last executing test programs: 7m49.794324139s ago: executing program 32 (id=168): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x80, 0x2, 0x27e}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x13, r4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x2}}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000240)={0x2e, 0x11, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x7f00000000000000, 0x0, 0x1, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@new_dev={0x1, 0x4f4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x20}}}, 0x0) 6m59.770516923s ago: executing program 33 (id=562): setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./proc\x00', 0x1bf) (async) mount(0x0, &(0x7f00000005c0)='./proc\x00', &(0x7f0000000600)='proc\x00', 0x4000, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./proc/thread-self/fail-nth\x00', 0x202, 0x150) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@empty, @in6=@private2={0xfc, 0x2, '\x00', 0x1}}, {@in6=@loopback, 0x100000, 0x3c}, @in=@remote, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0xa, 0x2}, [@coaddr={0x14}]}, 0x104}}, 0x0) (async) write(r0, &(0x7f0000000680)='27', 0x2) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xc0a41, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) (async) write$tun(r2, &(0x7f0000000280)={@val={0x60, 0x800}, @val={0x7, 0x0, 0x0, 0x380, 0x14}, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x3c, 0x28, 0x2000, 0x0, 0x0, 0x2f, 0x0, @empty, @broadcast}, {{0xa200, 0x22eb, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}, 0x36) (async) ioctl$KVM_IRQ_LINE_STATUS(r0, 0xc008ae67, 0x0) (async) r4 = socket$inet6(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r4, 0x29, 0x41, &(0x7f00000006c0)={'mangle\x00', 0x4f8, "000000001d00"/1272}, &(0x7f0000000c00)=0x520) 6m2.086137385s ago: executing program 1 (id=1112): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25fc010000000000000000000000000000ff0200000000000000000000000000010004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe80000000010000000000000000003700fe04d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000030000800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd70000535004002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r1], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 6m2.059028395s ago: executing program 1 (id=1114): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x20030b5, 0x0, 0x2, 0x158}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000240)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x45}}}, &(0x7f0000000300)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000340)={0x0, 0x1fffd, 0x0, 0x3}, &(0x7f0000000440)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x4, 0x3, 0x10000004, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf7ff, 0x8, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x1000, 0x2, 0xa3, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x29a7, 0x8200, 0x0, 0x367}}], 0x1, &(0x7f00000006c0)={0x2e, 0x40, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, r5, '\x00', {0x2, 0x0, 0x0, 0x0}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB='8'], 0x138}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000800), 0x40241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000840)={'syzkaller1\x00', 0xc201}) bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000880)={0x27, 0x0, 0x1, 0x0, 0x0, 0xff, "bac5115c7dad488702b535116fad55baf63cdd52fc30106310abb622a1c3c01c13c04df6b906288e64e96754059e65c39c5759b069d6e6d940de479248878c", 0xb}, 0x60) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000900)={'syzkaller1\x00', @broadcast}) write$tun(r9, &(0x7f0000000940)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x8016, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @dest_unreach={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @local, @loopback}}}}, 0xfdef) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000000c0)={0x44, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000980)=ANY=[@ANYBLOB="0000a36e4f753b3c45ca040066cfc2a300d4c84d32"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5m59.73102608s ago: executing program 1 (id=1130): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000800), 0x8002, 0x0) write$P9_RSTATu(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="9f0200007d200000050c00fe0000000005a7000000000a000000000000000000406100000000e0e5000005000000000000001b00046e6f6465767b65"], 0x29f) 5m59.654927259s ago: executing program 1 (id=1132): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0xd0) (async) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$sock_ifreq(r0, 0x8971, &(0x7f0000000780)={'dummy0\x00', @ifru_ivalue=0x4}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) (async, rerun: 64) recvmsg(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f00000005c0)=""/24, 0x18}], 0xa}, 0x40000180) (rerun: 64) write$binfmt_script(r1, &(0x7f0000000600), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000640)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io(r2, &(0x7f0000000680)={0x2c, &(0x7f00000006c0)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async, rerun: 32) r3 = syz_open_dev$hiddev(&(0x7f0000000700), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r3, 0xd01c4813, &(0x7f0000000740)={0x2, 0x100, 0x0, 0x2, 0x0, 0x42}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0xa5) (async) mmap(&(0x7f0000af2000/0x3000)=nil, 0x3000, 0x3000001, 0x8010, r3, 0xf5f80000) r4 = syz_open_dev$radio(&(0x7f0000000000), 0x0, 0x2) ppoll(&(0x7f0000000340)=[{r4, 0x381}, {r4, 0x1244}], 0x2, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000380)='./sys\x00', &(0x7f00000003c0)='sysfs\x00', 0x0, 0x0) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r5, &(0x7f0000000440)='wusb3801 0x', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file0\x00', 0x0) (async) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000140)='./file1/file0\x00', 0x0, 0x1085408, 0x0) (async, rerun: 64) mount$overlay(0x0, &(0x7f00000001c0)='./bus\x00', &(0x7f0000000200), 0x0, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (rerun: 64) chdir(&(0x7f0000000280)='./bus\x00') creat(&(0x7f00000002c0)='./file0/file1\x00', 0x90) unlink(&(0x7f0000000300)='./file0/file1\x00') 5m56.574560446s ago: executing program 1 (id=1157): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x11, 0x3, 0x0) setsockopt(r1, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg(r1, &(0x7f00000001c0)={&(0x7f0000000240)=@ll={0x11, 0x3, r2, 0x1, 0xe5, 0x6, @broadcast}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000300)="020195ff002d3922ff65b4355e953d23d254f087ff000000", 0x18}, {&(0x7f0000000340)="2cf2565b0e508224b706a643e98dc932f5fc6d8e51626cdbf9ff02dbb8b2d2ca2be0dfa8f2a777f680c590257a0641579678f72a6ff270a8989633cbe781bf372d4a0e61", 0xff87}], 0x2}, 0x44000) 5m56.249639673s ago: executing program 1 (id=1162): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) accept$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000440)=0x1c) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000001f80)={{{@in6=@ipv4={""/10, ""/2, @remote}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@private1}}, &(0x7f0000000580)=0xffffffffffffffc2) quotactl_fd$Q_GETQUOTA(r0, 0xffffffff80000701, r1, &(0x7f00000005c0)) r2 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000500)={{0x77359400}, {0x0, 0x3938700}}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) r4 = inotify_init1(0x0) inotify_add_watch(r4, &(0x7f0000000540)='.\x00', 0x44000160) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000640)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) r6 = dup(r4) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000880)) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000004c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r3, 0x3b88, &(0x7f0000000dc0)={0xc, r7}) ioctl$IOMMU_DESTROY$ioas(r3, 0x3b80, &(0x7f0000000e00)={0x8, r7}) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r2, 0x0, &(0x7f0000000000)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000080)=@any_dev={0x2, 0x40f, 0x0, 0x0, 0x1000, 0x1, 0x0, 0x0, 0xa1}}}, &(0x7f00000000c0)=0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = fanotify_init(0x200, 0x0) fanotify_mark(r10, 0x1, 0x1002, r9, 0x0) write(r9, &(0x7f0000000700)='g', 0x1) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r7, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r9, 0x3ba0, &(0x7f00000007c0)={0x48, 0xa, r11, 0x0, r7}) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) r13 = dup(r12) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r6, 0xc0189374, &(0x7f0000000840)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) syz_ublk_setup_queues(r14, r8, &(0x7f0000000140)={0x0, 0xfffffffe, 0x700, 0x4, 0x1f3, 0x0, r13}, &(0x7f00000001c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x20, 0x0, 0x40000006}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x2, 0x3, 0xbab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3de4, 0x2000, 0x40040005, 0x334, 0x0, r13}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x58d4, 0x200, 0x1, 0x164}}], 0x1, 0x0, 0x0) pipe2(&(0x7f0000000a40), 0x800) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000cc0)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000004000000340c79dcab"], &(0x7f0000000d00)=0x28) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) 5m56.059021199s ago: executing program 34 (id=1162): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) accept$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000440)=0x1c) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000001f80)={{{@in6=@ipv4={""/10, ""/2, @remote}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@private1}}, &(0x7f0000000580)=0xffffffffffffffc2) quotactl_fd$Q_GETQUOTA(r0, 0xffffffff80000701, r1, &(0x7f00000005c0)) r2 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000500)={{0x77359400}, {0x0, 0x3938700}}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) r4 = inotify_init1(0x0) inotify_add_watch(r4, &(0x7f0000000540)='.\x00', 0x44000160) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000640)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) r6 = dup(r4) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000880)) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000004c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r3, 0x3b88, &(0x7f0000000dc0)={0xc, r7}) ioctl$IOMMU_DESTROY$ioas(r3, 0x3b80, &(0x7f0000000e00)={0x8, r7}) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r2, 0x0, &(0x7f0000000000)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000080)=@any_dev={0x2, 0x40f, 0x0, 0x0, 0x1000, 0x1, 0x0, 0x0, 0xa1}}}, &(0x7f00000000c0)=0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = fanotify_init(0x200, 0x0) fanotify_mark(r10, 0x1, 0x1002, r9, 0x0) write(r9, &(0x7f0000000700)='g', 0x1) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r7, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r9, 0x3ba0, &(0x7f00000007c0)={0x48, 0xa, r11, 0x0, r7}) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) r13 = dup(r12) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r6, 0xc0189374, &(0x7f0000000840)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) syz_ublk_setup_queues(r14, r8, &(0x7f0000000140)={0x0, 0xfffffffe, 0x700, 0x4, 0x1f3, 0x0, r13}, &(0x7f00000001c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x20, 0x0, 0x40000006}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x2, 0x3, 0xbab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3de4, 0x2000, 0x40040005, 0x334, 0x0, r13}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x58d4, 0x200, 0x1, 0x164}}], 0x1, 0x0, 0x0) pipe2(&(0x7f0000000a40), 0x800) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000cc0)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000004000000340c79dcab"], &(0x7f0000000d00)=0x28) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) 5m42.789551674s ago: executing program 5 (id=1255): mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc\x00', 0x1ff) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x80) ppoll(&(0x7f0000000040)=[{r0, 0x8}, {r0, 0x4}, {r0, 0x8624}, {0xffffffffffffffff, 0x200}, {r0, 0x20}, {r0, 0x6c}], 0x6, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f00000000c0)={[0x6000]}, 0x8) mount(0x0, &(0x7f0000000a40)='./proc\x00', &(0x7f0000000a80)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000ac0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000b00)='27', 0x2) unshare(0x40000000) 5m41.861451734s ago: executing program 5 (id=1262): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r0, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x78b}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, &(0x7f00000000c0)=@x86={0x6b, 0x4, 0x8, 0x0, 0x0, 0x0, 0x4, 0xa, 0xd, 0x1, 0x8, 0x8, 0x0, 0x2, 0x9, 0x3, 0x3, 0x2e, 0x4, '\x00', 0x1, 0xffffffffffffff7f}) ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000000100)=0x4) ioctl$KVM_RUN(r1, 0xae80, 0x0) unshare(0x22020600) r2 = timerfd_create(0x7, 0x80800) timerfd_settime(r2, 0x3, &(0x7f0000000140)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) mmap$IORING_OFF_CQ_RING(0x7fffffffb000, 0x7, 0x2, 0xbd4c341840b03bf2, 0xffffffffffffffff, 0x8000000) 5m41.661185937s ago: executing program 5 (id=1263): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20f5ff00000a050401000000000000000a0000000900010073797a3000f5000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a310000000008000300060000050c0004"], 0x88}}, 0x0) 5m41.412368738s ago: executing program 5 (id=1266): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000003c0)="1c0000001a005f0214f9f407000904001f000000ff020002000000ff", 0x1c) 5m41.151578577s ago: executing program 5 (id=1268): r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0xb635773f06ebbeea, 0x40010, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udp\x00') preadv(r1, &(0x7f00000000c0)=[{&(0x7f0000000100)=""/225, 0xe1}], 0x1, 0x7, 0x20000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/ipv4/conf/all/accept_local\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='1', 0x15) mbind(&(0x7f0000051000/0x4000)=nil, 0x4000, 0x3, &(0x7f0000000080)=0x2, 0x5, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 5m40.980381948s ago: executing program 5 (id=1270): socket$inet(0x2b, 0x801, 0x0) r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x9, @loopback, 0x3e}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=@newsa={0x158, 0x10, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80, 0x0, 0x0, 0x80}, {@in6=@loopback, 0x1234, 0x33}, @in6=@loopback, {0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x80}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}, @replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x2, 0x4000, 0x20, [0x0]}}]}, 0x158}}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) sendmmsg$inet6(r1, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000740)}], 0x1, 0x0, 0x0, 0x300}}, {{&(0x7f0000000780)={0xa, 0x4e23, 0x5, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}, 0x1c, &(0x7f00000007c0)=[{&(0x7f0000000800)="3d3ae39933472ecf35", 0x9}], 0x1}}], 0x2, 0x4000801) syz_usb_connect(0x1, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00", @ANYRES32], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$tipc(0x1e, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) writev(r3, 0x0, 0x0) 5m25.835904659s ago: executing program 35 (id=1270): socket$inet(0x2b, 0x801, 0x0) r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x9, @loopback, 0x3e}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=@newsa={0x158, 0x10, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80, 0x0, 0x0, 0x80}, {@in6=@loopback, 0x1234, 0x33}, @in6=@loopback, {0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x80}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}, @replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x2, 0x4000, 0x20, [0x0]}}]}, 0x158}}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) sendmmsg$inet6(r1, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000740)}], 0x1, 0x0, 0x0, 0x300}}, {{&(0x7f0000000780)={0xa, 0x4e23, 0x5, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}, 0x1c, &(0x7f00000007c0)=[{&(0x7f0000000800)="3d3ae39933472ecf35", 0x9}], 0x1}}], 0x2, 0x4000801) syz_usb_connect(0x1, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00", @ANYRES32], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$tipc(0x1e, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) writev(r3, 0x0, 0x0) 5m3.773113332s ago: executing program 7 (id=1544): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x11, 0x3, 0x0) setsockopt(r1, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg(r1, &(0x7f00000001c0)={&(0x7f0000000240)=@ll={0x11, 0x3, r2, 0x1, 0xe5, 0x6, @broadcast}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000300)="020195ff002d3922ff65b4355e953d23d254f087ff000000", 0x18}, {&(0x7f0000000340)="2cf2565b0e508224b706a643e98dc932f5fc6d8e51626cdbf9ff02dbb8b2d2ca2be0dfa8f2a777f680c590257a0641579678f72a6ff270a8989633cbe781bf372d4a0e61", 0xff87}], 0x2}, 0x44000) 5m3.665960676s ago: executing program 7 (id=1547): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a1810039000009000b0000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) 5m3.500138983s ago: executing program 7 (id=1550): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x2000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000340)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x9, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x3, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff4, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x1000, 0x31, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xfff, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x6, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x0, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000007c0), 0x0, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000180)={0x7}) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000800)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000840)=[@text32={0x20, &(0x7f0000000880)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r0, 0x40045731, &(0x7f0000000080)=0x3) chdir(&(0x7f0000000240)='./file0\x00') r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) ioctl$I2C_FUNCS(r5, 0x705, &(0x7f0000000140)=0x2a41) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x101042, 0x15) 5m3.31056952s ago: executing program 2 (id=1553): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sec/tomoyo/query\x00', 0x2, 0x0) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000300)="5736835aa621fd8ffdc454d411cb70b3e82dd0e803777a7412ac6aa030769af4f33195ee343a5b306b69b388846b9a4e02eba8be3e7715a755d3e4fe4b9d130e3a32bd9671689e7e786687562222e027fe70e1bd0df283cf5affc8a971f3e745b0b595a024cf5c901ef9b7112ddbe9a115353a5eeea264e4016b3c1f87cfe8fca3bde426868858be007859280becacf5c136ce56a628fb422b9e45f3be935972afbc7fce2a7b2de26b0a", 0xaa}], 0x1) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r0, {0x1}}, './sec/tomoyo/query\x00'}) ioctl$TUNSETCARRIER(r2, 0x400454e2, &(0x7f0000000240)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x20501, 0x0) close(r3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x8c00, 0x0) close(r4) socketpair(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f00000001c0)={'syzkaller0\x00', @random="2b0100004ec6"}) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000000200)={'syzkaller0\x00', @random='\x00\a\x00'}) 5m3.056878592s ago: executing program 2 (id=1556): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller1\x00', 0x2}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000300)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000340)={@void, @void, @eth={@random="7aea53d8ebfc", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x2, 0x15, 0x1c, 0x65, 0x0, 0x82, 0x11, 0x0, @empty, @broadcast}, {0x4e22, 0x4e23, 0x8}}}}}}, 0x2e) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, 0x0, 0x20) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) ioctl$NILFS_IOCTL_GET_CPINFO(r3, 0x80186e82, &(0x7f00000000c0)={&(0x7f0000000000)=[{0x3, 0x0, 0x0, 0x8, 0x7bd5265e, 0x0, 0x9, 0x8}, {0x1, 0x0, 0x3, 0x5, 0x1b, 0x9, 0x292f, 0x9}, {0x0, 0x0, 0xffffffffffffffff, 0x8, 0x7fffffff, 0x700, 0x8, 0xf}], 0x3, 0x38, 0x1, 0xe1b7}) syz_usb_connect$midi(0x0, 0xbd, &(0x7f0000000100)=ANY=[@ANYBLOB="120101020000001044060f804000010203010902ab00010101200209040000060103303a0624020144040f2403000a0408010101020603029c06240207050609050d00080081b6051125010df0552f91ffb555f13d7eb3a44a09050604200002650404250100090500102000ff590005250101490905801020000204071025010c6d95655c0cab605266fc635f090503032000060405142501"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) r5 = syz_open_procfs(0x0, &(0x7f0000000200)='fdinfo\x00') fchdir(r5) r6 = creat(&(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xae) write$sysctl(r6, &(0x7f0000000240)='6', 0x1) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000004c0)=0x8) 5m2.490428514s ago: executing program 7 (id=1564): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r0 = socket(0x15, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000300)={0x7, {{0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @remote}, 0x1}}, {{0xa, 0x4e20, 0x80, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1}}}, 0x108) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='tcp 2', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/threads\x00', 0x2, 0x0) write(r3, 0x0, 0x0) write(r1, &(0x7f0000000280)='3', 0x4e) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) syz_clone3(&(0x7f0000001440)={0x4200000, 0x0, 0x0, 0x0, {0x2f}, 0x0, 0x0, 0x0, 0x0}, 0x58) 5m2.275327385s ago: executing program 7 (id=1566): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="60000000300005060100000000000001000000004c0001804800018007000100637400003c0002801800010001000000000000000300000000000000000000000600070008000000080010006674700005001100020000000500120006000000", 0x60}], 0x1}, 0x0) 5m1.704863033s ago: executing program 7 (id=1568): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x4040000) 5m1.195998056s ago: executing program 36 (id=1568): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x4040000) 4m59.700009285s ago: executing program 2 (id=1573): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./security\x00', &(0x7f0000000140)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./security/apparmor/.replace\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)="04080076657273696f6e00020500000004080070726f66696c650007050400662f2f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000308", 0x52) 4m59.44160429s ago: executing program 2 (id=1575): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r0 = socket(0x15, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000300)={0x7, {{0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @remote}, 0x1}}, {{0xa, 0x4e20, 0x80, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1}}}, 0x108) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='tcp 2', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/threads\x00', 0x2, 0x0) write(r3, 0x0, 0x0) write(r1, &(0x7f0000000280)='3', 0x4e) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) syz_clone3(&(0x7f0000001440)={0x4200000, 0x0, 0x0, 0x0, {0x2f}, 0x0, 0x0, 0x0, 0x0}, 0x58) 4m58.952492388s ago: executing program 2 (id=1577): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000640)={'syzkaller1\x00', 0x5001}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000680)={'syzkaller1\x00', 0x1}) r2 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000700)={0x1, &(0x7f0000000740)=[{0x80000006}]}, 0x10) write$tun(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="03031b003000940006006300000001632fff00000000000000000000ffffac141419ff02000000be88000000000000000001"], 0x195) 4m58.079680008s ago: executing program 2 (id=1580): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a200000000e0a01060000000000000000020000000900010073797a300000000040000000160a01060000000000000000020000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400008000040000000030a01060000000000000000020000000900010073797a30000000000900030073797a3000000000140004800800014000000002080002400000000058000000060a01060000000000000000020000000900010073797a30000010000900020073797a30000000002c0004802800018011000100666c6f775f6f66666c6f616400000000100002800900010073797a300000000014000000110001"], 0x120}}, 0x0) 4m57.821328225s ago: executing program 37 (id=1580): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a200000000e0a01060000000000000000020000000900010073797a300000000040000000160a01060000000000000000020000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400008000040000000030a01060000000000000000020000000900010073797a30000000000900030073797a3000000000140004800800014000000002080002400000000058000000060a01060000000000000000020000000900010073797a30000010000900020073797a30000000002c0004802800018011000100666c6f775f6f66666c6f616400000000100002800900010073797a300000000014000000110001"], 0x120}}, 0x0) 4m57.728814104s ago: executing program 6 (id=1582): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$sock(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="3c0000001000ff0400000000000000000000000100000000ff000000000000001c0012000a000100767863616e0000000c000200082000007b000000", 0x3c}], 0x1}, 0x0) 4m57.368017983s ago: executing program 6 (id=1583): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0xb8}}, 0x2c000010) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@updpolicy={0xb8, 0x14, 0x1, 0x70bd2b, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0xffffffffffffff80, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x3fffffffffffff, 0x1ffffffffffffff, 0x3}, 0x2, 