last executing test programs: 11m24.303460033s ago: executing program 3 (id=139): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x3000000, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 11m24.107974112s ago: executing program 3 (id=141): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010040000000000002034400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a001800000003e7000000001c005a"], 0x4c}, 0x1, 0x0, 0x0, 0x40010}, 0x4004090) 11m23.783589795s ago: executing program 3 (id=146): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x6, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000002540)={0x73622a85, 0x1114, 0x2}) r4 = socket$igmp6(0xa, 0x3, 0x2) recvfrom$inet6(r4, &(0x7f0000000340)=""/125, 0x7d, 0x10003, &(0x7f00000003c0)={0xa, 0x4e23, 0x3, @empty, 0x9}, 0x1c) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}, 0x1, 0x0, 0x0, 0x68840}, 0x4) recvmmsg(r5, &(0x7f0000003ac0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000004c0)=""/4091, 0xffb}, {&(0x7f00000014c0)=""/102, 0x66}], 0x2}, 0x2}], 0x1, 0x2, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000280)={[0x1, 0x200000001, 0x4, 0x2fb8, 0x7, 0x7ff, 0x2, 0x10000000000008, 0x800, 0x5, 0x5, 0xf9e0, 0x1, 0x4, 0x80000000, 0xba52], 0xdddd0000, 0x3902}) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r7 = dup3(r6, r3, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000001c0)={0x20, 0x0, &(0x7f0000002580)=[@request_death, @clear_death], 0x0, 0x0, 0x0}) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000280)=0x1) ioctl$TCSETS(r8, 0x89f2, &(0x7f0000000100)={0xfffffffc, 0x0, 0x0, 0x7ff, 0x0, "5dee0000005940000000000f00"}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$DRM_IOCTL_MODE_ADDFB(r0, 0xc01c64ae, &(0x7f0000000140)={0x0, 0xfffffffc, 0x10000, 0x2, 0x3, 0x4, 0x4}) 11m23.523082527s ago: executing program 0 (id=148): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000e80)="44900000000056ee08000000105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d4420380000000000000000bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf01000000ca92c73d97ce54164c2742b2568635bec8e020b41fb2f8000000000000000000000000000003000000000000003e26f6f0edc415851d0b8305fe66c2b7c114e3712d87744938848f", 0xef}, {0x0}], 0x2, 0x0, 0x3400}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5e911ef2ad63e849901d1001129dba", 0x61}], 0x1}}], 0x2, 0x2090) 11m23.399746699s ago: executing program 0 (id=149): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$rxrpc(0x21, 0x2, 0xa) (async, rerun: 64) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000000f8eca9c578ddc3dec3041c340bb630806e324517a1cdb4a479dc14582f9e8749268a418587625982bde7f94c24b3ea546241fae206b3b34d90f91b8d4a7d03720b76a02f6764c6a003fe0b7776039ca9ac4f09946c355f5152f3883f8a000423"], 0x8) (rerun: 64) 11m23.335681672s ago: executing program 0 (id=150): r0 = socket(0x10, 0x803, 0x6) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000000)={0xb, 0xffffffffffffffff, 0x4000, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1}, 0x10) recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x0, 0x0) 11m23.236734331s ago: executing program 0 (id=151): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc0686611, &(0x7f0000000180)={0x1fe, 0x1, 0x8000000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="05000000000000000000060000000c0099"], 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async, rerun: 64) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r4 = add_key$fscrypt_provisioning(&(0x7f00000029c0), &(0x7f0000002a00)={'syz', 0x0}, &(0x7f0000000000)=ANY=[@ANYBLOB="0200"], 0x48, 0xfffffffffffffffb) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5) (async, rerun: 64) keyctl$describe(0x6, r4, &(0x7f0000002d40)=""/176, 0xb0) (rerun: 64) sendmsg$NLBL_UNLABEL_C_STATICADD(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x4000040) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x38, 0x1403, 0xc23, 0x70bd2a, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'virt_wifi0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x400c080}, 0x0) (rerun: 32) 11m23.058522519s ago: executing program 3 (id=153): r0 = socket(0x10, 0x803, 0x6) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x0, 0x0) 11m23.05838731s ago: executing program 0 (id=154): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x21, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6, @private0}}}, 0x3a) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100ffffd1ff00004000010000000500070000000000080009e40e0000101400200000000000000000000000ffff0200000008000a000000000014001f00fe800000000000000000004422000012060002"], 0x5c}, 0x1, 0x620b}, 0x0) 11m23.012014618s ago: executing program 0 (id=155): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="180000001600010000000000080000000a000a00"], 0x18}}, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="180000001600010000000000080000000a000a00"], 0x18}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000200), 0x20a00, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000480)=0x1) ioctl$TCSETSF2(r1, 0x89f2, 0x0) (async) ioctl$TCSETSF2(r1, 0x89f2, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000001c0)={'vcan0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) connect$can_bcm(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r2, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) (async) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r2, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r5, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) (async) bind$inet(r5, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) r6 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) (async) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x489, 0x0, 0x140000}]}) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000040)=0x400, 0x4) (async) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000040)=0x400, 0x4) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r9 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r9, &(0x7f00000065c0)={0x0, 0x0, &(0x7f0000006580)={&(0x7f0000000000)={0x28, 0x14, 0x940e2689cab82739, 0x0, 0x0, {0x10}, [@INET_DIAG_REQ_BYTECODE={0x11, 0xfa, "4ac2412447060aefadfa61a0b9"}]}, 0x28}}, 0xc8c0) sendto$inet(r5, &(0x7f00000002c0)='v', 0x1, 0x4040, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000000c0)) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) (async) r11 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_RMFB(r11, 0xc00464af, &(0x7f00000003c0)) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f00000000c0)={'veth1_vlan\x00', &(0x7f00000005c0)=@ethtool_regs={0x4, 0x4, 0xe6, "fded98042bcce509c3ce819e00389fe4623dced48e5588f6631370b4bc367afa568a99cf60f9256fa5e1b58cabf08e51b6c2491f3a2ddb8f750c46a2813ca5a6d6a4e506ea11b610672c92d9f957721fa3f0abbf87d24032e4745615e1ab769a39d7f3ecf278125822e1caeb95ce436aa325c56bfd4e3f8ac004e309aba820bb3b9dffc3b2bc6953fe8bba47aa551fd2cd91968c33914b560c4ee61eb95709ee5d154b072beb9defc13e3310e72b933182ee485ca082bea9d0bbb5d85cf5a7bb42fbb67d2e5e7a150e0beca6e5e869698f63b551c8a97b46c045168eba1af11c8f280a518793"}}) 11m22.867709114s ago: executing program 3 (id=156): r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f00000000c0)={0xcf50, 0x8001, 0x2, 0x9a02, 0x6}) write$binfmt_aout(r0, &(0x7f0000000380)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0xffffbff9, 0x7fff, 0x1a, "0062007d82000000000000002240f7ffffff00"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000140)=0x17) 11m22.425578767s ago: executing program 3 (id=158): socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0xb, &(0x7f0000001500)=""/52, &(0x7f0000000080)=0x34) io_setup(0x4, 0x0) syz_open_dev$video4linux(&(0x7f0000000000), 0xe374, 0x1) eventfd(0x10001) r0 = socket(0x18, 0x4, 0xfffffffd) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x21, 0x0, 0x0) write$tun(r1, &(0x7f0000000780)=ANY=[@ANYBLOB="000086dd0000110000010000000060ec9700005c2c0000000000000003000000ffff0a010102ff02000000000000000000000000000132000000000000000100907809000000699951a503ff3c01fe8000"/91], 0x7d) recvmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000380)=""/46, 0x86}], 0x1}, 0x20003ff1}], 0x1, 0x1a1, 0x0) eventfd(0xea) r3 = syz_pidfd_open(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000000)={0x2, @vbi={0x8, 0x5, 0x0, 0x34324d59, [0x2f1ad270, 0x7fffffff], [0x8, 0x1000], 0x108}}) close(0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000200)={'wlan1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) socket$phonet_pipe(0x23, 0x5, 0x2) io_submit(0x0, 0x3, &(0x7f00000006c0)=[0x0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x8, 0x1, r3, &(0x7f0000000380), 0x0, 0x7ff, 0x0, 0x1}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x8, 0x6, 0xffffffffffffffff, &(0x7f0000000440)="eea7ff2c3983aed8ff5573596ccfbcedc67612512438271c1261f1baab4706bf43fc8c151a10efbde6c8b1d0d44cf4fc9df180e71b76195ca1a65e6e30bee0f7c2e103c21e067b8c4838ab27f5fdc876d7a6cbdec568595f475d1e490a3d6e9d29c214f0db3c460fa74897", 0x6b, 0xfffffffffffffffa, 0x0, 0x3}]) set_mempolicy_home_node(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x0, 0x0) 11m7.638885568s ago: executing program 32 (id=155): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="180000001600010000000000080000000a000a00"], 0x18}}, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="180000001600010000000000080000000a000a00"], 0x18}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000200), 0x20a00, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000480)=0x1) ioctl$TCSETSF2(r1, 0x89f2, 0x0) (async) ioctl$TCSETSF2(r1, 0x89f2, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000001c0)={'vcan0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) connect$can_bcm(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r2, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) (async) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r2, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r5, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) (async) bind$inet(r5, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) r6 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) (async) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x489, 0x0, 0x140000}]}) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000040)=0x400, 0x4) (async) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000040)=0x400, 0x4) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r9 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r9, &(0x7f00000065c0)={0x0, 0x0, &(0x7f0000006580)={&(0x7f0000000000)={0x28, 0x14, 0x940e2689cab82739, 0x0, 0x0, {0x10}, [@INET_DIAG_REQ_BYTECODE={0x11, 0xfa, "4ac2412447060aefadfa61a0b9"}]}, 0x28}}, 0xc8c0) sendto$inet(r5, &(0x7f00000002c0)='v', 0x1, 0x4040, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000000c0)) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) (async) r11 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_RMFB(r11, 0xc00464af, &(0x7f00000003c0)) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f00000000c0)={'veth1_vlan\x00', &(0x7f00000005c0)=@ethtool_regs={0x4, 0x4, 0xe6, "fded98042bcce509c3ce819e00389fe4623dced48e5588f6631370b4bc367afa568a99cf60f9256fa5e1b58cabf08e51b6c2491f3a2ddb8f750c46a2813ca5a6d6a4e506ea11b610672c92d9f957721fa3f0abbf87d24032e4745615e1ab769a39d7f3ecf278125822e1caeb95ce436aa325c56bfd4e3f8ac004e309aba820bb3b9dffc3b2bc6953fe8bba47aa551fd2cd91968c33914b560c4ee61eb95709ee5d154b072beb9defc13e3310e72b933182ee485ca082bea9d0bbb5d85cf5a7bb42fbb67d2e5e7a150e0beca6e5e869698f63b551c8a97b46c045168eba1af11c8f280a518793"}}) 11m6.427367278s ago: executing program 33 (id=158): socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0xb, &(0x7f0000001500)=""/52, &(0x7f0000000080)=0x34) io_setup(0x4, 0x0) syz_open_dev$video4linux(&(0x7f0000000000), 0xe374, 0x1) eventfd(0x10001) r0 = socket(0x18, 0x4, 0xfffffffd) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x21, 0x0, 0x0) write$tun(r1, &(0x7f0000000780)=ANY=[@ANYBLOB="000086dd0000110000010000000060ec9700005c2c0000000000000003000000ffff0a010102ff02000000000000000000000000000132000000000000000100907809000000699951a503ff3c01fe8000"/91], 0x7d) recvmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000380)=""/46, 0x86}], 0x1}, 0x20003ff1}], 0x1, 0x1a1, 0x0) eventfd(0xea) r3 = syz_pidfd_open(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000000)={0x2, @vbi={0x8, 0x5, 0x0, 0x34324d59, [0x2f1ad270, 0x7fffffff], [0x8, 0x1000], 0x108}}) close(0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000200)={'wlan1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) socket$phonet_pipe(0x23, 0x5, 0x2) io_submit(0x0, 0x3, &(0x7f00000006c0)=[0x0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x8, 0x1, r3, &(0x7f0000000380), 0x0, 0x7ff, 0x0, 0x1}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x8, 0x6, 0xffffffffffffffff, &(0x7f0000000440)="eea7ff2c3983aed8ff5573596ccfbcedc67612512438271c1261f1baab4706bf43fc8c151a10efbde6c8b1d0d44cf4fc9df180e71b76195ca1a65e6e30bee0f7c2e103c21e067b8c4838ab27f5fdc876d7a6cbdec568595f475d1e490a3d6e9d29c214f0db3c460fa74897", 0x6b, 0xfffffffffffffffa, 0x0, 0x3}]) set_mempolicy_home_node(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x0, 0x0) 3m46.791450152s ago: executing program 5 (id=3151): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_VMCI_CTX_REMOVE_NOTIFICATION(r0, 0x7b0, 0x0) 3m46.700811227s ago: executing program 5 (id=3152): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x78, 0x3, 0xa, 0x801, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_DEV={0x14, 0x3, 'netdevsim0\x00'}]}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7fff}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x100000000}]}]}], {0x14, 0x11, 0x1, 0x0, 0x5000000}}, 0xc0}}, 0x0) 3m46.559752725s ago: executing program 5 (id=3155): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5}}, @NFT_MSG_NEWCHAIN={0x30, 0x3, 0xa, 0x801, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x4}]}], {0x14}}, 0x6c}}, 0x200000f5) 3m46.411323984s ago: executing program 5 (id=3160): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c030000160001000000000000000000fc010000000000000000000000000000fe88000000000000000800000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000000006c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000300000006"], 0x34c}}, 0x0) 3m46.320741904s ago: executing program 5 (id=3163): r0 = syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0x2602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x11, r0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000a40)=ANY=[@ANYBLOB="08010f01fc"], 0x620) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x800000000000000, 0x31, 0xffffffffffffffff, 0x0) 3m46.128504606s ago: executing program 5 (id=3166): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000000040)={0x14, 0x27, 0x1, 0x709d2b, 0x25dfdbfb, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4000084}, 0x4040014) 3m31.073935057s ago: executing program 34 (id=3166): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000000040)={0x14, 0x27, 0x1, 0x709d2b, 0x25dfdbfb, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4000084}, 0x4040014) 2m40.094069596s ago: executing program 4 (id=3635): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x40080}, 0x4044804) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00'}}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="9402000021000100fcffffff00000000ac1414aae5fffff8b49ed9825133a900fc0100000000000000070000000000000000add500200000000000801aeaaec1", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000700004e6706362632874776f666973682900000000024000000000000480000000000000000000000000000000000000000000000000000000000000000000000000000040010000dc06216ef2c68e9f6da05d886dbc3273ef99796b36698e2bd5179c3eea5474fc78c9720bfc4f90a708001f0001000000cc0111"], 0x294}}, 0x0) 2m39.9886594s ago: executing program 4 (id=3636): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000700)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="0c000380"], 0x2c}}, 0x4004) 2m39.88683432s ago: executing program 4 (id=3637): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_SIOCSIFBR(r2, 0x8941, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f00000005c0), r3) sendmsg$NFC_CMD_LLC_SET_PARAMS(r3, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f00000003c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd7000fbdbdf25100000000500100083000000080001"], 0x24}, 0x1, 0x0, 0x0, 0x404c804}, 0x44000) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x48, &(0x7f00000002c0)=ANY=[@ANYBLOB='\b\v'], 0x68) ioctl$AUTOFS_IOC_FAIL(r0, 0x4c80, 0x7000000) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$rds(0x15, 0x5, 0x0) (async) ioctl$sock_SIOCSIFBR(r2, 0x8941, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nfc(&(0x7f00000005c0), r3) (async) sendmsg$NFC_CMD_LLC_SET_PARAMS(r3, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f00000003c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd7000fbdbdf25100000000500100083000000080001"], 0x24}, 0x1, 0x0, 0x0, 0x404c804}, 0x44000) (async) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x48, &(0x7f00000002c0)=ANY=[@ANYBLOB='\b\v'], 0x68) (async) ioctl$AUTOFS_IOC_FAIL(r0, 0x4c80, 0x7000000) (async) 2m39.486158673s ago: executing program 4 (id=3638): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000240)="09000000e7001400000000803500008100000088a8000000000081e400000000", 0x20, 0x4044800, &(0x7f00000001c0)={0x11, 0x88a8, r2, 0x1, 0xc}, 0x14) 2m38.975972254s ago: executing program 4 (id=3640): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="300000001000010000000000fedbdf25070000001300000008000000", @ANYRES32, @ANYBLOB="10001a8008000200010000000400"], 0x30}], 0x1}, 0x0) r1 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @loopback}, 0xc) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) 2m38.843664934s ago: executing program 4 (id=3641): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fcdbdf25010000000800010000000000040004800800020001000000240008800c00078008000600c210"], 0x4c}}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) r2 = socket(0xa, 0x5, 0x0) dup(r2) (async) setsockopt$inet6_tcp_int(r2, 0x6, 0x18, &(0x7f0000000080)=0xce2, 0x4) (async) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000000040)={0x14, 0x27, 0x1, 0x70bd2b, 0x25dfdbfb, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4000084}, 0x4040014) r4 = landlock_create_ruleset(&(0x7f0000000040)={0x4, 0x3}, 0x18, 0x0) landlock_restrict_self(r4, 0xa) 2m23.721254954s ago: executing program 35 (id=3641): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fcdbdf25010000000800010000000000040004800800020001000000240008800c00078008000600c210"], 0x4c}}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) r2 = socket(0xa, 0x5, 0x0) dup(r2) (async) setsockopt$inet6_tcp_int(r2, 0x6, 0x18, &(0x7f0000000080)=0xce2, 0x4) (async) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000000040)={0x14, 0x27, 0x1, 0x70bd2b, 0x25dfdbfb, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4000084}, 0x4040014) r4 = landlock_create_ruleset(&(0x7f0000000040)={0x4, 0x3}, 0x18, 0x0) landlock_restrict_self(r4, 0xa) 2m1.987404333s ago: executing program 2 (id=3893): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x7c, 0x7000, 0x0, 0xffffffffffffffff, 0x1}) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0xc0000, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0xe) ioctl$TCFLSH(r2, 0x80047437, 0x2) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000009980708b5192100c7980000000109021b00012000ac00090400000107000009090585cf"], 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r3, &(0x7f0000000a00)=[{&(0x7f0000000680)=""/102, 0x66}], 0x1, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r3, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'}) 2m0.483479605s ago: executing program 2 (id=3901): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25fc01000000000000ffffffef00000000ff0200000000000000000000000000010004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe801a00000100000000000000000037000004d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000030000800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd70000535004002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r2], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 2m0.098202899s ago: executing program 2 (id=3904): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000240)="09000000e7001400000000803500008100000088a8000000000081e40000000f", 0x20, 0x4044800, &(0x7f00000001c0)={0x11, 0x88a8, r2, 0x1, 0xc}, 0x14) 1m59.723762771s ago: executing program 2 (id=3907): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080), 0x280740, 0x0) r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0xfffffe98, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8400000000010104000000000000000002000000240001801400018008000100ac1414bb08000200ac0314bb0c000280050001000097ff00240002801400018008000100ac1414aa08000200ac1414000c0002800500010000000000080007400000000010001700000000000000000000000000100016"], 0x84}}, 0x0) 1m59.666576426s ago: executing program 2 (id=3908): socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0xb, &(0x7f0000001500)=""/52, &(0x7f0000000080)=0x34) io_setup(0x4, 0x0) syz_open_dev$video4linux(&(0x7f0000000000), 0xe374, 0x1) eventfd(0x10001) r0 = socket(0x18, 0x4, 0xfffffffd) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x21, 0x0, 0x0) write$tun(r1, &(0x7f0000000780)=ANY=[@ANYBLOB="000086dd0000110000010000000060ec9700005c2c0000000000000000000000ffff0a010102ff0200000000007fffffff000000000132000000000000000100907809000000699951a503ff3c01fe8000"/91], 