last executing test programs: 27m12.936090854s ago: executing program 1 (id=3174): socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x1, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a20000000000a01010000000000000000010000040900010073797a300000000040000000030a01080000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d657461000000001400028008000140000000120800024000000019140000001100", @ANYRES16=r1], 0xd8}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000810) 27m12.351799577s ago: executing program 1 (id=3175): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @flat=@binder={0x73622a85, 0xb}}, 0x0}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0xe0, 0x0, &(0x7f0000000a40)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x2000000, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000740)={0x30, 0x30, 0x30}}, 0x400}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @enter_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000980)={@ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/39, 0x27, 0x0, 0x27}, @ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/184, 0xb8, 0x1, 0xe}, @flat=@binder={0x73622a85, 0x1, 0x1}}, &(0x7f0000000a00)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 27m12.288820842s ago: executing program 1 (id=3176): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000f40)={0x10c, 0x6, 0x0, {0x4, 0x8000000001, 0xdcc3fe75ae364468, 0x0, '/sys/\x06\xc0\xa4\x9eN\x00\x00\x00\x00\x00\x00\x00en\xdf\x00\x00\x00\x00\x80\x00\x01\x00\x00\x00\x00\x00\x8a\xde\xb5\x1a8\xc1T\xcc\xe9|8\x18\xf0\xb5\xb4X0\x92\n%EaFK\xea\xce\x86c9\xff6h\x8c$\xa2,\xc3\xa4\xc9\xf4\xc8\x1f\xa3\xc2wa\x8f\xc5G\xad\x15\x9b\xfd\xcc8G\xefP\xbd*\x98`\xeb]\xde\xd6\xd0W\xd3\x18\x93g\x18]\xe0\xfc\xd0\v{\xf6,\xd6\xa3\xb1\xfc\xbcG8u\x9bH\xb3;\x94\x891It\x0e\x9em\xad\x90\xd2\x92i)1LgS\x8f4z\xa4\xf7\x8f\x16\xeeCS;Kk\xdcE\xe0\x1f\x9b\xa4Y\x85\xd8\x80zS\f\xb7\xf2\xb2|\x88\x1b?\x8e\nu+\xe8\xbf\xdc>\xd5X\xe2\xfdR\xed\xc2\xc8_\xf0\x0f\x7f}\xc4\x91\xca?\x8a\x89x\xce\xd7u\x03\xe5\x88\x90\x9ck1!+|\x18\x82W[\x84\x05/\xccI\xff'}}, 0x10c) (async) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000bc0), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000c00)={0x28, 0x2, 0x0, {0x3, 0x80000001, 0x7}}, 0x28) (async) r2 = syz_usb_connect(0x1, 0x24, &(0x7f0000000100)=ANY=[@ANYRES16=0x0], 0x0) syz_usb_control_io(r2, 0x0, &(0x7f00000008c0)={0x44, &(0x7f0000000440)=ANY=[@ANYBLOB="200f1100000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@updpolicy={0xb8, 0x19, 0x1, 0xfffffffc, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x2e}, @in6=@local, 0x4e22, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0x80}, {0x0, 0x1000000000000401, 0xfffffffffffffffe, 0x40000000, 0x0, 0x0, 0x1, 0xfffffffffffffffe}, {0x7a, 0x5, 0x0, 0x7fff}, 0x8, 0x0, 0x1, 0x1, 0x3}}, 0xb8}}, 0x8044) (async) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000380)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r5, 0x40182103, &(0x7f0000000300)={r6, 0x3, r5, 0xc87a, 0x80000}) (async) sendto$inet6(r3, &(0x7f0000000240)="c8", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x1, @dev={0xfe, 0x80, '\x00', 0x36}, 0x9}, 0x1c) syz_usb_connect(0x6, 0x537, &(0x7f0000000980)=ANY=[@ANYBLOB="120100036cbc5d082d153905b2770102030109022505020a09001009049eaf0b561f080209050118ff0300010009050e00000402030509050e00000404f80113016612e4ef8fd37c87db2b81771c3e3d0e5a0905030c40000400ce09050200400040ae0109050a03000205040909050a032000f00000072501040a14000725010001e287090502022000097f08090508002000e8010909050900100008040e072501000d050009050f100002930f100725010ca8020009048f080eff061bde09050308000200c6080905010c400006800609050a10080003000809050204200004090d0725010809a4000905050220020281040c06e9e436e404a4a553c4430725010801000809050210100009044f09050000080080010609050902145a01400709050d0200020206060725010887fbffe9030bdbe92c7a80cbcd28b75ffa31be81d0d855446b2508f240f6a7b3e89360a7c768bffdf149bf74f8050aed0b0ff4a553e465576f72c8352ae9f923c267791b369a24ca55dde14d87651d0ca2b74cbc6c89549c29eb11e5f735a65cd31a5dcbc49d0d0261ef001edc3f8c5a02020b2a1ace697772439cc4689269cb2018f5e78d489a7b904b40aa173098184c5b7473c4b3202261771cc8aa0e2bee094bd61047728dce6cc250ee78e0161fd9aeffac1c4a6594bee90258bb47db368c92635ef84c74d58e90ca75e0b50fcc549b61f17722fb0a2a2996c4b66083657b2c028864107b70aace74b50905000040007f094bf623375305f04b1d489e1fa3544bf559d1e4b29ea47b755134b34d2dd0311f0cfe0672ea9a3fcfcce0275e55b3c7ecad1c79f9ac7c3628fb2c41554182067ec4064cb882704a2ed183edb2035ae2fba242ee841071dabfc83f17bf6e7aac05cf46cdd7b18da4521466cb3267246d222b63345f045746b09571a7b2e0f85a6c1621222a83698702660fa0c96846032501de91fde58721341b4a5c52adafb2d041ce8fdcfd56d358c6c955aff29b12c2e1ff2ea585230600d70616aae9cdc96271dbe3238baeede9cd50742014f2b3fad2054e9da69a277740104ed6919d3589e91dd1452701e9ce34595879eaf8a871f02e357414a352a222c90eca56b43b6e0ce4d5e7b9ca0192dc355b853ee77b9f5bd1c13337a193b091f4ccec9721a480d226f7b40ea05c7dc9f6ba429ab9d4938ddd16c791db182929c822cf29b2e0325306605d12f795254310f51ec157c35d5976a8524fbbdbbbb9dc2d61c4be5d66b646e4d03258b5162e949930ee943f708a969bd3dac43871127932200887436aafb6235ea6d29cda1c1cd38f3d58c4a834dce0485c272f865309050a1020000408ffc405294973ef9b784474ca7e3d5299ea7b67c2706c25297e350dfa8b50ac0b005647781250c6bc88ee5dd8f9e5bc8c3fd5c02d18b8b5cf56908448d15a0117821ff0da51be7a37112ef95bf19bc2e6405b72a94f01af439a749f5c9a80115f31d0bc76b60976a985fb57f7ed0116160d21ce74fc321ff17df46b6980a233df9a052da7fe2e08c4809ae4d6346c3bedd369129b49ad1eeab69e3a0fc9af9c866971d856145db4a977be4771f31026b012ae11136263d8db077a981e5f29e6353a92a0a3d8090506100800560c0607250108070400072501041c060009050100000203370207250104c0040009050e001000ca81067f0e7b0f1844a444be6524571b3f96b4fdee9910ebe9bf708d330c31361f5a1c5030eeea95492e898b37a0ff2af3149cfd1ced25d74de554794ba5d0c83ba1bba2814cbb83d039bde41f05fc9ebfc6d7b8ba02bf9e5804115c8cd1e1eeb0bfd2b4b8856aaaf5e804a4a21b7dfe4533b7e336ffd2bb88387addf3ddf07c2d59"], &(0x7f0000001200)={0xa, &(0x7f0000000ec0)={0xa, 0x6, 0x200, 0xd, 0x80, 0x6, 0x8, 0x8}, 0x5, &(0x7f0000000f00)={0x5, 0xf, 0x35}, 0x8, [{0x4, &(0x7f0000000f40)=@lang_id={0x4, 0x3, 0xc01}}, {0x6d, &(0x7f0000000f80)=@string={0x6d, 0x3, "fcc9f20cbb4db6ba6cb5f94176d731c167d5d442818190985070c38f91bec38593b4923e49f556ee0ed008d8eafd06e926f9ae5c79e5cc98bfbc1b05029e38d9b41e776da7b81737c9c2555d081722b9638289e5ab98094f103ebf83e2c3e19758509fbedeb002da276cce"}}, {0x8d, &(0x7f0000001000)=@string={0x8d, 0x3, "99336278ae31abe30cb9dd486d421346187775c0580ccc51cd727ea91f1e3f5691cec4c0a38d6036da927ab5dfc1d57fcb5f616ec70ec786fc55775efaf38522bbbea29d6466c9495e3d80c2a1e3ea1bbaaf3d4b734266d7d4b3f33e2509dbaebd8de31d232c8881303df83bf63d0b86477431932b080d17d20f202d18bf0be69501242655fad4bfc79944"}}, {0x4, &(0x7f00000010c0)=@lang_id={0x4, 0x3, 0x810}}, {0x4, &(0x7f0000001100)=@lang_id={0x4, 0x3, 0x41b}}, {0x4, &(0x7f0000001140)=@lang_id={0x4, 0x3, 0x44d}}, {0x3, &(0x7f0000001180)=@string={0x3, 0x3, '\\'}}, {0x4, &(0x7f00000000c0)=@string={0x0, 0x3, "2bfa53"}}]}) (async, rerun: 64) syz_usb_ep_write(r2, 0x3, 0x7b, &(0x7f0000000040)="8ac8231b91fa85b8fefc6dc1b35141828222e1574ee82e064cff7961644716f373b1dd4a2d93a71b12a5fa687a2422d318fb839eb4253ac8cb3c6d595fca3c3b021dccaed2685e7bf25929a43f240ec0e8369a04d9f1719eef1f1a33f0e2c106c03689c5a4e1d79048a70d4a7f0f4c0e498118179ad9e7a0a07fb8") (rerun: 64) 27m9.017737779s ago: executing program 1 (id=3186): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x14}}, 0x68}}, 0x10) 27m8.901045296s ago: executing program 1 (id=3187): r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x10) symlink(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0)='./file1\x00') 27m8.824427799s ago: executing program 1 (id=3188): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1001, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x3}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000016c0)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}, 0x400}], 0x1, 0x4000, &(0x7f00000006c0)="02"}) (fail_nth: 2) 26m52.114689982s ago: executing program 32 (id=3188): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1001, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x3}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000016c0)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}, 0x400}], 0x1, 0x4000, &(0x7f00000006c0)="02"}) (fail_nth: 2) 14m16.465520648s ago: executing program 3 (id=8766): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois', 0x8) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f03446b000000750001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x4000000) 14m16.30069768s ago: executing program 3 (id=8769): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000040)={0x191, 0x78, 0xa0, 0x3f, 0x32, 0x1c0, 0x0, 0x20000000, {}, {0x0, 0x0, 0x2}, {}, {0xffffffff}, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x1, 0x1, 0x0, 0xfffffffd, 0x3e000000, 0x8, 0x4, 0x0, 0x3, 0xa}) 14m16.164419874s ago: executing program 3 (id=8770): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0x0, 0x4, 0x1}, 'syz1\x00', 0x35}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000340)={'syz1\x00', {0x8, 0x2, 0x0, 0x1}, 0x3d, [0x6, 0x5dc4, 0x10001, 0x1, 0x2, 0x7, 0x1, 0xc, 0x8, 0x6, 0x3, 0x200, 0x1, 0x6, 0x8001, 0x7, 0x0, 0x8, 0x9, 0x9, 0x1, 0x3, 0x8000, 0x0, 0x7, 0x3, 0x2, 0x1, 0x4, 0x2, 0x8, 0x2, 0x5, 0x8, 0x1, 0x10, 0x4, 0x0, 0x800, 0x1, 0x7fffffff, 0xfc43, 0x733, 0xddc, 0x9, 0x40000005, 0x0, 0xe, 0x0, 0xe, 0x6, 0x7, 0x6, 0x4, 0x4ff0, 0x6, 0xfffffb3e, 0x8004, 0x100, 0x6, 0x4ec, 0x1000, 0x1, 0x8001], [0x3, 0x1, 0x8, 0xa3d, 0xe1de, 0x7c79, 0x1, 0x2, 0x3b5, 0xe, 0xd, 0x0, 0x4, 0x8c2, 0x4, 0x7, 0x2, 0xdf9, 0x626b, 0x4, 0x2667, 0x3ff, 0x4, 0x1, 0x4, 0x1, 0xf, 0x7, 0x9, 0xffffffff, 0x2, 0x8, 0xfffff6de, 0xffffffff, 0x1, 0x1000, 0x80000000, 0x9, 0xb, 0x6, 0x2000000, 0x3, 0x0, 0x6, 0x5, 0x7f, 0x0, 0x8, 0x8, 0x400, 0x3ce, 0x4, 0x6, 0xa7, 0x9, 0x7fffffff, 0x7, 0x6, 0x1, 0x5, 0x2, 0x0, 0xfff], [0xffffffff, 0x2, 0x41, 0x3dd3, 0x6, 0xe, 0xd03a, 0x2, 0xffffffff, 0x7ff, 0xc45, 0x6, 0x0, 0x1, 0x7fffffff, 0x5, 0xe, 0x0, 0x401, 0x10001, 0xa1, 0xffff, 0x4, 0x2, 0x9, 0x3, 0x8000, 0x7d9, 0x5, 0xd, 0x3, 0x70000, 0x5, 0x10000, 0x5, 0x3, 0x1, 0x4, 0x3, 0x0, 0x10001, 0xf, 0x2, 0x7, 0x40, 0x0, 0x0, 0xb07, 0xfffffffe, 0x7ff, 0x0, 0x40, 0x100d4, 0x7ae, 0x7fff, 0x82d, 0xfff, 0x800, 0x7, 0x1, 0x6, 0xffff, 0x7, 0x1000], [0x1, 0x9, 0x8, 0x65d, 0x7, 0x7, 0x1, 0x8000, 0x2, 0x1ff, 0x1, 0x80, 0x5, 0xf, 0x7, 0x30f, 0x1, 0xfc, 0x3, 0x80000001, 0xfffffffe, 0x653, 0x8, 0x7, 0x0, 0x9, 0x7fff, 0x3, 0x1000, 0x3, 0xd45, 0x0, 0x3, 0x3, 0x9, 0x2, 0x5, 0x2, 0xff, 0x0, 0xe, 0x1000000, 0x5, 0x1000000, 0xfffffffd, 0x2, 0x40, 0xe64c, 0x19, 0x1, 0x9, 0x7, 0x4, 0x9, 0x7ff, 0x6, 0x8, 0x8, 0xb, 0x9, 0x3ff, 0x1, 0x1, 0x1]}, 0x45c) 14m15.934306075s ago: executing program 3 (id=8772): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r1) sendmsg$IEEE802154_LLSEC_ADD_DEV(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="da0d0000", @ANYRES16=r2, @ANYBLOB="4d7e00000000fedbdf252a00000008002f000000000005003700010000000c0005000202aaaaaaaaaaaa050036007e0000000a0001007770616e30000000"], 0x44}, 0x4, 0x700000000000000, 0x0, 0x2004c020}, 0x4004) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x2b5b093, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ac00000000010505000000faff0000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff02000000000000009d0000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffac1e00010800074000000001180006801400040000000000000000000000000000000001"], 0xac}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0xac, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}]}]}, 0xac}}, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r7, 0x0, 0x15, 0x0, &(0x7f0000000180)) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4c36ab0700000004a5e74a000000", @ANYRES16=r6, @ANYBLOB="010040000000000002034400000008000300", @ANYRES32=r9, @ANYBLOB="080026008516000001000000c4440ee41560024b16410a06000000000000008b0d55a9d047e69a49dbc40b88b86e50e522c83c5118a2e679acd8e1f7855060aefc760525833d348de8e3d9df4dba1ad46cca34c42f6b86"], 0x4c}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r13 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r13, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000580)={0x28, 0x1412, 0x1, 0x70bd25, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x8010) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000026c0)={0x1c, r12, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r14}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40010850}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, r6, 0x800, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r14}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}, @NL80211_ATTR_4ADDR={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20004005}, 0x40400c4) r15 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) read$FUSE(r15, 0x0, 0xeffd) r16 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), r11) sendmsg$TIPC_NL_MEDIA_SET(r15, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f0000000680)={0xc4, r16, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0xb0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x47, 0x4, {'gcm(aes)\x00', 0x1f, "728116bb6733f0fc294d6e340d79bf9d42081f6384ddeb28165b2c803633a7"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xabf}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x35, 0x3, "e9384e0fa3fc5d2c395a72935c8506a35a2633455575bcd4fc41b40ab84c131094149b59af81391b0ee342ae044cc21f90"}, @TIPC_NLA_NODE_ID={0x16, 0x3, "539d09171bce938cd95bd46b86335979fc0a"}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) 14m15.478700499s ago: executing program 3 (id=8776): syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000940)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f002100028000001294", 0x2e}], 0x1}, 0x0) 14m14.023345762s ago: executing program 3 (id=8781): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x4, 0xea, 0x440, 0x0, 0x10, 0x0, 0x8}, 0x9c) socket$packet(0x11, 0x3, 0x300) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0xfffffffd, @loopback, 0x3}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x2c01, @loopback}, 0x1c) 14m13.655923524s ago: executing program 33 (id=8781): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x4, 0xea, 0x440, 0x0, 0x10, 0x0, 0x8}, 0x9c) socket$packet(0x11, 0x3, 0x300) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0xfffffffd, @loopback, 0x3}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x2c01, @loopback}, 0x1c) 4.803226794s ago: executing program 0 (id=14198): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109021b0001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = fsopen(&(0x7f0000000000)='ceph\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='ip\x00\x03cr\x80e\x83', &(0x7f0000000240)='.\x8bR\xafH\xd6e\x11\'\xec\xbb\xcb\xa0/\x1f\x16\xcf\xe2\xb5\xfc\xeb1\x12\xfdC\xb8\xa0\x01\xa3~\x971W\x96\xec\xaf\x1c\x91\xeb\xa8e\xfe\x17\x02xEA\x0f\x14\r\xae\xc1\xfe\x06\x12\beSb{~R\xf0\x06\x00\x00\x00\xf92\xce\x81p\x1fC\n\x9f(\x00\xc5\x1d\x9c\xccCq\x06\x1b-\f\xc9\xd9+\xa4\x14\xd8\xf4\xef\xf5^2\x14\xb8=\x03\x00\xd5M\x04\xf4{H\xd0\xc8\xf7\x10\xe1R \x9a^\xdfq*L\xc4lP6\x8f\xff&>\x94\x882\x1c\x00\x00\xc5\xbdD(\xa5\x17\x11\xd6\t\x12\x7fe\xba\xfc\x93\xf4\xd8\xb5\x04\xcb\x98\xd1QF\xe5\x1b\xb30x/\x86\x02\x1ct\xc7\x88\xd2\xce\xd5\x9e1\xef`\xad\x05\x11\xc9\xd8<\xc6~\x97\xd5\xde\xe3Eh\\\x84\x14\x9e\b\xe1\x9b\x00\'\xe8!\x8c\xc3\x97\x8a\xcf\xfc\x8fe\xa6\x0f\x8b\x912c\x1b>8\xc5\xa3_\xab\xf1\xf5\r\xb6\xe7\xfcS9\xd1.\x8b\xf3\xbc,?\xb2\x9aBDPY=r\xfa8I\x16\xa2\x18\xd4\xa5\x8b\xaf\xd1\x8a\xbb\x0e\x15O\xc9p@\xadaw\x84\xc9\xdd\x87a[\xdf\xc2\xa4\xf9@T/\xf5\xd1t\xc7\xeb\x04y\rr\xba^\x9f\xf4\xfb\xaa#\xf6lX\'\x03u\xc6XZ\x8eK*Zs\xdb\xcaV\x92\x84\xc5\x05i]\xb6N\xa9&a\xe6\xa1\xedgd\xc2\x8b1Kq\x90U\xe0\x9a\xee\xd6BdU?\r\xd2\x13}u\xf6\x9entz\vW\x04\x968\xc5v\xe0t:\xe0D\xe8\xca\xb8\xd5\xb0\x89\x90\x928\x1d\r\x8b\xf2#8\xf5rI=6\xa1L\x19>I\f\xe7\xab\x98\xd2x\x82\x820\xf6\x8b]T\xd1\xe0\xefD\xc3\x94O\xdd\\\xd6\xb5z.\xc9z>\xdab\xcdw\xbf\x91\x190we\xa5\xfc\xf9\xaf\xedA&\xd50\xa9\xf0\xbeX\xe8\xd0', 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000140)=ANY=[@ANYBLOB="40274000000005edaeffffffffff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001540)={0x34, &(0x7f0000001340)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0}) 2.566212734s ago: executing program 0 (id=14208): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) (async) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000040)=0x30) ioctl$VHOST_NET_SET_BACKEND(r1, 0x8008af83, &(0x7f0000000000)={0x1}) (async) ioctl$TIOCL_BLANKSCREEN(r0, 0x541c, 0x0) (async, rerun: 64) write$UHID_INPUT(r0, &(0x7f0000001640)={0xfc, {"fce3ad0eed0d07f91b25091887f70706d038e7ff7fc6e5539b0d3e0a8b089b3f383163030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c523c921b1b5b3107200773090acd3b78130daa61d8e8040040005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b0463dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a91e0dad47f36fd9f73c152a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b14ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e1c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df11847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5769e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e30400f7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50cac77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddba02635478d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f79400000000ddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df04b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f3752dc1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c976cfc7f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e785419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd502ac8044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c70004000000000000861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88e4facfd4c735a20307c737afa2d60399473296b831dbd933d93990f00064279b10ea0c5833f41f157ea2302993dbe97fb1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea10c00a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6780063183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb421f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeee964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e42df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa10746c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed62480ec43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db80100b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e069160f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2a302a97bc641df076f0ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f87296ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef869c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) (rerun: 64) 2.182660481s ago: executing program 2 (id=14210): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@fd, @flat=@weak_binder={0x77622a85, 0x1100, 0x3, 0xfffffff0}, @flat=@binder={0x73622a85, 0x1000}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 2.18250302s ago: executing program 2 (id=14211): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), r0) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000c80)={0x2c, r1, 0x1, 0x400a00, 0xa000000, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x2c}, 0x1, 0x2000000}, 0x0) 2.139066842s ago: executing program 2 (id=14212): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000140)) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'veth1_to_team\x00', &(0x7f0000000040)=@ethtool_pauseparam={0x12, 0xfffffffd, 0x1, 0xb1b}}) setxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080), &(0x7f0000000100), 0x2, 0x0) 2.023110524s ago: executing program 2 (id=14213): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000080)={{@local, 0x2}, @local, 0x0, 0x0, 0x5e, 0x200000000000, 0x100000000000006}) 1.869361078s ago: executing program 2 (id=14215): ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27"}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="38000000020109040000000000000000027800"], 0x38}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) syz_open_dev$tty20(0xc, 0x4, 0x0) listen(r5, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(&(0x7f00000000c0)=[{r5, 0x60}], 0x1, 0x0, 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r6, 0xffffffffffffffff, 0x0) 1.479868641s ago: executing program 0 (id=14219): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x20000, 0x0}, &(0x7f0000000240)="588d7acda0b2", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000}) 1.377220527s ago: executing program 0 (id=14222): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100"}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27"}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), r2) sendmsg$NLBL_MGMT_C_ADD(r2, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000c80)={0x34, r3, 0x1, 0x400a00, 0xa000000, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @rand_addr=0x64010101}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x34}, 0x1, 0x2000000}, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r4, 0xc0d05604, &(0x7f0000000140)={0x1, @pix={0xc, 0x0, 0x3234564e, 0x9, 0x0, 0x657cab4d, 0xb, 0xfffffffa, 0x1, 0x1, 0xfffffdfd, 0x4}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000001140)='net\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r5, 0xffffffffffffffff, 0x0) 1.288201494s ago: executing program 5 (id=14223): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000080)={{@local, 0x2}, @local, 0x0, 0x0, 0x5e, 0x200000000000, 0x100000000000006}) 1.260783113s ago: executing program 5 (id=14224): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) (async, rerun: 32) r1 = socket$inet6(0xa, 0x2, 0x3a) (rerun: 32) sendmmsg$inet6(r1, &(0x7f0000001600)=[{{&(0x7f0000000380)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5, '\x00', 0x0}}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000100)="a0002883781ecc0e", 0x8}], 0x1}}, {{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000000140)="d4ad69c575dc9862", 0x8}], 0x1}}], 0x2, 