ T6389] bridge0: port 2(bridge_slave_1) entered blocking state [ 1034.047762][ T6389] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1034.250643][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1034.446706][T22453] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1034.469695][T16819] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1034.472969][T22451] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1034.823177][ T5621] Bluetooth: hci5: command tx timeout [ 1034.859606][T22381] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1035.071734][T22381] veth0_vlan: entered promiscuous mode [ 1035.095650][T22381] veth1_vlan: entered promiscuous mode [ 1035.196304][T22381] veth0_macvtap: entered promiscuous mode [ 1035.216071][T22381] veth1_macvtap: entered promiscuous mode [ 1035.258032][T22381] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1035.269746][T22381] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1035.285952][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1035.326417][T16827] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1035.326830][T16827] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1035.327366][T16827] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1035.327403][T16827] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1035.598345][ T6268] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1035.598369][ T6268] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1035.669495][T16819] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1035.669519][T16819] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1035.894618][T22474] __nla_validate_parse: 1 callbacks suppressed [ 1035.894641][T22474] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4489'. [ 1036.040153][T22479] netlink: 72 bytes leftover after parsing attributes in process `syz.0.4491'. [ 1036.082893][ T5621] Bluetooth: hci1: command 0x0406 tx timeout [ 1036.166106][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1036.296081][T22486] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4494'. [ 1036.323462][ T9320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1036.555421][T22493] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1036.579758][T16819] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1036.599667][T22489] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1036.684852][ T5715] IPVS: starting estimator thread 0... [ 1036.698096][T22495] netlink: 'syz.2.4496': attribute type 13 has an invalid length. [ 1036.788704][T22496] IPVS: using max 36 ests per chain, 86400 per kthread [ 1036.836129][T22498] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1036.868499][T22498] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1036.905229][ T5632] Bluetooth: hci5: command tx timeout [ 1037.365541][ T9320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1037.384755][T22504] ip6gre1: entered promiscuous mode [ 1037.390589][T22504] ip6gre1: entered allmulticast mode [ 1037.512936][T22506] bond1: option arp_validate: mode dependency failed, not supported in mode balance-tlb(5) [ 1037.538338][T22506] bond1 (unregistering): Released all slaves [ 1037.613003][T22512] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1037.639069][T22512] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1037.700141][T22512] netlink: 64 bytes leftover after parsing attributes in process `syz.5.4501'. [ 1037.745725][T22512] netlink: 'syz.5.4501': attribute type 5 has an invalid length. [ 1037.760677][T22512] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4501'. [ 1037.846407][T16264] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1038.052090][T22524] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4505'. [ 1038.107978][T22524] hsr_slave_1 (unregistering): left promiscuous mode [ 1038.405105][ T9320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1038.483223][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1038.593574][T22530] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1038.609868][T22530] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1038.659781][ T30] kauditd_printk_skb: 195 callbacks suppressed [ 1038.659799][ T30] audit: type=1326 audit(1785789704.211:3139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22529 comm="syz.5.4507" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1038.701934][ T30] audit: type=1326 audit(1785789704.251:3140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22529 comm="syz.5.4507" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1038.717471][T22526] syzkaller1: entered promiscuous mode [ 1038.732504][ T30] audit: type=1326 audit(1785789704.291:3141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22529 comm="syz.5.4507" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7effc295e84e code=0x7ffc0000 [ 1038.734431][T22526] syzkaller1: entered allmulticast mode [ 1038.763139][ T30] audit: type=1326 audit(1785789704.291:3142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22529 comm="syz.5.4507" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7effc295e84e code=0x7ffc0000 [ 1038.789986][ T30] audit: type=1326 audit(1785789704.291:3143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22529 comm="syz.5.4507" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1038.840362][ T30] audit: type=1326 audit(1785789704.291:3144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22529 comm="syz.5.4507" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1038.886791][ T30] audit: type=1326 audit(1785789704.321:3145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22529 comm="syz.5.4507" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7effc295e84e code=0x7ffc0000 [ 1038.912148][ T30] audit: type=1326 audit(1785789704.321:3146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22529 comm="syz.5.4507" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1038.942009][ T30] audit: type=1326 audit(1785789704.321:3147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22529 comm="syz.5.4507" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1038.970582][ T5632] Bluetooth: hci5: command tx timeout [ 1038.995324][ T30] audit: type=1326 audit(1785789704.381:3148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22529 comm="syz.5.4507" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=8 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1039.157104][T22540] ipip0: entered promiscuous mode [ 1039.162256][T22540] ipip0: entered allmulticast mode [ 1039.203756][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1039.308192][T22546] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4514'. [ 1039.432412][T22548] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4515'. [ 1039.445577][T22548] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1039.448309][ T9319] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1039.484146][T22548] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 1039.502027][T22550] FAULT_INJECTION: forcing a failure. [ 1039.502027][T22550] name failslab, interval 1, probability 0, space 0, times 0 [ 1039.523187][T22550] CPU: 0 UID: 0 PID: 22550 Comm: syz.5.4516 Tainted: G L syzkaller #0 PREEMPT(full) [ 1039.523217][T22550] Tainted: [L]=SOFTLOCKUP [ 1039.523223][T22550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1039.523232][T22550] Call Trace: [ 1039.523239][T22550] [ 1039.523246][T22550] dump_stack_lvl+0xe8/0x150 [ 1039.523274][T22550] should_fail_ex+0x40c/0x560 [ 1039.523298][T22550] should_failslab+0xa8/0x100 [ 1039.523324][T22550] __kmalloc_noprof+0xfe/0x720 [ 1039.523346][T22550] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1039.523363][T22550] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1039.523401][T22550] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1039.523425][T22550] genl_family_rcv_msg_doit+0xda/0x340 [ 1039.523454][T22550] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1039.523481][T22550] ? apparmor_capable+0x126/0x170 [ 1039.523506][T22550] ? bpf_lsm_capable+0x9/0x20 [ 1039.523526][T22550] ? security_capable+0x7e/0x2c0 [ 1039.523549][T22550] genl_rcv_msg+0x614/0x7a0 [ 1039.523584][T22550] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1039.523606][T22550] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 1039.523628][T22550] ? __pfx_nl80211_disconnect+0x10/0x10 [ 1039.523645][T22550] ? __pfx_nl80211_post_doit+0x10/0x10 [ 1039.523667][T22550] ? __pfx_ref_tracker_free+0x10/0x10 [ 1039.523694][T22550] netlink_rcv_skb+0x226/0x4a0 [ 1039.523714][T22550] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1039.523737][T22550] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1039.523765][T22550] ? down_read+0x2be/0x330 [ 1039.523789][T22550] genl_rcv+0x28/0x40 [ 1039.523809][T22550] netlink_unicast+0x7bb/0x940 [ 1039.523838][T22550] netlink_sendmsg+0x813/0xb40 [ 1039.523867][T22550] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1039.523892][T22550] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1039.523916][T22550] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1039.523934][T22550] sock_sendmsg_nosec+0x13a/0x180 [ 1039.523959][T22550] ____sys_sendmsg+0x54e/0x850 [ 1039.523982][T22550] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1039.524008][T22550] ? import_iovec+0x73/0xa0 [ 1039.524026][T22550] ___sys_sendmsg+0x2a5/0x360 [ 1039.524046][T22550] ? __lock_acquire+0x683/0x2cf0 [ 1039.524071][T22550] ? __pfx____sys_sendmsg+0x10/0x10 [ 1039.524120][T22550] ? __fget_files+0x2a/0x420 [ 1039.524138][T22550] ? __fget_files+0x3a2/0x420 [ 1039.524161][T22550] __x64_sys_sendmsg+0x1b1/0x290 [ 1039.524178][T22550] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1039.524210][T22550] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1039.524225][T22550] do_syscall_64+0x174/0x580 [ 1039.524240][T22550] ? trace_irq_disable+0x3b/0x140 [ 1039.524257][T22550] ? clear_bhb_loop+0x40/0x90 [ 1039.524272][T22550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1039.524285][T22550] RIP: 0033:0x7effc299e019 [ 1039.524300][T22550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1039.524311][T22550] RSP: 002b:00007effc38e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1039.524326][T22550] RAX: ffffffffffffffda RBX: 00007effc2c25fa0 RCX: 00007effc299e019 [ 1039.524336][T22550] RDX: 0000000000008004 RSI: 00002000000003c0 RDI: 0000000000000004 [ 1039.524345][T22550] RBP: 00007effc38e6090 R08: 0000000000000000 R09: 0000000000000000 [ 1039.524353][T22550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1039.524361][T22550] R13: 00007effc2c26038 R14: 00007effc2c25fa0 R15: 00007effc2d4fa48 [ 1039.524382][T22550] [ 1040.193036][ T9319] usb 3-1: new full-speed USB device number 70 using dummy_hcd [ 1040.229945][T22560] program syz.5.4519 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1040.256791][T22544] fuse: Unknown parameter ' 0x000000000000000c' [ 1040.332841][ T9319] usb 3-1: device descriptor read/64, error -71 [ 1040.484742][ T9320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1040.493531][T22563] netlink: 5212 bytes leftover after parsing attributes in process `syz.6.4518'. [ 1040.512232][T22563] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4518'. [ 1040.572799][ T9319] usb 3-1: new full-speed USB device number 71 using dummy_hcd [ 1040.728623][ T9319] usb 3-1: device descriptor read/64, error -71 [ 1040.855567][ T9319] usb usb3-port1: attempt power cycle [ 1041.252813][ T9319] usb 3-1: new full-speed USB device number 72 using dummy_hcd [ 1041.282900][ T9319] usb 3-1: device descriptor read/8, error -71 [ 1041.523784][ T9320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1041.532831][ T9319] usb 3-1: new full-speed USB device number 73 using dummy_hcd [ 1041.574074][ T9319] usb 3-1: device descriptor read/8, error -71 [ 1041.703304][ T9319] usb usb3-port1: unable to enumerate USB device [ 1041.858035][T22589] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1041.877531][T22589] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1041.975486][T16817] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1041.986375][T22597] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1042.010236][T22594] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1042.060651][T22600] FAULT_INJECTION: forcing a failure. [ 1042.060651][T22600] name failslab, interval 1, probability 0, space 0, times 0 [ 1042.075314][T22600] CPU: 0 UID: 0 PID: 22600 Comm: syz.6.4533 Tainted: G L syzkaller #0 PREEMPT(full) [ 1042.075340][T22600] Tainted: [L]=SOFTLOCKUP [ 1042.075347][T22600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1042.075357][T22600] Call Trace: [ 1042.075364][T22600] [ 1042.075372][T22600] dump_stack_lvl+0xe8/0x150 [ 1042.075403][T22600] should_fail_ex+0x40c/0x560 [ 1042.075430][T22600] should_failslab+0xa8/0x100 [ 1042.075456][T22600] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1042.075478][T22600] ? skb_clone+0x212/0x3a0 [ 1042.075497][T22600] ? skb_clone+0x212/0x3a0 [ 1042.075522][T22600] skb_clone+0x212/0x3a0 [ 1042.075546][T22600] __netlink_deliver_tap+0x413/0x860 [ 1042.075578][T22600] ? netlink_deliver_tap+0x2e/0x1b0 [ 1042.075600][T22600] netlink_deliver_tap+0x19c/0x1b0 [ 1042.075621][T22600] netlink_sendskb+0x68/0x140 [ 1042.075642][T22600] netlink_rcv_skb+0x2a4/0x4a0 [ 1042.075664][T22600] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1042.075688][T22600] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1042.075722][T22600] ? down_read+0x2be/0x330 [ 1042.075749][T22600] genl_rcv+0x28/0x40 [ 1042.075770][T22600] netlink_unicast+0x7bb/0x940 [ 1042.075800][T22600] netlink_sendmsg+0x813/0xb40 [ 1042.075829][T22600] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1042.075857][T22600] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1042.075883][T22600] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1042.075902][T22600] sock_sendmsg_nosec+0x13a/0x180 [ 1042.075929][T22600] ____sys_sendmsg+0x54e/0x850 [ 1042.075954][T22600] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1042.075982][T22600] ? import_iovec+0x73/0xa0 [ 1042.076004][T22600] ___sys_sendmsg+0x2a5/0x360 [ 1042.076023][T22600] ? __lock_acquire+0x683/0x2cf0 [ 1042.076050][T22600] ? __pfx____sys_sendmsg+0x10/0x10 [ 1042.076104][T22600] ? __fget_files+0x2a/0x420 [ 1042.076125][T22600] ? __fget_files+0x3a2/0x420 [ 1042.076155][T22600] __x64_sys_sendmsg+0x1b1/0x290 [ 1042.076178][T22600] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1042.076215][T22600] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1042.076242][T22600] do_syscall_64+0x174/0x580 [ 1042.076263][T22600] ? trace_irq_disable+0x3b/0x140 [ 1042.076284][T22600] ? clear_bhb_loop+0x40/0x90 [ 1042.076304][T22600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1042.076322][T22600] RIP: 0033:0x7f468b79e019 [ 1042.076340][T22600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1042.076353][T22600] RSP: 002b:00007f468c6b8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1042.076372][T22600] RAX: ffffffffffffffda RBX: 00007f468ba25fa0 RCX: 00007f468b79e019 [ 1042.076384][T22600] RDX: 0000000000008004 RSI: 00002000000003c0 RDI: 0000000000000004 [ 1042.076395][T22600] RBP: 00007f468c6b8090 R08: 0000000000000000 R09: 0000000000000000 [ 1042.076406][T22600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1042.076416][T22600] R13: 00007f468ba26038 R14: 00007f468ba25fa0 R15: 00007f468bb4fa48 [ 1042.076445][T22600] [ 1042.569003][T16264] net_ratelimit: 1 callbacks suppressed [ 