last executing test programs: 16.39995667s ago: executing program 1 (id=1488): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r4, &(0x7f0000000f80)={'syz0\x00', {0x5, 0xfff7, 0x4, 0x8}, 0x50, [0x800006, 0x9, 0x0, 0x1, 0x8, 0x80ea45, 0x800000e, 0x1, 0x63, 0xffffffff, 0x7f, 0xc, 0x4, 0x9, 0x1, 0x4, 0x8001080, 0x80000002, 0x1, 0x200008, 0x40, 0xa4d, 0x3ff, 0x40000005, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x401, 0x100, 0x9, 0x4, 0x2, 0x0, 0x2, 0x4, 0x1, 0x4, 0xa, 0x6, 0x3, 0x5ff, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x8, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x401, 0x9, 0x9, 0x8, 0x12, 0x7fc, 0xc, 0x0, 0x2729, 0xfd8, 0x3, 0x7, 0x7, 0x0, 0xd8, 0x2, 0xfffffff7, 0x2, 0x3, 0x5, 0x4009, 0x401, 0xb, 0xfffffff8, 0x9, 0xa1, 0x10000, 0xffffffff, 0x5, 0x10004, 0x9e, 0x2, 0xae3, 0x6, 0x7, 0xfffffffd, 0x9, 0xffff3f16, 0xa, 0x0, 0x9, 0xa, 0x5, 0xfffffeff, 0x9, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xfffe7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x8, 0x6, 0x6, 0x200007, 0x8], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x3, 0xc, 0x2, 0x5, 0x7aae, 0x80000000, 0x2, 0x7ffffff7, 0x7ffe, 0x1, 0x1, 0x5, 0x400, 0x80000002, 0x2b0, 0xfffffff4, 0x97f82544, 0x8, 0xfffffffd, 0x0, 0x1, 0x5, 0x4, 0x9, 0xc90, 0xffffff3c, 0xd, 0x13, 0x4, 0x8, 0x1, 0x4, 0x2, 0x1000000c, 0x0, 0x2, 0x3, 0x8007c12, 0x5, 0x1, 0x17, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x1fff80, 0x5, 0x0, 0xc, 0xdd, 0x1, 0x1400, 0xc3, 0x20ffff, 0x79c], [0x9, 0x3a8e, 0xffff9a7f, 0x200, 0x6, 0x2001, 0x6, 0xfffffff3, 0xd077, 0x2, 0xf, 0x21, 0x200, 0xa, 0x6, 0x2, 0x1ff, 0xfe, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x3, 0x5, 0x80000001, 0xffff, 0xd, 0x40, 0xfffffffd, 0x3, 0x10001, 0x8000, 0x10, 0x1002, 0xc, 0x104, 0x8, 0x20000000, 0x8, 0x9, 0xb32a, 0xec000000, 0x8001, 0x1900, 0x4, 0xc, 0x40, 0x7ff, 0x280, 0x5, 0xffffffff, 0x7, 0x6e79, 0x0, 0xc, 0x9371, 0x4f89, 0x7, 0xf, 0x2d1, 0x83, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) openat$cachefiles(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) 13.398786237s ago: executing program 0 (id=1493): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r1, 0x4b52, 0x0) r2 = getpid() setrlimit(0x1, &(0x7f0000000180)={0xe}) sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x8, &(0x7f0000000080)=0x7) socket$netlink(0x10, 0x3, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, 0x0, 0x4a0f0000}, 0x4) 12.091754655s ago: executing program 0 (id=1496): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) connect$inet(r3, 0x0, 0x0) r4 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r4, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x4) sendto$inet6(r4, &(0x7f00000002c0)='\x00', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) getsockopt$bt_hci(r4, 0x84, 0x6d, &(0x7f0000002280)=""/4090, &(0x7f0000000040)=0xffa) 11.824038295s ago: executing program 3 (id=1498): syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xeef, 0x72c4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r1, 0x0, 0x0) close(0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000000080)=0x7) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r6, r6, 0x0, 0x2000007ff) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000100)=0x7f, 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 9.619809877s ago: executing program 0 (id=1500): socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x5c}}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x401, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xee) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f0000000000)) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4000810}, 0x4008804) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_open_dev$dri(&(0x7f0000000140), 0x4, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000001080)={&(0x7f0000000f80)=[0x0, 0x0], &(0x7f0000000fc0)=[0x0], &(0x7f0000000280)=[0x0], &(0x7f0000001040), 0x2, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r8, 0xc05064a7, &(0x7f0000000400)={&(0x7f00000002c0), &(0x7f00000014c0)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000ec0), &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, 0x0, 0x0, r9}) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0000002500090122bd7008f9ffffff0200000008003f800400228008000300470000000800", @ANYRES32, @ANYBLOB], 0x2c}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0x340, 0x340, 0x0, 0x340, 0x270, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [0x0, 0x0, 0xff000000], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x270}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r10, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) syz_open_dev$evdev(0x0, 0x4, 0x40a200) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) socket$netlink(0x10, 0x3, 0x0) socket(0x200000000000011, 0x2, 0x0) 9.517079395s ago: executing program 1 (id=1502): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@rights={{0x10}}, @rights={{0x10}}], 0x20}, 0x80) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) syz_open_dev$radio(&(0x7f0000000040), 0x2, 0x2) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfdef) memfd_secret(0x80000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x4, 0x8, 0x80}, 0x0, &(0x7f00000002c0)={0x3ff, 0x30e3, 0x0, 0x3, 0x8, 0x8000000000, 0x80000001, 0xfffffffffffffffc}, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000180)={0x20, r1, 0x0, 0x0, &(0x7f00000001c0)}) 8.476970375s ago: executing program 1 (id=1503): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e05db0f20"], 0x8) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000140)=0x614b, 0x4) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000040)=0xfffffffb, 0x4) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffd}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000000380)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x12141, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8000000000100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r4, 0x89ef, &(0x7f0000000080)=0x6) 8.399827219s ago: executing program 3 (id=1504): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r1, 0x4b52, 0x0) r2 = getpid() setrlimit(0x1, &(0x7f0000000180)={0xe}) sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x8, &(0x7f0000000080)=0x7) socket$netlink(0x10, 0x3, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{0x0}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x4) 