0x7d) recvmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000380)=""/46, 0x86}], 0x1}, 0x20003ff1}], 0x1, 0x1a1, 0x0) eventfd(0xea) r3 = syz_pidfd_open(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000000)={0x2, @vbi={0x8, 0x5, 0x0, 0x34324d59, [0x2f1ad270, 0x7fffffff], [0x8, 0x1000], 0x108}}) close(0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000200)={'wlan1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) socket$phonet_pipe(0x23, 0x5, 0x2) io_submit(0x0, 0x3, &(0x7f00000006c0)=[0x0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x8, 0x1, r3, &(0x7f0000000380), 0x0, 0x7ff, 0x0, 0x1}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x8, 0x6, 0xffffffffffffffff, &(0x7f0000000440)="eea7ff2c3983aed8ff5573596ccfbcedc67612512438271c1261f1baab4706bf43fc8c151a10efbde6c8b1d0d44cf4fc9df180e71b76195ca1a65e6e30bee0f7c2e103c21e067b8c4838ab27f5fdc876d7a6cbdec568595f475d1e490a3d6e9d29c214f0db3c460fa74897", 0x6b, 0xfffffffffffffffa, 0x0, 0x3}]) set_mempolicy_home_node(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x0, 0x0) 1m59.107921119s ago: executing program 2 (id=3913): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000000040)={0x14, 0x27, 0x1, 0x70bd2b, 0x25dfdbfb, {0x6}}, 0x6b}, 0x1, 0x0, 0x0, 0x4000084}, 0x4040014) 1m43.896606189s ago: executing program 36 (id=3913): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000000040)={0x14, 0x27, 0x1, 0x70bd2b, 0x25dfdbfb, {0x6}}, 0x6b}, 0x1, 0x0, 0x0, 0x4000084}, 0x4040014) 5.320078288s ago: executing program 6 (id=4949): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x1d0) mount$tmpfs(0x0, &(0x7f0000000180)='./file1\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000040)={[{@size={'size', 0x3d, [0x25]}}]}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbff, {{@in=@multicast1, @in=@private=0xa010102, 0x4, 0x0, 0x4e21, 0x2, 0x2, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4d6, 0x32}, @in6=@private2, {0x5, 0x0, 0x0, 0x9, 0xffffffff00000001, 0x0, 0x80000001, 0x543}, {0x104, 0x3, 0x100, 0x1}, {}, 0x70bd2c, 0x3505, 0xa, 0x4, 0x0, 0x50}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x80}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000340)={@val={0x8, 0x800}, @val={0x5, 0x0, 0x6, 0x0, 0x14}, @ipv4=@tcp={{0x5, 0x4, 0x3, 0x2f, 0x28, 0x64, 0x0, 0x8, 0x6, 0x0, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x3e}}, {{0x4e20, 0x4e22, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0x101, 0x0, 0x401}}}}, 0x36) 4.982500048s ago: executing program 6 (id=4950): quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x5ea7b3cc31) 4.88442012s ago: executing program 6 (id=4951): r0 = socket$unix(0x1, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x4) write(r0, &(0x7f0000000000)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb00000000000000004000000052cb1edd73b09b56c912283a49807e1dd2558c09c03d1675c50785b7400cd5014082fb3714fc6f64fd57c0893dae6fa6681d883df4b11004448cf04274899e1f81cd570d531e05da0e7d245c34e67a0960953a8857c2ab961fafd5663ca697e111e633ef96c8f746224cbe2965a65ac9a2089c81e2db7f70790d8c74bc99773cfc77a807f265e82b0f83f03541f09a3f6b2ebf724e482aaff518f727f4da5057e3c8d41b5710e340e0057c1fc01964c29525d3d9407ef9bf8bf206f7fb0f86dfe8bc51672af171b1f3919eb1c2da517f752b2956fa925ad4e67ec2c95677dd589fa519ab0aeee8bf8ee9ac79e84df574277344e8f94270377e04d0b741bbba3b0f22b4cceb178c4421057b46", 0x135) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0", 0x25}], 0x1}], 0x1, 0x40800) sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100280000000000000004000000200001800d000100"], 0x34}}, 0x0) pipe2(&(0x7f0000000580)={0xffffffffffffffff}, 0x0) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r5) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_open_procfs(r4, &(0x7f0000000200)='smaps_rollup\x00') pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$F2FS_IOC_FLUSH_DEVICE(r5, 0x4008f50a, &(0x7f0000000180)={0x101, 0x10001}) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r7, 0x400455c8, 0x400000009) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000040)=0xff) fadvise64(r7, 0x2, 0x5, 0x3) tee(r3, r6, 0xfffffffffffffc01, 0x0) tee(r3, r6, 0x1fc, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000140)=0x7, 0x4) 2.440054327s ago: executing program 7 (id=4962): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x83) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r1, 0x800452d3, &(0x7f0000000100)) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r2, 0x9) r3 = fsopen(&(0x7f0000000200)='pstore\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0xf) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0xa, 0x300) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r4, 0x0) accept(r4, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r5], 0x7) socket$kcm(0x10, 0x2, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r6, 0x117, 0x5, 0x0, 0xb) sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000000800054000000001"], 0x1c}, 0x1, 0x0, 0x0, 0x20044004}, 0x44050) 1.691519083s ago: executing program 6 (id=4965): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000500)={0x28, r3, 0x1488f346e7c00843, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)={0x5c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x3d, 0x33, @action={{{}, {}, @device_b, @device_b}, @tdls_chsw_req={0xc, 0x5, {0xae, 0x1, @val={0x3e, 0x1, 0x2}, {0x65, 0x12, {@random="904fb21c1bea", @broadcast, @broadcast}}, {0x68, 0x4, {0xffff, 0x7}}}}}}]}, 0x5c}}, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000000640)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x59, 0x88, 0xfe, 0x0, 0x2a}, 0xe) shutdown(r5, 0x1) recvmmsg(r5, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x406, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000500)={0x28, r3, 0x1488f346e7c00843, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)={0x5c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x3d, 0x33, @action={{{}, {}, @device_b, @device_b}, @tdls_chsw_req={0xc, 0x5, {0xae, 0x1, @val={0x3e, 0x1, 0x2}, {0x65, 0x12, {@random="904fb21c1bea", @broadcast, @broadcast}}, {0x68, 0x4, {0xffff, 0x7}}}}}}]}, 0x5c}}, 0x0) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) sendto$inet6(r5, &(0x7f0000000640)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x59, 0x88, 0xfe, 0x0, 0x2a}, 0xe) (async) shutdown(r5, 0x1) (async) recvmmsg(r5, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x406, 0x0) (async) 1.514024798s ago: executing program 7 (id=4967): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40e41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001540), 0x2, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f0000000380)={0x5, 0x10, 0xfa00, {&(0x7f0000000180), 0xffffffffffffffff, 0x1}}, 0x18) 1.272517455s ago: executing program 1 (id=4970): socket$inet6(0xa, 0x80003, 0xff) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={0x0}, 0x1, 0x0, 0x0, 0x24044080}, 0x8002) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000900)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="2e003300d000003605021100030108021100000050505050505000000f03"], 0x54}}, 0x0) 1.228106432s ago: executing program 6 (id=4971): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0x4000, 0x2}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000a0000000c0000800800", @ANYRES16=r1], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0) r2 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000001c0)='ns/net\x00') getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000200)=@assoc_value, &(0x7f0000000240)=0x8) sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x44, 0x1402, 0x400, 0x70bd28, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r2}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004040) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="20000000151401"], 0x20}, 0x1, 0x0, 0x0, 0x40880}, 0x24040800) 1.155391913s ago: executing program 6 (id=4973): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_disconnect(r0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) close(0x4) 996.009918ms ago: executing program 8 (id=4975): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x83) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r1, 0x800452d3, &(0x7f0000000100)) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r2, 0x9) r3 = fsopen(&(0x7f0000000200)='pstore\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0xf) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0xa, 0x300) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r4, 0x0) accept(r4, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r5], 0x7) socket$kcm(0x10, 0x2, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r6, 0x117, 0x5, 0x0, 0xb) sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000000800054000000001"], 0x1c}, 0x1, 0x0, 0x0, 0x20044004}, 0x44050) 962.08059ms ago: executing program 1 (id=4976): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c0000004900010000000000000000000a0000000f00000000000000140001800d2a79075827af5aa534d6815c2e93f10c0002"], 0x3c}, 0x1, 0x0, 0xffffff80}, 0x0) 947.084792ms ago: executing program 8 (id=4977): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000009c0)={@fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f00000008c0)=""/239, 0xef, 0x2, 0x27}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000200)={0x0, 0x18, 0x40}}, 0x4000}], 0x0, 0x0, 0x0}) 864.069549ms ago: executing program 1 (id=4978): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x144, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x394, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@remote, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075a, 0x3}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="3801000010000100feffffff00010000fe880000000000000000000000000001fc010000000000000019000000000001000107144e230005000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES64], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 862.711523ms ago: executing program 7 (id=4979): sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f0000000600)="447df50ce4033a7b5ad00b83244c00b711803e7cca2504a2600da98e", 0x1c}, {&(0x7f00000006c0)='\b\f', 0x2}, {&(0x7f0000000780)="4274aa814c8f6ea8d8db43178dd2f41ef596a3ca465412910e05cba0f5d97e67886d55be18cac95a1aa093479596c3613670aaf2a3b1edc465bedfdb5156035719c0baa8bb8bf2a825ec04f424dda801fea000f41edc43511e9c8bf89656071e91ae4c356d6a9ca608af6b83cc9f3d9ae37c2bfab2e5708062c659e4427221", 0x7f}], 0x3}, 0x41) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f0000000600)="447df50ce4033a7b5ad00b83244c00b711803e7cca2504a2600da98e", 0x1c}, {&(0x7f00000006c0)='\b\f', 0x2}, {&(0x7f0000000780)="4274aa814c8f6ea8d8db43178dd2f41ef596a3ca465412910e05cba0f5d97e67886d55be18cac95a1aa093479596c3613670aaf2a3b1edc465bedfdb5156035719c0baa8bb8bf2a825ec04f424dda801fea000f41edc43511e9c8bf89656071e91ae4c356d6a9ca608af6b83cc9f3d9ae37c2bfab2e5708062c659e4427221", 0x7f}], 0x3}, 0x41) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac14143f000000000000000000000000000004d36c000000ac1414bb0000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000800000300000000000000000000000000000001"], 0x2c4}, 0x1, 0x0, 0x0, 0x48001}, 0x4044050) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) accept4(r2, 0x0, 0x0, 0x800) (async) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f0000000400)={0x0, 0x0, 0x4}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 844.237003ms ago: executing program 8 (id=4980): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000880), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f00000008c0)={0x14, r1, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}}, 0x818) (fail_nth: 5) 808.304836ms ago: executing program 1 (id=4981): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_DREG={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_BYTEORDER_SREG={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x2}]}}}]}]}], {0x14}}, 0x88}, 0x1, 0x0, 0x0, 0x6000}, 0x0) 339.53242ms ago: executing program 8 (id=4982): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000240)={0x0, 0x0}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f00000000c0)={[{0x4, 0x200, 0x8, 0x84, 0x1, 0x7, 0xc4, 0x1, 0x0, 0x9, 0xf, 0x8, 0x9}, {0x8, 0xaef2, 0xa, 0x5, 0xc, 0x1, 0x9, 0x3, 0x4, 0x13, 0x1, 0x6, 0x12005}, {0x2, 0x7, 0xa, 0xf, 0x1, 0x14, 0x0, 0xfb, 0x72, 0xfb, 0x1, 0x3, 0x2}], 0x9}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)=@x86={0x5, 0x10, 0x17, 0x0, 0x2d92119, 0xfc, 0x2, 0x4, 0xff, 0x0, 0x6, 0x1, 0x0, 0x7, 0x7, 0x4, 0x7, 0x6, 0xfa, '\x00', 0x3, 0x1ff}) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, 0x0, 0x0) setsockopt$IP_VS_SO_SET_DEL(r4, 0x0, 0x484, 0x0, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r4, 0x0, 0x485, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r3, 0x1, 0x31, &(0x7f0000001600)=0xffffffff, 0x4) ioctl$KVM_RUN(r2, 0xae80, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000000)='cdg', 0x3) write$binfmt_script(r5, &(0x7f0000000200), 0xfffffd9d) writev(r3, &(0x7f0000000740)=[{&(0x7f0000000180)="8bb9579e7be841684286bd83f1489f0099c26c58ccab74b91fe8a839847656c188fc13f15ec6811ccff23e9c3589f46dece1268f837f9911b6cc", 0x3a}, {&(0x7f0000000280)="66477bf81324d662c6e77d3d8b095b0d676f881cf2c3542040e4d6cfcaec03a884b1c429fccbbe82ad8cf5444117e629d6c81b8a2c4eafbc832f929527bd814492481506b0679e78eb45789902d200a64434d36e48f0fd12762592ffbaa0438ea69f8fde68b8b6ecc0ef0c925282f8ffb49575644768279d889ab5128fcbe598c37b69bb8ce49c75e192339d7a0908404d29c082d830a88ee190349cf6e80b66b7669e131dd3034d2cf6c21369fc143fea6fdeaa82e1071478ea50784f00a3718fe510013e5302bcbf595edfec68f5f8f8e34c851f420a1063fc1d318d01b3ae", 0xe0}, {&(0x7f0000000380)="cb18f078bcc494b27f735b8cf0ebcd4ebfce181924818d3ae29cc3bce53720bd95c0df5ef1af19b031f6e88daba5071bb9fd5792ba9602cb97412aafd519e1867b30cdf1eb154f8ba2437199def4a343d9e2092a1bd83d", 0x57}, {&(0x7f0000000440)="bf43009ee6d8c9927b6855429a23", 0xe}, {&(0x7f0000000480)="bba2c00f0b55b1a8ed9432d0c1c051c2cb44cddc6c5b745f37636d275abcc41e37c59f33f9b385b37efcb896b7289e", 0x2f}, {&(0x7f00000004c0)="e7b50f975287097e1c67dcf90f566ca3f16e7013d235caaaf69f2829de8fa62a174cae74dfe60d4b1da1f7f1c2e57dffd48fb6973271a9bc82b588fcad97f830f06e6b7564c1f53ac0a0755e6f0e0cf4a96f892e4b6e9e85a965865c7b24a0d5a23aca37c46fd24d533194a38e39057dbdcc9c6902a8a2d247df91c920106666f58a1b237c8278b393ed4a6a6369e54293fe918099e3908244e90133a8ffd7328cdf93d5109cd37afcfe455254c41cf774197a49e7899a9d5fce", 0xba}, {&(0x7f0000000580)="7df50f35b62c40edd367f09df40c4852abf5ccf40cd2b9ef22fee7ee5350f006ea0f22e93b081f7a870bb37cb00e4cc9adcf32b355f85e1ec980784743f625a8c8c7bc77645cf57e43362b", 0x4b}, {&(0x7f0000000600)="f83f84eea58302403ce501438dadaefd03b7919bfeeb0774217a71adb6ef6f392afcdf36eb5febbbf764ddf98470b0a1b1920573239e636e1f50e85e69ab8f47da7ea696acc666d3b3de8b5e7ed575b2042954a6d070132a1612e8e37f18dc0201658465edfe62bda2676cfeb4de88ce8a8b999fbde45be0ba3c06f6cfc909f3fac6344f50d6d3349d048496f09ee466996a06db7427a300d0d39ba04fdca2c9ee9b9df7d015d865b2181aac36771a2fd35407738da8cbe5933a60455f31124ee1cfd76ee1dd8476fa5807f8e97ed8d7a80c0f912decb2a193984e", 0xdb}, {&(0x7f0000000700)}], 0x9) rseq(&(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xcdd5, 0x8, 0x7}}, 0x20, 0x1, 0x0) 339.229114ms ago: executing program 1 (id=4983): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000500)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000140)={@empty, @empty, @mcast1, 0x100001, 0x6, 0x0, 0x100, 0x10003, 0x180107, r3}) r4 = openat2(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', &(0x7f0000000240)={0x105000, 0x2, 0x38}, 0x18) ioctl$SIOCX25SSUBSCRIP(r4, 0x89e1, &(0x7f00000003c0)={'veth1_to_batadv\x00', 0x5, 0x6}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a00000000030a03000000000000000000020000040000048000000140000000000000014000000003000001400000006beb000140000000030000024028d622d5000008800000024000000000000000080000024000000000000000090000088000000140000000000000000300000240000000000000000000000240000000000000000300000000140a0500000000000000000005000007000006400000000000000005000003400000000b0000010073797a3000000000000003400000000a0000020073797a32000000000000020073797a300000000000000800cb41c93c6d19e0b81486211b0529e7297c16382ddff4beba7e134171a076d6bd39436f2c29577bacde5c5408a56b902ab23f7f00237eb718a2acc58bb071764d40aed9140342b5afab134fc322bdf7b64fc0b28a9ffa7cfa5cdac8cb4133595061d8ec87c000000000000000160a050000000000000000000a000008000003800000038000000100766574683000000000000000000000000000010073797a6b616c6c6572300000000000000000010065727370616e30000000000000000000000001006d616373656330000000000000000000000001007465616d3000000000000000000000000000010067656e65766531000000000000000000000003800000010073797a5f74756e0000000000000000000000010065727370616e30000000000000000000000001006272696467655f736c6176655f3000000000010076657468315f746f5f7465616d00000000000100766972745f77696669300000000000000000010064756d6d7930000000000000000000000000010073797a5f74756e00000000000000000000000100697036746e6c302000000000000000000000010065727370616e300000000000000000000000010074756e6c300000000000000000000000000003800000010077673100000000000000000000000000000001007369743000000000000000000000000000000140000000000000020073797a31000000000000020073797a3200000000000007400000000261fdffff1000010000000000000000000584000aabb2faa3e75d924ce376946c2d27849dc9ea02b05c95ed035c043ecf65361a924c6938317da6873ccbfe0ff6844ae62e"], 0x28}, 0x1, 0x0, 0x0, 0x20000801}, 0x4000844) r5 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0xffffffff00000000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r8, 0xc08c5332, 0x0) r9 = accept4(r7, 0x0, 0x0, 0x80800) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000600)="f78d9ca38fff48f3be52163448415a7663d537c4dbecdc3eaa85b600dc1c0b4286b35cc7af8f4d7516e2c7197523b03e477dc20ed39ffc8f6a931a3d99cc350ed962054380458df60e", 0x49}, {&(0x7f0000000140)="ebe3a0", 0x3}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r10 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa8103, 0x0) sendmsg$TIPC_NL_SOCK_GET(r4, &(0x7f0000000b00)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000b40)=ANY=[@ANYBLOB="80010000", @ANYRES16=0x0, @ANYBLOB="000129bd7000fddbdf25060000003c0004802c000780080002000800000008000200018000000800030005000000080003002d05000008000400060000000900010073797a31000000006c0005804400028008000400080000000a000300060000000800010009000000080001001500000008000200040000000800040029790000080001001200000008000100180000001c00028008000300040000000800030008000000080002008000000008000100657468003800058008000100756470002c0002800800030002000000080001001f000000080004000800000008000200feffffff08000400010000000007000100696200001400028008000200020000000800030009000000240004800900010073797a300000618bbbb932f9a40115eaf03df732000014000780080002000a0000000800020002000000280007800c000300ff7f0000000000000c0004004abd0000000000000c000300de00000000000000180004801300010062726f6164636173742d6c696e6b00"/392], 0x180}}, 0x4008050) ioctl$BLKCLOSEZONE(r10, 0x40101287, &(0x7f0000000040)={0x2, 0x8}) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x20000041}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r11 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000080), 0x40, &(0x7f0000000680)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r11, @ANYRES64=r8, @ANYRESOCT=r2, @ANYRES8=r5]) r12 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r12, 0x107, 0x12, &(0x7f0000000000)=0x3, 0x4) ioprio_set$uid(0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x40b49, 0x6, 0x101, 0x0, 0x3}, 0x0) 324.381669ms ago: executing program 7 (id=4984): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x78, 0x3, 0xa, 0x801, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_DEV={0x14, 0x3, 'netdevsim0\x00'}]}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7fff}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x100000000}]}]}], {0x14}}, 0xc0}, 0x1, 0x0, 0x11000000}, 0x0) 227.026077ms ago: executing program 8 (id=4985): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x83) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r1, 0x800452d3, &(0x7f0000000100)) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r2, 0x9) r3 = fsopen(&(0x7f0000000200)='pstore\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0xf) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0xa, 0x300) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r4, 0x0) accept(r4, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r5], 0x7) socket$kcm(0x10, 0x2, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r6, 0x117, 0x5, 0x0, 0xb) sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000000800054000000001"], 0x1c}, 0x1, 0x0, 0x0, 0x20044004}, 0x44050) 144.111315ms ago: executing program 7 (id=4986): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c030000160001000000000000000000fc010000000000000000000000000000fe88000000000000000000000010000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000000006c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000300000006"], 0x34c}}, 0x0) 108.643089ms ago: executing program 8 (id=4987): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40e41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001540), 0x2, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f0000000380)={0x5, 0x10, 0xfa00, {&(0x7f0000000180), 0xffffffffffffffff, 0x1}}, 0x18) 47.84452ms ago: executing program 7 (id=4988): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000009c0)={@fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f00000008c0)=""/239, 0xef, 0x2, 0x27}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000200)={0x0, 0x18, 0x40}}, 0x4000}], 0x0, 0x0, 0x0}) 0s ago: executing program 1 (id=4989): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x5a, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = eventfd2(0x0, 