0x0) (async) sendmsg$NL80211_CMD_SET_WOWLAN(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000042c0)=ANY=[@ANYBLOB="ec050000", @ANYRES16=0x0, @ANYBLOB="200027bd7000ffdbdf254a000000080001006700000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900001000007f0000001c007580040006000400030004000900040009000400010004000100a40475800400080028011280ec00848004000080a000008008000200010000000a000500505050505050000008000200000000003c0006800800010008000000080001000400000008000200fc0000000800000000000000080002000400000008000200030000000800050008000000340006800800020001000100080002000b0000000800010008000000080000000300000008000200ffffffff080000000000000005000100a60000000800020001000000440000800a00050008021100000000000a000500899c4d496320000011000100f7f8008d095ce73857595902df0000000a000500f53e19b330b0000008000200000400000a000600ffffffffffff000008009e00001900000600f700090400000600f700010600000800dc00010000000a00f500ffffffffffff00000400020078010e800a000300080211000001000019000a004d61c61d7a68e74bcc74770f7b85a32430d6cd27e80000005500080005000000ffffffffd126de2ffd1e8c67e69876f20d0ec0a1ab28d92801dd77fab5a6ccc2582ccbfdc394479d906d6ba8f9985817bf138eaa46cefa4eca163f6363f3e97fe2ccbc6bf1e129d82296c3b9fd0000000a0003000802110000000000080009000a000000100007000600000008000000040000000600050008000000c50008000600000006000000830cf5288f3fcd00b1c953408332348cdb3c5e67af475ab81bc8636cbf0f257b34e6dab6f7290c7980def6a6949d13df37596730e9b4a1d8d940b6a73e7dd80bb72fad5da84be26de45a4f3daaa32348589d36408cbcdbd782bbf5b251fca94cbfb10d87f26c9f5fa4801e14e212596202b19850daa96ecf812738b58ec86362e5c8f689916413a1135199862e4dcacbe1a83a1817746f696692e15337d06418c21dbc3020826fda6248c0a37a155857ac22ff0dbd0b57e486000000ec0112800800dc0000000000e0017d80b9000000986601911bc7a549ea6a67eeb811794bbc88c22eb57d7500caaf5bf21a8d6cecb6ba756faef08041a58718500cb990027ae22967852bee46650b48a3d5cc76386ea55ce19b6b88fe03bf33464ba44825b7e1c6fab413ab7a0434b3c4ffe0d532732de767bf531045d1d938f88528ce2ac965f5d13d12aae0f28d7167fca02c17ff26767e0fb91cb7925bc16acc7ccb71884ef144a614197c9ac985497e42fae0a38b2473df16b1f99d5b33f8a851e2984804c52a3000000089000000f55ac8322b4155d3e284ba8d138c563b4f2cbd6b0fb8e2a5d80da55f49bb05d369ba4f8ea03daa23476de436f8dcb0a8ee468ad06727a7a331eee2240b6e7870dc2fc73d9cc42a6e7067590ee6e2cf26dfb01a4295c764201d82ae3dc0dd7775ae5abca224e4899fa6af331bcd8d0888bd18510134534ae2db57ea189abc462cdfb7005ffd00000091000200e230e5ee156041be576147c8f2a55568607552647c92f77907c90031bae2dfdcc2458d90e4b9516aaa87ae75e54303e69d820e59d3eed34f734a59441600e8276408bfa07cfd4f5cb023f44e06beddb9cd80e59b449d0009a7aee6b6ba8c00cd3445fd364559a3be2fc67d421c9cec9031d79301c796bb301af2b035afded20febb3874c6802cd658061d89efe000000040001000400090004000600fc00758010000e800a0003000802110000000000e8000e80c100080081000000bc000000d283086d607f69fe74aa7cfceacfe07b948ceb15d0a130af4613737fbfe114a922168a96638e30839d1670fd23346108ee323c704f6b552dc3af7db8be2a8366209b80807ff056545d7cf756be62d8e3ba4a9f53cadd401d8e0c4335908b2fe63858e0a772a07fab71263e2064fd1d23d6c4458b249a5e668d7fd6ca5673c0ca42ef2e8c6f516375487487ca5580d6ea7146dbbd8db42ce6e8e526c18974e16ace377bd168f8c235252ed5315caee50270ad31610a000000100007000c00000003000000ff0000001000070011dd230d0000008081000000"], 0x5ec}, 0x1, 0x0, 0x0, 0x20020080}, 0x20004004) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000003140)=ANY=[@ANYBLOB="c01800002000010a00000000000000000a0000002c01018028014880ed00a90013466820cd76bb221fbb4acd690c6a8b9c760a61eeec7793b579aefdb936d00f403d3f04637cdb9ac70e28c5dd66ddedde2d0930650e6821f9a26a4a193c1d06a3e75523f901e44fe087ae32c836c6d6ddba3af8e9a2beae8936168f9fa38c395f5cf7408df69c60bf584bee86a6312e9ce866e456c3eda6f2924082d78a2f385bdbd0c9afb54758c102bf13094645fb6aa34d424ec776691fee3d25307f61fed2752babf7c686e8a3d9b59a8343bcf4121bf5cf400a0c1070855fac565cad8968a97ce0a12a1161054d82d0a240b7dedf9ba3cc63e9d1c3b9a8402f7d5b4cafcd48928a3d4a76498900000014007c00ff01000000000000000000000000000108003d00", @ANYRES32=0x0, @ANYBLOB="08001a00", @ANYRES32=0x0, @ANYBLOB="06003800d8510000040049800400e0801a165c80f928efeadc95a00c88d81d8d36eb021f05e357ce0cc80496d946a14b733a0b75dc0e0fe7ec451e3304efabb148cf7740d92633549fc799efeffbb500bf6a3db52cb6551af05b9d13a338392b5a8a8a21422903ac79280ba0651419590f6126813018282ea112a8c697e421a55ef2aac7340a5736e3d51504d8c7f023ee72b55ab9a1a1195cf9edf01e30447d1e000ce0ec914a9a6ae232498e74bcd19c01b7086e3fec56b754ab12185fda15b9525dec81f973a9c4bc9e3346f077651b64733a62e0536a41b5d896c07d71bb8b256ff30493694ca27c654b9cdfd0721dcef4726d97a2974dc7d8e373b0a60174bb0800ee00", @ANYRES32=0x0, @ANYBLOB="0c0043001700000000000000fd11358084a64c4852ce59bc40427a1582ec7e9547999b7be18d57542e2971a2513a2b81d76f6ad9a7ceda50a48bcd2786f06ffd040009808cb297f99a3664c1952c24e42f729fc43262610d3652cef336adc19ee56c82ca3e707eb78d0148b668305d97f7ec33db8e3e9dc65e7c274e7bc24ed3a1184621df12504c07b14a737fcc8ef9009b890c6caeba9729fbfeca6b12211869a2716ea36f7399a7bd7c0f2377c94cfe62f2bcbff380ee256a7c3ec69110da7f9a6d89254f4ec5b539cbc7303ccdc6a8619996b6263165fa024adff951d4d8d2d6587b80d1c30440b0817f52c341360dc5df31f0b5639a5b96e26938d5bc55ea7bef35a4cf126c9183ac38fb34b319abe5f06082c1e8ce526cdb3066d523d12deb8697d8299c1f5edf46514913c4648f2fd1816a58beffaab5040d72e67ac75075da4c92fb2c60d17ee03c6cc004ceb9ef5abe60fe300faa63e19f5eefa54eaed41a4fa62c6a56be9ee7f691162545a8fd930f45517df0436b69efc7d5ac19e930a92ef86472205f87a61dd95dc35a6f258c8c7958a8175e8cd8dbf01f82cca2359aef93e3eb117014c231d67bc6da5248aeac9543ff47663c01581b945dd8507adb1689ac8244b010e66087ffd4c0b930f8ffc7408402d8ce7db0cfd9830cdd85aab9711919563d56d245801c371f040af5b8169de3c6fea317612f4c2317cc526e8ea8c8c1e953c791b20a1aaf4c62f6c906efa621b14e7d3e285aa55b7ef96e4feb652df2cf36e76132f396cedb9db9cf15eeaea7b13e1027ea5d1f5490e6688884e1f1df2a9853024e581c9ae87c12991f4f89aabc4020df65ac4683de032022e2d805273b2d6a62e841a74be316f2152002b87680d37f6b7faf2b24be1ebc0d7a95fc330a592d044fd05ed37465086402a1335ce622bc8526afbc6aad8bb1bc0b63bf46ff0496a8861f0ee2c990adaf568144fb15eb4492e049f762fe735ddf5d283433a9d2fb9faff70364046ed11752282c816611250cc1e14272470c12fbd96a06bd3b873da306810ed786bcdb8983bcc7acf941b819c4f59b132e6c81639b46b8ba630ae11e4751458aeaa9dc2cee291652e638a28d47ecd5e2df8830bc7267883dd7d77fe2392aa484b6dec167a1bf3e00c927b26832f5f8d67f5d1c0c935624bc6c917001dd4df77aea734fa05d4037db5b19cef7d161c5ad1e95b40dcdd369358fada0a2a04d7a99f0b93386f706aa3213c1c4428b8461062b29683b29e56748a65154e9c33eafd6dac22c2ef4f55c4ca8e4a6c0007b31305254a27425066fec4b41e11c8357bf67ce8e2a0facb1b26e1b19543cd5f075cc81b0873ec57bc7edf9a9fb8ae35d3a3ace676225b40a421e645301f304221763ecab8baa7515839ca7f29e9e646af9a1ff1fe8031b5b36a8f2d6d70ae3f514f1c2972df04bb4924373d39301c8708bdf1376d3be64f3614c183c5b5cf95edaf20d2e59ec124eb11526a7f2d28546b31566e161ff39233762c0e4b505f246454f3e27f8dbbedf1610464944ea873600ed8e95fa00d291fa3b1d9cb257ca29710f473ce1de492602202f23ab8102ec101110145fbafc73f41a830decc8fc46a9f8925e091fec25f87a69fa23f63621533da3e4f97d2ad78c1886b6783e46e2923fbc424bb010e5d586e5fce6f5191c161aac64eec1c3afb12b2c6b2047c9c9db9d6beeb10de8b1d8ed9b857c3c7e7c3b59e374c6a7407ef247c178147b3a0f82f8588b74ddbab03d4c78915750c463f68bc8f40f8e4ba87169bf6377c54d21d5a62cb0dcf466daa235ad887f5d2af2d8dd827047847190afa82fb866744bbfd38952705530e699270b1f13dc0b53fdc2de61de45ab153fd017274bb3b4b4c8b9fa2279dc3a6940e072e9fe87bc86011dcc0c1ab07b97868b0f51ff6208df234a2f5a10f896478a4c5d46ffbafaa810b45bb82368d0085f78e959d1b0f26dd7cff09a40d0d12285b1ccf203ef25f3a1cb5fd753c6aadf2a26c1a21b6355ec2ef8d29ac0f08cd44e94f9a9f6b8558c3e5d7db20ce3a8f147c0309fb3f4b856dec934af6072bc942de440d8cd0ec1944362cb579f75a91393e3ebaf5fc807c0df8367834bb0f08ca7c698991662d8b9e9e55dba84b968d316fce6311e5257ccf69348e06a693595bb94bdaba080fb1c0c88a33557c088a51948bd4f01c5544e9fbf5a8e09ae0dff397ea8522a4349d185f9a2f0b595093b29b88b5e2007e12e6b60ae8aed88bbc198dc7709c5e9181ead6ab91a0b7df795a0e9d349c1096bb29bf2e0643a0afc2f2ac9ffe3e5002a796b025da52dce5d89a8d76499a25bb4588202c18a12107b1fb9759f904ca3363921ed36d1fb3f0af559e771b0a708e26b39f00a87cf2e8489f53a6c0ae606ea8ced1b876895c1c21ece89b1955c4d827ffd4da4b994eb2dcff368ef534b34f6a566efd9480f1b6e308947684dc4960a083d3cf52960be62cf0c0d4ce6d256ff28141c274b7dc8dac819c04d4f1155a8bb4c29a2a00535ca4ea89ce1e218146b73e2103fadcf2c2de446e6c128cbe749c5f7aaf392e764a9397e06e443cb3e44d08af9a2ce55b0ef8cf1803f2167a67d59547d522d65934fba7875301db570cc4424f629a39a7bd36333029bdb818a3739f454966af6ffe4d237d6965cc81f335d8a787450abbe7c8ddfd2f8b749594cea4df455cdfb5eb5f7b0b4f67875adafb11b61639fd0be25bbf0d19cea430058fff31b0fb0ae36a84ad6ccd17038638fe38905fc24384bc60a15058c6b6defe60ed71c7697612b084d6a2cd0b15056f593335906c82265f38c47dcc1c1043da1ce74578a1919e03df4e155396b3dea89acd39d1449f00a9e8cf5ceb0684928432d21e6b7e83c099d285c126a430767e1e718c9dcaf83ae26120ed83c95d7d16a493d16c0a01f8bc05ac987bf8e378d7c8d28c201930890773c1d6ab6440cd3ff2454f17ced7e463d9753891a56833f5f673eb138d7e7ce6666b65ea74f6f0d3cc2d86dd7940ccf108ef7f0ad3c5c7da744c1988aee2a7fa5fd1bf52698221c6ed21de5077effb9bdb50b882523fa932bd1e3efe50b630599dfaf3b13167f57db1a12caeb51278b7fbd9768da62d45b1f056aac361b2da6cc4933a9159379a4152ad66a69362e347af0d414e8716c9869511034c2a366bfb5b125cfc5720c05af7895f4e318d89e85ad02e76c0d643b77c3bbab28865823d696dc5306e1731f56c29ddd25e378749493c762d9966e34b53049a84f4da9ff286bb20ea8c6918ae6df35bd82719ab07d197afe2c87cace76d139175fcfbb8ebc49a131d484244295baca1dec61526a5f844a6950899a0bfc13417b3df9b6580e5657a0d92bab2cfaab91e1513e0cb11c0f029841bf63da801ed3171aa7c039b45675b9197924a5429feeb52a7152d4b82304ff39f2d666edf8ccbfb35d2eee45af364ba98cc978ec7f4f361c4a9fb2bf1155e059c9874c9b00113b6d85ccfbeeb3bf33435ced0c94135a00162d1a1279041fca05ddb2ac02a0a34bbb15f5aac25ac3cdcc32cbb882b6456602bd011cb665661b483b20bcb6cadaf993b3d6fe59757e9fd2b00ebc3b6adfca5bd7bc016eac63adc33f450303dfc89a025d2e3e7fa99854cd468654428c4dbf40b078b24c939882bff81d871d19383b86a5d78e3dc5f53bbf31c56c9ceb28c43179b0f9829d9fdb9c126eaeee6858de67dc6cf0f75552fad19ab1dd381dfaf963790353816b68c1e4e0938d1312746e90d5ed32c32be83f2e1890ce24bd3594b8393280937ddd35475106a0336a61ef483202ca11d58dbb4345c5d68b41e949ad32a36b86983950a12dcb29e02b31880d041805197670fc30c8d6c30f736de8cf7955dd8ae6a46d6fa0d9955056abe5ef41acc00f94f9466327fa207f1f85aac9baceb25fcde2e8f1c6c5f68a66a62a7165c29afb66a17932c892fcd6c894c54abb3f56bbf1dd5901a60b2dc2a51615e6897e894aa15678403ce35a2dd94a31d03092a92e54be81c53adfefa653c00f63a76f2d6471625df5ccfdccffb30e1c545e435c3b3fad6249246d3c2f5796514a899d87905ef0a5bd1032c4718b467dc2df510183beb72b9140cf670e82c649460d782cbf33791088756a796c48d0f7df2b856a4b3e2914c7f8e707a05ed5956473c8eeca35aeb2b96c939b5bfd874e519b9d624e5b3fde44de50c1e9ccbd2642638ab2c1de38127c4c59c5d5710d82c619b634151b0fb1bb94a357e2e38b888f8fb30934009fbee693451b343f0cd656411565e4149433383a8ee7194bdf3907f8a9136296188c74bb3fb276da9cc275101882ac5046fa42b9142efce704014b17b72d0a7b2421b5efb3a0411da62d42019bf78d6a6c5c56f3e8e5fbd0240547c6db5404f1218ab391f361a5ecb9c2cd64c32693ca8dab991688b496daada1d02b5d9cd1b9df7f1258e1a9a70e22f229078b0b33f30cb3e4021335a4392548dbf11dd0ab1c138571179412f35b4106f9bfc0c5bf57b63909a5fd8892a584569cb7b9c330417ae9468d6583f2c923060e156d4a8c69114ac5281b8104b3dcee2abe8b94b7a0551079f6bc89dfe3c521a046b70b1d2a9f1df20fda6dd84adf9e57b34b795ffd5b3dca4c62c815177744c2c21046861135e70fed347985962f5409580c263a72cfd878fe10192902948c6bab642fab9be6b9b93fe41fdea762a9c78d1631f81c4d76c3187d23a26ad0d37ba1f44114afe994c18f8404f7ed02956eeec1ab8c87b0cf8450146705817beec015783b22e6d9125179887dc74b162b2890ffbf8c3443bf732c125f7d2ba0f75d0f81198eaf12e1251e85a34ebd23087ba790d6ad8a6c4cf0c85d410fef6bf6796e9a4c25699dd8bf51063b65b46aa5ad69ed243722b5ac050672fd3ba0c2d8b5e013f403dda3c30db4ca94da891a6d90ac9cfda97c0fce5bf7ed8c0d4b309ece7bbf0f536fcce750495dca0ba52c0c2e1972763f973a28925d8846b6a941bfc9dd1e96b889112336b1530327eaaddcb78ab1db7c35c4ef54a2888f770de481f0a6ba5b827a5013b6c9c0f9e6e629d7f0f65d260ee4ad62061305ba91ec2a29c27dc22b4d07cd090a66705f062ef25f632eaa2842b36dcf2807abb94403c458d78453a5bf20bae90912372db3e4ba83e66928dad13a734ecd912cff58640e8c3b4012ab0fd32f8679875b0f46812deb0f143d8c94b2d0c8d0d9bfc7c1f5eb6609179e1e4119e6c240d8ad581233f4b2bc55c39f3e46f4516ab2b2ac271f773809718f80efc4cd4fc28ebb09d7e8429203127de4aee25cb61bef5d71a3fd7b43741bb8d0f0b530f4d06e2c92c632930c8fec4c6a2b66f43efee55b50254dac26cbefde31cef6d044ce90e61bec3affde7682a14fd8327358b09b3445cc4af0bcf125d43d458d8089176f238d4253fc0e3f7b3b72fbd88bca0973539fdcab07ca1da7027a50ae01a071e080dd04718a82dc0ef72228a84598556d2f85777e72b4227475313a779b7cbc5c80314f7358cdb1e4ab8e178ef933e7192c60304770262e4b99d476b8f42c8eb2b10ba6ba0dd51a52710ac75d49f29ff6abfd791755a88c0456513b7e47915855ddb6b5c38b5955cac22aa6f2e96a135540b2da8d22b4c83590e585185946caf2307af83e4a9fc809301cb53284407cd5ed383477e0a0a1852b0b94c1c382d5a192ac2fc705f7eb05f2655a5c0220bc2eb03b8132290d7a2a3871d4c93fb48f0521c10590f35a90b813155483a2d64a408d21bcae12b5bf8977a42c7cf6810d7b300fcfe7b780688d227dba545cdb8104fc31d873f2ca8afe8a8ee1c8bfdc13663d5f4509b836e3901e41128bd694fef92737864630545ffba4afac3acc7b49a870566f245a2a3ed34ff266ff66ef1f45ecf83f33f548746c3f2d0868a2b0fda71312475a1e601c8b71a7b9231afa40936c42f7d1e3d053dc7dbf12956654590f55b12c6c77b9d7372d9805a84d6f99040e21b9791c62dda870814a60dbf27c4a82f3979410091ef1106220f96627d8f7f189de07ca85e0dab440efe5b8fdc8d7e434ba6162f0b5df11c0bd6489945c946953a21a2d0f0e8924337f401f42f96a87c26f76e4e6623eca76b8c81aa96741b248e07cc8fccb203903da21d364640549640aff4016c83c6e2586893212706aedd30c4b2b2c9c205d1332ea492d4aad97c2646c8082b6d769b5f5d606bec26fb762adf1308325c1c2ec38e2cfa424e41513718625a7d7004a7de11f937d177eee3da060e04b4f1311957fe7897e5f43d32f4c3b4234c3afdf3b069432ac235046efbe4e243c071f06c155bbc48cdac07171b38253c0de4afea667572ebbc28894cd2f9e21992d4d696710a0250acc1a355d951146cd46883787104494c20ca9abb33b07bb3e54b8c5861a1425f4d989029844ecdde4d851e57c9d39d757f473d55e4b0f0aeff40b304d3e04f6e2e9394b1e172d7482dad0b3ca2568aa3297391d614f912a08003300f50000000400238000000008004f00", @ANYRES32, @ANYBLOB="0b055bfae918f58d7afbadef493d7e358a95c4e330bcf2a04bc03c39d71670dab91ae5b106d1c2843ce4304ea577f9d8a1a0f848d602b9800600d00023000000f9768407cc2561184d2c4fc38602f7f8b7e4d6b3bb83f9abe034d3786433df04f18ac95f6d7d3fd067778f4450b81274918a59ba3a86b640f0b2f491691fbbf30d5968d8cac55f7faa350f658846cbf96a27bd30c15510f812038d31664a2401cbc2c9e12721a435f68c7490e6f85b04973390512b4a52fe2b005b277d1a2cb4f6609b499d2b554549f538e79bb251b0fb6cba3c2bd4ee5c2a261e87f8df3edb54c1acb4056770de689c1d57b90400e280e2bc598ed974dc397766010698def2d7772b1038bb9c17e0763cb138433f1e202f1611d0039a04209f742c012cea110be51c9b094f857d693685c3b632090db81a1ed81922c1bca49c033497098432b5cac25c7d29faaac98f1299fb1dd174a79b15697edc8badb40500dbca74b1ebf60400c1808723e75eb0d3bf1d6a19c1bcd4235f17e1b00f7a41329670f7d087b53a6ec1ea26f9b87f7bbde89b7abffc784f40bf50bafb1754a0ec5cf72e9089b5d61b9740aa1c56f016dd00d7da62d26242bfc367d029cd67bcb19fef0163b26f5a6fea1270de2665889035884d5137da65ac46509dfb7cd208e92dcf60f2faf30a5e53c8a2e83b6ee7ab4bfc225320e76ea3c10f3d8d440cebb9868fcf5dc7f513157d7b8a9322b23b544ca2131d65720f9a9279715eadf1fc70e535f868a25b760d349e142202b7ad4b65b80befeef4f8c1386507a2321365931e6facedda8269229e4815e587b5fcc9ea37e3a0a58273b4376cd8eebac1bcfc597dfab36b14aa33851094d9441bae8a044afc9b7afb784bfbd08a9db6a0f26ba9dac482446a7277903c08f0c639639658e8d4e28a3147ec1ef16f645271a41e746bdcad23b9238399ff08de694cc9746e60f02c6660e7f9bc90e77b70983b5d90a2c21537512c878c1cdbc1248969b461e35ca569d572593cd7918d45c0f6de5e4a4adef3ddad9ac2fd4795d1cb54f10427f07f7eee39c1fdecd2a177fd764774524be8c9ca3e08004c00", @ANYRES32, @ANYRES32, @ANYBLOB="08001b"], 0x18c0}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) (async) sendto$inet6(r3, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x6, @empty}, 0x1c) (async) sendto$inet6(r3, &(0x7f0000000600)="0d0ad7c36d6617110e434332d6ac582208222cfb7c37ce1148f448455bc37f5f70c92774dcb201629979039d7c8943b207e5bdf9ab8eed9ace110469c51f4f211dd9fad815", 0x45, 0x5, 0x0, 0x0) (async) recvfrom(r3, 0x0, 0x0, 0x10042, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x0) (async) mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) (async) r4 = syz_open_dev$loop(&(0x7f0000000140), 0x8000000000000001, 0xa382) (async) r5 = syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) ioctl$FE_GET_PROPERTY(r5, 0x80106f53, &(0x7f0000000000)={0x15, &(0x7f0000001600)=[{0x1c, '\x00', @st={0x4, [{0x0, @uvalue=0x8}, {0x1, @uvalue=0x2}, {0x2, @uvalue=0x2}, {0x3, @uvalue=0x5}]}}]}) (async) r6 = socket$inet6(0xa, 0x805, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)}], 0x1}}], 0x1, 0x200001c0) getsockopt$bt_hci(r6, 0x84, 0x81, &(0x7f0000000080)=""/4060, &(0x7f00000010c0)=0xfdc) ioprio_set$uid(0x3, 0x0, 0x0) (async) r7 = fsopen(&(0x7f0000000240)='squashfs\x00', 0x0) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={0x0, 0x248}, 0x1, 0x0, 0x0, 0x4010}, 0x800) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000a00)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c09c03305df32bf337cdd0e550dff4a1ea8854a216b12f4a11b85a1b6ecb9ad8a50588e56db", 0x13d}, {&(0x7f00000005c0)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a78", 0x1d}, {&(0x7f0000000140)="f610e61ac81cc3edc86f0500194d27a5a443f10dfd1ecda0fd0ed9a444b7fb76afe3a0002f0a5eafcd3555a6cad574af080de74a37f54ee5f10fe3f42b445293ca980200000000000000ecfd6cc1b3a9a9263506e88c5557069d0ca055991454ec1307b7411892a1beaef9ae548331", 0x6f}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r8 = socket(0x10, 0x803, 0x0) sendto(r8, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async) recvmmsg(r8, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) (async) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) sendfile(r4, r4, 0x0, 0x7fffffffffffffff) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) 996.74716ms ago: executing program 5 (id=14225): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1, 0x0, 0x14}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x54, 0x3, 0xa, 0x5, 0x1b00, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_DEV={0x14, 0x4, 'veth0\x00'}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0x9c}}, 0x0) 916.392356ms ago: executing program 4 (id=14226): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000040a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a32000000002c0003800800014000000000180003801400010076657468315f00005f626f6e64000000080002400000000064000000160a0101000b000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00038014000100"], 0x104}}, 0x0) 880.926808ms ago: executing program 5 (id=14227): r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = socket(0x1e, 0x1, 0x0) connect$tipc(r2, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0xfffffffd}}}, 0x10) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x2, @empty}, 0x20) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x6}, 0x20) r3 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r3, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100), 0x890, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@directio}]}}) 828.457349ms ago: executing program 4 (id=14228): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f0000001400)={{0x80, 0xe3}, 'port1\x00', 0xa3, 0x1b0407, 0x0, 0x20, 0x1000, 0x0, 0x0, 0x0, 0x2}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x84383, 0x2300) 771.964014ms ago: executing program 2 (id=14229): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000000)="b8", 0x1) setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000040)=@ccm_128={{0x304}, "e9b172ecf2655b52", "7712b91180acb093fb6b48dce5ba7c41", "0711e4b2", "e9190a5ace69e884"}, 0x28) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, 0x0, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205649, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f909, 0x0, '\x00', @p_u32=0x0}}) r2 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @fixed}, &(0x7f0000000140)=0xe, 0x80000) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000007c0)=[{&(0x7f0000000a80)="4191062c1421f8d286fea25179d3bff67ffb95a24f597e0388f330e7dfb81fde917ae89f97d5fde0855ce2942ff541f21652a7409dad35f8886d587bb6e6dc67532c99235c3f4d65696cdb98986ca5f808b1b92c1a37bcf9109eb576c388dca33df6129f9efd43ccbd58a93f146ce183a410b8959fe192652e32068e0d8e24d8eab4ecbd5ebaa165771a07c890804037074a1ebad3bcdd46b8f34ecb2f4a6e1bbc6ac3d80ea44fbfedf338583f63ba4607f430acc0a98b4fcbb501006052cb83625cbf60ebf28e9095458c1e9971417b2912bbe30037dd5c1ac06f612816e97ac304404619b0c75222e9339f6ba14eac3c1486ac997f919248498f073eb173a9b70dd4e2df0b14c490155bf06e801547ed96f1264b5c220cf3f65681d44cd20b1b2b2067fa91e1c30217b0e5f65358b8b08301da7c4349eeec41fd9a50c651d12551ceb6a6fd4989751a4bbb244b9d3d260ebeb8aad132df7ef16f676632b532eb04529f9cde05e338a327f0ab114f7241b4fb5fc9ea1813dfd2c9fba8858541166adf9cfaa6a4b7d77272d0698f742bdea73a6424f0b586cf40cf6dc0ad5a4f886231e736e2d15ae7b54e799376ddcfb2b9a8c25d1bdf50eaf8565c2b3927b5887a961fcf7ffd6847ddb974e774e3a4cd7a7766ca85000000000000000000000080bf69b2a3cc51bc5ef5731b75b9b5e86f62364eda15937353ac8f5c016c82ad179390cad5fe8673ce804afffbf2ba6c0d204ab33119", 0x217}, {&(0x7f00000002c0)="09ec8b684fbd9f0a18960e84defd08b28dc2f98b5aad5cfeb075441d6d15233b802af831523479391b7297416ddff60a6500da9864b042a3105e6ff295aaff14d9077735f34eaec042e8252a6456999297ed02a01da56a3809f0c58184192ebf4bead7e8618412536273bf08e0f6847e436dc74f9afe55639834dc4c941dfb330a7b92b049700cb67e0f14337d8390091514253c2f2d4499d89b5f04759319e2c7b6856f03c69029b689f0be37093c79e8ff2405eb93cbfe5487143a294c3e61b0c9be8323cd4d01c37e5f5d4bf94546d02d4dc988dbb47ee61e5be16f4c7701cc671d250000ebbef22d7f2d931c963877fead2ab06279afc4ae478a7078a7bbdac4c800a22f128ee9bc899bfd5deb66020573afccbe51503025748defb54a535ea2b58349463561392e0524203e7be632e162559fc3b538b8338b4bf1e6de9bc735612bb2fc209ba7eb2dbdd06fed65af89e8b314b5a6b309e10c4a50d56fafac82f33c79cd5b0d4324fd65e76f059f29ab898eeacc72ff0299a6c439fda16e044b6ff9698edda863d6511e6b5a531197b508318d6ccaaac93baed37b29d42ba4f7bcec7bf73be10b83a7f88ac8bb8b245f53a1b2a746c2af0357c3adcd2c1a25e14bb3b4262c66becae48d37d8cb600200000000000000011215cd3644bf36277d9f48f3096366405f32fd866ee6a6eaaba51628919f78374a13baeb3c64efe1b36845e4ef44c545fcb86bf851289081cef3a358f10e49b5c923d729315ac0e6", 0x221}, {&(0x7f0000000540)="6a5b3986af4597e55298f14c7f201f060fe29efbdf16a0ace97ea54e624ac84ccc7fc7f393c4ece5273773faa8c63f157edf2a0d41a7c6340c630b50b30c42d156fa375b30d31bf60311fd29e60958434b6f595565bc1d534aae4c0693aebccc5caa31bf5b1c194f52c9f67c71a5edf623de000071d68ab2fd000000000000000000000000003239e56a1b026ba99149a712f4817121372f3569277b0000000000000008ceaa32b526ff0f00009e40f2f7fb2309521d9949b4a2324f3eda920dd580fda0debe5ab3cf7f7339a4d58875517a9dd823b0b0c66d3b9f023c216f104faab5aa1e2811e357e8d2c0cdb12f7d2511200492b37b69165ab789a331e490b5966706882a7818073c3586fbf619e627a9f60774e8fcc662e7f61722833fb1a512569e0ea6bb4f96164e06859c4e8d355f271488c686408133", 