7.095535217s ago: executing program 3 (id=1506): capset(&(0x7f00000020c0)={0x20071026}, &(0x7f0000002100)={0x8, 0xc, 0x0, 0x0, 0x80000000, 0x4}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001400add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a04000800ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) 7.052640244s ago: executing program 1 (id=1508): r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000a80)={0x14, 0x0, &(0x7f0000000a40)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x8, &(0x7f0000000040)=ANY=[]) 7.001236614s ago: executing program 0 (id=1509): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffdfe) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, 0x0, &(0x7f0000000480)=""/61, 0x60000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000980)={0x84, 0x0, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000b7403340861a22753635f10203010902120001000000"], 0x0) socket$inet(0x2, 0x3, 0x6) fsopen(0x0, 0x0) syz_emit_vhci(0x0, 0xe) 6.902564402s ago: executing program 2 (id=1510): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r4, &(0x7f0000000f80)={'syz0\x00', {0x5, 0xfff7, 0x4, 0x8}, 0x50, [0x800006, 0x9, 0x0, 0x1, 0x8, 0x80ea45, 0x800000e, 0x1, 0x63, 0xffffffff, 0x7f, 0xc, 0x4, 0x9, 0x1, 0x4, 0x8001080, 0x80000002, 0x1, 0x200008, 0x40, 0xa4d, 0x3ff, 0x40000005, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x401, 0x100, 0x9, 0x4, 0x2, 0x0, 0x2, 0x4, 0x1, 0x4, 0xa, 0x6, 0x3, 0x5ff, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x8, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x401, 0x9, 0x9, 0x8, 0x12, 0x7fc, 0xc, 0x0, 0x2729, 0xfd8, 0x3, 0x7, 0x7, 0x0, 0xd8, 0x2, 0xfffffff7, 0x2, 0x3, 0x5, 0x4009, 0x401, 0xb, 0xfffffff8, 0x9, 0xa1, 0x10000, 0xffffffff, 0x5, 0x10004, 0x9e, 0x2, 0xae3, 0x6, 0x7, 0xfffffffd, 0x9, 0xffff3f16, 0xa, 0x0, 0x9, 0xa, 0x5, 0xfffffeff, 0x9, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xfffe7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x8, 0x6, 0x6, 0x200007, 0x8], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x3, 0xc, 0x2, 0x5, 0x7aae, 0x80000000, 0x2, 0x7ffffff7, 0x7ffe, 0x1, 0x1, 0x5, 0x400, 0x80000002, 0x2b0, 0xfffffff4, 0x97f82544, 0x8, 0xfffffffd, 0x0, 0x1, 0x5, 0x4, 0x9, 0xc90, 0xffffff3c, 0xd, 0x13, 0x4, 0x8, 0x1, 0x4, 0x2, 0x1000000c, 0x0, 0x2, 0x3, 0x8007c12, 0x5, 0x1, 0x17, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x1fff80, 0x5, 0x0, 0xc, 0xdd, 0x1, 0x1400, 0xc3, 0x20ffff, 0x79c], [0x9, 0x3a8e, 0xffff9a7f, 0x200, 0x6, 0x2001, 0x6, 0xfffffff3, 0xd077, 0x2, 0xf, 0x21, 0x200, 0xa, 0x6, 0x2, 0x1ff, 0xfe, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x3, 0x5, 0x80000001, 0xffff, 0xd, 0x40, 0xfffffffd, 0x3, 0x10001, 0x8000, 0x10, 0x1002, 0xc, 0x104, 0x8, 0x20000000, 0x8, 0x9, 0xb32a, 0xec000000, 0x8001, 0x1900, 0x4, 0xc, 0x40, 0x7ff, 0x280, 0x5, 0xffffffff, 0x7, 0x6e79, 0x0, 0xc, 0x9371, 0x4f89, 0x7, 0xf, 0x2d1, 0x83, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) openat$cachefiles(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) 5.791856835s ago: executing program 3 (id=1511): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@rights={{0x10}}, @rights={{0x10}}], 0x20}, 0x80) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) syz_open_dev$radio(&(0x7f0000000040), 0x2, 0x2) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfdef) memfd_secret(0x80000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x4, 0x8, 0x80}, 0x0, &(0x7f00000002c0)={0x3ff, 0x30e3, 0x0, 0x3, 0x8, 0x8000000000, 0x80000001, 0xfffffffffffffffc}, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000180)={0x20, r1, 0x0, 0x0, &(0x7f00000001c0)}) 4.427253263s ago: executing program 2 (id=1512): syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xeef, 0x72c4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r1, 0x0, 0x0) close(0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000000080)=0x7) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r6, r6, 0x0, 0x2000007ff) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000100)=0x7f, 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 4.426864403s ago: executing program 3 (id=1513): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x22, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x89, 0x0, @empty, @broadcast}}}}}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x4, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0xffffffff}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, 0x0) ioctl$COMEDI_INSNLIST(r3, 0x8008640b, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000840), 0x4) ptrace$ARCH_SHSTK_STATUS(0x1e, r0, &(0x7f0000000180), 0x5005) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') rename(&(0x7f0000000580)='./file0\x00', 0x0) symlinkat(&(0x7f0000001040)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mount$nfs(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0), 0x80000, &(0x7f0000000a00)={[], [{@uid_gt}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@fsmagic={'fsmagic', 0x3d, 0x4}}, {@obj_role={'obj_role', 0x3d, '@\xce?%\x15U$`\xd0,8>\xcd.\x96{o\x895\xca\x0e\xf6\x98X\xc61\xdb\xaa3\x9a\x11\xd6B\xe0\tz\xe9H\x93\x1fX\xaf\x1d\x87\xb0\xa6w\xfc\xaf\\\xa2\x00\x11\x94\xea\xfa\x1e\x1b\x92)\x8cBu\x13\xa1\xa3\xf4XLt\xec\xb6=\x0f\x97\xd7m\x89\xe1\xe6\xcb\'\x18tc\x9d\x94\xa1f3E\f\xfe=u\x04_d\xd2~\xb0F\x00\xea_K\xa8\xf6q\xbb\x94kxt\r\x8a'}}, {@smackfshat={'smackfshat', 0x3d, 'erspan0\x00'}}, {@appraise_type}]}) 3.429138765s ago: executing program 1 (id=1514): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r1, 0x4b52, 0x0) r2 = getpid() setrlimit(0x1, &(0x7f0000000180)={0xe}) sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x8, &(0x7f0000000080)=0x7) socket$netlink(0x10, 0x3, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{0x0}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x4) 3.428472435s ago: executing program 0 (id=1515): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$llc(0x1a, 0x2, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r4, 0xffffffffffffffff, 0x0) 3.360386628s ago: executing program 3 (id=1516): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e05db0f20"], 0x8) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000140)=0x614b, 0x4) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000040)=0xfffffffb, 