0x800) readv(r4, &(0x7f0000000040)=[{&(0x7f00000003c0)=""/236, 0xec}], 0x1) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, './file0\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000003f0009000000000000080000030000000400000010000180930f4c", @ANYRES32=r6], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4) ioctl$TIOCVHANGUP(r5, 0x5437, 0x0) kernel console output (not intermixed with test programs): [ 702.502010][ T5687] usb 2-1: Using ep0 maxpacket: 16 [ 702.504811][ T5687] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 702.515656][ T5687] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 702.515696][ T5687] usb 2-1: can't read configurations, error -61 [ 702.529067][ T5701] usb 7-1: string descriptor 0 read error: -71 [ 702.529846][ T5701] hub 7-1:32.0: USB hub found [ 702.545444][ T5687] usb usb2-port1: unable to enumerate USB device [ 702.553062][ T5701] hub 7-1:32.0: config failed, can't read hub descriptor (err -22) [ 702.625214][ T1245] usb 9-1: Using ep0 maxpacket: 32 [ 702.629593][ T1245] usb 9-1: unable to get BOS descriptor or descriptor too short [ 702.643246][ T1245] usb 9-1: config 6 has an invalid interface number: 82 but max is 0 [ 702.643275][ T1245] usb 9-1: config 6 has no interface number 0 [ 702.643308][ T1245] usb 9-1: config 6 interface 82 has no altsetting 0 [ 702.647599][ T1245] usb 9-1: New USB device found, idVendor=1b3d, idProduct=01a2, bcdDevice=97.34 [ 702.647629][ T1245] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.647755][ T1245] usb 9-1: Product: syz [ 702.647772][ T1245] usb 9-1: Manufacturer: syz [ 702.647787][ T1245] usb 9-1: SerialNumber: syz [ 702.870107][ T5701] usb 7-1: USB disconnect, device number 31 [ 702.944358][ T1245] ftdi_sio 9-1:6.82: FTDI USB Serial Device converter detected [ 702.948911][ T1245] ftdi_sio ttyUSB0: unknown device type: 0x9734 [ 702.960603][ T1245] usb 9-1: USB disconnect, device number 4 [ 702.977980][ T1245] ftdi_sio 9-1:6.82: device disconnected [ 703.283366][T19659] FAULT_INJECTION: forcing a failure. [ 703.283366][T19659] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 703.283391][T19659] CPU: 0 UID: 0 PID: 19659 Comm: syz.6.4076 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 703.283408][T19659] Tainted: [L]=SOFTLOCKUP [ 703.283413][T19659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 703.283420][T19659] Call Trace: [ 703.283425][T19659] [ 703.283431][T19659] dump_stack_lvl+0xe8/0x150 [ 703.283450][T19659] should_fail_ex+0x46b/0x600 [ 703.283468][T19659] _copy_from_iter+0x1d3/0x1670 [ 703.283488][T19659] ? trace_kmem_cache_alloc+0x29/0xe0 [ 703.283504][T19659] ? __alloc_skb+0x27d/0x7d0 [ 703.283519][T19659] ? __pfx__copy_from_iter+0x10/0x10 [ 703.283535][T19659] ? kmem_cache_alloc_node_noprof+0x27c/0x6e0 [ 703.283550][T19659] ? __alloc_skb+0x27d/0x7d0 [ 703.283567][T19659] ? netlink_sendmsg+0x650/0xb40 [ 703.283583][T19659] ? skb_put+0x11b/0x210 [ 703.283600][T19659] netlink_sendmsg+0x6c0/0xb40 [ 703.283620][T19659] ? __pfx_netlink_sendmsg+0x10/0x10 [ 703.283637][T19659] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 703.283659][T19659] ? aa_sock_msg_perm+0x122/0x200 [ 703.283677][T19659] ? __pfx_netlink_sendmsg+0x10/0x10 [ 703.283693][T19659] sock_sendmsg_nosec+0x112/0x150 [ 703.283710][T19659] ____sys_sendmsg+0x55c/0x870 [ 703.283730][T19659] ? __pfx_____sys_sendmsg+0x10/0x10 [ 703.283751][T19659] ? import_iovec+0x73/0xa0 [ 703.283769][T19659] ___sys_sendmsg+0x2a5/0x360 [ 703.283786][T19659] ? __lock_acquire+0x6b5/0x2d10 [ 703.283800][T19659] ? __pfx____sys_sendmsg+0x10/0x10 [ 703.283832][T19659] ? __fget_files+0x2a/0x420 [ 703.283846][T19659] ? __fget_files+0x3a6/0x420 [ 703.283867][T19659] __x64_sys_sendmsg+0x1c3/0x2a0 [ 703.283886][T19659] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 703.283907][T19659] ? __pfx_ksys_write+0x10/0x10 [ 703.283927][T19659] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.283941][T19659] do_syscall_64+0x15f/0xf80 [ 703.283952][T19659] ? trace_irq_disable+0x3b/0x140 [ 703.283969][T19659] ? clear_bhb_loop+0x40/0x90 [ 703.283983][T19659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.283995][T19659] RIP: 0033:0x7f05a971cdd9 [ 703.284008][T19659] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 703.284019][T19659] RSP: 002b:00007f05a7976028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 703.284032][T19659] RAX: ffffffffffffffda RBX: 00007f05a9995fa0 RCX: 00007f05a971cdd9 [ 703.284041][T19659] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 703.284049][T19659] RBP: 00007f05a7976090 R08: 0000000000000000 R09: 0000000000000000 [ 703.284057][T19659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 703.284065][T19659] R13: 00007f05a9996038 R14: 00007f05a9995fa0 R15: 00007ffd561f78a8 [ 703.284082][T19659] [ 703.738078][T19670] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4080'. [ 703.738172][T19670] bridge_slave_1: left allmulticast mode [ 703.738200][T19670] bridge_slave_1: left promiscuous mode [ 703.738495][T19670] bridge0: port 2(bridge_slave_1) entered disabled state [ 703.856813][T19670] bridge_slave_0: left allmulticast mode [ 703.856850][T19670] bridge_slave_0: left promiscuous mode [ 703.857122][T19670] bridge0: port 1(bridge_slave_0) entered disabled state [ 704.427261][T19709] binfmt_misc: Unknown parameter 'discard š+JOIç—è8üßωIœð‚' [ 704.483120][T19713] netlink: 188 bytes leftover after parsing attributes in process `syz.6.4089'. [ 704.536842][ T5701] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 704.593203][T19723] netlink: 'syz.7.4090': attribute type 29 has an invalid length. [ 704.594189][T19723] netlink: 'syz.7.4090': attribute type 29 has an invalid length. [ 704.595536][T19723] netlink: 500 bytes leftover after parsing attributes in process `syz.7.4090'. [ 704.707630][ T5701] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 704.707668][ T5701] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 704.707694][ T5701] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 704.707737][ T5701] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 704.707762][ T5701] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 704.720704][ T5701] usb 2-1: config 0 descriptor?? [ 704.745430][ T37] usb 7-1: new low-speed USB device number 32 using dummy_hcd [ 704.929137][ T37] usb 7-1: No LPM exit latency info found, disabling LPM. [ 704.930761][ T37] usb 7-1: config 1 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 704.930795][ T37] usb 7-1: config 1 interface 0 altsetting 4 endpoint 0x2 has invalid maxpacket 1023, setting to 8 [ 704.930823][ T37] usb 7-1: config 1 interface 0 has no altsetting 0 [ 704.934688][ T37] usb 7-1: New USB device found, idVendor=056a, idProduct=0029, bcdDevice= 0.40 [ 704.934717][ T37] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 704.934739][ T37] usb 7-1: Product: 䔺î˜á™½ï§è¡¶ì‘£áŸç•¿ç±›ì¿¾ç’„栚‟⬯剉孺ᨥ瘸硻ࣿ摚ꎠ중웫⊤說ꆃ攰৪⯆ç¿í’ŠãŽ•å££ç„…觑窆슎阅펶ᗪ臦ໄ漵ąベ䰘ṓ稷섒넰칰ⶭ㭠ᒎ钪⌼驢혱ä´æ°§âŒ¶áŽ©è¶°á•—◾囃䤵푿ㄮ舾䘣ߊê‡ïµ«ç­®à¾–澢ꨌë¶çꦖá‰éŸšã±˜ã‹¬ë¥âŸ‘䲋 [ 704.934771][ T37] usb 7-1: Manufacturer: 謿㢓愘괣컙寽â¿é¬¸Íµï­ªà¨ŒçŒ´ãº¿ã¸å¦™è™™é‡™ä¦ æ¯¬éªé§Žï¾¨è´ ë‘«ëž„å˜ï›‰ï‘—갠탫æ«ß§è˜°à¶Žê…‹è„–̲퀮é´é†§á‹æ¼èŠ®ï‡ç¤»áŸ»ê’Œé³¾á›­ãŠ‚ᛆȉ䪭꜔싃旯䗳㚒駿ᵠ섇뼢尤庳髱삾âªï’°ç¤†ë©½æ¶˜ÊŒá€ã«ˆæˆ–濾㟵┸ឺ跦繼鯔䤇 [ 704.934801][ T37] usb 7-1: SerialNumber: ꘰ⳛ艥䒦⹚膼똋涻㒮ë‹ç‰²ì‰ƒìºžéƒâ¶®â½¬ì¬†ê‰€ï‘ºÂ¶ïª‘彵⚼㬮ᷱìœé²˜ëƒªæŽšæ²šë‹§îš£æ”‘ึ衿妇븯죺㖰껢慩ꓭⶴ냦⭴솓鳭쿳喷疤㎠[ 705.071309][T19713] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 705.071591][T19713] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 705.447299][ T5701] plantronics 0003:047F:FFFF.0021: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 705.503955][ T37] usbhid 7-1:1.0: can't add hid device: -71 [ 705.504080][ T37] usbhid 7-1:1.0: probe with driver usbhid failed with error -71 [ 705.546361][ T37] usb 7-1: USB disconnect, device number 32 [ 705.680565][ T5701] usb 2-1: USB disconnect, device number 57 [ 705.771238][T19754] fido_id[19754]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 706.109964][T19782] loop8: detected capacity change from 0 to 7 [ 706.113688][T19784] FAULT_INJECTION: forcing a failure. [ 706.113688][T19784] name failslab, interval 1, probability 0, space 0, times 0 [ 706.113721][T19784] CPU: 1 UID: 0 PID: 19784 Comm: syz.6.4099 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 706.113748][T19784] Tainted: [L]=SOFTLOCKUP [ 706.113755][T19784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 706.113768][T19784] Call Trace: [ 706.113776][T19784] [ 706.113786][T19784] dump_stack_lvl+0xe8/0x150 [ 706.113814][T19784] should_fail_ex+0x46b/0x600 [ 706.113844][T19784] should_failslab+0xa8/0x100 [ 706.113870][T19784] __kmalloc_cache_noprof+0x84/0x690 [ 706.113898][T19784] ? pcpu_alloc_noprof+0x1079/0x1920 [ 706.113995][T19784] ? shrinker_alloc+0x59/0xad0 [ 706.114021][T19784] shrinker_alloc+0x59/0xad0 [ 706.114043][T19784] ? __rt_spin_lock_init+0x3e/0x50 [ 706.114078][T19784] alloc_super+0x799/0xac0 [ 706.114103][T19784] ? rt_spin_unlock+0x160/0x200 [ 706.114129][T19784] ? __pfx_super_s_dev_test+0x10/0x10 [ 706.114156][T19784] sget_fc+0x329/0xa40 [ 706.114182][T19784] ? __pfx_super_s_dev_set+0x10/0x10 [ 706.114209][T19784] get_tree_bdev_flags+0x214/0x4f0 [ 706.114237][T19784] ? __pfx_get_tree_mtd+0x10/0x10 [ 706.114258][T19784] ? __pfx_cramfs_blkdev_fill_super+0x10/0x10 [ 706.114290][T19784] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 706.114329][T19784] vfs_get_tree+0x92/0x2a0 [ 706.114359][T19784] do_new_mount+0x341/0xd30 [ 706.114379][T19784] ? apparmor_capable+0x126/0x170 [ 706.114414][T19784] ? __pfx_do_new_mount+0x10/0x10 [ 706.114435][T19784] ? ns_capable+0x89/0xe0 [ 706.114465][T19784] ? user_path_at+0xd4/0x160 [ 706.114494][T19784] ? user_path_at+0xd4/0x160 [ 706.114521][T19784] __se_sys_mount+0x31d/0x420 [ 706.114550][T19784] ? __pfx___se_sys_mount+0x10/0x10 [ 706.114578][T19784] ? __x64_sys_mount+0x20/0xc0 [ 706.114601][T19784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.114624][T19784] do_syscall_64+0x15f/0xf80 [ 706.114643][T19784] ? trace_irq_disable+0x3b/0x140 [ 706.114671][T19784] ? clear_bhb_loop+0x40/0x90 [ 706.114696][T19784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.114717][T19784] RIP: 0033:0x7f05a971cdd9 [ 706.114738][T19784] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 706.114755][T19784] RSP: 002b:00007f05a7976028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 706.114777][T19784] RAX: ffffffffffffffda RBX: 00007f05a9995fa0 RCX: 00007f05a971cdd9 [ 706.114791][T19784] RDX: 00002000000000c0 RSI: 0000200000000000 RDI: 0000200000000100 [ 706.114805][T19784] RBP: 00007f05a7976090 R08: 0000000000000000 R09: 0000000000000000 [ 706.114819][T19784] R10: 0000000000208000 R11: 0000000000000246 R12: 0000000000000002 [ 706.114832][T19784] R13: 00007f05a9996038 R14: 00007f05a9995fa0 R15: 00007ffd561f78a8 [ 706.114861][T19784] [ 706.117483][T14113] lo_rw_aio(loop8) starting read with raw_refcnt=0x1, refcnt=2 [ 706.117761][T19782] Dev loop8: unable to read RDB block 7 [ 706.117788][T19782] loop8: AHDI p1 p2 [ 706.117818][T19782] loop8: partition table partially beyond EOD, truncated [ 706.118133][T19782] loop8: p1 start 1702000233 is beyond EOD, truncated [ 706.252306][T10256] __loop_clr_fd(loop8) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 707.350780][ T5701] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 707.374577][T19838] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4113'. [ 707.444619][T19840] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4114'. [ 707.506171][ T5701] usb 2-1: config 255 has an invalid interface number: 237 but max is 0 [ 707.506205][ T5701] usb 2-1: config 255 has no interface number 0 [ 707.506238][ T5701] usb 2-1: config 255 interface 237 has no altsetting 0 [ 707.511426][ T5701] usb 2-1: New USB device found, idVendor=07c4, idProduct=a109, bcdDevice=29.fa [ 707.511461][ T5701] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 707.511482][ T5701] usb 2-1: Product: syz [ 707.511497][ T5701] usb 2-1: Manufacturer: syz [ 707.511513][ T5701] usb 2-1: SerialNumber: syz [ 707.721098][T19853] netlink: 'syz.7.4118': attribute type 29 has an invalid length. [ 707.727329][T19853] netlink: 'syz.7.4118': attribute type 29 has an invalid length. [ 707.730978][T19853] netlink: 500 bytes leftover after parsing attributes in process `syz.7.4118'. [ 707.752589][T19829] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 707.754887][T19829] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 707.770054][ T5701] ums-datafab 2-1:255.237: USB Mass Storage device detected [ 707.927182][ T5701] ums-sddr55 2-1:255.237: USB Mass Storage device detected [ 708.077110][ T5701] usb 2-1: USB disconnect, device number 58 [ 708.140412][T19879] netlink: 40 bytes leftover after parsing attributes in process `syz.8.4121'. [ 708.523846][T19897] netlink: 'syz.1.4126': attribute type 4 has an invalid length. [ 708.532967][ T5619] Bluetooth: hci3: command 0x0c1a tx timeout [ 708.603217][T19908] netlink: 200 bytes leftover after parsing attributes in process `syz.7.4129'. [ 708.683236][ T5701] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 708.716446][T19912] loop8: detected capacity change from 0 to 7 [ 708.744402][T19915] FAULT_INJECTION: forcing a failure. [ 708.744402][T19915] name failslab, interval 1, probability 0, space 0, times 0 [ 708.744440][T19915] CPU: 1 UID: 0 PID: 19915 Comm: syz.7.4132 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 708.744468][T19915] Tainted: [L]=SOFTLOCKUP [ 708.744476][T19915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 708.744489][T19915] Call Trace: [ 708.744497][T19915] [ 708.744506][T19915] dump_stack_lvl+0xe8/0x150 [ 708.744536][T19915] should_fail_ex+0x46b/0x600 [ 708.744567][T19915] should_failslab+0xa8/0x100 [ 708.744599][T19915] __kmalloc_noprof+0xdf/0x7b0 [ 708.744626][T19915] ? shrinker_alloc+0x2f6/0xad0 [ 708.744649][T19915] ? __list_lru_init+0xbe/0x600 [ 708.744667][T19915] ? __rt_spin_lock_init+0x3e/0x50 [ 708.744696][T19915] __list_lru_init+0xbe/0x600 [ 708.744726][T19915] alloc_super+0x879/0xac0 [ 708.744753][T19915] ? rt_spin_unlock+0x160/0x200 [ 708.744780][T19915] ? __pfx_super_s_dev_test+0x10/0x10 [ 708.744809][T19915] sget_fc+0x329/0xa40 [ 708.744834][T19915] ? __pfx_super_s_dev_set+0x10/0x10 [ 708.744862][T19915] get_tree_bdev_flags+0x214/0x4f0 [ 708.744888][T19915] ? __pfx_get_tree_mtd+0x10/0x10 [ 708.744919][T19915] ? __pfx_cramfs_blkdev_fill_super+0x10/0x10 [ 708.744948][T19915] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 708.744987][T19915] vfs_get_tree+0x92/0x2a0 [ 708.745010][T19915] do_new_mount+0x341/0xd30 [ 708.745026][T19915] ? apparmor_capable+0x126/0x170 [ 708.745048][T19915] ? __pfx_do_new_mount+0x10/0x10 [ 708.745065][T19915] ? ns_capable+0x89/0xe0 [ 708.745089][T19915] ? user_path_at+0xd4/0x160 [ 708.745112][T19915] ? user_path_at+0xd4/0x160 [ 708.745133][T19915] __se_sys_mount+0x31d/0x420 [ 708.745166][T19915] ? __pfx___se_sys_mount+0x10/0x10 [ 708.745192][T19915] ? __x64_sys_mount+0x20/0xc0 [ 708.745210][T19915] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.745228][T19915] do_syscall_64+0x15f/0xf80 [ 708.745245][T19915] ? trace_irq_disable+0x3b/0x140 [ 708.745271][T19915] ? clear_bhb_loop+0x40/0x90 [ 708.745293][T19915] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.745312][T19915] RIP: 0033:0x7f1b4728cdd9 [ 708.745330][T19915] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 708.745344][T19915] RSP: 002b:00007f1b454de028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 708.745362][T19915] RAX: ffffffffffffffda RBX: 00007f1b47505fa0 RCX: 00007f1b4728cdd9 [ 708.745373][T19915] RDX: 00002000000000c0 RSI: 0000200000000000 RDI: 0000200000000100 [ 708.745384][T19915] RBP: 00007f1b454de090 R08: 0000000000000000 R09: 0000000000000000 [ 708.745394][T19915] R10: 0000000000208000 R11: 0000000000000246 R12: 0000000000000002 [ 708.745404][T19915] R13: 00007f1b47506038 R14: 00007f1b47505fa0 R15: 00007ffc0ee74d58 [ 708.745427][T19915] [ 708.758244][ T4314] lo_rw_aio(loop8) starting read with raw_refcnt=0x1, refcnt=2 [ 708.759581][T19912] Dev loop8: unable to read RDB block 7 [ 708.759608][T19912] loop8: AHDI p1 p2 [ 708.759636][T19912] loop8: partition table partially beyond EOD, truncated [ 708.763933][T19912] loop8: p1 start 1702000233 is beyond EOD, truncated [ 708.794810][ T5619] Bluetooth: hci4: command 0x0406 tx timeout [ 709.085437][ T5701] usb 7-1: device descriptor read/64, error -71 [ 709.216372][T10256] __loop_clr_fd(loop8) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 709.419324][ T5701] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 709.528572][T19937] netlink: 28 bytes leftover after parsing attributes in process `syz.7.4136'. [ 709.555367][ T5701] usb 7-1: device descriptor read/64, error -71 [ 709.666665][ T5701] usb usb7-port1: attempt power cycle [ 709.686396][ T5616] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 709.797575][T19956] Cannot find set identified by id 0 to match [ 709.869161][ T5616] usb 2-1: Using ep0 maxpacket: 8 [ 709.873748][ T5616] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 709.873772][ T5616] usb 2-1: can't read configurations, error -61 [ 710.017920][ T5616] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 710.026817][ T5701] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 710.046331][ T5701] usb 7-1: device descriptor read/8, error -71 [ 710.176621][ T37] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 710.195791][ T5616] usb 2-1: Using ep0 maxpacket: 8 [ 710.198762][ T5616] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 710.198799][ T5616] usb 2-1: can't read configurations, error -61 [ 710.199144][ T5616] usb usb2-port1: attempt power cycle [ 710.285995][ T5701] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 710.308984][ T5701] usb 7-1: device descriptor read/8, error -71 [ 710.328117][ T37] usb 9-1: unable to get BOS descriptor or descriptor too short [ 710.329276][ T37] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 710.329301][ T37] usb 9-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 710.329350][ T37] usb 9-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 710.329388][ T37] usb 9-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 710.329430][ T37] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 710.329464][ T37] usb 9-1: config 1 interface 1 has no altsetting 0 [ 710.332528][ T37] usb 9-1: string descriptor 0 read error: -22 [ 710.332657][ T37] usb 9-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 710.332672][ T37] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 710.420059][ T5701] usb usb7-port1: unable to enumerate USB device [ 710.556307][ T5616] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 710.577287][ T5616] usb 2-1: Using ep0 maxpacket: 8 [ 710.579587][ T5616] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 710.579625][ T5616] usb 2-1: can't read configurations, error -61 [ 710.726584][ T5616] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 710.747977][ T5616] usb 2-1: Using ep0 maxpacket: 8 [ 710.751132][ T5616] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 710.751169][ T5616] usb 2-1: can't read configurations, error -61 [ 710.751750][ T5616] usb usb2-port1: unable to enumerate USB device [ 711.187901][ T37] usb 9-1: Warning! Unlikely small volume range (=48), linear volume or custom curve? [ 711.187923][ T37] usb 9-1: [2] FU [Speaker Playback Volume] ch = 1, val = 0/48/1 [ 711.237005][T19984] netlink: 'syz.7.4145': attribute type 29 has an invalid length. [ 711.248669][T19984] netlink: 'syz.7.4145': attribute type 29 has an invalid length. [ 711.252954][T19984] netlink: 500 bytes leftover after parsing attributes in process `syz.7.4145'. [ 711.341861][T19989] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4146'. [ 711.709492][T20013] netlink: 200 bytes leftover after parsing attributes in process `syz.7.4152'. [ 711.753132][T20015] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4153'. [ 712.048522][ T5763] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 712.213108][ T5763] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 712.213139][ T5763] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 712.213158][ T5763] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 712.213184][ T5763] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 712.213198][ T5763] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 712.216775][ T5763] usb 7-1: config 0 descriptor?? [ 712.597288][T20042] FAULT_INJECTION: forcing a failure. [ 712.597288][T20042] name failslab, interval 1, probability 0, space 0, times 0 [ 712.597313][T20042] CPU: 1 UID: 0 PID: 20042 Comm: syz.1.4160 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 712.597333][T20042] Tainted: [L]=SOFTLOCKUP [ 712.597337][T20042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 712.597345][T20042] Call Trace: [ 712.597350][T20042] [ 712.597356][T20042] dump_stack_lvl+0xe8/0x150 [ 712.597375][T20042] should_fail_ex+0x46b/0x600 [ 712.597393][T20042] should_failslab+0xa8/0x100 [ 712.597412][T20042] __kmalloc_noprof+0xdf/0x7b0 [ 712.597428][T20042] ? rwbase_write_lock+0x568/0x730 [ 712.597441][T20042] ? security_sb_alloc+0x48/0x310 [ 712.597461][T20042] security_sb_alloc+0x48/0x310 [ 712.597479][T20042] alloc_super+0x294/0xac0 [ 712.597495][T20042] ? rt_spin_unlock+0x160/0x200 [ 712.597510][T20042] ? __pfx_super_s_dev_test+0x10/0x10 [ 712.597526][T20042] sget_fc+0x329/0xa40 [ 712.597542][T20042] ? __pfx_super_s_dev_set+0x10/0x10 [ 712.597560][T20042] get_tree_bdev_flags+0x214/0x4f0 [ 712.597576][T20042] ? __pfx_get_tree_mtd+0x10/0x10 [ 712.597590][T20042] ? __pfx_cramfs_blkdev_fill_super+0x10/0x10 [ 