0x0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 4m57.204083214s ago: executing program 6 (id=1584): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000540)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000780)="3300000008000601010003000001", 0xe) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x240) 4m56.993814007s ago: executing program 6 (id=1585): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r0 = socket(0x15, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000300)={0x7, {{0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @remote}, 0x1}}, {{0xa, 0x4e20, 0x80, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1}}}, 0x108) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='tcp 2', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/threads\x00', 0x2, 0x0) write(r3, 0x0, 0x0) write(r1, &(0x7f0000000280)='3', 0x4e) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) syz_clone3(&(0x7f0000001440)={0x4200000, 0x0, 0x0, 0x0, {0x2f}, 0x0, 0x0, 0x0, 0x0}, 0x58) 4m56.506464659s ago: executing program 6 (id=1586): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a31f500000008000300060000050c0004"], 0x88}}, 0x0) 4m55.936903695s ago: executing program 6 (id=1587): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x4, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r3, 0x400, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2040, 0x100) fcntl$setlease(r4, 0x400, 0x2) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/pm_test', 0x8a881, 0xbb) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000001c0)={r5, 0x0, {0x0, 0x22000000, 0x0, 0x1, 0x4000000000000ffd, 0x0, 0x0, 0x3, 0xc, "faf98317e5a1149989fc67be43ea6acc96e3a2503dc31c97214d58128bbad0099cebdc25f5ab60c9e69098c8b534464c516bdd8a0f350000000000000300", "32d8cc26f7061a74df2cfc06489f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x8]}}) 4m55.707420376s ago: executing program 38 (id=1587): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x4, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r3, 0x400, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2040, 0x100) fcntl$setlease(r4, 0x400, 0x2) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/pm_test', 0x8a881, 0xbb) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000001c0)={r5, 0x0, {0x0, 0x22000000, 0x0, 0x1, 0x4000000000000ffd, 0x0, 0x0, 0x3, 0xc, "faf98317e5a1149989fc67be43ea6acc96e3a2503dc31c97214d58128bbad0099cebdc25f5ab60c9e69098c8b534464c516bdd8a0f350000000000000300", "32d8cc26f7061a74df2cfc06489f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x8]}}) 4m38.798785268s ago: executing program 4 (id=1643): ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={'\x00', 0xc, 0x8001, 0x2400000, 0xff, 0xa8f, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050001000000000000000b00000008000300", @ANYRES32=r3, @ANYBLOB="34005080140001000102030405060708090a0b0c0d0e0f1005000200060000000800030006ac0f"], 0x50}}, 0x0) syz_usb_connect$uac1(0x0, 0xaa, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902980003010000000904000000010100000a2401000000020102132406040006030000000000000000000000000924030000010000ff0924050000f8431cfd0924030604030204001b2404040209", @ANYBLOB="06", @ANYRESDEC=0x0], 0x0) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000600)={0xaa, 0x268}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000640)={0x0, 0x0, 0x100000000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000740)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r5 = syz_open_dev$swradio(&(0x7f00000000c0), 0x0, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r5, 0xc0405665, &(0x7f0000000100)={0x2, 0x4, 0x6, 0x40, 0x7ff, 0x1, 0x2}) prlimit64(r0, 0xe, &(0x7f0000000000)={0x87, 0xfe}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/sys/vm/drop_caches\x00', 0x1, 0x0) write(r6, &(0x7f00000002c0)='3', 0x1) stat(&(0x7f0000000780)='./proc\x00', &(0x7f0000000340)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000680)=""/173) 4m37.501573116s ago: executing program 4 (id=1651): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000180)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000001c0)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r2, &(0x7f0000000200)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) listen(r2, 0x5) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000008000100001c1122334400080000000500050000000580020008"], 0x4a) 4m37.484565301s ago: executing program 4 (id=1652): r0 = syz_open_dev$video(&(0x7f0000000600), 0x7ff, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f0000000640)={0x0, 0x35315258, 0x780, 0x438, 0x0, @discrete={0x2}}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x40000000000004, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000180)=0x1, r3, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r3, 0x7}}, 0x48) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000300)={0x14, 0x88, 0xfa00, {r5, 0x10, 0x0, @in={0x2, 0x4e23, @empty}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x40000000000004, &(0x7f0000000400), 0x2, 0x6}}, 0x20) r6 = socket(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f0000000680)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) write(r6, &(0x7f00000006c0)="3000000024000106010000000000000000fd0000010000000000fffff1ffffff000000000c000100696e677265737300", 0x30) 4m37.423525756s ago: executing program 4 (id=1653): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000845, &(0x7f00000006c0), 0x1c) getsockopt$inet6_buf(r1, 0x29, 0x3d, 0x0, &(0x7f0000000700)=0x37) mkdir(&(0x7f0000000100)='./file1\x00', 0x0) mkdir(&(0x7f0000000140)='./bus\x00', 0x0) mount$bind(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)='./file1/file0\x00', &(0x7f0000000580), 0x303c006, 0x0) mount$overlay(0x0, &(0x7f0000000180)='./bus\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r2 = open(&(0x7f0000000240)='./file1\x00', 0x808400, 0x0) chdir(&(0x7f0000000280)='./bus\x00') unlink(&(0x7f00000002c0)='./file0\x00') mkdirat(r2, &(0x7f0000000300)='./file0\x00', 0xf3) unshare(0x2c040480) mkdirat(r2, &(0x7f0000000380)='./proc\x00', 0x11a) mount(0x0, &(0x7f00000003c0)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f00000500070084000000060005"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) write(r4, &(0x7f0000000480)='6', 0x32) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) semtimedop(0x0, &(0x7f00000004c0)=[{0x3, 0x4, 0x1800}], 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) chdir(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x2) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x168, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@error={0x0, 0x400, 0x0, 0x30}]}) r5 = syz_open_dev$video(&(0x7f0000000040), 0xffffffffffffffff, 0x400) ioctl$VIDIOC_S_OUTPUT(r5, 0xc004562f, &(0x7f0000000080)=0x6) 4m37.20582356s ago: executing program 4 (id=1654): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a200000000005050401000000000000000a0000000900010073797a3000f5000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a310000000008000300060000050c0004"], 0x88}}, 0x0) 4m36.777936633s ago: executing program 4 (id=1657): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00000000c0)={0x1, 0x23}, &(0x7f0000000100)=0x8) r2 = socket$rxrpc(0x21, 0x2, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a580000000c0a3d0100000000000000150a0000060900020073797a31000000000900010073797a31000000002c0003801c0000840c00018006000100d10300000c000440000000002df31ab30c000080080003400000000214000000110001"], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="440000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a310000000018000380140000800800034000000002"], 0x44}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f0000000140), 0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={r1, 0x0, &(0x7f0000000140)}, &(0x7f00000001c0)=0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000040)=@ethtool_coalesce={0x12, 0x1, 0xfffffffa, 0x871e, 0x6, 0x8, 0x9, 0x4, 0xffffff1b, 0x1, 0x4, 0x8, 0x4, 0xfffffff9, 0x0, 0x5, 0x1, 0x2, 0x7, 0x7, 0x2, 0x9, 0xc}}) 4m36.402049433s ago: executing program 39 (id=1657): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00000000c0)={0x1, 0x23}, &(0x7f0000000100)=0x8) r2 = socket$rxrpc(0x21, 0x2, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a580000000c0a3d0100000000000000150a0000060900020073797a31000000000900010073797a31000000002c0003801c0000840c00018006000100d10300000c000440000000002df31ab30c000080080003400000000214000000110001"], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="440000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a310000000018000380140000800800034000000002"], 0x44}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f0000000140), 0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={r1, 0x0, &(0x7f0000000140)}, &(0x7f00000001c0)=0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000040)=@ethtool_coalesce={0x12, 0x1, 0xfffffffa, 0x871e, 0x6, 0x8, 0x9, 0x4, 0xffffff1b, 0x1, 0x4, 0x8, 0x4, 0xfffffff9, 0x0, 0x5, 0x1, 0x2, 0x7, 0x7, 0x2, 0x9, 0xc}}) 15.821995904s ago: executing program 8 (id=4009): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a31000000006800f400060a010400000000000000000100000008000b4000000000400004802800018007000100637400001c000280080001400000000108000240000000090500030000000000140001800a0001007265646972000000040002800900010073797a30"], 0xdc}, 0x1, 0x0, 0x0, 0x15}, 0x4000000) 15.693557519s ago: executing program 8 (id=4011): prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x2) (async) prctl$PR_CAP_AMBIENT(0x2f, 0x0, 0x1e) (async) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x101700, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) (async) ioctl$BTRFS_IOC_BALANCE(r0, 0x5000940c, 0x0) ioctl$RTC_AIE_OFF(r0, 0x7002) (async) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000040)=0x1) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/image_size', 0x1000, 0x12) syz_usb_connect$uac1(0x3, 0xb0, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9e, 0x3, 0x1, 0x6, 0x0, 0x7, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1ff, 0x11}, [@mixer_unit={0x7, 0x24, 0x4, 0x4, 0x46, "ce57"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x8, 0x5, 0xf, 0x5, 0x8}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x1e, 0x1, 0x6, 0x1, 0xf5}, @as_header={0x7, 0x24, 0x1, 0x4, 0x43}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0x5, 0xd, {0x7, 0x25, 0x1, 0xc, 0x4, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x808, 0x8, 0x2, "995a773e41640828"}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x5, 0x0, 0x3, "0bb0f7c2"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3df, 0x2, 0x5, 0xc, {0x7, 0x25, 0x1, 0x8, 0xe6, 0x4}}}}}}}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x201, 0x0, 0x78, 0x9, 0x20, 0x8c}, 0x10, &(0x7f00000001c0)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0x2, 0x4, 0x7f, 0xf8, 0x9, 0x18}]}, 0x3, [{0x6, &(0x7f0000000200)=@string={0x6, 0x3, "552605b1"}}, {0x56, &(0x7f0000000240)=@string={0x56, 0x3, "ba7272810c4d798762ffd46977820a0ce005fd37f717f1d30e7a0fdba3952a7ac8cf81518522b00a31aac4f1fce9144974265f7dc4cdf6720574de092c36ebd7b552caa5d57337b786807e9c7eb019567841ef5c"}}, {0x19, &(0x7f00000002c0)=@string={0x19, 0x3, "3d2dcc450bbd3fbb2f2ee78cc29380bf446658c0485439"}}]}) ioctl$RTC_AIE_ON(r1, 0x7001) mbind(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, &(0x7f0000000340)=0xd6, 0x6, 0x1) (async) r2 = syz_usb_connect(0x1, 0x69d, &(0x7f0000000380)={{0x12, 0x1, 0x110, 0xf8, 0xac, 0x5c, 0xff, 0x1bc7, 0x701b, 0x1ddf, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68b, 0x1, 0xc, 0xb, 0x40, 0x0, "", [{{0x9, 0x4, 0xb1, 0x81, 0x6, 0xff, 0xf6, 0xc8, 0x2, [@generic={0xc7, 0x9, "bd965d91b0759b786c180206d7df5dbd6783e5fd917803e7db844dac21b5cd5b5eac034e7b7781bbffe1661361dea8f233070dad97562973f0e29c5791ddcc8fafe91ece955cf4bac09302cf206054ec012bf0574353ef78dee5bbfbbd7b2ef24b1bc21e670c02a119143b9ba758b22f133f70f8b7544835fdb02f393e70119cb1f3d18eb6376fa197cc70cbeea3a8b5ad08f9720d24b7adbc7e1b51b025f812664bbaada9a4d1ff01650b95b03888bf6e759dc3d56e57b86f65a1b5cae58c8915dab0f432"}], [{{0x9, 0x5, 0x9, 0x0, 0x8, 0x5, 0x40, 0x10, [@generic={0x79, 0x11, "6c9087397499a89d9b812ab352e33088161c93f1dfc15188969cd30ab771206cd7338e79716ef325ad4aa504bf764d72ccc4ab7b685a7e2957de7c8c9ba6124ea3685d48b64b0059f4fe5c2f9e7ce1d821ff5759766c51ec0f7531dd62ba88c70d573b3582eddf8af8092b7a3e233a16528adcd36288b6"}]}}, {{0x9, 0x5, 0x6, 0x3, 0x40, 0x0, 0x0, 0x2, [@generic={0xce, 0x4, "29cb65b73aa437ff21a0c106f242b12de9c508d8512f8cb2d008ebd81b5d5f550dfbf625fb1e4272ed08d1c5dde2a4268e65498b05ed21fff527060e4b8f935e69c1b2b71a4cb6af76c1ed0795f4323fe5f1df7440a371ada4280a9112b56e9de850ddd3fc346c6429896bb52fefc063e5f53ebbb99be1f7e12ef36cc9c61fe91b3b1e470b98c2db4a4679179e292818fe4dea15194eb7cb000adc1ce02179814b548c207be5fe3c19b8f6bb874869b33f262f14c274ca4dcea9b0c13c7ebeeeb3f3184a703b6da5a4e75626"}]}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x80, 0xf7, 0x7, [@generic={0xdc, 0x21, "9808b64839c5f694bcaddb61221303051712ac5396a7924c9a98cee2b5a0a12c2af6560f7ef7277800857c01b0bddf2035e1caf7b83c8e53ea1d2774c2b51285213b661db2728aa7ebb901ff1c52b6c340581a19bb2591a08df476da39323b1316caac2a28716d5d32400958461a2b524c3d9a22ea4843ada58e1526c3eef75c56c57a97d2a3c41d99ef0d6af9d54cedfbd0efb0ec4afd40b1be52d13fa31f0953962697624d3c7518ad41b66da5281de66615e65ebb5e1c6493ce8971a8b2f5e5fd29bbfd10b18efde87ed2a3dc5b930077b8ab5e47d50440ca"}]}}, {{0x9, 0x5, 0xb, 0x0, 0x400, 0x6, 0xbd, 0x8, [@generic={0xcb, 0x21, "4c9a82f0ee1a6ef035af96041f87e62d86e9f5c6be6ba2584e4575e9b95e4985f2f69ca45dc222d16fd5ae216d927303b5e15e2033640bb8d3df8d2a0055f95b19d62492c7b70a6ad0f7edd581eb1a132ebcddd6ead33e55e7f54a363693badf52c45a66b84dff966d9f8ab627795b0779ce04506128920e1e39324c0a7303f05b258fc9ae9c184b987ea9728619fbf2527cc099d94591cdef5ecdef0f2063b23686d5ddd2eb3f2546bf09e2659d0de1bc0ab1724e12c3fd631f4235e8ad8b1afc5ba7b9570c5f8626"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x400, 0x2, 0x0, 0x7, [@generic={0xfc, 0x1, "ad93e4b75929737e68f2d5ba962bb8de32d2f11a1f97fa3a09d35f7d5e76da9f91e285c576d2000f6c1568ef2a3426e6f137de6ed3c70c5d9bab69900b3a4c090f81f3a7a8113c9e3c67d8120267092796179b52552baeea239658635a32fbce7d6bb78dcc56928516c6e2d11970d828b4171d623805b21be405179ce067fb03c3566c493a99d1f2ff18f00e4b9a9a2e3c823f56c8a686fdcfde834888a093939b3ae309e99439d2261c47063df00269c0f26b28999e1d2eb99a730c64ec7c86f05dea42c6e4a30b51a09002638ccc19bd9a4314a1b124ac6835dae4bb6ff63d6c7888501300d758967d91019ab905153b1d6a72ef6ae7c74d50"}]}}, {{0x9, 0x5, 0xa, 0x8, 0x20, 0x8, 0x8d, 0x6, [@generic={0xc8, 0x38, "79a0b9320f65c3dbbac966c78415460ab065107a1626a7f101df073223db3421b98467823ef0881d34ffa51f68fae928ce331da7fe32c95f3e394fa22c0806b4fd3f0aa688beb937a548658c9c11aac3833e39b54078ac10cb92c08cc88ea475b3301c0a70dd5defd2cacc5b675bef12e75441747221c63b390345ae10f6b8e4fe10a8c1fa5696745643accdda0c8f84464abad471d127947efda5376865b758de02f9fa6ca374c1bd70a82af2b1b9960276c98e3070b883fc53045bfde7602c2e1ae65283be"}, @generic={0xca, 0x5, "e6291193ba6e31f9f72d32a7912a42f79d3f0adeafde9acb2de47095b81f87bb174e67e7f36e64a855d1ed235d38d80909473e7962a0d114f11362be7a3e71f7985075b3dcb4e528d455e27c1b3884b569d261d9680827a90a5f4a2a52869b15b1eeb7e53c45b510e2a23ccbfae0293b596686440dbd38e1b88ed5113a5e0f4270f5df3166f198bf9d270a6c55c228477a3bcfbd8b42c4c16c54b8dccf5ec92f67b6781a3a44a08779b045fd79b67ffdb3536c194f0ff1ddd953078f95cbc4d6d989fe6fe8d07511"}]}}]}}]}}]}}, &(0x7f0000000f00)={0xa, &(0x7f0000000a40)={0xa, 0x6, 0x310, 0x1, 0x6, 0xfb, 0x40, 0xfd}, 0x1e7, &(0x7f0000000a80)={0x5, 0xf, 0x1e7, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x4, 0x2, 0x8, 0x6}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xa, 0x2, 0xf0, 0xa}, @generic={0xeb, 0x10, 0xa, "d7de31dbdd31a5e5edfbb5ce569a0be1f77f77dbee7f6403cca6428cc1c49a3df48608bd033a1734d6393cf9f1d4075cf8b42a53a67c9237ada65c2a9c6ad5e4c32aa2659e5079e478485c30196d7341001f7b2b5335e60641c937973755e996996476565b9a57f17134d9d86e522ba0df37a1686cb26e34c00ff239fd50213adf9d783428a5adb0ea1de1b1682682868ac04e41ba3c188d5732c2d3cb8bd6c90816718f2e491a4112e992d95ca3a66a9e63863744d909038ea39626daf609f6bf820d0693deb59456bf5f01eae31b5660177c7fefa68dc5b23f9dce39fd2d7612e017a6a8ea801a"}, @generic={0xe6, 0x10, 0x2, "48d3811285246137994eb403323b65a29b91176d0ff6ccb32d4cac1641529971d4650ea194602ef9ea48f89d2f83c925c8490235899202d2e5890aca73ebd52ef762b701b4306dbfc6007c339730dee50cd64ef5818aed27efcc2e1841ebd2bcd8328e4aba703e9c42b021653a60abeda3a1f0901c6697a580803b2f2f88cb9c734e4a9f2ab17cd40caab98f4141b40409e75f4b73ccfd988746aa07ebeb08067725528917cae179aacb471c0aceadc69447f92ffa491229c7b6420544c16b0730f9ae312c56538796d511da54977264f5e02848a39991e5d2ed6cc58e916e24300422"}]}, 0x6, [{0x2e, &(0x7f0000000c80)=@string={0x2e, 0x3, "0e0d3e5db53d5035a66f09595843ae1c5b7e0373a7c2fb9d5fe355281aa196dd10b2a1454130e8f083066b4a"}}, {0x5a, &(0x7f0000000cc0)=@string={0x5a, 0x3, "0631843459f8dfde3fc4c70650da802faad3467e4a44713c7b328f79f556cdbf86c1ca11cc95ede842175c785f60d0255df6ff09c6667ad43d39c147e5ef24840a647c5fbb37d27590d5728303c30f0ee15454eaae3cf5a9"}}, {0x4, &(0x7f0000000d40)=@lang_id={0x4, 0x3, 0x409}}, {0x8b, &(0x7f0000000d80)=@string={0x8b, 0x3, "f77f78004542a26c1a7cdf0f8069634bc20cfcf3cac5bf227b0b4dd942e6520d49a3aa63499eacb9333b05c80503aa3fe4704772c0d0cc30198af0da90af59c206fb60897e10aee60f724c64e05053f3ff4d795b2d58056ca6500acc8448c5bb70ad802c7f38519c974994fb11ce52f4c4276a16afcc4dc1a9394a3a2df40ed1efbea68337c3daf6f4"}}, {0x4, &(0x7f0000000e40)=@lang_id={0x4, 0x3, 0x1001}}, {0x62, &(0x7f0000000e80)=@string={0x62, 0x3, "cfff7d8c04b3d172847134e2a9c7a28cfee9e79b87530a3db0235af9821c9d585f2a63ee9e604cca5be5066fd7ee09d43061659ad154f8b17e20821c80fe2390030ffa0c00c859bd0462df7aba14c314048c09a3c2a7bf4b466b4727bdd2bf67"}}]}) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000001080)={0x14, &(0x7f0000000f80)={0x0, 0x30, 0x8c, {0x8c, 0xb, "47aeca0ea9aaa1ccaa5840758f94aefbc96b0aec6f50067212534fec558d7fe8c9f8bd21da7cc07e4602ad53897d3adb422faa830728bc90b52df2776dfcb232447da8febf644461192df10ae36c36c0356cb34fd7a08fb3fb85d1d32e2e7d0226cacb53b6467bbb4858556f74ffefc1e0844139fbe2bc61f9aa55989fcc12561fb54373133350151ba6"}}, &(0x7f0000001040)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000001180)={0x1c, &(0x7f00000010c0)={0x0, 0x1b, 0x27, "95906b85bcfd62029fdbc5bc797ed97ce0955b4b90687b53e149b53fcc6f8962e6f099871fa383"}, &(0x7f0000001100)={0x0, 0xa, 0x1, 0x59}, &(0x7f0000001140)={0x0, 0x8, 0x1, 0xd}}) (async) syz_usb_control_io(r2, &(0x7f00000014c0)={0x2c, &(0x7f00000011c0)={0x0, 0x11, 0xce, {0xce, 0x31, "b509553575f927c9130a9c3d5ec02dee57f3c0a779ff1833ceaf935cfaff2010a10cb4daaf842afd9d23a0f89969df023fa16144e8b1ad2248e7af664237b046ec5e54e5629e36f6e22262b0a2ca0d11cfe83871aeb7c07ff58b2c7fa0c30f47cb58abee28ed18b10c2ae0a4b745c5e98a5b6c7c03d7d9ceccb7b0101d5fd194e02b2248c8e5ed475f041fbea29b669e121f63395f8d3d757401aac264a3e93909e73fd326ebe65dfd040ee0c47568a6d579964785e0e567943c878b5efd8d98090b7ec3e970f1634e6dce24"}}, &(0x7f00000012c0)={0x0, 0x3, 0x7c, @string={0x7c, 0x3, "59a960ceade728b2104ef31807349196f37995bce648c8dccd1c7794188c6ca3d3eac1318d9134f221e97b94d4ef964fd197b4520f4b3c56a2f30d88a2842df9b3f33dd1fd4d3207c32df737e1ddcb46b61e2495186065fe29949acbd1ee2ae4d26e1a7481d822ae1c4322141968029243b05b50e87906e04d49"}}, &(0x7f0000001380)={0x0, 0xf, 0xa2, {0x5, 0xf, 0xa2, 0x4, [@generic={0x73, 0x10, 0x1, "2546f642298ea9d7609dcc787e83594b1dbe68c27705fcf6dd1e9db26196f39df3fcc15cadf78afdf7bb557d395735e70ec4481fd229c3636c4b26225f13ec408506c8c4208265c04feff01b4dfaa5680910459d30915ff0571b5736bb198450cfe9a5c14265270eb5804c120c39cbb4"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x81, 0xf9, 0x5, 0x4, 0x8}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "595cfc2ce3371d33f2a4796c481cc089"}, @wireless={0xb, 0x10, 0x1, 0x2, 0x63, 0x6, 0x9, 0x101, 0x3}]}}, &(0x7f0000001440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x8, 0x6, 0x3, "4020b5b5", "b9df12c2"}}, &(0x7f0000001480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x8, 0x80, 0xf7, 0xd7, 0x39, 0x7, 0x1}}}, &(0x7f00000019c0)={0x84, &(0x7f0000001500)={0x40, 0x3, 0xbd, "77c7f099e5fda690f4dcf9faf6de7d3fe795310c2fce396bfb14b238857645758a777ce9ea26d02530cd61bfd954bfa95d288905d1c9b03123ff9ee6afe1aa42726881f5d0a2e71c6dd39f0aa87e883da38d08fc73b8340ce2e2c4b1e7eacfd68a7cfc23acc887cbb2e3170e0c4d547a1722855be4b531d6ec88a7a9bb9d7c7083315d57610a0ca7ad86dac81d0fb4cdfca5f144bde0288d8fa3c5998c38a94c722b725b1b0d1aa24541ec4db6533b18fc708a18d9d4dd25ea6b95e75a"}, &(0x7f0000001600)={0x0, 0xa, 0x1, 0x14}, &(0x7f0000001640)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000001680)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f00000016c0)={0x20, 0x0, 0x8, {0x120, 0x8, [0xff0]}}, &(0x7f0000001700)={0x40, 0x7, 0x2, 0x1000}, &(0x7f0000001740)={0x40, 0x9, 0x1, 0x1}, &(0x7f0000001780)={0x40, 0xb, 0x2, "9ece"}, &(0x7f00000017c0)={0x40, 0xf, 0x2, 0x200}, &(0x7f0000001800)={0x40, 0x13, 0x6, @remote}, &(0x7f0000001840)={0x40, 0x17, 0x6, @link_local}, &(0x7f0000001880)={0x40, 0x19, 0x2, "1781"}, &(0x7f00000018c0)={0x40, 0x1a, 0x2, 0xe91}, &(0x7f0000001900)={0x40, 0x1c, 0x1, 0x6}, &(0x7f0000001940)={0x40, 0x1e, 0x1, 0x6d}, &(0x7f0000001980)={0x40, 0x21, 0x1, 0x9}}) (async) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r1, 0x80489439, &(0x7f0000001a80)) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) (async) getpeername$packet(r1, &(0x7f0000001b00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000001b40)=0x14) bind$xdp(r0, &(0x7f0000001b80)={0x2c, 0x1, r3, 0x15}, 0x10) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) ioctl$KVM_SET_GUEST_DEBUG_x86(r0, 0x4048ae9b, &(0x7f0000001bc0)={0x100000, 0x0, {[0x1, 0xd, 0x7fffffffffffffff, 0x7fff, 0xf84a, 0x256d9c7c, 0xffffffffffffffff]}}) (async) syz_usb_control_io$uac3(r2, &(0x7f0000001e00)={0x14, &(0x7f0000001c40)={0x20, 0x21, 0xe2, {0xe2, 0x3, "1c7b938a40f390a43f0d63f8517ac4949bdd91a8852fc63799f1fc5dc8425185f04aa07632dd4d9f33b76cd9ec3718b936907e062d443effc0755ac46c69e02a100ea21eaefec251960970d29d1096804a44e98806d341d33837668a845f58953be247c2c6795548632c89f4f824ca4dbca987d14906bc4fd32a808a2a6d9f796539add4c15a13645a086f16a9a9a251d7c2befc0246b7848b4c0f25080fdb495820c10e231ffcc13f9b057d7405f5090776ac2b668f5d55706187d87a2fe614535f157b61ac881bb051e50e2d39ec3da83921cced8fbf0f169435c062a8c081"}}, &(0x7f0000001d40)={0x0, 0x3, 0x80, @string={0x80, 0x3, "7b6b5d957ef50f29d5b29db9461b82114677f07167b4fc5a7fe4ac0fd77a334e3a23be4cf442ad3f394bb92108033a33fb910d14c33fc050b284d13c48636c70a33f7b059596eda285227a1380ed6610bf15f7eba5e3de340744335b7bd16a53e4977917bce6e4dc463ebd4ffa79370508a585b435feee6a4f7456de0025"}}}, &(0x7f00000020c0)={0x44, &(0x7f0000001e40)={0x0, 0x1, 0x91, "bd8d0821946b2a03aad4a52e6a821733a191c8a2792134fe78a94731ce6380479b761733807d6a6c39722070c23965605691f1a9ad00ce955e3935529bf9c4be37fb04027da09a61c6368e67fca18ece7f52246fbe35398f0031240b32f4978da8b6bcd92cb0559f093626766d775aaa10b3e4b77bbe1d36d494574b025f9e066fed65f8c717197c7b1fcde1e5cb36f872"}, &(0x7f0000001f00)={0x0, 0xa, 0x1, 0x7a}, &(0x7f0000001f40)={0x0, 0x8, 0x1, 0xb}, &(0x7f0000001f80)={0x20, 0x81, 0x3, "67aa42"}, &(0x7f0000001fc0)={0x20, 0x82, 0x3, "abd0cc"}, &(0x7f0000002000)={0x20, 0x83, 0x1, "10"}, &(0x7f0000002040)={0x20, 0x84, 0x1, "b3"}, &(0x7f0000002080)={0x20, 0x85, 0x3, "dfea79"}}) (async) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000001, 0x13, r0, 0xc0417000) syz_usb_connect$uac3(0x6, 0x108, &(0x7f0000002140)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1739, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xf6, 0x3, 0x1, 0x9, 0x80, 0x5, {0x8, 0xb, 0x2, 0x2, 0x1, 0x26, 0x30, 0x5}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x5, 0x75, 0x4}, [@extension_unit={0x19, 0x24, 0xa, 0x3, 0x4, [0x2, 0x8a74929be1200f15, 0x0, 0x0, 0x2]}, @output_terminal={0x13, 0x24, 0x3, 0x6, 0x100, 0x2, 0x3, 0x1d, 0xffff0001, 0x0, 0x1000, 0x2}, @extension_unit={0x11, 0x24, 0xa, 0x3, 0x3, [0x0, 0x1, 0x3]}, @output_terminal={0x13, 0x24, 0x3, 0x2, 0x405, 0x4, 0x6, 0x0, 0x0, 0x7, 0x1, 0x3}, @mixer_unit={0x8, 0x24, 0x5, 0x6, 0xc, "065b40"}, @output_terminal={0x13, 0x24, 0x3, 0x6, 0x304, 0x5, 0x4, 0x8, 0x4, 0x8000, 0x2, 0x9}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0xd, 0xe42, 0x3b, 0x5, 0x30, 0x6, 0x7, 0x2}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x94}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x6, 0x5, 0x6, {0xa, 0x25, 0x25, 0x3ff, 0x0, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x5, 0x5, 0x4, {0xa, 0x25, 0x25, 0x2, 0x5, 0x7957}}}}}}}}]}}, &(0x7f0000002440)={0xa, &(0x7f0000002280)={0xa, 0x6, 0x310, 0x7, 0x1, 0x8, 0x10, 0x9}, 0x3a, &(0x7f00000022c0)={0x5, 0xf, 0x3a, 0x5, [@ssp_cap={0x10, 0x10, 0xa, 0x9, 0x1, 0x6, 0xf00, 0x6, [0xf]}, @ptm_cap={0x3}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x5, "a6d6e4f2fa85b99313b57d7cf6d48587"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x20, 0x0, 0xc, 0xd91, 0xb}]}, 0x5, [{0x4, &(0x7f0000002300)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f0000002340)=@lang_id={0x4, 0x3, 0x4445}}, {0x4, &(0x7f0000002380)=@lang_id={0x4, 0x3, 0x500a}}, {0x4, &(0x7f00000023c0)=@lang_id={0x4, 0x3, 0x426}}, {0x4, &(0x7f0000002400)=@lang_id={0x4, 0x3, 0xc35}}]}) syz_usb_control_io$uac1(r2, &(0x7f0000002600)={0x14, &(0x7f00000024c0)={0x0, 0x7, 0xbe, {0xbe, 0x30, "390067eaa250615f2353a315400c2b871e34e704ecbfc9fc65d67716a931d9949f6345171458b5156018ee571964c7c2d877927df97e8c909bba521d1853a28fcfe291f725aee37eac3a46438c7bd32a6a538d4a885341533ede7408df49d8888ec5657f676481f7edf935efdde690c393c00defa74b65a455dc2aeaf69cf85c0827c568e89e42d1d87680e6bc6dc07c1ca8868d8668aa3ec6054989e564042b958e037a70e458b3ce6b7ab57bbff51f72930cf86db88d276da958d3"}}, &(0x7f00000025c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c2f}}}, &(0x7f0000002880)={0x44, &(0x7f0000002640)={0x40, 0x14, 0x43, "9c05a7736c1b2d583547db604475b4c555c9cb96c1e26dd992a6b01a62b2ccd7dab3251e0b65f659e2088de11fa60334b7d1f54615d6bf5fd77825bf519b8252065e94"}, &(0x7f00000026c0)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000002700)={0x0, 0x8, 0x1, 0x65}, &(0x7f0000002740)={0x20, 0x81, 0x2, "d785"}, &(0x7f0000002780)={0x20, 0x82, 0x1, '4'}, &(0x7f00000027c0)={0x20, 0x83, 0x1, "16"}, &(0x7f0000002800)={0x20, 0x84, 0x4, "819b152b"}, &(0x7f0000002840)={0x20, 0x85, 0x3, "97d1fd"}}) ioctl$KVM_RUN(r1, 0xae80, 0x0) (async) r4 = dup3(r0, r0, 0x80000) ioctl$FIOCLEX(r4, 0x5451) ioctl$XFS_IOC_FSGROWFSRT(r4, 0x40105870, &(0x7f0000002900)={0xff, 0x10}) (async) ioctl$DRM_IOCTL_PANTHOR_VM_GET_STATE(r4, 0xc0086444, &(0x7f0000002940)) syz_usb_control_io$lan78xx(r2, &(0x7f0000002ac0)={0x14, &(0x7f0000002980)={0x60, 0x1e, 0xe7, {0xe7, 0x30, "120479780848835b1779261e45fe600a6e3fbb978b610680d0abd42c1b60e70121d8eb4dcd3fb7f633f34a10ba8a041b1b477bc56cf5ed40c34083eb47cfd43697026f7519055718b0a0b076f386e53b322cb9341fa4f1d03feea4587176055007fc49ef7c7ae7e7dbbc8c3e134e9d1d9ca2a4c84507078d9557a9fc1b37a4f758f3977e81daff5be60149a5a8dd9fd195eae23d52f210d58876f3ec3b8be220e1f9865200b65923e6001d995851c569d8bc8b29a431e1abd8241d9a6cea627f2d3c9cf2e250f7a38f4c49c0188a02f10543527be0d13c2ba1d2e6d26b978905f0ceb6ecd1"}}, &(0x7f0000002a80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x6afebe8c65b1714b}}}, &(0x7f0000002d00)={0x34, &(0x7f0000002b00)={0x20, 0x5, 0x8c, "04f2cf839d8c20dfc612987cb12018fe2ef9c0e73984642ce1a4008fc883c46653f825209cb6f695834a1bb984ce2e537cd753aa43edb14a032c60029de2f8ae74ee21768cbd736f3ac31c45cea2fc97e730ec7604b507fc86ac4d5cfa571e4105ce3260a78cc01f2974357fb9b5ecba165cc515863e5d54c06d623d59760169f47655cae7506cfde7785f37"}, &(0x7f0000002bc0)={0x0, 0xa, 0x1, 0xff}, &(0x7f0000002c00)={0x0, 0x8, 0x1, 0xc2}, &(0x7f0000002c40)={0xc0, 0xa1, 0x4, 0x9}, &(0x7f0000002c80)={0x40, 0xa0, 0x4}, &(0x7f0000002cc0)={0xc0, 0xa2, 0x2f, "91d4b18c5bca0277d1d582cba330a8de8a386b8d13d5401ad34789e7086347ee509408e496f9512ab749b83cce0f4a"}}) 14.31045131s ago: executing program 8 (id=4016): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=ANY=[@ANYBLOB="540000000b0601080000000000000000020000000900020073797a310000000005000100070000002c000780060004404e21000005000700110000000c000180080001407f000001"], 0x54}, 0x1, 0x0, 0x0, 0x1000c893}, 0x4080) 14.199431393s ago: executing program 8 (id=4018): ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(0xffffffffffffffff, 0x40184150, &(0x7f0000000040)={0x0, &(0x7f0000000000)="06cf5d29d9240c", 0x7}) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f00000000c0)=0x6) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = getuid() getresuid(&(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0xee01}}, './file0\x00'}) r8 = getegid() stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r1, &(0x7f0000000100)='system.posix_acl_default\x00', &(0x7f0000000300)={{}, {0x1, 0x7}, [{0x2, 0x0, r2}, {0x2, 0x7, r4}, {0x2, 0x4, r7}], {}, [{0x8, 0x4, r8}, {0x8, 0x2}, {0x8, 0x4, r9}], {0x10, 0x5}, {0x20, 0x4}}, 0x54, 0x6) ioctl$TIOCPKT(r6, 0x5420, &(0x7f0000000380)=0x3) statx(r6, &(0x7f00000003c0)='./file0\x00', 0x0, 0x418, &(0x7f0000000400)) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f0000000500)=@chacha20_poly1305={{0x303}, "37a8aedf755680c9e6cd3a56", "20c7151f8c96813b27fb3bade1b9d6d11883f29b1922257e29410635c6885419", "6da181cfa83dec3f"}, 0x38) mount$pvfs2(&(0x7f0000000540), &(0x7f0000000580)='./file0\x00', &(0x7f00000005c0), 0x880, &(0x7f0000000600)={[{}, {'system.posix_acl_default\x00'}], [{@permit_directio}, {@fsmagic={'fsmagic', 0x3d, 0xfffffffffffffff7}}, {@uid_gt={'uid>', r3}}, {@permit_directio}, {@obj_type={'obj_type', 0x3d, '^\'[#*\xfb\x91!'