1042.569020][T16264] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1042.863505][T22608] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1042.893521][T22608] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1043.305390][T22619] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4541'. [ 1043.378678][T22619] team0: entered promiscuous mode [ 1043.389315][T22619] team_slave_0: entered promiscuous mode [ 1043.399948][T22619] team_slave_1: entered promiscuous mode [ 1043.416724][T22619] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1043.530609][T22623] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1043.607517][T16264] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1044.316565][T22642] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:20001 [ 1044.332421][T22644] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4550'. [ 1044.364760][T22645] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4552'. [ 1044.541497][T22648] netlink: 64475 bytes leftover after parsing attributes in process `syz.5.4553'. [ 1044.750192][T22653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1044.761324][T22653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1044.830813][T22651] loop6: detected capacity change from 0 to 2640 [ 1044.846889][ T7422] Buffer I/O error on dev loop6, logical block 0, async page read [ 1044.880644][T22651] Buffer I/O error on dev loop6, logical block 0, async page read [ 1044.891627][T22651] Buffer I/O error on dev loop6, logical block 0, async page read [ 1044.912652][ T7422] Buffer I/O error on dev loop6, logical block 0, async page read [ 1044.923378][ T7422] Buffer I/O error on dev loop6, logical block 0, async page read [ 1044.934321][T22651] Buffer I/O error on dev loop6, logical block 0, async page read [ 1044.967923][ T7422] Buffer I/O error on dev loop6, logical block 0, async page read [ 1044.977335][T22651] Buffer I/O error on dev loop6, logical block 0, async page read [ 1044.987974][ T7422] Buffer I/O error on dev loop6, logical block 0, async page read [ 1044.996287][T22651] Buffer I/O error on dev loop6, logical block 0, async page read [ 1045.021200][T22655] team_slave_0: Caught tx_queue_len zero misconfig [ 1045.035173][T22655] netlink: 'syz.2.4555': attribute type 4 has an invalid length. [ 1045.041718][T22651] ldm_validate_partition_table(): Disk read failed. [ 1045.065927][T22651] Dev loop6: unable to read RDB block 0 [ 1045.076116][T22651] loop6: unable to read partition table [ 1045.085441][T22657] FAULT_INJECTION: forcing a failure. [ 1045.085441][T22657] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1045.086337][T22651] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 1045.098811][T22657] CPU: 0 UID: 0 PID: 22657 Comm: syz.0.4556 Tainted: G L syzkaller #0 PREEMPT(full) [ 1045.098839][T22657] Tainted: [L]=SOFTLOCKUP [ 1045.098845][T22657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1045.098856][T22657] Call Trace: [ 1045.098864][T22657] [ 1045.098871][T22657] dump_stack_lvl+0xe8/0x150 [ 1045.098899][T22657] should_fail_ex+0x40c/0x560 [ 1045.098926][T22657] _copy_from_iter+0x1d3/0x1660 [ 1045.098950][T22657] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1045.098984][T22657] ? __pfx_policy_nodemask+0x10/0x10 [ 1045.099012][T22657] ? __pfx__copy_from_iter+0x10/0x10 [ 1045.099036][T22657] ? alloc_pages_mpol+0x24a/0x380 [ 1045.099067][T22657] af_alg_sendmsg+0x14c3/0x2250 [ 1045.099109][T22657] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 1045.099128][T22657] ? __might_fault+0xaf/0x130 [ 1045.099147][T22657] ? __pfx_aa_sk_perm+0x10/0x10 [ 1045.099168][T22657] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1045.099187][T22657] ? skcipher_sendmsg+0x26/0xf0 [ 1045.099211][T22657] ? __pfx_skcipher_sendmsg+0x10/0x10 [ 1045.099231][T22657] sock_sendmsg_nosec+0x13a/0x180 [ 1045.099257][T22657] ____sys_sendmsg+0x54e/0x850 [ 1045.099281][T22657] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1045.099309][T22657] ? import_iovec+0x73/0xa0 [ 1045.099329][T22657] ___sys_sendmsg+0x2a5/0x360 [ 1045.099347][T22657] ? __lock_acquire+0x683/0x2cf0 [ 1045.099373][T22657] ? __pfx____sys_sendmsg+0x10/0x10 [ 1045.099397][T22657] ? kstrtouint+0x6e/0xe0 [ 1045.099442][T22657] ? __fget_files+0x2a/0x420 [ 1045.099462][T22657] ? __fget_files+0x3a2/0x420 [ 1045.099491][T22657] __sys_sendmmsg+0x273/0x4d0 [ 1045.099515][T22657] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1045.099543][T22657] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1045.099577][T22657] ? ksys_write+0x242/0x270 [ 1045.099596][T22657] ? __pfx_ksys_write+0x10/0x10 [ 1045.099619][T22657] __x64_sys_sendmmsg+0xa0/0xc0 [ 1045.099639][T22657] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1045.099656][T22657] do_syscall_64+0x174/0x580 [ 1045.099676][T22657] ? trace_irq_disable+0x3b/0x140 [ 1045.099696][T22657] ? clear_bhb_loop+0x40/0x90 [ 1045.099716][T22657] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1045.099733][T22657] RIP: 0033:0x7f7e0679e019 [ 1045.099750][T22657] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1045.099765][T22657] RSP: 002b:00007f7e075d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1045.099782][T22657] RAX: ffffffffffffffda RBX: 00007f7e06a25fa0 RCX: 00007f7e0679e019 [ 1045.099795][T22657] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000005 [ 1045.099806][T22657] RBP: 00007f7e075d7090 R08: 0000000000000000 R09: 0000000000000000 [ 1045.099817][T22657] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 1045.099828][T22657] R13: 00007f7e06a26038 R14: 00007f7e06a25fa0 R15: 00007f7e06b4fa48 [ 1045.099859][T22657] [ 1045.407402][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1045.541827][T22664] netlink: 'syz.0.4559': attribute type 1 has an invalid length. [ 1046.070764][T22671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1046.089995][T22671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1046.205316][T22675] IPVS: set_ctl: invalid protocol: 94 100.1.1.5:20002 [ 1046.527659][T22687] macvlan2: entered allmulticast mode [ 1046.534120][T22687] veth0: entered promiscuous mode [ 1046.541805][T22687] veth0: entered allmulticast mode [ 1046.556738][T22687] team0: Port device macvlan2 added [ 1046.688219][T22689] program syz.6.4569 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1046.726569][T22691] syzkaller0: entered promiscuous mode [ 1046.732603][T22691] syzkaller0: entered allmulticast mode [ 1046.985191][T22696] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1047.000091][T22696] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1047.016255][T22696] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1047.023669][T22696] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1047.034687][T22696] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1047.041040][T22696] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1047.073475][T22696] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1047.085484][T22696] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1047.096274][T22696] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1047.109392][T22696] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1047.116086][T22696] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1047.139194][T22696] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1048.111492][T16817] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1048.121340][ T6268] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1048.130969][T18491] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1048.195152][T18491] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1048.528698][T16264] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1048.540597][ T9320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1048.598351][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1049.060679][ T5632] Bluetooth: hci1: command 0x0406 tx timeout [ 1049.062732][ T5621] Bluetooth: hci4: command 0x0406 tx timeout [ 1049.066993][ T5632] Bluetooth: hci2: command 0x0406 tx timeout [ 1049.125118][T19653] Bluetooth: hci5: command 0x0c1a tx timeout [ 1049.125227][T22715] Bluetooth: hci3: command 0x0c1a tx timeout [ 1049.380961][T16817] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1051.139695][T22715] Bluetooth: hci4: command 0x0406 tx timeout [ 1051.139748][ T5632] Bluetooth: hci2: command 0x0406 tx timeout [ 1051.144556][T19653] Bluetooth: hci1: command 0x0406 tx timeout [ 1051.203071][T19653] Bluetooth: hci3: command 0x0c1a tx timeout [ 1051.234530][T19653] Bluetooth: hci5: command 0x0c1a tx timeout [ 1051.618576][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1053.283133][T19653] Bluetooth: hci5: command 0x0c1a tx timeout [ 1053.289294][T19653] Bluetooth: hci3: command 0x0c1a tx timeout [ 1053.815018][T22741] FAULT_INJECTION: forcing a failure. [ 1053.815018][T22741] name failslab, interval 1, probability 0, space 0, times 0 [ 1053.843500][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1053.909649][T22741] CPU: 1 UID: 0 PID: 22741 Comm: syz.5.4585 Tainted: G L syzkaller #0 PREEMPT(full) [ 1053.909679][T22741] Tainted: [L]=SOFTLOCKUP [ 1053.909686][T22741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1053.909696][T22741] Call Trace: [ 1053.909704][T22741] [ 1053.909711][T22741] dump_stack_lvl+0xe8/0x150 [ 1053.909745][T22741] should_fail_ex+0x40c/0x560 [ 1053.909774][T22741] should_failslab+0xa8/0x100 [ 1053.909802][T22741] __kmalloc_cache_noprof+0xa8/0x660 [ 1053.909823][T22741] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 1053.909845][T22741] ? __kmalloc_cache_noprof+0x150/0x660 [ 1053.909866][T22741] ? sctp_add_bind_addr+0x8c/0x370 [ 1053.909883][T22741] ? sctp_add_bind_addr+0x8c/0x370 [ 1053.909907][T22741] sctp_add_bind_addr+0x8c/0x370 [ 1053.909931][T22741] sctp_copy_local_addr_list+0x31a/0x4e0 [ 1053.909952][T22741] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 1053.909972][T22741] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1053.909993][T22741] ? sctp_v6_is_any+0x64/0x80 [ 1053.910012][T22741] ? sctp_copy_one_addr+0x93/0x360 [ 1053.910030][T22741] sctp_bind_addr_copy+0xb3/0x3c0 [ 1053.910045][T22741] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1053.910068][T22741] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1053.910088][T22741] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1053.910108][T22741] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 1053.910130][T22741] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 1053.910149][T22741] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 1053.910170][T22741] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1053.910191][T22741] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1053.910221][T22741] sctp_sendmsg+0x159b/0x2d00 [ 1053.910257][T22741] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1053.910293][T22741] ? aa_sk_perm+0x6d5/0x900 [ 1053.910325][T22741] ? sock_rps_record_flow+0x19/0x350 [ 1053.910349][T22741] ? inet_sendmsg+0x298/0x320 [ 1053.910370][T22741] ? __pfx_inet_sendmsg+0x10/0x10 [ 1053.910387][T22741] sock_sendmsg_nosec+0x10e/0x180 [ 1053.910416][T22741] ____sys_sendmsg+0x54e/0x850 [ 1053.910442][T22741] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1053.910472][T22741] ? import_iovec+0x73/0xa0 [ 1053.910493][T22741] ___sys_sendmsg+0x2a5/0x360 [ 1053.910573][T22741] ? __lock_acquire+0x683/0x2cf0 [ 1053.910601][T22741] ? __pfx____sys_sendmsg+0x10/0x10 [ 1053.910656][T22741] ? __fget_files+0x2a/0x420 [ 1053.910678][T22741] ? __fget_files+0x3a2/0x420 [ 1053.910710][T22741] __x64_sys_sendmsg+0x1b1/0x290 [ 1053.910733][T22741] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1053.910776][T22741] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1053.910796][T22741] do_syscall_64+0x174/0x580 [ 1053.910817][T22741] ? trace_irq_disable+0x3b/0x140 [ 1053.910840][T22741] ? clear_bhb_loop+0x40/0x90 [ 1053.910861][T22741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1053.910879][T22741] RIP: 0033:0x7effc299e019 [ 1053.910897][T22741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1053.910911][T22741] RSP: 002b:00007effc38e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1053.910930][T22741] RAX: ffffffffffffffda RBX: 00007effc2c25fa0 RCX: 00007effc299e019 [ 1053.910943][T22741] RDX: 0000000000040054 RSI: 0000200000000540 RDI: 0000000000000004 [ 1053.910954][T22741] RBP: 00007effc38e6090 R08: 0000000000000000 R09: 0000000000000000 [ 1053.910965][T22741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1053.910976][T22741] R13: 00007effc2c26038 R14: 00007effc2c25fa0 R15: 00007effc2d4fa48 [ 1053.911009][T22741] [ 1054.496460][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1054.506956][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.513892][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.555032][T22758] FAULT_INJECTION: forcing a failure. [ 1054.555032][T22758] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1054.653136][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1054.663223][T22758] CPU: 0 UID: 0 PID: 22758 Comm: syz.6.4591 Tainted: G L syzkaller #0 PREEMPT(full) [ 1054.663251][T22758] Tainted: [L]=SOFTLOCKUP [ 1054.663258][T22758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1054.663268][T22758] Call Trace: [ 1054.663276][T22758] [ 1054.663283][T22758] dump_stack_lvl+0xe8/0x150 [ 1054.663314][T22758] should_fail_ex+0x40c/0x560 [ 1054.663341][T22758] _copy_from_user+0x2d/0xb0 [ 1054.663361][T22758] restore_altstack+0xae/0x4f0 [ 1054.663385][T22758] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1054.663404][T22758] ? __might_fault+0xaf/0x130 [ 1054.663430][T22758] ? __pfx_restore_altstack+0x10/0x10 [ 1054.663458][T22758] ? _raw_spin_unlock_irq+0x23/0x50 [ 1054.663483][T22758] __ia32_sys_rt_sigreturn+0x2bd/0x8c0 [ 1054.663508][T22758] ? __lock_acquire+0x683/0x2cf0 [ 1054.663534][T22758] ? _raw_spin_unlock_irq+0x23/0x50 [ 1054.663553][T22758] ? __pfx___ia32_sys_rt_sigreturn+0x10/0x10 [ 1054.663573][T22758] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1054.663590][T22758] ? signal_setup_done+0x22f/0x310 [ 1054.663614][T22758] ? arch_do_signal_or_restart+0x4f4/0x860 [ 1054.663640][T22758] ? __task_pid_nr_ns+0x28/0x470 [ 1054.663672][T22758] ? __task_pid_nr_ns+0x28/0x470 [ 1054.663700][T22758] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1054.663719][T22758] do_syscall_64+0x174/0x580 [ 1054.663741][T22758] ? clear_bhb_loop+0x40/0x90 [ 1054.663761][T22758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1054.663782][T22758] RIP: 0033:0x7f468b73f399 [ 1054.663799][T22758] Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25 [ 1054.663813][T22758] RSP: 002b:00007f468c6b7a80 EFLAGS: 00000202 ORIG_RAX: 000000000000000f [ 1054.663832][T22758] RAX: ffffffffffffffda RBX: 00007f468ba25fa0 RCX: 00007f468b73f399 [ 1054.663844][T22758] RDX: 00007f468c6b7a80 RSI: 00007f468c6b7bb0 RDI: 0000000000000021 [ 1054.663856][T22758] RBP: 00007f468c6b8090 R08: 0000000000000000 R09: 0000000000000000 [ 1054.663868][T22758] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002 [ 1054.663878][T22758] R13: 00007f468ba26038 R14: 00007f468ba25fa0 R15: 00007f468bb4fa48 [ 1054.663905][T22758] [ 1055.072786][ T9320] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 1055.092361][T22747] syzkaller1: entered promiscuous mode [ 1055.102797][T22747] syzkaller1: entered allmulticast mode [ 1055.204333][ T9320] usb 3-1: device descriptor read/64, error -71 [ 1055.452524][T22770] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1055.461626][ T9320] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 1055.485672][T22770] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1055.501121][T22774] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2310821331 (9243285324 ns) > initial count (3976107104 ns). Using initial count to start timer. [ 1055.603321][ T9320] usb 3-1: device descriptor read/64, error -71 [ 1055.713519][ T9320] usb usb3-port1: attempt power cycle [ 1055.808098][T16817] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1055.823419][T22789] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1055.831248][T22785] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1056.072806][ T9320] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 1056.103273][ T9320] usb 3-1: device descriptor read/8, error -71 [ 1056.352810][ T9320] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 1056.375493][ T9320] usb 3-1: device descriptor read/8, error -71 [ 1056.484533][ T9320] usb usb3-port1: unable to enumerate USB device [ 1056.866075][T22802] mac80211_hwsim hwsim66 syzkaller1: entered promiscuous mode [ 1056.874586][T22802] mac80211_hwsim hwsim66 syzkaller1: entered allmulticast mode [ 1057.004313][T22810] mac80211_hwsim hwsim66 syzkaller1: left promiscuous mode [ 1057.029609][T22810] mac80211_hwsim hwsim66 syzkaller1: left allmulticast mode [ 1057.220283][T16817] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1057.443865][T22816] FAULT_INJECTION: forcing a failure. [ 1057.443865][T22816] name failslab, interval 1, probability 0, space 0, times 0 [ 1057.476425][T22816] CPU: 1 UID: 0 PID: 22816 Comm: syz.1.4613 Tainted: G L syzkaller #0 PREEMPT(full) [ 1057.476454][T22816] Tainted: [L]=SOFTLOCKUP [ 1057.476460][T22816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1057.476469][T22816] Call Trace: [ 1057.476476][T22816] [ 1057.476484][T22816] dump_stack_lvl+0xe8/0x150 [ 1057.476514][T22816] should_fail_ex+0x40c/0x560 [ 1057.476540][T22816] should_failslab+0xa8/0x100 [ 1057.476565][T22816] __kmalloc_cache_noprof+0xa8/0x660 [ 1057.476589][T22816] ? br_vlan_init+0x54/0x1b0 [ 1057.476746][T22816] ? br_vlan_init+0x54/0x1b0 [ 1057.476807][T22816] br_vlan_init+0x54/0x1b0 [ 1057.476828][T22816] br_dev_init+0x65/0x490 [ 1057.476854][T22816] register_netdevice+0x6a1/0x1eb0 [ 1057.476882][T22816] ? alloc_netdev_mqs+0xd45/0x12b0 [ 1057.476903][T22816] ? __kvmalloc_node_noprof+0x55a/0x860 [ 1057.476928][T22816] ? __pfx_register_netdevice+0x10/0x10 [ 1057.476946][T22816] ? __kvmalloc_node_noprof+0x35c/0x860 [ 1057.476964][T22816] ? alloc_netdev_mqs+0xd45/0x12b0 [ 1057.476990][T22816] ? alloc_netdev_mqs+0xe64/0x12b0 [ 1057.477016][T22816] br_add_bridge+0xa3/0xf0 [ 1057.477037][T22816] br_ioctl_stub+0x588/0xd60 [ 1057.477055][T22816] ? trace_contention_end+0x3d/0x140 [ 1057.477074][T22816] ? __mutex_lock+0x30d/0x1550 [ 1057.477095][T22816] ? __pfx_br_ioctl_stub+0x10/0x10 [ 1057.477112][T22816] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1057.477133][T22816] ? sock_ioctl+0x4b8/0x7e0 [ 1057.477157][T22816] ? hook_file_ioctl+0x1f0/0x5f0 [ 1057.477188][T22816] ? __pfx_br_ioctl_stub+0x10/0x10 [ 1057.477203][T22816] sock_ioctl+0x4e1/0x7e0 [ 1057.477235][T22816] ? __pfx_sock_ioctl+0x10/0x10 [ 1057.477257][T22816] ? __fget_files+0x2a/0x420 [ 1057.477278][T22816] ? __fget_files+0x3a2/0x420 [ 1057.477297][T22816] ? __fget_files+0x2a/0x420 [ 1057.477321][T22816] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1057.477342][T22816] ? __pfx_sock_ioctl+0x10/0x10 [ 1057.477363][T22816] __se_sys_ioctl+0xfc/0x170 [ 1057.477381][T22816] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1057.477401][T22816] do_syscall_64+0x174/0x580 [ 1057.477420][T22816] ? trace_irq_disable+0x3b/0x140 [ 1057.477440][T22816] ? clear_bhb_loop+0x40/0x90 [ 1057.477460][T22816] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1057.477477][T22816] RIP: 0033:0x7f105279e019 [ 1057.477494][T22816] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1057.477508][T22816] RSP: 002b:00007f1053659028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1057.477528][T22816] RAX: ffffffffffffffda RBX: 00007f1052a25fa0 RCX: 00007f105279e019 [ 1057.477540][T22816] RDX: 0000200000000040 RSI: 00000000000089a0 RDI: 0000000000000003 [ 1057.477552][T22816] RBP: 00007f1053659090 R08: 0000000000000000 R09: 0000000000000000 [ 1057.477562][T22816] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1057.477573][T22816] R13: 00007f1052a26038 R14: 00007f1052a25fa0 R15: 00007f1052b4fa48 [ 1057.477600][T22816] [ 1057.790617][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1057.799478][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1057.840691][T19653] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1057.877020][T19653] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1057.897154][T19653] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1057.945038][T19653] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1057.956861][T19653] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1058.058013][T16817] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1058.249254][T22833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1058.262382][T22833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1058.289330][T16817] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1058.295195][T22833] netlink: 'syz.5.4618': attribute type 10 has an invalid length. [ 1058.409064][T16817] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1058.963539][T21962] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1058.988332][T16817] bridge_slave_1: left allmulticast mode [ 1059.000081][T16817] bridge0: port 2(bridge_slave_1) entered disabled state [ 1059.032938][T16817] bridge_slave_0: left allmulticast mode [ 1059.064173][T16817] bridge_slave_0: left promiscuous mode [ 1059.072962][T16817] bridge0: port 1(bridge_slave_0) entered disabled state [ 1059.706896][T16817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1059.728889][T16817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1059.765649][T16817] bond0 (unregistering): Released all slaves [ 1059.798855][T22852] syzkaller1: entered promiscuous mode [ 1059.806808][T22852] syzkaller1: entered allmulticast mode [ 1059.956502][ T5286] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1060.097207][T19653] Bluetooth: hci5: command tx timeout [ 1060.243399][ T6389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1060.294801][T22825] bridge0: port 1(bridge_slave_0) entered blocking state [ 1060.305560][T22825] bridge0: port 1(bridge_slave_0) entered disabled state [ 1060.313886][T22825] bridge_slave_0: entered allmulticast mode [ 1060.323616][T22825] bridge_slave_0: entered promiscuous mode [ 1060.363744][T22825] bridge0: port 2(bridge_slave_1) entered blocking state [ 1060.374125][T22825] bridge0: port 2(bridge_slave_1) entered disabled state [ 1060.385460][T22825] bridge_slave_1: entered allmulticast mode [ 1060.429143][T22825] bridge_slave_1: entered promiscuous mode [ 1060.621837][T22825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1060.658867][T22825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1060.804621][T18491] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1060.929694][T22825] team0: Port device team_slave_0 added [ 1060.959445][T22825] team0: Port device team_slave_1 added [ 1061.453910][T22825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1061.467143][T22825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1061.473012][T19714] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 1061.558245][T22825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1061.714646][T19714] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1061.733992][T19714] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1061.753746][T19714] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1061.775143][T19714] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1061.795381][T22825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1061.833300][T22825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1061.835615][T19714] usb 3-1: config 0 descriptor?? [ 1061.947935][T22825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1062.098552][T22893] fuse: Unknown parameter 'rootmod6Rǖe' [ 1062.130685][T16817] hsr_slave_0: left promiscuous mode [ 1062.155040][T16817] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1062.169410][T19653] Bluetooth: hci5: command tx timeout [ 1062.182583][T16817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1062.194094][T16817] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1062.209854][T16817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1062.286842][T16817] veth0: left allmulticast mode [ 1062.296856][T16817] veth0: left promiscuous mode [ 1062.313387][T16817] veth1_macvtap: left promiscuous mode [ 1062.320305][T22894] fuse: Unknown parameter ' 0x000000000000000c' [ 1062.332786][T16817] veth0_macvtap: left promiscuous mode [ 1062.338456][T16817] veth1_vlan: left promiscuous mode [ 1062.348613][T16817] veth0_vlan: left promiscuous mode [ 1062.525121][T16817] team0 (unregistering): Port device macvlan2 removed [ 1062.808364][T16817] team0 (unregistering): Port device team_slave_1 removed [ 1062.845399][T16817] team0 (unregistering): Port device team_slave_0 removed [ 1063.029718][ T5286] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1063.073230][T22825] hsr_slave_0: entered promiscuous mode [ 1063.080266][T22825] hsr_slave_1: entered promiscuous mode [ 1063.087770][T22825] debugfs: 'hsr0' already exists in 'hsr' [ 1063.096875][T22825] Cannot create hsr debugfs directory [ 1063.784447][T22923] mac80211_hwsim hwsim66 syzkaller1: entered promiscuous mode [ 1063.792301][T22923] mac80211_hwsim hwsim66 syzkaller1: entered allmulticast mode [ 1063.844617][T18491] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1064.054320][T22948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1064.079741][T22948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1064.090752][ T6268] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1064.134138][ T9319] usb 3-1: USB disconnect, device number 78 [ 1064.243207][T19653] Bluetooth: hci5: command tx timeout [ 1064.470250][T22952] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4639'. [ 1064.855767][ T9319] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 1065.024176][ T9319] usb 3-1: Using ep0 maxpacket: 16 [ 1065.036878][ T9319] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1065.054505][ T9319] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.095953][ T9319] usb 3-1: Product: syz [ 1065.107068][ T9319] usb 3-1: Manufacturer: syz [ 1065.138042][ T9319] usb 3-1: SerialNumber: syz [ 1065.159566][ T9319] r8152-cfgselector 3-1: Unknown version 0x0000 [ 1065.172934][ T9319] r8152-cfgselector 3-1: config 0 descriptor?? [ 1065.472998][T22956] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1065.496768][T22956] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1065.758665][T22984] sctp: [Deprecated]: syz.2.4638 (pid 22984) Use of int in max_burst socket option. [ 1065.758665][T22984] Use struct sctp_assoc_value instead [ 1065.828661][T22982] syzkaller0: tun_chr_ioctl cmd 35108 [ 1065.954266][T22990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1065.978541][T22990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1066.004855][ T6268] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1066.042364][T22825] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1066.083485][T22825] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1066.146445][T22825] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1066.153761][T22973] fuse: Unknown parameter ' 0x000000000000000c' [ 1066.175161][T22825] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1066.189998][T22825] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1066.210461][T22825] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1066.224304][T22825] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1066.254200][T22825] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1066.323439][T19653] Bluetooth: hci5: command tx timeout [ 1066.504692][T22825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1066.539546][T22825] 8021q: adding VLAN 0 to HW filter on device team0 [ 1066.557919][T16827] bridge0: port 1(bridge_slave_0) entered blocking state [ 1066.565361][T16827] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1066.586913][T16827] bridge0: port 2(bridge_slave_1) entered blocking state [ 1066.594104][T16827] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1066.775783][T23007] netlink: 348 bytes leftover after parsing attributes in process `syz.0.4645'. [ 1066.867807][T22825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1066.883860][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1067.068439][T22825] veth0_vlan: entered promiscuous mode [ 1067.102278][T22825] veth1_vlan: entered promiscuous mode [ 1067.256899][T22825] veth0_macvtap: entered promiscuous mode [ 1067.285847][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1067.308244][T22825] veth1_macvtap: entered promiscuous mode [ 1067.365557][T22825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1067.398712][T22825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1067.434242][T16827] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1067.463743][T16819] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1067.597063][T21962] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1067.633842][T21962] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1067.819296][ T5705] r8152-cfgselector 3-1: USB disconnect, device number 79 [ 1067.884926][ T6268] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1067.928298][ T6268] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1068.098713][T16819] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1068.128918][T16819] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1068.292854][ T5705] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 1068.476330][ T5705] usb 3-1: Using ep0 maxpacket: 32 [ 1068.500955][ T5705] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 1068.530419][ T5705] usb 3-1: config 0 has no interface number 0 [ 1068.542788][ T5705] usb 3-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1068.580152][ T5705] usb 3-1: config 0 interface 89 has no altsetting 0 [ 1068.592629][ T5705] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 1068.618990][ T5705] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.628349][T16827] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1068.633785][T23044] fuse: Unknown parameter ' 0x000000000000000c' [ 1068.639292][ T5705] usb 3-1: Product: syz [ 1068.651558][T23056] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1068.663669][ T5705] usb 3-1: Manufacturer: syz [ 1068.668372][ T5705] usb 3-1: SerialNumber: syz [ 1068.678363][ T5705] usb 3-1: config 0 descriptor?? [ 1068.689401][ T5705] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1068.700410][ T5705] em28xx 3-1:0.89: Video interface 89 found: [ 1069.321850][ T5705] em28xx 3-1:0.89: unknown em28xx chip ID (64) [ 1069.609925][ T5705] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1069.619526][ T5705] em28xx 3-1:0.89: board has no eeprom [ 1069.682970][ T5705] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 1069.691211][ T5705] em28xx 3-1:0.89: analog set to bulk mode. [ 1069.697803][ T9320] em28xx 3-1:0.89: Registering