0x13a}, {&(0x7f0000000680)="f39a9e8346ddfd46e5ba", 0xa}], 0x4, 0x9) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r5) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES16=r5, @ANYRES16=r6, @ANYBLOB="010000000000ffdbdf25460000000e000100696d0000000f00eeff6e657464657673696d30000008008e00000000000c00900004000000000000000c0090000000000200"/78], 0x54}, 0x1, 0x0, 0x0, 0x8841}, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0xfffb, @local}, 0x10) connect$inet(r7, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) r8 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r8, &(0x7f0000000d00)=[{{&(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10, &(0x7f0000000a00)=[{&(0x7f0000000280)="7399142f8eb4c82ff4d540b2ab8632f03d0ce726304a826f2c478692c9a751a524169eefe59f5eb3bbe33acf9e15e212ec2829025d", 0x35}, {&(0x7f00000006c0)="e3d424d426c722a10354045903a5caa26c65ca02ccaafe4df16110d847499b894db82efc0667d4ae32168db6318f3f2a5e2702e47a773af29f87c808ac6bd2cd60111b61519a17b46586b7c9bc581ece084207b22686b5294a031dff1b5a3ac6cca09f6d80463e33d90fc0443b49dbc319d12913d207ebbd0638ade46614f2578716069bb72ec177c4ecad8e4a8831b7489169ae022a2ee2330e7053d853e642a200c59aa5b36bc802b476572a9288b689298e313663c2f69176afbde4c7f9926eb52f1f8031234da7abe7fe9f16479007bae7f8abad866bfb8d97133704b0f94caa46ccacb6ee847d0ce8", 0xeb}, {&(0x7f0000000800)="79aac081492130f77ab1d0106602adc4b0a86fdec69ab1c99623aa0c772424c7eb7449bf7993e71ec1827ff4f2bf8b408fad06a12806922db43c664908d3653150a9e8af56a52fa51985c1e97fa568730845e76e5348324b504872ee045e6cdc2e9f3dd8cba93fe16861f6d7662601b0e01bf078c087cd11f40a222f396d8188dcbf", 0x82}, {&(0x7f00000008c0)="c687ec9584d3a36050f912d6713dd0f5cb9d6cec54b7ba01a82cc00d587f09bd59c934795faca6305b32bbc5130a2192048877175dcf5251f1548271699d7789ba9aa4f4dccf7e54ca0a81916a65d8f110b61a39688ad1ff824a790b9cd68745c0bcb14eb2e0ddd1419350cbf809a8bc485a1fdc45c58147a73a8ae1073768e9e1882782855cc4eda656e2c65e489b2dbd67231153ce64db6d711488e4ac79ca18335b435f5d339ab575f7fb7013e5845a9e6f54351b94", 0xb7}, {&(0x7f0000000980)="547083834653d38dc51ef2484d6f381de8a17df06f411f4c804b3d9b60d86545c727c429223df15e155e3c709bf0629494c7127462adf27161826cb6fb3069cbcc534d80bb7b8d31cb5ee56b330781b71c112a770149bd2d5c9bc79b615991df393d34993fb56f43d75e8cdc7fc2ad13fe8d6d69", 0x74}], 0x5, &(0x7f0000000cc0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0xe}}], 0x18}}], 0x1, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r8, 0x84, 0x22, &(0x7f0000000000)={0x4, 0x0, 0x6, 0x8001, r10}, 0x10) splice(r3, 0x0, r7, 0x0, 0x2000000002ffff, 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0xc) mount$overlay(0x0, &(0x7f0000000d80)='./file1\x00', &(0x7f0000000d40), 0x0, &(0x7f0000000500)={[{@nfs_export_off}]}) connect$bt_l2cap(r2, &(0x7f0000000180)={0x1f, 0x31, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x0, 0x5}, 0xe) syz_usb_connect(0x5, 0x64, &(0x7f0000000100)=ANY=[@ANYRES32=r1], 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000080)=[{0x6, 0x2, 0x9, 0x3ff}, {0x15, 0x0, 0x0, 0x1c}, {0x6, 0x7, 0x1, 0xd060}]}, 0x10) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) openat$vcs(0xffffffffffffff9c, &(0x7f0000006700), 0x2200, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000002e00)={0x2020}, 0x2020) 744.567981ms ago: executing program 4 (id=14230): socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)='\\', 0x1}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = socket(0x1e, 0x4, 0x0) poll(&(0x7f0000000000)=[{r2, 0x8000}], 0x1, 0x6) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000001f00)=""/4062, &(0x7f00000001c0)=0xfde) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000140)=@polexpire={0xd4, 0x1b, 0x1, 0x70bd2c, 0x25dfdbff, {{{@in=@private=0xa010100, @in6=@local, 0x4e22, 0x8000, 0x4e21, 0x5, 0x2, 0x20, 0x84be0cf7f0636606, 0x3c}, {0xb, 0x8, 0x0, 0x100000000, 0x0, 0x6, 0x1670, 0xa}, {0x7, 0x6, 0xfff, 0xc2e}, 0x3ff, 0x6e6bbb, 0x2, 0x1, 0x1, 0x1}, 0x2}, [@policy_type={0xa}, @XFRMA_IF_ID={0x8, 0x1f, 0x4}]}, 0xd4}}, 0x40000) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRESHEX=r0, @ANYRES8=r0, @ANYRES16=r0, @ANYRESHEX=r0, @ANYRES64=r0, @ANYRES8=r0], 0xb4}, 0x1, 0x0, 0x0, 0x10884}, 0x4004) 730.404066ms ago: executing program 5 (id=14231): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0xe0, 0x0, &(0x7f0000000a40)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x30, 0x18, 0x0, &(0x7f0000000740)={0x30, 0x30, 0x30}}, 0x400}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @enter_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x30, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000980)={@ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/39, 0x27, 0x0, 0x27}, @ptr={0x70742a85, 0x1, &(0x7f0000000b40)=""/184, 0xb8, 0x1, 0xe}, @flat=@binder={0x73622a85, 0x1, 0x1}}, &(0x7f0000000a00)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 583.858647ms ago: executing program 4 (id=14232): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000080)={{@local, 0x2}, @local, 0x0, 0x0, 0x5e, 0x200000000000, 0x100000000000006}) 583.472947ms ago: executing program 5 (id=14233): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRESDEC=0x0, @ANYRES64, @ANYRES8], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r1, 0x3b70, 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f00000000c0)=ANY=[@ANYRES64=r1], 0x0, 0x0, 0x0, 0x0}, 0x0) 543.239472ms ago: executing program 4 (id=14234): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois', 0x8) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f03446b000000000001ffca1b1f0000001124c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x4000000) 459.338965ms ago: executing program 4 (id=14235): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$rds(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, @local}, 0x10) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$kcm(0x2, 0x1000000000000002, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000024002080060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0xd231c4f959ad4808) ppoll(0x0, 0x0, 0x0, &(0x7f0000000080)={[0x6]}, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x810}, 0x4084) 384.097746ms ago: executing program 0 (id=14236): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x4) socket$packet(0x11, 0x3, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000080)) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081064e81f782db44b904021d080006007c09e8fe55a10a0015000500142603600e1208000f0000000401a8001600a000014001000700036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe10000000001001000730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) (async) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x4) (async) socket$packet(0x11, 0x3, 0x300) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000080)) (async) socket$kcm(0x10, 0x2, 0x0) (async) sendmsg$kcm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081064e81f782db44b904021d080006007c09e8fe55a10a0015000500142603600e1208000f0000000401a8001600a000014001000700036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe10000000001001000730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) (async) 0s ago: executing program 0 (id=14237): ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="38000000020109040000000000000000027800"], 0x38}}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r4, 0x0) preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000040)) listen(r6, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(&(0x7f00000000c0)=[{r6, 0x60}], 0x1, 0x0, 0x0, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r7, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): C core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2060.360463][T10514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2060.403856][ T32] usbhid 5-1:1.0: can't add hid device: -71 [ 2060.404007][ T32] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 2060.421911][ T32] usb 5-1: USB disconnect, device number 27 [ 2060.597884][T30573] gspca_zc3xx: reg_w_i err -71 [ 2060.597944][T30573] gspca_zc3xx 1-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 2060.604918][T30573] usb 1-1: USB disconnect, device number 125 [ 2061.206870][ T38] audit: type=1326 audit(5337140413.761:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10531 comm="syz.4.13750" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2061.293320][T10535] IPVS: set_ctl: invalid protocol: 29 0.0.0.0:20000 [ 2061.312597][T10539] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13753'. [ 2061.814122][ T9049] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2061.990102][ T9049] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2062.058960][ T9049] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2062.130044][ T9049] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2062.198201][ T9049] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2062.956032][T10566] ±ÿÔù4—SÃ: renamed from lo (while UP) [ 2063.380438][T10549] wg2 speed is unknown, defaulting to 1000 [ 2063.478659][ T4341] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 2063.543343][T10549] lo speed is unknown, defaulting to 1000 [ 2063.641697][ T4341] usb 1-1: unable to get BOS descriptor or descriptor too short [ 2063.643137][ T4341] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2063.646196][ T4341] usb 1-1: New USB device found, idVendor=0644, idProduct=800f, bcdDevice= 0.40 [ 2063.646225][ T4341] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2063.646248][ T4341] usb 1-1: Product: syz [ 2063.646264][ T4341] usb 1-1: Manufacturer: syz [ 2063.646281][ T4341] usb 1-1: SerialNumber: syz [ 2063.756006][T10549] virt_wifi0 speed is unknown, defaulting to 1000 [ 2063.955525][ T4341] usb 1-1: disable ehci-hcd to run US-144 [ 2063.967843][ T4341] usb 1-1: USB disconnect, device number 126 [ 2064.237183][T10549] bridge0: port 1(bridge_slave_0) entered blocking state [ 2064.244852][T10549] bridge0: port 1(bridge_slave_0) entered disabled state [ 2064.245190][T10549] bridge_slave_0: entered allmulticast mode [ 2064.262534][T10549] bridge_slave_0: entered promiscuous mode [ 2064.266971][T10549] bridge0: port 2(bridge_slave_1) entered blocking state [ 2064.267379][T10549] bridge0: port 2(bridge_slave_1) entered disabled state [ 2064.268030][T10549] bridge_slave_1: entered allmulticast mode [ 2064.272445][T10549] bridge_slave_1: entered promiscuous mode [ 2064.331373][T10549] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2064.341301][T10549] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2064.401397][T10549] team0: Port device team_slave_0 added [ 2064.405281][T10549] team0: Port device team_slave_1 added [ 2064.450592][T10549] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2064.450605][T10549] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2064.450621][T10549] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2064.455128][T10549] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2064.455144][T10549] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2064.455170][T10549] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2064.648452][ T38] audit: type=1326 audit(5337140416.978:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10603 comm="syz.0.13770" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faeb2a3cdd9 code=0x0 [ 2064.669588][T10549] hsr_slave_0: entered promiscuous mode [ 2064.672432][T10549] hsr_slave_1: entered promiscuous mode [ 2064.674478][T10549] debugfs: 'hsr0' already exists in 'hsr' [ 2064.674504][T10549] Cannot create hsr debugfs directory [ 2064.770972][ T38] audit: type=1326 audit(5337140417.091:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10603 comm="syz.0.13770" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7faeb2a3cdd9 code=0x40000 [ 2064.860192][T10614] program syz.5.13774 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2064.943366][T29055] Bluetooth: hci0: command tx timeout [ 2065.081859][T10620] FAULT_INJECTION: forcing a failure. [ 2065.081859][T10620] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2065.081897][T10620] CPU: 0 UID: 0 PID: 10620 Comm: syz.5.13777 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 2065.081923][T10620] Tainted: [L]=SOFTLOCKUP [ 2065.081931][T10620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 2065.081943][T10620] Call Trace: [ 2065.081951][T10620] [ 2065.081959][T10620] dump_stack_lvl+0xe8/0x150 [ 2065.081990][T10620] should_fail_ex+0x46b/0x600 [ 2065.082018][T10620] _copy_from_user+0x2d/0xb0 [ 2065.082046][T10620] kstrtouint_from_user+0xd6/0x180 [ 2065.082073][T10620] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 2065.082113][T10620] proc_fail_nth_write+0x8e/0x210 [ 2065.082138][T10620] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2065.082166][T10620] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2065.082192][T10620] vfs_write+0x2a3/0xba0 [ 2065.082226][T10620] ? __pfx_vfs_write+0x10/0x10 [ 2065.082255][T10620] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2065.082285][T10620] ? lockdep_hardirqs_on+0x7a/0x110 [ 2065.082315][T10620] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 2065.082345][T10620] ? mutex_lock_nested+0x152/0x1d0 [ 2065.082368][T10620] ? fdget_pos+0x252/0x320 [ 2065.082407][T10620] ksys_write+0x156/0x270 [ 2065.082437][T10620] ? __pfx_ksys_write+0x10/0x10 [ 2065.082470][T10620] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2065.082493][T10620] do_syscall_64+0x15f/0xf80 [ 2065.082513][T10620] ? trace_irq_disable+0x3b/0x140 [ 2065.082540][T10620] ? clear_bhb_loop+0x40/0x90 [ 2065.082566][T10620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2065.082587][T10620] RIP: 0033:0x7fcfcae4d60e [ 2065.082608][T10620] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2065.082626][T10620] RSP: 002b:00007fcfc90ddfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2065.082649][T10620] RAX: ffffffffffffffda RBX: 00007fcfc90de6c0 RCX: 00007fcfcae4d60e [ 2065.082665][T10620] RDX: 0000000000000001 RSI: 00007fcfc90de0a0 RDI: 0000000000000004 [ 2065.082679][T10620] RBP: 00007fcfc90de090 R08: 0000000000000000 R09: 0000000000000000 [ 2065.082693][T10620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2065.082706][T10620] R13: 00007fcfcb106038 R14: 00007fcfcb105fa0 R15: 00007fff0a29ea38 [ 2065.082739][T10620] [ 2065.907301][ T5794] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 2066.087386][ T5794] usb 5-1: Using ep0 maxpacket: 8 [ 2066.089744][ T5794] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2066.093039][ T5794] usb 5-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2066.093069][ T5794] usb 5-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2066.093093][ T5794] usb 5-1: Product: syz [ 2066.093109][ T5794] usb 5-1: Manufacturer: syz [ 2066.093125][ T5794] usb 5-1: SerialNumber: syz [ 2066.427924][ T5794] usb 5-1: Invalid connection information received from device [ 2066.649305][ T32] usb 5-1: USB disconnect, device number 28 [ 2067.010696][T10549] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2067.166836][T29055] Bluetooth: hci0: command tx timeout [ 2067.848325][ T32] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 2068.009141][ T32] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2068.009197][ T32] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2068.009225][ T32] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2068.017652][ T32] usb 5-1: config 0 descriptor?? [ 2068.132998][T10549] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2068.290271][T10669] ±ÿÔù4—SÃ: renamed from lo (while UP) [ 2068.679106][ T32] ath6kl: Failed to read usb control message: -32 [ 2068.679224][ T32] ath6kl: Unable to read the bmi data from the device: -32 [ 2068.679242][ T32] ath6kl: unable to read target info byte count: -32 [ 2068.681796][ T32] ath6kl: Failed to init ath6kl core: -32 [ 2068.682316][ T32] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -32 [ 2068.787401][ T32] usb 5-1: USB disconnect, device number 29 [ 2069.146564][T10549] bond0: (slave netdevsim1): Releasing backup interface [ 2069.218374][T10549] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2069.391651][T29055] Bluetooth: hci0: command tx timeout [ 2069.568694][T10714] netlink: 'syz.4.13822': attribute type 10 has an invalid length. [ 2069.941276][T10730] netlink: 36 bytes leftover after parsing attributes in process `syz.4.13829'. [ 2070.171196][ T5794] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 2070.365316][ T5794] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2070.365353][ T5794] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2070.365376][ T5794] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2070.365415][ T5794] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2070.365439][ T5794] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2070.379749][ T5794] usb 6-1: config 0 descriptor?? [ 2070.406804][ T5716] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 2070.577285][ T5716] usb 5-1: Using ep0 maxpacket: 16 [ 2070.580588][ T5716] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2070.580624][ T5716] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2070.580715][ T5716] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 2070.580741][ T5716] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2070.615730][ T5716] usb 5-1: config 0 descriptor?? [ 2070.732159][T10549] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 2070.879145][T10549] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2070.894184][T10549] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 2071.009593][T10549] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2071.019491][T10549] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 2071.083556][T10549] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2071.096380][ T5716] usbhid 5-1:0.0: can't add hid device: -71 [ 2071.096515][ T5716] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2071.114812][T10549] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 2071.114959][ T5794] plantronics 0003:047F:FFFF.003B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 2071.168211][ T5716] usb 5-1: USB disconnect, device number 30 [ 2071.284701][ T5794] usb 6-1: USB disconnect, device number 20 [ 2071.478588][T10742] fido_id[10742]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 2071.536718][T10549] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2071.619067][T29055] Bluetooth: hci0: command tx timeout [ 2072.008804][T10549] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2072.083071][T10756] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13833'. [ 2072.118611][T10549] 8021q: adding VLAN 0 to HW filter on device team0 [ 2072.142630][ T3412] bridge0: port 1(bridge_slave_0) entered blocking state [ 2072.142817][ T3412] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2072.187905][ T3412] bridge0: port 2(bridge_slave_1) entered blocking state [ 2072.189362][ T3412] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2072.245016][ T5716] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 2072.486756][ T5716] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2072.486808][ T5716] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2072.486831][ T5716] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2072.491615][ T5716] usb 1-1: config 0 descriptor?? [ 2073.268629][ T5716] ath6kl: Failed to read usb control message: -32 [ 2073.268681][ T5716] ath6kl: Unable to read the bmi data from the device: -32 [ 2073.268697][ T5716] ath6kl: unable to read target info byte count: -32 [ 2073.269925][ T5716] ath6kl: Failed to init ath6kl core: -32 [ 2073.270467][ T5716] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -32 [ 2073.371843][ T5716] usb 1-1: USB disconnect, device number 127 [ 2073.442302][T30573] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 2073.609723][T30573] usb 5-1: Using ep0 maxpacket: 16 [ 2073.618626][T30573] usb 5-1: config index 0 descriptor too short (expected 52, got 36) [ 2073.618657][T30573] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 2073.618678][T30573] usb 5-1: config 0 has no interface number 0 [ 2073.618739][T30573] usb 5-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 2073.618765][T30573] usb 5-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 2073.624720][T30573] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 2073.624750][T30573] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2073.624772][T30573] usb 5-1: Product: syz [ 2073.624787][T30573] usb 5-1: Manufacturer: syz [ 2073.624802][T30573] usb 5-1: SerialNumber: syz [ 2073.633196][T30573] usb 5-1: config 0 descriptor?? [ 2073.634259][T10779] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 2073.634446][T10779] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 2074.097225][T10798] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 2074.097354][T10798] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 2074.140016][T10549] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2074.314966][T10549] veth0_vlan: entered promiscuous mode [ 2074.354075][T10549] veth1_vlan: entered promiscuous mode [ 2074.462714][T10549] veth0_macvtap: entered promiscuous mode [ 2074.482800][T10549] veth1_macvtap: entered promiscuous mode [ 2074.535029][T30573] asix 5-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 2074.535071][T30573] asix 5-1:0.251 (unnamed net_device) (uninitialized): Failed to read software interface selection register: -71 [ 2074.535367][T30573] asix 5-1:0.251: probe with driver asix failed with error -71 [ 2074.563527][T30573] usb 5-1: USB disconnect, device number 31 [ 2074.600382][T10549] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2074.653073][T10549] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2074.764882][T23837] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2074.766936][T23837] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2074.767127][T23837] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2074.807126][T23837] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2076.023897][T10834] FAULT_INJECTION: forcing a failure. [ 