0x4) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffd}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000000380)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x12141, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8000000000100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r3, 0x89ef, &(0x7f0000000080)=0x6) 923.848152ms ago: executing program 1 (id=1517): socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x5c}}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x401, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xee) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f0000000000)) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4000810}, 0x4008804) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_open_dev$dri(&(0x7f0000000140), 0x4, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000001080)={&(0x7f0000000f80)=[0x0, 0x0], &(0x7f0000000fc0)=[0x0], &(0x7f0000000280)=[0x0], &(0x7f0000001040), 0x2, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r8, 0xc05064a7, &(0x7f0000000400)={&(0x7f00000002c0), &(0x7f00000014c0)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000ec0), &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, 0x0, 0x0, r9}) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0000002500090122bd7008f9ffffff0200000008003f800400228008000300470000000800", @ANYRES32, @ANYBLOB], 0x2c}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0x340, 0x340, 0x0, 0x340, 0x270, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [0x0, 0x0, 0xff000000], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x270}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r10, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) syz_open_dev$evdev(0x0, 0x4, 0x40a200) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) socket$netlink(0x10, 0x3, 0x0) socket(0x200000000000011, 0x2, 0x0) 910.758864ms ago: executing program 0 (id=1518): socket(0x27, 0x800, 0xffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000110)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000250)='/dev/zram0,6', 0xc) 781.772198ms ago: executing program 2 (id=1519): r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x2) r1 = dup(r0) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000240)={0x80, 0x14, 0x103, 0x0, 0x0, 0x0, 0x0}) 613.485828ms ago: executing program 2 (id=1520): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r2, &(0x7f0000000f80)={'syz0\x00', {0x5, 0xfff7, 0x4, 0x8}, 0x50, [0x800006, 0x9, 0x0, 0x1, 0x8, 0x80ea45, 0x800000e, 0x1, 0x63, 0xffffffff, 0x7f, 0xc, 0x4, 0x9, 0x1, 0x4, 0x8001080, 0x80000002, 0x1, 0x200008, 0x40, 0xa4d, 0x3ff, 0x40000005, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x401, 0x100, 0x9, 0x4, 0x2, 0x0, 0x2, 0x4, 0x1, 0x4, 0xa, 0x6, 0x3, 0x5ff, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x8, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x401, 0x9, 0x9, 0x8, 0x12, 0x7fc, 0xc, 0x0, 0x2729, 0xfd8, 0x3, 0x7, 0x7, 0x0, 0xd8, 0x2, 0xfffffff7, 0x2, 0x3, 0x5, 0x4009, 0x401, 0xb, 0xfffffff8, 0x9, 0xa1, 0x10000, 0xffffffff, 0x5, 0x10004, 0x9e, 0x2, 0xae3, 0x6, 0x7, 0xfffffffd, 0x9, 0xffff3f16, 0xa, 0x0, 0x9, 0xa, 0x5, 0xfffffeff, 0x9, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xfffe7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x8, 0x6, 0x6, 0x200007, 0x8], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x3, 0xc, 0x2, 0x5, 0x7aae, 0x80000000, 0x2, 0x7ffffff7, 0x7ffe, 0x1, 0x1, 0x5, 0x400, 0x80000002, 0x2b0, 0xfffffff4, 0x97f82544, 0x8, 0xfffffffd, 0x0, 0x1, 0x5, 0x4, 0x9, 0xc90, 0xffffff3c, 0xd, 0x13, 0x4, 0x8, 0x1, 0x4, 0x2, 0x1000000c, 0x0, 0x2, 0x3, 0x8007c12, 0x5, 0x1, 0x17, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x1fff80, 0x5, 0x0, 0xc, 0xdd, 0x1, 0x1400, 0xc3, 0x20ffff, 0x79c], [0x9, 0x3a8e, 0xffff9a7f, 0x200, 0x6, 0x2001, 0x6, 0xfffffff3, 0xd077, 0x2, 0xf, 0x21, 0x200, 0xa, 0x6, 0x2, 0x1ff, 0xfe, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x3, 0x5, 0x80000001, 0xffff, 0xd, 0x40, 0xfffffffd, 0x3, 0x10001, 0x8000, 0x10, 0x1002, 0xc, 0x104, 0x8, 0x20000000, 0x8, 0x9, 0xb32a, 0xec000000, 0x8001, 0x1900, 0x4, 0xc, 0x40, 0x7ff, 0x280, 0x5, 0xffffffff, 0x7, 0x6e79, 0x0, 0xc, 0x9371, 0x4f89, 0x7, 0xf, 0x2d1, 0x83, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) openat$cachefiles(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) 215.546141ms ago: executing program 2 (id=1521): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0) writev(r0, &(0x7f0000019540)=[{0x0}], 0x1) 0s ago: executing program 2 (id=1522): r0 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) close(r0) socket$inet_smc(0x2b, 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x2c00) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x40) kernel console output (not intermixed with test programs): 38] usb 4-1: selecting invalid altsetting 0 [ 372.469927][ T7994] Invalid ELF header type: 3 != 1 [ 373.177480][ T5838] usb 4-1: USB disconnect, device number 13 [ 373.186730][ T7994] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 378.345802][ T5820] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 378.557917][ T5820] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 378.884333][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.901163][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.225584][ T5820] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 381.234765][ T5820] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 381.255620][ T5820] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.266333][ T5820] usb 4-1: config 0 descriptor?? [ 381.272272][ T5820] usb 4-1: can't set config #0, error -71 [ 381.287089][ T5820] usb 4-1: USB disconnect, device number 14 [ 383.343649][ T8098] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 384.162986][ T8102] input: syz1 as /devices/virtual/input/input8 [ 387.965714][ T5838] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 388.065423][ T8129] bio_check_eod: 2 callbacks suppressed [ 388.065442][ T8129] syz.3.625: attempt to access beyond end of device [ 388.065442][ T8129] nbd3: rw=0, sector=64, nr_sectors = 1 limit=0 [ 388.109463][ T8129] syz.3.625: attempt to access beyond end of device [ 388.109463][ T8129] nbd3: rw=0, sector=256, nr_sectors = 1 limit=0 [ 388.127226][ T8129] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 388.139077][ T8129] syz.3.625: attempt to access beyond end of device [ 388.139077][ T8129] nbd3: rw=0, sector=512, nr_sectors = 1 limit=0 [ 388.152789][ T8129] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 388.162574][ T8129] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 388.170280][ T8129] UDF-fs: Scanning with blocksize 512 failed [ 388.177352][ T8129] syz.3.625: attempt to access beyond end of device [ 388.177352][ T8129] nbd3: rw=0, sector=64, nr_sectors = 2 limit=0 [ 388.192426][ T8129] syz.3.625: attempt to access beyond end of device [ 388.192426][ T8129] nbd3: rw=0, sector=512, nr_sectors = 2 limit=0 [ 388.207180][ T8129] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 388.219045][ T8129] syz.3.625: attempt to access beyond end of device [ 388.219045][ T8129] nbd3: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 388.222198][ T5838] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 388.243062][ T8129] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 388.252850][ T8129] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 388.268947][ T8129] UDF-fs: Scanning with blocksize 1024 failed [ 388.273543][ T5838] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 388.286661][ T5838] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 388.299619][ T8129] syz.3.625: attempt to access beyond end of device [ 388.299619][ T8129] nbd3: rw=0, sector=64, nr_sectors = 4 limit=0 [ 388.313763][ T5838] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 388.325479][ T8129] syz.3.625: attempt to access beyond end of device [ 388.325479][ T8129] nbd3: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 388.346368][ T5838] usb 2-1: config 0 descriptor?? [ 388.368688][ T8129] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 388.382856][ T8129] syz.3.625: attempt to access beyond end of device [ 388.382856][ T8129] nbd3: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 388.403190][ T8129] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 388.413827][ T8129] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 388.425160][ T8129] UDF-fs: Scanning with blocksize 2048 failed [ 388.432595][ T8129] syz.3.625: attempt to access beyond end of device [ 388.432595][ T8129] nbd3: rw=0, sector=64, nr_sectors = 8 limit=0 [ 388.450915][ T8129] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 388.461677][ T8129] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 388.472542][ T8129] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 388.480812][ T8129] UDF-fs: Scanning with blocksize 4096 failed [ 388.487682][ T8129] UDF-fs: warning (device nbd3): udf_fill_super: No partition found (1) [ 390.818482][ T8145] FAULT_INJECTION: forcing a failure. [ 390.818482][ T8145] name failslab, interval 1, probability 0, space 0, times 0 [ 390.833610][ T8145] CPU: 0 PID: 8145 Comm: syz.0.629 Not tainted syzkaller #0 [ 390.840970][ T8145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 390.851088][ T8145] Call Trace: [ 390.854411][ T8145] [ 390.857364][ T8145] dump_stack_lvl+0x18c/0x250 [ 390.862049][ T8145] ? show_regs_print_info+0x20/0x20 [ 390.867254][ T8145] ? load_image+0x420/0x420 [ 390.871789][ T8145] ? __might_sleep+0xe0/0xe0 [ 390.876411][ T8145] ? __lock_acquire+0x7d80/0x7d80 [ 390.881438][ T8145] should_fail_ex+0x394/0x4c0 [ 390.886122][ T8145] should_failslab+0x9/0x20 [ 390.890624][ T8145] slab_pre_alloc_hook+0x59/0x300 [ 390.895659][ T8145] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 390.901315][ T8145] ? gfs2_meta_init_fs_context+0x54/0x2b0 [ 390.907140][ T8145] __kmem_cache_alloc_node+0x53/0x250 [ 390.912528][ T8145] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 390.918259][ T8145] ? gfs2_meta_init_fs_context+0x54/0x2b0 [ 390.924081][ T8145] kmalloc_trace+0x2a/0xe0 [ 390.928514][ T8145] gfs2_meta_init_fs_context+0x54/0x2b0 [ 390.934074][ T8145] alloc_fs_context+0x618/0x7a0 [ 390.938997][ T8145] __se_sys_fsopen+0xa0/0x2c0 [ 390.943691][ T8145] do_syscall_64+0x55/0xb0 [ 390.948130][ T8145] ? clear_bhb_loop+0x40/0x90 [ 390.953008][ T8145] ? clear_bhb_loop+0x40/0x90 [ 390.957782][ T8145] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 390.963719][ T8145] RIP: 0033:0x7f76e0d9e159 [ 390.968141][ T8145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 390.987759][ T8145] RSP: 002b:00007f76e1c25028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 390.996181][ T8145] RAX: ffffffffffffffda RBX: 00007f76e1025fa0 RCX: 00007f76e0d9e159 [ 391.004193][ T8145] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180 [ 391.012195][ T8145] RBP: 00007f76e0e3506b R08: 0000000000000000 R09: 0000000000000000 [ 391.020175][ T8145] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 391.028178][ T8145] R13: 00007f76e1026038 R14: 00007f76e1025fa0 R15: 00007fff42c0e0f8 [ 391.036171][ T8145] [ 392.953754][ T5838] usb 2-1: USB disconnect, device number 17 [ 395.189839][ T8180] netlink: 12 bytes leftover after parsing attributes in process `syz.0.638'. [ 396.288808][ T5852] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 397.368484][ T5852] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 397.507220][ T5852] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 397.522428][ T5852] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 397.537918][ T5852] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.560813][ T5852] usb 2-1: config 0 descriptor?? [ 399.185831][ T5838] usb 2-1: USB disconnect, device number 18 [ 400.089173][ T8214] bond_slave_0: entered promiscuous mode [ 400.155597][ T8214] bond_slave_0: entered allmulticast mode [ 402.792418][ T8228] netlink: 'syz.3.647': attribute type 21 has an invalid length. [ 402.800690][ T8228] netlink: 128 bytes leftover after parsing attributes in process `syz.3.647'. [ 402.810028][ T8228] netlink: 3 bytes leftover after parsing attributes in process `syz.3.647'. [ 410.937255][ T5852] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 414.886941][ T8330] block device autoloading is deprecated and will be removed. [ 416.813090][ T8333] netlink: 'syz.1.665': attribute type 21 has an invalid length. [ 416.821122][ T8333] netlink: 128 bytes leftover after parsing attributes in process `syz.1.665'. [ 416.830421][ T8333] netlink: 3 bytes leftover after parsing attributes in process `syz.1.665'. [ 423.320299][ T5839] IPVS: starting estimator thread 0... [ 423.498420][ T8367] IPVS: using max 22 ests per chain, 52800 per kthread [ 423.555726][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 425.375641][ T8375] netlink: 20 bytes leftover after parsing attributes in process `syz.0.682'. [ 437.798496][ T8431] bridge0: port 2(bridge_slave_1) entered disabled state [ 437.805905][ T8431] bridge0: port 1(bridge_slave_0) entered disabled state [ 440.220536][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.241254][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 444.326149][ T8431] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 444.335149][ T8431] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 444.355670][ T8431] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 444.419898][ T8431] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 460.557826][ T8608] netlink: 'syz.3.734': attribute type 21 has an invalid length. [ 460.565981][ T8608] netlink: 128 bytes leftover after parsing attributes in process `syz.3.734'. [ 460.576625][ T8608] netlink: 3 bytes leftover after parsing attributes in process `syz.3.734'. [ 474.865734][ T8697] netlink: 'syz.2.757': attribute type 21 has an invalid length. [ 474.888710][ T8697] netlink: 128 bytes leftover after parsing attributes in process `syz.2.757'. [ 474.900073][ T8697] netlink: 3 bytes leftover after parsing attributes in process `syz.2.757'. [ 485.635861][ T8789] netlink: 'syz.1.769': attribute type 21 has an invalid length. [ 485.643655][ T8789] netlink: 128 bytes leftover after parsing attributes in process `syz.1.769'. [ 485.652731][ T8789] netlink: 3 bytes leftover after parsing attributes in process `syz.1.769'. [ 492.503796][ T8886] Cannot find del_set index 0 as target [ 495.911509][ T8907] netlink: 'syz.1.784': attribute type 21 has an invalid length. [ 495.919800][ T8907] netlink: 128 bytes leftover after parsing attributes in process `syz.1.784'. [ 495.931771][ T8907] netlink: 3 bytes leftover after parsing attributes in process `syz.1.784'. [ 501.659716][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.666137][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 504.325967][ T8949] netlink: 'syz.2.803': attribute type 21 has an invalid length. [ 504.333945][ T8949] netlink: 128 bytes leftover after parsing attributes in process `syz.2.803'. [ 504.345225][ T8949] netlink: 3 bytes leftover after parsing attributes in process `syz.2.803'. [ 512.186711][ T8982] netlink: 'syz.2.813': attribute type 21 has an invalid length. [ 512.194766][ T8982] netlink: 128 bytes leftover after parsing attributes in process `syz.2.813'. [ 512.205350][ T8982] netlink: 3 bytes leftover after parsing attributes in process `syz.2.813'. [ 519.184315][ T9058] netlink: 'syz.1.823': attribute type 21 has an invalid length. [ 519.192353][ T9058] netlink: 128 bytes leftover after parsing attributes in process `syz.1.823'. [ 519.203318][ T9058] netlink: 3 bytes leftover after parsing attributes in process `syz.1.823'. [ 525.208592][ T9136] netlink: 'syz.2.832': attribute type 21 has an invalid length. [ 525.216636][ T9136] netlink: 128 bytes leftover after parsing attributes in process `syz.2.832'. [ 525.226595][ T9136] netlink: 3 bytes leftover after parsing attributes in process `syz.2.832'. [ 528.402646][ T9153] rnbd_client L602: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 528.440568][ T8572] rtrs_client L2018: : CM error (CM event: address error, err: -19) [ 528.456868][ T9153] rtrs_client L2618: : init_conns() failed: err=-113 path=@ip:27.0.0.1 [:0] [ 540.041901][ T28] audit: type=1800 audit(1790523087.060:19): pid=9301 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.857" name="file0" dev="overlay" ino=1224 res=0 errno=0 [ 561.975982][ T5769] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 562.200645][ T5769] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 562.216308][ T5769] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 563.488811][ T9452] netlink: 'syz.1.893': attribute type 21 has an invalid length. [ 563.497599][ T9452] netlink: 128 bytes leftover after parsing attributes in process `syz.1.893'. [ 563.507750][ T9452] netlink: 3 bytes leftover after parsing attributes in process `syz.1.893'. [ 564.225984][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 564.232130][ T5769] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 564.232327][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.241465][ T5769] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 564.263040][ T5769] usb 3-1: config 0 descriptor?? [ 566.719562][ T5919] usb 3-1: USB disconnect, device number 14 [ 571.878116][ T9501] netlink: 'syz.3.909': attribute type 21 has an invalid length. [ 571.886629][ T9501] netlink: 128 bytes leftover after parsing attributes in process `syz.3.909'. [ 571.900620][ T9501] netlink: 3 bytes leftover after parsing attributes in process `syz.3.909'. [ 573.293044][ T9505] IPVS: lc: FWM 3 0x00000003 - no destination available [ 574.597335][ T9511] block device autoloading is deprecated and will be removed. [ 574.605117][ T9511] XFS (loop0): Cannot mount filesystem with identical rtdev and ddev/logdev. [ 580.341253][ T9545] netlink: 132 bytes leftover after parsing attributes in process `syz.3.921'. [ 585.472862][ T28] audit: type=1800 audit(1790523132.490:20): pid=9561 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.923" name="file1" dev="sda1" ino=2043 res=0 errno=0 PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/consolele0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaÀ ð[ 591.450428][ T9600] netlink: 132 bytes leftover after parsing attributes in process `syz.2.935'. [ 592.089562][ T9605] netlink: 4612 bytes leftover after parsing attributes in process `syz.1.942'. [ 594.195659][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 595.841925][ T9620] FAULT_INJECTION: forcing a failure. [ 595.841925][ T9620] name failslab, interval 1, probability 0, space 0, times 0 [ 595.895908][ T9620] CPU: 0 PID: 9620 Comm: syz.2.947 Not tainted syzkaller #0 [ 595.903278][ T9620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 595.913454][ T9620] Call Trace: [ 595.916758][ T9620] [ 595.919716][ T9620] dump_stack_lvl+0x18c/0x250 [ 595.924439][ T9620] ? show_regs_print_info+0x20/0x20 [ 595.929676][ T9620] ? load_image+0x420/0x420 [ 595.934222][ T9620] ? __might_sleep+0xe0/0xe0 [ 595.938949][ T9620] ? __lock_acquire+0x7d80/0x7d80 [ 595.944027][ T9620] should_fail_ex+0x394/0x4c0 [ 595.948752][ T9620] should_failslab+0x9/0x20 [ 595.953299][ T9620] slab_pre_alloc_hook+0x59/0x300 [ 595.958468][ T9620] kmem_cache_alloc+0x5a/0x2c0 [ 595.963306][ T9620] ? vm_area_dup+0x27/0x270 [ 595.967855][ T9620] vm_area_dup+0x27/0x270 [ 595.972233][ T9620] copy_mm+0x11a6/0x1e30 [ 595.976571][ T9620] ? copy_signal+0x640/0x640 [ 595.981209][ T9620] ? lockdep_init_map_type+0x9c/0x8e0 [ 595.986647][ T9620] ? __init_rwsem+0x122/0x160 [ 595.991358][ T9620] ? copy_signal+0x51f/0x640 [ 595.995985][ T9620] copy_process+0x16c9/0x3da0 [ 596.000783][ T9620] ? plist_add+0x3db/0x490 [ 596.005523][ T9620] ? copy_process+0x98e/0x3da0 [ 596.010332][ T9620] ? futex_wait+0x4a7/0x5c0 [ 596.015051][ T9620] ? __pidfd_prepare+0x140/0x140 [ 596.020037][ T9620] kernel_clone+0x24b/0x8a0 [ 596.024579][ T9620] ? create_io_thread+0x190/0x190 [ 596.029670][ T9620] ? do_futex+0x2ff/0x3e0 [ 596.034038][ T9620] __x64_sys_clone+0x1b7/0x230 [ 596.038833][ T9620] ? fput+0x154/0x1a0 [ 596.042887][ T9620] ? __ia32_sys_vfork+0x140/0x140 [ 596.048155][ T9620] ? lock_chain_count+0x20/0x20 [ 596.053077][ T9620] ? lockdep_hardirqs_on+0x98/0x150 [ 596.058421][ T9620] do_syscall_64+0x55/0xb0 [ 596.062922][ T9620] ? clear_bhb_loop+0x40/0x90 [ 596.067644][ T9620] ? clear_bhb_loop+0x40/0x90 [ 596.072366][ T9620] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 596.078298][ T9620] RIP: 0033:0x7f158db9e159 [ 596.082768][ T9620] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 596.102795][ T9620] RSP: 002b:00007f158ea20fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 596.112135][ T9620] RAX: ffffffffffffffda RBX: 00007f158de25fa0 RCX: 00007f158db9e159 [ 596.120763][ T9620] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 596.128801][ T9620] RBP: 00007f158dc3506b R08: 0000000000000000 R09: 0000000000000000 [ 596.136811][ T9620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 596.145515][ T9620] R13: 00007f158de26038 R14: 00007f158de25fa0 R15: 00007ffcafbab268 [ 596.153630][ T9620] [ 602.527185][ T9659] netlink: 'syz.1.958': attribute type 4 has an invalid length. [ 604.912216][ T9685] sctp: [Deprecated]: syz.1.969 (pid 9685) Use of int in maxseg socket option. [ 604.912216][ T9685] Use struct sctp_assoc_value instead PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/consolele0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaÀ ð[ 608.186221][ T9724] IPVS: dh: UDP 127.0.0.1:21 - no destination available [ 608.725714][ T5839] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 609.422993][ T5839] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 609.433733][ T5839] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 609.447091][ T5839] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 609.459089][ T5839] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.471450][ T5839] usb 3-1: config 0 descriptor?? [ 612.202965][ T5919] usb 3-1: USB disconnect, device number 15 PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/consolele0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaÀ ð[ 612.972009][ T5793] Bluetooth: hci2: unexpected event for opcode 0x200f [ 617.805688][ T5919] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 618.026124][ T5919] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 618.080674][ T5919] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 618.110230][ T5919] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 618.145616][ T5919] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 618.178033][ T5919] usb 2-1: config 0 descriptor?? [ 618.726101][ T8072] Bluetooth: hci4: Frame reassembly failed (-84) [ 620.775807][ T9792] Bluetooth: hci4: command 0x1003 tx timeout [ 620.831184][ T5793] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 620.892615][ T9] usb 2-1: USB disconnect, device number 20 [ 624.475870][ T5769] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 624.625457][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.665616][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.020093][ T5769] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 625.030045][ T5769] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 625.042107][ T5769] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 625.110192][ T5769] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 625.119527][ T5769] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 625.127837][ T5769] usb 2-1: Product: syz [ 625.135366][ T5769] usb 2-1: Manufacturer: syz [ 625.141518][ T5769] usb 2-1: SerialNumber: syz [ 625.466346][ T5769] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 21 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 625.921749][ T5769] usb 2-1: USB disconnect, device number 21 [ 627.396801][ T9830] usblp0: removed [ 630.504890][ T9861] tty tty4: ldisc open failed (-12), clearing slot 3 [ 644.765746][ T5769] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 644.927030][ T5769] usb 3-1: device descriptor read/64, error -71 [ 646.405678][ T5769] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 646.575686][ T5769] usb 3-1: device descriptor read/64, error -71 [ 646.695861][ T5769] usb usb3-port1: attempt power cycle PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/consolele0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaÀ ðPÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/consolele0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaÀ ð[ 685.986239][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.992605][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 691.507991][T10382] netlink: 'syz.1.1149': attribute type 21 has an invalid length. [ 691.516142][T10382] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1149'. [ 691.530293][T10382] netlink: 3 bytes leftover after parsing attributes in process `syz.1.1149'. [ 696.080536][T10451] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1170'. [ 696.114399][ T5793] Bluetooth: hci3: unexpected event for opcode 0x200f [ 697.646529][T10447] netlink: 'syz.0.1168': attribute type 21 has an invalid length. [ 697.654489][T10447] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1168'. [ 697.671514][T10447] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1168'. [ 702.069785][T10504] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1181'. [ 702.154310][ T5793] Bluetooth: hci0: unexpected event for opcode 0x200f [ 705.907100][T10535] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1191'. [ 711.086493][T10575] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1204'. [ 713.499560][T10597] netlink: 'syz.2.1213': attribute type 21 has an invalid length. [ 