712.597608][T20042] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 712.597630][T20042] vfs_get_tree+0x92/0x2a0 [ 712.597648][T20042] do_new_mount+0x341/0xd30 [ 712.597661][T20042] ? apparmor_capable+0x126/0x170 [ 712.597677][T20042] ? __pfx_do_new_mount+0x10/0x10 [ 712.597690][T20042] ? ns_capable+0x89/0xe0 [ 712.597709][T20042] ? user_path_at+0xd4/0x160 [ 712.597727][T20042] ? user_path_at+0xd4/0x160 [ 712.597745][T20042] __se_sys_mount+0x31d/0x420 [ 712.597762][T20042] ? __pfx___se_sys_mount+0x10/0x10 [ 712.597779][T20042] ? __x64_sys_mount+0x20/0xc0 [ 712.597792][T20042] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 712.597806][T20042] do_syscall_64+0x15f/0xf80 [ 712.597817][T20042] ? trace_irq_disable+0x3b/0x140 [ 712.597843][T20042] ? clear_bhb_loop+0x40/0x90 [ 712.597868][T20042] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 712.597888][T20042] RIP: 0033:0x7f5b4fa3cdd9 [ 712.597907][T20042] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 712.597925][T20042] RSP: 002b:00007f5b4dc8e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 712.597947][T20042] RAX: ffffffffffffffda RBX: 00007f5b4fcb5fa0 RCX: 00007f5b4fa3cdd9 [ 712.597956][T20042] RDX: 00002000000000c0 RSI: 0000200000000000 RDI: 0000200000000100 [ 712.597965][T20042] RBP: 00007f5b4dc8e090 R08: 0000000000000000 R09: 0000000000000000 [ 712.597973][T20042] R10: 0000000000208000 R11: 0000000000000246 R12: 0000000000000002 [ 712.597981][T20042] R13: 00007f5b4fcb6038 R14: 00007f5b4fcb5fa0 R15: 00007fffea315828 [ 712.597999][T20042] [ 712.995931][ T5763] plantronics 0003:047F:FFFF.0022: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 713.022789][ T5616] usb 9-1: USB disconnect, device number 5 [ 713.317399][T20076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 713.332713][T20076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 713.441529][ T5687] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 713.570468][ T5687] usb 2-1: device descriptor read/64, error -71 [ 713.606874][T20099] syzkaller1: entered promiscuous mode [ 713.606893][T20099] syzkaller1: entered allmulticast mode [ 713.823959][ T5687] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 713.950988][ T5687] usb 2-1: device descriptor read/64, error -71 [ 714.066758][ T5687] usb usb2-port1: attempt power cycle [ 714.126145][T20116] netlink: 'syz.8.4174': attribute type 29 has an invalid length. [ 714.127473][T20116] netlink: 'syz.8.4174': attribute type 29 has an invalid length. [ 714.128176][T20116] netlink: 500 bytes leftover after parsing attributes in process `syz.8.4174'. [ 714.421585][ T5687] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 714.443303][ T5687] usb 2-1: device descriptor read/8, error -71 [ 714.551731][ T5763] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 714.681817][ T5687] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 714.693493][ T5763] usb 9-1: device descriptor read/64, error -71 [ 714.702848][ T5687] usb 2-1: device descriptor read/8, error -71 [ 714.726974][ T5616] usb 7-1: USB disconnect, device number 37 [ 714.812277][ T5687] usb usb2-port1: unable to enumerate USB device [ 714.886519][T20142] netlink: 200 bytes leftover after parsing attributes in process `syz.6.4177'. [ 714.942193][ T5763] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 715.102824][ T5763] usb 9-1: device descriptor read/64, error -71 [ 715.214061][ T5763] usb usb9-port1: attempt power cycle [ 715.562939][ T5763] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 715.593369][ T5763] usb 9-1: device descriptor read/8, error -71 [ 715.642990][ T5616] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 715.773079][ T5616] usb 7-1: device descriptor read/64, error -71 [ 715.833146][ T5763] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 715.854360][ T5763] usb 9-1: device descriptor read/8, error -71 [ 715.964836][ T5763] usb usb9-port1: unable to enumerate USB device [ 716.033452][ T5616] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 716.178531][T20163] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4182'. [ 716.185084][ T5616] usb 7-1: device descriptor read/64, error -71 [ 716.312304][ T5616] usb usb7-port1: attempt power cycle [ 716.604790][ T5615] usb 2-1: new full-speed USB device number 67 using dummy_hcd [ 716.664159][ T5616] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 716.685773][ T5616] usb 7-1: device descriptor read/8, error -71 [ 716.765628][ T5615] usb 2-1: not running at top speed; connect to a high speed hub [ 716.766746][ T5615] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x5 has invalid wMaxPacketSize 0 [ 716.766784][ T5615] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 716.766887][ T5615] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 1023 [ 716.769128][ T5615] usb 2-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 716.769154][ T5615] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 716.769167][ T5615] usb 2-1: Product: syz [ 716.769176][ T5615] usb 2-1: Manufacturer: syz [ 716.769184][ T5615] usb 2-1: SerialNumber: syz [ 716.934367][ T5616] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 716.959606][ T5616] usb 7-1: device descriptor read/8, error -71 [ 717.030920][ T5615] usb 2-1: BAAD GENERIC IO: no channels? [ 717.078836][ T5616] usb usb7-port1: unable to enumerate USB device [ 717.172477][ T5615] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 717.206559][ T5615] usb 2-1: USB disconnect, device number 67 [ 717.277263][T10256] udevd[10256]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 717.795229][ T5701] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 717.895274][ T5615] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 717.947482][ T5701] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 717.947512][ T5701] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 717.947561][ T5701] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 717.947589][ T5701] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 717.947607][ T5701] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.952955][ T5701] usb 2-1: config 0 descriptor?? [ 718.101984][ T5615] usb 9-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 718.102019][ T5615] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 718.102041][ T5615] usb 9-1: Product: syz [ 718.102057][ T5615] usb 9-1: Manufacturer: syz [ 718.102073][ T5615] usb 9-1: SerialNumber: syz [ 718.146795][ T5615] usb 9-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 718.264138][ T5763] usb 9-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 718.565944][ T5701] plantronics 0003:047F:FFFF.0023: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 718.769999][T12467] usb 2-1: USB disconnect, device number 68 [ 718.804524][T20252] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 718.830197][T20252] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 718.949033][T20271] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4193'. [ 718.949094][T20271] netlink: 200 bytes leftover after parsing attributes in process `syz.6.4193'. [ 719.328113][T20287] netlink: 56 bytes leftover after parsing attributes in process `syz.6.4195'. [ 719.342940][T20287] netlink: 56 bytes leftover after parsing attributes in process `syz.6.4195'. [ 719.457165][ T5763] ath9k_htc 9-1:1.0: ath9k_htc: Target is unresponsive [ 719.457480][ T5763] ath9k_htc: Failed to initialize the device [ 719.552901][T12467] usb 9-1: USB disconnect, device number 10 [ 719.587948][T12467] usb 9-1: ath9k_htc: USB layer deinitialized [ 719.881381][T20313] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4200'. [ 720.217384][ T5763] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 720.387574][ T5763] usb 7-1: Using ep0 maxpacket: 8 [ 720.390969][ T5763] usb 7-1: config 149 has an invalid interface number: 79 but max is 0 [ 720.390998][ T5763] usb 7-1: config 149 has an invalid descriptor of length 0, skipping remainder of the config [ 720.391019][ T5763] usb 7-1: config 149 has no interface number 0 [ 720.391063][ T5763] usb 7-1: config 149 interface 79 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 7 [ 720.391091][ T5763] usb 7-1: config 149 interface 79 has no altsetting 0 [ 720.393907][ T5763] usb 7-1: New USB device found, idVendor=05ac, idProduct=6940, bcdDevice=ff.a3 [ 720.393937][ T5763] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.393959][ T5763] usb 7-1: Product: syz [ 720.393975][ T5763] usb 7-1: Manufacturer: syz [ 720.393990][ T5763] usb 7-1: SerialNumber: syz [ 720.484933][ T823] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 720.657719][ T823] usb 9-1: Using ep0 maxpacket: 8 [ 720.659991][ T823] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 720.660024][ T823] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 8 [ 720.660122][ T823] usb 9-1: New USB device found, idVendor=056a, idProduct=0309, bcdDevice= 0.00 [ 720.660148][ T823] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 720.719677][ T823] usb 9-1: config 0 descriptor?? [ 720.755492][ T5763] usb 7-1: USB disconnect, device number 42 [ 721.218137][ T5763] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 721.367377][T20324] netlink: 'syz.8.4203': attribute type 27 has an invalid length. [ 721.367420][T20324] lo: entered promiscuous mode [ 721.367440][T20324] lo: entered allmulticast mode [ 721.369633][T20324] tunl0: entered promiscuous mode [ 721.369657][T20324] tunl0: entered allmulticast mode [ 721.370473][T20324] gre0: entered promiscuous mode [ 721.370494][T20324] gre0: entered allmulticast mode [ 721.371205][T20324] gretap0: entered promiscuous mode [ 721.371226][T20324] gretap0: entered allmulticast mode [ 721.372674][T20324] erspan0: entered promiscuous mode [ 721.372711][T20324] erspan0: entered allmulticast mode [ 721.374203][T20324] ip_vti0: entered promiscuous mode [ 721.374225][T20324] ip_vti0: entered allmulticast mode [ 721.374965][T20324] ip6_vti0: entered promiscuous mode [ 721.374985][T20324] ip6_vti0: entered allmulticast mode [ 721.375645][T20324] sit0: entered promiscuous mode [ 721.375666][T20324] sit0: entered allmulticast mode [ 721.376331][T20324] ip6tnl0: entered promiscuous mode [ 721.376351][T20324] ip6tnl0: entered allmulticast mode [ 721.377029][T20324] ip6gre0: entered promiscuous mode [ 721.377048][T20324] ip6gre0: entered allmulticast mode [ 721.377733][T20324] syz_tun: entered promiscuous mode [ 721.377753][T20324] syz_tun: entered allmulticast mode [ 721.380407][T20324] ip6gretap0: entered promiscuous mode [ 721.380430][T20324] ip6gretap0: entered allmulticast mode [ 721.384157][T20324] vcan0: entered promiscuous mode [ 721.384180][T20324] vcan0: entered allmulticast mode [ 721.385303][T20324] bond0: entered promiscuous mode [ 721.385322][T20324] bond_slave_0: entered promiscuous mode [ 721.385580][T20324] bond_slave_1: entered promiscuous mode [ 721.386429][T20324] bond0: entered allmulticast mode [ 721.386447][T20324] bond_slave_0: entered allmulticast mode [ 721.386471][T20324] bond_slave_1: entered allmulticast mode [ 721.389353][T20324] team0: entered promiscuous mode [ 721.389372][T20324] team_slave_0: entered promiscuous mode [ 721.389595][T20324] team_slave_1: entered promiscuous mode [ 721.389811][T20324] team0: entered allmulticast mode [ 721.389826][T20324] team_slave_0: entered allmulticast mode [ 721.389848][T20324] team_slave_1: entered allmulticast mode [ 721.392234][T20324] dummy0: entered promiscuous mode [ 721.392260][T20324] dummy0: entered allmulticast mode [ 721.425882][T20324] nlmon0: entered promiscuous mode [ 721.425909][T20324] nlmon0: entered allmulticast mode [ 721.455750][T20324] batadv0: entered promiscuous mode [ 721.455779][T20324] batadv0: entered allmulticast mode [ 721.489822][T20324] vxcan0: entered promiscuous mode [ 721.489850][T20324] vxcan0: entered allmulticast mode [ 721.518459][T20324] vxcan1: entered promiscuous mode [ 721.518486][T20324] vxcan1: entered allmulticast mode [ 721.525605][T20324] veth0: entered promiscuous mode [ 721.525633][T20324] veth0: entered allmulticast mode [ 721.540392][T20324] veth1: entered promiscuous mode [ 721.540420][T20324] veth1: entered allmulticast mode [ 721.564544][T20324] wg0: entered promiscuous mode [ 721.564571][T20324] wg0: entered allmulticast mode [ 721.565524][T20324] wg1: entered promiscuous mode [ 721.565545][T20324] wg1: entered allmulticast mode [ 721.566412][T20324] wg2: entered promiscuous mode [ 721.566432][T20324] wg2: entered allmulticast mode [ 721.567295][T20324] veth0_to_bridge: entered promiscuous mode [ 721.567317][T20324] veth0_to_bridge: entered allmulticast mode [ 721.572903][T20324] bridge_slave_0: entered promiscuous mode [ 721.572928][T20324] bridge_slave_0: entered allmulticast mode [ 721.575246][T20324] veth1_to_bridge: entered promiscuous mode [ 721.575268][T20324] veth1_to_bridge: entered allmulticast mode [ 721.577149][T20324] bridge_slave_1: entered promiscuous mode [ 721.577171][T20324] bridge_slave_1: entered allmulticast mode [ 721.579550][T20324] veth0_to_bond: entered promiscuous mode [ 721.579573][T20324] veth0_to_bond: entered allmulticast mode [ 721.582960][T20324] veth1_to_bond: entered promiscuous mode [ 721.582982][T20324] veth1_to_bond: entered allmulticast mode [ 721.586231][T20324] veth0_to_team: entered promiscuous mode [ 721.586254][T20324] veth0_to_team: entered allmulticast mode [ 721.603550][T20324] veth1_to_team: entered promiscuous mode [ 721.603577][T20324] veth1_to_team: entered allmulticast mode [ 721.614418][T20324] veth0_to_batadv: entered promiscuous mode [ 721.614444][T20324] veth0_to_batadv: entered allmulticast mode [ 721.651279][T20324] batadv_slave_0: entered promiscuous mode [ 721.651305][T20324] batadv_slave_0: entered allmulticast mode [ 721.653603][T20324] veth1_to_batadv: entered promiscuous mode [ 721.653625][T20324] veth1_to_batadv: entered allmulticast mode [ 721.656130][T20324] batadv_slave_1: entered promiscuous mode [ 721.656153][T20324] batadv_slave_1: entered allmulticast mode [ 721.664237][T20324] xfrm0: entered promiscuous mode [ 721.664258][T20324] xfrm0: entered allmulticast mode [ 721.665715][T20324] veth0_to_hsr: entered promiscuous mode [ 721.665745][T20324] veth0_to_hsr: entered allmulticast mode [ 721.665895][ T5763] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 721.665925][ T5763] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 721.666004][ T5763] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 721.666048][ T5763] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 721.666073][ T5763] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 721.677047][T20324] hsr_slave_0: entered allmulticast mode [ 721.683726][T20324] veth1_to_hsr: entered promiscuous mode [ 721.683750][T20324] veth1_to_hsr: entered allmulticast mode [ 721.686170][T20324] hsr_slave_1: entered allmulticast mode [ 721.689410][T20324] hsr0: entered promiscuous mode [ 721.689437][T20324] hsr0: entered allmulticast mode [ 721.692089][T20324] veth1_virt_wifi: entered promiscuous mode [ 721.692109][T20324] veth1_virt_wifi: entered allmulticast mode [ 721.694552][T20324] veth0_virt_wifi: entered promiscuous mode [ 721.694575][T20324] veth0_virt_wifi: entered allmulticast mode [ 721.699429][T20324] virt_wifi0: entered promiscuous mode [ 721.699451][T20324] virt_wifi0: entered allmulticast mode [ 721.703639][T20324] veth1_vlan: entered allmulticast mode [ 721.706187][T20324] veth0_vlan: entered allmulticast mode [ 721.718806][T20324] vlan0: entered promiscuous mode [ 721.719080][T20324] vlan0: entered allmulticast mode [ 721.721806][T20324] vlan1: entered promiscuous mode [ 721.722083][T20324] vlan1: entered allmulticast mode [ 721.724653][T20324] macvlan0: entered promiscuous mode [ 721.724852][T20324] macvlan0: entered allmulticast mode [ 721.733747][T20324] macvlan1: entered promiscuous mode [ 721.733952][T20324] macvlan1: entered allmulticast mode [ 721.791104][T20324] ipvlan0: entered promiscuous mode [ 721.791134][T20324] ipvlan0: entered allmulticast mode [ 721.802490][T20324] ipvlan1: entered promiscuous mode [ 721.802519][T20324] ipvlan1: entered allmulticast mode [ 721.904956][T20324] veth1_macvtap: entered allmulticast mode [ 721.913776][T20324] veth0_macvtap: entered allmulticast mode [ 721.917984][T20324] macvtap0: entered promiscuous mode [ 721.918174][T20324] macvtap0: entered allmulticast mode [ 721.920979][T20324] macsec0: entered promiscuous mode [ 721.921178][T20324] macsec0: entered allmulticast mode [ 721.923342][T20324] geneve0: entered promiscuous mode [ 721.923363][T20324] geneve0: entered allmulticast mode [ 721.926453][T20324] geneve1: entered promiscuous mode [ 721.926474][T20324] geneve1: entered allmulticast mode [ 721.946641][T20324] netdevsim netdevsim8 netdevsim0: entered promiscuous mode [ 721.946676][T20324] netdevsim netdevsim8 netdevsim0: entered allmulticast mode [ 721.997082][T20324] netdevsim netdevsim8 netdevsim1: entered promiscuous mode [ 721.997118][T20324] netdevsim netdevsim8 netdevsim1: entered allmulticast mode [ 722.155528][T20324] netdevsim netdevsim8 netdevsim2: entered promiscuous mode [ 722.155567][T20324] netdevsim netdevsim8 netdevsim2: entered allmulticast mode [ 722.185318][T20324] netdevsim netdevsim8 netdevsim3: entered promiscuous mode [ 722.185729][T20324] netdevsim netdevsim8 netdevsim3: entered allmulticast mode [ 722.231656][ T5763] usb 2-1: config 0 descriptor?? [ 722.277563][T20324] mac80211_hwsim hwsim28 wlan0: entered promiscuous mode [ 722.277602][T20324] mac80211_hwsim hwsim28 wlan0: entered allmulticast mode [ 722.280605][T20324] mac80211_hwsim hwsim29 wlan1: entered promiscuous mode [ 722.281017][T20324] mac80211_hwsim hwsim29 wlan1: entered allmulticast mode [ 722.575949][ T823] usbhid 9-1:0.0: can't add hid device: -71 [ 722.576442][ T823] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 722.608545][ T823] usb 9-1: USB disconnect, device number 11 [ 722.668873][ T5763] plantronics 0003:047F:FFFF.0024: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 722.925545][T20397] binder_alloc: 20396: binder_alloc_buf size 16496 failed, no address space [ 722.925720][T20397] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 723.047412][ T5763] usb 2-1: USB disconnect, device number 69 [ 723.047440][T20399] plantronics 0003:047F:FFFF.0024: usb_submit_urb(ctrl) failed: -19 [ 723.307848][T20425] netlink: 'syz.7.4220': attribute type 4 has an invalid length. [ 723.956401][T20452] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4228'. [ 723.956477][T20452] netlink: 200 bytes leftover after parsing attributes in process `syz.1.4228'. [ 724.180167][ T823] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 724.210577][T20465] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4232'. [ 724.360291][ T823] usb 9-1: Using ep0 maxpacket: 16 [ 724.362121][ T823] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 724.362148][ T823] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 724.365159][ T823] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 724.365182][ T823] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.365247][ T823] usb 9-1: Product: syz [ 724.365263][ T823] usb 9-1: Manufacturer: syz [ 724.365280][ T823] usb 9-1: SerialNumber: syz [ 724.442354][ T823] usb 9-1: 0:2 : does not exist [ 724.442405][ T823] usb 9-1: unit 6 not found! [ 724.565060][T20476] syzkaller1: entered promiscuous mode [ 724.565085][T20476] syzkaller1: entered allmulticast mode [ 724.934146][ T823] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 725.362461][T20502] netlink: 152 bytes leftover after parsing attributes in process `syz.7.4237'. [ 726.211374][ T823] usb 7-1: Using ep0 maxpacket: 16 [ 726.223889][ T823] usb 7-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 726.223924][ T823] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.223946][ T823] usb 7-1: Product: syz [ 726.223962][ T823] usb 7-1: Manufacturer: syz [ 726.223978][ T823] usb 7-1: SerialNumber: syz [ 726.285418][ T823] usb 7-1: config 0 descriptor?? [ 726.418965][T20507] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4238'. [ 726.488682][ T823] speedtch 7-1:0.0: speedtch_bind: data interface not found! [ 726.488709][ T823] speedtch 7-1:0.0: usbatm_usb_probe: bind failed: -19! [ 726.551312][ T5701] usb 7-1: USB disconnect, device number 43 [ 726.623719][T20525] wireguard: wg0: Could not create IPv4 socket [ 726.770644][T20534] netlink: 36 bytes leftover after parsing attributes in process `syz.7.4244'. [ 726.908073][T20543] binder_alloc: 20542: binder_alloc_buf size 28784 failed, no address space [ 726.908097][T20543] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 727.154633][ T823] usb 9-1: USB disconnect, device number 12 [ 727.483716][T20580] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4257'. [ 727.483775][T20580] netlink: 200 bytes leftover after parsing attributes in process `syz.6.4257'. [ 727.576879][T20585] sg_write: process 125 (syz.8.4259) changed security contexts after opening file descriptor, this is not allowed. [ 728.512650][ T823] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 728.686107][ T823] usb 9-1: Using ep0 maxpacket: 32 [ 728.688153][ T823] usb 9-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 728.688172][ T823] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 728.692253][ T823] usb 9-1: config 0 descriptor?? [ 728.742676][ T37] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 728.895657][ T823] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 728.921148][ T37] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 728.921176][ T37] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 728.921191][ T37] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 728.921216][ T37] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 728.921230][ T37] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 728.984637][ T37] usb 7-1: config 0 descriptor?? [ 729.007999][ T823] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 729.009304][ T823] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 729.009423][ T823] usb 9-1: media controller created [ 729.052528][ T823] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 729.394991][ T823] az6027: usb out operation failed. (-71) [ 729.518795][ T823] az6027: usb out operation failed. (-71) [ 729.518819][ T823] stb0899_attach: Driver disabled by Kconfig [ 729.518829][ T823] az6027: no front-end attached [ 729.518829][ T823] [ 729.520627][ T823] az6027: usb out operation failed. (-71) [ 729.520648][ T823] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 729.564380][ T823] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input51 [ 729.572012][ T823] dvb-usb: schedule remote query interval to 400 msecs. [ 729.572036][ T823] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 729.632706][ T823] usb 9-1: USB disconnect, device number 13 [ 729.650833][ T37] plantronics 0003:047F:FFFF.0025: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 730.148591][ T823] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 730.412129][T20673] syzkaller1: entered promiscuous mode [ 730.412157][T20673] syzkaller1: entered allmulticast mode [ 730.538301][T20686] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4271'. [ 731.222304][T20714] virtio-fs: tag not found [ 731.655128][T20732] netlink: 16 bytes leftover after parsing attributes in process `syz.8.4281'. [ 731.665546][T20736] loop8: detected capacity change from 0 to 7 [ 731.668370][ T13] lo_rw_aio(loop8) starting read with raw_refcnt=0x1, refcnt=2 [ 731.668639][T20736] Dev loop8: unable to read RDB block 7 [ 731.668664][T20736] loop8: AHDI p1 p2 [ 731.668693][T20736] loop8: partition table partially beyond EOD, truncated [ 731.669726][T20736] loop8: p1 start 1702000233 is beyond EOD, truncated [ 731.751789][T20740] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4283'. [ 731.754626][T10256] __loop_clr_fd(loop8) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 732.004342][ T823] usb 7-1: USB disconnect, device number 44 [ 732.434468][ T823] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 732.464331][ T5621] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 732.759805][ T823] usb 7-1: Using ep0 maxpacket: 32 [ 732.766864][ T823] usb 7-1: unable to get BOS descriptor or descriptor too short [ 732.770136][ T823] usb 7-1: New USB device found, idVendor=0582, idProduct=0002, bcdDevice= 0.40 [ 732.770168][ T823] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.770189][ T823] usb 7-1: Product: syz [ 732.770199][ T823] usb 7-1: Manufacturer: syz [ 732.770208][ T823] usb 7-1: SerialNumber: syz [ 732.794306][ T5621] usb 2-1: Using ep0 maxpacket: 16 [ 732.806334][ T5621] usb 2-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 732.806368][ T5621] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.850573][ T5621] usb 2-1: config 0 descriptor?? [ 732.892536][ T5621] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 733.058323][ T823] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 733.060657][ T823] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 733.064247][T20774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 733.094857][T20774] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 733.115183][ T823] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 733.116344][ T823] snd-usb-audio 7-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 733.146844][ T823] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 733.254208][ T823] snd-usb-audio 7-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 733.281528][ T823] usb 7-1: USB disconnect, device number 45 [ 733.352699][T10137] udevd[10137]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 733.422091][T20812] netlink: 20 bytes leftover after parsing attributes in process `syz.8.4292'. [ 733.530290][T20815] netlink: 36 bytes leftover after parsing attributes in process `syz.8.4293'. [ 734.667369][T20858] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 734.925196][ T37] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 735.085503][ T37] usb 7-1: Using ep0 maxpacket: 8 [ 735.088588][ T37] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 735.088628][ T37] usb 7-1: config 1 interface 0 has no altsetting 0 [ 735.122404][ T37] usb 7-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 735.122436][ T37] usb 7-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 735.122506][ T37] usb 7-1: Product: syz [ 735.122516][ T37] usb 7-1: Manufacturer: syz [ 735.122525][ T37] usb 7-1: SerialNumber: syz [ 735.155297][ T5621] gspca_sonixj: i2c_w8 err -71 [ 735.155558][ T5621] sonixj 2-1:0.0: probe with driver sonixj failed with error -71 [ 735.189667][ T5621] usb 2-1: USB disconnect, device number 70 [ 735.271928][T20875] netlink: 200 bytes leftover after parsing attributes in process `syz.8.4307'. [ 735.384560][ T37] usb 7-1: Handspring Visor / Palm OS: No valid connect info available [ 735.384579][ T37] usb 7-1: Handspring Visor / Palm OS: port 143, is for Remote File System use [ 735.384591][ T37] usb 7-1: Handspring Visor / Palm OS: port 223, is for unknown use [ 735.384602][ T37] usb 7-1: Handspring Visor / Palm OS: Number of ports: 2 [ 735.611238][ T37] usb 7-1: palm_os_3_probe - error -71 getting bytes available request [ 735.611317][ T37] visor 7-1:1.0: Handspring Visor / Palm OS converter detected [ 735.628035][ T37] usb 7-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 735.651397][ T37] usb 7-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 735.670119][ T37] usb 7-1: USB disconnect, device number 46 [ 735.672027][T20905] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4310'. [ 735.672911][T20905] netlink: 200 bytes leftover after parsing attributes in process `syz.7.4310'. [ 735.694397][ T37] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 735.711793][ T37] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 735.716349][ T823] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 735.717670][ T37] visor 7-1:1.0: device disconnected [ 735.845403][ T823] usb 9-1: device descriptor read/64, error -71 [ 736.095519][ T823] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 736.177431][ T37] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 736.245603][ T823] usb 9-1: device descriptor read/64, error -71 [ 736.332650][ T37] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 736.332688][ T37] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 736.332712][ T37] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 736.332755][ T37] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 736.332779][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 736.354335][ T37] usb 2-1: config 0 descriptor?? [ 736.364670][ T823] usb usb9-port1: attempt power cycle [ 736.379621][T20942] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4321'. [ 736.715779][ T823] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 736.736960][ T823] usb 9-1: device descriptor read/8, error -71 [ 736.802637][ T37] plantronics 0003:047F:FFFF.0026: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 736.888359][T20958] tmpfs: Bad value for 'mpol' [ 736.890109][T20958] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4323'. [ 736.995798][ T823] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 737.016346][ T823] usb 9-1: device descriptor read/8, error -71 [ 737.126328][ T823] usb usb9-port1: unable to enumerate USB device [ 738.173497][T20975] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4325'. [ 738.659407][T20992] netlink: 36 bytes leftover after parsing attributes in process `syz.8.4330'. [ 739.046541][ T823] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 739.081603][T21011] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4334'. [ 739.238143][ T823] usb 9-1: config 1 has an invalid interface number: 7 but max is 0 [ 739.238174][ T823] usb 9-1: config 1 has no interface number 0 [ 739.238220][ T823] usb 9-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 739.238249][ T823] usb 9-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 739.238377][ T823] usb 9-1: config 1 interface 7 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 739.238400][ T823] usb 9-1: config 1 interface 7 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 739.240804][ T823] usb 9-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 739.240835][ T823] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.240857][ T823] usb 9-1: Product: syz [ 739.240873][ T823] usb 9-1: Manufacturer: syz [ 739.240888][ T823] usb 9-1: SerialNumber: syz [ 739.266783][ T5687] usb 2-1: reset high-speed USB device number 71 using dummy_hcd [ 739.354777][T20994] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 739.376395][ T823] usb 9-1: Expected 3 endpoints, found: 2 [ 739.400950][T21022] loop8: detected capacity change from 0 to 7 [ 739.401645][ T1914] lo_rw_aio(loop8) starting read with raw_refcnt=0x1, refcnt=2 [ 739.407546][T21022] Dev loop8: unable to read RDB block 7 [ 739.407575][T21022] loop8: AHDI p1 p2 [ 739.407603][T21022] loop8: partition table partially beyond EOD, truncated [ 739.407885][T21022] loop8: p1 start 1702000233 is beyond EOD, truncated [ 739.463158][T10502] __loop_clr_fd(loop8) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 739.573565][ T823] usb 9-1: USB disconnect, device number 18 [ 739.785133][T21042] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4341'. [ 740.205542][ T9] usb 2-1: USB disconnect, device number 71 [ 740.225503][ T5687] plantronics 0003:047F:FFFF.0026: usb_submit_urb(ctrl) failed: -19 [ 740.381015][T21069] Bluetooth: MGMT ver 1.23 [ 740.420230][T21077] binder_alloc: 21072: binder_alloc_buf size 33554544 failed, no address space [ 740.420253][T21077] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 740.527153][T21081] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4348'. [ 740.790868][T21095] netlink: 36 bytes leftover after parsing attributes in process `syz.7.4353'. [ 741.281856][T21122] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4364'. [ 741.556900][ T37] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 741.706931][ T5615] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 741.716908][ T37] usb 7-1: Using ep0 maxpacket: 32 [ 741.724968][ T37] usb 7-1: config 1 has an invalid descriptor of length 131, skipping remainder of the config [ 741.725034][ T37] usb 7-1: config 1 interface 0 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 741.725063][ T37] usb 7-1: config 1 interface 0 has no altsetting 0 [ 741.752820][ T37] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 741.752852][ T37] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.752873][ T37] usb 7-1: Product: syz [ 741.752889][ T37] usb 7-1: Manufacturer: syz [ 741.752905][ T37] usb 7-1: SerialNumber: syz [ 741.761715][ T37] usb 7-1: rejected 1 configuration due to insufficient available bus power [ 741.761743][ T37] usb 7-1: no configuration chosen from 1 choice [ 741.870441][ T5615] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 741.870478][ T5615] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 741.870509][ T5615] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 741.870552][ T5615] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 741.870567][ T5615] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 741.873784][ T5615] usb 9-1: config 0 descriptor?? [ 742.316724][ T5615] plantronics 0003:047F:FFFF.0027: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 742.539251][ T9] usb 9-1: USB disconnect, device number 19 [ 743.751390][T21192] FAULT_INJECTION: forcing a failure. [ 743.751390][T21192] name failslab, interval 1, probability 0, space 0, times 0 [ 743.751416][T21192] CPU: 1 UID: 0 PID: 21192 Comm: syz.8.4376 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 743.751433][T21192] Tainted: [L]=SOFTLOCKUP [ 743.751438][T21192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 743.751446][T21192] Call Trace: [ 743.751451][T21192] [ 743.751456][T21192] dump_stack_lvl+0xe8/0x150 [ 743.751475][T21192] should_fail_ex+0x46b/0x600 [ 743.751495][T21192] should_failslab+0xa8/0x100 [ 743.751512][T21192] __kmalloc_noprof+0xdf/0x7b0 [ 743.751528][T21192] ? kfree+0x4d/0x6c0 [ 743.751542][T21192] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 743.751564][T21192] tomoyo_realpath_from_path+0xe3/0x5d0 [ 743.751582][T21192] ? tomoyo_domain+0xd7/0x130 [ 743.751597][T21192] ? tomoyo_path_number_perm+0x219/0x630 [ 743.751612][T21192] tomoyo_path_number_perm+0x246/0x630 [ 743.751634][T21192] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 743.751649][T21192] ? __lock_acquire+0x6b5/0x2d10 [ 743.751663][T21192] ? do_raw_spin_lock+0x12b/0x2f0 [ 743.751694][T21192] ? __fget_files+0x2a/0x420 [ 743.751710][T21192] ? __fget_files+0x2a/0x420 [ 743.751723][T21192] ? __fget_files+0x3a6/0x420 [ 743.751736][T21192] ? __fget_files+0x2a/0x420 [ 743.751752][T21192] security_file_ioctl+0xc3/0x2a0 [ 743.751768][T21192] __se_sys_ioctl+0x47/0x170 [ 743.751785][T21192] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 743.751798][T21192] do_syscall_64+0x15f/0xf80 [ 743.751811][T21192] ? trace_irq_disable+0x3b/0x140 [ 743.751827][T21192] ? clear_bhb_loop+0x40/0x90 [ 743.751842][T21192] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 743.751854][T21192] RIP: 0033:0x7f0a423ecdd9 [ 743.751867][T21192] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 743.751877][T21192] RSP: 002b:00007f0a4063e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 743.751893][T21192] RAX: ffffffffffffffda RBX: 00007f0a42665fa0 RCX: 00007f0a423ecdd9 [ 743.751902][T21192] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 743.751910][T21192] RBP: 00007f0a4063e090 R08: 0000000000000000 R09: 0000000000000000 [ 743.751918][T21192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 743.751926][T21192] R13: 00007f0a42666038 R14: 00007f0a42665fa0 R15: 00007ffea6256be8 [ 743.751943][T21192] [ 743.752014][T21192] ERROR: Out of memory at tomoyo_realpath_from_path. [ 744.336220][ T823] usb 7-1: USB disconnect, device number 47 [ 744.407429][ T37] usb 2-1: new full-speed USB device number 72 using dummy_hcd [ 744.456266][T21215] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4380'. [ 744.585493][ T37] usb 2-1: not running at top speed; connect to a high speed hub [ 744.586403][T21223] tipc: Started in network mode [ 744.586421][T21223] tipc: Node identity 4, cluster identity 4711 [ 744.586434][T21223] tipc: Node number set to 4 [ 744.600029][ T37] usb 2-1: config 1 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 744.600065][ T37] usb 2-1: config 1 interface 0 has no altsetting 0 [ 744.620250][ T37] usb 2-1: New USB device found, idVendor=056a, idProduct=010f, bcdDevice= 0.40 [ 744.620284][ T37] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 744.620307][ T37] usb 2-1: Product: à Œ [ 744.620323][ T37] usb 2-1: Manufacturer: à ‡ [ 744.620339][ T37] usb 2-1: SerialNumber: 军뉢펗僱æ‡ä“ªæ¨’ﺄꪔ剜ì˜ì…›åˆŒâ„宖㣾钑鮿è⺗청芒鹺娹ì‘êŠã‡¥â¤ˆà¼¤ç‚€é±ˆì®…࠵┅퀟몎匦슭舱И쪓æ³êŽé®‘풾ᨑè¢é‘ⓈíŒâº—䀠횪센 [ 744.636374][T21229] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4384'. [ 744.710614][T21197] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 744.942120][T21243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 744.942606][T21243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 745.151505][ T37] usbhid 2-1:1.0: can't add hid device: -71 [ 745.151684][ T37] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 745.170814][ T5687] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 745.180836][ T37] usb 2-1: USB disconnect, device number 72 [ 745.227552][T12467] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 745.328501][ T5687] usb 9-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 745.328535][ T5687] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.328558][ T5687] usb 9-1: Product: syz [ 745.328574][ T5687] usb 9-1: Manufacturer: syz [ 745.328590][ T5687] usb 9-1: SerialNumber: syz [ 745.342412][ T5687] usb 9-1: config 0 descriptor?? [ 745.361167][ T5687] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 745.377825][T12467] usb 7-1: Using ep0 maxpacket: 16 [ 745.377984][ T5687] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 745.379688][ T5687] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 745.379944][ T5687] usb 9-1: media controller created [ 745.417097][T12467] usb 7-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 745.417130][T12467] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.417144][T12467] usb 7-1: Product: syz [ 745.417153][T12467] usb 7-1: Manufacturer: syz [ 745.417161][T12467] usb 7-1: SerialNumber: syz [ 745.436802][T12467] usb 7-1: config 0 descriptor?? [ 745.466996][T12467] ssu100 7-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 745.563996][ T5687] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 745.858644][ T5687] DVB: Unable to find symbol mt352_attach() [ 745.949338][ T5687] DVB: Unable to find symbol nxt6000_attach() [ 745.949350][ T5687] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 745.963984][ T5687] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input52 [ 746.049840][ T5687] dvb-usb: schedule remote query interval to 1000 msecs. [ 746.049926][ T5687] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 746.049945][ T5687] dvb-usb: bulk message failed: -22 (7/0) [ 746.049961][ T5687] dvb-usb: bulk message failed: -22 (7/0) [ 746.163993][ T5687] usb 9-1: USB disconnect, device number 20 [ 746.170088][T12467] ssu100 7-1:0.0: probe with driver ssu100 failed with error -110 [ 746.209928][T21296] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4394'. [ 746.229549][T21296] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4394'. [ 746.412845][ T1245] usb 7-1: USB disconnect, device number 48 [ 746.665167][ T5687] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 746.702086][T21332] ksmbd: Unknown IPC event: 1, ignore. [ 746.944182][ T1245] usb 2-1: new full-speed USB device number 73 using dummy_hcd [ 747.338338][ T5687] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 747.379876][ T823] libceph: connect (1)[c::]:6789 error -101 [ 747.395245][ T823] libceph: mon0 (1)[c::]:6789 connect error [ 747.459669][T21321] ceph: No mds server is up or the cluster is laggy [ 747.478967][ T823] libceph: connect (1)[c::]:6789 error -101 [ 747.479176][ T823] libceph: mon0 (1)[c::]:6789 connect error [ 747.511315][ T5687] usb 7-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 747.511345][ T5687] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 747.511401][ T5687] usb 7-1: Product: syz [ 747.511418][ T5687] usb 7-1: Manufacturer: syz [ 747.511434][ T5687] usb 7-1: SerialNumber: syz [ 747.528213][ T5687] usb 7-1: config 0 descriptor?? [ 747.692972][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.780390][ T823] libceph: connect (1)[c::]:6789 error -101 [ 747.780589][ T823] libceph: mon0 (1)[c::]:6789 connect error [ 747.971819][ T5687] usb 7-1: Firmware: major: 139, minor: 4, hardware type: ATUSB (0) [ 748.205588][ T5687] usb 7-1: failed to fetch extended address, random address set [ 748.305107][ T37] libceph: connect (1)[c::]:6789 error -101 [ 748.305296][ T37] libceph: mon0 (1)[c::]:6789 connect error [ 748.816750][ T37] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 748.953490][ T5687] usb 7-1: USB disconnect, device number 49 [ 749.013516][ T37] usb 9-1: Using ep0 maxpacket: 32 [ 749.015688][ T37] usb 9-1: unable to get BOS descriptor or descriptor too short [ 749.016734][ T37] usb 9-1: config 1 has an invalid interface number: 234 but max is 2 [ 749.016759][ T37] usb 9-1: config 1 has 4 interfaces, different from the descriptor's value: 3 [ 749.016781][ T37] usb 9-1: config 1 has no interface number 3 [ 749.016880][ T37] usb 9-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 186, changing to 7 [ 749.016907][ T37] usb 9-1: config 1 interface 234 has no altsetting 0 [ 749.063258][ T37] usb 9-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 749.063292][ T37] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.063313][ T37] usb 9-1: Product: syz [ 749.063328][ T37] usb 9-1: Manufacturer: syz [ 749.063344][ T37] usb 9-1: SerialNumber: syz [ 749.734396][ T37] usb 9-1: unit 255 not found! [ 749.791604][T21419] syzkaller1: entered promiscuous mode [ 749.791629][T21419] syzkaller1: entered allmulticast mode [ 749.888268][ T37] usb 9-1: USB disconnect, device number 21 [ 750.160951][T10256] udevd[10256]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 750.450659][ T5687] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 750.603153][ T5687] usb 7-1: config 0 has an invalid descriptor of length 152, skipping remainder of the config [ 750.603181][ T5687] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 750.603218][ T5687] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 750.603234][ T5687] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 750.611319][ T5687] usb 7-1: config 0 descriptor?? [ 751.966174][ T5687] usb 7-1: string descriptor 0 read error: -71 [ 751.971127][ T5687] usb 7-1: USB disconnect, device number 50 [ 752.461310][ T37] usb 7-1: new full-speed USB device number 51 using dummy_hcd [ 752.638456][ T37] usb 7-1: unable to get BOS descriptor or descriptor too short [ 752.642217][ T37] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 752.642254][ T37] usb 7-1: can't