V4L2 extension [ 1069.710887][ T5705] usb 3-1: USB disconnect, device number 80 [ 1069.721796][ T5705] em28xx 3-1:0.89: Disconnecting em28xx [ 1069.740083][ T9320] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 1069.751213][ T9320] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 1069.760005][ T9320] em28xx 3-1:0.89: No AC97 audio processor [ 1069.771838][ T9320] usb 3-1: Decoder not found [ 1069.777571][ T9320] em28xx 3-1:0.89: failed to create media graph [ 1069.784431][ T9320] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 1069.801987][ T9320] em28xx 3-1:0.89: Registering snapshot button... [ 1069.820011][ T9320] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input75 [ 1069.846566][T16819] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1069.852578][ T9320] em28xx 3-1:0.89: Remote control support is not available for this card. [ 1069.884354][ T5705] em28xx 3-1:0.89: Closing input extension [ 1069.900218][ T5705] em28xx 3-1:0.89: Deregistering snapshot button [ 1069.923773][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1070.033361][ T5705] em28xx 3-1:0.89: Freeing device [ 1070.288102][T23081] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1070.305301][T16827] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1070.308672][ T30] kauditd_printk_skb: 104 callbacks suppressed [ 1070.308688][ T30] audit: type=1326 audit(1785789735.861:3253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23079 comm="syz.2.4662" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f194319e019 code=0x0 [ 1070.318934][T23077] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1071.412932][ T5705] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 1071.572758][ T5705] usb 3-1: Using ep0 maxpacket: 16 [ 1071.584124][ T5705] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 119, changing to 10 [ 1071.603094][ T5705] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1071.610648][ T5705] usb 3-1: New USB device found, idVendor=17ef, idProduct=61ae, bcdDevice= 0.00 [ 1071.626053][ T5705] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1071.653812][ T5705] usb 3-1: config 0 descriptor?? [ 1071.687302][ T30] audit: type=1326 audit(1785789737.241:3254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23091 comm="syz.1.4667" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f105279e019 code=0x0 [ 1071.770588][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1072.067220][ T5705] hid_parser_main: 34 callbacks suppressed [ 1072.067235][ T5705] lenovo 0003:17EF:61AE.002B: unknown main item tag 0x0 [ 1072.127470][ T5705] lenovo 0003:17EF:61AE.002B: unknown main item tag 0x0 [ 1072.149295][ T5705] lenovo 0003:17EF:61AE.002B: unknown main item tag 0x0 [ 1072.164923][T23100] fuse: Unknown parameter ' 0x000000000000000c' [ 1072.177433][ T5705] lenovo 0003:17EF:61AE.002B: unknown main item tag 0x0 [ 1072.188311][ T5705] lenovo 0003:17EF:61AE.002B: unknown main item tag 0x0 [ 1072.200172][ T5705] lenovo 0003:17EF:61AE.002B: unknown main item tag 0x0 [ 1072.215549][T23103] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1072.226364][ T5705] lenovo 0003:17EF:61AE.002B: unknown main item tag 0x0 [ 1072.237965][ T5705] lenovo 0003:17EF:61AE.002B: hidraw0: USB HID v0.04 Device [HID 17ef:61ae] on usb-dummy_hcd.2-1/input0 [ 1072.253769][T23103] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1072.274860][ T30] audit: type=1326 audit(1785789737.821:3255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23087 comm="syz.2.4665" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f194319e019 code=0x7ffc0000 [ 1072.340189][ T30] audit: type=1326 audit(1785789737.821:3256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23087 comm="syz.2.4665" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f194319e019 code=0x7ffc0000 [ 1072.412767][ T30] audit: type=1326 audit(1785789737.821:3257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23087 comm="syz.2.4665" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f194319e019 code=0x7ffc0000 [ 1072.482461][ T30] audit: type=1326 audit(1785789737.821:3258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23087 comm="syz.2.4665" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=74 compat=0 ip=0x7f194319e019 code=0x7ffc0000 [ 1072.549582][ T30] audit: type=1326 audit(1785789737.821:3259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23087 comm="syz.2.4665" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f194319e019 code=0x7ffc0000 [ 1072.616419][ T30] audit: type=1326 audit(1785789737.821:3260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23087 comm="syz.2.4665" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f194319e019 code=0x7ffc0000 [ 1072.699009][ T30] audit: type=1326 audit(1785789737.821:3261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23087 comm="syz.2.4665" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f194319e019 code=0x7ffc0000 [ 1072.780915][ T30] audit: type=1326 audit(1785789737.821:3262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23087 comm="syz.2.4665" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=126 compat=0 ip=0x7f194319e019 code=0x7ffc0000 [ 1072.963051][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1074.229110][ T5677] usb 3-1: USB disconnect, device number 81 [ 1074.743824][ T5677] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 1074.885534][T23144] fuse: Unknown parameter ' 0x000000000000000c' [ 1074.932814][ T5677] usb 3-1: Using ep0 maxpacket: 16 [ 1074.945463][ T5677] usb 3-1: config 3 has an invalid interface number: 20 but max is 0 [ 1074.957879][ T5677] usb 3-1: config 3 has no interface number 0 [ 1074.969121][T16819] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1074.991653][ T5677] usb 3-1: config 3 interface 20 has no altsetting 0 [ 1075.007478][ T5677] usb 3-1: New USB device found, idVendor=05ac, idProduct=0246, bcdDevice=27.b1 [ 1075.018514][ T5677] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1075.046506][ T5677] usb 3-1: Product: syz [ 1075.064030][ T5677] usb 3-1: Manufacturer: syz [ 1075.078324][ T5677] usb 3-1: SerialNumber: syz [ 1075.273985][T23147] syzkaller1: entered promiscuous mode [ 1075.279624][T23147] syzkaller1: entered allmulticast mode [ 1075.379264][ T5677] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:3.20/input/input76 [ 1075.562414][ T4976] bcm5974 3-1:3.20: could not read from device [ 1075.603690][ T4976] bcm5974 3-1:3.20: could not read from device [ 1075.627552][ T5677] usb 3-1: USB disconnect, device number 82 [ 1075.729043][ T4976] bcm5974 3-1:3.20: could not read from device [ 1075.749604][T23166] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4690'. [ 1075.767356][ T4976] bcm5974 3-1:3.20: could not read from device [ 1075.857092][T23169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1075.898028][T23169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1076.005964][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1076.071397][T23171] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 1076.622961][ T30] kauditd_printk_skb: 767 callbacks suppressed [ 1076.622975][ T30] audit: type=1326 audit(1785789742.171:4030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23180 comm="syz.5.4696" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7effc299e019 code=0x0 [ 1076.723242][ T5677] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 1076.768864][T23173] syzkaller1: entered promiscuous mode [ 1076.783254][T23173] syzkaller1: entered allmulticast mode [ 1076.883539][T16264] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1076.896640][T18491] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1076.913447][ T5677] usb 3-1: no configurations [ 1076.918744][ T5677] usb 3-1: can't read configurations, error -22 [ 1076.981805][T23185] fuse: Unknown parameter ' 0x000000000000000c' [ 1077.063133][ T5677] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 1077.132565][T23193] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4700'. [ 1077.227875][T23200] syzkaller0: entered promiscuous mode [ 1077.235499][T23200] syzkaller0: entered allmulticast mode [ 1077.256704][ T5677] usb 3-1: no configurations [ 1077.263829][ T5677] usb 3-1: can't read configurations, error -22 [ 1077.272100][T23200] ip_tables: iptables: counters copy to user failed while replacing table [ 1077.283360][ T5677] usb usb3-port1: attempt power cycle [ 1077.518470][T16817] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1077.543372][T23211] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1077.551457][T23209] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1077.632898][ T5677] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 1077.692319][ T5677] usb 3-1: no configurations [ 1077.697068][ T5677] usb 3-1: can't read configurations, error -22 [ 1077.815291][T23220] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4708'. [ 1077.847267][ T5677] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 1077.887146][ T5677] usb 3-1: no configurations [ 1077.891943][ T5677] usb 3-1: can't read configurations, error -22 [ 1077.900798][ T5677] usb usb3-port1: unable to enumerate USB device [ 1077.982568][T23213] syzkaller1: entered promiscuous mode [ 1077.988362][T23213] syzkaller1: entered allmulticast mode [ 1078.166349][T16264] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1078.179514][T23223] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1078.311374][T23225] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1078.581396][T23231] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1078.603314][T23231] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1079.043399][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1079.190546][T23240] netlink: 'syz.1.4714': attribute type 33 has an invalid length. [ 1079.198650][T23240] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4714'. [ 1079.214765][T23240] `: renamed from team0 (while UP) [ 1079.882347][T23259] syzkaller1: entered promiscuous mode [ 1079.890271][T23259] syzkaller1: entered allmulticast mode [ 1080.002331][T23270] futex_wake_op: syz.5.4724 tries to shift op by -1; fix this program [ 1080.362902][ T5677] usb 3-1: new full-speed USB device number 87 using dummy_hcd [ 1080.535255][ T5677] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1080.545980][ T5677] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1080.555214][ T5677] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1080.565582][ T5677] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1080.575989][ T5677] usb 3-1: config 0 descriptor?? [ 1080.724627][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1082.083079][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1082.277437][T23283] syzkaller0: entered promiscuous mode [ 1082.291913][T23283] syzkaller0: entered allmulticast mode [ 1082.310814][T23283] ip_tables: iptables: counters copy to user failed while replacing table [ 1082.403504][T16819] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1082.417858][T23287] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1082.425766][T23285] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1082.644648][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1082.840625][T23292] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 1082.847171][T23292] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1082.855572][T23292] vhci_hcd vhci_hcd.0: Device attached [ 1082.864924][ T6268] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1082.873612][ T6268] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1083.123972][T19714] usb 36-1: SetAddress Request (2) to port 0 [ 1083.131531][T19714] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 1083.141430][T23303] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(11) [ 1083.148060][T23303] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1083.158823][T23303] vhci_hcd vhci_hcd.0: Device attached [ 1083.161468][ T5677] usb 3-1: USB disconnect, device number 87 [ 1083.181596][T23303] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1083.201673][T23303] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1083.227859][T23304] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 0 [ 1083.240127][T16264] vhci_hcd vhci_hcd.5: stop threads [ 1083.268861][T16264] vhci_hcd vhci_hcd.5: release socket [ 1083.289023][T16264] vhci_hcd vhci_hcd.5: disconnect device [ 1083.314951][T23311] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4736'. [ 1083.316966][T23313] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4736'. [ 1083.334923][ T5717] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 1083.362441][T23295] vhci_hcd: connection reset by peer [ 1083.382307][T16264] vhci_hcd vhci_hcd.1: stop threads [ 1083.401319][T16264] vhci_hcd vhci_hcd.1: release socket [ 1083.428774][T16264] vhci_hcd vhci_hcd.1: disconnect device [ 1083.518032][T23307] syzkaller1: entered promiscuous mode [ 1083.527778][T23307] syzkaller1: entered allmulticast mode [ 1083.664487][T23316] syzkaller1: entered promiscuous mode [ 1083.670212][T23316] syzkaller1: entered allmulticast mode [ 1083.972915][ T5677] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 1084.146546][ T5677] usb 3-1: Using ep0 maxpacket: 32 [ 1084.167447][ T5677] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 1084.178563][ T5677] usb 3-1: config 0 has no interface number 0 [ 1084.186578][ T5677] usb 3-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1084.197849][ T5677] usb 3-1: config 0 interface 89 has no altsetting 0 [ 1084.207974][ T5677] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 1084.218074][ T5677] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1084.227136][ T5677] usb 3-1: Product: syz [ 1084.231695][ T5677] usb 3-1: Manufacturer: syz [ 1084.242635][ T5677] usb 3-1: SerialNumber: syz [ 1084.254031][ T5677] usb 3-1: config 0 descriptor?? [ 1084.265785][ T5677] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1084.293212][ T5677] em28xx 3-1:0.89: Video interface 89 found: [ 1084.318664][T23343] kvm: pic: non byte write [ 1084.580470][T23349] netlink: 48 bytes leftover after parsing attributes in process `syz.6.4748'. [ 1084.774356][T16264] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1084.779433][T23353] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1084.792088][T23351] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1084.872038][ T5677] em28xx 3-1:0.89: unknown em28xx chip ID (64) [ 1085.123090][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1085.180265][ T5677] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1085.198858][ T5677] em28xx 3-1:0.89: board has no eeprom [ 1085.237568][T23362] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4753'. [ 1085.252998][T23362] unsupported nlmsg_type 40 [ 1085.273819][ T5677] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 1085.287066][ T5677] em28xx 3-1:0.89: analog set to bulk mode. [ 1085.300185][ T9] em28xx 3-1:0.89: Registering V4L2 extension [ 1085.323063][ T5677] usb 3-1: USB disconnect, device number 88 [ 1085.342075][T16264] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1085.356432][ T5677] em28xx 3-1:0.89: Disconnecting em28xx [ 1085.455353][ T9] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 1085.471699][ T9] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 1085.481165][ T9] em28xx 3-1:0.89: No AC97 audio processor [ 1085.577225][ T9] usb 3-1: Decoder not found [ 1085.592589][ T9] em28xx 3-1:0.89: failed to create media graph [ 1085.608498][ T9] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 1085.676667][ T9] em28xx 3-1:0.89: Registering snapshot button... [ 1085.726826][ T9] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input77 [ 1085.726915][ T5632] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1085.739427][ T9] em28xx 3-1:0.89: Remote control support is not available for this card. [ 1085.759807][ T5677] em28xx 3-1:0.89: Closing input extension [ 1085.771495][ T5677] em28xx 3-1:0.89: Deregistering snapshot button [ 1085.777588][ T5632] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1085.791916][ T5632] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1085.818735][ T5632] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1085.827953][ T5632] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1085.844566][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1085.968551][ T5677] em28xx 3-1:0.89: Freeing device [ 1086.102075][T16264] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.368501][T16264] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.485935][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1086.709766][T16264] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.972902][ T5715] usb 3-1: new full-speed USB device number 89 using dummy_hcd [ 1087.158416][ T5715] usb 3-1: config 0 has an invalid descriptor of length 195, skipping remainder of the config [ 1087.196456][ T5715] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1087.224471][ T5715] usb 3-1: New USB device found, idVendor=09da, idProduct=062b, bcdDevice= 0.00 [ 1087.274155][ T5715] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1087.312605][ T5715] usb 3-1: config 0 descriptor?? [ 1087.621144][T16264] bridge_slave_1: left allmulticast mode [ 1087.665005][T16264] bridge_slave_1: left promiscuous mode [ 1087.685386][T16264] bridge0: port 2(bridge_slave_1) entered disabled state [ 1087.728972][T16264] bridge_slave_0: left allmulticast mode [ 1087.747960][T16264] bridge_slave_0: left promiscuous mode [ 1087.771311][T16264] bridge0: port 1(bridge_slave_0) entered disabled state [ 1087.933245][T19653] Bluetooth: hci5: command tx timeout [ 1088.163513][T19714] usb 36-1: device descriptor read/8, error -110 [ 1088.174393][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1088.413469][ T6268] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1088.489622][T16264] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1088.517301][T16264] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1088.541938][T16264] bond0 (unregistering): Released all slaves [ 1088.581919][T19714] usb usb36-port1: attempt power cycle [ 1089.140402][T23447] kAFS: unable to lookup cell '' [ 1089.151100][T23447] kAFS: unable to lookup cell '(,c' [ 1089.185234][T19714] usb usb36-port1: unable to enumerate USB device [ 1089.234852][T23370] bridge0: port 1(bridge_slave_0) entered blocking state [ 1089.252627][T23370] bridge0: port 1(bridge_slave_0) entered disabled state [ 1089.287048][T23370] bridge_slave_0: entered allmulticast mode [ 1089.321663][T23370] bridge_slave_0: entered promiscuous mode [ 1089.369117][T23370] bridge0: port 2(bridge_slave_1) entered blocking state [ 1089.448359][T23370] bridge0: port 2(bridge_slave_1) entered disabled state [ 1089.474625][T23370] bridge_slave_1: entered allmulticast mode [ 1089.500915][T23370] bridge_slave_1: entered promiscuous mode [ 1089.550677][T16264] hsr_slave_0: left promiscuous mode [ 1089.609701][T16264] hsr_slave_1: left promiscuous mode [ 1089.637473][T16264] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1089.661090][T16264] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1089.694256][T16264] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1089.732951][T16264] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1089.841009][T16264] veth1_macvtap: left promiscuous mode [ 1089.866507][T16264] veth0_macvtap: left promiscuous mode [ 1089.889741][T16264] veth1_vlan: left promiscuous mode [ 1089.910116][T16264] veth0_vlan: left promiscuous mode [ 1089.991087][ T30] audit: type=1326 audit(1785789755.541:4031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23453 comm="syz.5.4777" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1090.016446][T19653] Bluetooth: hci5: command tx timeout [ 1090.065831][ T30] audit: type=1326 audit(1785789755.541:4032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23453 comm="syz.5.4777" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1090.099907][ T30] audit: type=1326 audit(1785789755.581:4033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23453 comm="syz.5.4777" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1090.127962][ T30] audit: type=1326 audit(1785789755.581:4034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23453 comm="syz.5.4777" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1090.183910][ T5677] usb 3-1: USB disconnect, device number 89 [ 1090.220211][ T30] audit: type=1326 audit(1785789755.581:4035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23453 comm="syz.5.4777" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1090.256279][ T30] audit: type=1326 audit(1785789755.591:4036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23453 comm="syz.5.4777" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1090.285924][ T30] audit: type=1326 audit(1785789755.591:4037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23453 comm="syz.5.4777" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1090.338238][ T30] audit: type=1326 audit(1785789755.591:4038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23453 comm="syz.5.4777" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1090.366175][ T30] audit: type=1326 audit(1785789755.591:4039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23453 comm="syz.5.4777" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=131 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1090.393394][ T30] audit: type=1326 audit(1785789755.591:4040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23453 comm="syz.5.4777" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc299e019 code=0x7ffc0000 [ 1090.755151][T23461] loop5: detected capacity change from 0 to 7 [ 1090.780667][T23461] Dev loop5: unable to read RDB block 7 [ 1090.796860][T23461] loop5: unable to read partition table [ 1090.822723][T23461] loop5: partition table beyond EOD, truncated [ 1090.837775][T23461] loop_reread_partitions: partition scan of loop5 (被x) failed (rc=-5) [ 1091.203103][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1091.348238][T16264] team0 (unregistering): Port device team_slave_1 removed [ 1091.415663][T16264] team0 (unregistering): Port device team_slave_0 removed [ 1091.607739][ T6268] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1091.673021][ T5286] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1091.782407][T23493] syzkaller0: entered promiscuous mode [ 1091.788800][T23493] syzkaller0: entered allmulticast mode [ 1091.805213][T23370] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1091.830234][T23370] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1091.922222][T23370] team0: Port device team_slave_0 added [ 1092.085565][T19653] Bluetooth: hci5: command tx timeout [ 1093.534655][T16817] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1094.187883][T19653] Bluetooth: hci5: command tx timeout [ 1094.258450][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1094.525197][ T4991] udevd[4991]: worker [6506] /devices/platform/dummy_hcd.1/usb2/2-1 is taking a long time [ 1096.088275][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1097.289193][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1097.369103][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1098.362465][T23370] team0: Port device team_slave_1 added [ 1098.411038][T23370] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1098.419161][T23370] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1098.446002][T23370] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1098.530000][T23507] syzkaller1: entered promiscuous mode [ 1098.540812][T23507] syzkaller1: entered allmulticast mode [ 1098.567771][T23370] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1098.575005][T23370] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1098.633008][T23370] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1098.749136][T23516] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4799'. [ 1098.886123][T23370] hsr_slave_0: entered promiscuous mode [ 1098.909121][T23370] hsr_slave_1: entered promiscuous mode [ 1098.926214][T23370] debugfs: 'hsr0' already exists in 'hsr' [ 1098.942426][T23370] Cannot create hsr debugfs directory [ 1099.286760][T16817] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1100.027681][T23547] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4805'. [ 1100.323687][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1100.439325][ T5286] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1100.742763][ T5677] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 1100.919921][ T5677] usb 3-1: config 0 has no interfaces? [ 1100.937025][ T5677] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 1100.979718][ T5677] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1100.993085][ T5677] usb 3-1: config 0 descriptor?? [ 1101.375122][T23568] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4808'. [ 1101.429186][ T5677] usb 3-1: USB disconnect, device number 90 [ 1102.205591][T23370] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1102.230968][T23370] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1102.248661][T23370] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1102.273435][T23370] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1102.298298][T23370] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1102.336205][T23370] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1102.368318][T23370] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1102.416748][T23370] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1102.679097][T23370] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1102.693111][T19714] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1102.739065][T23370] 8021q: adding VLAN 0 to HW filter on device team0 [ 1102.808620][T21956] bridge0: port 1(bridge_slave_0) entered blocking state [ 1102.816122][T21956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1102.849427][ T6389] bridge0: port 2(bridge_slave_1) entered blocking state [ 1102.856651][ T6389] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1102.933579][T19714] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1102.944695][T19714] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1102.958001][T19714] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1103.001332][T19714] usb 3-1: New USB device found, idVendor=04fa, idProduct=4201, bcdDevice= 0.40 [ 1103.060602][T23370] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1103.084660][T23370] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1103.124342][ T6389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1103.126635][T19714] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1103.141826][T19714] usb 3-1: Product: syz [ 1103.147521][T19714] usb 3-1: Manufacturer: syz [ 1103.155575][T19714] usb 3-1: SerialNumber: syz [ 1103.363992][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1103.586994][T23370] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1103.665616][ T5717] bridge0: entered promiscuous mode [ 1103.836575][T23370] veth0_vlan: entered promiscuous mode [ 1103.880719][T23370] veth1_vlan: entered promiscuous mode [ 1104.038155][T23370] veth0_macvtap: entered promiscuous mode [ 1104.094511][T23370] veth1_macvtap: entered promiscuous mode [ 1104.197847][T23370] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1104.279741][T23370] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1104.404994][T21956] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1104.574307][T16264] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.650562][T16817] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.714996][T16264] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.784737][T16817] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1105.151306][T16827] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1105.181093][T16827] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1105.276930][T21956] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1105.278129][T23651] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4821'. [ 1105.295035][T21956] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1105.321689][T23651] netlink: 'syz.5.4821': attribute type 3 has an invalid length. [ 1105.335881][T23651] netlink: 'syz.5.4821': attribute type 3 has an invalid length. [ 1105.391150][T23651] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4821'. [ 1105.584961][T19714] usb 3-1: 1:1 : sample bitwidth 62 in over sample bytes 3 [ 1105.618775][T19714] usb 3-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 1105.682191][T19714] usb 3-1: failed to enable PITCH for EP 0x1 [ 1105.691823][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1105.728424][T19714] usb 3-1: unit 2 not found! [ 1105.741002][T19714] usb 3-1: unit 0 not found! [ 1105.817391][T23664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1105.852508][T23664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1105.861992][T19714] usb 3-1: USB disconnect, device number 91 [ 1106.202773][T19714] usb 3-1: new low-speed USB device number 92 using dummy_hcd [ 1106.367850][T19714] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1106.404614][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1106.416215][T19714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 8 [ 1106.453704][T19714] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1106.491373][T19714] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1b3e, bcdDevice= 0.00 [ 1106.509080][T19714] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1106.535192][T19714] usb 3-1: config 0 descriptor?? [ 1106.549396][T23661] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1106.851486][ T30] kauditd_printk_skb: 739 callbacks suppressed [ 1106.851504][ T30] audit: type=1326 audit(1785789772.401:4780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23666 comm="syz.1.4834" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105279e019 code=0x7ffc0000 [ 1106.901196][ T30] audit: type=1326 audit(1785789772.441:4781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23666 comm="syz.1.4834" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105279e019 code=0x7ffc0000 [ 1106.932996][ T30] audit: type=1326 audit(1785789772.481:4782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23666 comm="syz.1.4834" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105279e019 code=0x7ffc0000 [ 1106.960645][ T30] audit: type=1326 audit(1785789772.481:4783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23666 comm="syz.1.4834" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105279e019 code=0x7ffc0000 [ 1106.988114][ T30] audit: type=1326 audit(1785789772.481:4784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23666 comm="syz.1.4834" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f105279e019 code=0x7ffc0000 [ 1107.053489][ T30] audit: type=1326 audit(1785789772.481:4785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23666 