713.508680][T10597] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1213'. [ 713.519459][T10597] netlink: 3 bytes leftover after parsing attributes in process `syz.2.1213'. [ 715.536545][T10606] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1216'. [ 721.186384][T10639] netlink: 'syz.2.1223': attribute type 21 has an invalid length. [ 721.194538][T10639] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1223'. [ 721.206009][T10639] netlink: 3 bytes leftover after parsing attributes in process `syz.2.1223'. [ 723.465214][T10647] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1228'. [ 727.702439][ T5793] Bluetooth: hci3: unexpected event for opcode 0x200f [ 730.029732][T10690] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1241'. PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/console./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaÀ ð[ 732.283756][ T5793] Bluetooth: hci2: unexpected event for opcode 0x200f [ 733.773772][T10749] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1254'. PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/console./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaÀ ðPÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/console./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaÀ ð[ 740.509327][T10817] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1266'. [ 747.359427][T10869] netlink: 'syz.0.1285': attribute type 21 has an invalid length. [ 747.367775][T10869] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1285'. [ 747.376924][T10869] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1285'. [ 747.446366][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.452726][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 751.169895][T10915] netlink: 'syz.1.1299': attribute type 21 has an invalid length. [ 751.178225][T10915] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1299'. [ 751.187930][T10915] netlink: 3 bytes leftover after parsing attributes in process `syz.1.1299'. [ 758.840412][T10958] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1308'. [ 761.256282][T10971] netlink: 'syz.3.1311': attribute type 21 has an invalid length. [ 761.264157][T10971] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1311'. [ 761.273364][T10971] netlink: 3 bytes leftover after parsing attributes in process `syz.3.1311'. [ 766.937652][T10998] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1322'. PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/console./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaÀ ð[ 767.959908][T11004] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1325'. PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/console./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaÀ ð[ 775.970039][ T5793] Bluetooth: hci1: unexpected event for opcode 0x200f [ 782.875107][T11096] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1352'. PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs/dev/ttyS3./dev/console./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/dev/sequenceraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  /dev/snd/midiC#D#./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa[ 784.003229][ T5793] Bluetooth: hci3: unexpected event for opcode 0x200f À ð[ 789.624045][ T5793] Bluetooth: hci3: unexpected event for opcode 0x200f [ 790.151363][T11151] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1369'. [ 791.091305][T11153] netlink: 'syz.3.1370': attribute type 21 has an invalid length. [ 791.099267][T11153] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1370'. [ 791.108441][T11153] netlink: 3 bytes leftover after parsing attributes in process `syz.3.1370'. [ 800.460594][T11205] netlink: 'syz.3.1380': attribute type 21 has an invalid length. [ 800.468858][T11205] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1380'. [ 800.478355][T11205] netlink: 3 bytes leftover after parsing attributes in process `syz.3.1380'. [ 802.787728][T11217] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1387'. [ 802.818671][T11217] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 808.866103][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.875638][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 812.482184][T11271] input: syz1 as /devices/virtual/input/input9 PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs./dev/console./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  [ 818.064639][T11310] zram: Cannot change disksize for initialized device PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs./dev/console./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  [ 824.756249][ T8255] blk_print_req_error: 77 callbacks suppressed [ 824.756265][ T8255] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 824.772065][ T8255] buffer_io_error: 138 callbacks suppressed [ 824.772079][ T8255] Buffer I/O error on dev nbd0, logical block 0, async page read [ 824.791512][ T8255] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 3 prio class 2 [ 824.801081][ T8255] Buffer I/O error on dev nbd0, logical block 1, async page read [ 824.809977][ T8255] Buffer I/O error on dev nbd0, logical block 2, async page read [ 824.819223][ T8255] Buffer I/O error on dev nbd0, logical block 3, async page read [ 824.835274][ T8255] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 824.845680][ T8255] Buffer I/O error on dev nbd0, logical block 0, async page read [ 824.853468][ T8255] Buffer I/O error on dev nbd0, logical block 1, async page read [ 824.863109][ T8255] Buffer I/O error on dev nbd0, logical block 2, async page read [ 824.871281][ T8255] Buffer I/O error on dev nbd0, logical block 3, async page read [ 824.884434][ T8255] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 824.893710][ T8255] Buffer I/O error on dev nbd0, logical block 0, async page read [ 824.905841][ T8255] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 3 prio class 2 [ 824.915086][ T8255] Buffer I/O error on dev nbd0, logical block 1, async page read [ 824.925929][ T8255] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 824.936191][ T8255] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 824.945659][ T8255] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 824.955025][ T8255] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 824.964431][ T8255] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 824.978025][T11341] ldm_validate_partition_table(): Disk