read configurations, error -71 [ 752.976303][T21599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 752.978083][T21599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 753.200245][ T5621] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 753.369385][ T5621] usb 2-1: Using ep0 maxpacket: 16 [ 753.375126][ T5621] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 753.375146][ T5621] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 753.375170][ T5621] usb 2-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 753.375183][ T5621] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 753.387695][ T5621] usb 2-1: config 0 descriptor?? [ 753.817586][ T5621] usbhid 2-1:0.0: can't add hid device: -71 [ 753.817718][ T5621] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 753.866751][ T5621] usb 2-1: USB disconnect, device number 74 [ 754.279351][ T5687] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 754.431269][ T5687] usb 7-1: unable to get BOS descriptor or descriptor too short [ 754.443025][ T5687] usb 7-1: config 114 has an invalid interface number: 240 but max is 0 [ 754.443056][ T5687] usb 7-1: config 114 has no interface number 0 [ 754.443101][ T5687] usb 7-1: config 114 interface 240 altsetting 232 bulk endpoint 0x1 has invalid maxpacket 1023 [ 754.443127][ T5687] usb 7-1: config 114 interface 240 altsetting 232 has an endpoint descriptor with address 0xCA, changing to 0x8A [ 754.443162][ T5687] usb 7-1: config 114 interface 240 altsetting 232 bulk endpoint 0x8A has invalid maxpacket 16 [ 754.443187][ T5687] usb 7-1: config 114 interface 240 has no altsetting 0 [ 754.446408][ T5687] usb 7-1: string descriptor 0 read error: -22 [ 754.446556][ T5687] usb 7-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice= 6.38 [ 754.446582][ T5687] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 754.541221][T21665] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 754.541347][T21665] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 754.564533][ T5687] ir_usb 7-1:114.240: IR Dongle converter detected [ 754.591058][ T1245] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 754.738706][ T1245] usb 2-1: Using ep0 maxpacket: 16 [ 754.740627][ T1245] usb 2-1: config 3 has an invalid interface number: 201 but max is 0 [ 754.740654][ T1245] usb 2-1: config 3 has no interface number 0 [ 754.740687][ T1245] usb 2-1: config 3 interface 201 has no altsetting 0 [ 754.771698][ T1245] usb 2-1: New USB device found, idVendor=0545, idProduct=800d, bcdDevice= 3.0a [ 754.771719][ T1245] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 754.771732][ T1245] usb 2-1: Product: syz [ 754.771740][ T1245] usb 2-1: Manufacturer: syz [ 754.771749][ T1245] usb 2-1: SerialNumber: syz [ 754.777543][ T5687] usb 7-1: IR Dongle converter now attached to ttyUSB0 [ 754.849327][ T37] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 754.998681][ T37] usb 9-1: Using ep0 maxpacket: 32 [ 755.000835][ T37] usb 9-1: config 0 has an invalid interface number: 67 but max is 0 [ 755.000864][ T37] usb 9-1: config 0 has no interface number 0 [ 755.003790][ T37] usb 9-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 755.003819][ T37] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.003841][ T37] usb 9-1: Product: syz [ 755.003858][ T37] usb 9-1: Manufacturer: syz [ 755.003874][ T37] usb 9-1: SerialNumber: syz [ 755.012709][ T37] usb 9-1: config 0 descriptor?? [ 755.103961][T21692] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4480'. [ 755.231765][ T1245] usb 2-1: USB disconnect, device number 75 [ 755.341334][ T37] smsc95xx 9-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 755.341364][ T37] smsc95xx 9-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 755.341769][ T37] smsc95xx 9-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 755.342051][ T37] smsc95xx 9-1:0.67: probe with driver smsc95xx failed with error -71 [ 755.372585][ T37] usb 9-1: USB disconnect, device number 22 [ 755.571524][ T37] usb 7-1: USB disconnect, device number 53 [ 755.643901][ T37] ir-usb ttyUSB0: IR Dongle converter now disconnected from ttyUSB0 [ 755.652100][ T37] ir_usb 7-1:114.240: device disconnected [ 755.797778][T21776] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4491'. [ 755.797815][T21776] netlink: 'syz.1.4491': attribute type 1 has an invalid length. [ 755.797828][T21776] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4491'. [ 755.890702][T21782] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4490'. [ 755.890761][T21782] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 756.038875][ T1245] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 756.190389][ T1245] usb 2-1: Using ep0 maxpacket: 16 [ 756.200048][ T1245] usb 2-1: config index 0 descriptor too short (expected 51443, got 18) [ 756.205161][ T1245] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 756.205194][ T1245] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.205216][ T1245] usb 2-1: Product: syz [ 756.205232][ T1245] usb 2-1: Manufacturer: syz [ 756.205248][ T1245] usb 2-1: SerialNumber: syz [ 756.259201][ T1245] r8152-cfgselector 2-1: Unknown version 0x0000 [ 756.259228][ T1245] r8152-cfgselector 2-1: config 0 descriptor?? [ 756.466714][T21776] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4491'. [ 756.538978][ T5687] usb 7-1: new high-speed USB device number 54 using dummy_hcd [ 756.562173][ T1245] r8152-cfgselector 2-1: USB disconnect, device number 76 [ 756.695435][ T5687] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 756.695472][ T5687] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 756.695497][ T5687] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 756.695539][ T5687] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 756.695563][ T5687] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 756.751306][ T5687] usb 7-1: config 0 descriptor?? [ 757.242507][ T5687] plantronics 0003:047F:FFFF.0028: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 757.478044][ T5621] usb 7-1: USB disconnect, device number 54 [ 757.608917][ T823] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 757.789322][ T823] usb 2-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x62, changing to 0x2 [ 757.789361][ T823] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 116, changing to 7 [ 757.789392][ T823] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 25439, setting to 1024 [ 757.789423][ T823] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 757.791573][ T823] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 757.791601][ T823] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 757.791622][ T823] usb 2-1: SerialNumber: syz [ 758.081841][T21923] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 758.082507][T21923] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 758.203674][ T823] usbtest 2-1:1.0: Linux user mode ISO test driver [ 758.203698][ T823] usbtest 2-1:1.0: high-speed {control bulk-in iso-out} tests (+alt) [ 758.240663][ T823] usb 2-1: USB disconnect, device number 77 [ 758.808980][T21965] 9p: Could not find request transport: 0xffffffffffffffff [ 759.008575][T21982] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4536'. [ 759.149008][ T5687] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 759.155909][T21991] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 759.157144][T21991] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 759.187153][T21991] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4538'. [ 759.301902][ T5687] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 759.301939][ T5687] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 759.301953][ T5687] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 759.301979][ T5687] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 759.301993][ T5687] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 759.307031][ T5687] usb 2-1: config 0 descriptor?? [ 759.429095][ T1245] usb 7-1: new high-speed USB device number 55 using dummy_hcd [ 759.559052][ T1245] usb 7-1: device descriptor read/64, error -71 [ 759.793037][ T5687] plantronics 0003:047F:FFFF.0029: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 759.849119][ T1245] usb 7-1: new high-speed USB device number 56 using dummy_hcd [ 759.922091][ T5621] usb 2-1: USB disconnect, device number 78 [ 759.999136][ T1245] usb 7-1: device descriptor read/64, error -71 [ 760.002781][T22033] fido_id[22033]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 760.109464][ T1245] usb usb7-port1: attempt power cycle [ 760.449107][ T1245] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 760.469811][ T1245] usb 7-1: device descriptor read/8, error -71 [ 760.709331][ T1245] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 760.730940][ T1245] usb 7-1: device descriptor read/8, error -71 [ 760.839757][ T1245] usb usb7-port1: unable to enumerate USB device [ 761.015679][T22111] netlink: 36 bytes leftover after parsing attributes in process `syz.8.4569'. [ 761.110153][ T5621] usb 2-1: new full-speed USB device number 79 using dummy_hcd [ 761.294596][ T5621] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 761.294642][ T5621] usb 2-1: config 0 interface 0 has no altsetting 0 [ 761.320191][ T5621] usb 2-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 761.320222][ T5621] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 761.320241][ T5621] usb 2-1: Product: syz [ 761.320253][ T5621] usb 2-1: Manufacturer: syz [ 761.320269][ T5621] usb 2-1: SerialNumber: syz [ 761.340255][ T5621] usb 2-1: config 0 descriptor?? [ 761.382867][ T5621] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 761.431730][ T5621] dvb-usb: will use the device's hardware PID filter (table count: 8). [ 761.436394][ T5621] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 761.436449][ T5621] usb 2-1: media controller created [ 761.440032][ T5621] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 761.491365][ T5621] DVB: Unable to find symbol tda10046_attach() [ 761.491377][ T5621] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 761.491387][ T5621] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 761.568703][ T5621] dvb_usb_m920x 2-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 761.579233][ T5621] usb 2-1: USB disconnect, device number 79 [ 761.597221][T10502] udevd[10502]: setting mode of /dev/bus/usb/002/079 to 020664 failed: No such file or directory [ 761.597352][T10502] udevd[10502]: setting owner of /dev/bus/usb/002/079 to uid=0, gid=0 failed: No such file or directory [ 761.669354][ T823] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 761.809812][ T823] usb 9-1: device descriptor read/64, error -71 [ 761.989939][T22152] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4577'. [ 762.059723][ T823] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 762.219424][ T823] usb 9-1: device descriptor read/64, error -71 [ 762.329620][ T823] usb usb9-port1: attempt power cycle [ 762.365876][T22171] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4582'. [ 762.530411][ T1245] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 762.692538][ T1245] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 762.692575][ T1245] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 762.692591][ T1245] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 762.692624][ T1245] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 762.692638][ T1245] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 762.709259][ T823] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 762.720292][ T1245] usb 2-1: config 0 descriptor?? [ 762.739807][ T823] usb 9-1: device descriptor read/8, error -71 [ 762.810616][T22193] netlink: 28 bytes leftover after parsing attributes in process `syz.7.4586'. [ 762.979257][ T823] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 763.000848][ T823] usb 9-1: device descriptor read/8, error -71 [ 763.098550][T22203] netlink: 20 bytes leftover after parsing attributes in process `syz.7.4589'. [ 763.113239][ T823] usb usb9-port1: unable to enumerate USB device [ 763.167186][ T1245] plantronics 0003:047F:FFFF.002A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 763.343733][ T1245] usb 2-1: USB disconnect, device number 80 [ 763.670709][T22239] binder: BINDER_SET_CONTEXT_MGR already set [ 763.670727][T22239] binder: 22238:22239 ioctl 4018620d 200000004a80 returned -16 [ 763.688395][T22241] netlink: 200 bytes leftover after parsing attributes in process `syz.6.4597'. [ 763.747953][T22243] netlink: 212 bytes leftover after parsing attributes in process `syz.7.4598'. [ 763.747983][T22243] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4598'. [ 763.748011][T22243] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4598'. [ 763.811643][T22248] loop8: detected capacity change from 0 to 7 [ 763.813062][ T102] lo_rw_aio(loop8) starting read with raw_refcnt=0x1, refcnt=2 [ 763.813326][T22248] Dev loop8: unable to read RDB block 7 [ 763.813352][T22248] loop8: AHDI p1 p2 [ 763.813377][T22248] loop8: partition table partially beyond EOD, truncated [ 763.814094][T22248] loop8: p1 start 1702000233 is beyond EOD, truncated [ 763.818126][T22246] __loop_clr_fd(loop8) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 763.818518][T22245] syzkaller1: entered promiscuous mode [ 763.818535][T22245] syzkaller1: entered allmulticast mode [ 763.954891][T22256] QAT: failed to copy from user. [ 763.955034][T22256] QAT: failed to copy from user. [ 763.955120][T22256] QAT: failed to copy from user. [ 763.955213][T22256] QAT: failed to copy from user. [ 763.955311][T22256] QAT: failed to copy from user. [ 763.955425][T22256] QAT: failed to copy from user. [ 763.955508][T22256] QAT: failed to copy from user. [ 763.955595][T22256] QAT: failed to copy from user. [ 763.955678][T22256] QAT: failed to copy from user. [ 763.955764][T22256] QAT: failed to copy from user. [ 763.955852][T22256] QAT: failed to copy from user. [ 763.955945][T22256] QAT: failed to copy from user. [ 763.956039][T22256] QAT: failed to copy from user. [ 763.956127][T22256] QAT: failed to copy from user. [ 763.956213][T22256] QAT: failed to copy from user. [ 763.956307][T22256] QAT: failed to copy from user. [ 763.956394][T22256] QAT: failed to copy from user. [ 763.956481][T22256] QAT: failed to copy from user. [ 763.956566][T22256] QAT: failed to copy from user. [ 763.956658][T22256] QAT: failed to copy from user. [ 763.956744][T22256] QAT: failed to copy from user. [ 763.956832][T22256] QAT: failed to copy from user. [ 763.956920][T22256] QAT: failed to copy from user. [ 763.957013][T22256] QAT: failed to copy from user. [ 763.957106][T22256] QAT: failed to copy from user. [ 763.957193][T22256] QAT: failed to copy from user. [ 763.957274][T22256] QAT: failed to copy from user. [ 763.957361][T22256] QAT: failed to copy from user. [ 763.957445][T22256] QAT: failed to copy from user. [ 763.957531][T22256] QAT: failed to copy from user. [ 763.957616][T22256] QAT: failed to copy from user. [ 763.957743][T22256] QAT: failed to copy from user. [ 763.957826][T22256] QAT: failed to copy from user. [ 763.957913][T22256] QAT: failed to copy from user. [ 763.957998][T22256] QAT: failed to copy from user. [ 763.958126][T22256] QAT: failed to copy from user. [ 763.958212][T22256] QAT: failed to copy from user. [ 763.958518][T22256] QAT: failed to copy from user. [ 763.958607][T22256] QAT: failed to copy from user. [ 764.001564][T22256] QAT: failed to copy from user. [ 764.530884][T22273] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4604'. [ 764.538274][T22276] binder: BINDER_SET_CONTEXT_MGR already set [ 764.538301][T22276] binder: 22275:22276 ioctl 4018620d 200000004a80 returned -16 [ 764.743751][T22288] tmpfs: Unknown parameter 'nrFinodes' [ 765.324549][T22311] FAULT_INJECTION: forcing a failure. [ 765.324549][T22311] name failslab, interval 1, probability 0, space 0, times 0 [ 765.324586][T22311] CPU: 0 UID: 0 PID: 22311 Comm: syz.7.4619 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 765.324614][T22311] Tainted: [L]=SOFTLOCKUP [ 765.324622][T22311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 765.324634][T22311] Call Trace: [ 765.324643][T22311] [ 765.324652][T22311] dump_stack_lvl+0xe8/0x150 [ 765.324680][T22311] should_fail_ex+0x46b/0x600 [ 765.324720][T22311] should_failslab+0xa8/0x100 [ 765.324751][T22311] kmem_cache_alloc_noprof+0x87/0x680 [ 765.324779][T22311] ? skb_clone+0x212/0x3a0 [ 765.324813][T22311] skb_clone+0x212/0x3a0 [ 765.324845][T22311] __netlink_deliver_tap+0x424/0x8b0 [ 765.324885][T22311] ? netlink_deliver_tap+0x2e/0x1b0 [ 765.324915][T22311] netlink_deliver_tap+0x19c/0x1b0 [ 765.324947][T22311] netlink_unicast+0x754/0x920 [ 765.324983][T22311] netlink_sendmsg+0x813/0xb40 [ 765.325020][T22311] ? __pfx_netlink_sendmsg+0x10/0x10 [ 765.325050][T22311] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 765.325087][T22311] ? aa_sock_msg_perm+0x122/0x200 [ 765.325118][T22311] ? __pfx_netlink_sendmsg+0x10/0x10 [ 765.325144][T22311] sock_sendmsg_nosec+0x112/0x150 [ 765.325171][T22311] ____sys_sendmsg+0x55c/0x870 [ 765.325205][T22311] ? __pfx_____sys_sendmsg+0x10/0x10 [ 765.325242][T22311] ? import_iovec+0x73/0xa0 [ 765.325276][T22311] ___sys_sendmsg+0x2a5/0x360 [ 765.325304][T22311] ? __lock_acquire+0x6b5/0x2d10 [ 765.325330][T22311] ? __pfx____sys_sendmsg+0x10/0x10 [ 765.325392][T22311] ? __fget_files+0x2a/0x420 [ 765.325417][T22311] ? __fget_files+0x3a6/0x420 [ 765.325450][T22311] __x64_sys_sendmsg+0x1c3/0x2a0 [ 765.325482][T22311] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 765.325521][T22311] ? __pfx_ksys_write+0x10/0x10 [ 765.325557][T22311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.325580][T22311] do_syscall_64+0x15f/0xf80 [ 765.325600][T22311] ? trace_irq_disable+0x3b/0x140 [ 765.325629][T22311] ? clear_bhb_loop+0x40/0x90 [ 765.325654][T22311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.325674][T22311] RIP: 0033:0x7f1b4728cdd9 [ 765.325694][T22311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 765.325718][T22311] RSP: 002b:00007f1b454de028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 765.325740][T22311] RAX: ffffffffffffffda RBX: 00007f1b47505fa0 RCX: 00007f1b4728cdd9 [ 765.325755][T22311] RDX: 0000000000000818 RSI: 0000200000000940 RDI: 0000000000000003 [ 765.325769][T22311] RBP: 00007f1b454de090 R08: 0000000000000000 R09: 0000000000000000 [ 765.325783][T22311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 765.325796][T22311] R13: 00007f1b47506038 R14: 00007f1b47505fa0 R15: 00007ffc0ee74d58 [ 765.325827][T22311] [ 765.580931][T22299] can0: slcan on ptm0. [ 765.924718][T22298] can0 (unregistered): slcan off ptm0. [ 766.745855][T22380] __nla_validate_parse: 5 callbacks suppressed [ 766.745875][T22380] netlink: 204 bytes leftover after parsing attributes in process `syz.6.4637'. [ 766.745896][T22380] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4637'. [ 766.781149][T22382] FAULT_INJECTION: forcing a failure. [ 766.781149][T22382] name failslab, interval 1, probability 0, space 0, times 0 [ 766.781185][T22382] CPU: 1 UID: 0 PID: 22382 Comm: syz.8.4638 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 766.781212][T22382] Tainted: [L]=SOFTLOCKUP [ 766.781221][T22382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 766.781232][T22382] Call Trace: [ 766.781240][T22382] [ 766.781249][T22382] dump_stack_lvl+0xe8/0x150 [ 766.781277][T22382] should_fail_ex+0x46b/0x600 [ 766.781308][T22382] should_failslab+0xa8/0x100 [ 766.781340][T22382] __kmalloc_noprof+0xdf/0x7b0 [ 766.781368][T22382] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 766.781398][T22382] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 766.781429][T22382] genl_family_rcv_msg_doit+0xd9/0x330 [ 766.781459][T22382] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 766.781489][T22382] ? apparmor_capable+0x126/0x170 [ 766.781514][T22382] ? bpf_lsm_capable+0x9/0x20 [ 766.781609][T22382] ? security_capable+0x7e/0x2c0 [ 766.781644][T22382] genl_rcv_msg+0x61c/0x7a0 [ 766.781672][T22382] ? __pfx_genl_rcv_msg+0x10/0x10 [ 766.781695][T22382] ? ref_tracker_free+0x673/0x820 [ 766.781721][T22382] ? __pfx_ip_vs_genl_set_cmd+0x10/0x10 [ 766.781745][T22382] ? ____sys_sendmsg+0x55c/0x870 [ 766.781772][T22382] ? ___sys_sendmsg+0x2a5/0x360 [ 766.781799][T22382] ? __x64_sys_sendmsg+0x1c3/0x2a0 [ 766.781827][T22382] ? do_syscall_64+0x15f/0xf80 [ 766.781846][T22382] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.781876][T22382] netlink_rcv_skb+0x232/0x4b0 [ 766.781910][T22382] ? __pfx_genl_rcv_msg+0x10/0x10 [ 766.781934][T22382] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 766.781975][T22382] ? netlink_deliver_tap+0x2e/0x1b0 [ 766.782002][T22382] ? netlink_deliver_tap+0x2e/0x1b0 [ 766.782054][T22382] genl_rcv+0x28/0x40 [ 766.782075][T22382] netlink_unicast+0x780/0x920 [ 766.782112][T22382] netlink_sendmsg+0x813/0xb40 [ 766.782149][T22382] ? __pfx_netlink_sendmsg+0x10/0x10 [ 766.782181][T22382] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 766.782218][T22382] ? aa_sock_msg_perm+0x122/0x200 [ 766.782248][T22382] ? __pfx_netlink_sendmsg+0x10/0x10 [ 766.782275][T22382] sock_sendmsg_nosec+0x112/0x150 [ 766.782301][T22382] ____sys_sendmsg+0x55c/0x870 [ 766.782337][T22382] ? __pfx_____sys_sendmsg+0x10/0x10 [ 766.782375][T22382] ? import_iovec+0x73/0xa0 [ 766.782410][T22382] ___sys_sendmsg+0x2a5/0x360 [ 766.782438][T22382] ? __lock_acquire+0x6b5/0x2d10 [ 766.782464][T22382] ? __pfx____sys_sendmsg+0x10/0x10 [ 766.782529][T22382] ? __fget_files+0x2a/0x420 [ 766.782552][T22382] ? __fget_files+0x3a6/0x420 [ 766.782593][T22382] __x64_sys_sendmsg+0x1c3/0x2a0 [ 