2076.023897][T10834] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2076.023935][T10834] CPU: 0 UID: 0 PID: 10834 Comm: syz.5.13862 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 2076.023964][T10834] Tainted: [L]=SOFTLOCKUP [ 2076.023972][T10834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 2076.023984][T10834] Call Trace: [ 2076.023992][T10834] [ 2076.024001][T10834] dump_stack_lvl+0xe8/0x150 [ 2076.024032][T10834] should_fail_ex+0x46b/0x600 [ 2076.024063][T10834] _copy_to_user+0x31/0xb0 [ 2076.024095][T10834] simple_read_from_buffer+0xe1/0x170 [ 2076.024125][T10834] proc_fail_nth_read+0x1be/0x230 [ 2076.024154][T10834] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2076.024183][T10834] ? rw_verify_area+0x2ac/0x4e0 [ 2076.024219][T10834] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2076.024246][T10834] vfs_read+0x212/0xa80 [ 2076.024281][T10834] ? __pfx_vfs_read+0x10/0x10 [ 2076.024311][T10834] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2076.024343][T10834] ? lockdep_hardirqs_on+0x7a/0x110 [ 2076.024374][T10834] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 2076.024404][T10834] ? mutex_lock_nested+0x152/0x1d0 [ 2076.024429][T10834] ? fdget_pos+0x252/0x320 [ 2076.024459][T10834] ksys_read+0x156/0x270 [ 2076.024488][T10834] ? __pfx_ksys_read+0x10/0x10 [ 2076.024512][T10834] ? __pfx_cec_ioctl+0x10/0x10 [ 2076.024541][T10834] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2076.024561][T10834] do_syscall_64+0x15f/0xf80 [ 2076.024579][T10834] ? trace_irq_disable+0x3b/0x140 [ 2076.024605][T10834] ? clear_bhb_loop+0x40/0x90 [ 2076.024630][T10834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2076.024648][T10834] RIP: 0033:0x7fcfcae4d60e [ 2076.024668][T10834] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2076.024686][T10834] RSP: 002b:00007fcfc90ddfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2076.024708][T10834] RAX: ffffffffffffffda RBX: 00007fcfc90de6c0 RCX: 00007fcfcae4d60e [ 2076.024723][T10834] RDX: 000000000000000f RSI: 00007fcfc90de0a0 RDI: 0000000000000004 [ 2076.024736][T10834] RBP: 00007fcfc90de090 R08: 0000000000000000 R09: 0000000000000000 [ 2076.024750][T10834] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2076.024761][T10834] R13: 00007fcfcb106038 R14: 00007fcfcb105fa0 R15: 00007fff0a29ea38 [ 2076.024792][T10834] [ 2076.462180][T23842] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2076.462200][T23842] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2076.918500][ T32] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 2077.170587][ T32] usb 5-1: Using ep0 maxpacket: 8 [ 2077.196895][ T32] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2077.207861][ T32] usb 5-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2077.207893][ T32] usb 5-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2077.207916][ T32] usb 5-1: Product: syz [ 2077.207932][ T32] usb 5-1: Manufacturer: syz [ 2077.207947][ T32] usb 5-1: SerialNumber: syz [ 2077.544185][ T32] usb 5-1: Handspring Visor / Palm OS: No valid connect info available [ 2077.544210][ T32] usb 5-1: Handspring Visor / Palm OS: port 0, is for Console use [ 2077.544229][ T32] usb 5-1: Handspring Visor / Palm OS: port 0, is for Generic use [ 2077.544248][ T32] usb 5-1: Handspring Visor / Palm OS: Number of ports: 2 [ 2077.640449][T23837] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2077.640470][T23837] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2077.774099][ T32] usb 5-1: palm_os_3_probe - error -71 getting bytes available request [ 2077.774180][ T32] visor 5-1:1.0: Handspring Visor / Palm OS converter detected [ 2077.802626][ T32] usb 5-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 2077.830694][ T32] usb 5-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 2077.916108][ T32] usb 5-1: USB disconnect, device number 32 [ 2078.011031][ T32] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 2078.068943][ T32] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 2078.078288][ T32] visor 5-1:1.0: device disconnected [ 2078.277829][T10858] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13873'. [ 2078.849431][ T9049] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2078.914431][ T9049] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2078.938702][ T9049] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2078.942725][ T9049] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2078.960706][ T9049] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2079.171113][T10880] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2079.171775][T10880] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2079.183109][T20701] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 2079.300735][T30573] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 2079.322208][T20701] usb 3-1: device descriptor read/64, error -71 [ 2079.510262][ T9049] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 2079.510334][ T9049] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 2079.537005][ T9049] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 2079.537074][ T9049] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 2079.537129][ T9049] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 2079.537182][ T9049] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 2079.537236][ T9049] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 2079.537290][ T9049] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 2079.537345][ T9049] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 2079.537400][ T9049] Bluetooth: hci4: SCO packet for unknown connection handle 200 [ 2079.586628][T20701] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 2079.743316][T20701] usb 3-1: device descriptor read/64, error -71 [ 2079.748219][T30573] usb 5-1: device descriptor read/64, error -71 [ 2079.857694][T20701] usb usb3-port1: attempt power cycle [ 2079.985845][ T1085] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 2079.996042][T30573] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 2080.051227][T10867] wg2 speed is unknown, defaulting to 1000 [ 2080.241236][T30573] usb 5-1: Using ep0 maxpacket: 32 [ 2080.261985][T30573] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2080.262016][T30573] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2080.262086][T30573] usb 5-1: too many endpoints for config 1 interface 1 altsetting 0: 128, using maximum allowed: 30 [ 2080.262125][T30573] usb 5-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 128 [ 2080.262167][T30573] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 2080.262194][T30573] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 2080.349120][T30573] usb 5-1: New USB device found, idVendor=2b53, idProduct=0031, bcdDevice= 0.40 [ 2080.349151][T30573] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2080.349170][T30573] usb 5-1: Product: syz [ 2080.349185][T30573] usb 5-1: Manufacturer: syz [ 2080.349198][T30573] usb 5-1: SerialNumber: syz [ 2080.446546][T20701] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 2080.517204][T20701] usb 3-1: device descriptor read/8, error -71 [ 2080.522593][ T1085] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2080.522650][ T1085] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2080.522731][ T1085] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2080.572182][ T1085] usb 1-1: config 0 descriptor?? [ 2080.840824][T20701] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 2080.862431][T20701] usb 3-1: device descriptor read/8, error -71 [ 2080.895419][T10867] lo speed is unknown, defaulting to 1000 [ 2080.913382][T30573] usb 5-1: USB disconnect, device number 34 [ 2080.979853][T20701] usb usb3-port1: unable to enumerate USB device [ 2081.234115][ T1085] ath6kl: mismatched byte count 0 vs. expected 12 [ 2081.352428][ T1085] ath6kl: Failed to init ath6kl core: -22 [ 2081.353376][ T1085] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 2081.367647][ T9049] Bluetooth: hci3: command tx timeout [ 2081.517439][ T1085] usb 1-1: USB disconnect, device number 2 [ 2081.558100][T10901] loop8: detected capacity change from 0 to 8 [ 2081.561616][ T1380] lo_rw_aio(loop8) starting read with raw_refcnt=0x1, refcnt=2 [ 2081.561891][T10901] Dev loop8: unable to read RDB block 8 [ 2081.561928][T10901] loop8: unable to read partition table [ 2081.562183][T10901] loop8: partition table beyond EOD, truncated [ 2081.562351][T10901] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà ) failed (rc=-5) [ 2081.570659][T10867] virt_wifi0 speed is unknown, defaulting to 1000 [ 2081.613663][ T7700] __loop_clr_fd(loop8) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 2081.846611][ T38] audit: type=1326 audit(5337140433.058:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10906 comm="syz.4.13886" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2082.457410][T10867] bridge0: port 1(bridge_slave_0) entered blocking state [ 2082.457729][T10867] bridge0: port 1(bridge_slave_0) entered disabled state [ 2082.458142][T10867] bridge_slave_0: entered allmulticast mode [ 2082.461770][T10867] bridge_slave_0: entered promiscuous mode [ 2082.514127][T10867] bridge0: port 2(bridge_slave_1) entered blocking state [ 2082.514371][T10867] bridge0: port 2(bridge_slave_1) entered disabled state [ 2082.514927][T10867] bridge_slave_1: entered allmulticast mode [ 2082.543828][T10867] bridge_slave_1: entered promiscuous mode [ 2082.572107][ T1085] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 2082.586573][T10867] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2082.592729][T10867] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2082.640444][T10867] team0: Port device team_slave_0 added [ 2082.644405][T10867] team0: Port device team_slave_1 added [ 2082.693380][T10867] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2082.693393][T10867] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2082.693411][T10867] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2082.701483][T10867] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2082.701501][T10867] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2082.701540][T10867] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2082.785978][ T1085] usb 3-1: Using ep0 maxpacket: 8 [ 2082.796584][ T1085] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2082.808062][ T1085] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2082.808095][ T1085] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2082.808117][ T1085] usb 3-1: Product: syz [ 2082.808134][ T1085] usb 3-1: Manufacturer: syz [ 2082.808149][ T1085] usb 3-1: SerialNumber: syz [ 2083.025055][T10867] hsr_slave_0: entered promiscuous mode [ 2083.035599][T10867] hsr_slave_1: entered promiscuous mode [ 2083.049985][T10867] debugfs: 'hsr0' already exists in 'hsr' [ 2083.050013][T10867] Cannot create hsr debugfs directory [ 2083.061595][ T1085] usb 3-1: Invalid connection information received from device [ 2083.197609][T10932] netlink: 36 bytes leftover after parsing attributes in process `syz.0.13893'. [ 2083.270574][ T5794] usb 3-1: USB disconnect, device number 82 [ 2083.388523][ T9049] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 2083.388553][ T9049] CPU: 0 UID: 0 PID: 9049 Comm: kworker/u9:3 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 2083.388597][ T9049] Tainted: [L]=SOFTLOCKUP [ 2083.388606][ T9049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 2083.388621][ T9049] Workqueue: hci4 hci_rx_work [ 2083.388659][ T9049] Call Trace: [ 2083.388668][ T9049] [ 2083.388679][ T9049] dump_stack_lvl+0xe8/0x150 [ 2083.388710][ T9049] sysfs_create_dir_ns+0x271/0x2a0 [ 2083.388739][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2083.388770][ T9049] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 2083.388799][ T9049] ? rt_spin_unlock+0x160/0x200 [ 2083.388829][ T9049] kobject_add_internal+0x631/0xd10 [ 2083.388864][ T9049] kobject_add+0x163/0x240 [ 2083.388895][ T9049] ? __pfx_kobject_add+0x10/0x10 [ 2083.388930][ T9049] ? get_device_parent+0x370/0x3a0 [ 2083.388964][ T9049] device_add+0x408/0xb90 [ 2083.388999][ T9049] hci_conn_add_sysfs+0xd5/0x210 [ 2083.389035][ T9049] le_conn_complete_evt+0x10e6/0x16b0 [ 2083.389073][ T9049] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2083.389101][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2083.389136][ T9049] ? lockdep_hardirqs_on+0x7a/0x110 [ 2083.389172][ T9049] ? skb_pull_data+0xfb/0x200 [ 2083.389201][ T9049] hci_le_conn_complete_evt+0x187/0x470 [ 2083.389241][ T9049] hci_event_packet+0x659/0xef0 [ 2083.389280][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2083.389308][ T9049] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2083.389332][ T9049] ? __pfx_hci_event_packet+0x10/0x10 [ 2083.389364][ T9049] ? rt_spin_unlock+0x14f/0x200 [ 2083.389402][ T9049] ? hci_send_to_monitor+0xe2/0x590 [ 2083.389432][ T9049] hci_rx_work+0x3ee/0x1040 [ 2083.389476][ T9049] ? process_one_work+0x8be/0x1630 [ 2083.389505][ T9049] process_one_work+0x98b/0x1630 [ 2083.389550][ T9049] ? __pfx_process_one_work+0x10/0x10 [ 2083.389575][ T9049] ? do_raw_spin_lock+0x12b/0x2f0 [ 2083.389629][ T9049] worker_thread+0xb49/0x1140 [ 2083.389668][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2083.389715][ T9049] kthread+0x388/0x470 [ 2083.389738][ T9049] ? __pfx_worker_thread+0x10/0x10 [ 2083.389767][ T9049] ? __pfx_kthread+0x10/0x10 [ 2083.389790][ T9049] ret_from_fork+0x514/0xb70 [ 2083.389821][ T9049] ? __pfx_ret_from_fork+0x10/0x10 [ 2083.389846][ T9049] ? __switch_to+0xc79/0x1410 [ 2083.389884][ T9049] ? __pfx_kthread+0x10/0x10 [ 2083.389908][ T9049] ret_from_fork_asm+0x1a/0x30 [ 2083.389954][ T9049] [ 2083.390015][ T9049] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 2083.390057][ T9049] Bluetooth: hci4: failed to register connection device [ 2083.590489][ T9049] Bluetooth: hci3: command tx timeout [ 2083.696999][ T1085] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 2083.863087][ T1085] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2083.863752][ T1085] usb 5-1: not running at top speed; connect to a high speed hub [ 2083.865199][ T1085] usb 5-1: config 5 has an invalid interface number: 220 but max is 1 [ 2083.865225][ T1085] usb 5-1: config 5 has an invalid interface number: 57 but max is 1 [ 2083.865247][ T1085] usb 5-1: config 5 contains an unexpected descriptor of type 0x1, skipping [ 2083.865267][ T1085] usb 5-1: config 5 has no interface number 0 [ 2083.865284][ T1085] usb 5-1: config 5 has no interface number 1 [ 2083.865342][ T1085] usb 5-1: config 5 interface 220 altsetting 15 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2083.865392][ T1085] usb 5-1: config 5 interface 220 altsetting 15 has an invalid descriptor for endpoint zero, skipping [ 2083.901014][ T1085] usb 5-1: config 5 interface 220 altsetting 15 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 2083.901049][ T1085] usb 5-1: config 5 interface 220 altsetting 15 has a duplicate endpoint with address 0x8, skipping [ 2083.901073][ T1085] usb 5-1: config 5 interface 220 altsetting 15 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 2083.901100][ T1085] usb 5-1: config 5 interface 220 altsetting 15 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 2083.901147][ T1085] usb 5-1: config 5 interface 57 altsetting 129 has an invalid descriptor for endpoint zero, skipping [ 2083.901172][ T1085] usb 5-1: config 5 interface 57 altsetting 129 has a duplicate endpoint with address 0xC, skipping [ 2083.901197][ T1085] usb 5-1: config 5 interface 57 altsetting 129 has a duplicate endpoint with address 0x8, skipping [ 2083.901217][ T1085] usb 5-1: config 5 interface 57 altsetting 129 has a duplicate endpoint with address 0xE, skipping [ 2083.901238][ T1085] usb 5-1: config 5 interface 220 has no altsetting 0 [ 2083.901258][ T1085] usb 5-1: config 5 interface 57 has no altsetting 0 [ 2083.993929][ T1085] usb 5-1: New USB device found, idVendor=0681, idProduct=0010, bcdDevice=28.ae [ 2083.993975][ T1085] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2083.993994][ T1085] usb 5-1: Product: syz [ 2083.994008][ T1085] usb 5-1: Manufacturer: syz [ 2083.994023][ T1085] usb 5-1: SerialNumber: syz [ 2084.150275][ T38] audit: type=1326 audit(5337140435.219:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10945 comm="syz.0.13897" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faeb2a3cdd9 code=0x0 [ 2084.379547][T10935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2084.381337][T10935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2084.437118][ T1085] usb 5-1: USB disconnect, device number 35 [ 2084.869545][T10867] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2085.330337][T10962] loop4: detected capacity change from 0 to 524255231 [ 2085.332956][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x1, refcnt=2 [ 2085.336625][ T1380] lo_rw_aio(loop4) starting read with raw_refcnt=0x1, refcnt=2 [ 2085.337199][ T1380] lo_rw_aio(loop4) starting read with raw_refcnt=0x1, refcnt=2 [ 2085.380432][ T1380] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.381799][ T1380] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.388419][ T1380] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.392838][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.400071][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.407068][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.408117][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.410861][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.418543][ T5305] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.457168][ T5305] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.458904][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.462621][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.468680][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.478034][T23842] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.481941][T23842] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.486042][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.495638][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.511913][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.514967][T10966] netlink: 'syz.0.13905': attribute type 2 has an invalid length. [ 2085.515288][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.517898][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.520749][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.525094][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.526183][T23842] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.528362][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.532738][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.556976][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.583920][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.586068][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.586213][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.661802][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.691044][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.701490][T23842] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.824990][ T9049] Bluetooth: hci3: command tx timeout [ 2085.835950][ T5305] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.866597][T23837] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.886323][ T38] audit: type=1326 audit(5337140436.846:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10973 comm="syz.0.13907" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faeb2a3cdd9 code=0x0 [ 2085.927929][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.927983][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.928009][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.928035][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.928066][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.937028][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.942487][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2085.942546][ T12] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2086.015015][ T5794] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 2086.069934][ T7700] __loop_clr_fd(loop4) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 2086.175088][ T2770] usb 3-1: new full-speed USB device number 83 using dummy_hcd [ 2086.263400][ T5794] usb 5-1: Using ep0 maxpacket: 8 [ 2086.269421][ T5794] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2086.275440][ T5794] usb 5-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2086.275470][ T5794] usb 5-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2086.275491][ T5794] usb 5-1: Product: syz [ 2086.275507][ T5794] usb 5-1: Manufacturer: syz [ 2086.275522][ T5794] usb 5-1: SerialNumber: syz [ 2086.406069][T10867] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2086.456992][ T2770] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2086.457987][ T2770] usb 3-1: not running at top speed; connect to a high speed hub [ 2086.487829][ T2770] usb 3-1: config 5 has an invalid interface number: 220 but max is 1 [ 2086.487892][ T2770] usb 3-1: config 5 has an invalid interface number: 57 but max is 1 [ 2086.487905][ T2770] usb 3-1: config 5 contains an unexpected descriptor of type 0x1, skipping [ 2086.487924][ T2770] usb 3-1: config 5 has no interface number 0 [ 2086.487941][ T2770] usb 3-1: config 5 has no interface number 1 [ 2086.488057][ T2770] usb 3-1: config 5 interface 220 altsetting 15 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2086.488072][ T2770] usb 3-1: config 5 interface 220 altsetting 15 has an invalid descriptor for endpoint zero, skipping [ 2086.488085][ T2770] usb 3-1: config 5 interface 220 altsetting 15 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 2086.488100][ T2770] usb 3-1: config 5 interface 220 altsetting 15 has a duplicate endpoint with address 0x8, skipping [ 2086.488113][ T2770] usb 3-1: config 5 interface 220 altsetting 15 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 2086.488129][ T2770] usb 3-1: config 5 interface 220 altsetting 15 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 2086.488153][ T2770] usb 3-1: config 5 interface 57 altsetting 129 has an invalid descriptor for endpoint zero, skipping [ 2086.488202][ T2770] usb 3-1: config 5 interface 57 altsetting 129 has a duplicate endpoint with address 0xC, skipping [ 2086.488218][ T2770] usb 3-1: config 5 interface 57 altsetting 129 has a duplicate endpoint with address 0x8, skipping [ 2086.488231][ T2770] usb 3-1: config 5 interface 57 altsetting 129 has a duplicate endpoint with address 0xE, skipping [ 2086.488244][ T2770] usb 3-1: config 5 interface 220 has no altsetting 0 [ 2086.488255][ T2770] usb 3-1: config 5 interface 57 has no altsetting 0 [ 2086.512834][ T2770] usb 3-1: New USB device found, idVendor=0681, idProduct=0010, bcdDevice=28.ae [ 2086.512867][ T2770] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2086.512888][ T2770] usb 3-1: Product: syz [ 2086.512903][ T2770] usb 3-1: Manufacturer: syz [ 2086.512971][ T2770] usb 3-1: SerialNumber: syz [ 2086.524600][ T5794] usb 5-1: Invalid connection information received from device [ 2086.744259][ T5794] usb 5-1: USB disconnect, device number 36 [ 2086.840711][T10976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2086.856850][T10976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2086.931801][ T2770] usb 3-1: USB disconnect, device number 83 [ 2087.233341][ T5792] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 2087.255756][T10867] bond0: (slave netdevsim1): Releasing backup interface [ 2087.326595][T10867] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2087.395498][ T5792] usb 1-1: config 36 has an invalid descriptor of length 255, skipping remainder of the config [ 2087.395538][ T5792] usb 1-1: config 36 has 0 interfaces, different from the descriptor's value: 1 [ 2087.397164][ T5792] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 2087.397193][ T5792] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 2087.397205][ T5792] usb 1-1: Manufacturer: syz [ 2087.397214][ T5792] usb 1-1: SerialNumber: syz [ 2087.676057][ T5792] usb 1-1: USB disconnect, device number 3 [ 2088.051907][ T5716] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 2088.053919][T29055] Bluetooth: hci3: command tx timeout [ 2088.093237][T10867] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2088.094426][ T38] audit: type=1326 audit(5337140438.913:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10996 comm="syz.2.13916" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2088.315790][ T5716] usb 5-1: Using ep0 maxpacket: 16 [ 2088.318250][ T5716] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2088.318280][ T5716] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2088.318307][ T5716] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 30768, setting to 1024 [ 2088.318336][ T5716] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 2088.319926][ T5716] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2088.319956][ T5716] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2088.319977][ T5716] usb 5-1: SerialNumber: syz [ 2088.339903][T10993] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 2088.358822][ T5716] cdc_acm 5-1:1.0: skipping garbage [ 2088.370381][ T5716] cdc_acm 5-1:1.0: probe with driver cdc_acm failed with error -12 [ 2088.558063][ T5792] usb 5-1: USB disconnect, device number 37 [ 2088.808337][ T4341] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 2088.965005][ T4341] usb 1-1: Using ep0 maxpacket: 8 [ 2088.967240][ T4341] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2088.969946][ T4341] usb 1-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2088.969976][ T4341] usb 1-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2088.969998][ T4341] usb 1-1: Product: syz [ 2088.970012][ T4341] usb 1-1: Manufacturer: syz [ 2088.970027][ T4341] usb 1-1: SerialNumber: syz [ 2089.225190][T11006] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13919'. [ 2089.225214][T11006] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13919'. [ 2089.242921][T10867] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 2089.259929][ T4341] usb 1-1: Invalid connection information received from device [ 2089.414209][T10867] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2089.419092][T10867] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 2089.482455][ T5794] usb 1-1: USB disconnect, device number 4 [ 2089.508526][T10867] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2089.516796][T10867] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 2089.572759][T10867] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2089.573968][T10867] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 2089.621259][T10867] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2089.755141][T10867] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2089.787982][T10867] 8021q: adding VLAN 0 to HW filter on device team0 [ 2089.797279][ T4013] bridge0: port 1(bridge_slave_0) entered blocking state [ 2089.797428][ T4013] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2089.798963][ T5716] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 2089.880387][T23837] bridge0: port 2(bridge_slave_1) entered blocking state [ 2089.880479][T23837] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2089.982128][ T5716] usb 5-1: Using ep0 maxpacket: 16 [ 2089.985423][ T5716] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2089.985457][ T5716] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2089.985479][ T5716] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 2089.985518][ T5716] usb 5-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice= 0.00 [ 2089.985541][ T5716] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2090.002478][T29055] Bluetooth: hci4: command 0x0406 tx timeout [ 2090.004303][ T5716] usb 5-1: config 0 descriptor?? [ 2090.235946][T11013] netlink: 36 bytes leftover after parsing attributes in process `syz.4.13922'. [ 2090.235973][T11013] netlink: 16 bytes leftover after parsing attributes in process `syz.4.13922'. [ 2090.235991][T11013] netlink: 36 bytes leftover after parsing attributes in process `syz.4.13922'. [ 2090.456489][ T38] audit: type=1326 audit(5337140697.117:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11027 comm="syz.0.13926" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faeb2a3cdd9 code=0x0 [ 2090.511033][ T5716] belkin 0003:1020:0006.003C: unknown main item tag 0x0 [ 2090.511073][ T5716] belkin 0003:1020:0006.003C: unknown main item tag 0x0 [ 2090.513132][ T5716] belkin 0003:1020:0006.003C: unknown main item tag 0x0 [ 2090.513164][ T5716] belkin 0003:1020:0006.003C: unknown main item tag 0x0 [ 2090.513195][ T5716] belkin 0003:1020:0006.003C: unknown main item tag 0x0 [ 2090.513223][ T5716] belkin 0003:1020:0006.003C: unknown main item tag 0x0 [ 2090.513250][ T5716] belkin 0003:1020:0006.003C: unknown main item tag 0x0 [ 2090.513278][ T5716] belkin 0003:1020:0006.003C: unknown main item tag 0x0 [ 2090.513307][ T5716] belkin 0003:1020:0006.003C: unknown main item tag 0x0 [ 2090.513446][ T5716] belkin 0003:1020:0006.003C: unknown main item tag 0x0 [ 2090.820824][ T5716] belkin 0003:1020:0006.003C: hidraw0: USB HID v0.0a Device [HID 1020:0006] on usb-dummy_hcd.4-1/input0 [ 2090.856822][ T5716] usb 5-1: USB disconnect, device number 38 [ 2090.941166][T11042] fido_id[11042]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 2091.331178][T30573] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 2091.473712][T10867] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2091.488989][T30573] usb 3-1: Using ep0 maxpacket: 8 [ 2091.510625][T30573] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2091.516431][T30573] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2091.516452][T30573] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2091.516465][T30573] usb 3-1: Product: syz [ 2091.516474][T30573] usb 3-1: Manufacturer: syz [ 2091.516483][T30573] usb 3-1: SerialNumber: syz [ 2091.617344][T11063] tipc: Enabling of bearer rejected, failed to enable media [ 2091.758961][T30573] usb 3-1: Invalid connection information received from device [ 2091.926368][ T5716] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 2091.983404][ T10] usb 3-1: USB disconnect, device number 84 [ 2092.093442][ T5716] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2092.093501][ T5716] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2092.093527][ T5716] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2092.133098][ T5716] usb 1-1: config 0 descriptor?? [ 2092.230596][T10867] veth0_vlan: entered promiscuous mode [ 2092.306641][T10867] veth1_vlan: entered promiscuous mode [ 2092.415217][T10867] veth0_macvtap: entered promiscuous mode [ 2092.425978][T10867] veth1_macvtap: entered promiscuous mode [ 2092.450305][T30573] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 2092.513267][T10867] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2092.538726][T10867] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2092.626613][T30573] usb 5-1: Using ep0 maxpacket: 32 [ 2092.632631][T23837] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2092.644045][T23842] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2092.655636][ T1380] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2092.663404][ T1380] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2092.683977][T30573] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2092.693256][T30573] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1023 [ 2092.710215][T30573] usb 5-1: New USB device found, idVendor=0582, idProduct=0004, bcdDevice= 0.00 [ 2092.710247][T30573] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2092.710269][T30573] usb 5-1: Product: syz [ 2092.710284][T30573] usb 5-1: Manufacturer: syz [ 2092.710300][T30573] usb 5-1: SerialNumber: syz [ 2092.746928][T11058] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 2092.786186][ T5716] ath6kl: mismatched byte count 0 vs. expected 12 [ 2092.787399][ T5716] ath6kl: Failed to init ath6kl core: -22 [ 2092.787959][ T5716] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 2093.052142][ T5792] usb 1-1: USB disconnect, device number 5 [ 2093.122338][T11076] netlink: 28 bytes leftover after parsing attributes in process `syz.2.13936'. [ 2093.779599][T30573] usb 5-1: USB disconnect, device number 39 [ 2094.159447][ T38] audit: type=1326 audit(5337140700.475:690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11080 comm="syz.0.13938" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faeb2a3cdd9 code=0x0 [ 2094.294253][ T7700] udevd[7700]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2094.561109][ T107] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2094.561129][ T107] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2095.141881][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2095.141904][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2095.282882][T11101] netlink: 28 bytes leftover after parsing attributes in process `syz.2.13944'. [ 2095.381573][ T10] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 2095.474876][ T38] audit: type=1326 audit(5337140701.812:691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11104 comm="syz.5.13874" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3b8629cdd9 code=0x0 [ 2095.552028][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 2095.555978][ T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2095.594179][ T10] usb 5-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2095.594215][ T10] usb 5-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2095.594236][ T10] usb 5-1: Product: syz [ 2095.594252][ T10] usb 5-1: Manufacturer: syz [ 2095.594268][ T10] usb 5-1: SerialNumber: syz [ 2095.872911][ T10] usb 5-1: Invalid connection information received from device [ 2095.909945][ T5794] usb 3-1: new full-speed USB device number 85 using dummy_hcd [ 2096.007238][T29055] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2096.127839][T29055] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2096.143849][T29055] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2096.174057][ T5794] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2096.174635][ T5794] usb 3-1: not running at top speed; connect to a high speed hub [ 2096.174698][ T5794] usb 3-1: too many configurations: 128, using maximum allowed: 8 [ 2096.176512][ T5794] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 2096.176547][ T5794] usb 3-1: can't read configurations, error -61 [ 2096.196215][ T2770] usb 5-1: USB disconnect, device number 40 [ 2096.198237][T29055] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2096.205602][T29055] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2096.471991][ T5794] usb 3-1: new full-speed USB device number 86 using dummy_hcd [ 2096.688400][ T5794] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2096.690004][ T5794] usb 3-1: not running at top speed; connect to a high speed hub [ 2096.690072][ T5794] usb 3-1: too many configurations: 128, using maximum allowed: 8 [ 2096.691797][ T5794] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 2096.691834][ T5794] usb 3-1: can't read configurations, error -61 [ 2096.692200][ T5794] usb usb3-port1: attempt power cycle [ 2096.889981][ T38] audit: type=1326 audit(5337140703.141:692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11120 comm="syz.4.13949" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2097.080816][ T5794] usb 3-1: new full-speed USB device number 87 using dummy_hcd [ 2097.123244][ T5794] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2097.124401][ T5794] usb 3-1: not running at top speed; connect to a high speed hub [ 2097.124465][ T5794] usb 3-1: too many configurations: 128, using maximum allowed: 8 [ 2097.127693][ T5794] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 2097.127731][ T5794] usb 3-1: can't read configurations, error -61 [ 2097.224244][T11110] wg2 speed is unknown, defaulting to 1000 [ 2097.282658][ T5794] usb 3-1: new full-speed USB device number 88 using dummy_hcd [ 2097.440782][ T5794] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2097.441370][ T5794] usb 3-1: not running at top speed; connect to a high speed hub [ 2097.441434][ T5794] usb 3-1: too many configurations: 128, using maximum allowed: 8 [ 2097.444722][ T5794] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 2097.444760][ T5794] usb 3-1: can't read configurations, error -61 [ 2097.445170][ T5794] usb usb3-port1: unable to enumerate USB device [ 2097.909050][T11132] netlink: 'syz.5.13950': attribute type 10 has an invalid length. [ 2098.020983][T11110] lo speed is unknown, defaulting to 1000 [ 2098.177057][T11132] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2098.193313][T11132] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 2098.293705][T11136] netlink: 28 bytes leftover after parsing attributes in process `syz.4.13952'. [ 2098.330180][T11110] virt_wifi0 speed is unknown, defaulting to 1000 [ 2098.650975][ T9049] Bluetooth: hci2: command tx timeout [ 2098.787786][ T38] audit: type=1326 audit(5337140704.908:693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11146 comm="syz.4.13956" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2099.111520][T11110] bridge0: port 1(bridge_slave_0) entered blocking state [ 2099.111752][T11110] bridge0: port 1(bridge_slave_0) entered disabled state [ 2099.112010][T11110] bridge_slave_0: entered allmulticast mode [ 2099.114267][T11110] bridge_slave_0: entered promiscuous mode [ 2099.119233][T11110] bridge0: port 2(bridge_slave_1) entered blocking state [ 2099.119609][T11110] bridge0: port 2(bridge_slave_1) entered disabled state [ 2099.119972][T11110] bridge_slave_1: entered allmulticast mode [ 2099.124541][T11110] bridge_slave_1: entered promiscuous mode [ 2099.164043][ T5792] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 2099.211084][T11110] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2099.297425][T11110] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2099.344229][T11110] team0: Port device team_slave_0 added [ 2099.349743][T11110] team0: Port device team_slave_1 added [ 2099.357655][ T5792] usb 3-1: Using ep0 maxpacket: 8 [ 2099.360031][ T5792] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2099.377160][ T5792] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2099.377193][ T5792] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2099.377216][ T5792] usb 3-1: Product: syz [ 2099.377231][ T5792] usb 3-1: Manufacturer: syz [ 2099.377247][ T5792] usb 3-1: SerialNumber: syz [ 2099.457233][T11110] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2099.457253][T11110] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2099.457278][T11110] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2099.460718][T11110] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2099.460736][T11110] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2099.460762][T11110] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2099.605210][T11110] hsr_slave_0: entered promiscuous mode [ 2099.627402][T11110] hsr_slave_1: entered promiscuous mode [ 2099.631044][T11110] debugfs: 'hsr0' already exists in 'hsr' [ 2099.631071][T11110] Cannot create hsr debugfs directory [ 2099.676099][ T5792] usb 3-1: Invalid connection information received from device [ 2099.765131][ T38] audit: type=1326 audit(5337140705.834:694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11161 comm="syz.4.13959" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2099.805985][T11164] netlink: 72 bytes leftover after parsing attributes in process `syz.5.13960'. [ 2099.894791][T20701] usb 3-1: USB disconnect, device number 89 [ 2100.329171][T30573] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 2100.509850][T30573] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 2100.509882][T30573] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2100.509894][T30573] usb 6-1: Product: syz [ 2100.509904][T30573] usb 6-1: Manufacturer: syz [ 2100.509913][T30573] usb 6-1: SerialNumber: syz [ 2100.783178][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 2100.783773][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 2100.868358][ T9049] Bluetooth: hci2: command tx timeout [ 2100.933117][T11181] netlink: 'syz.4.13965': attribute type 10 has an invalid length. [ 2101.096012][T30573] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 2101.096059][T30573] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 2101.457639][T11110] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2101.639407][T11186] netlink: 72 bytes leftover after parsing attributes in process `syz.2.13968'. [ 2101.914795][T11181] team0: Cannot enslave team device to itself [ 2102.057629][T11190] loop8: detected capacity change from 0 to 8 [ 2102.065068][ T198] lo_rw_aio(loop8) starting read with raw_refcnt=0x1, refcnt=2 [ 2102.083771][T11190] Dev loop8: unable to read RDB block 8 [ 2102.083816][T11190] loop8: unable to read partition table [ 2102.083992][T11190] loop8: partition table beyond EOD, truncated [ 2102.084008][T11190] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà ) failed (rc=-5) [ 2102.097760][T11189] __loop_clr_fd(loop8) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 2102.298672][T11192] input: syz1 as /devices/virtual/input/input160 [ 2102.402962][T11196] overlayfs: conflicting options: metacopy=on,redirect_dir=nofollow [ 2102.477072][ T38] audit: type=1326 audit(5337140708.360:695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11197 comm="syz.2.13973" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2103.087395][ T9049] Bluetooth: hci2: command tx timeout [ 2103.088772][T11110] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2103.143598][T30573] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 2103.392952][T30573] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 2103.393446][T30573] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 2103.393492][T30573] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 2103.394111][T30573] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 2103.448917][T30573] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 2103.468023][T30573] usb 6-1: USB disconnect, device number 21 [ 2103.481610][T11208] netlink: 72 bytes leftover after parsing attributes in process `syz.2.13976'. [ 2103.531731][T11110] bond0: (slave netdevsim1): Releasing backup interface [ 2103.650585][T11110] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2103.850711][ T4341] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 2104.076421][T11216] netlink: 36 bytes leftover after parsing attributes in process `syz.5.13979'. [ 2104.081661][ T4341] usb 3-1: Using ep0 maxpacket: 16 [ 2104.084123][ T4341] usb 3-1: config index 0 descriptor too short (expected 51443, got 18) [ 2104.087409][ T4341] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 2104.087437][ T4341] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2104.087459][ T4341] usb 3-1: Product: syz [ 2104.087474][ T4341] usb 3-1: Manufacturer: syz [ 2104.087490][ T4341] usb 3-1: SerialNumber: syz [ 2104.094587][ T4341] r8152-cfgselector 3-1: Unknown version 0x0000 [ 2104.094610][ T4341] r8152-cfgselector 3-1: config 0 descriptor?? [ 2104.219828][T11110] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2104.306526][ T9049] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 2104.306557][ T9049] CPU: 0 UID: 0 PID: 9049 Comm: kworker/u9:3 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 2104.306591][ T9049] Tainted: [L]=SOFTLOCKUP [ 2104.306599][ T9049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 2104.306614][ T9049] Workqueue: hci3 hci_rx_work [ 2104.306643][ T9049] Call Trace: [ 2104.306649][ T9049] [ 2104.306655][ T9049] dump_stack_lvl+0xe8/0x150 [ 2104.306674][ T9049] sysfs_create_dir_ns+0x271/0x2a0 [ 2104.306699][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2104.306731][ T9049] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 2104.306769][ T9049] ? rt_spin_unlock+0x160/0x200 [ 2104.306800][ T9049] kobject_add_internal+0x631/0xd10 [ 2104.306821][ T9049] kobject_add+0x163/0x240 [ 2104.306839][ T9049] ? __pfx_kobject_add+0x10/0x10 [ 2104.306865][ T9049] ? get_device_parent+0x370/0x3a0 [ 2104.306901][ T9049] device_add+0x408/0xb90 [ 2104.306935][ T9049] hci_conn_add_sysfs+0xd5/0x210 [ 2104.306970][ T9049] le_conn_complete_evt+0x10e6/0x16b0 [ 2104.306990][ T9049] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2104.307005][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2104.307035][ T9049] ? lockdep_hardirqs_on+0x7a/0x110 [ 2104.307071][ T9049] ? skb_pull_data+0xfb/0x200 [ 2104.307100][ T9049] hci_le_conn_complete_evt+0x187/0x470 [ 2104.307134][ T9049] hci_event_packet+0x659/0xef0 [ 2104.307156][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2104.307171][ T9049] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2104.307186][ T9049] ? __pfx_hci_event_packet+0x10/0x10 [ 2104.307218][ T9049] ? rt_spin_unlock+0x14f/0x200 [ 2104.307256][ T9049] ? hci_send_to_monitor+0xe2/0x590 [ 2104.307288][ T9049] hci_rx_work+0x3ee/0x1040 [ 2104.307317][ T9049] ? process_one_work+0x8be/0x1630 [ 2104.307333][ T9049] process_one_work+0x98b/0x1630 [ 2104.307373][ T9049] ? __pfx_process_one_work+0x10/0x10 [ 2104.307400][ T9049] ? do_raw_spin_lock+0x12b/0x2f0 [ 2104.307449][ T9049] worker_thread+0xb49/0x1140 [ 2104.307478][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2104.307503][ T9049] kthread+0x388/0x470 [ 2104.307518][ T9049] ? __pfx_worker_thread+0x10/0x10 [ 2104.307546][ T9049] ? __pfx_kthread+0x10/0x10 [ 2104.307570][ T9049] ret_from_fork+0x514/0xb70 [ 2104.307598][ T9049] ? __pfx_ret_from_fork+0x10/0x10 [ 2104.307624][ T9049] ? __switch_to+0xc79/0x1410 [ 2104.307649][ T9049] ? __pfx_kthread+0x10/0x10 [ 2104.307663][ T9049] ret_from_fork_asm+0x1a/0x30 [ 2104.307694][ T9049] [ 2104.310980][ T9049] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 2104.311027][ T9049] Bluetooth: hci3: failed to register connection device [ 2104.506588][ T4341] r8152-cfgselector 3-1: Unknown version 0x0000 [ 2104.507052][ T4341] r8152-cfgselector 3-1: No union descriptors [ 2104.652322][ T4341] r8152-cfgselector 3-1: USB disconnect, device number 90 [ 2104.818436][T11210] netlink: 14568 bytes leftover after parsing attributes in process `syz.2.13977'. [ 2105.112082][ T38] audit: type=1326 audit(5337140710.830:696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11228 comm="syz.4.13983" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2105.313876][ T9049] Bluetooth: hci2: command tx timeout [ 2105.327491][ T10] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 2105.330760][T11110] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 2105.364135][T11110] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2105.375881][T11110] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 2105.386090][ T5794] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 2105.409298][T11110] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2105.410337][T11110] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 2105.444951][T11110] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2105.446085][T11110] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 2105.529584][T11110] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2105.560512][ T10] usb 3-1: config index 0 descriptor too short (expected 64802, got 45) [ 2105.576712][ T5794] usb 6-1: Using ep0 maxpacket: 8 [ 2105.596457][ T5794] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2105.604551][ T5794] usb 6-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2105.604585][ T5794] usb 6-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2105.604658][ T5794] usb 6-1: Product: syz [ 2105.604673][ T5794] usb 6-1: Manufacturer: syz [ 2105.604688][ T5794] usb 6-1: SerialNumber: syz [ 2105.668756][ T10] usb 3-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 2105.668788][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2105.668801][ T10] usb 3-1: Product: syz [ 2105.668810][ T10] usb 3-1: Manufacturer: syz [ 2105.668819][ T10] usb 3-1: SerialNumber: syz [ 2105.884861][ T5794] usb 6-1: Invalid connection information received from device [ 2106.042214][ T10] rtl8150 3-1:1.0: couldn't reset the device [ 2106.042590][ T10] rtl8150 3-1:1.0: probe with driver rtl8150 failed with error -5 [ 2106.072143][ T10] usb 3-1: USB disconnect, device number 91 [ 2106.117743][ T4341] usb 6-1: USB disconnect, device number 22 [ 2106.212858][T11239] netlink: 48 bytes leftover after parsing attributes in process `syz.4.13984'. [ 2106.214291][T11110] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2106.414967][T11110] 8021q: adding VLAN 0 to HW filter on device team0 [ 2106.456103][T23837] bridge0: port 1(bridge_slave_0) entered blocking state [ 2106.456333][T23837] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2106.502760][T23842] bridge0: port 2(bridge_slave_1) entered blocking state [ 2106.503035][T23842] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2106.803164][T11250] netlink: 36 bytes leftover after parsing attributes in process `syz.5.13988'. [ 2106.902675][T11252] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13989'. [ 2107.002077][ T9049] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 2107.366532][T11110] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2107.446219][T11268] netlink: 48 bytes leftover after parsing attributes in process `syz.4.13992'. [ 2107.551892][T11110] veth0_vlan: entered promiscuous mode [ 2107.567266][ T32] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 2107.657226][T11110] veth1_vlan: entered promiscuous mode [ 2107.739413][ T32] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 2107.739462][ T32] usb 3-1: config 2 interface 0 altsetting 178 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2107.739488][ T32] usb 3-1: config 2 interface 0 has no altsetting 0 [ 2107.777242][ T32] usb 3-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 2107.777276][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2107.777296][ T32] usb 3-1: Product: syz [ 2107.777309][ T32] usb 3-1: Manufacturer: syz [ 2107.777323][ T32] usb 3-1: SerialNumber: syz [ 2107.946016][T11110] veth0_macvtap: entered promiscuous mode [ 2107.993945][T11110] veth1_macvtap: entered promiscuous mode [ 2108.130860][ T32] usb 3-1: USB disconnect, device number 92 [ 2108.203427][T11110] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2108.269413][T11110] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2108.360215][ T107] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2108.363043][ T107] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2108.365204][ T107] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2108.365496][ T107] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2108.444125][T20701] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 2108.606709][T20701] usb 6-1: Using ep0 maxpacket: 8 [ 2108.628466][T20701] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2108.671533][T20701] usb 6-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2108.671566][T20701] usb 6-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2108.671588][T20701] usb 6-1: Product: syz [ 2108.671603][T20701] usb 6-1: Manufacturer: syz [ 2108.671619][T20701] usb 6-1: SerialNumber: syz [ 2109.111640][T20701] usb 6-1: Invalid connection information received from device [ 2109.964312][ T1085] usb 6-1: USB disconnect, device number 23 [ 2110.348970][T11289] netlink: 48 bytes leftover after parsing attributes in process `syz.5.14000'. [ 2110.961298][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2110.961320][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2111.128488][ T9049] Bluetooth: hci3: command 0x0406 tx timeout [ 2111.374678][T11297] netlink: 36 bytes leftover after parsing attributes in process `syz.5.14003'. [ 2111.643646][ T38] audit: type=1326 audit(5337140716.928:697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11302 comm="syz.2.14005" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2111.682175][T23837] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2111.682195][T23837] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2111.765023][T29055] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 2112.106495][T11311] netlink: 'syz.0.13946': attribute type 21 has an invalid length. [ 2112.106567][T11311] netlink: 164 bytes leftover after parsing attributes in process `syz.0.13946'. [ 2112.303145][ T38] audit: type=1326 audit(5337140717.564:698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11316 comm="syz.0.14009" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff1540ecdd9 code=0x0 [ 2112.895236][T11337] netlink: 36 bytes leftover after parsing attributes in process `syz.4.14017'. [ 2113.076715][ T9049] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 2113.076748][ T9049] CPU: 0 UID: 0 PID: 9049 Comm: kworker/u9:3 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 2113.076781][ T9049] Tainted: [L]=SOFTLOCKUP [ 2113.076790][ T9049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 2113.076806][ T9049] Workqueue: hci1 hci_rx_work [ 2113.076847][ T9049] Call Trace: [ 2113.076856][ T9049] [ 2113.076866][ T9049] dump_stack_lvl+0xe8/0x150 [ 2113.076898][ T9049] sysfs_create_dir_ns+0x271/0x2a0 [ 2113.076926][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2113.076958][ T9049] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 2113.076990][ T9049] ? rt_spin_unlock+0x160/0x200 [ 2113.077020][ T9049] kobject_add_internal+0x631/0xd10 [ 2113.077056][ T9049] kobject_add+0x163/0x240 [ 2113.077085][ T9049] ? __pfx_kobject_add+0x10/0x10 [ 2113.077119][ T9049] ? get_device_parent+0x370/0x3a0 [ 2113.077155][ T9049] device_add+0x408/0xb90 [ 2113.077190][ T9049] hci_conn_add_sysfs+0xd5/0x210 [ 2113.077234][ T9049] le_conn_complete_evt+0x10e6/0x16b0 [ 2113.077272][ T9049] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2113.077298][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2113.077329][ T9049] ? lockdep_hardirqs_on+0x7a/0x110 [ 2113.077366][ T9049] ? skb_pull_data+0xfb/0x200 [ 2113.077394][ T9049] hci_le_conn_complete_evt+0x187/0x470 [ 2113.077429][ T9049] hci_event_packet+0x659/0xef0 [ 2113.077470][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2113.077497][ T9049] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2113.077522][ T9049] ? __pfx_hci_event_packet+0x10/0x10 [ 2113.077555][ T9049] ? rt_spin_unlock+0x14f/0x200 [ 2113.077593][ T9049] ? hci_send_to_monitor+0xe2/0x590 [ 2113.077630][ T9049] hci_rx_work+0x3ee/0x1040 [ 2113.077676][ T9049] ? process_one_work+0x8be/0x1630 [ 2113.077704][ T9049] process_one_work+0x98b/0x1630 [ 2113.077756][ T9049] ? __pfx_process_one_work+0x10/0x10 [ 2113.077782][ T9049] ? do_raw_spin_lock+0x12b/0x2f0 [ 2113.077829][ T9049] worker_thread+0xb49/0x1140 [ 2113.077869][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2113.077917][ T9049] kthread+0x388/0x470 [ 2113.077941][ T9049] ? __pfx_worker_thread+0x10/0x10 [ 2113.077968][ T9049] ? __pfx_kthread+0x10/0x10 [ 2113.077993][ T9049] ret_from_fork+0x514/0xb70 [ 2113.078023][ T9049] ? __pfx_ret_from_fork+0x10/0x10 [ 2113.078049][ T9049] ? __switch_to+0xc79/0x1410 [ 2113.078086][ T9049] ? __pfx_kthread+0x10/0x10 [ 2113.078111][ T9049] ret_from_fork_asm+0x1a/0x30 [ 2113.078157][ T9049] [ 2113.078222][ T9049] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 2113.078261][ T9049] Bluetooth: hci1: failed to register connection device [ 2113.318830][ T38] audit: type=1326 audit(5337140718.500:699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11345 comm="syz.2.14020" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2113.436232][ T823] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 2113.601536][ T823] usb 6-1: Using ep0 maxpacket: 8 [ 2113.603850][ T823] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2113.615234][ T823] usb 6-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2113.615266][ T823] usb 6-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2113.615288][ T823] usb 6-1: Product: syz [ 2113.615303][ T823] usb 6-1: Manufacturer: syz [ 2113.615318][ T823] usb 6-1: SerialNumber: syz [ 2113.735263][ T5716] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 2113.869870][ T823] usb 6-1: Invalid connection information received from device [ 2113.927738][ T5716] usb 1-1: Using ep0 maxpacket: 32 [ 2113.929646][ T5716] usb 1-1: too many configurations: 255, using maximum allowed: 8 [ 2113.949713][ T5716] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 2113.949752][ T5716] usb 1-1: can't read configurations, error -61 [ 2114.085612][ T10] usb 6-1: USB disconnect, device number 24 [ 2114.190153][ T5716] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 2114.355385][ T5716] usb 1-1: Using ep0 maxpacket: 32 [ 2114.356186][ T5716] usb 1-1: too many configurations: 255, using maximum allowed: 8 [ 2114.357835][ T5716] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 2114.357914][ T5716] usb 1-1: can't read configurations, error -61 [ 2114.358251][ T5716] usb usb1-port1: attempt power cycle [ 2114.393713][T11362] netlink: 'syz.2.14026': attribute type 10 has an invalid length. [ 2114.587885][ T38] audit: type=1326 audit(5337140719.688:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11367 comm="syz.2.14029" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2114.684271][T11373] netlink: 'syz.5.14030': attribute type 10 has an invalid length. [ 2114.766919][ T5716] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 2114.795839][ T5716] usb 1-1: Using ep0 maxpacket: 32 [ 2114.796661][ T5716] usb 1-1: too many configurations: 255, using maximum allowed: 8 [ 2114.799394][ T5716] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 2114.799439][ T5716] usb 1-1: can't read configurations, error -61 [ 2114.955160][ T5716] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 2114.977815][ T5716] usb 1-1: Using ep0 maxpacket: 32 [ 2114.978458][ T5716] usb 1-1: too many configurations: 255, using maximum allowed: 8 [ 2114.982203][ T5716] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 2114.982239][ T5716] usb 1-1: can't read configurations, error -61 [ 2114.982635][ T5716] usb usb1-port1: unable to enumerate USB device [ 2115.147206][ T4341] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 2115.237703][ T38] audit: type=1326 audit(5337140720.296:701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11382 comm="syz.4.14034" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2115.306756][ T4341] usb 6-1: Using ep0 maxpacket: 32 [ 2115.310611][ T4341] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2115.310673][ T4341] usb 6-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 2115.310692][ T4341] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2115.313189][ T4341] usb 6-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 2115.313218][ T4341] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2115.313230][ T4341] usb 6-1: Product: syz [ 2115.313238][ T4341] usb 6-1: Manufacturer: syz [ 2115.313248][ T4341] usb 6-1: SerialNumber: syz [ 2115.317034][ T4341] usb 6-1: config 0 descriptor?? [ 2116.046327][ T4341] gs_usb 6-1:0.0: Couldn't get device config: (err=-71) [ 2116.046374][ T4341] gs_usb 6-1:0.0: probe with driver gs_usb failed with error -71 [ 2116.079388][ T4341] usb 6-1: USB disconnect, device number 25 [ 2116.471994][ T10] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 2116.632551][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 2116.634621][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2116.642804][ T38] audit: type=1326 audit(5337140721.615:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11404 comm="syz.5.14043" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3b8629cdd9 code=0x0 [ 2116.652970][ T10] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2116.653000][ T10] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2116.653023][ T10] usb 3-1: Product: syz [ 2116.653039][ T10] usb 3-1: Manufacturer: syz [ 2116.653054][ T10] usb 3-1: SerialNumber: syz [ 2116.841412][T11410] netlink: 'syz.0.14045': attribute type 4 has an invalid length. [ 2116.880335][T11410] netlink: 'syz.0.14045': attribute type 4 has an invalid length. [ 2116.968721][ T10] usb 3-1: Handspring Visor / Palm OS: No valid connect info available [ 2116.968746][ T10] usb 3-1: Handspring Visor / Palm OS: port 0, is for Console use [ 2116.968758][ T10] usb 3-1: Handspring Visor / Palm OS: port 0, is for Generic use [ 2116.968770][ T10] usb 3-1: Handspring Visor / Palm OS: Number of ports: 2 [ 2117.176773][ T10] usb 3-1: palm_os_3_probe - error -71 getting bytes available request [ 2117.176876][ T10] visor 3-1:1.0: Handspring Visor / Palm OS converter detected [ 2117.198029][ T10] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 2117.213574][ T38] audit: type=1326 audit(5337140722.139:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11415 comm="syz.0.14048" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff1540ecdd9 code=0x0 [ 2117.237507][ T10] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 2117.270713][ T10] usb 3-1: USB disconnect, device number 93 [ 2117.353537][ T10] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 2117.388912][ T10] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 2117.404416][ T10] visor 3-1:1.0: device disconnected [ 2117.861863][ T1085] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 2118.022172][ T10] usb 3-1: new full-speed USB device number 94 using dummy_hcd [ 2118.022188][ T1085] usb 5-1: Using ep0 maxpacket: 32 [ 2118.026267][ T1085] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2118.026297][ T1085] usb 5-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 2118.026312][ T1085] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2118.028592][ T1085] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 2118.028621][ T1085] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2118.028643][ T1085] usb 5-1: Product: syz [ 2118.028660][ T1085] usb 5-1: Manufacturer: syz [ 2118.028675][ T1085] usb 5-1: SerialNumber: syz [ 2118.083752][ T1085] usb 5-1: config 0 descriptor?? [ 2118.178925][ T10] usb 3-1: device descriptor read/64, error -71 [ 2118.439075][ T10] usb 3-1: new full-speed USB device number 95 using dummy_hcd [ 2118.449725][ T32] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 2118.599136][ T10] usb 3-1: device descriptor read/64, error -71 [ 2118.666347][ T32] usb 1-1: config 0 has an invalid interface number: 255 but max is 0 [ 2118.666380][ T32] usb 1-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 2118.666401][ T32] usb 1-1: config 0 has no interface number 0 [ 2118.666490][ T32] usb 1-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 2118.666530][ T32] usb 1-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 2118.666558][ T32] usb 1-1: config 0 interface 255 has no altsetting 0 [ 2118.666653][ T32] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2118.666679][ T32] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2118.711917][ T10] usb usb3-port1: attempt power cycle [ 2118.758952][ T32] usb 1-1: config 0 descriptor?? [ 2118.822816][ T1085] gs_usb 5-1:0.0: Couldn't get device config: (err=-71) [ 2118.822864][ T1085] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -71 [ 2118.899805][ T1085] usb 5-1: USB disconnect, device number 41 [ 2119.012289][ T32] usb 1-1: string descriptor 0 read error: -71 [ 2119.046166][ T32] ath6kl: Failed to submit usb control message: -71 [ 2119.046210][ T32] ath6kl: unable to send the bmi data to the device: -71 [ 2119.046225][ T32] ath6kl: Unable to send get target info: -71 [ 2119.070760][ T10] usb 3-1: new full-speed USB device number 96 using dummy_hcd [ 2119.104187][ T10] usb 3-1: device descriptor read/8, error -71 [ 2119.238048][ T32] ath6kl: Failed to init ath6kl core: -71 [ 2119.238613][ T32] ath6kl_usb 1-1:0.255: probe with driver ath6kl_usb failed with error -71 [ 2119.249643][ T32] usb 1-1: USB disconnect, device number 10 [ 2119.486891][ T10] usb 3-1: new full-speed USB device number 97 using dummy_hcd [ 2119.522480][ T10] usb 3-1: device descriptor read/8, error -71 [ 2119.604655][T29055] Bluetooth: hci1: command 0x0406 tx timeout [ 2119.636742][ T10] usb usb3-port1: unable to enumerate USB device [ 2119.654037][T11440] FAULT_INJECTION: forcing a failure. [ 2119.654037][T11440] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2119.654061][T11440] CPU: 0 UID: 0 PID: 11440 Comm: syz.4.14057 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 2119.654078][T11440] Tainted: [L]=SOFTLOCKUP [ 2119.654083][T11440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 2119.654090][T11440] Call Trace: [ 2119.654095][T11440] [ 2119.654100][T11440] dump_stack_lvl+0xe8/0x150 [ 2119.654120][T11440] should_fail_ex+0x46b/0x600 [ 2119.654138][T11440] _copy_from_user+0x2d/0xb0 [ 2119.654157][T11440] ___sys_sendmsg+0x1c6/0x360 [ 2119.654175][T11440] ? __lock_acquire+0x6b5/0x2d10 [ 2119.654189][T11440] ? __pfx____sys_sendmsg+0x10/0x10 [ 2119.654222][T11440] ? __fget_files+0x2a/0x420 [ 2119.654236][T11440] ? __fget_files+0x3a6/0x420 [ 2119.654254][T11440] __x64_sys_sendmsg+0x1c3/0x2a0 [ 2119.654272][T11440] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2119.654294][T11440] ? __pfx_ksys_write+0x10/0x10 [ 2119.654314][T11440] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2119.654327][T11440] do_syscall_64+0x15f/0xf80 [ 2119.654339][T11440] ? trace_irq_disable+0x3b/0x140 [ 2119.654355][T11440] ? clear_bhb_loop+0x40/0x90 [ 2119.654370][T11440] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2119.654382][T11440] RIP: 0033:0x7f911c40cdd9 [ 2119.654394][T11440] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2119.654405][T11440] RSP: 002b:00007f911a666028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2119.654418][T11440] RAX: ffffffffffffffda RBX: 00007f911c685fa0 RCX: 00007f911c40cdd9 [ 2119.654427][T11440] RDX: 0000000000008000 RSI: 0000200000000380 RDI: 0000000000000003 [ 2119.654435][T11440] RBP: 00007f911a666090 R08: 0000000000000000 R09: 0000000000000000 [ 2119.654443][T11440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2119.654451][T11440] R13: 00007f911c686038 R14: 00007f911c685fa0 R15: 00007ffd04a1e3b8 [ 2119.654467][T11440] [ 2120.011353][ T38] audit: type=1326 audit(5337140724.758:704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11445 comm="syz.5.14060" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3b8629cdd9 code=0x0 [ 2120.045524][T11449] netlink: 36 bytes leftover after parsing attributes in process `syz.4.14061'. [ 2120.064370][ T38] audit: type=1326 