}}]}) mmap$snddsp(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x6, 0x8010, r6, 0x7000) syz_genetlink_get_family_id$mptcp(&(0x7f00000006c0), r6) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r1, &(0x7f0000000700)={0x10}) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000780), r6) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r6, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x20, r10, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xfd}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) syz_genetlink_get_family_id$mptcp(&(0x7f0000000880), r6) ioctl$sock_inet_SIOCDELRT(r6, 0x890c, &(0x7f0000000900)={0x0, {0x2, 0x4e21, @local}, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x14}}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xf}}, 0x11a, 0x0, 0x0, 0x0, 0x5, &(0x7f00000008c0)='netpci0\x00', 0x2, 0x9, 0x5}) r11 = add_key$keyring(&(0x7f0000000980), &(0x7f00000009c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$get_persistent(0x16, r5, r11) madvise(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xa) ioctl$XFS_IOC_SET_RESBLKS(r0, 0xc0105872, &(0x7f0000000a00)={0x4, 0xffffffff}) link(&(0x7f0000000a40)='./file0\x00', &(0x7f0000000a80)='./file0\x00') setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f0000000ac0)=@chacha20_poly1305={{0x303}, "56fde14ce547ddb3832797f6", "88519e724ea8d8792d921d172c8f288d4a2bab012143f94418e98aa0173b439e", "ac38ec93d126f95b"}, 0x38) r12 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/tty/ldiscs\x00', 0x0, 0x0) mknodat(r12, &(0x7f0000000b40)='./file0/file0\x00', 0x10, 0x8) openat$dir(0xffffffffffffff9c, &(0x7f0000000b80)='\x00', 0x244801, 0x4) 13.899669502s ago: executing program 8 (id=4022): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x8000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFQNL_MSG_CONFIG(r2, 0x0, 0x8080) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="060086dd0800140040000000000065c5dd380028067efc020000000000000000000000030001ff020000000000000000000000000001"], 0x5e) write(0xffffffffffffffff, 0x0, 0x0) 13.684169218s ago: executing program 8 (id=4025): setns(0xc9, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000000)="120000001200e76f00341658a585107b462e", 0x12, 0x24004000, 0x0, 0x0) recvmmsg(r0, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)=""/217, 0xd9}, {&(0x7f0000000400)=""/108, 0x6c}, {&(0x7f0000000480)=""/4099, 0x1003}, {&(0x7f00000014c0)=""/235, 0xeb}, {&(0x7f00000015c0)=""/283, 0x11b}, {&(0x7f0000001700)=""/216, 0xd8}, {&(0x7f0000001800)=""/132, 0x84}], 0x7}, 0x7ff}, {{0x0, 0x0, 0x0}, 0x800}, {{0x0, 0x0, 0x0}, 0x2}], 0x3, 0x0, 0x0) (fail_nth: 3) 8.738339269s ago: executing program 3 (id=4053): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f00000003c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x0, 0x3, 0x6c4ba42, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xb4, 0x0, 0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xcd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x3, 0x7fffffffffffffff, 0x2, 0x0, 0x8e665f0, 0x0, 0x92c, 0x3, 0x7f, 0x0, 0x1000, 0x4, 0x0, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x800, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c8e, 0x100000000000000, 0x2, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x9, 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x80003, 0x0, 0x0, 0x400000, 0x200, 0x0, 0x81, 0x2000007ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000000, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2, 0xfffffffffffffffe, 0x2, 0x1, 0x3, 0x10, 0x4000100000001]}) 8.67690736s ago: executing program 3 (id=4054): mount(0x0, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', &(0x7f00000002c0)='gfs2\x00', 0x4000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) mount(0x0, &(0x7f0000000040)='./proc/thread-self/fail-nth\x00', &(0x7f00000000c0)='securityfs\x00', 0x100004, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="100000001d1d61b8c997ab0e6edbdf25b8d7bc9d61f9e7a3ef83c1ef8286e6c74b36a6bcf8ee33f8e147f8284b4a5ba460ae50179352a978d5a7618a9d1f616be568007139402106c4e47e28561664b401b0c64532f7da80d184fa5afaf80813f58647e5120b0edb9f"], 0x10}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) syz_clone3(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40a01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0xc201}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000380)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB], 0xffe) prlimit64(0x0, 0xe, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000400), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f0000000440), 0xb6, 0x5f1882) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) mq_open(0x0, 0x800, 0x80, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000480)={'vxcan1\x00', 0x0}) bind$can_j1939(r5, &(0x7f00000004c0)={0x1d, r6, 0x0, {}, 0xfe}, 0x18) sendmsg$kcm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000600)="2e00000011008108090f9becdb4cb92e0a483137140000006bbd6efb25eee9f60d00307e181ac52d170300020400bf0500", 0x31}, {&(0x7f0000000340)="81cf2aac698775916c162336b2811740", 0x10}], 0x2}, 0x1f) 7.802971026s ago: executing program 3 (id=4057): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0xffffffd9, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00`\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x20049000) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000000040), 0x12) connect$x25(r1, &(0x7f0000000100), 0x12) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r3, 0x4b72, &(0x7f00000007c0)={0x0, 0xfdfd, 0x8, 0x14, 0x100, &(0x7f0000000800)="387ed7626d850509a2d6c1aa38f15cd00f85c263cb226db671261fff7ce9c555f189afae3530db6dd493f28fd988721b9ae21b3e3bb75dae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef495689092883b902a41cd75387ef6f7bc7d460d5e665f398ff95596dc94ec97003a3db08e500c2fb17e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1f7a1e850ecb3421143c5c4ded0f083a0c524dcf320827266819b6a952db5bc96141b26c54db857edbcbbc81c7af7aadf50bc549974b6401a19cdb130282b955592efb94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3a256c7520b285d8da0dbf5e20d604413ed2ddf9bcbf881cae811852806175d63892a15234fbcd7a88a0a0aea45d19148f0e7dada7d6d0d77881387fdeaa02863be90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695ef060000001bbe1b649f42f310859122c0d2c1e558dc6586958a28374f386ecf369274e43003a09b5159ea515eb44521901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc509254a12cece59181fcb5bad8c24bd9f8f78d17ab01831325501e80d899e9252f99d3a2666343392fda115048e4f4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b18914beb66ac9e519bd3330000000000000009a3237aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b5b66ab89d2d6333f699b16db68986ab3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9b647ba812f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d14df8aa9df6f40a80ace2bb8a2aad3b0c66915927db4173181943d88c0c76d5969e2053db5bd77fd60ba0f012139929ccfec965c1f769785a4d23332d71f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fdc1bc31152538db50f47dc38ba908a0d808687e478a609fe0daa0000000000000000e7f2e98597e27f3e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d4794ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e8fd4e71929f918b98c4cbfcb11a90139264a9ee807c973167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d174d2465382a1a00ddc42915e4f3a5db640600000095a3d63904c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e04c93a5470774975b42091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00000000ddffffff00"}) listen(r2, 0xfffffffd) r4 = accept4(r2, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e22, @multicast1}}}, &(0x7f0000000240)=0x84) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'bond0\x00', 0x2000}) syz_genetlink_get_family_id$batadv(&(0x7f0000000680), r4) 3.086554435s ago: executing program 3 (id=4060): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000800), 0x8002, 0x0) write$P9_RSTATu(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="9f0200007d200000050c00000000040005a7000000000a000000000000000000406100000000e0e5000005000000000000001b00046e6f6465767b65"], 0x29f) 2.820206835s ago: executing program 3 (id=4063): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f00000003c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x7, 0x0, 0x3, 0x6c4ba42, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xb4, 0x0, 0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xcd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x3, 0x7fffffffffffffff, 0x2, 0x0, 0x8e665f0, 0x0, 0x92c, 0x3, 0x7f, 0x0, 0x1000, 0x4, 0x0, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x800, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c8e, 0x700000000000000, 0x2, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x9, 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x80003, 0x0, 0x0, 0x400000, 0x200, 0x0, 0x81, 0x2000007ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000000, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2, 0xfffffffffffffffe, 0x2, 0x1, 0x3, 0x10, 0x4000100000001]}) openat$dm_control(0xffffff9c, &(0x7f0000000380), 0x202, 0x0) 2.607593063s ago: executing program 3 (id=4064): syz_usb_connect$uac2(0x0, 0x80, &(0x7f0000003700)=ANY=[@ANYRESDEC], &(0x7f00000037c0)={0x0, 0x0, 0x0, 0x0}) 1.788851587s ago: executing program 0 (id=4067): timer_create(0x2, 0x0, &(0x7f00000008c0)) (async) r0 = syz_open_dev$sndpcmc(&(0x7f0000000780), 0x0, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x9, 0x12, r0, 0x80000000) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/net/ipv4/neigh/lo/base_reachable_time\x00', 0x2, 0x17b) write$cgroup_pid(r1, 0x0, 0x0) (async) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_DELDEST(r2, 0x0, 0x488, 0x0, 0x0) (async) ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f0000000280)=0x96b9) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, '\x00', 0x10}, 0x4}, 0x1c) r6 = syz_open_dev$evdev(&(0x7f0000000200), 0x2, 0x862b01) ioctl$EVIOCSKEYCODE_V2(r6, 0x40284504, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x10012, r3, 0x0) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) (async) prctl$PR_GET_TSC(0x43, &(0x7f0000000040)) r7 = syz_usb_connect(0x0, 0x4a, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) (async) r8 = syz_open_dev$dvb_frontend(&(0x7f00000007c0), 0x0, 0x400) ioctl$FE_GET_INFO(r8, 0x80a86f3d, &(0x7f0000000800)) (async) syz_usb_control_io$hid(r7, &(0x7f0000000300)={0x14, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) (async) syz_usb_ep_write$ath9k_ep1(r7, 0x82, 0x9c, &(0x7f0000000380)=ANY=[@ANYBLOB="0000004e9100004eb19a1e55ea706ef8c49ec53b57064e122ae0aaa7719ac768cffbff11e6"]) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x9, 0x2010, r0, 0xe360b000) mount(&(0x7f0000000100)=@rnullb={'/dev/syzrnull', 0x0}, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='romfs\x00', 0x400, 0x0) (async) r9 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000080)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r9, 0x0, 0x0) syz_usb_control_io$printer(r9, 0x0, 0x0) (async) r10 = syz_open_dev$I2C(&(0x7f0000000900), 0x1, 0x402) ioctl$I2C_RDWR(r10, 0x707, &(0x7f0000000940)={&(0x7f0000000980)=[{0x1, 0x811, 0x0, 0x0}], 0x1}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r4) syz_usb_control_io$cdc_ncm(r7, &(0x7f0000000480)={0x14, &(0x7f00000003c0)={0x40, 0x10, 0x68, {0x68, 0xe, "2e11168c431882735479eff0ef15a432981a45ea872eaa594b4469e7e58912aac45aedda01f182891845ecbc3caeb642240b7473622556974619604c687220c5cdb31bf4d2b378a18d192b6eb329c47af8ef7071ac2d5b721b700aafabca5a37331cce2847c7"}}, &(0x7f0000000440)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000700)={0x44, &(0x7f00000004c0)={0x0, 0x0, 0x65, "f31de5142e79da6162827b5bff80410999aa73e629633f3a9103288005e9d912904ae35a52060f5b8b3d7e30127a8bfedcfcbcfa7c7b46ba9c7ff253e3740d08dd8bc195eafeffefdb5fe5a99b1afcb47c341743a300cffd3324d7ea74beac199f5d2fd75a"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0xc}, &(0x7f00000005c0)={0x20, 0x80, 0x1c, {0x4, 0x3, 0xb, 0x3, 0x2, 0x9, 0x2, 0xdfe, 0x3, 0x0, 0x2, 0x3}}, &(0x7f0000000600)={0x20, 0x85, 0x4, 0x8}, &(0x7f0000000640)={0x20, 0x83, 0x2}, &(0x7f0000000680)={0x20, 0x87, 0x2, 0x101}, &(0x7f00000006c0)={0x20, 0x89, 0x2, 0x1}}) 1.548282224s ago: executing program 9 (id=4069): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x27) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f00000002c0)={'tunl0\x00', &(0x7f00000007c0)=@ethtool_per_queue_op={0x4b, 0xf, [0x4, 0x0, 0x401, 0x2, 0x8000, 0x6, 0xb845, 0x5, 0x0, 0x4, 0x3, 0x10000, 0xfffffff7, 0x0, 0x6, 0x5, 0x9, 0xffffff00, 0x5, 0x0, 0x6, 0x6727366, 0x2, 0x8, 0x6, 0x8, 0x2, 0x0, 0xb94e, 0x6, 0xff, 0x101, 0x3, 0x1, 0xe455, 0x8000, 0x400, 0x6, 0x5c8, 0xac51, 0xfffffff4, 0xbe62048, 0x5, 0x306a, 0xe6f, 0x80e, 0x8000, 0x0, 0x5, 0x200, 0x6, 0x4, 0xac08, 0x5, 0x256, 0x100, 0x80, 0x8000, 0x4, 0x0, 0x800, 0x5, 0x7, 0x9, 0x842, 0x5, 0x5f8, 0x3, 0x2, 0x1, 0x5, 0x6, 0x10, 0xffffffff, 0x9, 0x91, 0xc4, 0x7fffffff, 0xb, 0x0, 0xfffff79d, 0xffff7fff, 0x8001, 0xc, 0x6, 0x80000001, 0xcad, 0xf0, 0x6fe, 0x5, 0x2, 0x102, 0x100, 0x6, 0xee, 0x8000, 0x282, 0x2, 0xb, 0x3, 0xf0, 0x867e, 0x6, 0x5, 0x0, 0x9c1, 0x8, 0x0, 0x7, 0xfffffffb, 0x13, 0x5, 0xffff7fff, 0x0, 0x3, 0xb, 0x1, 0x7fff, 0xfffffc01, 0xffffff7f, 0xe5, 0x8, 0x6, 0x0, 0x4, 0xf, 0x0, 0xfffff478]}}) 1.419426693s ago: executing program 9 (id=4070): r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) readv(r0, &(0x7f0000000180)=[{0x0}, {&(0x7f0000000200)=""/36, 0x24}, {&(0x7f0000000240)=""/35, 0x23}, {0x0, 0x2424}, {0x0}], 0x5) open(&(0x7f0000000080)='./bus\x00', 0x4c27e, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2a) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_DIRECT_TLBFLUSH(r3, 0x4068aea3, &(0x7f00000002c0)={0xaf, 0x8000000}) mount(0x0, &(0x7f0000000340)='./dev\x00', &(0x7f0000000380)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./dev/mapper/control\x00', 0x202, 0x26) syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="040e04060304"], 0x7) mount$tmpfs(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100), 0x14000, &(0x7f0000000140)={[{@mpol={'mpol', 0x3d, {'local', '', @void}}}]}) 689.863565ms ago: executing program 9 (id=4071): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000002100)={0x0, 0x35, &(0x7f0000002140)={&(0x7f0000002180)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000002000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000018000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) 552.492757ms ago: executing program 9 (id=4072): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x14, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xa0}, 0x1, 0x1200}, 0x0) 541.698858ms ago: executing program 0 (id=4073): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc\x00', 0x1ff) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x600000, 0x0) (async) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x600000, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) r2 = signalfd4(r0, &(0x7f0000000100)={[0x4]}, 0x8, 0x80800) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) (async) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x3}, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x3}, 0x10) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f00000005c0)={0x42, 0x1, 0x1}, 0xf) sendmsg$tipc(r4, &(0x7f0000000200)={&(0x7f0000000240)=@name={0x1e, 0x2, 0x0, {{}, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x80) dup3(r3, r4, 0x0) (async) r5 = dup3(r3, r4, 0x0) setsockopt$TIPC_GROUP_LEAVE(r5, 0x10f, 0x88) r6 = syz_ublk_setup_io_uring(0x3c8e, &(0x7f0000000400)={0x0, 0x966f, 0x800, 0x3, 0x15, 0x0, r0}, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500)) poll(&(0x7f0000000540)=[{r0}, {r1, 0x2}, {r0, 0x4400}, {r0, 0xe100}, {r2, 0x4210}, {r5, 0x5047}, {r0, 0x7040}, {r6}, {r0, 0x4160}], 0x9, 0x7ff) (async) poll(&(0x7f0000000540)=[{r0}, {r1, 0x2}, {r0, 0x4400}, {r0, 0xe100}, {r2, 0x4210}, {r5, 0x5047}, {r0, 0x7040}, {r6}, {r0, 0x4160}], 0x9, 0x7ff) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r7, 0x1, 0x24, &(0x7f0000000280), 0x4) (async) setsockopt$sock_int(r7, 0x1, 0x24, &(0x7f0000000280), 0x4) socket$inet_tcp(0x2, 0x1, 0x0) (async) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x210000000013, &(0x7f0000000600)=0x100000001, 0x4) (async) setsockopt$inet_tcp_int(r8, 0x6, 0x210000000013, &(0x7f0000000600)=0x100000001, 0x4) bind$inet(r8, &(0x7f0000000640)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r5, &(0x7f0000000680)={0x2, 0x4ea4, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$sock_timeval(r8, 0x1, 0x43, &(0x7f00000006c0)={0x77359400}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r8, 0x6, 0x13, &(0x7f0000000700), 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR(r8, 0x6, 0x13, &(0x7f0000000700), 0x4) sendto$inet(r8, &(0x7f0000000740), 0xffffffffffffff94, 0xb, 0x0, 0x0) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) (async) r9 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) write(r9, &(0x7f00000003c0)='27', 0x2) r10 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0x418980, 0x0) ioctl$COMEDI_DEVCONFIG(r10, 0x40946400, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000001c0)={'ip6gretap0\x00'}) 409.741824ms ago: executing program 9 (id=4074): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000000a0000000900010073797a300000000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a310000000008000300060000050c0004"], 0x88}, 0x1, 0x0, 0x0, 0xa00}, 0x0) 404.420611ms ago: executing program 0 (id=4075): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050401000000000000f50a0000000900010073797a3000f5000040000000120a050402000000000000000a0000000900010073797a30000000000900020073797a310000000008000300060000050c0004"], 0x88}}, 0x0) 322.107082ms ago: executing program 9 (id=4076): mknodat$md(0xffffffffffffff9c, &(0x7f0000000980)='./md0\x00', 0x6180, 0x0) r0 = openat$md_node(0xffffffffffffff9c, &(0x7f00000009c0)='./md0\x00', 0x2, 0x0) ioctl$SET_ARRAY_INFO(r0, 0x40480923, &(0x7f0000000a00)={0x1, 0x1, 0x0, 0x40, 0x1, 0xb7e, 0x0, 0x3, 0x0, 0x1, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x11, 0x1000}) r1 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000000)={'/sys/block/md', @named={'_syz', 0x0, '1'}, '/md/', @array='sync_io_depth\x00'}, 0x1, 0x0) write$md_sysfs(r1, &(0x7f0000000040)=@str='y', 0x1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r4) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000000180)=0x0) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r6], 0x1c}}, 0x4008054) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nfc(&(0x7f00000002c0), r8) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000300)=0x0) sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r10], 0x1c}}, 0x4008054) sendmsg$NFC_CMD_LLC_SET_PARAMS(r2, &(0x7f00000004c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x12000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x64, 0x0, 0x20, 0x70bd27, 0x25dfdbfb, {}, [@NFC_ATTR_LLC_PARAM_LTO={0x5, 0xf, 0xb4}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_LLC_PARAM_LTO={0x5, 0xf, 0x8}, @NFC_ATTR_LLC_PARAM_RW={0x5}, @NFC_ATTR_LLC_PARAM_RW={0x5}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0xc}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r10}, @NFC_ATTR_LLC_PARAM_LTO={0x5, 0xf, 0xb5}, @NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x8c1) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f0000000a80)={0x3, {0x1, 0x1}, 0x1, 0x6}) ioctl$RUN_ARRAY(r0, 0x400c0930, 0x0) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f0000000080)={0x12, {0x1, 0x0}, 0x2, 0x40207}) 102.439019ms ago: executing program 0 (id=4077): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x11, 0x3, 0x0) setsockopt(r1, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg(r1, &(0x7f00000001c0)={&(0x7f0000000240)=@ll={0x11, 0x3, r2, 0x1, 0xe5, 0x6, @broadcast}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000300)="020195ff002d3922ff65b4355e953d23d254f087ff000000", 0x18}, {&(0x7f0000000340)="2cf2565b0e508224b706a643e98dc932f5fc6d8e51626cdbf9ff02dbb8b2d2ca2be0dfa8f2a777f680c590257a0641579678f72a6ff270a8989633cbe781bf372d4a0e61", 0xff87}], 0x2, 0x0, 0x0, 0x1fff0000}, 0x44000) 66.880599ms ago: executing program 0 (id=4078): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a1810039000000000b0018000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) 0s ago: executing program 0 (id=4079): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0xfffe, 0x4, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000140)=ANY=[], 0x8) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='bridge0\x00', 0x10) sendto$inet6(r1, &(0x7f00000001c0)="846bb66f", 0x4, 0xc, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./nfsd\x00', &(0x7f00000002c0)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0) write(r2, &(0x7f0000000340)='tcp 2', 0x5) kernel console output (not intermixed with test programs): y_hcd [ 496.039064][T16520] netlink: 'syz.9.3558': attribute type 10 has an invalid length. [ 496.039359][T16520] veth1_vlan: left allmulticast mode [ 496.081973][ T47] usb 4-1: Using ep0 maxpacket: 32 [ 496.083654][ T47] usb 4-1: New USB device found: idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 496.086906][ T47] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.086931][ T47] usb 4-1: Product: syz [ 496.086946][ T47] usb 4-1: Manufacturer: syz [ 496.086962][ T47] usb 4-1: SerialNumber: syz [ 496.091509][ T47] usb 4-1: config 0 descriptor?? [ 496.104665][ T47] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 496.276424][T16524] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3560'. [ 497.262224][ T5762] usb 9-1: new high-speed USB device number 69 using dummy_hcd [ 497.391874][ T5762] usb 9-1: device descriptor read/64, error -71 [ 497.633759][ T5762] usb 9-1: new high-speed USB device number 70 using dummy_hcd [ 497.762117][ T5762] usb 9-1: device descriptor read/64, error -71 [ 497.856305][ T47] gspca_ov534_9: reg_r err -32 [ 497.872423][ T5762] usb usb9-port1: attempt power cycle [ 498.112910][ T47] gspca_ov534_9: Unknown sensor 0000 [ 498.113013][ T47] ov534_9 4-1:0.0: probe with driver ov534_9 failed with error -22 [ 498.221924][ T5762] usb 9-1: new high-speed USB device number 71 using dummy_hcd [ 