comm="syz.1.4834" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105279e019 code=0x7ffc0000 [ 1107.105620][T23671] kAFS: unable to lookup cell '' [ 1107.115450][T19714] corsair 0003:1B1C:1B3E.002C: unknown main item tag 0x2 [ 1107.132904][T19714] corsair 0003:1B1C:1B3E.002C: unexpected long global item [ 1107.133954][ T30] audit: type=1326 audit(1785789772.481:4786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23666 comm="syz.1.4834" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105279e019 code=0x7ffc0000 [ 1107.180876][T23672] kAFS: unable to lookup cell '(,c' [ 1107.201138][T19714] corsair 0003:1B1C:1B3E.002C: parse failed [ 1107.218187][T19714] corsair 0003:1B1C:1B3E.002C: probe with driver corsair failed with error -22 [ 1107.233615][ T30] audit: type=1326 audit(1785789772.481:4787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23666 comm="syz.1.4834" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105279e019 code=0x7ffc0000 [ 1107.323816][T23661] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4823'. [ 1107.333571][ T30] audit: type=1326 audit(1785789772.481:4788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23666 comm="syz.1.4834" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105279e019 code=0x7ffc0000 [ 1107.399620][ T10] usb 3-1: USB disconnect, device number 92 [ 1107.429641][ T30] audit: type=1326 audit(1785789772.481:4789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23666 comm="syz.1.4834" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f105279e019 code=0x7ffc0000 [ 1107.892909][T23675] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 1107.899488][T23675] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1107.987957][T23675] vhci_hcd vhci_hcd.0: Device attached [ 1108.252795][ T9] usb 36-1: SetAddress Request (6) to port 0 [ 1108.259354][ T9] usb 36-1: new SuperSpeed USB device number 6 using vhci_hcd [ 1108.885249][T16264] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1108.910872][T23676] vhci_hcd: connection reset by peer [ 1108.919197][T16264] vhci_hcd vhci_hcd.1: stop threads [ 1108.925676][T16264] vhci_hcd vhci_hcd.1: release socket [ 1108.936155][T16264] vhci_hcd vhci_hcd.1: disconnect device [ 1109.444261][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1110.165254][T21956] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1112.158773][T23749] netlink: 'syz.5.4850': attribute type 10 has an invalid length. [ 1112.209574][T23753] netlink: 'syz.5.4850': attribute type 10 has an invalid length. [ 1112.290361][T23749] team0: Port device dummy0 added [ 1112.380290][T23753] team0: Port device dummy0 removed [ 1112.415788][T23753] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1112.493825][T23762] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1112.495440][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1112.508937][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1112.524043][T23762] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1112.542485][T23762] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1112.551857][T18491] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1112.558726][T23762] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1112.567444][T23762] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1112.577318][T23762] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1112.600984][T23762] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1113.362870][ T9] usb 36-1: device descriptor read/8, error -110 [ 1113.703487][T19714] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1113.817979][ T9] usb usb36-port1: attempt power cycle [ 1113.895904][T19714] usb 3-1: Using ep0 maxpacket: 16 [ 1113.931234][T19714] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1113.942554][T23785] syz.6.4863 (23785): drop_caches: 2 [ 1113.963811][T19714] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1113.991744][T19714] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1114.020382][T19714] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1114.046749][T19714] usb 3-1: config 0 descriptor?? [ 1114.095403][T19714] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1114.311858][T23809] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1114.358859][T23809] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1114.373477][T23786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1114.407789][T23786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1114.456749][ T9] usb usb36-port1: unable to enumerate USB device [ 1114.562864][T19653] Bluetooth: hci3: command 0x0c1a tx timeout [ 1114.562936][ T5632] Bluetooth: hci1: command 0x0406 tx timeout [ 1114.568965][T19653] Bluetooth: hci4: command 0x0406 tx timeout [ 1114.575209][ T5632] Bluetooth: hci2: command 0x0406 tx timeout [ 1114.645410][ T5632] Bluetooth: hci5: command 0x0c1a tx timeout [ 1114.651955][ T6389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.293086][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.308422][ T9320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.330890][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.609272][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.925664][T16264] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1115.937464][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.944118][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.637438][T23861] loop5: detected capacity change from 0 to 7 [ 1116.682522][T23861] Dev loop5: unable to read RDB block 7 [ 1116.723374][ T5632] Bluetooth: hci5: command 0x0c1a tx timeout [ 1116.725370][T23861] loop5: unable to read partition table [ 1116.759785][T23861] loop5: partition table beyond EOD, truncated [ 1116.782111][T23861] loop_reread_partitions: partition scan of loop5 (被x) failed (rc=-5) [ 1117.013518][ T10] usb 3-1: USB disconnect, device number 93 [ 1118.643336][T18491] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1118.804080][ T5632] Bluetooth: hci5: command 0x0c1a tx timeout [ 1120.413117][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1120.690070][T23927] bridge0: port 3(macvlan2) entered blocking state [ 1120.707907][T23927] bridge0: port 3(macvlan2) entered disabled state [ 1120.727691][T23927] macvlan2: entered allmulticast mode [ 1120.742617][T23927] ip6gretap0: entered allmulticast mode [ 1120.765276][T23927] macvlan2: entered promiscuous mode [ 1120.777212][T23927] bridge0: port 3(macvlan2) entered blocking state [ 1120.784082][T23927] bridge0: port 3(macvlan2) entered forwarding state [ 1120.832292][T23931] loop5: detected capacity change from 0 to 7 [ 1120.863931][T23931] Dev loop5: unable to read RDB block 7 [ 1120.889161][T23931] loop5: unable to read partition table [ 1120.901029][T23931] loop5: partition table beyond EOD, truncated [ 1120.918938][T23931] loop_reread_partitions: partition scan of loop5 (被x) failed (rc=-5) [ 1120.960837][T23935] UHID_CREATE from different security context by process 639 (syz.1.4910), this is not allowed. [ 1121.073083][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1121.091186][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1121.107540][T18491] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1121.362040][T23955] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4917'. [ 1121.480246][T23959] netlink: 'syz.0.4919': attribute type 2 has an invalid length. [ 1121.520434][T23959] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4919'. [ 1121.590527][T23959] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4919'. [ 1121.693131][T16827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1121.701402][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1122.565874][T23974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1122.581872][T23974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1122.852805][T19714] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1122.983166][T19714] usb 3-1: device descriptor read/64, error -71 [ 1123.222958][T19714] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1123.352880][T19714] usb 3-1: device descriptor read/64, error -71 [ 1123.463660][T19714] usb usb3-port1: attempt power cycle [ 1123.822905][T19714] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1123.846714][T19714] usb 3-1: device descriptor read/8, error -71 [ 1124.102809][T19714] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 1124.123387][T19714] usb 3-1: device descriptor read/8, error -71 [ 1124.243612][T19714] usb usb3-port1: unable to enumerate USB device [ 1124.733918][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1125.523008][T24020] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1125.533068][T24020] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1126.168155][T16819] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1126.443837][T24032] syz.1.4949 (24032): drop_caches: 1 [ 1126.443838][T24033] syz.1.4949 (24033): drop_caches: 1 [ 1126.505388][T24032] syz.1.4949 (24032): drop_caches: 1 [ 1126.694050][T24043] syz.1.4953 (24043): drop_caches: 1 [ 1126.723540][T16817] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1126.769282][T24043] syz.1.4953 (24043): drop_caches: 1 [ 1126.786097][T24045] syz.1.4953 (24045): drop_caches: 1 [ 1126.804279][T21956] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1126.814975][ T9320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1126.835900][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1127.048911][T24055] loop5: detected capacity change from 0 to 7 [ 1127.057307][T24055] Dev loop5: unable to read RDB block 7 [ 1127.063665][T24055] loop5: unable to read partition table [ 1127.069494][T24055] loop5: partition table beyond EOD, truncated [ 1127.076484][T24055] loop_reread_partitions: partition scan of loop5 (被x) failed (rc=-5) [ 1127.103400][T19714] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1127.252779][T19714] usb 3-1: Using ep0 maxpacket: 16 [ 1127.268573][T19714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 1127.285027][T19714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 1127.301019][T19714] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1127.316099][T19714] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1127.332995][T19714] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1127.348575][T19714] usb 3-1: config 0 descriptor?? [ 1127.360881][T24049] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 1127.440402][T24065] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1127.553111][T16817] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1127.565515][T24063] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1127.795361][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1128.402082][T24082] loop5: detected capacity change from 0 to 7 [ 1128.411738][T24082] Dev loop5: unable to read RDB block 7 [ 1128.417951][T24082] loop5: unable to read partition table [ 1128.424387][T24082] loop5: partition table beyond EOD, truncated [ 1128.430646][T24082] loop_reread_partitions: partition scan of loop5 (被x) failed (rc=-5) [ 1129.089633][T24090] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1129.103748][T24090] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1129.115476][T24090] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4971'. [ 1129.603324][T19714] usbhid 3-1:0.0: can't add hid device: -71 [ 1129.623135][T19714] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1129.634556][T19714] usb 3-1: USB disconnect, device number 98 [ 1129.875091][T16262] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1129.885047][T24100] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1129.913432][T24102] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1130.804071][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1130.822916][ T5632] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 1130.849851][T24110] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1130.860474][T24110] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1130.870161][T24110] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1131.283649][T16262] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1131.843640][T16817] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1133.845175][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1134.055308][T24151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1134.085265][T24151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1134.159873][T24152] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1134.181152][T24152] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1134.197839][T24152] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1134.701536][T24155] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1134.721008][T24155] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1135.478627][T24175] netlink: 'syz.2.5000': attribute type 10 has an invalid length. [ 1135.526996][T24181] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1135.552253][T24175] team_slave_0: left promiscuous mode [ 1135.662979][T24175] team0 (unregistering): Port device team_slave_0 removed [ 1135.674592][T16819] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1135.697186][T24179] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1135.780612][T24175] team_slave_1: left promiscuous mode [ 1135.995869][T24175] team0 (unregistering): Port device team_slave_1 removed [ 1136.115997][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805f0f4400: rx timeout, send abort [ 1136.124567][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805f0f4400: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 1136.404723][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1136.418866][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1136.866326][T24191] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(11) [ 1136.873061][T24191] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1136.892390][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1136.932519][T24191] vhci_hcd vhci_hcd.0: Device attached [ 1137.045563][ T6389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1137.104317][ T9320] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 1137.173064][ T9320] usb 35-1: new full-speed USB device number 7 using vhci_hcd [ 1137.246084][T24197] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1137.315740][T24197] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1137.373932][T24188] syzkaller1: entered promiscuous mode [ 1137.390390][T24188] syzkaller1: entered allmulticast mode [ 1137.512161][T24211] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5011'. [ 1137.536529][T24203] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1137.566237][T24209] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1137.605380][T24203] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1137.686703][ T6389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1138.653076][ T10] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 1138.823015][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 1138.842106][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1138.856400][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1138.896631][ T10] usb 3-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 1138.908904][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1138.925982][ T10] usb 3-1: Product: syz [ 1138.935864][ T10] usb 3-1: Manufacturer: syz [ 1138.945492][ T10] usb 3-1: SerialNumber: syz [ 1139.830576][T24193] vhci_hcd: connection reset by peer [ 1139.863912][T16817] vhci_hcd vhci_hcd.1: stop threads [ 1139.896847][T16817] vhci_hcd vhci_hcd.1: release socket [ 1139.919351][T16817] vhci_hcd vhci_hcd.1: disconnect device [ 1139.927754][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1140.195718][T24254] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(11) [ 1140.202367][T24254] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1140.316495][T24254] vhci_hcd vhci_hcd.0: Device attached [ 1140.474553][ C0] vcan0: j1939_tp_rxtimer: 0xffff88801e30ec00: rx timeout, send abort [ 1140.483933][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88801e30ec00: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 1140.509198][ T5717] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 1140.593821][ T5717] usb 33-1: new full-speed USB device number 8 using vhci_hcd [ 1141.021239][T19714] IPVS: starting estimator thread 0... [ 1141.032529][T24277] netlink: 'syz.6.5023': attribute type 13 has an invalid length. [ 1141.143969][T24278] IPVS: using max 57 ests per chain, 136800 per kthread [ 1141.525240][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1142.145515][T24292] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 1142.169820][T16262] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1142.204314][T21962] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 1142.239112][T24288] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 1142.313182][ T9320] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 1142.442718][ T0] NOHZ tick-stop error: local softirq work is pending, handler #182!!! [ 1142.465614][T24297] netlink: 'syz.5.5031': attribute type 1 has an invalid length. [ 1142.490881][T24297] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5031'. [ 1142.554016][T24291] lo: Caught tx_queue_len zero misconfig [ 1143.057572][T24262] vhci_hcd: connection reset by peer [ 1143.081030][T21956] vhci_hcd vhci_hcd.0: stop threads [ 1143.093969][T21956] vhci_hcd vhci_hcd.0: release socket [ 1143.120069][T21956] vhci_hcd vhci_hcd.0: disconnect device [ 1143.221742][ T10] usb 3-1: unit 6 not found! [ 1143.324366][ T10] usb 3-1: USB disconnect, device number 99 [ 1143.443590][T21962] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1144.456623][T24315] syzkaller1: entered promiscuous mode [ 1144.491570][T24315] syzkaller1: entered allmulticast mode [ 1144.573085][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1145.763054][ T5717] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 1146.018738][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1146.645043][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1146.672937][ T9320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1147.283646][T16819] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1147.590757][T24389] syzkaller1: entered promiscuous mode [ 1147.596964][T24389] syzkaller1: entered allmulticast mode [ 1147.606480][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1148.017344][T24415] syz.1.5075 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=1000 [ 1148.030038][T24415] CPU: 0 UID: 0 PID: 24415 Comm: syz.1.5075 Tainted: G L syzkaller #0 PREEMPT(full) [ 1148.030071][T24415] Tainted: [L]=SOFTLOCKUP [ 1148.030078][T24415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1148.030090][T24415] Call Trace: [ 1148.030097][T24415] [ 1148.030107][T24415] dump_stack_lvl+0xe8/0x150 [ 1148.030137][T24415] dump_header+0xd3/0x4b0 [ 1148.030163][T24415] oom_kill_process+0x3ab/0x970 [ 1148.030188][T24415] out_of_memory+0x1064/0x1480 [ 1148.030205][T24415] ? try_charge_memcg+0xbca/0x1590 [ 1148.030241][T24415] ? __pfx_out_of_memory+0x10/0x10 [ 1148.030258][T24415] ? do_raw_spin_unlock+0xf5/0x210 [ 1148.030296][T24415] try_charge_memcg+0xc74/0x1590 [ 1148.030335][T24415] ? __pfx_try_charge_memcg+0x10/0x10 [ 1148.030364][T24415] ? percpu_ref_tryget+0x15/0x180 [ 1148.030389][T24415] ? __memcg_slab_post_alloc_hook+0x710/0xf10 [ 1148.030407][T24415] ? __memcg_slab_post_alloc_hook+0x710/0xf10 [ 1148.030419][T24415] ? __memcg_slab_post_alloc_hook+0x710/0xf10 [ 1148.030432][T24415] __memcg_slab_post_alloc_hook+0x909/0xf10 [ 1148.030453][T24415] ? __kmalloc_cache_noprof+0x150/0x660 [ 1148.030466][T24415] __kmalloc_cache_noprof+0x372/0x660 [ 1148.030479][T24415] ? __kmalloc_cache_noprof+0x150/0x660 [ 1148.030491][T24415] ? kvm_ioapic_init+0x58/0xf20 [ 1148.030527][T24415] ? kvm_ioapic_init+0x58/0xf20 [ 1148.030540][T24415] kvm_ioapic_init+0x58/0xf20 [ 1148.030549][T24415] ? kvm_pic_init+0x226/0x2f0 [ 1148.030565][T24415] kvm_arch_vm_ioctl+0x1736/0x1a10 [ 1148.030584][T24415] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 1148.030597][T24415] ? __lock_acquire+0x683/0x2cf0 [ 1148.030616][T24415] ? __lock_acquire+0x683/0x2cf0 [ 1148.030641][T24415] ? unwind_next_frame+0x8f/0x2550 [ 1148.030656][T24415] ? is_bpf_text_address+0x26/0x2b0 [ 1148.030677][T24415] ? is_bpf_text_address+0x26/0x2b0 [ 1148.030692][T24415] ? is_bpf_text_address+0x292/0x2b0 [ 1148.030705][T24415] ? is_bpf_text_address+0x26/0x2b0 [ 1148.030724][T24415] ? kernel_text_address+0xa5/0xe0 [ 1148.030741][T24415] ? __kernel_text_address+0xd/0x30 [ 1148.030757][T24415] ? unwind_get_return_address+0x4d/0x90 [ 1148.030773][T24415] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1148.030795][T24415] ? arch_stack_walk+0xfb/0x150 [ 1148.030819][T24415] ? stack_trace_save+0xa9/0x100 [ 1148.030831][T24415] ? __pfx_stack_trace_save+0x10/0x10 [ 1148.030842][T24415] ? kasan_save_track+0x4f/0x80 [ 1148.030856][T24415] ? stack_depot_save_flags+0x33/0x800 [ 1148.030870][T24415] ? __lock_acquire+0x683/0x2cf0 [ 1148.030885][T24415] ? kasan_save_track+0x4f/0x80 [ 1148.030896][T24415] ? kasan_save_track+0x3e/0x80 [ 1148.030907][T24415] ? kasan_save_free_info+0x40/0x50 [ 1148.030918][T24415] ? __kasan_slab_free+0x5c/0x80 [ 1148.030930][T24415] ? kfree+0x1c5/0x640 [ 1148.030940][T24415] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 1148.030954][T24415] ? security_file_ioctl+0xc3/0x2a0 [ 1148.030967][T24415] ? __se_sys_ioctl+0x47/0x170 [ 1148.030977][T24415] ? do_syscall_64+0x174/0x580 [ 1148.030990][T24415] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1148.031009][T24415] kvm_vm_ioctl+0x8f7/0xd30 [ 1148.031026][T24415] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 1148.031051][T24415] ? kasan_quarantine_put+0xbb/0x1f0 [ 1148.031075][T24415] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1148.031093][T24415] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1148.031110][T24415] ? do_vfs_ioctl+0x116f/0x1530 [ 1148.031122][T24415] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1148.031140][T24415] ? hook_file_ioctl+0x1f0/0x5f0 [ 1148.031175][T24415] ? __fget_files+0x2a/0x420 [ 1148.031201][T24415] ? __fget_files+0x2a/0x420 [ 1148.031223][T24415] ? __fget_files+0x3a2/0x420 [ 1148.031239][T24415] ? __fget_files+0x2a/0x420 [ 1148.031254][T24415] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1148.031267][T24415] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 1148.031292][T24415] __se_sys_ioctl+0xfc/0x170 [ 1148.031304][T24415] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1148.031315][T24415] do_syscall_64+0x174/0x580 [ 1148.031328][T24415] ? trace_irq_disable+0x3b/0x140 [ 1148.031341][T24415] ? clear_bhb_loop+0x40/0x90 [ 1148.031354][T24415] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1148.031364][T24415] RIP: 0033:0x7f105279e019 [ 1148.031376][T24415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1148.031386][T24415] RSP: 002b:00007f1053659028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1148.031398][T24415] RAX: ffffffffffffffda RBX: 00007f1052a25fa0 RCX: 00007f105279e019 [ 1148.031406][T24415] RDX: 0000000000000000 RSI: 000000000000ae60 RDI: 0000000000000004 [ 1148.031413][T24415] RBP: 00007f105283500c R08: 0000000000000000 R09: 0000000000000000 [ 1148.031420][T24415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1148.031427][T24415] R13: 00007f1052a26038 R14: 00007f1052a25fa0 R15: 00007f1052b4fa48 [ 1148.031443][T24415] [ 1148.031522][T24415] memory: usage 4kB, limit 8kB, failcnt 20 [ 1148.483634][T21956] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1148.531113][T24415] memory+swap: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 1148.631386][T24415] kmem: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 1148.683043][T24415] Memory cgroup stats for /syz1/test: [ 1148.683464][T24415] cache 0 [ 1148.708564][T24432] loop5: detected capacity change from 0 to 7 [ 1148.720039][T24415] rss 0 [ 1148.725021][T24415] rss_huge 0 [ 1148.730821][T24432] Dev loop5: unable to read RDB block 7 [ 1148.732712][T24415] shmem 0 [ 1148.752311][T24432] loop5: unable to read partition table [ 1148.758759][T24415] mapped_file 0 [ 1148.775539][T24432] loop5: partition table beyond EOD, truncated [ 1148.781856][T24415] dirty 0 [ 1148.794578][T24415] writeback 0 [ 1148.804845][T24432] loop_reread_partitions: partition scan of loop5 (被x) failed (rc=-5) [ 1148.838858][T24415] workingset_refault_anon 0 [ 1148.867735][T24415] workingset_refault_file 0 [ 1148.876979][T24415] swap 0 [ 1148.891014][T24415] swapcached 0 [ 1148.905343][T24415] pgpgin 0 [ 1148.914012][T24415] pgpgout 0 [ 1148.926418][T24415] pgfault 0 [ 1148.939031][T24415] pgmajfault 0 [ 1148.950526][T24415] inactive_anon 0 [ 1148.959618][T24415] active_anon 0 [ 1148.978267][T24415] inactive_file 0 [ 1149.003838][T24436] netlink: 'syz.2.5081': attribute type 1 has an invalid length. [ 1149.015445][T24415] active_file 0 [ 1149.020740][T24415] unevictable 0 [ 1149.034243][T24436] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5081'. [ 1149.045230][T24415] hierarchical_memory_limit 8192 [ 1149.052527][T24415] hierarchical_memsw_limit 9223372036854771712 [ 1149.084083][T24415] total_cache 0 [ 1149.107682][T24415] total_rss 0 [ 1149.119582][T24415] total_rss_huge 0 [ 1149.132910][T24415] total_shmem 0 [ 1149.137074][T24415] total_mapped_file 0 [ 1149.148927][T24415] total_dirty 0 [ 1149.159115][T24415] total_writeback 0 [ 1149.173186][T24415] total_workingset_refault_anon 0 [ 1149.198231][T24415] total_workingset_refault_file 0 [ 1149.226810][T24415] total_swap 0 [ 1149.246969][T24415] total_swapcached 0 [ 1149.257616][T24415] total_pgpgin 0 [ 1149.272926][T24415] total_pgpgout 0 [ 1149.291138][T24415] total_pgfault 0 [ 1149.312810][T24415] total_pgmajfault 0 [ 1149.329947][T24415] total_inactive_anon 0 [ 1149.346814][T24415] total_active_anon 0 [ 1149.373321][T24415] total_inactive_file 0 [ 1149.402943][T24415] total_active_file 0 [ 1149.423949][T24415] total_unevictable 0 [ 1149.458629][T24415] anon_cost 0 [ 1149.481339][T24415] file_cost 0 [ 1149.512337][T24415] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.5075,pid=24414,uid=0 [ 1149.655684][T24415] Memory cgroup out of memory: Killed process 24415 (syz.1.5075) total-vm:102252kB, anon-rss:1428kB, file-rss:23132kB, shmem-rss:0kB, UID:0 pgtables:140kB oom_score_adj:1000 [ 1149.715961][T24444] syzkaller1: entered promiscuous mode [ 1149.727964][T24444] syzkaller1: entered allmulticast mode [ 1150.087557][T24453] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5086'. [ 1150.450985][T24467] loop5: detected capacity change from 0 to 7 [ 1150.581947][T24467] Dev loop5: unable to read RDB block 7 [ 1150.622163][T24467] loop5: unable to read partition table [ 1150.651226][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1150.681729][T24467] loop5: partition table beyond EOD, truncated [ 1150.741676][T24467] loop_reread_partitions: partition scan of loop5 (被x) failed (rc=-5) [ 1152.255459][T24468] syz.5.5091 (24468): drop_caches: 1 [ 1152.413889][T24515] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5099'. [ 1152.934950][T24526] loop5: detected capacity change from 0 to 7 [ 1152.954137][T24526] Dev loop5: unable to read RDB block 7 [ 1152.976411][T24526] loop5: unable to read partition table [ 1153.003915][T24526] loop5: partition table beyond EOD, truncated [ 1153.046256][T16264] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1153.046358][T24526] loop_reread_partitions: partition scan of loop5 (被x) failed (rc=-5) [ 1153.683024][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1153.900975][T24543] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5110'. [ 1153.967046][T24541] syz.2.5109 (24541): drop_caches: 1 [ 1154.320445][T24545] syzkaller1: entered promiscuous mode [ 1154.328661][T24545] syzkaller1: entered allmulticast mode [ 1154.335297][T16264] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1155.184066][T24578] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5124'. [ 1155.439403][T24575] syzkaller1: entered promiscuous mode [ 1155.467587][T24575] syzkaller1: entered allmulticast mode [ 1156.244751][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1156.723142][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1156.887801][T16264] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1156.896776][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1156.916175][T19714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1157.182967][ T10] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 1157.385930][ T10] usb 3-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 1157.428940][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1157.500965][ T10] usb 3-1: Product: syz [ 1157.515301][ T10] usb 3-1: Manufacturer: syz [ 1157.538840][ T10] usb 3-1: SerialNumber: syz [ 1157.613271][ T10] usb 3-1: config 0 descriptor?? [ 1157.632716][T24620] syzkaller1: entered promiscuous mode [ 1157.647273][ T10] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 1157.670572][T24620] syzkaller1: entered allmulticast mode [ 1157.697114][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1157.727572][ T10] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 1157.760180][ T10] usb 3-1: media controller created [ 1157.871538][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1158.324602][ T10] DVB: Unable to find symbol mt352_attach() [ 1158.525161][ T10] DVB: Unable to find symbol nxt6000_attach() [ 1158.553079][ T10] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 1158.602468][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input78 [ 1158.684606][ T10] dvb-usb: schedule remote query interval to 1000 msecs. [ 1158.721401][ T10] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 1158.761707][ T10] dvb-usb: bulk message failed: -22 (7/0) [ 1158.785331][ T10] dvb-usb: bulk message failed: -22 (7/0) [ 1158.803262][T16262] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1158.838187][ T10] usb 3-1: USB disconnect, device number 100 [ 1159.073467][ T10] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 1159.413016][ T10] usb 3-1: new low-speed USB device number 101 using dummy_hcd [ 1159.428078][T24674] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1159.443608][ T31] INFO: task kworker/0:6:5712 blocked for more than 143 seconds. [ 1159.461946][ T31] Tainted: G L syzkaller #0 [ 1159.469772][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1159.479168][ T31] task:kworker/0:6 state:D stack:20104 pid:5712 tgid:5712 ppid:2 task_flags:0x4288060 flags:0x00080000 [ 1159.499001][T24679] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1159.509510][ T31] Workqueue: usb_hub_wq hub_event [ 1159.517956][ T31] Call Trace: [ 1159.521312][ T31] [ 1159.526763][ T31] __schedule+0x17d9/0x56c0 [ 1159.537669][ T31] ? __lock_acquire+0x683/0x2cf0 [ 