766.782626][T22382] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 766.782666][T22382] ? __pfx_ksys_write+0x10/0x10 [ 766.782703][T22382] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.782726][T22382] do_syscall_64+0x15f/0xf80 [ 766.782745][T22382] ? trace_irq_disable+0x3b/0x140 [ 766.782774][T22382] ? clear_bhb_loop+0x40/0x90 [ 766.782800][T22382] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.782821][T22382] RIP: 0033:0x7f0a423ecdd9 [ 766.782841][T22382] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 766.782859][T22382] RSP: 002b:00007f0a4063e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 766.782882][T22382] RAX: ffffffffffffffda RBX: 00007f0a42665fa0 RCX: 00007f0a423ecdd9 [ 766.782898][T22382] RDX: 0000000000000818 RSI: 0000200000000940 RDI: 0000000000000003 [ 766.782912][T22382] RBP: 00007f0a4063e090 R08: 0000000000000000 R09: 0000000000000000 [ 766.782926][T22382] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 766.782939][T22382] R13: 00007f0a42666038 R14: 00007f0a42665fa0 R15: 00007ffea6256be8 [ 766.782970][T22382] [ 767.193557][T22396] netlink: 'syz.6.4644': attribute type 4 has an invalid length. [ 767.374145][T22406] netlink: 204 bytes leftover after parsing attributes in process `syz.6.4648'. [ 767.374173][T22406] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4648'. [ 767.585069][T22421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4652'. [ 767.865351][T22439] binder: BINDER_SET_CONTEXT_MGR already set [ 767.865369][T22439] binder: 22437:22439 ioctl 4018620d 200000004a80 returned -16 [ 768.369513][ T37] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 768.450176][T22468] netlink: 200 bytes leftover after parsing attributes in process `syz.7.4668'. [ 768.523700][ T37] usb 7-1: Using ep0 maxpacket: 8 [ 768.527986][T22470] netlink: 'syz.7.4672': attribute type 4 has an invalid length. [ 768.546355][ T37] usb 7-1: unable to get BOS descriptor or descriptor too short [ 768.550874][ T37] usb 7-1: config 0 has no interfaces? [ 768.561539][ T37] usb 7-1: New USB device found, idVendor=045e, idProduct=0455, bcdDevice=6f.bb [ 768.561573][ T37] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 768.561594][ T37] usb 7-1: Product: syz [ 768.561609][ T37] usb 7-1: Manufacturer: syz [ 768.561624][ T37] usb 7-1: SerialNumber: syz [ 768.594296][ T37] usb 7-1: config 0 descriptor?? [ 768.677892][T22476] binder: BINDER_SET_CONTEXT_MGR already set [ 768.677907][T22476] binder: 22475:22476 ioctl 4018620d 200000004a80 returned -16 [ 768.816369][ T37] usb 7-1: USB disconnect, device number 59 [ 769.475323][T22532] netlink: 204 bytes leftover after parsing attributes in process `syz.6.4688'. [ 769.475353][T22532] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4688'. [ 770.082325][T22565] netlink: 37 bytes leftover after parsing attributes in process `syz.6.4698'. [ 770.867420][T22607] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4712'. [ 771.260369][ T1245] usb 7-1: new high-speed USB device number 60 using dummy_hcd [ 771.352332][T22647] netlink: 'syz.1.4725': attribute type 2 has an invalid length. [ 771.352349][T22647] netlink: 'syz.1.4725': attribute type 9 has an invalid length. [ 771.419662][ T1245] usb 7-1: Using ep0 maxpacket: 32 [ 771.422556][ T1245] usb 7-1: config 1 has an invalid interface number: 33 but max is 2 [ 771.422588][ T1245] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 771.422610][ T1245] usb 7-1: config 1 has 4 interfaces, different from the descriptor's value: 3 [ 771.422634][ T1245] usb 7-1: config 1 has no interface number 3 [ 771.422715][ T1245] usb 7-1: config 1 interface 1 altsetting 1 has an invalid endpoint descriptor of length 4, skipping [ 771.422740][ T1245] usb 7-1: config 1 interface 1 has no altsetting 0 [ 771.425254][ T1245] usb 7-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 771.425282][ T1245] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.425294][ T1245] usb 7-1: Product: syz [ 771.425303][ T1245] usb 7-1: Manufacturer: syz [ 771.425312][ T1245] usb 7-1: SerialNumber: syz [ 771.569648][ T9] usb 9-1: new full-speed USB device number 27 using dummy_hcd [ 771.726045][ T9] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 771.726069][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 771.728507][ T9] usb 9-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 771.728531][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.728544][ T9] usb 9-1: Product: syz [ 771.728553][ T9] usb 9-1: Manufacturer: syz [ 771.728562][ T9] usb 9-1: SerialNumber: syz [ 771.802670][ T1245] snd-ua101 7-1:1.1: invalid num_altsetting [ 771.802685][ T1245] snd-ua101 7-1:1.0: invalid num_altsetting [ 771.802705][ T1245] usb 7-1: selecting invalid altsetting 0 [ 771.805543][ T9] usb 9-1: config 0 descriptor?? [ 771.809706][ T823] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 771.850371][ T9] streamzap 9-1:0.0: streamzap_probe: endpoint attributes don't match xfer 0200 [ 771.873343][ T1245] usb 7-1: selecting invalid altsetting 0 [ 771.873381][ T1245] usbtest 7-1:1.1: probe with driver usbtest failed with error -22 [ 771.877593][ T1245] usb 7-1: selecting invalid altsetting 0 [ 771.877636][ T1245] snd-usb-audio 7-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 771.878056][ T1245] usb 7-1: selecting invalid altsetting 0 [ 771.878087][ T1245] snd-ua101 7-1:1.1: probe with driver snd-ua101 failed with error -22 [ 771.937620][ T1245] usb 7-1: USB disconnect, device number 60 [ 771.965318][ T823] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 771.965355][ T823] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 771.965378][ T823] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 771.965433][ T823] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 771.965459][ T823] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 771.997284][ T823] usb 2-1: config 0 descriptor?? [ 772.028438][T22682] binder: BINDER_SET_CONTEXT_MGR already set [ 772.028449][T22682] binder: 22637:22682 ioctl 4018620d 200000000100 returned -16 [ 772.045521][T22638] binder_alloc: binder_alloc_mmap_handler: 22637 200000ffd000-200001000000 already mapped failed -16 [ 772.045864][T22682] binder: BINDER_SET_CONTEXT_MGR already set [ 772.045871][T22682] binder: 22637:22682 ioctl 4018620d 200000004a80 returned -16 [ 772.147925][ T5621] usb 9-1: USB disconnect, device number 27 [ 772.161580][T22687] netlink: 'syz.7.4729': attribute type 4 has an invalid length. [ 772.161601][T22687] __nla_validate_parse: 3 callbacks suppressed [ 772.161612][T22687] netlink: 152 bytes leftover after parsing attributes in process `syz.7.4729'. [ 772.208705][T22687] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 772.255217][ T823] usbhid 2-1:0.0: can't add hid device: -71 [ 772.255340][ T823] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 772.336631][ T823] usb 2-1: USB disconnect, device number 81 [ 772.575844][T22716] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4735'. [ 773.931829][T22793] netlink: 'syz.7.4760': attribute type 29 has an invalid length. [ 773.935491][T22793] netlink: 'syz.7.4760': attribute type 29 has an invalid length. [ 774.007309][T22793] netlink: 500 bytes leftover after parsing attributes in process `syz.7.4760'. [ 774.645732][T22839] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 774.646328][T22839] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 774.878023][T22856] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4780'. [ 775.143734][T22872] binder: 22871:22872 ioctl 4018620d 0 returned -22 [ 775.470327][T22893] netlink: 200 bytes leftover after parsing attributes in process `syz.1.4791'. [ 775.767339][T22918] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4800'. [ 775.820547][T22918] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4800'. [ 776.558382][ T1245] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 776.591702][T22956] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4812'. [ 776.712479][ T1245] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 776.712502][ T1245] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 776.712515][ T1245] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 776.712540][ T1245] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 776.712555][ T1245] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 776.770949][ T1245] usb 2-1: config 0 descriptor?? [ 776.981291][T22973] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4817'. [ 777.268376][ T1245] plantronics 0003:047F:FFFF.002B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 777.479093][ T9] usb 2-1: USB disconnect, device number 82 [ 777.515756][T22998] fido_id[22998]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 778.012515][T23045] pimreg: entered allmulticast mode [ 778.034044][T23055] 9pnet_virtio: no channels available for device ./file0 [ 778.034578][T23054] batadv0: left promiscuous mode [ 778.034601][T23054] batadv0: left allmulticast mode [ 778.394159][T23073] netlink: 200 bytes leftover after parsing attributes in process `syz.6.4843'. [ 778.483115][T23077] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4845'. [ 778.599078][T23084] tmpfs: Unknown parameter 'no' [ 778.879893][ T823] usb 7-1: new high-speed USB device number 62 using dummy_hcd [ 779.050212][ T823] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 779.050238][ T823] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 779.050252][ T823] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 779.050277][ T823] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 779.050292][ T823] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 779.054389][ T823] usb 7-1: config 0 descriptor?? [ 779.239821][ T9] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 779.401539][ T9] usb 9-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 779.401573][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 779.401595][ T9] usb 9-1: Product: syz [ 779.401610][ T9] usb 9-1: Manufacturer: syz [ 779.401627][ T9] usb 9-1: SerialNumber: syz [ 779.412202][ T9] usb 9-1: config 0 descriptor?? [ 779.457834][ T9] ch341 9-1:0.0: ch341-uart converter detected [ 779.484830][ T823] plantronics 0003:047F:FFFF.002C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 779.544546][T23114] syzkaller1: entered promiscuous mode [ 779.544574][T23114] syzkaller1: entered allmulticast mode [ 779.655091][ T9] usb 9-1: failed to receive control message: -121 [ 779.655129][ T9] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -121 [ 779.728742][ T9] usb 7-1: USB disconnect, device number 62 [ 779.894876][ T823] usb 9-1: USB disconnect, device number 28 [ 779.902053][ T823] ch341 9-1:0.0: device disconnected [ 780.097991][T23149] binder: 23148:23149 ioctl c0306201 2000000001c0 returned -14 [ 780.579131][T23164] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4857'. [ 780.661671][T23173] binder: BINDER_SET_CONTEXT_MGR already set [ 780.661684][T23173] binder: 23172:23173 ioctl 4018620d 200000004a80 returned -16 [ 780.834949][T23181] netlink: 'syz.7.4863': attribute type 29 has an invalid length. [ 780.851263][T23181] netlink: 'syz.7.4863': attribute type 29 has an invalid length. [ 780.852417][T23181] netlink: 500 bytes leftover after parsing attributes in process `syz.7.4863'. [ 781.497680][T23228] loop8: detected capacity change from 0 to 7 [ 781.499289][T14113] lo_rw_aio(loop8) starting read with raw_refcnt=0x1, refcnt=2 [ 781.499553][T23228] Dev loop8: unable to read RDB block 7 [ 781.499580][T23228] loop8: AHDI p1 p2 [ 781.499605][T23228] loop8: partition table partially beyond EOD, truncated [ 781.507957][T23228] loop8: p1 start 1702000233 is beyond EOD, truncated [ 781.563625][T10137] __loop_clr_fd(loop8) clearing lo_backing_file with raw_refcnt=0x0, refcnt=1 [ 781.709924][T23240] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4880'. [ 781.710200][T23240] netlink: 200 bytes leftover after parsing attributes in process `syz.6.4880'. [ 782.258030][T23272] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4891'. [ 782.362692][T23279] tmpfs: Bad value for 'mpol' [ 782.720536][ T5615] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 782.890188][ T5615] usb 2-1: Using ep0 maxpacket: 32 [ 782.913427][ T5615] usb 2-1: config 4 has an invalid interface number: 228 but max is 0 [ 782.913455][ T5615] usb 2-1: config 4 has no interface number 0 [ 782.913494][ T5615] usb 2-1: config 4 interface 228 altsetting 68 endpoint 0x7 has invalid wMaxPacketSize 0 [ 782.913519][ T5615] usb 2-1: config 4 interface 228 altsetting 68 bulk endpoint 0x7 has invalid maxpacket 0 [ 782.913540][ T5615] usb 2-1: config 4 interface 228 has no altsetting 0 [ 782.928530][ T5615] usb 2-1: New USB device found, idVendor=0499, idProduct=a9a2, bcdDevice=c4.e8 [ 782.928562][ T5615] usb 2-1: New USB device strings: Mfr=1, Product=25, SerialNumber=3 [ 782.928584][ T5615] usb 2-1: Product: syz [ 782.928599][ T5615] usb 2-1: Manufacturer: syz [ 782.928615][ T5615] usb 2-1: SerialNumber: syz [ 783.182117][T23319] netlink: 'syz.8.4901': attribute type 6 has an invalid length. [ 783.182197][T23319] netlink: 76 bytes leftover after parsing attributes in process `syz.8.4901'. [ 783.383843][T23323] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4904'. [ 783.637202][T23338] FAULT_INJECTION: forcing a failure. [ 783.637202][T23338] name failslab, interval 1, probability 0, space 0, times 0 [ 783.637240][T23338] CPU: 1 UID: 0 PID: 23338 Comm: syz.8.4907 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 783.637270][T23338] Tainted: [L]=SOFTLOCKUP [ 783.637286][T23338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 783.637298][T23338] Call Trace: [ 783.637306][T23338] [ 783.637315][T23338] dump_stack_lvl+0xe8/0x150 [ 783.637341][T23338] should_fail_ex+0x46b/0x600 [ 783.637369][T23338] should_failslab+0xa8/0x100 [ 783.637397][T23338] kmem_cache_alloc_noprof+0x87/0x680 [ 783.637423][T23338] ? skb_clone+0x212/0x3a0 [ 783.637453][T23338] skb_clone+0x212/0x3a0 [ 783.637485][T23338] __netlink_deliver_tap+0x424/0x8b0 [ 783.637521][T23338] ? netlink_deliver_tap+0x2e/0x1b0 [ 783.637546][T23338] netlink_deliver_tap+0x19c/0x1b0 [ 783.637573][T23338] netlink_unicast+0x754/0x920 [ 783.637606][T23338] netlink_sendmsg+0x813/0xb40 [ 783.637638][T23338] ? __pfx_netlink_sendmsg+0x10/0x10 [ 783.637667][T23338] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 783.637705][T23338] ? aa_sock_msg_perm+0x122/0x200 [ 783.637733][T23338] ? __pfx_netlink_sendmsg+0x10/0x10 [ 783.637759][T23338] sock_sendmsg_nosec+0x112/0x150 [ 783.637782][T23338] ____sys_sendmsg+0x55c/0x870 [ 783.637815][T23338] ? __pfx_____sys_sendmsg+0x10/0x10 [ 783.637847][T23338] ? import_iovec+0x73/0xa0 [ 783.637874][T23338] ___sys_sendmsg+0x2a5/0x360 [ 783.637898][T23338] ? __lock_acquire+0x6b5/0x2d10 [ 783.637920][T23338] ? __pfx____sys_sendmsg+0x10/0x10 [ 783.637969][T23338] ? __fget_files+0x2a/0x420 [ 783.637988][T23338] ? __fget_files+0x3a6/0x420 [ 783.638015][T23338] __x64_sys_sendmsg+0x1c3/0x2a0 [ 783.638040][T23338] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 783.638071][T23338] ? __pfx_ksys_write+0x10/0x10 [ 783.638100][T23338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.638118][T23338] do_syscall_64+0x15f/0xf80 [ 783.638134][T23338] ? trace_irq_disable+0x3b/0x140 [ 783.638158][T23338] ? clear_bhb_loop+0x40/0x90 [ 783.638178][T23338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.638195][T23338] RIP: 0033:0x7f0a423ecdd9 [ 783.638212][T23338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 783.638226][T23338] RSP: 002b:00007f0a4063e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 783.638244][T23338] RAX: ffffffffffffffda RBX: 00007f0a42665fa0 RCX: 00007f0a423ecdd9 [ 783.638257][T23338] RDX: 0000000000000004 RSI: 0000200000000040 RDI: 0000000000000004 [ 783.638268][T23338] RBP: 00007f0a4063e090 R08: 0000000000000000 R09: 0000000000000000 [ 783.638286][T23338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 783.638296][T23338] R13: 00007f0a42666038 R14: 00007f0a42665fa0 R15: 00007ffea6256be8 [ 783.638321][T23338] [ 783.643319][T23338] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4907'. [ 783.643973][T23338] netlink: 200 bytes leftover after parsing attributes in process `syz.8.4907'. [ 784.146382][ T5615] usb 2-1: USB disconnect, device number 83 [ 784.224138][T12467] usb 7-1: new high-speed USB device number 63 using dummy_hcd [ 784.227133][T10256] udevd[10256]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:4.228/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 784.355245][T23376] netlink: 'syz.1.4915': attribute type 4 has an invalid length. [ 784.390093][T12467] usb 7-1: Using ep0 maxpacket: 8 [ 784.397776][T12467] usb 7-1: config 17 has no interfaces? [ 784.407556][T12467] usb 7-1: New USB device found, idVendor=1430, idProduct=bdd1, bcdDevice=73.ce [ 784.407589][T12467] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 784.407610][T12467] usb 7-1: Product: syz [ 784.407626][T12467] usb 7-1: Manufacturer: syz [ 784.407642][T12467] usb 7-1: SerialNumber: syz [ 784.665914][T12467] usb 7-1: USB disconnect, device number 63 [ 784.940338][ T9] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 785.094001][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 785.098914][ T9] usb 2-1: config index 0 descriptor too short (expected 6427, got 27) [ 785.098946][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.110812][ T9] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 785.110844][ T9] usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 785.110866][ T9] usb 2-1: Product: syz [ 785.160725][ T9] usb 2-1: config 0 descriptor?? [ 785.293606][ T38] audit: type=1326 audit(1779136427.901:445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23431 comm="syz.7.4930" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1b4728cdd9 code=0x0 [ 785.359323][T23441] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4933'. [ 785.359460][T23441] FAULT_INJECTION: forcing a failure. [ 785.359460][T23441] name failslab, interval 1, probability 0, space 0, times 0 [ 785.359490][T23441] CPU: 0 UID: 0 PID: 23441 Comm: syz.6.4933 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 785.359524][T23441] Tainted: [L]=SOFTLOCKUP [ 785.359532][T23441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 785.359544][T23441] Call Trace: [ 785.359553][T23441] [ 785.359562][T23441] dump_stack_lvl+0xe8/0x150 [ 785.359590][T23441] should_fail_ex+0x46b/0x600 [ 785.359621][T23441] should_failslab+0xa8/0x100 [ 785.359652][T23441] kmem_cache_alloc_noprof+0x87/0x680 [ 785.359680][T23441] ? __nf_conntrack_alloc+0x81/0x400 [ 785.359710][T23441] __nf_conntrack_alloc+0x81/0x400 [ 785.359737][T23441] ctnetlink_new_conntrack+0x5ca/0x22b0 [ 785.359770][T23441] ? __pfx_ctnetlink_new_conntrack+0x10/0x10 [ 785.359797][T23441] ? __pfx___nla_validate_parse+0x10/0x10 [ 785.359851][T23441] ? lockdep_hardirqs_on+0x7a/0x110 [ 785.359892][T23441] nfnetlink_rcv_msg+0xbc9/0x1260 [ 785.359918][T23441] ? nfnetlink_rcv_msg+0x230/0x1260 [ 785.359980][T23441] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 785.360037][T23441] ? __lock_acquire+0x6b5/0x2d10 [ 785.360061][T23441] ? __lock_acquire+0x6b5/0x2d10 [ 785.360080][T23441] ? sock_sendmsg_nosec+0x112/0x150 [ 785.360110][T23441] netlink_rcv_skb+0x232/0x4b0 [ 785.360139][T23441] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 785.360168][T23441] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 785.360207][T23441] ? bpf_lsm_capable+0x9/0x20 [ 785.360230][T23441] ? security_capable+0x7e/0x2c0 [ 785.360265][T23441] nfnetlink_rcv+0x2c0/0x27b0 [ 785.360294][T23441] ? sock_sendmsg_nosec+0x112/0x150 [ 785.360318][T23441] ? __pfx_snprintf+0x10/0x10 [ 785.360347][T23441] ? unwind_get_return_address+0x4d/0x90 [ 785.360374][T23441] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 785.360412][T23441] ? trim_netdev_trace+0x7ac/0x840 [ 785.360438][T23441] ? __pfx_trim_netdev_trace+0x10/0x10 [ 785.360458][T23441] ? stack_trace_save+0xa9/0x100 [ 785.360487][T23441] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 785.360520][T23441] ? save_netdev_trace_buffer+0x18f/0x5f0 [ 785.360545][T23441] ? save_netdev_trace_buffer+0x4cf/0x5f0 [ 785.360572][T23441] ? __pfx_save_netdev_trace_buffer+0x10/0x10 [ 785.360593][T23441] ? ref_tracker_free+0x673/0x820 [ 785.360618][T23441] ? __netlink_deliver_tap+0x636/0x8b0 [ 785.360645][T23441] ? netlink_deliver_tap+0x19c/0x1b0 [ 785.360671][T23441] ? netlink_unicast+0x754/0x920 [ 785.360694][T23441] ? netlink_sendmsg+0x813/0xb40 [ 785.360721][T23441] ? sock_sendmsg_nosec+0x112/0x150 [ 785.360742][T23441] ? ____sys_sendmsg+0x55c/0x870 [ 785.360769][T23441] ? ___sys_sendmsg+0x2a5/0x360 [ 785.360796][T23441] ? __x64_sys_sendmsg+0x1c3/0x2a0 [ 785.360824][T23441] ? do_syscall_64+0x15f/0xf80 [ 785.360842][T23441] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.360878][T23441] ? skb_clone+0x246/0x3a0 [ 785.360909][T23441] ? __netlink_deliver_tap+0x866/0x8b0 [ 785.360935][T23441] ? netlink_deliver_tap+0x2e/0x1b0 [ 785.360967][T23441] ? netlink_deliver_tap+0x2e/0x1b0 [ 785.360991][T23441] ? netlink_deliver_tap+0x2e/0x1b0 [ 785.361022][T23441] netlink_unicast+0x780/0x920 [ 785.361057][T23441] netlink_sendmsg+0x813/0xb40 [ 785.361093][T23441] ? __pfx_netlink_sendmsg+0x10/0x10 [ 785.361121][T23441] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 785.361158][T23441] ? aa_sock_msg_perm+0x122/0x200 [ 785.361189][T23441] ? __pfx_netlink_sendmsg+0x10/0x10 [ 785.361215][T23441] sock_sendmsg_nosec+0x112/0x150 [ 785.361242][T23441] ____sys_sendmsg+0x55c/0x870 [ 785.361274][T23441] ? __pfx_____sys_sendmsg+0x10/0x10 [ 785.361311][T23441] ? import_iovec+0x73/0xa0 [ 785.361345][T23441] ___sys_sendmsg+0x2a5/0x360 [ 785.361373][T23441] ? __lock_acquire+0x6b5/0x2d10 [ 785.361398][T23441] ? __pfx____sys_sendmsg+0x10/0x10 [ 785.361460][T23441] ? __fget_files+0x2a/0x420 [ 785.361484][T23441] ? __fget_files+0x3a6/0x420 [ 785.361524][T23441] __x64_sys_sendmsg+0x1c3/0x2a0 [ 785.361556][T23441] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 785.361590][T23441] ? __pfx_ksys_write+0x10/0x10 [ 785.361623][T23441] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.361644][T23441] do_syscall_64+0x15f/0xf80 [ 785.361662][T23441] ? trace_irq_disable+0x3b/0x140 [ 785.361689][T23441] ? clear_bhb_loop+0x40/0x90 [ 785.361713][T23441] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.361731][T23441] RIP: 0033:0x7f05a971cdd9 [ 785.361750][T23441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 785.361767][T23441] RSP: 002b:00007f05a7976028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 785.361790][T23441] RAX: ffffffffffffffda RBX: 00007f05a9995fa0 RCX: 00007f05a971cdd9 [ 785.361805][T23441] RDX: 0000000000000004 RSI: 0000200000000040 RDI: 0000000000000004 [ 785.361818][T23441] RBP: 00007f05a7976090 R08: 0000000000000000 R09: 0000000000000000 [ 785.361832][T23441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 785.361845][T23441] R13: 00007f05a9996038 R14: 00007f05a9995fa0 R15: 00007ffd561f78a8 [ 785.361876][T23441] [ 785.379489][T23401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 785.401216][T23401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 785.416206][ T5615] usb 2-1: USB disconnect, device number 84 [ 785.837616][T23466] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4937'. [ 786.000799][ T5615] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 786.106039][T23481] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4943'. [ 786.130154][ T5615] usb 9-1: device descriptor read/64, error -71 [ 786.253978][T23485] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4945'. [ 786.390058][ T5615] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 786.531452][ T5615] usb 9-1: device descriptor read/64, error -71 [ 786.553527][T23501] syzkaller1: entered promiscuous mode [ 786.553544][T23501] syzkaller1: entered allmulticast mode [ 786.642255][ T5615] usb usb9-port1: attempt power cycle [ 787.030014][ T5615] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 787.057629][ T5615] usb 9-1: device descriptor read/8, error -71 [ 787.182650][ T1914] Bluetooth: hci7: Frame reassembly failed (-84) [ 787.319914][ T5615] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 787.341071][ T5615] usb 9-1: device descriptor read/8, error -71 [ 787.450238][ T5615] usb usb9-port1: unable to enumerate USB device [ 788.878282][T23530] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4955'. [ 788.878394][T23530] netlink: 200 bytes leftover after parsing attributes in process `syz.1.4955'. [ 789.108649][T23541] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4957'. [ 789.108792][T23541] netlink: 200 bytes leftover after parsing attributes in process `syz.7.4957'. [ 789.140269][T12467] usb 9-1: new high-speed USB device number 33 using dummy_hcd [ 789.205684][ T60] Bluetooth: hci7: Entering manufacturer mode failed (-110) [ 789.329094][T12467] usb 9-1: Using ep0 maxpacket: 8 [ 789.335397][T12467] usb 9-1: config 179 has an invalid interface number: 65 but max is 0 [ 789.335428][T12467] usb 9-1: config 179 has no interface number 0 [ 789.335474][T12467] usb 9-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 789.335502][T12467] usb 9-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 789.335531][T12467] usb 9-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 789.335555][T12467] usb 9-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 789.335581][T12467] usb 9-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 789.335630][T12467] usb 9-1: config 179 interface 65 has no altsetting 0 [ 789.335666][T12467] usb 9-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 789.335689][T12467] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 789.570315][T12467] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:179.65/input/input53 [ 789.689145][T23523] misc userio: Invalid payload size [ 789.696446][ T4962] input input53: unable to receive magic message: -110 [ 789.838126][T10256] input input53: unable to receive magic message: -32 [ 789.967030][T23523] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 789.967673][T23523] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 790.070209][ T4962] input input53: unable to receive magic message: -32 [ 790.283617][ T5621] usb 9-1: USB disconnect, device number 33 [ 790.283766][ C0] xpad 9-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 790.678328][T23610] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4971'. [ 790.777937][T23608] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4970'. [ 790.989977][ T9] usb 7-1: new high-speed USB device number 64 using dummy_hcd [ 791.112307][T23640] FAULT_INJECTION: forcing a failure. [ 791.112307][T23640] name failslab, interval 1, probability 0, space 0, times 0 [ 791.112343][T23640] CPU: 0 UID: 0 PID: 23640 Comm: syz.8.4980 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 791.112372][T23640] Tainted: [L]=SOFTLOCKUP [ 791.112380][T23640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 791.112392][T23640] Call Trace: [ 791.112400][T23640] [ 791.112408][T23640] dump_stack_lvl+0xe8/0x150 [ 791.112435][T23640] should_fail_ex+0x46b/0x600 [ 791.112464][T23640] should_failslab+0xa8/0x100 [ 791.112496][T23640] kmem_cache_alloc_noprof+0x87/0x680 [ 791.112523][T23640] ? skb_clone+0x212/0x3a0 [ 791.112559][T23640] skb_clone+0x212/0x3a0 [ 791.112592][T23640] __netlink_deliver_tap+0x424/0x8b0 [ 791.112630][T23640] ? netlink_deliver_tap+0x2e/0x1b0 [ 791.112659][T23640] netlink_deliver_tap+0x19c/0x1b0 [ 791.112687][T23640] netlink_unicast+0x754/0x920 [ 791.112723][T23640] netlink_sendmsg+0x813/0xb40 [ 791.112759][T23640] ? __pfx_netlink_sendmsg+0x10/0x10 [ 791.112790][T23640] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 791.112826][T23640] ? aa_sock_msg_perm+0x122/0x200 [ 791.112856][T23640] ? __pfx_netlink_sendmsg+0x10/0x10 [ 791.112883][T23640] sock_sendmsg_nosec+0x112/0x150 [ 791.112909][T23640] ____sys_sendmsg+0x55c/0x870 [ 791.112949][T23640] ? __pfx_____sys_sendmsg+0x10/0x10 [ 791.112999][T23640] ? import_iovec+0x73/0xa0 [ 791.113037][T23640] ___sys_sendmsg+0x2a5/0x360 [ 791.113065][T23640] ? __lock_acquire+0x6b5/0x2d10 [ 791.113091][T23640] ? __pfx____sys_sendmsg+0x10/0x10 [ 791.113153][T23640] ? __fget_files+0x2a/0x420 [ 791.113177][T23640] ? __fget_files+0x3a6/0x420 [ 791.113210][T23640] __x64_sys_sendmsg+0x1c3/0x2a0 [ 791.113243][T23640] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 791.113281][T23640] ? __pfx_ksys_write+0x10/0x10 [ 791.113317][T23640] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.113340][T23640] do_syscall_64+0x15f/0xf80 [ 791.113359][T23640] ? trace_irq_disable+0x3b/0x140 [ 791.113388][T23640] ? clear_bhb_loop+0x40/0x90 [ 791.113413][T23640] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.113434][T23640] RIP: 0033:0x7f0a423ecdd9 [ 791.113454][T23640] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 791.113472][T23640] RSP: 002b:00007f0a4063e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 791.113494][T23640] RAX: ffffffffffffffda RBX: 00007f0a42665fa0 RCX: 00007f0a423ecdd9 [ 791.113510][T23640] RDX: 0000000000000818 RSI: 0000200000000940 RDI: 0000000000000003 [ 791.113524][T23640] RBP: 00007f0a4063e090 R08: 0000000000000000 R09: 0000000000000000 [ 791.113538][T23640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 791.113551][T23640] R13: 00007f0a42666038 R14: 00007f0a42665fa0 R15: 00007ffea6256be8 [ 791.113584][T23640] [ 791.239986][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 791.240021][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 791.240046][ T9] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 791.240089][ T9] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 791.240114][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.478291][ T9] usb 7-1: config 0 descriptor?? [ 791.762400][T23660] netlink: 'syz.7.4986': attribute type 29 has an invalid length. [ 791.764668][T23660] netlink: 'syz.7.4986': attribute type 29 has an invalid length. [ 791.766291][T23660] netlink: 500 bytes leftover after parsing attributes in process `syz.7.4986'. [ 791.852238][ T39] INFO: task syz.4.3641:16715 blocked for more than 143 seconds. [ 791.852267][ T39] Tainted: G L syzkaller #0 [ 791.852279][ T39] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 791.852289][ T39] task:syz.4.3641 state:D stack:26328 pid:16715 tgid:16714 ppid:13676 task_flags:0x400140 flags:0x00080006 [ 791.852416][ T39] Call Trace: [ 791.852424][ T39] [ 791.852438][ T39] __schedule+0x16f9/0x5500 [ 791.852549][ T39] ? trace_irq_disable+0x3b/0x140 [ 791.852583][ T39] ? __pfx___schedule+0x10/0x10 [ 791.852609][ T39] ? rt_mutex_slowlock_block+0x2e9/0x680 [ 791.852701][ T39] rt_mutex_schedule+0x76/0xf0 [ 791.852728][ T39] rt_mutex_slowlock_block+0x508/0x680 [ 791.852766][ T39] ? rt_mutex_slowlock_block+0x2e9/0x680 [ 791.852793][ T39] rt_mutex_slowlock+0x2dc/0x780 [ 791.852872][ T39] ? rt_mutex_slowlock+0x1fd/0x780 [ 791.852899][ T39] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 791.852933][ T39] ? nfsd_nl_listener_set_doit+0x13e/0x1630 [ 791.853271][ T39] ? nfsd_nl_listener_set_doit+0x13e/0x1630 [ 791.853316][ T39] ? nfsd_nl_listener_set_doit+0x13e/0x1630 [ 791.853343][ T39] mutex_lock_nested+0x168/0x1d0 [ 791.853596][ T39] nfsd_nl_[ 791.853596][ T39] nfsd_nl_listener_set_doit+0x13e/0x1630 [ 791.853628][ T39] ? __pfx___nla_validate_parse+0x10/0x10 [ 791.853678][ T39] ? __pfx_nfsd_nl_listener_set_doit+0x10/0x10 [ 791.853921][ T39] ? __nla_parse+0x40/0x60 [ 791.853953][ T39] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 791.853976][ T39] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 791.854004][ T39] genl_family_rcv_msg_doit+0x22a/0x330 [ 791.854399][ T39] ? __asan_memcpy+0x40/0x70 [ 791.854429][ T39] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 791.854464][ T39] ? bpf_lsm_capable+0x9/0x20 [ 791.854486][ T39] ? security_capable+0x7e/0x2c0 [ 791.855063][ T39] genl_rcv_msg+0x61c/0x7a0 [ 791.855096][ T39] ? __pfx_genl_rcv_msg+0x10/0x10 [ 791.855117][ T39] ? ref_tracker_free+0x673/0x820 [ 791.855144][ T39] ? __pfx_nfsd_nl_listener_set_doit+0x10/0x10 [ 791.855227][ T39] ? ____sys_sendmsg+0x55c/0x870 [ 791.855257][ T39] ? ___sys_sendmsg+0x2a5/0x360 [ 791.855301][ T39] netlink_rcv_skb+0x232/0x4b0 [ 791.855711][ T39] ? __pfx_genl_rcv_msg+0x10/0x10 [ 791.855738][ T39] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 791.855785][ T39] genl_rcv+0x28/0x40 [ 791.855805][ T39] netlink_unicast+0x780/0x920 [ 791.856219][ T39] netlink_sendmsg+0x813/0xb40 [ 791.856258][ T39] ? __pfx_netlink_sendmsg+0x10/0x10 [ 791.856289][ T39] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 791.856642][ T39] ? aa_sock_msg_perm+0x122/0x200 [ 791.856890][ T39] ? __pfx_netlink_sendmsg+0x10/0x10 [ 791.856921][ T39] sock_sendmsg_nosec+0x112/0x150 [ 791.856948][ T39] ____sys_sendmsg+0x55c/0x870 [ 791.856982][ T39] ? __pfx_____sys_sendmsg+0x10/0x10 [ 791.857232][ T39] ? import_iovec+0x73/0xa0 [ 791.857270][ T39] ___sys_sendmsg+0x2a5/0x360 [ 791.857304][ T39] ? __lock_acquire+0x6b5/0x2d10 [ 791.857689][ T39] ? __pfx____sys_sendmsg+0x10/0x10 [ 791.857725][ T39] ? futex_wait+0x2a2/0x390 [ 791.858228][ T39] ? __fget_files+0x2a/0x420 [ 791.858254][ T39] ? __fget_files+0x3a6/0x420 [ 791.858287][ T39] __x64_sys_sendmsg+0x1c3/0x2a0 [ 791.872080][ T39] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 791.872134][ T39] ? rcu_is_watching+0x15/0xb0 [ 791.872169][ T39] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.887813][ T39] do_syscall_64+0x15f/0xf80 [ 791.887849][ T39] ? trace_irq_disable+0x3b/0x140 [ 791.887879][ T39] ? clear_bhb_loop+0x40/0x90 [ 791.887904][ T39] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.904973][ T39] RIP: 0033:0x7f8e1173cdd9 [ 791.949356][ T39] RSP: 002b:00007f8e0f996028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 791.949386][ T39] RAX: ffffffffffffffda RBX: 00007f8e119b5fa0 RCX: 00007f8e1173cdd9 [ 791.949403][ T39] RDX: 0000000004040014 RSI: 0000200000000000 RDI: 0000000000000006 [ 791.949417][ T39] RBP: 00007f8e117d2d69 R08: 0000000000000000 R09: 0000000000000000 [ 791.949429][ T39] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 791.949443][ T39] R13: 00007f8e119b6038 R14: 00007f8e119b5fa0 R15: 00007ffdcec73258 [ 791.949475][ T39] [ 791.955724][ T39] [ 791.955724][ T39] Showing all locks held in the system: [ 791.955741][ T39] 5 locks held by kworker/0:0/9: [ 791.955754][ T39] #0: ffff888021ec2538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 791.955878][ T39] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 791.955931][ T39] #2: ffff88802a384210 (&dev->mutex){....}-{4:4}, at: hub_event+0x17c/0x4f60 [ 791.955980][ T39] #3: ffff888037b32210 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 791.956033][ T39] #4: ffff8880263131d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 791.956087][ T39] 4 locks held by pr/legacy/17: [ 791.956099][ T39] #0: ffffffff8e1ba4e0 (console_lock){+.+.}-{0:0}, at: legacy_kthread_func+0x1a3/0x250 [ 791.956168][ T39] #1: ffffffff8e0a1dd8 (console_srcu){....}-{0:0}, at: console_flush_one_record+0xfa/0xb90 [ 791.956222][ T39] #2: ffffffff99dc6bf8 (&port_lock_key){+.+.}-{3:3}, at: serial8250_console_write+0x179/0x1b90 [ 791.956279][ T39] #3: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 791.956331][ T39] 1 lock held by khungtaskd/39: [ 791.956344][ T39] #0: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 791.956404][ T39] 6 locks held by kworker/u8:12/1914: [ 791.956416][ T39] #0: ffff8880323bd138 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 791.958777][ T39] #1: ffffc90006e0fc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 791.958832][ T39] #2: ffffffff8e05f380 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 791.958885][ T39] #3: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 791.958949][ T39] #4: ffff8880b873b820 (&rq->__lock){-...}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 [ 791.959055][ T39] #5: ffff8880b87244c8 (psi_seq){-...}-{0:0}, at: psi_task_switch+0x53/0x880 [ 791.959183][ T39] 2 locks held by getty/5363: [ 791.959195][ T39] #0: ffff888035b7a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 791.965321][ T39] #1: ffffc90003cbe2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13a0 [ 791.965386][ T39] 7 locks held by kworker/1:5/5621: [ 791.965399][ T39] #0: ffff88813fe0e538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 791.965453][ T39] #1: ffffc90005107c40 ((work_completion)(&(&tbl->gc_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 791.965505][ T39] #2: ffffffff8e05f380 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 791.965557][ T39] #3: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 791.965609][ T39] #4: ffffffff8f6bec38 (&tbl->lock){+...}-{3:3}, at: neigh_periodic_work+0xc64/0xe90 [ 791.965660][ T39] #5: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 791.965718][ T39] #6: ffff888057cbc740 (&dir->lock#2){+.+.}-{3:3}, at: ref_tracker_free+0x13d/0x820 [ 791.965783][ T39] 2 locks held by syz.5.3166/14985: [ 791.965795][ T39] #0: ffffffff8f6024c0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 791.966727][ T39] #1: ffffffff8e4ec158 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x13e/0x1630 [ 791.966788][ T39] 2 locks held by syz.4.3641/16715: [ 791.966813][ T39] #0: ffffffff8f6024c0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 791.966860][ T39] #1: ffffffff8e4ec158 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x13e/0x1630 [ 791.966916][ T39] 2 locks held by syz.2.3913/18436: [ 791.966928][ T39] #0: ffffffff8f6024c0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 791.967067][ T39] #1: ffffffff8e4ec158 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x13e/0x1630 [ 791.967123][ T39] 4 locks held by syz.8.4987/23663: [ 791.967135][ T39] #0: ffff88802a8c03b0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x194/0x9e0 [ 791.967187][ T39] #1: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 791.967374][ T39] #2: ffff88803a80c598 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 791.967429][ T39] #3: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 791.967480][ T39] 2 locks held by syz.1.4989/23667: [ 791.967493][ T39] #0: ffff88805b71ae48 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 [ 791.967548][ T39] #1: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 791.967598][ T39] 1 lock held by syz.7.4988/23668: [ 791.967610][ T39] #0: ffff888028d24e58 (&sighand->siglock){+.+.}-{3:3}, at: copy_process+0x70e/0x4450 [ 791.967748][ T39] [ 791.967754][ T39] ============================================= [ 791.967754][ T39] [ 791.967771][ T39] NMI backtrace for cpu 1 [ 791.967788][ T39] CPU: 1 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 791.967818][ T39] Tainted: [L]=SOFTLOCKUP [ 791.967826][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 791.967839][ T39] Call Trace: [ 791.967848][ T39] [ 791.967857][ T39] dump_stack_lvl+0xe8/0x150 [ 791.967884][ T39] nmi_cpu_backtrace+0x274/0x2d0 [ 791.967911][ T39] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 791.967967][ T39] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 791.967996][ T39] sys_info+0x135/0x170 [ 791.968019][ T39] watchdog+0xfd3/0x1030 [ 791.968083][ T39] ? watchdog+0x1c9/0x1030 [ 791.968115][ T39] kthread+0x388/0x470 [ 791.968137][ T39] ? __pfx_watchdog+0x10/0x10 [ 791.968162][ T39] ? __pfx_kthread+0x10/0x10 [ 791.968184][ T39] ret_from_fork+0x514/0xb70 [ 791.968209][ T39] ? __pfx_ret_from_fork+0x10/0x10 [ 791.968231][ T39] ? __switch_to+0xc79/0x1410 [ 791.968289][ T39] ? __pfx_kthread+0x10/0x10 [ 791.968311][ T39] ret_from_fork_asm+0x1a/0x30 [ 791.968350][ T39] [ 791.968388][ T39] Sending NMI from CPU 1 to CPUs 0: [ 791.968417][ C0] NMI backtrace for cpu 0 [ 791.968433][ C0] CPU: 0 UID: 0 PID: 17 Comm: pr/legacy Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 791.968455][ C0] Tainted: [L]=SOFTLOCKUP [ 791.968462][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 791.968472][ C0] RIP: 0010:io_serial_in+0x77/0xc0 [ 791.968492][ C0] Code: e8 3e fb 7c fc 44 89 f9 d3 e3 49 83 ee 80 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 1f 95 e6 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f e9 8a 4c ef 05 cc 44 89 f9 80 e1 07 [ 791.968507][ C0] RSP: 0018:ffffc900001679d0 EFLAGS: 00000202 [ 791.968522][ C0] RAX: 1ffffffff33b8d00 RBX: 00000000000003fd RCX: 0000000000000000 [ 791.968534][ C0] RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000000 [ 791.968544][ C0] RBP: ffffffff99dc6eb0 R08: 0000000000000000 R09: 0000000000000000 [ 791.968555][ C0] R10: dffffc0000000000 R11: ffffffff85482090 R12: dffffc0000000000 [ 791.968568][ C0] R13: 0000000000000000 R14: ffffffff99dc6c20 R15: 0000000000000000 [ 791.968579][ C0] FS: 0000000000000000(0000) GS:ffff888125cc7000(0000) knlGS:0000000000000000 [ 791.968593][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 791.968605][ C0] CR2: 000055557bf09a38 CR3: 0000000028eb4000 CR4: 00000000003526f0 [ 791.968620][ C0] Call Trace: [ 791.968628][ C0] [ 791.968636][ C0] wait_for_lsr+0x1aa/0x2f0 [ 791.968663][ C0] serial8250_console_write+0x120d/0x1b90 [ 791.968693][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 791.968718][ C0] ? console_flush_one_record+0xfa/0xb90 [ 791.968744][ C0] ? console_flush_one_record+0x48f/0xb90 [ 791.968769][ C0] console_flush_one_record+0x68b/0xb90 [ 791.968795][ C0] ? console_flush_one_record+0xfa/0xb90 [ 791.968819][ C0] ? __pfx_console_flush_one_record+0x10/0x10 [ 791.968844][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 791.968869][ C0] legacy_kthread_func+0x1b6/0x250 [ 791.968893][ C0] ? __pfx_legacy_kthread_func+0x10/0x10 [ 791.968916][ C0] ? __pfx_autoremove_wake_function+0x10/0x10 [ 791.968975][ C0] ? __kthread_parkme+0x7a/0x1f0 [ 791.969001][ C0] kthread+0x388/0x470 [ 791.969017][ C0] ? __pfx_legacy_kthread_func+0x10/0x10 [ 791.969039][ C0] ? __pfx_kthread+0x10/0x10 [ 791.969056][ C0] ret_from_fork+0x514/0xb70 [ 791.969075][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 791.969093][ C0] ? __switch_to+0xc79/0x1410 [ 791.969116][ C0] ? __pfx_kthread+0x10/0x10 [ 791.969133][ C0] ret_from_fork_asm+0x1a/0x30 [ 791.969160][ C0] [ 791.982958][ T39] Kernel panic - not syncing: hung_task: blocked tasks [ 791.982983][ T39] CPU: 1 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 791.983011][ T39] Tainted: [L]=SOFTLOCKUP [ 791.983019][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 791.983030][ T39] Call Trace: [ 791.983039][ T39] [ 791.983048][ T39] vpanic+0x56c/0xa60 [ 791.983081][ T39] ? __pfx___schedule+0x10/0x10 [ 791.983112][ T39] ? __pfx_vpanic+0x10/0x10 [ 791.983148][ T39] panic+0xc5/0xd0 [ 791.983174][ T39] ? __pfx_panic+0x10/0x10 [ 791.983203][ T39] ? preempt_schedule_thunk+0x16/0x40 [ 791.983238][ T39] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 791.983267][ T39] watchdog+0x102c/0x1030 [ 791.983302][ T39] ? watchdog+0x1c9/0x1030 [ 791.983334][ T39] kthread+0x388/0x470 [ 791.983357][ T39] ? __pfx_watchdog+0x10/0x10 [ 791.983381][ T39] ? __pfx_kthread+0x10/0x10 [ 791.983406][ T39] ret_from_fork+0x514/0xb70 [ 791.983433][ T39] ? __pfx_ret_from_fork+0x10/0x10 [ 791.983455][ T39] ? __switch_to+0xc79/0x1410 [ 791.983487][ T39] ? __pfx_kthread+0x10/0x10 [ 791.983510][ T39] ret_from_fork_asm+0x1a/0x30 [ 791.983549][ T39] [ 791.983822][ T39] Kernel Offset: disabled