498.242628][ T5762] usb 9-1: device descriptor read/8, error -71 [ 498.331844][ T993] usb 10-1: new high-speed USB device number 64 using dummy_hcd [ 498.482060][ T5762] usb 9-1: new high-speed USB device number 72 using dummy_hcd [ 498.484910][ T993] usb 10-1: New USB device found: idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 498.491897][ T993] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.503552][ T5762] usb 9-1: device descriptor read/8, error -71 [ 498.528323][ T993] usb 10-1: config 0 descriptor?? [ 498.539445][ T993] cp210x 10-1:0.0: cp210x converter detected [ 498.612334][ T5762] usb usb9-port1: unable to enumerate USB device [ 498.757308][ T993] cp210x 10-1:0.0: failed to get vendor val 0x370b size 1: -32 [ 498.757430][ T993] cp210x 10-1:0.0: querying part number failed [ 498.781463][ T993] usb 10-1: cp210x converter now attached to ttyUSB0 [ 499.131965][ T993] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 499.303588][ T993] usb 1-1: Using ep0 maxpacket: 32 [ 499.306462][ T993] usb 1-1: New USB device found: idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 499.307765][ T993] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 499.307790][ T993] usb 1-1: config 0 has no interface number 0 [ 499.307827][ T993] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 499.310388][ T993] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.310403][ T993] usb 1-1: Product: syz [ 499.311429][ T993] usb 1-1: Manufacturer: syz [ 499.311441][ T993] usb 1-1: SerialNumber: syz [ 499.375880][ T993] usb 1-1: config 0 descriptor?? [ 499.379334][T16568] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 499.446862][ T5762] usb 4-1: USB disconnect, device number 66 [ 499.585392][T16568] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 499.861889][ T5762] usb 4-1: new full-speed USB device number 67 using dummy_hcd [ 500.013206][ T5762] usb 4-1: not running at top speed; connect to a high speed hub [ 500.013243][ T5762] usb 4-1: New USB device found: idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 500.014419][ T5762] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 500.016318][ T5762] usb 4-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 500.016342][ T5762] usb 4-1: Product: syz [ 500.016356][ T5762] usb 4-1: Manufacturer: syz [ 500.048294][ T5762] uvcvideo 4-1:1.0: Found UVC 1.00 device syz (225a:e1d4) [ 500.048481][ T5762] uvcvideo 4-1:1.0: No streaming interface found for terminal 32770. [ 500.200984][ T993] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 500.201284][ T993] asix 1-1:0.188: probe with driver asix failed with error -71 [ 500.229029][ T993] usb 1-1: USB disconnect, device number 55 [ 500.251469][ T5762] usb 4-1: USB disconnect, device number 67 [ 500.682280][ T47] usb 9-1: new full-speed USB device number 73 using dummy_hcd [ 500.769430][T16588] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3585'. [ 500.811851][ T47] usb 9-1: device descriptor read/64, error -71 [ 500.886181][T16591] dlm: no locking on control device [ 501.053283][ T47] usb 9-1: new full-speed USB device number 74 using dummy_hcd [ 501.155442][ T5762] usb 10-1: USB disconnect, device number 64 [ 501.178515][ T5762] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 501.179287][ T5762] cp210x 10-1:0.0: device disconnected [ 501.182226][ T47] usb 9-1: device descriptor read/64, error -71 [ 501.244422][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.244484][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.292283][ T47] usb usb9-port1: attempt power cycle [ 501.529776][T16606] FAULT_INJECTION: forcing a failure. [ 501.529776][T16606] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 501.529816][T16606] CPU: 1 UID: 0 PID: 16606 Comm: syz.9.3593 Tainted: G L syzkaller #0 PREEMPT(full) [ 501.529843][T16606] Tainted: [L]=SOFTLOCKUP [ 501.529851][T16606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 501.529863][T16606] Call Trace: [ 501.529871][T16606] [ 501.529879][T16606] dump_stack_lvl+0xe8/0x150 [ 501.529914][T16606] should_fail_ex+0x3eb/0x540 [ 501.529940][T16606] _copy_to_user+0x31/0xb0 [ 501.529965][T16606] simple_read_from_buffer+0xe1/0x170 [ 501.530121][T16606] proc_fail_nth_read+0x1bb/0x230 [ 501.530196][T16606] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 501.530219][T16606] ? rw_verify_area+0x24a/0x4c0 [ 501.530246][T16606] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 501.530264][T16606] vfs_read+0x213/0xa80 [ 501.530296][T16606] ? __pfx___mutex_lock+0x10/0x10 [ 501.530359][T16606] ? __pfx_vfs_read+0x10/0x10 [ 501.530386][T16606] ? __fget_files+0x2a/0x420 [ 501.530409][T16606] ? __fget_files+0x3a2/0x420 [ 501.530432][T16606] ? __fget_files+0x2a/0x420 [ 501.530459][T16606] ? fdget+0x1ac/0x250 [ 501.530490][T16606] ksys_read+0x150/0x270 [ 501.530518][T16606] ? __pfx_ksys_read+0x10/0x10 [ 501.530555][T16606] do_syscall_64+0x16a/0x530 [ 501.530580][T16606] ? trace_irq_disable+0x3b/0x140 [ 501.530604][T16606] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.530624][T16606] ? clear_bhb_loop+0x70/0xc0 [ 501.530649][T16606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.530669][T16606] RIP: 0033:0x7f3708b6974e [ 501.530687][T16606] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 501.530704][T16606] RSP: 002b:00007f3709a94fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 501.530726][T16606] RAX: ffffffffffffffda RBX: 00007f3709a956c0 RCX: 00007f3708b6974e [ 501.530740][T16606] RDX: 000000000000000f RSI: 00007f3709a950a0 RDI: 0000000000000004 [ 501.530751][T16606] RBP: 00007f3709a95090 R08: 0000000000000000 R09: 0000000000000000 [ 501.530763][T16606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 501.530775][T16606] R13: 00007f3708e26038 R14: 00007f3708e25fa0 R15: 00007ffc033cd968 [ 501.530813][T16606] [ 501.581898][ T4966] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 501.634123][ T47] usb 9-1: new full-speed USB device number 75 using dummy_hcd [ 501.659524][ T47] usb 9-1: device descriptor read/8, error -71 [ 501.735750][ T4966] usb 4-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 501.738140][ T4966] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 501.738174][ T4966] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 501.738194][ T4966] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 501.738238][ T4966] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 501.740064][ T4966] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 501.740087][ T4966] usb 4-1: Product: syz [ 501.740102][ T4966] usb 4-1: Manufacturer: syz [ 501.760115][ T4966] cdc_wdm 4-1:1.0: skipping garbage [ 501.760137][ T4966] cdc_wdm 4-1:1.0: skipping garbage [ 501.778661][ T4966] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 501.778779][ T4966] cdc_wdm 4-1:1.0: Unknown control protocol [ 501.892090][ T47] usb 9-1: new full-speed USB device number 76 using dummy_hcd [ 501.912812][ T47] usb 9-1: device descriptor read/8, error -71 [ 501.967867][ T5814] usb 4-1: USB disconnect, device number 68 [ 502.022291][ T47] usb usb9-port1: unable to enumerate USB device [ 502.185172][T16616] cgroup: name respecified [ 502.291871][ T5814] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 502.672282][ T1163] netdevsim netdevsim9 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.672331][ T1163] netdevsim netdevsim9 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.672366][ T1163] netdevsim netdevsim9 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.672399][ T1163] netdevsim netdevsim9 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 503.210127][T16641] syzkaller1: entered promiscuous mode [ 503.210150][T16641] syzkaller1: entered allmulticast mode [ 503.226897][T16643] netlink: 'syz.9.3605': attribute type 10 has an invalid length. [ 503.391172][T16647] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3607'. [ 503.861911][ T47] usb 9-1: new high-speed USB device number 77 using dummy_hcd [ 504.011845][ T47] usb 9-1: Using ep0 maxpacket: 16 [ 504.012959][ T47] usb 9-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 504.014401][ T47] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 504.014453][ T47] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 504.014481][ T47] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 504.014515][ T47] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 504.014539][ T47] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 504.016547][ T47] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 504.016571][ T47] usb 9-1: Manufacturer: syz [ 504.019333][ T47] usb 9-1: config 0 descriptor?? [ 504.092817][ T993] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 504.234797][ T993] usb 1-1: New USB device found: idVendor=2b73, idProduct=000a, bcdDevice=0.40 [ 504.239796][ T993] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.239824][ T993] usb 1-1: Product: syz [ 504.239838][ T993] usb 1-1: Manufacturer: syz [ 504.239853][ T993] usb 1-1: SerialNumber: syz [ 504.362047][ T47] rc_core: IR keymap rc-hauppauge not found [ 504.362067][ T47] Registered IR keymap rc-empty [ 504.362387][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.386110][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.405436][ T47] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0 [ 504.410181][ T47] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0/input70 [ 504.440703][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.453159][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.472125][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.491922][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.512202][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.531969][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.543310][ T993] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 504.556779][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.572031][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.594734][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.611938][ T47] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 504.635724][ T47] mceusb 9-1:0.0: Registered 42 with mce emulator interface version 1 [ 504.635751][ T47] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 504.687183][T16671] gadgetfs: bound to dummy_udc driver [ 504.763675][ T47] usb 9-1: USB disconnect, device number 77 [ 504.877239][ T993] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 504.891561][ T993] usb 1-1: USB disconnect, device number 56 [ 504.917686][T16676] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3618'. [ 504.933021][ T5814] usb 2-1: new full-speed USB device number 56 using dummy_hcd [ 504.933318][ C0] gadgetfs: connected [ 504.933895][ T5814] gadgetfs: disconnected [ 505.082379][ C0] gadgetfs: connected [ 505.083425][ T5814] usb 2-1: New USB device found: idVendor=0525, idProduct=a4a0, bcdDevice=1.00 [ 505.083768][ T5814] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 505.083804][ T5814] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 505.087375][ C0] gadgetfs: configuration #1 [ 505.274833][T16686] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3621'. [ 505.470527][T16669] gadgetfs: suspended from state 3 [ 505.471130][ T993] usb 2-1: USB disconnect, device number 56 [ 505.487002][T16669] gadgetfs: disconnected [ 506.112615][T16724] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3637'. [ 506.144066][T16723] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3636'. [ 506.144105][T16723] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3636'. [ 506.181060][T16723] netlink: 6012 bytes leftover after parsing attributes in process `syz.0.3636'. [ 506.492106][ T5814] usb 4-1: new full-speed USB device number 70 using dummy_hcd [ 506.622217][ T5814] usb 4-1: device descriptor read/64, error -71 [ 506.712394][ T4966] usb 10-1: new high-speed USB device number 65 using dummy_hcd [ 506.822327][T11146] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 506.862113][ T4966] usb 10-1: Using ep0 maxpacket: 16 [ 506.864433][ T4966] usb 10-1: New USB device found: idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 506.868444][ T4966] usb 10-1: config index 0 descriptor too short (expected 51443, got 18) [ 506.870354][ T4966] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 506.870377][ T4966] usb 10-1: Product: syz [ 506.870391][ T4966] usb 10-1: Manufacturer: syz [ 506.870406][ T4966] usb 10-1: SerialNumber: syz [ 506.877354][ T5814] usb 4-1: new full-speed USB device number 71 using dummy_hcd [ 506.883061][ T4966] r8152-cfgselector 10-1: Unknown version 0x0000 [ 506.883086][ T4966] r8152-cfgselector 10-1: config 0 descriptor?? [ 507.002879][T11146] usb 1-1: New USB device found: idVendor=1d50, idProduct=614d, bcdDevice=1.00 [ 507.003905][T11146] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 507.003952][T11146] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 507.003974][T11146] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 507.003997][T11146] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 507.004038][T11146] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.043709][ T5814] usb 4-1: device descriptor read/64, error -71 [ 507.152692][ T5814] usb usb4-port1: attempt power cycle [ 507.294514][ T993] r8152-cfgselector 10-1: USB disconnect, device number 65 [ 507.491909][ T5814] usb 4-1: new full-speed USB device number 72 using dummy_hcd [ 507.512611][ T5814] usb 4-1: device descriptor read/8, error -71 [ 507.527235][ T4966] usb 1-1: USB disconnect, device number 57 [ 507.751863][ T5814] usb 4-1: new full-speed USB device number 73 using dummy_hcd [ 507.772553][ T5814] usb 4-1: device descriptor read/8, error -71 [ 507.797353][T16772] netlink: 20 bytes leftover after parsing attributes in process `syz.8.3656'. [ 507.883831][ T5814] usb usb4-port1: unable to enumerate USB device [ 507.927062][T16777] syzkaller1: entered promiscuous mode [ 507.927087][T16777] syzkaller1: entered allmulticast mode [ 508.148949][T16783] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3660'. [ 508.671393][T16803] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3670'. [ 509.510539][T16830] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 509.894134][T16844] FAULT_INJECTION: forcing a failure. [ 509.894134][T16844] name failslab, interval 1, probability 5, space 0, times 42 [ 509.894173][T16844] CPU: 0 UID: 0 PID: 16844 Comm: syz.8.3685 Tainted: G L syzkaller #0 PREEMPT(full) [ 509.894203][T16844] Tainted: [L]=SOFTLOCKUP [ 509.894212][T16844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 509.894225][T16844] Call Trace: [ 509.894234][T16844] [ 509.894243][T16844] dump_stack_lvl+0xe8/0x150 [ 509.894281][T16844] should_fail_ex+0x3eb/0x540 [ 509.894310][T16844] should_failslab+0xa8/0x100 [ 509.894461][T16844] ? __kernfs_new_node+0xe6/0x980 [ 509.894512][T16844] kmem_cache_alloc_noprof+0x9c/0x600 [ 509.894577][T16844] ? __kernfs_new_node+0xe6/0x980 [ 509.894613][T16844] __kernfs_new_node+0xe6/0x980 [ 509.894645][T16844] ? __pfx___kernfs_new_node+0x10/0x10 [ 509.894668][T16844] ? kernfs_root+0x1c/0x230 [ 509.894696][T16844] ? kernfs_root+0x1c/0x230 [ 509.894716][T16844] ? kernfs_root+0x1c/0x230 [ 509.894734][T16844] ? kernfs_root+0x1c/0x230 [ 509.894759][T16844] kernfs_new_node+0xea/0x140 [ 509.894785][T16844] __kernfs_create_file+0x4b/0x2e0 [ 509.894814][T16844] sysfs_add_file_mode_ns+0x237/0x300 [ 509.894849][T16844] sysfs_merge_group+0x183/0x320 [ 509.894902][T16844] ? __pfx_sysfs_merge_group+0x10/0x10 [ 509.894922][T16844] ? device_add_attrs+0x5c5/0x600 [ 509.895044][T16844] ? __pfx_device_add_attrs+0x10/0x10 [ 509.895073][T16844] dpm_sysfs_add+0xd2/0x270 [ 509.895159][T16844] device_add+0x4ca/0xb80 [ 509.895185][T16844] hci_register_dev+0x38c/0x8e0 [ 509.895276][T16844] hci_uart_tty_ioctl+0x846/0xa80 [ 509.895362][T16844] ? __pfx_hci_uart_tty_ioctl+0x10/0x10 [ 509.895385][T16844] tty_ioctl+0x9bd/0xde0 [ 509.895484][T16844] ? __pfx_tty_ioctl+0x10/0x10 [ 509.895507][T16844] __se_sys_ioctl+0xfc/0x170 [ 509.895571][T16844] do_syscall_64+0x16a/0x530 [ 509.895609][T16844] ? trace_irq_disable+0x3b/0x140 [ 509.895636][T16844] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.895658][T16844] ? clear_bhb_loop+0x70/0xc0 [ 509.895682][T16844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.895702][T16844] RIP: 0033:0x7ffbf07a8f19 [ 509.895722][T16844] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 509.895741][T16844] RSP: 002b:00007ffbf16d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 509.895764][T16844] RAX: ffffffffffffffda RBX: 00007ffbf0a25fa0 RCX: 00007ffbf07a8f19 [ 509.895779][T16844] RDX: 0000000000000004 RSI: 00000000400455c8 RDI: 0000000000000007 [ 509.895793][T16844] RBP: 00007ffbf0837f6d R08: 0000000000000000 R09: 0000000000000000 [ 509.895808][T16844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 509.895821][T16844] R13: 00007ffbf0a26038 R14: 00007ffbf0a25fa0 R15: 00007fff06a45028 [ 509.895854][T16844] [ 509.973404][T16844] Bluetooth: Can't register HCI device [ 510.269532][T16855] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3689'. [ 510.441874][ T993] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 510.603584][ T993] usb 1-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 510.603626][ T993] usb 1-1: too many configurations: 87, using maximum allowed: 8 [ 510.659843][ T993] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.659872][ T993] usb 1-1: Product: syz [ 510.659888][ T993] usb 1-1: Manufacturer: syz [ 510.659902][ T993] usb 1-1: SerialNumber: syz [ 510.893291][ T993] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 510.893364][ T993] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 510.893386][ T993] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 510.941740][ T993] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -32 [ 512.402015][ T5762] usb 10-1: new high-speed USB device number 66 using dummy_hcd [ 512.552274][ T5762] usb 10-1: Using ep0 maxpacket: 16 [ 512.558535][ T5762] usb 10-1: New USB device found: idVendor=1d6b, idProduct=0101, bcdDevice=0.40 [ 512.559747][ T5762] usb 10-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 81, changing to 7 [ 512.563003][ T5762] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.563025][ T5762] usb 10-1: Product: ࠰ [ 512.563040][ T5762] usb 10-1: Manufacturer: ⫦굁᱒幈韔蛸喢໦踜▛块筐ﮁꦷ꬛拻լ䗑뙖菺鑰飋憐▢⇰痯䖺杢薒賬珟溎鷇䗑꪿깮ﻨ쁿䰽攙洯對﫨벋피∵黽컆娻촖킩姶퉐ߐ­厯몃걣쫴יִ믒ꮒⳐ흋ﺡ蟢羑쳕翇郖募㠵닎怗䙐໏ꕂꣻꭋ뿘县ẫ䬹覮굥 [ 512.563069][ T5762] usb 10-1: SerialNumber: 亲腌욳㓉ʭ䮧袺賿秹৳ꀯ佌浌皉Ꞔ꺿㕨ଁ콾ꭂᙂ頵᏿ﰻꞮ蜄묘䮷ࡅ梵ӕ묝ੌ颬㳾緟曯컖屼۠淴䊈䇎䓥凝諒列⃙ጡ秢ߕ⽖닾翖㚚䊨욽쮏㭒瘔ꪯ䣀瞮㞟횦聯嗬䛧ᆁ琝돧ﺃ铿ᅏେ䋡䡢粒Ꮈໆ㍊⽌蟘埨髙笥뼼햶鉢눇᱆ [ 512.578273][ T5762] usb 10-1: rejected 1 configuration due to insufficient available bus power [ 512.578300][ T5762] usb 10-1: no configuration chosen from 1 choice [ 513.047867][T16917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.048325][T16917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.488711][T11146] usb 1-1: USB disconnect, device number 58 [ 514.641700][T16931] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3714'. [ 514.865219][T16938] syzkaller1: entered promiscuous mode [ 514.865327][T16938] syzkaller1: entered allmulticast mode [ 515.201491][ T4966] usb 10-1: USB disconnect, device number 66 [ 515.292135][ T5762] usb 9-1: new high-speed USB device number 78 using dummy_hcd [ 515.454738][ T5762] usb 9-1: unable to get BOS descriptor or descriptor too short [ 515.454789][ T5762] usb 9-1: New USB device found: idVendor=2040, idProduct=721f, bcdDevice=f2.00 [ 515.460428][ T5762] usb 9-1: config 129 has an invalid interface number: 135 but max is 0 [ 515.460458][ T5762] usb 9-1: config 129 has an invalid interface number: 5 but max is 0 [ 515.460479][ T5762] usb 9-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 515.460502][ T5762] usb 9-1: config 129 has no interface number 0 [ 515.460519][ T5762] usb 9-1: config 129 has no interface number 1 [ 515.460573][ T5762] usb 9-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 515.460600][ T5762] usb 9-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 515.460636][ T5762] usb 9-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 515.460669][ T5762] usb 9-1: config 129 interface 135 has no altsetting 0 [ 515.460687][ T5762] usb 9-1: config 129 interface 5 has no altsetting 0 [ 515.477894][T16943] device-mapper: ioctl: only supply one of name or uuid, cmd(9) [ 515.486750][ T5762] usb 9-1: string descriptor 0 read error: -22 [ 515.486881][ T5762] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.555408][ T5762] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 515.555488][ T5762] usb 9-1: MIDIStreaming interface descriptor not found [ 515.711299][T16940] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3718'. [ 516.615722][T16977] tipc: Can't bind to reserved service type 2 [ 517.611856][ T5762] usb 10-1: new high-speed USB device number 67 using dummy_hcd [ 517.761921][ T5762] usb 10-1: Using ep0 maxpacket: 8 [ 517.762677][ T5762] usb 10-1: New USB device found: idVendor=05ac, idProduct=8102, bcdDevice=0.00 [ 517.763984][ T5762] usb 10-1: config 0 interface 0 has no altsetting 0 [ 517.764023][ T5762] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 517.768720][ T5762] usb 10-1: config 0 descriptor?? [ 518.010860][ T47] usb 9-1: USB disconnect, device number 78 [ 518.185422][T17011] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3750'. [ 518.237795][ T5762] input: HID 05ac:8102 as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/0003:05AC:8102.0029/input/input71 [ 518.315962][ T5762] apple 0003:05AC:8102.0029: input,hidraw0: USB HID v0.06 Joystick [HID 05ac:8102] on usb-dummy_hcd.9-1/input0 [ 518.576010][ T47] usb 9-1: new full-speed USB device number 79 using dummy_hcd [ 518.722743][ T47] usb 9-1: New USB device found: idVendor=041e, idProduct=3000, bcdDevice=0.40 [ 518.730016][ T47] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.730045][ T47] usb 9-1: Product: syz [ 518.730060][ T47] usb 9-1: Manufacturer: syz [ 518.730075][ T47] usb 9-1: SerialNumber: syz [ 518.778378][T17025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.781428][T17026] netlink: 'syz.3.3756': attribute type 10 has an invalid length. [ 518.781622][T17026] veth1_vlan: left allmulticast mode [ 518.784687][T17025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.815665][T17025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.816109][T17025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.817049][T17026] bond0: (slave macvlan1): Error -22 calling dev_set_mtu [ 518.838311][T17025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.849397][T17025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.994960][ T47] usb 9-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 518.995417][ T47] usb 9-1: unit 4 not found! [ 519.104296][ T47] usb 9-1: USB disconnect, device number 79 [ 519.484425][T17038] tmpfs: Bad value for 'mpol' [ 519.581907][ T47] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 519.733646][ T47] usb 4-1: Using ep0 maxpacket: 32 [ 519.737067][ T47] usb 4-1: New USB device found: idVendor=03f0, idProduct=6c17, bcdDevice=0.40 [ 519.741069][ T47] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 519.741098][ T47] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 519.741118][ T47] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 519.741169][ T47] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 519.741192][ T47] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 519.741217][ T47] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 519.741259][ T47] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.835513][ T47] usb 4-1: config 0 descriptor?? [ 520.048613][ T47] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 74 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 520.068390][ T47] usb 4-1: USB disconnect, device number 74 [ 520.086872][ T47] usblp0: removed [ 520.344238][T17052] netlink: 68 bytes leftover after parsing attributes in process `syz.8.3767'. [ 520.474058][ T5814] usb 10-1: USB disconnect, device number 67 [ 520.623221][T11146] usb 9-1: new high-speed USB device number 80 using dummy_hcd [ 520.636240][T17056] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 520.647729][T17057] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 520.766946][T11146] usb 9-1: device descriptor read/64, error -71 [ 520.834485][T16805] syz.8.3668 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 520.834526][T16805] CPU: 1 UID: 0 PID: 16805 Comm: syz.8.3668 Tainted: G L syzkaller #0 PREEMPT(full) [ 520.834553][T16805] Tainted: [L]=SOFTLOCKUP [ 520.834560][T16805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 520.834573][T16805] Call Trace: [ 520.834581][T16805] [ 520.834590][T16805] dump_stack_lvl+0xe8/0x150 [ 520.834625][T16805] dump_header+0xd3/0x4b0 [ 520.834687][T16805] oom_kill_process+0x3ab/0x9e0 [ 520.834804][T16805] out_of_memory+0xfb1/0x13b0 [ 520.834827][T16805] ? try_charge_memcg+0xbd9/0x1a90 [ 520.834899][T16805] ? __pfx_out_of_memory+0x10/0x10 [ 520.834921][T16805] ? do_raw_spin_unlock+0xf5/0x200 [ 520.834974][T16805] try_charge_memcg+0xc6b/0x1a90 [ 520.835012][T16805] ? __pfx_try_charge_memcg+0x10/0x10 [ 520.835030][T16805] ? lock_acquire+0x115/0x350 [ 520.835073][T16805] ? charge_memcg+0x47/0x310 [ 520.835134][T16805] charge_memcg+0x1dd/0x310 [ 520.835167][T16805] __mem_cgroup_charge+0x25/0x80 [ 520.835197][T16805] shmem_alloc_and_add_folio+0x7bb/0xf60 [ 520.835281][T16805] ? filemap_get_entry+0xcd/0x3f0 [ 520.835343][T16805] ? __pfx_filemap_get_entry+0x10/0x10 [ 520.835368][T16805] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 520.835412][T16805] shmem_get_folio_gfp+0x594/0x1330 [ 520.835459][T16805] shmem_write_begin+0x16c/0x330 [ 520.835493][T16805] generic_perform_write+0x2d5/0x8e0 [ 520.835535][T16805] ? __pfx_generic_perform_write+0x10/0x10 [ 520.835563][T16805] ? __mark_inode_dirty+0x4e7/0x13b0 [ 520.835632][T16805] ? mnt_put_write_access_file+0xc3/0x100 [ 520.835688][T16805] ? file_update_time_flags+0x3ab/0x440 [ 520.835745][T16805] shmem_file_write_iter+0xf8/0x120 [ 520.835782][T16805] __kernel_write_iter+0x44a/0x8f0 [ 520.835816][T16805] ? __pfx___kernel_write_iter+0x10/0x10 [ 520.835841][T16805] ? get_dump_page+0x1e6/0x410 [ 520.835902][T16805] ? __asan_memset+0x22/0x50 [ 520.835927][T16805] ? iov_iter_bvec+0xb8/0x180 [ 520.835953][T16805] dump_user_range+0x715/0xca0 [ 520.836022][T16805] ? __pfx_dump_user_range+0x10/0x10 [ 520.836060][T16805] ? __pfx_writenote+0x10/0x10 [ 520.836112][T16805] ? elf_core_dump+0x28d0/0x3a70 [ 520.836145][T16805] elf_core_dump+0x346a/0x3a70 [ 520.836191][T16805] ? __pfx_elf_core_dump+0x10/0x10 [ 520.836214][T16805] ? kasan_save_track+0x51/0x90 [ 520.836288][T16805] ? do_coredump+0x4efc/0x6ba0 [ 520.836308][T16805] ? vfs_coredump+0xac3/0x10c0 [ 520.836329][T16805] ? get_signal+0x11d1/0x1430 [ 520.836358][T16805] ? arch_do_signal_or_restart+0xbb/0x860 [ 520.836400][T16805] ? irqentry_exit+0x348/0x9b0 [ 520.836427][T16805] ? asm_exc_page_fault+0x26/0x30 [ 520.836499][T16805] ? lock_acquire+0x115/0x350 [ 520.836522][T16805] ? 