audit(5337140724.823:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11447 comm="syz.0.14062" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff1540ecdd9 code=0x0 [ 2120.200018][ T9049] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 2121.173412][T11469] netlink: 36 bytes leftover after parsing attributes in process `syz.5.14071'. [ 2121.229359][ T823] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 2121.352294][ T9049] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 2121.432426][ T823] usb 1-1: Using ep0 maxpacket: 32 [ 2121.434559][ T823] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2121.434590][ T823] usb 1-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 2121.434613][ T823] usb 1-1: config 0 interface 0 has no altsetting 0 [ 2121.436953][ T823] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 2121.436980][ T823] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2121.436992][ T823] usb 1-1: Product: syz [ 2121.437001][ T823] usb 1-1: Manufacturer: syz [ 2121.437010][ T823] usb 1-1: SerialNumber: syz [ 2121.440319][ T823] usb 1-1: config 0 descriptor?? [ 2121.592907][T30573] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 2121.601630][ T38] audit: type=1326 audit(5337140726.254:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11477 comm="syz.5.14073" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3b8629cdd9 code=0x0 [ 2121.753062][T30573] usb 5-1: Using ep0 maxpacket: 8 [ 2121.756810][T30573] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2121.759337][T30573] usb 5-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2121.759366][T30573] usb 5-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2121.759388][T30573] usb 5-1: Product: syz [ 2121.759403][T30573] usb 5-1: Manufacturer: syz [ 2121.759419][T30573] usb 5-1: SerialNumber: syz [ 2121.933608][ T38] audit: type=1326 audit(5337140726.563:707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11480 comm="syz.2.14074" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2122.063981][T30573] usb 5-1: palm_os_3_probe - error -32 getting connection information [ 2122.064085][T30573] visor 5-1:1.0: probe with driver visor failed with error -32 [ 2122.159563][T30573] usb 5-1: USB disconnect, device number 42 [ 2122.198775][ T823] gs_usb 1-1:0.0: Couldn't get device config: (err=-71) [ 2122.198829][ T823] gs_usb 1-1:0.0: probe with driver gs_usb failed with error -71 [ 2122.242945][ T823] usb 1-1: USB disconnect, device number 11 [ 2122.550295][T11486] netlink: 36 bytes leftover after parsing attributes in process `syz.5.14076'. [ 2122.977227][ T38] audit: type=1326 audit(5337140727.536:708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11500 comm="syz.2.14083" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2123.196462][ T823] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 2123.404006][ T823] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 2123.404038][ T823] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2123.404050][ T823] usb 6-1: Product: syz [ 2123.404066][ T823] usb 6-1: Manufacturer: syz [ 2123.404075][ T823] usb 6-1: SerialNumber: syz [ 2123.506670][ T32] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 2123.672013][ T32] usb 5-1: config 0 has an invalid interface number: 64 but max is 0 [ 2123.672033][ T32] usb 5-1: config 0 has no interface number 0 [ 2123.676438][ T32] usb 5-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 2123.676469][ T32] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2123.676490][ T32] usb 5-1: Product: syz [ 2123.676505][ T32] usb 5-1: Manufacturer: syz [ 2123.676521][ T32] usb 5-1: SerialNumber: syz [ 2123.732689][ T32] usb 5-1: config 0 descriptor?? [ 2123.885786][ T823] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 2123.885848][ T823] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 2123.893992][T11497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2123.901192][T11497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2123.977349][ T32] uvcvideo 5-1:0.64: Found UVC 0.08 device syz (046d:0823) [ 2123.977386][ T32] uvcvideo 5-1:0.64: No valid video chain found. [ 2124.055092][ T32] usb 5-1: USB disconnect, device number 43 [ 2124.211081][ T38] audit: type=1326 audit(5337140728.686:709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11520 comm="syz.2.14091" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2125.210521][ T38] audit: type=1326 audit(5337140729.631:710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11540 comm="syz.2.14098" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2125.975985][ T823] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000040. ret = -EPROTO [ 2125.977764][ T823] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 2125.978235][ T823] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 2125.978287][ T823] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 2125.979207][ T823] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 2126.021738][T11555] loop4: detected capacity change from 0 to 524255231 [ 2126.027637][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x1, refcnt=2 [ 2126.060300][ T5305] lo_rw_aio(loop4) starting read with raw_refcnt=0x1, refcnt=2 [ 2126.061200][ T5305] lo_rw_aio(loop4) starting read with raw_refcnt=0x1, refcnt=2 [ 2126.075631][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.082794][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.086536][ T5305] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.091251][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.095066][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.134152][ T823] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 2126.153827][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.154846][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.155968][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.156921][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.186250][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.199405][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.208277][ T1444] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.216290][ T1444] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.218407][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.221163][ T823] usb 6-1: USB disconnect, device number 26 [ 2126.225146][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.230367][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.238263][ T1444] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.311408][ T38] audit: type=1326 audit(5337140730.651:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11556 comm="syz.4.14105" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2126.323481][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.325603][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.327295][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.330438][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.334787][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.335705][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.337294][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.339942][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.344676][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.345349][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.348522][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.348566][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.355370][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.361827][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.366526][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.440946][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.495731][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.539014][T11564] netlink: 20 bytes leftover after parsing attributes in process `syz.5.14108'. [ 2126.549487][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.549550][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.549578][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.549608][ T67] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.557286][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.565875][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.565929][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.565982][ T13] lo_rw_aio(loop4) starting read with raw_refcnt=0x0, refcnt=1 [ 2126.740736][T22739] __loop_clr_fd(loop4) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 2126.848841][T11576] netlink: 'syz.5.14112': attribute type 46 has an invalid length. [ 2126.848864][T11576] netlink: 44 bytes leftover after parsing attributes in process `syz.5.14112'. [ 2126.964404][T11580] netlink: 12 bytes leftover after parsing attributes in process `syz.5.14114'. [ 2127.054925][ T38] audit: type=1326 audit(5337140731.352:712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11582 comm="syz.0.14115" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff1540ecdd9 code=0x0 [ 2127.594945][ T38] audit: type=1326 audit(5337140731.857:713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11610 comm="syz.4.14126" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2127.980168][T11627] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14132'. [ 2128.005271][T11627] netlink: 1760 bytes leftover after parsing attributes in process `syz.0.14132'. [ 2128.114107][ T1085] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 2128.274443][ T5696] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 2128.277565][ T1085] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 2128.277597][ T1085] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 2128.278699][ T1085] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2128.278726][ T1085] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2128.278748][ T1085] usb 3-1: SerialNumber: syz [ 2128.283912][T11622] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 2128.413480][ T5696] usb 1-1: device descriptor read/64, error -71 [ 2128.565991][T11622] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 2128.670234][ T5696] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 2128.819630][ T5696] usb 1-1: device descriptor read/64, error -71 [ 2128.888138][T11641] netlink: 'syz.4.14137': attribute type 10 has an invalid length. [ 2128.937815][ T5696] usb usb1-port1: attempt power cycle [ 2128.970391][T11645] netlink: 36 bytes leftover after parsing attributes in process `syz.5.14139'. [ 2128.995674][ T1085] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 2129.132180][T29055] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 2129.184905][ T38] audit: type=1326 audit(5337140733.354:714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11649 comm="syz.4.14141" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2129.211155][T11622] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2129.211811][T11622] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2129.214612][T11622] netlink: 'syz.2.14129': attribute type 15 has an invalid length. [ 2129.214631][T11622] netlink: 666 bytes leftover after parsing attributes in process `syz.2.14129'. [ 2129.300936][ T5696] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 2129.323720][ T5696] usb 1-1: device descriptor read/8, error -71 [ 2129.595950][T11654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2129.596919][T11654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2129.621595][ T5696] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 2129.624712][ T1085] usb 3-1: USB disconnect, device number 98 [ 2129.645093][ T5696] usb 1-1: device descriptor read/8, error -71 [ 2129.760789][ T5696] usb usb1-port1: unable to enumerate USB device [ 2130.007312][ T1085] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 2130.167833][ T1085] usb 3-1: Using ep0 maxpacket: 8 [ 2130.171731][ T1085] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2130.181421][ T1085] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2130.181460][ T1085] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2130.181481][ T1085] usb 3-1: Product: syz [ 2130.181496][ T1085] usb 3-1: Manufacturer: syz [ 2130.181512][ T1085] usb 3-1: SerialNumber: syz [ 2130.472367][ T1085] usb 3-1: palm_os_3_probe - error -32 getting connection information [ 2130.472430][ T1085] visor 3-1:1.0: probe with driver visor failed with error -32 [ 2130.498965][ T1085] usb 3-1: USB disconnect, device number 99 [ 2131.330484][T11679] netlink: 36 bytes leftover after parsing attributes in process `syz.2.14152'. [ 2131.399155][ T823] usb 5-1: new full-speed USB device number 44 using dummy_hcd [ 2131.443540][ T38] audit: type=1326 audit(5337140735.459:715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11681 comm="syz.0.14153" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff1540ecdd9 code=0x0 [ 2131.511544][ T9049] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 2131.511576][ T9049] CPU: 0 UID: 0 PID: 9049 Comm: kworker/u9:3 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 2131.511607][ T9049] Tainted: [L]=SOFTLOCKUP [ 2131.511616][ T9049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 2131.511630][ T9049] Workqueue: hci0 hci_rx_work [ 2131.511666][ T9049] Call Trace: [ 2131.511675][ T9049] [ 2131.511686][ T9049] dump_stack_lvl+0xe8/0x150 [ 2131.511716][ T9049] sysfs_create_dir_ns+0x271/0x2a0 [ 2131.511744][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2131.511773][ T9049] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 2131.511802][ T9049] ? rt_spin_unlock+0x160/0x200 [ 2131.511830][ T9049] kobject_add_internal+0x631/0xd10 [ 2131.511865][ T9049] kobject_add+0x163/0x240 [ 2131.511894][ T9049] ? __pfx_kobject_add+0x10/0x10 [ 2131.511929][ T9049] ? get_device_parent+0x370/0x3a0 [ 2131.511965][ T9049] device_add+0x408/0xb90 [ 2131.511998][ T9049] hci_conn_add_sysfs+0xd5/0x210 [ 2131.512031][ T9049] le_conn_complete_evt+0x10e6/0x16b0 [ 2131.512065][ T9049] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2131.512093][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2131.512124][ T9049] ? lockdep_hardirqs_on+0x7a/0x110 [ 2131.512158][ T9049] ? skb_pull_data+0xfb/0x200 [ 2131.512186][ T9049] hci_le_conn_complete_evt+0x187/0x470 [ 2131.512218][ T9049] hci_event_packet+0x659/0xef0 [ 2131.512256][ T9049] ? __pfx____migrate_enable+0x10/0x10 [ 2131.512288][ T9049] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2131.512326][ T9049] ? __pfx_hci_event_packet+0x10/0x10 [ 2131.512357][ T9049] ? rt_spin_unlock+0x14f/0x200 [ 2131.512391][ T9049] ? hci_send_to_monitor+0xe2/0x590 [ 2131.512420][ T9049] hci_rx_work+0x3ee/0x1040 [ 2131.512461][ T9049] ? process_one_work+0x8be/0x1630 [ 2131.512489][ T9049] process_one_work+0x98b/0x1630 [ 2131.512536][ T9049] ? __pfx_process_one_work+0x10/0x10 [ 2131.512563][ T9049] ? do_raw_spin_lock+0x12b/0x2f0 [ 2131.512609][ T9049] worker_thread+0xb49/0x1140 [ 2131.512649][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2131.512696][ T9049] kthread+0x388/0x470 [ 2131.512718][ T9049] ? __pfx_worker_thread+0x10/0x10 [ 2131.512746][ T9049] ? __pfx_kthread+0x10/0x10 [ 2131.512770][ T9049] ret_from_fork+0x514/0xb70 [ 2131.512809][ T9049] ? __pfx_ret_from_fork+0x10/0x10 [ 2131.512835][ T9049] ? __switch_to+0xc79/0x1410 [ 2131.512872][ T9049] ? __pfx_kthread+0x10/0x10 [ 2131.512897][ T9049] ret_from_fork_asm+0x1a/0x30 [ 2131.512944][ T9049] [ 2131.513002][ T9049] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 2131.513040][ T9049] Bluetooth: hci0: failed to register connection device [ 2131.559588][ T823] usb 5-1: config 1 has an invalid interface number: 69 but max is 0 [ 2131.559618][ T823] usb 5-1: config 1 has no interface number 0 [ 2131.559651][ T823] usb 5-1: config 1 interface 69 has no altsetting 0 [ 2131.563334][ T823] usb 5-1: New USB device found, idVendor=13d8, idProduct=0010, bcdDevice=ac.d9 [ 2131.563364][ T823] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2131.563385][ T823] usb 5-1: Product: syz [ 2131.563401][ T823] usb 5-1: Manufacturer: syz [ 2131.563416][ T823] usb 5-1: SerialNumber: syz [ 2131.878826][T11671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2131.881434][T11671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2131.912141][ T823] comedi comedi4: This driver needs USB 2.0 to operate. Aborting... [ 2131.912167][ T823] usbduxfast 5-1:1.69: driver 'usbduxfast' failed to auto-configure device. [ 2131.924205][ T823] usb 5-1: USB disconnect, device number 44 [ 2132.634491][ T823] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 2132.786054][ T10] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 2132.807253][ T823] usb 1-1: Using ep0 maxpacket: 8 [ 2132.809508][ T823] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 2132.812016][ T823] usb 1-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 2132.812045][ T823] usb 1-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 2132.812068][ T823] usb 1-1: Product: syz [ 2132.812080][ T823] usb 1-1: Manufacturer: syz [ 2132.812088][ T823] usb 1-1: SerialNumber: syz [ 2132.965002][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 2132.984945][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2133.001716][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2133.001735][ T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2133.001763][ T10] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2133.032309][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2133.032402][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2133.032431][ T10] usb 5-1: Product: syz [ 2133.032447][ T10] usb 5-1: Manufacturer: syz [ 2133.032462][ T10] usb 5-1: SerialNumber: syz [ 2133.078166][ T823] usb 1-1: palm_os_3_probe - error -32 getting connection information [ 2133.078238][ T823] visor 1-1:1.0: probe with driver visor failed with error -32 [ 2133.119281][ T823] usb 1-1: USB disconnect, device number 16 [ 2133.284276][T11708] program syz.5.14162 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2133.380790][ T10] cdc_ncm 5-1:1.0: CDC Union missing and no IAD found [ 2133.380840][ T10] cdc_ncm 5-1:1.0: bind() failure [ 2133.424345][T11713] netlink: 36 bytes leftover after parsing attributes in process `syz.5.14164'. [ 2133.433687][ T10] usb 5-1: USB disconnect, device number 45 [ 2133.554163][T11716] tipc: Started in network mode [ 2133.554190][T11716] tipc: Node identity 000000000000003a2d00000000000001, cluster identity 4711 [ 2133.554225][T11716] tipc: Enabling of bearer rejected, failed to enable media [ 2133.578815][T29055] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 2133.634441][T11718] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14166'. [ 2133.917712][T11729] netlink: 'syz.4.14171': attribute type 10 has an invalid length. [ 2134.146423][ T823] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 2134.253295][T11729] team0: Device vxcan0 is of different type [ 2134.335967][ T823] usb 1-1: Using ep0 maxpacket: 32 [ 2134.338150][ T823] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 2134.338187][ T823] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2134.343934][ T823] usb 1-1: config 0 descriptor?? [ 2134.349938][ T823] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 2134.664519][T11739] loop9: detected capacity change from 0 to 7 [ 2134.665519][T23837] lo_rw_aio(loop9) starting read with raw_refcnt=0x1, refcnt=2 [ 2134.681033][T11739] Dev loop9: unable to read RDB block 7 [ 2134.681083][T11739] loop9: unable to read partition table [ 2134.681285][T11739] loop9: partition table beyond EOD, truncated [ 2134.682461][T11739] loop_reread_partitions: partition scan of loop9 (þ被xü—ŸÑà– ) failed (rc=-5) [ 2134.723528][ T7700] __loop_clr_fd(loop9) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 2134.804687][ T823] gspca_vc032x: reg_w err -71 [ 2134.804706][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804718][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804728][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804737][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804746][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804756][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804765][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804774][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804783][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804793][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804802][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804812][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804821][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804830][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804840][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804849][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804859][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804867][ T823] gspca_vc032x: I2c Bus Busy Wait 00 [ 2134.804877][ T823] gspca_vc032x: Unknown sensor... [ 2134.804939][ T823] vc032x 1-1:0.0: probe with driver vc032x failed with error -22 [ 2134.855460][ T823] usb 1-1: USB disconnect, device number 17 [ 2135.351917][ T32] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 2135.376138][ T38] audit: type=1326 audit(5337140739.144:716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11761 comm="syz.2.14184" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2135.502176][ T10] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 2135.512033][ T32] usb 5-1: Using ep0 maxpacket: 8 [ 2135.529438][ T32] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 2135.529469][ T32] usb 5-1: config 179 has no interface number 0 [ 2135.529515][ T32] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 2135.529543][ T32] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 2135.529572][ T32] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2135.529600][ T32] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 2135.529624][ T32] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 2135.529652][ T32] usb 5-1: config 179 interface 65 has no altsetting 0 [ 2135.529687][ T32] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 2135.529711][ T32] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2135.662202][ T10] usb 6-1: device descriptor read/64, error -71 [ 2135.713994][ T32] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input161 [ 2135.799641][T11769] netlink: 'syz.0.14187': attribute type 10 has an invalid length. [ 2135.924818][T11769] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2135.928479][T11769] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 2135.944813][ T10] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 2135.962744][ T823] usb 5-1: USB disconnect, device number 46 [ 2136.100824][ T10] usb 6-1: device descriptor read/64, error -71 [ 2136.228571][ T10] usb usb6-port1: attempt power cycle [ 2136.333951][T11773] tmpfs: Bad value for 'size' [ 2136.341660][T29055] bt_err_ratelimited: 23 callbacks suppressed [ 2136.341677][T29055] Bluetooth: hci0: Unknown advertising packet type: 0x19 [ 2136.341687][T29055] Bluetooth: hci0: Unknown advertising packet type: 0x1f [ 2136.341705][T29055] Bluetooth: hci0: Unknown advertising packet type: 0x31 [ 2136.341714][T29055] Bluetooth: hci0: Unknown advertising packet type: 0x37 [ 2136.341722][T29055] Bluetooth: hci0: Malformed LE Event: 0x0d [ 2136.591757][ T10] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 2136.615355][ T10] usb 6-1: device descriptor read/8, error -71 [ 2136.872252][ T10] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 2136.891601][ T10] usb 6-1: device descriptor read/8, error -71 [ 2136.944479][ T823] usb 5-1: new full-speed USB device number 47 using dummy_hcd [ 2137.009078][ T10] usb usb6-port1: unable to enumerate USB device [ 2137.110804][ T823] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2137.111461][ T823] usb 5-1: not running at top speed; connect to a high speed hub [ 2137.115829][ T823] usb 5-1: New USB device found, idVendor=1235, idProduct=8014, bcdDevice= 0.40 [ 2137.115859][ T823] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2137.115880][ T823] usb 5-1: Product: syz [ 2137.115895][ T823] usb 5-1: Manufacturer: syz [ 2137.115911][ T823] usb 5-1: SerialNumber: syz [ 2137.354515][ T38] audit: type=1326 audit(5337140740.987:717): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11789 comm="syz.2.14196" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c9773cdd9 code=0x0 [ 2137.407807][T11781] syzkaller1: entered promiscuous mode [ 2137.407845][T11781] syzkaller1: entered allmulticast mode [ 2137.865200][ T823] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 2137.868044][ T823] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 2137.914854][ T823] usb 5-1: USB disconnect, device number 47 [ 2138.323930][ T5716] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 2138.516130][ T1085] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 2138.528833][ T5716] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2138.528887][ T5716] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2138.528910][ T5716] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2138.541866][ T5716] usb 1-1: config 0 descriptor?? [ 2138.644019][T11800] netlink: 36 bytes leftover after parsing attributes in process `syz.4.14200'. [ 2138.676473][ T1085] usb 3-1: Using ep0 maxpacket: 32 [ 2138.679678][ T1085] usb 3-1: config 0 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2138.679712][ T1085] usb 3-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 2138.679741][ T1085] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2138.679775][ T1085] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 2138.679800][ T1085] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2138.744010][ T1085] usb 3-1: config 0 descriptor?? [ 2138.845430][T29055] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 2139.061480][T11795] libceph: resolve '.‹R¯HÖe'ì»Ë /Ïâµüë1ýC¸ £~—1W–쯑ë¨eþxEA®ÁþeSb{~Rð' (ret=-3): failed [ 2139.284314][ T5716] ath6kl: mismatched byte count 0 vs. expected 12 [ 2139.288108][ T5716] ath6kl: Failed to init ath6kl core: -22 [ 2139.288814][ T5716] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 2139.439422][T11797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2139.441010][T11797] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2139.598676][ T5696] usb 1-1: USB disconnect, device number 18 [ 2139.660528][ T1085] usbhid 3-1:0.0: can't add hid device: -71 [ 2139.660653][ T1085] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 2139.680216][ T1085] usb 3-1: USB disconnect, device number 100 [ 2139.895100][ T5716] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 2139.912141][ T38] audit: type=1326 audit(5337140743.381:718): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11819 comm="syz.4.14207" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f911c40cdd9 code=0x0 [ 2140.055556][ T5716] usb 6-1: Using ep0 maxpacket: 32 [ 2140.057663][ T5716] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2140.057692][ T5716] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2140.057725][ T5716] usb 6-1: too many endpoints for config 1 interface 1 altsetting 0: 128, using maximum allowed: 30 [ 2140.057748][ T5716] usb 6-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 128 [ 2140.057771][ T5716] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 2140.057786][ T5716] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 2140.059932][ T5716] usb 6-1: New USB device found, idVendor=2b53, idProduct=0031, bcdDevice= 0.40 [ 2140.059962][ T5716] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2140.059982][ T5716] usb 6-1: Product: syz [ 2140.059997][ T5716] usb 6-1: Manufacturer: syz [ 2140.060013][ T5716] usb 6-1: SerialNumber: syz [ 2140.377534][T11827] netlink: 'syz.2.14209': attribute type 10 has an invalid length. [ 2140.399318][T11827] team0: Cannot enslave team device to itself [ 2140.407439][ T5716] usb 6-1: USB disconnect, device number 31 [ 2140.792382][ T7700] udevd[7700]: setting mode of /dev/bus/usb/006/031 to 020664 failed: No such file or directory [ 2140.792541][ T7700] udevd[7700]: setting owner of /dev/bus/usb/006/031 to uid=0, gid=0 failed: No such file or directory [ 2140.885711][ T7703] udevd[7703]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2141.012496][T11839] netlink: 36 bytes leftover after parsing attributes in process `syz.2.14215'. [ 2141.046112][T11841] netlink: 36 bytes leftover after parsing attributes in process `syz.5.14216'. [ 2141.308696][T29055] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 2141.450886][ T38] audit: type=1326 audit(5337140744.822:719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11853 comm="syz.0.14222" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff1540ecdd9 code=0x0 [ 2141.546716][T11860] netlink: 348 bytes leftover after parsing attributes in process `syz.5.14224'. [ 2141.891461][T11866] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14226'. [ 2142.116234][T11874] overlayfs: missing 'lowerdir' [ 2142.397714][T20701] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 2142.449308][T11886] netlink: 'syz.0.14236': attribute type 21 has an invalid length. [ 2142.449419][T11886] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14236'. [ 2142.453804][T11888] netlink: 'syz.0.14236': attribute type 21 has an invalid length. [ 2142.453862][T11888] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14236'. [ 2142.546553][ T1085] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 2142.564758][T20701] usb 3-1: device descriptor read/64, error -71 [ 2142.685357][ T1085] usb 6-1: device descriptor read/64, error -71 [ 2142.750640][T11891] netlink: 36 bytes leftover after parsing attributes in process `syz.0.14237'. [ 2142.815662][T20701] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 2142.906125][ T9049] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 2142.906147][ T9049] CPU: 1 UID: 0 PID: 9049 Comm: kworker/u9:3 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 2142.906164][ T9049] Tainted: [L]=SOFTLOCKUP [ 2142.906169][ T9049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 2142.906178][ T9049] Workqueue: hci2 hci_rx_work [ 2142.906202][ T9049] Call Trace: [ 2142.906207][ T9049] [ 2142.906215][ T9049] dump_stack_lvl+0xe8/0x150 [ 2142.906233][ T9049] sysfs_create_dir_ns+0x271/0x2a0 [ 2142.906249][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2142.906266][ T9049] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 2142.906284][ T9049] ? rt_spin_unlock+0x160/0x200 [ 2142.906300][ T9049] kobject_add_internal+0x631/0xd10 [ 2142.906320][ T9049] kobject_add+0x163/0x240 [ 2142.906337][ T9049] ? __pfx_kobject_add+0x10/0x10 [ 2142.906363][ T9049] ? get_device_parent+0x370/0x3a0 [ 2142.906383][ T9049] device_add+0x408/0xb90 [ 2142.906402][ T9049] hci_conn_add_sysfs+0xd5/0x210 [ 2142.906422][ T9049] le_conn_complete_evt+0x10e6/0x16b0 [ 2142.906443][ T9049] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2142.906458][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2142.906477][ T9049] ? lockdep_hardirqs_on+0x7a/0x110 [ 2142.906496][ T9049] ? skb_pull_data+0xfb/0x200 [ 2142.906512][ T9049] hci_le_conn_complete_evt+0x187/0x470 [ 2142.906530][ T9049] hci_event_packet+0x659/0xef0 [ 2142.906551][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2142.906566][ T9049] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2142.906580][ T9049] ? __pfx_hci_event_packet+0x10/0x10 [ 2142.906599][ T9049] ? rt_spin_unlock+0x14f/0x200 [ 2142.906619][ T9049] ? hci_send_to_monitor+0xe2/0x590 [ 2142.906636][ T9049] hci_rx_work+0x3ee/0x1040 [ 2142.906660][ T9049] ? process_one_work+0x8be/0x1630 [ 2142.906675][ T9049] process_one_work+0x98b/0x1630 [ 2142.906702][ T9049] ? __pfx_process_one_work+0x10/0x10 [ 2142.906717][ T9049] ? do_raw_spin_lock+0x12b/0x2f0 [ 2142.906742][ T9049] worker_thread+0xb49/0x1140 [ 2142.906763][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2142.906788][ T9049] kthread+0x388/0x470 [ 2142.906801][ T9049] ? __pfx_worker_thread+0x10/0x10 [ 2142.906816][ [ 2142.906816][ T9049] ? __pfx_kthread+0x10/0x10 [ 2142.906829][ T9049] ret_from_fork+0x514/0xb70 [ 2142.906845][ T9049] ? __pfx_ret_from_fork+0x10/0x10 [ 2142.906859][ T9049] ? __switch_to+0xc79/0x1410 [ 2142.906878][ T9049] ? __pfx_kthread+0x10/0x10 [ 2142.906891][ T9049] ret_from_fork_asm+0x1a/0x30 [ 2142.906915][ T9049] [ 2142.906935][ T9049] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 2142.906959][ T9049] Bluetooth: hci2: failed to register connection device [ 2142.963321][ T1085] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 2142.967133][T20701] usb 3-1: device descriptor read/64, error -71 [ 2143.256245][T20701] usb usb3-port1: attempt power cycle [ 2143.327292][ T9049] ================================================================== [ 2143.327310][ T9049] BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0x902/0x1560 [ 2143.327356][ T9049] Read of size 8 at addr ffff88804dce5500 by task kworker/u9:3/9049 [ 2143.327376][ T9049] [ 2143.327391][ T9049] CPU: 1 UID: 0 PID: 9049 Comm: kworker/u9:3 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 2143.327423][ T9049] Tainted: [L]=SOFTLOCKUP [ 2143.327433][ T9049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 2143.327448][ T9049] Workqueue: hci2 hci_rx_work [ 2143.327482][ T9049] Call Trace: [ 2143.327491][ T9049] [ 2143.327502][ T9049] dump_stack_lvl+0xe8/0x150 [ 2143.327529][ T9049] print_address_description+0x55/0x1e0 [ 2143.327557][ T9049] ? l2cap_connect_cfm+0x902/0x1560 [ 2143.327584][ T9049] print_report+0x58/0x70 [ 2143.327607][ T9049] kasan_report+0x117/0x150 [ 2143.327640][ T9049] ? l2cap_connect_cfm+0x902/0x1560 [ 2143.327667][ T9049] l2cap_connect_cfm+0x902/0x1560 [ 2143.327698][ T9049] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 2143.327725][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2143.327757][ T9049] ? lockdep_hardirqs_on+0x7a/0x110 [ 2143.327789][ T9049] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 2143.327819][ T9049] ? mutex_lock_nested+0x152/0x1d0 [ 2143.327845][ T9049] ? hci_connect_cfm+0x2c/0x140 [ 2143.327868][ T9049] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 2143.327896][ T9049] hci_connect_cfm+0x95/0x140 [ 2143.327920][ T9049] le_conn_complete_evt+0x1134/0x16b0 [ 2143.327947][ T9049] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2143.327971][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2143.328003][ T9049] ? lockdep_hardirqs_on+0x7a/0x110 [ 2143.328037][ T9049] ? skb_pull_data+0xfb/0x200 [ 2143.328060][ T9049] hci_le_conn_complete_evt+0x187/0x470 [ 2143.328087][ T9049] hci_event_packet+0x659/0xef0 [ 2143.328119][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2143.328146][ T9049] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2143.328168][ T9049] ? __pfx_hci_event_packet+0x10/0x10 [ 2143.328199][ T9049] ? rt_spin_unlock+0x14f/0x200 [ 2143.328230][ T9049] ? hci_send_to_monitor+0xe2/0x590 [ 2143.328258][ T9049] hci_rx_work+0x3ee/0x1040 [ 2143.328293][ T9049] ? process_one_work+0x8be/0x1630 [ 2143.328318][ T9049] process_one_work+0x98b/0x1630 [ 2143.328361][ T9049] ? __pfx_process_one_work+0x10/0x10 [ 2143.328387][ T9049] ? do_raw_spin_lock+0x12b/0x2f0 [ 2143.328422][ T9049] worker_thread+0xb49/0x1140 [ 2143.328453][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2143.328488][ T9049] kthread+0x388/0x470 [ 2143.328507][ T9049] ? __pfx_worker_thread+0x10/0x10 [ 2143.328534][ T9049] ? __pfx_kthread+0x10/0x10 [ 2143.328555][ T9049] ret_from_fork+0x514/0xb70 [ 2143.328580][ T9049] ? __pfx_ret_from_fork+0x10/0x10 [ 2143.328603][ T9049] ? __switch_to+0xc79/0x1410 [ 2143.328633][ T9049] ? __pfx_kthread+0x10/0x10 [ 2143.328653][ T9049] ret_from_fork_asm+0x1a/0x30 [ 2143.328691][ T9049] [ 2143.328700][ T9049] [ 2143.328706][ T9049] Allocated by task 9049: [ 2143.328717][ T9049] kasan_save_track+0x3e/0x80 [ 2143.328743][ T9049] __kasan_kmalloc+0x93/0xb0 [ 2143.328769][ T9049] __kmalloc_cache_noprof+0x3a6/0x690 [ 2143.328796][ T9049] l2cap_chan_create+0x51/0x7a0 [ 2143.328824][ T9049] l2cap_sock_new_connection_cb+0x191/0x2f0 [ 2143.328853][ T9049] l2cap_connect_cfm+0x368/0x1560 [ 2143.328878][ T9049] hci_connect_cfm+0x95/0x140 [ 2143.328900][ T9049] le_conn_complete_evt+0x1134/0x16b0 [ 2143.328923][ T9049] hci_le_conn_complete_evt+0x187/0x470 [ 2143.328946][ T9049] hci_event_packet+0x659/0xef0 [ 2143.328974][ T9049] hci_rx_work+0x3ee/0x1040 [ 2143.329003][ T9049] process_one_work+0x98b/0x1630 [ 2143.329028][ T9049] worker_thread+0xb49/0x1140 [ 2143.329054][ T9049] kthread+0x388/0x470 [ 2143.329073][ T9049] ret_from_fork+0x514/0xb70 [ 2143.329094][ T9049] ret_from_fork_asm+0x1a/0x30 [ 2143.329119][ T9049] [ 2143.329124][ T9049] Freed by task 11891: [ 2143.329135][ T9049] kasan_save_track+0x3e/0x80 [ 2143.329160][ T9049] kasan_save_free_info+0x46/0x50 [ 2143.329180][ T9049] __kasan_slab_free+0x5c/0x80 [ 2143.329206][ T9049] kfree+0x1c5/0x6c0 [ 2143.329229][ T9049] l2cap_sock_cleanup_listen+0xf0/0x440 [ 2143.329257][ T9049] l2cap_sock_release+0x6e/0x270 [ 2143.329283][ T9049] __sock_release+0xb9/0x250 [ 2143.329303][ T9049] sock_close+0x1c/0x30 [ 2143.329323][ T9049] __fput+0x461/0xa70 [ 2143.329353][ T9049] task_work_run+0x1d9/0x270 [ 2143.329375][ T9049] exit_to_user_mode_loop+0xf3/0x4d0 [ 2143.329407][ T9049] do_syscall_64+0x33e/0xf80 [ 2143.329425][ T9049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2143.329446][ T9049] [ 2143.329452][ T9049] The buggy address belongs to the object at ffff88804dce5000 [ 2143.329452][ T9049] which belongs to the cache kmalloc-2k of size 2048 [ 2143.329471][ T9049] The buggy address is located 1280 bytes inside of [ 2143.329471][ T9049] freed 2048-byte region [ffff88804dce5000, ffff88804dce5800) [ 2143.329495][ T9049] [ 2143.329501][ T9049] The buggy address belongs to the physical page: [ 2143.329520][ T9049] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4dce0 [ 2143.329542][ T9049] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2143.329560][ T9049] flags: 0x80000000000040(head|node=0|zone=1) [ 2143.329580][ T9049] page_type: f5(slab) [ 2143.329600][ T9049] raw: 0080000000000040 ffff88813fea2000 dead000000000100 dead000000000122 [ 2143.329621][ T9049] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 2143.329643][ T9049] head: 0080000000000040 ffff88813fea2000 dead000000000100 dead000000000122 [ 2143.329663][ T9049] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 2143.329684][ T9049] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 2143.329704][ T9049] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 2143.329716][ T9049] page dumped because: kasan: bad access detected [ 2143.329727][ T9049] page_owner tracks the page as allocated [ 2143.329736][ T9049] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 14886, tgid 14885 (syz.3.3377), ts 548277390892, free_ts 547940095912 [ 2143.329775][ T9049] post_alloc_hook+0x1f9/0x250 [ 2143.329801][ T9049] get_page_from_freelist+0x27d6/0x2850 [ 2143.329831][ T9049] __alloc_frozen_pages_noprof+0x18d/0x380 [ 2143.329861][ T9049] allocate_slab+0x74/0x5e0 [ 2143.329881][ T9049] refill_objects+0x33c/0x3d0 [ 2143.329900][ T9049] __pcs_replace_empty_main+0x373/0x720 [ 2143.329922][ T9049] __kmalloc_cache_noprof+0x44e/0x690 [ 2143.329950][ T9049] psi_cgroup_alloc+0x56/0x200 [ 2143.329975][ T9049] cgroup_mkdir+0x49f/0xf40 [ 2143.329993][ T9049] kernfs_iop_mkdir+0x211/0x350 [ 2143.330021][ T9049] vfs_mkdir+0x40b/0x630 [ 2143.330048][ T9049] filename_mkdirat+0x289/0x520 [ 2143.330077][ T9049] __se_sys_mkdirat+0x35/0x150 [ 2143.330105][ T9049] do_syscall_64+0x15f/0xf80 [ 2143.330122][ T9049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2143.330149][ T9049] page last free pid 1444 tgid 1444 stack trace: [ 2143.330162][ T9049] __free_frozen_pages+0x1075/0x11b0 [ 2143.330189][ T9049] __slab_free+0x252/0x2a0 [ 2143.330216][ T9049] qlist_free_all+0x99/0x100 [ 2143.330239][ T9049] kasan_quarantine_reduce+0x148/0x160 [ 2143.330263][ T9049] __kasan_slab_alloc+0x22/0x80 [ 2143.330287][ T9049] kmem_cache_alloc_node_noprof+0x22a/0x6e0 [ 2143.330312][ T9049] __alloc_skb+0x1d0/0x7d0 [ 2143.330344][ T9049] rtmsg_fib+0xea/0x4c0 [ 2143.330365][ T9049] fib_table_delete+0xaa6/0xd60 [ 2143.330390][ T9049] fib_magic+0x456/0x510 [ 2143.330418][ T9049] fib_del_ifaddr+0x1085/0x1460 [ 2143.330437][ T9049] fib_inetaddr_event+0xbb/0x190 [ 2143.330455][ T9049] notifier_call_chain+0x1ad/0x3d0 [ 2143.330486][ T9049] blocking_notifier_call_chain+0x6a/0x90 [ 2143.330506][ T9049] __inet_del_ifa+0x840/0xfe0 [ 2143.330532][ T9049] inetdev_event+0x647/0x1610 [ 2143.330560][ T9049] [ 2143.330565][ T9049] Memory state around the buggy address: [ 2143.330577][ T9049] ffff88804dce5400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2143.330593][ T9049] ffff88804dce5480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2143.330608][ T9049] >ffff88804dce5500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2143.330620][ T9049] ^ [ 2143.330631][ T9049] ffff88804dce5580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2143.330647][ T9049] ffff88804dce5600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2143.330658][ T9049] ================================================================== [ 2143.333779][ T9049] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 2143.333803][ T9049] CPU: 1 UID: 0 PID: 9049 Comm: kworker/u9:3 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 2143.333836][ T9049] Tainted: [L]=SOFTLOCKUP [ 2143.333846][ T9049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 2143.333862][ T9049] Workqueue: hci2 hci_rx_work [ 2143.333898][ T9049] Call Trace: [ 2143.333907][ T9049] [ 2143.333917][ T9049] vpanic+0x56c/0xa60 [ 2143.333951][ T9049] ? __pfx_vpanic+0x10/0x10 [ 2143.333986][ T9049] panic+0xc5/0xd0 [ 2143.334015][ T9049] ? __pfx_panic+0x10/0x10 [ 2143.334046][ T9049] ? preempt_schedule_thunk+0x16/0x40 [ 2143.334080][ T9049] ? l2cap_connect_cfm+0x902/0x1560 [ 2143.334106][ T9049] ? preempt_schedule_thunk+0x16/0x40 [ 2143.334139][ T9049] ? l2cap_connect_cfm+0x902/0x1560 [ 2143.334166][ T9049] check_panic_on_warn+0x89/0xb0 [ 2143.334190][ T9049] ? l2cap_connect_cfm+0x902/0x1560 [ 2143.334217][ T9049] end_report+0x73/0x170 [ 2143.334247][ T9049] ? l2cap_connect_cfm+0x902/0x1560 [ 2143.334273][ T9049] kasan_report+0x128/0x150 [ 2143.334303][ T9049] ? l2cap_connect_cfm+0x902/0x1560 [ 2143.334341][ T9049] l2cap_connect_cfm+0x902/0x1560 [ 2143.334374][ T9049] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 2143.334401][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2143.334435][ T9049] ? lockdep_hardirqs_on+0x7a/0x110 [ 2143.334468][ T9049] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 2143.334500][ T9049] ? mutex_lock_nested+0x152/0x1d0 [ 2143.334526][ T9049] ? hci_connect_cfm+0x2c/0x140 [ 2143.334550][ T9049] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 2143.334577][ T9049] hci_connect_cfm+0x95/0x140 [ 2143.334602][ T9049] le_conn_complete_evt+0x1134/0x16b0 [ 2143.334633][ T9049] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2143.334658][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2143.334688][ T9049] ? lockdep_hardirqs_on+0x7a/0x110 [ 2143.334720][ T9049] ? skb_pull_data+0xfb/0x200 [ 2143.334743][ T9049] hci_le_conn_complete_evt+0x187/0x470 [ 2143.334771][ T9049] hci_event_packet+0x659/0xef0 [ 2143.334807][ T9049] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2143.334834][ T9049] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2143.334855][ T9049] ? __pfx_hci_event_packet+0x10/0x10 [ 2143.334887][ T9049] ? rt_spin_unlock+0x14f/0x200 [ 2143.334917][ T9049] ? hci_send_to_monitor+0xe2/0x590 [ 2143.334945][ T9049] hci_rx_work+0x3ee/0x1040 [ 2143.334982][ T9049] ? process_one_work+0x8be/0x1630 [ 2143.335011][ T9049] process_one_work+0x98b/0x1630 [ 2143.335048][ T9049] ? __pfx_process_one_work+0x10/0x10 [ 2143.335076][ T9049] ? do_raw_spin_lock+0x12b/0x2f0 [ 2143.335112][ T9049] worker_thread+0xb49/0x1140 [ 2143.335146][ T9049] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2143.335189][ T9049] kthread+0x388/0x470 [ 2143.335211][ T9049] ? __pfx_worker_thread+0x10/0x10 [ 2143.335240][ T9049] ? __pfx_kthread+0x10/0x10 [ 2143.335262][ T9049] ret_from_fork+0x514/0xb70 [ 2143.335288][ T9049] ? __pfx_ret_from_fork+0x10/0x10 [ 2143.335312][ T9049] ? __switch_to+0xc79/0x1410 [ 2143.335353][ T9049] ? __pfx_kthread+0x10/0x10 [ 2143.335376][ T9049] ret_from_fork_asm+0x1a/0x30 [ 2143.335413][ T9049] [ 2143.335558][ T9049] Kernel Offset: disabled