1159.543919][T24674] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1159.552805][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 1159.563960][ T31] ? __pfx___schedule+0x10/0x10 [ 1159.572398][ T31] ? schedule+0x90/0x2b0 [ 1159.578361][T24681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1159.586876][ T31] schedule+0x164/0x2b0 [ 1159.591077][ T31] schedule_timeout+0xc0/0x2c0 [ 1159.596456][T24681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1159.607195][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1159.607485][T24660] syzkaller1: entered promiscuous mode [ 1159.621392][T24660] syzkaller1: entered allmulticast mode [ 1159.628102][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 1159.635985][ T10] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1159.647641][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1159.656090][ T31] ? wait_for_completion+0x272/0x5e0 [ 1159.656806][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 8 [ 1159.675710][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1159.689400][ T10] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1b3e, bcdDevice= 0.00 [ 1159.691087][ T31] wait_for_completion+0x2ca/0x5e0 [ 1159.699003][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1159.719751][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 1159.730466][ T31] ? kobject_put+0x50f/0x550 [ 1159.736440][ T10] usb 3-1: config 0 descriptor?? [ 1159.746228][ T31] i2c_del_adapter+0x281/0x430 [ 1159.746620][T24662] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1159.762063][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 1159.775607][ T31] ? kfree+0x4d/0x640 [ 1159.784450][ T31] dvb_usb_i2c_exit+0x64/0xb0 [ 1159.793762][ T31] dvb_usb_device_exit+0x1cb/0x350 [ 1159.804277][ T31] ? __pfx_rpm_resume+0x10/0x10 [ 1159.814509][ T31] ? __pfx_dvb_usb_device_exit+0x10/0x10 [ 1159.827053][ T31] ? usb_disable_interface+0x31d/0x350 [ 1159.838895][ T31] ? lockdep_hardirqs_on+0x7a/0x110 [ 1159.850270][ T31] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1159.863938][ T31] usb_unbind_interface+0x295/0x9f0 [ 1159.873181][ T31] ? kernfs_remove_by_name_ns+0x101/0x140 [ 1159.884145][ T31] ? kernfs_remove_by_name_ns+0x101/0x140 [ 1159.894078][ T31] ? __pfx_usb_unbind_interface+0x10/0x10 [ 1159.905474][ T31] device_release_driver_internal+0x4f5/0x880 [ 1159.916510][ T31] bus_remove_device+0x444/0x560 [ 1159.923612][ T5715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1159.937468][ T31] ? __pfx_bus_remove_device+0x10/0x10 [ 1159.948139][ T31] ? kernfs_remove_by_name_ns+0x101/0x140 [ 1159.960897][ T31] device_del+0x524/0x8f0 [ 1159.972903][ T31] ? __pfx_device_del+0x10/0x10 [ 1159.982161][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1159.991640][ T31] usb_disable_device+0x3d4/0x8d0 [ 1160.001003][ T31] usb_disconnect+0x346/0x9a0 [ 1160.011473][ T31] hub_event+0x1bbb/0x4d30 [ 1160.020475][ T31] ? register_lock_class+0x31/0x2e0 [ 1160.031619][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1160.044511][ T31] ? __pfx_hub_event+0x10/0x10 [ 1160.052936][ T31] ? process_scheduled_works+0xa20/0x14e0 [ 1160.062562][ T31] ? rcu_is_watching+0x15/0xb0 [ 1160.071468][ T31] ? process_scheduled_works+0xa20/0x14e0 [ 1160.081694][ T31] process_scheduled_works+0xa8e/0x14e0 [ 1160.098762][T21962] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1160.108688][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1160.118771][ T31] ? assign_work+0x3cf/0x5d0 [ 1160.128537][ T31] worker_thread+0xa47/0xfb0 [ 1160.137526][ T31] ? __kthread_parkme+0x71/0x1f0 [ 1160.150952][ T31] kthread+0x388/0x470 [ 1160.162743][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1160.176691][ T10] corsair 0003:1B1C:1B3E.002D: unknown main item tag 0x2 [ 1160.194351][ T31] ? __pfx_kthread+0x10/0x10 [ 1160.198118][ T10] corsair 0003:1B1C:1B3E.002D: unexpected long global item [ 1160.210365][ T31] ret_from_fork+0x514/0xb70 [ 1160.220745][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1160.221008][ T10] corsair 0003:1B1C:1B3E.002D: parse failed [ 1160.242815][ T31] ? __switch_to+0xc89/0x1420 [ 1160.242847][ T10] corsair 0003:1B1C:1B3E.002D: probe with driver corsair failed with error -22 [ 1160.260684][ T31] ? __pfx_kthread+0x10/0x10 [ 1160.272781][ T31] ret_from_fork_asm+0x1a/0x30 [ 1160.279370][ T31] [ 1160.286062][ T31] INFO: task syz.3.4351:22032 blocked for more than 144 seconds. [ 1160.301724][ T31] Tainted: G L syzkaller #0 [ 1160.317052][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1160.336840][ T31] task:syz.3.4351 state:D stack:23656 pid:22032 tgid:22025 ppid:18506 task_flags:0x400140 flags:0x00080002 [ 1160.357731][ T31] Call Trace: [ 1160.361103][ T31] [ 1160.364120][ T31] __schedule+0x17d9/0x56c0 [ 1160.368744][ T31] ? __pfx___schedule+0x10/0x10 [ 1160.373832][ T31] ? schedule+0x90/0x2b0 [ 1160.378611][ T31] schedule+0x164/0x2b0 [ 1160.383374][ T31] schedule_preempt_disabled+0x13/0x30 [ 1160.388905][ T31] __mutex_lock+0x7bf/0x1550 [ 1160.393635][ T31] ? __mutex_lock+0x5d4/0x1550 [ 1160.398493][ T31] ? usbdev_open+0x151/0x770 [ 1160.403904][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1160.409025][ T31] ? bus_find_device+0x27d/0x2d0 [ 1160.410583][T24662] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5148'. [ 1160.414364][ T31] ? __pfx_bus_find_device+0x10/0x10 [ 1160.414398][ T31] ? usbdev_open+0xa7/0x770 [ 1160.414418][ T31] ? usbdev_open+0xa7/0x770 [ 1160.414445][ T31] usbdev_open+0x151/0x770 [ 1160.414472][ T31] ? __pfx_usbdev_open+0x10/0x10 [ 1160.414497][ T31] ? do_raw_spin_unlock+0xf5/0x210 [ 1160.457877][ T31] chrdev_open+0x4d9/0x600 [ 1160.462870][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 1160.467835][ T31] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 1160.474247][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 1160.479249][ T31] do_dentry_open+0x816/0x1380 [ 1160.484284][ T31] vfs_open+0x3b/0x340 [ 1160.488401][ T31] ? path_openat+0x2e2d/0x3830 [ 1160.493324][ T31] path_openat+0x2e44/0x3830 [ 1160.497977][ T31] ? kasan_save_track+0x3e/0x80 [ 1160.503080][ T31] ? do_sys_openat2+0xcc/0x200 [ 1160.507956][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1160.514227][ T31] do_file_open+0x23e/0x4a0 [ 1160.518780][ T31] ? __pfx_do_file_open+0x10/0x10 [ 1160.524080][ T31] ? _raw_spin_unlock+0x28/0x50 [ 1160.528997][ T31] ? alloc_fd+0x651/0x6c0 [ 1160.533994][ T31] do_sys_openat2+0x115/0x200 [ 1160.538750][ T31] ? __se_sys_futex+0x3a8/0x450 [ 1160.544179][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 1160.549508][ T31] ? rcu_is_watching+0x15/0xb0 [ 1160.554801][ T31] __x64_sys_openat+0x138/0x170 [ 1160.559715][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1160.565920][ T31] do_syscall_64+0x174/0x580 [ 1160.570562][ T31] ? trace_irq_disable+0x3b/0x140 [ 1160.575772][ T31] ? clear_bhb_loop+0x40/0x90 [ 1160.580500][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1160.586667][ T31] RIP: 0033:0x7fa9e595e84e [ 1160.591125][ T31] RSP: 002b:00007fa9e6810b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1160.599635][ T31] RAX: ffffffffffffffda RBX: 00007fa9e68116c0 RCX: 00007fa9e595e84e [ 1160.607749][ T31] RDX: 0000000000141002 RSI: 00007fa9e6810c00 RDI: ffffffffffffff9c [ 1160.615870][ T31] RBP: 00007fa9e6810c00 R08: 0000000000000000 R09: 0000000000000000 [ 1160.624088][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 1160.632107][ T31] R13: 00007fa9e5c26128 R14: 00007fa9e5c26090 R15: 00007fa9e5d4fa48 [ 1160.640890][ T31] [ 1160.644225][ T31] [ 1160.644225][ T31] Showing all locks held in the system: [ 1160.652045][ T31] 1 lock held by khungtaskd/31: [ 1160.659203][ T31] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1160.669469][ T31] 2 locks held by getty/5377: [ 1160.674735][ T31] #0: ffff8880359060a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1160.684666][ T31] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 1160.695170][ T31] 5 locks held by kworker/0:6/5712: [ 1160.700451][ T31] #0: ffff888022ed1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1160.712096][ T31] #1: ffffc90004f17c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1160.725417][ T31] #2: ffff888029e281d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 1160.734558][ T31] #3: ffff88807b61a1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 [ 1160.744606][ T31] #4: ffff88807bf4c1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 1160.755284][ T31] 4 locks held by udevd/6506: [ 1160.760343][ T31] #0: ffff88807f740f38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 [ 1160.769315][ T31] #1: ffff88805307a480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 [ 1160.778935][ T31] #2: ffff8880a597ed28 (kn->active#31){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 1160.788740][ T31] #3: ffff88807b61a1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 1160.798188][ T31] 3 locks held by kworker/u8:45/21962: [ 1160.804351][ T31] #0: ffff88801b06c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1160.816443][ T31] #1: ffffc90004e3fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1160.827683][ T31] #2: ffffffff9002dec0 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 1160.836783][ T31] 1 lock held by syz.3.4351/22032: [ 1160.842468][ T31] #0: ffff888029e281d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 [ 1160.851592][ T31] 1 lock held by syz.6.5147/24658: [ 1160.856920][ T31] #0: ffffffff9002dec0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 1160.866265][ T31] 2 locks held by syz.2.5148/24662: [ 1160.871525][ T31] #0: ffff88807eeac0d0 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nf_tables_valid_genid+0x3b/0x100 [ 1160.882939][ T31] #1: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 1160.893939][ T31] 1 lock held by syz.1.5150/24669: [ 1160.899065][ T31] #0: ffffffff8eb5fe38 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 1160.909241][ T31] 2 locks held by syz.0.5151/24678: [ 1160.914520][ T31] #0: ffff88807f6d4450 (sb_writers#16){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 1160.923819][ T31] #1: ffff88807a3e6680 (&sb->s_type->i_mutex_key#26){+.+.}-{4:4}, at: fuse_open+0x276/0x770 [ 1160.934134][ T31] [ 1160.936673][ T31] ============================================= [ 1160.936673][ T31] [ 1160.947958][ T31] NMI backtrace for cpu 1 [ 1160.947985][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1160.948010][ T31] Tainted: [L]=SOFTLOCKUP [ 1160.948016][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1160.948025][ T31] Call Trace: [ 1160.948033][ T31] [ 1160.948040][ T31] dump_stack_lvl+0xe8/0x150 [ 1160.948069][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 1160.948089][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1160.948114][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 1160.948132][ T31] sys_info+0x135/0x170 [ 1160.948152][ T31] watchdog+0xfd7/0x1030 [ 1160.948175][ T31] ? watchdog+0x1c7/0x1030 [ 1160.948198][ T31] kthread+0x388/0x470 [ 1160.948219][ T31] ? __pfx_watchdog+0x10/0x10 [ 1160.948237][ T31] ? __pfx_kthread+0x10/0x10 [ 1160.948259][ T31] ret_from_fork+0x514/0xb70 [ 1160.948284][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1160.948306][ T31] ? __switch_to+0xc89/0x1420 [ 1160.948329][ T31] ? __pfx_kthread+0x10/0x10 [ 1160.948352][ T31] ret_from_fork_asm+0x1a/0x30 [ 1160.948382][ T31] [ 1160.948395][ T31] Sending NMI from CPU 1 to CPUs 0: [ 1161.065534][ C0] NMI backtrace for cpu 0 [ 1161.065561][ C0] CPU: 0 UID: 0 PID: 16262 Comm: kworker/u8:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 1161.065592][ C0] Tainted: [L]=SOFTLOCKUP [ 1161.065598][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1161.065609][ C0] Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet [ 1161.065713][ C0] RIP: 0010:lock_acquire+0x221/0x350 [ 1161.065739][ C0] Code: ff ff ff e8 e1 6e 2e 0a f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 cb 89 ca 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d b8 65 b8 [ 1161.065753][ C0] RSP: 0018:ffffc90005ecf8a0 EFLAGS: 00000286 [ 1161.065767][ C0] RAX: 613ed1aa6bad5000 RBX: 0000000000000000 RCX: 0000000000000046 [ 1161.065780][ C0] RDX: 0000000023e18b1f RSI: ffffffff8e4b418f RDI: ffffffff8c4bdd80 [ 1161.065792][ C0] RBP: ffffffff8b97bc84 R08: ffffffff8b97bc84 R09: 0000000000000000 [ 1161.065804][ C0] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000002 [ 1161.065816][ C0] R13: ffffffff8eb59c60 R14: 0000000000000000 R15: 0000000000000246 [ 1161.065827][ C0] FS: 0000000000000000(0000) GS:ffff888124f4b000(0000) knlGS:0000000000000000 [ 1161.065841][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1161.065853][ C0] CR2: 00007f19413d4ff8 CR3: 000000007a95a000 CR4: 00000000003526f0 [ 1161.065868][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1161.065878][ C0] DR3: 000000000000000c DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1161.065888][ C0] Call Trace: [ 1161.065896][ C0] [ 1161.065905][ C0] batadv_iv_ogm_schedule+0x485/0xff0 [ 1161.065925][ C0] ? batadv_iv_ogm_schedule+0x464/0xff0 [ 1161.065947][ C0] ? batadv_iv_ogm_schedule+0x464/0xff0 [ 1161.065967][ C0] ? __pfx_batadv_iv_ogm_schedule+0x10/0x10 [ 1161.065985][ C0] ? batadv_skb_head_push+0x187/0x200 [ 1161.066037][ C0] ? batadv_send_skb_packet+0x40e/0x650 [ 1161.066088][ C0] batadv_iv_send_outstanding_bat_ogm_packet+0x67a/0x790 [ 1161.066115][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 1161.066135][ C0] process_scheduled_works+0xa8e/0x14e0 [ 1161.066165][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 1161.066187][ C0] ? assign_work+0x3cf/0x5d0 [ 1161.066207][ C0] worker_thread+0xa47/0xfb0 [ 1161.066237][ C0] kthread+0x388/0x470 [ 1161.066260][ C0] ? __pfx_worker_thread+0x10/0x10 [ 1161.066278][ C0] ? __pfx_kthread+0x10/0x10 [ 1161.066301][ C0] ret_from_fork+0x514/0xb70 [ 1161.066326][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1161.066349][ C0] ? __switch_to+0xc89/0x1420 [ 1161.066370][ C0] ? __pfx_kthread+0x10/0x10 [ 1161.066393][ C0] ret_from_fork_asm+0x1a/0x30 [ 1161.066415][ C0] [ 1161.338284][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1161.345167][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1161.355841][ T31] Tainted: [L]=SOFTLOCKUP [ 1161.360158][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1161.370291][ T31] Call Trace: [ 1161.373564][ T31] [ 1161.376515][ T31] vpanic+0x56c/0xa60 [ 1161.380494][ T31] ? __pfx___schedule+0x10/0x10 [ 1161.385331][ T31] ? __pfx_vpanic+0x10/0x10 [ 1161.389831][ T31] ? nmi_trigger_cpumask_backtrace+0x207/0x380 [ 1161.396009][ T31] panic+0xc5/0xd0 [ 1161.399752][ T31] ? __pfx_panic+0x10/0x10 [ 1161.404165][ T31] ? preempt_schedule_common+0x82/0xd0 [ 1161.409619][ T31] ? preempt_schedule_thunk+0x16/0x40 [ 1161.414983][ T31] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 1161.421125][ T31] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 1161.427267][ T31] watchdog+0x1030/0x1030 [ 1161.431599][ T31] ? watchdog+0x1c7/0x1030 [ 1161.436008][ T31] kthread+0x388/0x470 [ 1161.440071][ T31] ? __pfx_watchdog+0x10/0x10 [ 1161.444733][ T31] ? __pfx_kthread+0x10/0x10 [ 1161.449324][ T31] ret_from_fork+0x514/0xb70 [ 1161.453911][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1161.459022][ T31] ? __switch_to+0xc89/0x1420 [ 1161.463697][ T31] ? __pfx_kthread+0x10/0x10 [ 1161.468283][ T31] ret_from_fork_asm+0x1a/0x30 [ 1161.473046][ T31] [ 1161.476204][ T31] Kernel Offset: disabled [ 1161.480515][ T31] Rebooting in 86400 seconds..