0xffffffffff600000 [ 520.836557][T16805] do_coredump+0x6012/0x6ba0 [ 520.836612][T16805] ? __pfx_do_coredump+0x10/0x10 [ 520.836646][T16805] ? __lock_acquire+0x747/0x2de0 [ 520.836677][T16805] ? __lock_acquire+0x747/0x2de0 [ 520.836711][T16805] ? lock_acquire+0x115/0x350 [ 520.836737][T16805] ? lock_acquire+0x115/0x350 [ 520.836765][T16805] ? is_bpf_text_address+0x26/0x2b0 [ 520.836870][T16805] ? is_bpf_text_address+0x292/0x2b0 [ 520.836895][T16805] ? is_bpf_text_address+0x26/0x2b0 [ 520.836924][T16805] ? kernel_text_address+0xa5/0xe0 [ 520.836970][T16805] ? __kernel_text_address+0xd/0x30 [ 520.836990][T16805] ? unwind_get_return_address+0x4d/0x90 [ 520.837018][T16805] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 520.837039][T16805] ? arch_stack_walk+0xfb/0x150 [ 520.837072][T16805] ? stack_trace_save+0xa9/0x100 [ 520.837092][T16805] ? __pfx_stack_trace_save+0x10/0x10 [ 520.837111][T16805] ? __lock_acquire+0x747/0x2de0 [ 520.837133][T16805] ? stack_depot_save_flags+0x33/0x840 [ 520.837212][T16805] ? kasan_save_track+0x51/0x90 [ 520.837233][T16805] ? kasan_save_track+0x3f/0x90 [ 520.837279][T16805] ? __kasan_kmalloc+0x93/0xb0 [ 520.837298][T16805] ? __kmalloc_noprof+0x366/0x710 [ 520.837315][T16805] ? security_prepare_creds+0x52/0x360 [ 520.837412][T16805] ? prepare_creds+0x57d/0x820 [ 520.837428][T16805] ? vfs_coredump+0x28a/0x10c0 [ 520.837445][T16805] ? get_signal+0x11d1/0x1430 [ 520.837460][T16805] ? arch_do_signal_or_restart+0xbb/0x860 [ 520.837480][T16805] ? irqentry_exit+0x348/0x9b0 [ 520.837499][T16805] ? asm_exc_page_fault+0x26/0x30 [ 520.837539][T16805] ? __lock_acquire+0x747/0x2de0 [ 520.837581][T16805] ? do_raw_spin_lock+0x12b/0x2f0 [ 520.837614][T16805] ? _raw_spin_unlock_irq+0x23/0x50 [ 520.837676][T16805] vfs_coredump+0xac3/0x10c0 [ 520.837706][T16805] ? __pfx_vfs_coredump+0x10/0x10 [ 520.837748][T16805] ? _raw_spin_unlock_irq+0x23/0x50 [ 520.837770][T16805] get_signal+0x11d1/0x1430 [ 520.837805][T16805] arch_do_signal_or_restart+0xbb/0x860 [ 520.837828][T16805] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 520.837868][T16805] irqentry_exit+0x348/0x9b0 [ 520.837888][T16805] ? trace_irq_disable+0x3b/0x140 [ 520.837914][T16805] asm_exc_page_fault+0x26/0x30 [ 520.837930][T16805] RIP: 0033:0x7ffbf07a8f19 [ 520.837953][T16805] Code: Unable to access opcode bytes at 0x7ffbf07a8eef. [ 520.838022][T16805] RSP: 002b:00007ffbf16d6fd8 EFLAGS: 00010246 [ 520.838038][T16805] RAX: 0000000000000000 RBX: 00007ffbf0a25fa0 RCX: 00007ffbf07a8f19 [ 520.838050][T16805] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 520.838061][T16805] RBP: 00007ffbf0837f6d R08: 0000000000000000 R09: 0000000000000000 [ 520.838072][T16805] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 520.838083][T16805] R13: 00007ffbf0a26038 R14: 00007ffbf0a25fa0 R15: 00007fff06a45028 [ 520.838114][T16805] [ 520.908844][T16805] memory: usage 307200kB, limit 307200kB, failcnt 20297 [ 520.908864][T16805] memory+swap: usage 432016kB, limit 9007199254740988kB, failcnt 0 [ 520.908878][T16805] kmem: usage 41424kB, limit 9007199254740988kB, failcnt 0 [ 520.908891][T16805] Memory cgroup stats for /syz8: [ 520.909175][T16805] cache 271929344 [ 520.909185][T16805] rss 221184 [ 520.909192][T16805] rss_huge 0 [ 520.909199][T16805] shmem 271929344 [ 520.909206][T16805] mapped_file 134795264 [ 520.909213][T16805] dirty 0 [ 520.909220][T16805] writeback 0 [ 520.909227][T16805] workingset_refault_anon 107 [ 520.909234][T16805] workingset_refault_file 128 [ 520.909242][T16805] swap 127811584 [ 520.909249][T16805] swapcached 4096 [ 520.909256][T16805] pgpgin 171636 [ 520.909263][T16805] pgpgout 105703 [ 520.909270][T16805] pgfault 119585 [ 520.909277][T16805] pgmajfault 110 [ 520.909284][T16805] inactive_anon 53096448 [ 520.909291][T16805] active_anon 219058176 [ 520.909299][T16805] inactive_file 0 [ 520.909306][T16805] active_file 0 [ 520.909312][T16805] unevictable 0 [ 520.909319][T16805] hierarchical_memory_limit 314572800 [ 520.909327][T16805] hierarchical_memsw_limit 9223372036854771712 [ 520.909335][T16805] total_cache 271929344 [ 520.909343][T16805] total_rss 221184 [ 520.909350][T16805] total_rss_huge 0 [ 520.909364][T16805] total_shmem 271929344 [ 520.909372][T16805] total_mapped_file 134795264 [ 520.909379][T16805] total_dirty 0 [ 520.909386][T16805] total_writeback 0 [ 520.909393][T16805] total_workingset_refault_anon 107 [ 520.909401][T16805] total_workingset_refault_file 128 [ 520.909409][T16805] total_swap 127811584 [ 520.909416][T16805] total_swapcached 4096 [ 520.909423][T16805] total_pgpgin 171636 [ 520.909430][T16805] total_pgpgout 105703 [ 520.909438][T16805] total_pgfault 119585 [ 520.909445][T16805] total_pgmajfault 110 [ 520.909452][T16805] total_inactive_anon 53096448 [ 520.909460][T16805] total_active_anon 219058176 [ 520.909467][T16805] total_inactive_file 0 [ 520.909474][T16805] total_active_file 0 [ 520.909482][T16805] total_unevictable 0 [ 520.909489][T16805] anon_cost 0 [ 520.909496][T16805] file_cost 0 [ 520.909503][T16805] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz8,task_memcg=/syz8,task=syz.8.3668,pid=16804,uid=0 [ 520.912642][T16805] Memory cgroup out of memory: Killed process 16804 (syz.8.3668) total-vm:184316kB, anon-rss:0kB, file-rss:0kB, shmem-rss:130064kB, UID:0 pgtables:300kB oom_score_adj:1000 [ 521.033119][T11146] usb 9-1: new high-speed USB device number 81 using dummy_hcd [ 521.090570][T10948] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 521.090605][T10948] CPU: 0 UID: 0 PID: 10948 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 521.090632][T10948] Tainted: [L]=SOFTLOCKUP [ 521.090639][T10948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 521.090651][T10948] Call Trace: [ 521.090659][T10948] [ 521.090667][T10948] dump_stack_lvl+0xe8/0x150 [ 521.090701][T10948] dump_header+0xd3/0x4b0 [ 521.090733][T10948] oom_kill_process+0x3ab/0x9e0 [ 521.090763][T10948] out_of_memory+0xfb1/0x13b0 [ 521.090784][T10948] ? try_charge_memcg+0xbd9/0x1a90 [ 521.090816][T10948] ? __pfx_out_of_memory+0x10/0x10 [ 521.090837][T10948] ? do_raw_spin_unlock+0xf5/0x200 [ 521.090876][T10948] try_charge_memcg+0xc6b/0x1a90 [ 521.090914][T10948] ? __pfx_try_charge_memcg+0x10/0x10 [ 521.090954][T10948] ? charge_memcg+0x47/0x310 [ 521.090985][T10948] charge_memcg+0x1dd/0x310 [ 521.091016][T10948] __mem_cgroup_charge+0x25/0x80 [ 521.091044][T10948] filemap_add_folio+0x140/0x4e0 [ 521.091075][T10948] __filemap_get_folio_mpol+0x4fa/0xff0 [ 521.091108][T10948] filemap_fault+0x9db/0x12d0 [ 521.091146][T10948] ? __pfx_filemap_fault+0x10/0x10 [ 521.091171][T10948] ? __pfx_filemap_map_pages+0x10/0x10 [ 521.091198][T10948] ? lock_acquire+0x115/0x350 [ 521.091231][T10948] __do_fault+0x138/0x2a0 [ 521.091382][T10948] do_pte_missing+0x20c9/0x3520 [ 521.091416][T10948] ? handle_mm_fault+0xee/0x3080 [ 521.091449][T10948] handle_mm_fault+0x1847/0x3080 [ 521.091490][T10948] ? handle_mm_fault+0xee/0x3080 [ 521.091527][T10948] ? __pfx_handle_mm_fault+0x10/0x10 [ 521.091553][T10948] ? lock_vma_under_rcu+0x45a/0x500 [ 521.091607][T10948] do_user_addr_fault+0xb35/0x1480 [ 521.091642][T10948] ? trace_page_fault_user+0x84/0x1e0 [ 521.091666][T10948] exc_page_fault+0x6a/0xc0 [ 521.091694][T10948] asm_exc_page_fault+0x26/0x30 [ 521.091713][T10948] RIP: 0033:0x7ffbf066cfd1 [ 521.091733][T10948] Code: 85 65 0a 00 00 48 b8 db 34 b6 d7 82 de 1b 43 48 f7 a4 24 98 00 00 00 48 8b 05 e3 87 ee 00 48 69 8c 24 90 00 00 00 e8 03 00 00 <8b> 78 08 48 8b 44 24 18 48 c1 ea 12 4c 8b 0d dc 86 ee 00 48 01 d1 [ 521.091749][T10948] RSP: 002b:00007fff06a45390 EFLAGS: 00010206 [ 521.091767][T10948] RAX: 0000001b30c24000 RBX: 000000000000051f RCX: 000000000007f328 [ 521.091780][T10948] RDX: 0000000003dfdd59 RSI: 00007fff06a45420 RDI: 0000000000000001 [ 521.091793][T10948] RBP: 00007fff06a453cc R08: 000000000ec7a9d0 R09: 3fffffffffffffff [ 521.091807][T10948] R10: 4000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 521.091820][T10948] R13: 00000000000927c0 R14: 000000000007f284 R15: 00007fff06a45420 [ 521.091852][T10948] [ 521.155032][T10948] memory: usage 307200kB, limit 307200kB, failcnt 20348 [ 521.155055][T10948] memory+swap: usage 432016kB, limit 9007199254740988kB, failcnt 0 [ 521.155069][T10948] kmem: usage 41424kB, limit 9007199254740988kB, failcnt 0 [ 521.155082][T10948] Memory cgroup stats for /syz8: [ 521.155309][T10948] cache 271929344 [ 521.155318][T10948] rss 221184 [ 521.155325][T10948] rss_huge 0 [ 521.155332][T10948] shmem 271929344 [ 521.155345][T10948] mapped_file 134795264 [ 521.155353][T10948] dirty 0 [ 521.155359][T10948] writeback 0 [ 521.155366][T10948] workingset_refault_anon 107 [ 521.155374][T10948] workingset_refault_file 128 [ 521.155382][T10948] swap 127811584 [ 521.155389][T10948] swapcached 4096 [ 521.155396][T10948] pgpgin 171636 [ 521.155402][T10948] pgpgout 105703 [ 521.155409][T10948] pgfault 119585 [ 521.155417][T10948] pgmajfault 110 [ 521.155423][T10948] inactive_anon 53096448 [ 521.155430][T10948] active_anon 219058176 [ 521.155438][T10948] inactive_file 0 [ 521.155445][T10948] active_file 0 [ 521.155452][T10948] unevictable 0 [ 521.155458][T10948] hierarchical_memory_limit 314572800 [ 521.155466][T10948] hierarchical_memsw_limit 9223372036854771712 [ 521.155474][T10948] total_cache 271929344 [ 521.155482][T10948] total_rss 221184 [ 521.155490][T10948] total_rss_huge 0 [ 521.155497][T10948] total_shmem 271929344 [ 521.155504][T10948] total_mapped_file 134795264 [ 521.155511][T10948] total_dirty 0 [ 521.155519][T10948] total_writeback 0 [ 521.155526][T10948] total_workingset_refault_anon 107 [ 521.155534][T10948] total_workingset_refault_file 128 [ 521.155542][T10948] total_swap 127811584 [ 521.155549][T10948] total_swapcached 4096 [ 521.155555][T10948] total_pgpgin 171636 [ 521.155561][T10948] total_pgpgout 105703 [ 521.155567][T10948] total_pgfault 119585 [ 521.155573][T10948] total_pgmajfault 110 [ 521.155579][T10948] total_inactive_anon 53096448 [ 521.155585][T10948] total_active_anon 219058176 [ 521.155591][T10948] total_inactive_file 0 [ 521.155598][T10948] total_active_file 0 [ 521.155604][T10948] total_unevictable 0 [ 521.155610][T10948] anon_cost 0 [ 521.155616][T10948] file_cost 0 [ 521.155623][T10948] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz8,task_memcg=/syz8,task=syz.8.3668,pid=16805,uid=0 [ 521.158396][T10948] Memory cgroup out of memory: Killed process 16805 (syz.8.3668) total-vm:184316kB, anon-rss:0kB, file-rss:0kB, shmem-rss:130048kB, UID:0 pgtables:300kB oom_score_adj:1000 [ 521.183366][T11146] usb 9-1: device descriptor read/64, error -71 [ 521.243793][T17076] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3777'. [ 521.269009][T10948] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 521.269044][T10948] CPU: 0 UID: 0 PID: 10948 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 521.269070][T10948] Tainted: [L]=SOFTLOCKUP [ 521.269077][T10948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 521.269089][T10948] Call Trace: [ 521.269096][T10948] [ 521.269105][T10948] dump_stack_lvl+0xe8/0x150 [ 521.269138][T10948] dump_header+0xd3/0x4b0 [ 521.269169][T10948] oom_kill_process+0x3ab/0x9e0 [ 521.269198][T10948] out_of_memory+0xfb1/0x13b0 [ 521.269219][T10948] ? try_charge_memcg+0xbd9/0x1a90 [ 521.269251][T10948] ? __pfx_out_of_memory+0x10/0x10 [ 521.269272][T10948] ? do_raw_spin_unlock+0xf5/0x200 [ 521.269311][T10948] try_charge_memcg+0xc6b/0x1a90 [ 521.269356][T10948] ? __pfx_try_charge_memcg+0x10/0x10 [ 521.269394][T10948] ? charge_memcg+0x47/0x310 [ 521.269427][T10948] charge_memcg+0x1dd/0x310 [ 521.269457][T10948] __mem_cgroup_charge+0x25/0x80 [ 521.269486][T10948] filemap_add_folio+0x140/0x4e0 [ 521.269514][T10948] __filemap_get_folio_mpol+0x4fa/0xff0 [ 521.269548][T10948] filemap_fault+0x9db/0x12d0 [ 521.269582][T10948] ? __pfx_filemap_fault+0x10/0x10 [ 521.269606][T10948] ? __pfx_filemap_map_pages+0x10/0x10 [ 521.269633][T10948] ? lock_acquire+0x115/0x350 [ 521.269666][T10948] __do_fault+0x138/0x2a0 [ 521.269692][T10948] do_pte_missing+0x20c9/0x3520 [ 521.269727][T10948] ? handle_mm_fault+0xee/0x3080 [ 521.269760][T10948] handle_mm_fault+0x1847/0x3080 [ 521.269802][T10948] ? handle_mm_fault+0xee/0x3080 [ 521.269838][T10948] ? __pfx_handle_mm_fault+0x10/0x10 [ 521.269864][T10948] ? lock_vma_under_rcu+0x45a/0x500 [ 521.269917][T10948] do_user_addr_fault+0xb35/0x1480 [ 521.269951][T10948] ? trace_page_fault_user+0x84/0x1e0 [ 521.269975][T10948] exc_page_fault+0x6a/0xc0 [ 521.270002][T10948] asm_exc_page_fault+0x26/0x30 [ 521.270020][T10948] RIP: 0033:0x7ffbf066cfd1 [ 521.270040][T10948] Code: 85 65 0a 00 00 48 b8 db 34 b6 d7 82 de 1b 43 48 f7 a4 24 98 00 00 00 48 8b 05 e3 87 ee 00 48 69 8c 24 90 00 00 00 e8 03 00 00 <8b> 78 08 48 8b 44 24 18 48 c1 ea 12 4c 8b 0d dc 86 ee 00 48 01 d1 [ 521.270056][T10948] RSP: 002b:00007fff06a45390 EFLAGS: 00010206 [ 521.270074][T10948] RAX: 0000001b30c24000 RBX: 000000000000051f RCX: 000000000007f328 [ 521.270087][T10948] RDX: 0000000003dfdd59 RSI: 00007fff06a45420 RDI: 0000000000000001 [ 521.270100][T10948] RBP: 00007fff06a453cc R08: 000000000ec7a9d0 R09: 3fffffffffffffff [ 521.270113][T10948] R10: 4000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 521.270127][T10948] R13: 00000000000927c0 R14: 000000000007f284 R15: 00007fff06a45420 [ 521.270158][T10948] [ 521.286775][T10948] memory: usage 307200kB, limit 307200kB, failcnt 20382 [ 521.286795][T10948] memory+swap: usage 432016kB, limit 9007199254740988kB, failcnt 0 [ 521.286808][T10948] kmem: usage 41424kB, limit 9007199254740988kB, failcnt 0 [ 521.286821][T10948] Memory cgroup stats for /syz8: [ 521.286948][T10948] cache 271929344 [ 521.286958][T10948] rss 221184 [ 521.286965][T10948] rss_huge 0 [ 521.286972][T10948] shmem 271929344 [ 521.286979][T10948] mapped_file 128000000 [ 521.286986][T10948] dirty 0 [ 521.286993][T10948] writeback 0 [ 521.287000][T10948] workingset_refault_anon 107 [ 521.287007][T10948] workingset_refault_file 128 [ 521.287014][T10948] swap 127811584 [ 521.287021][T10948] swapcached 4096 [ 521.287028][T10948] pgpgin 171636 [ 521.287035][T10948] pgpgout 105703 [ 521.287042][T10948] pgfault 119585 [ 521.287048][T10948] pgmajfault 110 [ 521.287054][T10948] inactive_anon 53096448 [ 521.287062][T10948] active_anon 219058176 [ 521.287069][T10948] inactive_file 0 [ 521.287076][T10948] active_file 0 [ 521.287083][T10948] unevictable 0 [ 521.287090][T10948] hierarchical_memory_limit 314572800 [ 521.287097][T10948] hierarchical_memsw_limit 9223372036854771712 [ 521.287106][T10948] total_cache 271929344 [ 521.287113][T10948] total_rss 221184 [ 521.287120][T10948] total_rss_huge 0 [ 521.287127][T10948] total_shmem 271929344 [ 521.287134][T10948] total_mapped_file 128000000 [ 521.287142][T10948] total_dirty 0 [ 521.287148][T10948] total_writeback 0 [ 521.287155][T10948] total_workingset_refault_anon 107 [ 521.287163][T10948] total_workingset_refault_file 128 [ 521.287171][T10948] total_swap 127811584 [ 521.287178][T10948] total_swapcached 4096 [ 521.287185][T10948] total_pgpgin 171636 [ 521.287193][T10948] total_pgpgout 105703 [ 521.287200][T10948] total_pgfault 119585 [ 521.287207][T10948] total_pgmajfault 110 [ 521.287215][T10948] total_inactive_anon 53096448 [ 521.287222][T10948] total_active_anon 219058176 [ 521.287230][T10948] total_inactive_file 0 [ 521.287237][T10948] total_active_file 0 [ 521.287243][T10948] total_unevictable 0 [ 521.287250][T10948] anon_cost 0 [ 521.287257][T10948] file_cost 0 [ 521.287265][T10948] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz8,task_memcg=/syz8,task=syz.8.3767,pid=17051,uid=0 [ 521.287389][T10948] Memory cgroup out of memory: Killed process 17051 (syz.8.3767) total-vm:102288kB, anon-rss:1464kB, file-rss:23516kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 521.302310][T11146] usb usb9-port1: attempt power cycle [ 521.352688][ T993] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 521.534079][ T993] usb 4-1: Using ep0 maxpacket: 16 [ 521.542990][ T993] usb 4-1: unable to get BOS descriptor or descriptor too short [ 521.543040][ T993] usb 4-1: New USB device found: idVendor=1235, idProduct=0018, bcdDevice=0.40 [ 521.572402][ T993] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.572430][ T993] usb 4-1: Product: syz [ 521.572444][ T993] usb 4-1: Manufacturer: syz [ 521.572458][ T993] usb 4-1: SerialNumber: syz [ 521.761488][T17084] syzkaller1: entered promiscuous mode [ 521.761532][T17084] syzkaller1: entered allmulticast mode [ 522.604068][ T993] usb 4-1: selecting invalid altsetting 1 [ 523.023619][ T993] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 523.028840][ T993] usb 4-1: USB disconnect, device number 75 [ 523.339376][T17117] overlay: Unknown parameter 'mask' [ 523.349545][T17117] CacheFiles: Failed to register: -95 [ 524.655158][T13802] Bluetooth: hci2: unexpected event for opcode 0x041c [ 524.677964][T17165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.678415][T17165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.912987][ T993] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 525.064362][ T993] usb 4-1: unable to get BOS descriptor or descriptor too short [ 525.064413][ T993] usb 4-1: New USB device found: idVendor=0bfd, idProduct=0112, bcdDevice=bb.9e [ 525.068437][ T993] usb 4-1: config 4 has an invalid interface number: 12 but max is 0 [ 525.068472][ T993] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 525.068491][ T993] usb 4-1: config 4 has no interface number 0 [ 525.068529][ T993] usb 4-1: config 4 interface 12 altsetting 2 endpoint 0x2 has invalid wMaxPacketSize 0 [ 525.070404][ T993] usb 4-1: config 4 interface 12 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 525.070435][ T993] usb 4-1: config 4 interface 12 has no altsetting 0 [ 525.086014][ T993] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.086043][ T993] usb 4-1: Product: syz [ 525.086058][ T993] usb 4-1: Manufacturer: syz [ 525.086072][ T993] usb 4-1: SerialNumber: syz [ 525.212665][ T47] usb 9-1: new high-speed USB device number 83 using dummy_hcd [ 525.305515][ T993] kvaser_usb 4-1:4.12: error -ENODEV: Cannot get usb endpoint(s) [ 525.319972][ T993] usb 4-1: USB disconnect, device number 76 [ 525.362774][ T47] usb 9-1: New USB device found: idVendor=05ac, idProduct=027a, bcdDevice=0.40 [ 525.363814][ T47] usb 9-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 525.363842][ T47] usb 9-1: config 1 interface 0 has no altsetting 0 [ 525.396380][ T47] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.396406][ T47] usb 9-1: Product: ＊ᨙ諉⪳⡌쳙怞龮噏㵯ꏶ癎䃓菗蟨뱇嘇㊓佟杭閣浍䵁棽⹥꺪扠畟ꜱꕡ聎⬒№㗁뤥雛㍢遏퍄ᯒ⽑⠕䅋ꛛ勒蛦뙵᪺햍饋ᑽ䱎뭽昜掂䃳먝놑譒쓃단홶ㅦ䠍뇲폭湏萍⏑둦睢ታ㽡┝˓荦먴爿䰐్␇ճ抵ݙᇻ䂐㾼鿘포횻꼱苧됚曧͘⫖㸶쑭빻ܳ뚋궳硝㻞 [ 525.396438][ T47] usb 9-1: Manufacturer: ఇ [ 525.396452][ T47] usb 9-1: SerialNumber: ࡡ [ 525.601836][T17184] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3819'. [ 526.103730][ T47] usbhid 9-1:1.0: can't add hid device: -71 [ 526.103830][ T47] usbhid 9-1:1.0: probe with driver usbhid failed with error -71 [ 526.109019][ T47] usb 9-1: USB disconnect, device number 83 [ 526.184281][ T4954] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 526.197119][ T4954] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 526.208605][ T4954] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 526.227220][ T4954] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 526.227844][ T4954] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 526.390099][T17199] netlink: 88 bytes leftover after parsing attributes in process `syz.3.3825'. [ 526.547665][T17203] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3826'. [ 526.952806][T17218] netlink: 'syz.3.3831': attribute type 10 has an invalid length. [ 526.953031][T17218] bond0: (slave macvlan1): Error -22 calling dev_set_mtu [ 527.403678][T17190] rxe_eth0 speed is unknown, defaulting to 1000 [ 527.617653][T17244] fuse: Unknown parameter '00000000000000000000004' [ 527.795957][T17248] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 527.809400][T17248] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 528.042302][T11146] usb 9-1: new high-speed USB device number 84 using dummy_hcd [ 528.096329][T17258] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3849'. [ 528.193858][T11146] usb 9-1: New USB device found: idVendor=0846, idProduct=1001, bcdDevice=1.00 [ 528.196305][T11146] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 528.209884][T11146] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.209910][T11146] usb 9-1: Product: syz [ 528.209924][T11146] usb 9-1: Manufacturer: syz [ 528.209938][T11146] usb 9-1: SerialNumber: syz [ 528.228853][T11146] kaweth 9-1:1.0: couldn't find required endpoints [ 528.282444][T13802] Bluetooth: hci4: command tx timeout [ 528.464574][T17269] syzkaller1: entered promiscuous mode [ 528.464599][T17269] syzkaller1: entered allmulticast mode [ 528.776835][T17190] bridge0: port 1(bridge_slave_0) entered blocking state [ 528.777007][T17190] bridge0: port 1(bridge_slave_0) entered disabled state [ 528.777156][T17190] bridge_slave_0: entered allmulticast mode [ 528.778881][T17190] bridge_slave_0: entered promiscuous mode [ 528.811355][T17190] bridge0: port 2(bridge_slave_1) entered blocking state [ 528.811530][T17190] bridge0: port 2(bridge_slave_1) entered disabled state [ 528.811661][T17190] bridge_slave_1: entered allmulticast mode [ 528.824183][T17279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 528.830061][T17279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.831733][T17279] 9pnet_virtio: no channels available for device ./file0 [ 528.838530][T17279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 528.843921][T17279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.866582][T17190] bridge_slave_1: entered promiscuous mode [ 528.932094][T17190] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 528.935452][T17190] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 528.971033][T17190] team0: Port device team_slave_0 added [ 528.975029][T17190] team0: Port device team_slave_1 added [ 529.009164][T17190] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 529.009183][T17190] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 529.009208][T17190] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 529.011518][T17190] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 529.011593][T17190] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 529.011619][T17190] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 529.069623][T17190] hsr_slave_0: entered promiscuous mode [ 529.070700][T17190] hsr_slave_1: entered promiscuous mode [ 529.071520][T17190] debugfs: 'hsr0' already exists in 'hsr' [ 529.071535][T17190] Cannot create hsr debugfs directory [ 529.141984][ T4966] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 529.293690][ T4966] usb 4-1: New USB device found: idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 529.299116][ T4966] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.299142][ T4966] usb 4-1: Product: syz [ 529.299157][ T4966] usb 4-1: Manufacturer: syz [ 529.299172][ T4966] usb 4-1: SerialNumber: syz [ 529.318024][ T4966] usb 4-1: config 0 descriptor?? [ 529.478606][T17190] netdevsim netdevsim9 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 529.478643][T17190] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.527655][T17286] FAULT_INJECTION: forcing a failure. [ 529.527655][T17286] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 529.527677][T17286] CPU: 1 UID: 0 PID: 17286 Comm: syz.0.3857 Tainted: G L syzkaller #0 PREEMPT(full) [ 529.527694][T17286] Tainted: [L]=SOFTLOCKUP [ 529.527698][T17286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 529.527705][T17286] Call Trace: [ 529.527709][T17286] [ 529.527714][T17286] dump_stack_lvl+0xe8/0x150 [ 529.527739][T17286] should_fail_ex+0x3eb/0x540 [ 529.527773][T17286] _copy_from_user+0x2d/0xb0 [ 529.527795][T17286] ___sys_recvmsg+0x173/0x5a0 [ 529.527825][T17286] ? __pfx____sys_recvmsg+0x10/0x10 [ 529.527848][T17286] ? lock_acquire+0x115/0x350 [ 529.527868][T17286] ? __fget_files+0x2a/0x420 [ 529.527881][T17286] ? __fget_files+0x3a2/0x420 [ 529.527894][T17286] ? __fget_files+0x2a/0x420 [ 529.527908][T17286] ? fdget+0x1ac/0x250 [ 529.527922][T17286] do_recvmmsg+0x31a/0x800 [ 529.527941][T17286] ? __pfx_do_recvmmsg+0x10/0x10 [ 529.527960][T17286] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 529.527979][T17286] ? fdget+0x1ac/0x250 [ 529.527995][T17286] __x64_sys_recvmmsg+0x198/0x250 [ 529.528011][T17286] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 529.528030][T17286] do_syscall_64+0x16a/0x530 [ 529.528046][T17286] ? trace_irq_disable+0x3b/0x140 [ 529.528060][T17286] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.528071][T17286] ? clear_bhb_loop+0x70/0xc0 [ 529.528083][T17286] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.528094][T17286] RIP: 0033:0x7ff6bc3a8f19 [ 529.528105][T17286] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 529.528114][T17286] RSP: 002b:00007ff6bd2aa028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 529.528126][T17286] RAX: ffffffffffffffda RBX: 00007ff6bc626090 RCX: 00007ff6bc3a8f19 [ 529.528133][T17286] RDX: 0000000000000003 RSI: 00002000000001c0 RDI: 0000000000000003 [ 529.528140][T17286] RBP: 00007ff6bd2aa090 R08: 0000000000000000 R09: 0000000000000000 [ 529.528147][T17286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 529.528153][T17286] R13: 00007ff6bc626128 R14: 00007ff6bc626090 R15: 00007fffc082c8b8 [ 529.528170][T17286] [ 529.757821][ T4966] usb 4-1: Firmware version (0.0) predates our first public release. [ 529.757847][ T4966] usb 4-1: Please update to version 0.2 or newer [ 529.760539][T17281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 529.761676][T17281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 529.764597][ T4966] usb 4-1: Firmware: build [ 529.872441][T17190] netdevsim netdevsim9 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 529.872465][T17190] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.996949][T17190] netdevsim netdevsim9 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 529.997004][T17190] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.032005][ T4966] usb 4-1: USB disconnect, device number 77 [ 530.153463][T17190] netdevsim netdevsim9 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 530.153500][T17190] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.363021][T13802] Bluetooth: hci4: command tx timeout [ 530.516414][T17190] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 530.528071][T17190] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 530.529270][T17190] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 530.549988][T17190] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 530.559149][T17190] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 530.575142][T17190] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 530.580359][T17190] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 530.611013][T17190] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 530.854477][ T5762] usb 9-1: USB disconnect, device number 84 [ 530.861442][T17190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 530.908234][T17190] 8021q: adding VLAN 0 to HW filter on device team0 [ 530.932272][ T86] bridge0: port 1(bridge_slave_0) entered blocking state [ 530.932381][ T86] bridge0: port 1(bridge_slave_0) entered forwarding state [ 530.954052][ T86] bridge0: port 2(bridge_slave_1) entered blocking state [ 530.954172][ T86] bridge0: port 2(bridge_slave_1) entered forwarding state [ 531.145161][T17322] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3867'. [ 531.332384][ T5762] usb 9-1: new high-speed USB device number 85 using dummy_hcd [ 531.486197][ T5762] usb 9-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 531.487232][ T5762] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 531.487278][ T5762] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.491217][ T5762] usb 9-1: config 0 descriptor?? [ 531.503384][ T5762] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 531.526073][T11146] usb 4-1: new full-speed USB device number 78 using dummy_hcd [ 531.694413][T11146] usb 4-1: unable to get BOS descriptor or descriptor too short [ 531.694917][T11146] usb 4-1: not running at top speed; connect to a high speed hub [ 531.694949][T11146] usb 4-1: New USB device found: idVendor=8086, idProduct=0ad2, bcdDevice=0.00 [ 531.697368][T11146] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 531.697392][T11146] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 531.697434][T11146] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 531.767088][T11146] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 531.767118][T11146] usb 4-1: Product: syz [ 531.767132][T11146] usb 4-1: Manufacturer: syz [ 531.791462][T17319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 531.808634][T17319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 531.810371][T11146] uvcvideo 4-1:1.0: Found UVC 1.00 device syz (8086:0ad2) [ 531.810487][T11146] uvcvideo 4-1:1.0: No streaming interface found for terminal 32770. [ 531.955377][T17190] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 531.990234][ T5754] usb 9-1: USB disconnect, device number 85 [ 532.180735][ T5814] usb 4-1: USB disconnect, device number 78 [ 532.442550][T13802] Bluetooth: hci4: command tx timeout [ 532.493529][T17190] veth0_vlan: entered promiscuous mode [ 532.501665][T17190] veth1_vlan: entered promiscuous mode [ 532.563216][T17190] veth0_macvtap: entered promiscuous mode [ 532.568440][T17190] veth1_macvtap: entered promiscuous mode [ 532.599726][T17190] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 532.615750][T17190] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 532.724201][ T13] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.752975][T12090] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.753016][T12090] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.753043][T12090] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.888687][T12090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 532.888709][T12090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 533.008434][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 533.008455][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 533.685309][T17392] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3885'. [ 534.522136][T13802] Bluetooth: hci4: command tx timeout [ 534.602037][ T993] usb 10-1: new high-speed USB device number 68 using dummy_hcd [ 534.751869][ T993] usb 10-1: Using ep0 maxpacket: 32 [ 534.754276][ T993] usb 10-1: unable to get BOS descriptor or descriptor too short [ 534.754329][ T993] usb 10-1: New USB device found: idVendor=1199, idProduct=0224, bcdDevice=a4.0d [ 534.755562][ T993] usb 10-1: config 129 has an invalid interface number: 6 but max is 0 [ 534.755587][ T993] usb 10-1: config 129 has no interface number 0 [ 534.755632][ T993] usb 10-1: config 129 interface 6 altsetting 0 endpoint 0x9 has invalid maxpacket 1024, setting to 64 [ 534.757619][ T993] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.757644][ T993] usb 10-1: Product: syz [ 534.757658][ T993] usb 10-1: Manufacturer: syz [ 534.757672][ T993] usb 10-1: SerialNumber: syz [ 535.151238][ T993] hub 10-1:129.6: bad descriptor, ignoring hub [ 535.151268][ T993] hub 10-1:129.6: probe with driver hub failed with error -5 [ 535.168554][ T993] sierra 10-1:129.6: Sierra USB modem converter detected [ 535.199140][ T993] usb 10-1: Sierra USB modem converter now attached to ttyUSB0 [ 535.213048][ T993] usb 10-1: Sierra USB modem converter now attached to ttyUSB1 [ 535.253394][ T993] usb 10-1: USB disconnect, device number 68 [ 535.261685][ T993] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 535.282329][ T993] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 535.283009][ T993] sierra 10-1:129.6: device disconnected [ 535.463167][T17439] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3904'. [ 536.679240][T17466] netlink: 'syz.9.3912': attribute type 10 has an invalid length. [ 536.681577][T17466] macvlan1: entered promiscuous mode [ 536.681601][T17466] macvlan1: entered allmulticast mode [ 536.713440][T17466] veth1_vlan: entered allmulticast mode [ 536.718558][T17466] bond0: (slave macvlan1): Enslaving as an active interface with an up link [ 537.120571][ T4954] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 537.140209][ T4954] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 537.161482][ T4954] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 537.174081][ T4954] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 537.174724][ T4954] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 537.433925][T17489] FAULT_INJECTION: forcing a failure. [ 537.433925][T17489] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 537.433961][T17489] CPU: 0 UID: 0 PID: 17489 Comm: syz.9.3922 Tainted: G L syzkaller #0 PREEMPT(full) [ 537.433991][T17489] Tainted: [L]=SOFTLOCKUP [ 537.433999][T17489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 537.434012][T17489] Call Trace: [ 537.434020][T17489] [ 537.434030][T17489] dump_stack_lvl+0xe8/0x150 [ 537.434069][T17489] should_fail_ex+0x3eb/0x540 [ 537.434097][T17489] prepare_alloc_pages+0x21e/0x5f0 [ 537.434226][T17489] __alloc_frozen_pages_noprof+0x189/0x450 [ 537.434261][T17489] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 537.434288][T17489] ? __alloc_frozen_pages_noprof+0x274/0x450 [ 537.434322][T17489] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 537.434360][T17489] __alloc_pages_noprof+0x10/0x100 [ 537.434389][T17489] alloc_pages_bulk_noprof+0x6df/0x8f0 [ 537.434419][T17489] ? alloc_pages_mpol+0x256/0x390 [ 537.434511][T17489] ? alloc_pages_noprof+0x140/0x2b0 [ 537.434547][T17489] __kasan_populate_vmalloc+0xb7/0x1c0 [ 537.434582][T17489] alloc_vmap_area+0xd10/0x1410 [ 537.434643][T17489] ? __pfx_alloc_vmap_area+0x10/0x10 [ 537.434663][T17489] ? __kmalloc_cache_node_noprof+0x3cc/0x620 [ 537.434689][T17489] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 537.434715][T17489] ? __get_vm_area_node+0x155/0x2f0 [ 537.434742][T17489] __get_vm_area_node+0x200/0x2f0 [ 537.434771][T17489] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 537.434796][T17489] ? write_ldt+0x4f7/0x930 [ 537.434858][T17489] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 537.434883][T17489] ? __kasan_kmalloc+0x93/0xb0 [ 537.434913][T17489] ? __kmalloc_cache_noprof+0x31c/0x600 [ 537.434941][T17489] ? write_ldt+0x4f7/0x930 [ 537.434966][T17489] __vmalloc_noprof+0xd2/0x120 [ 537.434988][T17489] ? write_ldt+0x4f7/0x930 [ 537.435017][T17489] write_ldt+0x4f7/0x930 [ 537.435043][T17489] ? __se_sys_futex+0x3a8/0x450 [ 537.435102][T17489] ? __pfx_write_ldt+0x10/0x10 [ 537.435136][T17489] ? rcu_is_watching+0x16/0xb0 [ 537.435173][T17489] __se_sys_modify_ldt+0x6c/0x310 [ 537.435204][T17489] do_syscall_64+0x16a/0x530 [ 537.435234][T17489] ? trace_irq_disable+0x3b/0x140 [ 537.435260][T17489] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.435283][T17489] ? clear_bhb_loop+0x70/0xc0 [ 537.435309][T17489] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.435331][T17489] RIP: 0033:0x7f88d87a8f19 [ 537.435351][T17489] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 537.435370][T17489] RSP: 002b:00007f88d95cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000009a [ 537.435393][T17489] RAX: ffffffffffffffda RBX: 00007f88d8a25fa0 RCX: 00007f88d87a8f19 [ 537.435410][T17489] RDX: 0000000000000010 RSI: 0000200000000200 RDI: 0000000000000001 [ 537.435424][T17489] RBP: 00007f88d8837f6d R08: 0000000000000000 R09: 0000000000000000 [ 537.435438][T17489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 537.435452][T17489] R13: 00007f88d8a26038 R14: 00007f88d8a25fa0 R15: 00007ffce143edf8 [ 537.435486][T17489] [ 537.636939][T17489] warn_alloc: 1 callbacks suppressed [ 537.636961][T17489] syz.9.3922: vmalloc error: size 65536, align 0x1, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 537.637055][T17489] CPU: 1 UID: 0 PID: 17489 Comm: syz.9.3922 Tainted: G L syzkaller #0 PREEMPT(full) [ 537.637083][T17489] Tainted: [L]=SOFTLOCKUP [ 537.637092][T17489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 537.637104][T17489] Call Trace: [ 537.637113][T17489] [ 537.637120][T17489] dump_stack_lvl+0xe8/0x150 [ 537.637156][T17489] warn_alloc+0x24d/0x270 [ 537.637183][T17489] ? lockdep_hardirqs_on+0x7b/0x110 [ 537.637216][T17489] ? __pfx_warn_alloc+0x10/0x10 [ 537.637239][T17489] ? kfree+0x1c7/0x650 [ 537.637268][T17489] ? __get_vm_area_node+0x219/0x2f0 [ 537.637297][T17489] __vmalloc_node_range_noprof+0x396/0x16f0 [ 537.637354][T17489] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 537.637380][T17489] ? __kasan_kmalloc+0x93/0xb0 [ 537.637409][T17489] ? __kmalloc_cache_noprof+0x31c/0x600 [ 537.637436][T17489] ? write_ldt+0x4f7/0x930 [ 537.637460][T17489] __vmalloc_noprof+0xd2/0x120 [ 537.637481][T17489] ? write_ldt+0x4f7/0x930 [ 537.637513][T17489] write_ldt+0x4f7/0x930 [ 537.637537][T17489] ? __se_sys_futex+0x3a8/0x450 [ 537.637574][T17489] ? __pfx_write_ldt+0x10/0x10 [ 537.637603][T17489] ? rcu_is_watching+0x16/0xb0 [ 537.637647][T17489] __se_sys_modify_ldt+0x6c/0x310 [ 537.637677][T17489] do_syscall_64+0x16a/0x530 [ 537.637706][T17489] ? trace_irq_disable+0x3b/0x140 [ 537.637733][T17489] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.637755][T17489] ? clear_bhb_loop+0x70/0xc0 [ 537.637780][T17489] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.637802][T17489] RIP: 0033:0x7f88d87a8f19 [ 537.637822][T17489] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 537.637840][T17489] RSP: 002b:00007f88d95cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000009a [ 537.637861][T17489] RAX: ffffffffffffffda RBX: 00007f88d8a25fa0 RCX: 00007f88d87a8f19 [ 537.637877][T17489] RDX: 0000000000000010 RSI: 0000200000000200 RDI: 0000000000000001 [ 537.637891][T17489] RBP: 00007f88d8837f6d R08: 0000000000000000 R09: 0000000000000000 [ 537.637905][T17489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 537.637919][T17489] R13: 00007f88d8a26038 R14: 00007f88d8a25fa0 R15: 00007ffce143edf8 [ 537.637955][T17489] [ 537.640764][T17489] Mem-Info: [ 537.640778][T17489] active_anon:19338 inactive_anon:15 isolated_anon:0 [ 537.640778][T17489] active_file:190 inactive_file:57148 isolated_file:0 [ 537.640778][T17489] unevictable:0 dirty:80 writeback:0 [ 537.640778][T17489] slab_reclaimable:16644 slab_unreclaimable:94630 [ 537.640778][T17489] mapped:35469 shmem:13619 pagetables:1497 [ 537.640778][T17489] sec_pagetables:0 bounce:0 [ 537.640778][T17489] kernel_misc_reclaimable:0 [ 537.640778][T17489] free:1270436 free_pcp:13653 free_cma:0 [ 537.640839][T17489] Node 0 active_anon:77352kB inactive_anon:60kB active_file:760kB inactive_file:228456kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:141876kB dirty:320kB writeback:0kB shmem:54476kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12752kB pagetables:5844kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 537.640896][T17489] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:136kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 537.640949][T17489] Node 0 DMA free:15356kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 537.641008][T17489] lowmem_reserve[]: 0 2460 2461 2461 2461 [ 537.641044][T17489] Node 0 DMA32 free:1128064kB boost:0kB min:33896kB low:42368kB high:50840kB reserved_highatomic:0kB free_highatomic:0kB active_anon:77300kB inactive_anon:60kB active_file:760kB inactive_file:228432kB unevictable:0kB writepending:320kB zspages:764kB present:3129332kB managed:2519180kB mlocked:0kB bounce:0kB free_pcp:48396kB local_pcp:25752kB free_cma:0kB [ 537.655576][T17489] lowmem_reserve[]: 0 0 1 1 1 [ 537.655627][T17489] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1052kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 537.655689][T17489] lowmem_reserve[]: 0 0 0 0 0 [ 537.655722][T17489] Node 1 Normal free:3938324kB boost:0kB min:55988kB low:69984kB high:83980kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:136kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:6212kB local_pcp:2048kB free_cma:0kB [ 537.655784][T17489] lowmem_reserve[]: 0 0 0 0 0 [ 537.655816][T17489] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 537.656016][T17489] Node 0 DMA32: 14*4kB (E) 859*8kB (ME) 489*16kB (UME) 163*32kB (UE) 154*64kB (UME) 142*128kB (UME) 129*256kB (UME) 65*512kB (ME) 36*1024kB (ME) 21*2048kB (UME) 228*4096kB (UM) = 1128064kB [ 537.656173][T17489] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 537.656269][T17489] Node 1 Normal: 3*4kB (UM) 5*8kB (UM) 10*16kB (UM) 8*32kB (UM) 3*64kB (UM) 3*128kB (UM) 2*256kB (M) 5*512kB (UM) 2*1024kB (UM) 4*2048kB (UM) 958*4096kB (M) = 3938324kB [ 537.660365][T17489] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 537.660383][T17489] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 537.660400][T17489] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 537.660417][T17489] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 537.660434][T17489] 70980 total pagecache pages [ 537.660447][T17489] 1 pages in swap cache [ 537.660454][T17489] Free swap = 124800kB [ 537.660462][T17489] Total swap = 124996kB [ 537.660471][T17489] 2097051 pages RAM [ 537.660478][T17489] 0 pages HighMem/MovableOnly [ 537.660486][T17489] 435377 pages reserved [ 537.660494][T17489] 0 pages cma reserved [ 538.392437][T17503] netlink: 20 bytes leftover after parsing attributes in process `syz.8.3927'. [ 538.771095][T17518] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 539.008710][T17524] netlink: 44 bytes leftover after parsing attributes in process `syz.8.3930'. [ 539.126839][T12090] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 539.126876][T12090] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.241907][ T4954] Bluetooth: hci3: command tx timeout [ 539.650307][T12090] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 539.650345][T12090] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.899634][T12090] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 539.899676][T12090] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.926857][T17478] rxe_eth0 speed is unknown, defaulting to 1000 [ 540.212030][T12090] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 540.212068][T12090] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.338331][T17544] syzkaller1: entered promiscuous mode [ 540.338358][T17544] syzkaller1: entered allmulticast mode [ 540.649587][T17549] netlink: 44 bytes leftover after parsing attributes in process `syz.9.3939'. [ 540.864147][T17554] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 540.984415][T17556] FAULT_INJECTION: forcing a failure. [ 540.984415][T17556] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 540.984449][T17556] CPU: 0 UID: 0 PID: 17556 Comm: syz.3.3942 Tainted: G L syzkaller #0 PREEMPT(full) [ 540.984476][T17556] Tainted: [L]=SOFTLOCKUP [ 540.984483][T17556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 540.984495][T17556] Call Trace: [ 540.984503][T17556] [ 540.984512][T17556] dump_stack_lvl+0xe8/0x150 [ 540.984547][T17556] should_fail_ex+0x3eb/0x540 [ 540.984574][T17556] _copy_to_iter+0x404/0x17e0 [ 540.984703][T17556] ? __pfx__copy_to_iter+0x10/0x10 [ 540.984737][T17556] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 540.984764][T17556] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 540.984792][T17556] __skb_datagram_iter+0xf8/0x980 [ 540.984878][T17556] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 540.984918][T17556] skb_copy_datagram_iter+0xb5/0x240 [ 540.984948][T17556] netlink_recvmsg+0x2c8/0xa70 [ 540.985023][T17556] ? __pfx_netlink_recvmsg+0x10/0x10 [ 540.985049][T17556] ? aa_sock_msg_perm+0x144/0x210 [ 540.985150][T17556] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 540.985231][T17556] ? security_socket_recvmsg+0x7e/0x2c0 [ 540.985254][T17556] ? __pfx_netlink_recvmsg+0x10/0x10 [ 540.985275][T17556] sock_recvmsg+0x196/0x1e0 [ 540.985335][T17556] ____sys_recvmsg+0x1f8/0x530 [ 540.985367][T17556] ? __pfx_____sys_recvmsg+0x10/0x10 [ 540.985407][T17556] ? import_iovec+0x73/0xa0 [ 540.985431][T17556] ___sys_recvmsg+0x213/0x5a0 [ 540.985461][T17556] ? __pfx____sys_recvmsg+0x10/0x10 [ 540.985490][T17556] ? lock_acquire+0x115/0x350 [ 540.985526][T17556] ? __fget_files+0x2a/0x420 [ 540.985550][T17556] ? __fget_files+0x3a2/0x420 [ 540.985572][T17556] ? __fget_files+0x2a/0x420 [ 540.985599][T17556] ? fdget+0x1ac/0x250 [ 540.985623][T17556] do_recvmmsg+0x31a/0x800 [ 540.985656][T17556] ? __pfx_do_recvmmsg+0x10/0x10 [ 540.985692][T17556] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 540.985724][T17556] ? fdget+0x1ac/0x250 [ 540.985753][T17556] __x64_sys_recvmmsg+0x198/0x250 [ 540.985779][T17556] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 540.985811][T17556] do_syscall_64+0x16a/0x530 [ 540.985836][T17556] ? trace_irq_disable+0x3b/0x140 [ 540.985859][T17556] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.985878][T17556] ? clear_bhb_loop+0x70/0xc0 [ 540.985901][T17556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.985927][T17556] RIP: 0033:0x7f322c7a8f19 [ 540.985944][T17556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 540.985960][T17556] RSP: 002b:00007f322d65d028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 540.985981][T17556] RAX: ffffffffffffffda RBX: 00007f322ca25fa0 RCX: 00007f322c7a8f19 [ 540.985996][T17556] RDX: 0000000000000003 RSI: 00002000000001c0 RDI: 0000000000000003 [ 540.986008][T17556] RBP: 00007f322d65d090 R08: 0000000000000000 R09: 0000000000000000 [ 540.986021][T17556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 540.986032][T17556] R13: 00007f322ca26038 R14: 00007f322ca25fa0 R15: 00007fff9710f368 [ 540.986063][T17556] [ 541.322175][ T4954] Bluetooth: hci3: command tx timeout [ 541.348171][T12090] bridge_slave_1: left allmulticast mode [ 541.348198][T12090] bridge_slave_1: left promiscuous mode [ 541.348394][T12090] bridge0: port 2(bridge_slave_1) entered disabled state [ 541.366020][T12090] bridge_slave_0: left allmulticast mode [ 541.366045][T12090] bridge_slave_0: left promiscuous mode [ 541.366250][T12090] bridge0: port 1(bridge_slave_0) entered disabled state [ 542.058673][T12090] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 542.074415][T12090] bond0 (unregistering): (slave c@0): Releasing backup interface [ 542.080311][T12090] bond0 (unregistering): (slave macvlan1): Releasing backup interface [ 542.084820][T12090] veth1_vlan: left allmulticast mode [ 542.114760][T12090] bond0 (unregistering): Released all slaves [ 542.229598][T11146] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 542.391999][T11146] usb 4-1: Using ep0 maxpacket: 16 [ 542.393864][T11146] usb 4-1: New USB device found: idVendor=258a, idProduct=0033, bcdDevice=0.00 [ 542.397222][T11146] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 542.397272][T11146] usb 4-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 542.397298][T11146] usb 4-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 542.397322][T11146] usb 4-1: config 0 interface 0 has no altsetting 0 [ 542.397355][T11146] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.427866][T11146] usb 4-1: config 0 descriptor?? [ 542.867207][T11146] glorious 0003:258A:0033.002A: unknown main item tag 0x0 [ 542.868848][T11146] glorious 0003:258A:0033.002A: unknown main item tag 0x0 [ 542.868887][T11146] glorious 0003:258A:0033.002A: unknown main item tag 0x0 [ 542.868914][T11146] glorious 0003:258A:0033.002A: unknown main item tag 0x0 [ 542.868942][T11146] glorious 0003:258A:0033.002A: unknown main item tag 0x0 [ 542.868969][T11146] glorious 0003:258A:0033.002A: unknown main item tag 0x0 [ 542.868996][T11146] glorious 0003:258A:0033.002A: unknown main item tag 0x0 [ 542.869023][T11146] glorious 0003:258A:0033.002A: unknown main item tag 0x0 [ 542.869050][T11146] glorious 0003:258A:0033.002A: unknown main item tag 0x0 [ 542.869076][T11146] glorious 0003:258A:0033.002A: unknown main item tag 0x0 [ 542.975089][ T10] usb 10-1: new high-speed USB device number 69 using dummy_hcd [ 542.982909][T17478] bridge0: port 1(bridge_slave_0) entered blocking state [ 542.983007][T17478] bridge0: port 1(bridge_slave_0) entered disabled state [ 542.983171][T17478] bridge_slave_0: entered allmulticast mode [ 542.988354][T17478] bridge_slave_0: entered promiscuous mode [ 542.996025][T17478] bridge0: port 2(bridge_slave_1) entered blocking state [ 543.001250][T17478] bridge0: port 2(bridge_slave_1) entered disabled state [ 543.001403][T17478] bridge_slave_1: entered allmulticast mode [ 543.011234][T17478] bridge_slave_1: entered promiscuous mode [ 543.019010][T11146] glorious 0003:258A:0033.002A: hidraw0: USB HID v0.04 Device [Glorious Model D] on usb-dummy_hcd.3-1/input0 [ 543.068132][T11146] usb 4-1: USB disconnect, device number 79 [ 543.142752][ T10] usb 10-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 543.143750][ T10] usb 10-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 543.143782][ T10] usb 10-1: config 0 interface 0 altsetting 255 bulk endpoint 0x8F has invalid maxpacket 61 [ 543.143806][ T10] usb 10-1: config 0 interface 0 has no altsetting 0 [ 543.145698][ T10] usb 10-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 543.145722][ T10] usb 10-1: Product: syz [ 543.145737][ T10] usb 10-1: Manufacturer: syz [ 543.145752][ T10] usb 10-1: SerialNumber: syz [ 543.148753][ T10] usb 10-1: config 0 descriptor?? [ 543.149559][T17589] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 543.199232][T17595] netlink: 44 bytes leftover after parsing attributes in process `syz.8.3948'. [ 543.286305][ T10] usb 10-1: selecting invalid altsetting 0 [ 543.309535][T17478] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 543.326817][T17478] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 543.402623][ T4954] Bluetooth: hci3: command tx timeout [ 543.422646][ T10] usb 10-1: USB disconnect, device number 69 [ 543.450049][T17478] team0: Port device team_slave_0 added [ 543.467838][T17478] team0: Port device team_slave_1 added [ 543.513596][T17478] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 543.513614][T17478] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 543.513635][T17478] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 543.515471][T17478] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 543.515484][T17478] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 543.515506][T17478] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 543.714007][ T5754] usb 9-1: new high-speed USB device number 86 using dummy_hcd [ 543.787877][T17478] hsr_slave_0: entered promiscuous mode [ 543.788951][T17478] hsr_slave_1: entered promiscuous mode [ 543.789702][T17478] debugfs: 'hsr0' already exists in 'hsr' [ 543.789718][T17478] Cannot create hsr debugfs directory [ 543.875794][ T5754] usb 9-1: Using ep0 maxpacket: 32 [ 543.877995][ T5754] usb 9-1: New USB device found: idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 543.879936][ T5754] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 543.879962][ T5754] usb 9-1: config 0 has no interface number 0 [ 543.890034][ T5754] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.890061][ T5754] usb 9-1: Product: syz [ 543.890075][ T5754] usb 9-1: Manufacturer: syz [ 543.890089][ T5754] usb 9-1: SerialNumber: syz [ 543.895112][ T5754] usb 9-1: config 0 descriptor?? [ 543.899620][ T5754] quatech2 9-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 544.128300][ T5754] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 544.196608][ T5754] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 544.219364][T17601] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3953'. [ 544.517819][ C1] usb 9-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 544.521061][ T5754] usb 9-1: USB disconnect, device number 86 [ 544.547991][ T5754] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 544.601384][ T5754] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 544.616396][ T5754] quatech2 9-1:0.51: device disconnected [ 544.754267][T11146] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 544.844775][T12090] hsr_slave_0: left promiscuous mode [ 544.845619][T12090] hsr_slave_1: left promiscuous mode [ 544.848822][T12090] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 544.848846][T12090] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 544.849880][T12090] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 544.849899][T12090] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 544.873252][T12090] veth1_macvtap: left promiscuous mode [ 544.873329][T12090] veth0_macvtap: left promiscuous mode [ 544.873481][T12090] veth1_vlan: left promiscuous mode [ 544.873606][T12090] veth0_vlan: left promiscuous mode [ 544.926874][T11146] usb 4-1: New USB device found: idVendor=17ef, idProduct=6009, bcdDevice=0.00 [ 544.928178][T11146] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 544.928208][T11146] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 544.928235][T11146] usb 4-1: config 0 interface 0 has no altsetting 0 [ 544.928269][T11146] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 544.931196][T11146] usb 4-1: config 0 descriptor?? [ 545.364512][T11146] lenovo 0003:17EF:6009.002B: hidraw0: USB HID v0.00 Device [HID 17ef:6009] on usb-dummy_hcd.3-1/input0 [ 545.481952][ T4954] Bluetooth: hci3: command tx timeout [ 545.484520][T12090] team0 (unregistering): Port device team_slave_1 removed [ 545.506787][T12090] team0 (unregistering): Port device team_slave_0 removed [ 545.556614][T11146] usb 4-1: USB disconnect, device number 80 [ 545.824532][T17612] program syz.8.3957 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 545.908768][T17614] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3958'. [ 546.407352][T17632] ufs: You didn't specify the type of your ufs filesystem [ 546.407352][T17632] [ 546.407352][T17632] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 546.407352][T17632] [ 546.407352][T17632] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 546.451006][T12090] IPVS: stop unused estimator thread 0... [ 546.684549][ T5754] usb 10-1: new high-speed USB device number 70 using dummy_hcd [ 546.829886][T17640] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3967'. [ 546.844049][ T5754] usb 10-1: New USB device found: idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 546.845383][ T5754] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 546.845414][ T5754] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 546.845438][ T5754] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 546.847504][ T5754] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.847529][ T5754] usb 10-1: Product: syz [ 546.847544][ T5754] usb 10-1: Manufacturer: syz [ 546.847559][ T5754] usb 10-1: SerialNumber: syz [ 546.856527][ T5754] usb 10-1: config 0 descriptor?? [ 547.029473][T17644] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3968'. [ 547.090255][ T5754] adutux 10-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 547.268480][ T5762] usb 10-1: USB disconnect, device number 70 [ 547.609645][T17478] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 547.629905][T17478] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 547.644121][T17478] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 547.669799][T17478] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 547.685435][T17478] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 547.708514][T17478] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 547.720128][T17478] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 547.746816][T17478] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 549.207367][T12090] bridge_slave_1: left allmulticast mode [ 549.207394][T12090] bridge_slave_1: left promiscuous mode [ 549.207596][T12090] bridge0: port 2(bridge_slave_1) entered disabled state [ 549.224175][T12090] bridge_slave_0: left allmulticast mode [ 549.224200][T12090] bridge_slave_0: left promiscuous mode [ 549.224397][T12090] bridge0: port 1(bridge_slave_0) entered disabled state [ 549.526888][T17673] 9pnet_fd: Insufficient options for proto=fd [ 549.601572][T12090] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 549.620177][T12090] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 549.636076][T12090] bond0 (unregistering): (slave macvlan1): Releasing backup interface [ 549.637118][T12090] bond0 (unregistering): Released all slaves [ 549.666197][T17478] 8021q: adding VLAN 0 to HW filter on device bond0 [ 549.905003][T17478] 8021q: adding VLAN 0 to HW filter on device team0 [ 549.918958][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 549.919061][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 549.934853][ T14] bridge0: port 2(bridge_slave_1) entered blocking state [ 549.934999][ T14] bridge0: port 2(bridge_slave_1) entered forwarding state [ 550.185786][T17683] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 550.185810][T17683] block device autoloading is deprecated and will be removed. [ 550.276766][T17685] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3975'. [ 550.319770][T17683] md: md8 stopped. [ 550.595792][T17695] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3986'. [ 550.700899][T17699] netlink: 'syz.3.3987': attribute type 4 has an invalid length. [ 551.022991][ T47] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 551.110430][T12090] hsr_slave_0: left promiscuous mode [ 551.117612][T12090] hsr_slave_1: left promiscuous mode [ 551.118595][T12090] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 551.118615][T12090] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 551.120515][T12090] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 551.120535][T12090] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 551.143853][T12090] veth1_macvtap: left promiscuous mode [ 551.150074][T12090] veth0_macvtap: left promiscuous mode [ 551.150258][T12090] veth1_vlan: left promiscuous mode [ 551.150376][T12090] veth0_vlan: left promiscuous mode [ 551.184838][ T47] usb 4-1: unable to get BOS descriptor or descriptor too short [ 551.184890][ T47] usb 4-1: New USB device found: idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 551.187390][ T47] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 551.187438][ T47] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 9 [ 551.187463][ T47] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 551.187484][ T47] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 0 [ 551.189420][ T47] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.189469][ T47] usb 4-1: Product: syz [ 551.189484][ T47] usb 4-1: Manufacturer: syz [ 551.189499][ T47] usb 4-1: SerialNumber: syz [ 551.201272][ T47] usb 4-1: config 0 descriptor?? [ 551.202553][T17700] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 551.219423][ C1] usb 4-1: NFC: Urb failure (status -71) [ 551.253026][ T47] usb 4-1: NFC: Unable to get FW version [ 551.271434][ T47] pn533_usb 4-1:0.0: probe with driver pn533_usb failed with error -90 [ 551.334787][T17715] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3992'. [ 551.471097][ T5754] usb 4-1: USB disconnect, device number 81 [ 551.514971][T17717] netlink: 'syz.8.3993': attribute type 10 has an invalid length. [ 552.055595][T12090] team0 (unregistering): Port device team_slave_1 removed [ 552.108439][T12090] team0 (unregistering): Port device team_slave_0 removed [ 552.449630][T17740] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4000'. [ 552.938209][T17759] netlink: 20 bytes leftover after parsing attributes in process `syz.8.4006'. [ 553.018597][T12090] IPVS: stop unused estimator thread 0... [ 553.199276][T17767] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4008'. [ 553.374553][ T5762] usb 4-1: new low-speed USB device number 82 using dummy_hcd [ 553.407294][T17478] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 553.502630][ T5762] usb 4-1: device descriptor read/64, error -71 [ 553.532929][T17478] veth0_vlan: entered promiscuous mode [ 553.550562][T17478] veth1_vlan: entered promiscuous mode [ 553.622908][T17478] veth0_macvtap: entered promiscuous mode [ 553.635606][T17478] veth1_macvtap: entered promiscuous mode [ 553.671872][ T5754] usb 9-1: new high-speed USB device number 87 using dummy_hcd [ 553.676521][T17478] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 553.694089][T17478] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 553.722847][ T14] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.723152][ T14] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.723189][ T14] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.723222][ T14] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.732367][T12091] netdevsim netdevsim9 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 553.733504][T12091] netdevsim netdevsim9 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 553.742871][ T5762] usb 4-1: new low-speed USB device number 83 using dummy_hcd [ 553.778523][T12091] netdevsim netdevsim9 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 553.778905][T12091] netdevsim netdevsim9 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 553.823074][ T5754] usb 9-1: Using ep0 maxpacket: 32 [ 553.827781][ T5754] usb 9-1: New USB device found: idVendor=1d6b, idProduct=0101, bcdDevice=0.40 [ 553.839698][ T5754] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.839726][ T5754] usb 9-1: Product: ⴽ䗌봋묿ⸯ賧鏂뾀晄쁘呈 [ 553.839742][ T5754] usb 9-1: Manufacturer: 犺腲䴌蝹｢槔艷ఊנ㟽៷폱税閣稪쿈冁⊅રꨱ䤔♴絟췄狶琅৞㘬ퟫ劵ꗊ珕뜷肆鱾끾嘙䅸峯 [ 553.839757][ T5754] usb 9-1: SerialNumber: syz [ 553.872001][ T5762] usb 4-1: device descriptor read/64, error -71 [ 553.974998][T12090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 553.975022][T12090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 553.982180][ T5762] usb usb4-port1: attempt power cycle [ 554.060430][T17777] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 554.068305][T17777] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.081614][T12090] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 554.081635][T12090] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 554.106700][ T5754] usb 9-1: 1:1 : format type 0 is detected, processed as PCM [ 554.106729][ T5754] usb 9-1: 1:1 : unsupported sample bitwidth 15 in 5 bytes [ 554.107916][ T5754] usb 9-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 554.280417][ T5754] usb 9-1: USB disconnect, device number 87 [ 554.321879][ T5762] usb 4-1: new low-speed USB device number 84 using dummy_hcd [ 554.342853][ T5762] usb 4-1: device descriptor read/8, error -71 [ 554.404339][T17784] FAULT_INJECTION: forcing a failure. [ 554.404339][T17784] name failslab, interval 1, probability 5, space 0, times 41 [ 554.404380][T17784] CPU: 1 UID: 0 PID: 17784 Comm: syz.9.4014 Tainted: G L syzkaller #0 PREEMPT(full) [ 554.404410][T17784] Tainted: [L]=SOFTLOCKUP [ 554.404418][T17784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 554.404431][T17784] Call Trace: [ 554.404440][T17784] [ 554.404450][T17784] dump_stack_lvl+0xe8/0x150 [ 554.404489][T17784] should_fail_ex+0x3eb/0x540 [ 554.404517][T17784] should_failslab+0xa8/0x100 [ 554.404558][T17784] __kmalloc_noprof+0xf9/0x710 [ 554.404584][T17784] ? tomoyo_encode+0x2ad/0x570 [ 554.404699][T17784] ? tomoyo_encode+0x2ad/0x570 [ 554.404726][T17784] tomoyo_encode+0x2ad/0x570 [ 554.404758][T17784] tomoyo_realpath_from_path+0x5fd/0x640 [ 554.404793][T17784] tomoyo_check_open_permission+0x229/0x470 [ 554.404859][T17784] ? tomoyo_check_open_permission+0x1d3/0x470 [ 554.404897][T17784] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 554.404928][T17784] ? __asan_memset+0x22/0x50 [ 554.404959][T17784] ? seqcount_lockdep_reader_access+0xea/0x100 [ 554.405014][T17784] ? devcgroup_check_permission+0x31/0x8f0 [ 554.405075][T17784] security_file_open+0xa9/0x240 [ 554.405104][T17784] do_dentry_open+0x495/0x1360 [ 554.405138][T17784] vfs_open_consume+0x4a/0x350 [ 554.405159][T17784] ? path_openat+0x16e1/0x20f0 [ 554.405225][T17784] path_openat+0x16fc/0x20f0 [ 554.405273][T17784] do_file_open+0x23e/0x4a0 [ 554.405308][T17784] ? __pfx_do_file_open+0x10/0x10 [ 554.405359][T17784] ? _raw_spin_unlock+0x28/0x50 [ 554.405385][T17784] ? alloc_fd+0x6af/0x760 [ 554.405420][T17784] do_sys_openat2+0x115/0x200 [ 554.405443][T17784] ? __se_sys_futex+0x3a8/0x450 [ 554.405475][T17784] ? __pfx_do_sys_openat2+0x10/0x10 [ 554.405505][T17784] ? rcu_is_watching+0x16/0xb0 [ 554.405538][T17784] __x64_sys_openat+0x138/0x170 [ 554.405567][T17784] do_syscall_64+0x16a/0x530 [ 554.405595][T17784] ? trace_irq_disable+0x3b/0x140 [ 554.405620][T17784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.405642][T17784] ? clear_bhb_loop+0x70/0xc0 [ 554.405668][T17784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.405689][T17784] RIP: 0033:0x7f88d87a8f19 [ 554.405709][T17784] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 554.405727][T17784] RSP: 002b:00007f88d95cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 554.405751][T17784] RAX: ffffffffffffffda RBX: 00007f88d8a25fa0 RCX: 00007f88d87a8f19 [ 554.405767][T17784] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: ffffffffffffff9c [ 554.405783][T17784] RBP: 00007f88d8837f6d R08: 0000000000000000 R09: 0000000000000000 [ 554.405797][T17784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 554.405810][T17784] R13: 00007f88d8a26038 R14: 00007f88d8a25fa0 R15: 00007ffce143edf8 [ 554.405844][T17784] [ 554.409094][T17784] ERROR: Out of memory at tomoyo_realpath_from_path. [ 554.582216][ T5762] usb 4-1: new low-speed USB device number 85 using dummy_hcd [ 554.603758][ T5762] usb 4-1: device descriptor read/8, error -71 [ 554.714412][ T5762] usb usb4-port1: unable to enumerate USB device [ 554.836342][T17799] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4016'. [ 554.920249][T17801] FAULT_INJECTION: forcing a failure. [ 554.920249][T17801] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 554.920280][T17801] CPU: 0 UID: 0 PID: 17801 Comm: syz.0.4019 Tainted: G L syzkaller #0 PREEMPT(full) [ 554.920308][T17801] Tainted: [L]=SOFTLOCKUP [ 554.920316][T17801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 554.920328][T17801] Call Trace: [ 554.920336][T17801] [ 554.920345][T17801] dump_stack_lvl+0xe8/0x150 [ 554.920379][T17801] should_fail_ex+0x3eb/0x540 [ 554.920404][T17801] _copy_from_user+0x2d/0xb0 [ 554.920428][T17801] ___sys_sendmsg+0x1c6/0x360 [ 554.920451][T17801] ? __lock_acquire+0x747/0x2de0 [ 554.920479][T17801] ? __pfx____sys_sendmsg+0x10/0x10 [ 554.920538][T17801] ? __fget_files+0x3a2/0x420 [ 554.920561][T17801] ? __fget_files+0x2a/0x420 [ 554.920595][T17801] __x64_sys_sendmsg+0x1b1/0x290 [ 554.920621][T17801] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 554.920666][T17801] do_syscall_64+0x16a/0x530 [ 554.920693][T17801] ? trace_irq_disable+0x3b/0x140 [ 554.920718][T17801] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.920738][T17801] ? clear_bhb_loop+0x70/0xc0 [ 554.920762][T17801] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.920782][T17801] RIP: 0033:0x7ff2a93a8f19 [ 554.920800][T17801] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 554.920818][T17801] RSP: 002b:00007ff2a75f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 554.920840][T17801] RAX: ffffffffffffffda RBX: 00007ff2a9625fa0 RCX: 00007ff2a93a8f19 [ 554.920855][T17801] RDX: 0000000000000080 RSI: 0000200000000480 RDI: 000000000000000a [ 554.920868][T17801] RBP: 00007ff2a75f6090 R08: 0000000000000000 R09: 0000000000000000 [ 554.920881][T17801] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 554.920900][T17801] R13: 00007ff2a9626038 R14: 00007ff2a9625fa0 R15: 00007ffe7a5124d8 [ 554.920933][T17801] [ 555.208540][T17806] syzkaller1: entered promiscuous mode [ 555.208563][T17806] syzkaller1: entered allmulticast mode [ 555.218622][T17807] device-mapper: ioctl: device name cannot be "control", ".", or ".." [ 555.432488][T17816] FAULT_INJECTION: forcing a failure. [ 555.432488][T17816] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 555.432521][T17816] CPU: 1 UID: 0 PID: 17816 Comm: syz.8.4025 Tainted: G L syzkaller #0 PREEMPT(full) [ 555.432548][T17816] Tainted: [L]=SOFTLOCKUP [ 555.432555][T17816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 555.432567][T17816] Call Trace: [ 555.432575][T17816] [ 555.432584][T17816] dump_stack_lvl+0xe8/0x150 [ 555.432618][T17816] should_fail_ex+0x3eb/0x540 [ 555.432643][T17816] _copy_to_iter+0x5a1/0x17e0 [ 555.432683][T17816] ? __pfx__copy_to_iter+0x10/0x10 [ 555.432715][T17816] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 555.432740][T17816] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 555.432765][T17816] __skb_datagram_iter+0xf8/0x980 [ 555.432793][T17816] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 555.432827][T17816] skb_copy_datagram_iter+0xb5/0x240 [ 555.432865][T17816] netlink_recvmsg+0x2c8/0xa70 [ 555.432895][T17816] ? __pfx_netlink_recvmsg+0x10/0x10 [ 555.432923][T17816] ? aa_sock_msg_perm+0x144/0x210 [ 555.432956][T17816] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 555.432979][T17816] ? security_socket_recvmsg+0x7e/0x2c0 [ 555.433000][T17816] ? __pfx_netlink_recvmsg+0x10/0x10 [ 555.433022][T17816] sock_recvmsg+0x196/0x1e0 [ 555.433054][T17816] ____sys_recvmsg+0x1f8/0x530 [ 555.433088][T17816] ? __pfx_____sys_recvmsg+0x10/0x10 [ 555.433125][T17816] ? import_iovec+0x73/0xa0 [ 555.433150][T17816] ___sys_recvmsg+0x213/0x5a0 [ 555.433181][T17816] ? __pfx____sys_recvmsg+0x10/0x10 [ 555.433211][T17816] ? lock_acquire+0x115/0x350 [ 555.433245][T17816] ? __fget_files+0x2a/0x420 [ 555.433268][T17816] ? __fget_files+0x3a2/0x420 [ 555.433290][T17816] ? __fget_files+0x2a/0x420 [ 555.433318][T17816] ? fdget+0x1ac/0x250 [ 555.433344][T17816] do_recvmmsg+0x31a/0x800 [ 555.433378][T17816] ? __pfx_do_recvmmsg+0x10/0x10 [ 555.433425][T17816] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 555.433458][T17816] ? fdget+0x1ac/0x250 [ 555.433487][T17816] __x64_sys_recvmmsg+0x198/0x250 [ 555.433517][T17816] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 555.433550][T17816] do_syscall_64+0x16a/0x530 [ 555.433575][T17816] ? trace_irq_disable+0x3b/0x140 [ 555.433598][T17816] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.433618][T17816] ? clear_bhb_loop+0x70/0xc0 [ 555.433641][T17816] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.433661][T17816] RIP: 0033:0x7ffbf07a8f19 [ 555.433680][T17816] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 555.433696][T17816] RSP: 002b:00007ffbf16d7028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 555.433718][T17816] RAX: ffffffffffffffda RBX: 00007ffbf0a25fa0 RCX: 00007ffbf07a8f19 [ 555.433734][T17816] RDX: 0000000000000003 RSI: 00002000000001c0 RDI: 0000000000000003 [ 555.433747][T17816] RBP: 00007ffbf16d7090 R08: 0000000000000000 R09: 0000000000000000 [ 555.433782][T17816] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 555.433795][T17816] R13: 00007ffbf0a26038 R14: 00007ffbf0a25fa0 R15: 00007fff06a45028 [ 555.433827][T17816] [ 556.119031][T13802] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 556.133224][T13802] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 556.137160][T13802] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 556.141385][T13802] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 556.150812][T13802] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 556.211600][T17829] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.222703][T17829] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.263986][T17831] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(3) [ 556.296226][T17829] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4028'. [ 556.317949][T17829] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.318382][T17829] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.452055][ T5814] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 556.612076][T17844] xt_l2tp: missing protocol rule (udp|l2tpip) [ 556.633268][ T5814] usb 1-1: unable to get BOS descriptor or descriptor too short [ 556.633319][ T5814] usb 1-1: New USB device found: idVendor=0582, idProduct=004c, bcdDevice=0.40 [ 556.634464][ T5814] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 556.636380][ T5814] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.636403][ T5814] usb 1-1: Product: syz [ 556.636417][ T5814] usb 1-1: Manufacturer: syz [ 556.636431][ T5814] usb 1-1: SerialNumber: syz [ 556.878795][ T5814] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 556.890085][T17854] netlink: 'syz.9.4033': attribute type 2 has an invalid length. [ 556.890108][T17854] netlink: 252 bytes leftover after parsing attributes in process `syz.9.4033'. [ 556.890429][ T5814] usb 1-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 556.971920][ T993] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 557.016308][ T5814] usb 1-1: USB disconnect, device number 59 [ 557.050842][ T1027] netdevsim netdevsim8 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 557.050880][ T1027] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.122005][ T993] usb 4-1: Using ep0 maxpacket: 8 [ 557.122820][ T993] usb 4-1: New USB device found: idVendor=0458, idProduct=701e, bcdDevice=13.50 [ 557.123812][ T993] usb 4-1: config 137 has an invalid interface number: 134 but max is 1 [ 557.123837][ T993] usb 4-1: config 137 has an invalid interface number: 195 but max is 1 [ 557.123858][ T993] usb 4-1: config 137 has an invalid interface number: 85 but max is 1 [ 557.123878][ T993] usb 4-1: config 137 has an invalid interface number: 42 but max is 1 [ 557.123900][ T993] usb 4-1: config 137 has 4 interfaces, different from the descriptor's value: 2 [ 557.123921][ T993] usb 4-1: config 137 has no interface number 0 [ 557.123937][ T993] usb 4-1: config 137 has no interface number 1 [ 557.123953][ T993] usb 4-1: config 137 has no interface number 2 [ 557.123970][ T993] usb 4-1: config 137 has no interface number 3 [ 557.124038][ T993] usb 4-1: config 137 interface 134 altsetting 249 has 2 endpoint descriptors, different from the interface descriptor's value: 9 [ 557.124066][ T993] usb 4-1: too many endpoints for config 137 interface 195 altsetting 169: 250, using maximum allowed: 30 [ 557.124105][ T993] usb 4-1: config 137 interface 195 altsetting 169 has an endpoint descriptor with address 0x97, changing to 0x87 [ 557.124131][ T993] usb 4-1: config 137 interface 195 altsetting 169 endpoint 0x87 has invalid maxpacket 1104, setting to 64 [ 557.124158][ T993] usb 4-1: config 137 interface 195 altsetting 169 endpoint 0x8 has invalid maxpacket 29011, setting to 64 [ 557.124185][ T993] usb 4-1: config 137 interface 195 altsetting 169 bulk endpoint 0xC has invalid maxpacket 16 [ 557.124210][ T993] usb 4-1: config 137 interface 195 altsetting 169 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 557.124236][ T993] usb 4-1: config 137 interface 195 altsetting 169 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 557.124262][ T993] usb 4-1: config 137 interface 195 altsetting 169 has a duplicate endpoint with address 0xC, skipping [ 557.124286][ T993] usb 4-1: config 137 interface 195 altsetting 169 has an invalid endpoint descriptor of length 3, skipping [ 557.124307][ T993] usb 4-1: config 137 interface 195 altsetting 169 has 8 endpoint descriptors, different from the interface descriptor's value: 250 [ 557.124333][ T993] usb 4-1: too many endpoints for config 137 interface 85 altsetting 109: 73, using maximum allowed: 30 [ 557.124367][ T993] usb 4-1: config 137 interface 85 altsetting 109 has 0 endpoint descriptors, different from the interface descriptor's value: 73 [ 557.124404][ T993] usb 4-1: config 137 interface 42 altsetting 9 has a duplicate endpoint with address 0x8, skipping [ 557.124428][ T993] usb 4-1: config 137 interface 42 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 557.124448][ T993] usb 4-1: config 137 interface 42 altsetting 9 has a duplicate endpoint with address 0xE, skipping [ 557.124472][ T993] usb 4-1: config 137 interface 42 altsetting 9 endpoint 0x5 has invalid maxpacket 512, setting to 64 [ 557.124498][ T993] usb 4-1: config 137 interface 42 altsetting 9 has a duplicate endpoint with address 0x5, skipping [ 557.124520][ T993] usb 4-1: config 137 interface 42 altsetting 9 has a duplicate endpoint with address 0xD, skipping [ 557.124542][ T993] usb 4-1: config 137 interface 134 has no altsetting 0 [ 557.124559][ T993] usb 4-1: config 137 interface 195 has no altsetting 0 [ 557.124577][ T993] usb 4-1: config 137 interface 85 has no altsetting 0 [ 557.124595][ T993] usb 4-1: config 137 interface 42 has no altsetting 0 [ 557.126749][ T993] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.126771][ T993] usb 4-1: Product: ᒅ◙剺酓䐢ퟨ㮷껞啫慂䧞묉⤯骠賌浼떪䊗腍㑙㪫Р䢜ᛵ韜໪Ĺफ़練᝚佷​㝆삿壘࡯㰒ꢢ䳔⻂ [ 557.126793][ T993] usb 4-1: Manufacturer: 龷珪䐫雱栁ஓ춰⣻䖋噩瑾㏜妺䂉⢇⯬罜㮂狲∂⿃䳊븈ᦊघ叹᝵ལᶔ豫愽ꛌ왨듢輰鈯ᇄ눎劌쌻⒲ฃ㏯类㒢뤐봺횝Ῐ혁༩㋄﫦ꍦﻮ摷௠ỹề噪ޕ퍒脤⬧枂뱁얤깽呤睫殁催₽࣬쁿꾵텒蕏婽玟㱦腳ᒾꌿଭ閹ᦍ䎏ꪾܮৗ途ᚰ孟캘罸 튅죳ңꡰ뤰륎跸垈蝄❸띂潡멘ޛ내䜊 [ 557.126834][ T993] usb 4-1: SerialNumber: 㰊 [ 557.320101][ T1027] netdevsim netdevsim8 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 557.320165][ T1027] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.364150][ T993] dvb-usb: found a 'VideoWalker DVB-T USB' in cold state, will try to load a firmware [ 557.379792][ T993] usb 4-1: Direct firmware load for dvb-usb-dibusb-5.0.0.11.fw failed with error -2 [ 557.379832][ T993] usb 4-1: Falling back to sysfs fallback for: dvb-usb-dibusb-5.0.0.11.fw [ 557.608188][ T1027] netdevsim netdevsim8 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 557.608225][ T1027] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.661201][T17825] rxe_eth0 speed is unknown, defaulting to 1000 [ 557.667819][T17861] netlink: 44 bytes leftover after parsing attributes in process `syz.9.4035'. [ 557.764698][ T1027] netdevsim netdevsim8 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 557.764743][ T1027] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 558.062036][ T5762] usb 10-1: new high-speed USB device number 71 using dummy_hcd [ 558.212166][ T5762] usb 10-1: Using ep0 maxpacket: 32 [ 558.214419][ T5762] usb 10-1: New USB device found: idVendor=14c8, idProduct=0003, bcdDevice=5.6c [ 558.218582][ T5762] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 558.220488][ T5762] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.220514][ T5762] usb 10-1: Product: syz [ 558.220529][ T5762] usb 10-1: Manufacturer: syz [ 558.220544][ T5762] usb 10-1: SerialNumber: syz [ 558.274218][ T5762] usb 10-1: config 0 descriptor?? [ 558.282873][T13802] Bluetooth: hci0: command tx timeout [ 558.290958][ T5762] hub 10-1:0.0: bad descriptor, ignoring hub [ 558.290985][ T5762] hub 10-1:0.0: probe with driver hub failed with error -5 [ 558.492735][T17865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.493289][T17865] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.546009][ T1027] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 558.549115][ T1027] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 558.571392][ T1027] bond0 (unregistering): (slave macvlan1): Releasing backup interface [ 558.572762][ T1027] bond0 (unregistering): Released all slaves [ 558.644724][ T5754] usb 10-1: USB disconnect, device number 71 [ 558.714243][ T1027] IPVS: stopping master sync thread 15956 ... [ 559.697084][ T1027] hsr_slave_0: left promiscuous mode [ 559.697817][ T1027] hsr_slave_1: left promiscuous mode [ 559.698743][ T1027] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 559.698762][ T1027] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 559.701376][ T1027] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 559.701395][ T1027] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 559.706457][T17892] input: syz1 as /devices/virtual/input/input73 [ 559.779270][ T1027] veth1_macvtap: left promiscuous mode [ 559.779365][ T1027] veth0_macvtap: left promiscuous mode [ 559.780539][ T1027] veth1_vlan: left promiscuous mode [ 559.780694][ T1027] veth0_vlan: left promiscuous mode [ 560.363634][T13802] Bluetooth: hci0: command tx timeout [ 560.745483][ T1027] team0 (unregistering): Port device team_slave_1 removed [ 560.775031][ T1027] team0 (unregistering): Port device team_slave_0 removed [ 561.239199][T17933] tipc: Started in network mode [ 561.239231][T17933] tipc: Node identity 3e70e1aeb50d, cluster identity 4711 [ 561.259674][T17933] tipc: Enabled bearer , priority 0 [ 561.515456][T17935] syzkaller0: entered promiscuous mode [ 561.515481][T17935] syzkaller0: entered allmulticast mode [ 561.516269][T17935] tipc: Resetting bearer [ 561.557121][T17930] tipc: Resetting bearer [ 562.443808][T13802] Bluetooth: hci0: command tx timeout [ 562.700078][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.700136][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.522310][T13802] Bluetooth: hci0: command tx timeout [ 565.850296][T17930] tipc: Disabling bearer [ 565.866566][T17825] bridge0: port 1(bridge_slave_0) entered blocking state [ 565.866744][T17825] bridge0: port 1(bridge_slave_0) entered disabled state [ 565.866895][T17825] bridge_slave_0: entered allmulticast mode [ 565.871494][T17825] bridge_slave_0: entered promiscuous mode [ 565.923142][ T10] tipc: Node number set to 2340282798 [ 565.930051][T17825] bridge0: port 2(bridge_slave_1) entered blocking state [ 565.930149][T17825] bridge0: port 2(bridge_slave_1) entered disabled state [ 565.930300][T17825] bridge_slave_1: entered allmulticast mode [ 565.931831][T17825] bridge_slave_1: entered promiscuous mode [ 566.043683][T17825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 566.048249][T17825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 566.104519][T17825] team0: Port device team_slave_0 added [ 566.107331][T17825] team0: Port device team_slave_1 added [ 566.154525][T17825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 566.154544][T17825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 566.154565][T17825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 566.158667][T17825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 566.158685][T17825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 566.158717][T17825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 566.310324][T17825] hsr_slave_0: entered promiscuous mode [ 566.318558][T17825] hsr_slave_1: entered promiscuous mode [ 567.184767][T17975] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4066'. [ 567.369575][T17979] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.371632][T17979] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 567.593221][T11146] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 567.751834][T11146] usb 1-1: Using ep0 maxpacket: 16 [ 567.752623][T11146] usb 1-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 567.753595][T11146] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 567.753638][T11146] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 567.753664][T11146] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 567.753683][T11146] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 567.753703][T11146] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 567.754897][T11146] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 567.754919][T11146] usb 1-1: Manufacturer: syz [ 567.757307][T11146] usb 1-1: config 0 descriptor?? [ 567.901558][T17825] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 567.914202][T17825] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 567.915666][T17825] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 567.920441][T17825] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 567.944968][T17825] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 567.950603][T17825] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 567.972651][T17825] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 567.977693][T17825] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 568.074693][T17825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 568.098101][T17825] 8021q: adding VLAN 0 to HW filter on device team0 [ 568.110798][ T86] bridge0: port 1(bridge_slave_0) entered blocking state [ 568.110890][ T86] bridge0: port 1(bridge_slave_0) entered forwarding state [ 568.131889][T11146] rc_core: IR keymap rc-hauppauge not found [ 568.131909][T11146] Registered IR keymap rc-empty [ 568.132048][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.135099][ T86] bridge0: port 2(bridge_slave_1) entered blocking state [ 568.135159][ T86] bridge0: port 2(bridge_slave_1) entered forwarding state [ 568.176740][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.194337][T11146] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 568.216405][T11146] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input74 [ 568.221247][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.242655][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.262252][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.282099][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.302360][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.322037][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.342472][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.361962][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.385732][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.402171][T11146] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 568.425717][T11146] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 568.425743][T11146] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 568.429107][T11146] usb 1-1: USB disconnect, device number 60 [ 568.873026][T18016] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 568.873052][T18016] block device autoloading is deprecated and will be removed. [ 569.018958][T18029] netlink: 'syz.0.4078': attribute type 10 has an invalid length. [ 569.019341][T18029] macvlan1: entered promiscuous mode [ 569.019375][T18029] macvlan1: entered allmulticast mode [ 569.028146][T18029] veth1_vlan: entered allmulticast mode [ 569.030800][T18029] bond0: (slave macvlan1): Enslaving as an active interface with an up link [ 569.120054][T18030] md: invalid raid superblock magic on ram19 [ 569.120076][T18030] md: ram19 does not have a valid v0.0 superblock, not importing! [ 569.120177][T18030] md: md_import_device returned -22 [ 569.168737][T17825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 569.206890][T18030] [ 569.209275][T18030] ====================================================== [ 569.216344][T18030] WARNING: possible circular locking dependency detected [ 569.223558][T18030] syzkaller #0 Tainted: G L [ 569.229556][T18030] ------------------------------------------------------ [ 569.236581][T18030] syz.9.4076/18030 is trying to acquire lock: [ 569.242657][T18030] ffffffff90b6d920 (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 569.252380][T18030] [ 569.252380][T18030] but task is already holding lock: [ 569.259744][T18030] ffff888065ab6358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 569.270124][T18030] [ 569.270124][T18030] which lock already depends on the new lock. [ 569.270124][T18030] [ 569.280542][T18030] [ 569.280542][T18030] the existing dependency chain (in reverse order) is: [ 569.289563][T18030] [ 569.289563][T18030] -> #2 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 569.298007][T18030] __mutex_lock+0x197/0x15a0 [ 569.303145][T18030] md_alloc+0x81e/0xf40 [ 569.307940][T18030] md_alloc_and_put+0x1a/0x1f0 [ 569.313246][T18030] blk_request_module+0x27d/0x2a0 [ 569.318827][T18030] blkdev_get_no_open+0x3f/0xe0 [ 569.324367][T18030] blkdev_open+0x1d7/0x600 [ 569.329328][T18030] do_dentry_open+0x80e/0x1360 [ 569.334636][T18030] vfs_open_consume+0x4a/0x350 [ 569.339942][T18030] path_openat+0x16fc/0x20f0 [ 569.345082][T18030] do_file_open+0x23e/0x4a0 [ 569.350126][T18030] do_sys_openat2+0x115/0x200 [ 569.355333][T18030] __x64_sys_openat+0x138/0x170 [ 569.360717][T18030] do_syscall_64+0x16a/0x530 [ 569.365852][T18030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.372281][T18030] [ 569.372281][T18030] -> #1 (disks_mutex){+.+.}-{4:4}: [ 569.379607][T18030] __mutex_lock+0x197/0x15a0 [ 569.384758][T18030] md_alloc+0x40/0xf40 [ 569.389373][T18030] md_alloc_and_put+0x1a/0x1f0 [ 569.394680][T18030] blk_request_module+0x27d/0x2a0 [ 569.400249][T18030] blkdev_get_no_open+0x3f/0xe0 [ 569.405655][T18030] blkdev_open+0x1d7/0x600 [ 569.410612][T18030] do_dentry_open+0x80e/0x1360 [ 569.415919][T18030] vfs_open_consume+0x4a/0x350 [ 569.421232][T18030] path_openat+0x16fc/0x20f0 [ 569.426364][T18030] do_file_open+0x23e/0x4a0 [ 569.431403][T18030] do_sys_openat2+0x115/0x200 [ 569.436624][T18030] __x64_sys_openat+0x138/0x170 [ 569.442022][T18030] do_syscall_64+0x16a/0x530 [ 569.447158][T18030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.453584][T18030] [ 569.453584][T18030] -> #0 (major_names_lock){+.+.}-{4:4}: [ 569.461338][T18030] __lock_acquire+0x164c/0x2de0 [ 569.466734][T18030] lock_acquire+0x115/0x350 [ 569.471816][T18030] __mutex_lock+0x197/0x15a0 [ 569.476956][T18030] blk_request_module+0x35/0x2a0 [ 569.482431][T18030] blkdev_get_no_open+0x3f/0xe0 [ 569.487838][T18030] bdev_file_open_by_dev+0xa0/0x240 [ 569.493586][T18030] md_import_device+0x2e9/0x650 [ 569.498976][T18030] md_add_new_disk+0x3a3/0x1850 [ 569.504379][T18030] md_ioctl+0x2027/0x2630 [ 569.509258][T18030] blkdev_ioctl+0x5e3/0x740 [ 569.514303][T18030] __se_sys_ioctl+0xfc/0x170 [ 569.519436][T18030] do_syscall_64+0x16a/0x530 [ 569.524577][T18030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.531012][T18030] [ 569.531012][T18030] other info that might help us debug this: [ 569.531012][T18030] [ 569.541294][T18030] Chain exists of: [ 569.541294][T18030] major_names_lock --> disks_mutex --> &mddev->reconfig_mutex [ 569.541294][T18030] [ 569.554803][T18030] Possible unsafe locking scenario: [ 569.554803][T18030] [ 569.562295][T18030] CPU0 CPU1 [ 569.567751][T18030] ---- ---- [ 569.573156][T18030] lock(&mddev->reconfig_mutex); [ 569.578193][T18030] lock(disks_mutex); [ 569.584804][T18030] lock(&mddev->reconfig_mutex); [ 569.592364][T18030] lock(major_names_lock); [ 569.596888][T18030] [ 569.596888][T18030] *** DEADLOCK *** [ 569.596888][T18030] [ 569.605037][T18030] locks held by syz.9.4076/18030: 1, on CPU#0: [ 569.611298][T18030] #0: ffff888065ab6358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 569.622124][T18030] [ 569.622124][T18030] stack backtrace: [ 569.628028][T18030] CPU: 0 UID: 0 PID: 18030 Comm: syz.9.4076 Tainted: G L syzkaller #0 PREEMPT(full) [ 569.638981][T18030] Tainted: [L]=SOFTLOCKUP [ 569.643306][T18030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 569.653369][T18030] Call Trace: [ 569.656660][T18030] [ 569.659598][T18030] dump_stack_lvl+0xe8/0x150 [ 569.664217][T18030] print_circular_bug+0x2e2/0x300 [ 569.669262][T18030] check_noncircular+0x12f/0x150 [ 569.674226][T18030] __lock_acquire+0x164c/0x2de0 [ 569.679103][T18030] ? prep_new_page+0x22/0xb0 [ 569.683711][T18030] ? get_page_from_freelist+0x22a1/0x22e0 [ 569.689480][T18030] lock_acquire+0x115/0x350 [ 569.694010][T18030] ? blk_request_module+0x35/0x2a0 [ 569.699156][T18030] __mutex_lock+0x197/0x15a0 [ 569.700337][T17825] veth0_vlan: entered promiscuous mode [ 569.709223][T18030] ? blk_request_module+0x35/0x2a0 [ 569.714354][T18030] ? lock_acquire+0x115/0x350 [ 569.714425][T17825] veth1_vlan: entered promiscuous mode [ 569.724523][T18030] ? blk_request_module+0x35/0x2a0 [ 569.729666][T18030] ? __pfx___mutex_lock+0x10/0x10 [ 569.734698][T18030] ? find_inode_fast+0x5dc/0x740 [ 569.739635][T18030] ? find_inode_fast+0xd2/0x740 [ 569.744487][T18030] blk_request_module+0x35/0x2a0 [ 569.749425][T18030] blkdev_get_no_open+0x3f/0xe0 [ 569.754276][T18030] bdev_file_open_by_dev+0xa0/0x240 [ 569.759478][T18030] md_import_device+0x2e9/0x650 [ 569.764332][T18030] md_add_new_disk+0x3a3/0x1850 [ 569.769186][T18030] md_ioctl+0x2027/0x2630 [ 569.773530][T18030] ? tomoyo_path_number_perm+0x219/0x5f0 [ 569.779168][T18030] ? __pfx_md_ioctl+0x10/0x10 [ 569.783844][T18030] ? do_vfs_ioctl+0x11a7/0x1570 [ 569.788699][T18030] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 569.793736][T18030] ? do_futex+0x3e7/0x4e0 [ 569.798094][T18030] ? __pfx_md_ioctl+0x10/0x10 [ 569.802784][T18030] blkdev_ioctl+0x5e3/0x740 [ 569.807288][T18030] ? __pfx_blkdev_ioctl+0x10/0x10 [ 569.812335][T18030] ? bpf_lsm_file_ioctl+0x9/0x20 [ 569.817373][T18030] ? __pfx_blkdev_ioctl+0x10/0x10 [ 569.822424][T18030] __se_sys_ioctl+0xfc/0x170 [ 569.827028][T18030] do_syscall_64+0x16a/0x530 [ 569.831619][T18030] ? trace_irq_disable+0x3b/0x140 [ 569.836644][T18030] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.842705][T18030] ? clear_bhb_loop+0x70/0xc0 [ 569.847377][T18030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.853264][T18030] RIP: 0033:0x7f88d87a8f19 [ 569.857685][T18030] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 569.877288][T18030] RSP: 002b:00007f88d958a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 569.885705][T18030] RAX: ffffffffffffffda RBX: 00007f88d8a26180 RCX: 00007f88d87a8f19 [ 569.893681][T18030] RDX: 0000200000000080 RSI: 0000000040140921 RDI: 0000000000000003 [ 569.901648][T18030] RBP: 00007f88d8837f6d R08: 0000000000000000 R09: 0000000000000000 [ 569.909616][T18030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 569.917586][T18030] R13: 00007f88d8a26218 R14: 00007f88d8a26180 R15: 00007ffce143edf8 [ 569.925569][T18030] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 569.951527][T18030] block device autoloading is deprecated and will be removed. [ 569.951592][T18030] md: invalid raid superblock magic on ram18 [ 569.951605][T18030] md: ram18 does not have a valid v0.0 superblock, not importing! [ 569.951651][T18030] md: md_import_device returned -22 [ 570.070248][T17825] veth0_macvtap: entered promiscuous mode [ 570.072903][T17825] veth1_macvtap: entered promiscuous mode [ 570.080822][T17825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 570.089600][T17825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 570.115345][ T53] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 570.115388][ T53] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 570.115417][ T53] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 570.115448][ T53] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 570.149774][T17478] svc: failed to register nfsdv3 RPC service (errno 5). [ 570.149793][T17478] failed to unregister tcp with rpcbind [ 570.166053][T18016] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 570.543493][ T86] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.543529][ T86] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.644604][ T86] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.644641][ T86] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.705919][ T86] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.729653][ T86] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.791196][ T86] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.791248][ T86] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.901572][ T86] bridge_slave_1: left allmulticast mode [ 570.901597][ T86] bridge_slave_1: left promiscuous mode [ 570.901730][ T86] bridge0: port 2(bridge_slave_1) entered disabled state [ 570.913727][ T86] bridge_slave_0: left allmulticast mode [ 570.913750][ T86] bridge_slave_0: left promiscuous mode [ 570.913891][ T86] bridge0: port 1(bridge_slave_0) entered disabled state [ 571.129785][ T86] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 571.140647][ T86] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 571.152489][ T86] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 571.154605][ T86] bond0 (unregistering): Released all slaves [ 571.487985][ T86] hsr_slave_0: left promiscuous mode [ 571.488465][ T86] hsr_slave_1: left promiscuous mode [ 571.489074][ T86] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 571.489096][ T86] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 571.493625][ T86] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 571.493653][ T86] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 571.545098][ T86] veth1_macvtap: left promiscuous mode [ 571.545148][ T86] veth0_macvtap: left promiscuous mode [ 571.545227][ T86] veth1_vlan: left promiscuous mode [ 571.545313][ T86] veth0_vlan: left promiscuous mode [ 571.735506][ T86] team0 (unregistering): Port device team_slave_1 removed [ 571.740649][ T86] team0 (unregistering): Port device team_slave_0 removed [ 572.148759][ T86] IPVS: stop unused estimator thread 0... [ 572.227084][ T86] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.715253][ T86] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.757914][ T86] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.793487][ T86] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.854539][ T86] netdevsim netdevsim9 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 572.854575][ T86] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.910551][ T86] netdevsim netdevsim9 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 572.910587][ T86] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.957704][ T86] netdevsim netdevsim9 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 572.957740][ T86] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.024575][ T86] netdevsim netdevsim9 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 573.024612][ T86] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.105394][ T86] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.129589][ T86] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.184390][ T86] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.240524][ T86] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.294874][ T86] bridge_slave_1: left allmulticast mode [ 573.294900][ T86] bridge_slave_1: left promiscuous mode [ 573.295041][ T86] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.296540][ T86] bridge_slave_0: left allmulticast mode [ 573.296561][ T86] bridge_slave_0: left promiscuous mode [ 573.296686][ T86] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.325109][ T86] bridge_slave_1: left allmulticast mode [ 573.325135][ T86] bridge_slave_1: left promiscuous mode [ 573.325288][ T86] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.326857][ T86] bridge_slave_0: left allmulticast mode [ 573.326876][ T86] bridge_slave_0: left promiscuous mode [ 573.326995][ T86] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.363892][ T86] bridge_slave_1: left allmulticast mode [ 573.363914][ T86] bridge_slave_1: left promiscuous mode [ 573.364049][ T86] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.378517][ T86] bridge_slave_0: left allmulticast mode [ 573.378539][ T86] bridge_slave_0: left promiscuous mode [ 573.378676][ T86] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.544735][ T86] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 573.546943][ T86] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 573.547955][ T86] bond0 (unregistering): Released all slaves [ 573.612812][ T86] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 573.614441][ T86] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 573.616822][ T86] bond0 (unregistering): (slave macvlan1): Releasing backup interface [ 573.617227][ T86] veth1_vlan: left allmulticast mode [ 573.618063][ T86] bond0 (unregistering): Released all slaves [ 573.676553][ T86] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 573.678222][ T86] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 573.679794][ T86] bond0 (unregistering): (slave macvlan1): Releasing backup interface [ 573.680296][ T86] veth1_vlan: left allmulticast mode [ 573.688902][ T86] bond0 (unregistering): Released all slaves [ 573.807052][ T86] tipc: Left network mode [ 574.389061][ T86] hsr_slave_0: left promiscuous mode [ 574.389473][ T86] hsr_slave_1: left promiscuous mode [ 574.389974][ T86] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 574.389990][ T86] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 574.390495][ T86] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 574.390511][ T86] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 574.407199][ T86] hsr_slave_0: left promiscuous mode [ 574.412870][ T86] hsr_slave_1: left promiscuous mode [ 574.413433][ T86] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 574.413450][ T86] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 574.420572][ T86] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 574.420590][ T86] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 574.480516][ T86] hsr_slave_0: left promiscuous mode [ 574.480958][ T86] hsr_slave_1: left promiscuous mode [ 574.481480][ T86] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 574.481496][ T86] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 574.508282][ T86] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 574.508302][ T86] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 574.529736][ T86] veth1_macvtap: left promiscuous mode [ 574.529790][ T86] veth0_macvtap: left promiscuous mode [ 574.529914][ T86] veth1_vlan: left promiscuous mode [ 574.529984][ T86] veth0_vlan: left promiscuous mode [ 574.530684][ T86] veth1_macvtap: left promiscuous mode [ 574.530739][ T86] veth0_macvtap: left promiscuous mode [ 574.530827][ T86] veth1_vlan: left promiscuous mode [ 574.530895][ T86] veth0_vlan: left promiscuous mode [ 574.531705][ T86] veth1_macvtap: left promiscuous mode [ 574.536662][ T86] veth0_macvtap: left promiscuous mode [ 574.536767][ T86] veth1_vlan: left promiscuous mode [ 574.536849][ T86] veth0_vlan: left promiscuous mode [ 574.828140][ T86] team0 (unregistering): Port device team_slave_1 removed [ 574.847004][ T86] team0 (unregistering): Port device team_slave_0 removed [ 575.006426][ T86] team0 (unregistering): Port device team_slave_1 removed [ 575.028884][ T86] team0 (unregistering): Port device team_slave_0 removed [ 575.192954][ T86] team0 (unregistering): Port device team_slave_1 removed [ 575.198242][ T86] team0 (unregistering): Port device team_slave_0 removed