read failed. [ 825.008144][T11341] Dev nbd0: unable to read RDB block 0 [ 825.036362][T11341] nbd0: unable to read partition table [ 825.286568][ T5146] ldm_validate_partition_table(): Disk read failed. [ 825.306572][T11345] sg_write: data in/out 360412/136 bytes for SCSI command 0x0-- guessing data in; [ 825.306572][T11345] program syz.2.1423 not setting count and/or reply_len properly [ 825.336172][ T5146] Dev nbd0: unable to read RDB block 0 [ 825.343397][ T5146] nbd0: unable to read partition table [ 825.366299][ T5146] ldm_validate_partition_table(): Disk read failed. [ 825.386838][ T5146] Dev nbd0: unable to read RDB block 0 [ 825.405841][ T5146] nbd0: unable to read partition table [ 825.455109][T11198] ldm_validate_partition_table(): Disk read failed. [ 825.482734][T11198] Dev nbd0: unable to read RDB block 0 [ 825.520148][T11198] nbd0: unable to read partition table [ 826.740751][T11198] ldm_validate_partition_table(): Disk read failed. [ 826.777393][T11198] Dev nbd0: unable to read RDB block 0 [ 826.806770][T11198] nbd0: unable to read partition table [ 827.865166][T11363] input: syz1 as /devices/virtual/input/input10 PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs./dev/console./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa‹r0€$  [ 834.525723][ T5919] usb 4-1: new high-speed USB device number 15 using dummy_hcd PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs[ 834.725627][ T5919] usb 4-1: Using ep0 maxpacket: 32 ./dev/console./file0aaaaaaaa[ 834.748197][ T5919] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa[ 834.767864][ T5919] usb 4-1: config 155 interface 0 altsetting 0 has an invalid endpoint with address 0xE2, skipping aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa[ 834.790863][ T5919] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 ‹r0€$ [ 834.820718][ T5919] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 834.832597][ T5919] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 834.849841][ T5919] usb 4-1: Product: syz [ 834.854148][ T5919] usb 4-1: Manufacturer: syz [ 834.860615][ T5919] usb 4-1: SerialNumber: syz [ 834.878984][ T5919] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 834.888807][ T5919] imon 4-1:155.0: unable to initialize intf0, err -19 [ 834.895871][ T5919] imon:imon_probe: failed to initialize context! [ 835.136767][ T5919] imon 4-1:155.0: unable to register, err -19 [ 836.886719][T11444] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1462'. PÚÿÿÿ-D ¬ N"þ€=Cdevtmpfs./dev/console./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa./binderfs/binder0€$  [ 837.865966][ T5919] usb 4-1: USB disconnect, device number 15 [ 840.984221][T11481] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1473'. [ 842.735761][ T28] audit: type=1800 audit(1790523389.310:21): pid=11492 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1477" name="file0" dev="overlay" ino=2079 res=0 errno=0 [ 849.010810][T11534] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1485'. [ 852.062780][T11559] xt_CT: You must specify a L4 protocol and not use inversions on it [ 852.569426][ T5769] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 854.258143][ T5769] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 854.269668][ T5769] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 854.283068][ T5769] usb 4-1: config 0 interface 0 has no altsetting 0 [ 854.295605][ T5769] usb 4-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 854.304812][ T5769] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 855.172984][ T5769] usb 4-1: config 0 descriptor?? [ 855.305249][ T5769] usb 4-1: can't set config #0, error -71 [ 855.383348][ T5793] Bluetooth: hci0: unexpected event for opcode 0x200f [ 855.454686][ T5769] usb 4-1: USB disconnect, device number 16 [ 857.085598][ T5769] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 857.310709][ T5769] usb 2-1: Using ep0 maxpacket: 16 [ 857.352653][ T5769] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 857.382351][ T5769] usb 2-1: config 0 interface 0 has no altsetting 0 [ 857.412810][ T5769] usb 2-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 857.441197][ T5769] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 857.474429][ T5769] usb 2-1: Product: syz [ 857.487628][ T5769] usb 2-1: Manufacturer: syz [ 857.506568][ T5769] usb 2-1: SerialNumber: syz [ 857.534674][ T5769] usb 2-1: config 0 descriptor?? [ 857.827230][ T5769] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input11 [ 857.926988][T11607] capability: warning: `syz.3.1506' uses deprecated v2 capabilities in a way that may be insecure [ 858.545730][ T5769] rc_core: IR keymap rc-imon-pad not found [ 858.885771][ T5769] Registered IR keymap rc-empty [ 858.890867][ T5769] imon 2-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 858.901868][ T5769] imon 2-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 858.948795][ T5769] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 858.982616][ T5769] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input12 [ 858.998749][ T5769] imon 2-1:0.0: iMON device (15c2:0041, intf0) on usb<2:22> initialized [ 859.200736][ C1] imon 2-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 859.213889][ T5769] usb 2-1: USB disconnect, device number 22 [ 861.659468][ T5919] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 862.834645][ T5793] Bluetooth: hci2: unexpected event for opcode 0x200f [ 863.325630][ T5919] usb 3-1: device not accepting address 19, error -71 [ 864.222829][T11645] block2mtd: erasesize must be a divisor of device size [ 864.232020][T11645] ------------[ cut here ]------------ [ 864.238306][T11645] WARNING: CPU: 1 PID: 11645 at block/bdev.c:643 blkdev_flush_mapping+0xac/0x290 [ 864.247959][T11645] Modules linked in: [ 864.251891][T11645] CPU: 1 PID: 11645 Comm: syz.0.1518 Not tainted syzkaller #0 [ 864.259640][T11645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 864.269901][T11645] RIP: 0010:blkdev_flush_mapping+0xac/0x290 [ 864.276369][T11645] Code: 42 80 3c 28 00 74 08 4c 89 f7 e8 4f d2 cb fd 49 8b 3e 48 ba ff ff ff ff ff ff ff 7f 31 f6 e8 4b 57 a1 fd eb 11 e8 14 46 73 fd <0f> 0b 48 85 db 75 9f e8 08 46 73 fd 48 89 1c 24 4c 8d b3 80 00 00 [ 864.296313][T11645] RSP: 0018:ffffc9000351f970 EFLAGS: 00010287 [ 864.302419][T11645] RAX: ffffffff8414453c RBX: ffff8881489fd240 RCX: 0000000000080000 [ 864.310483][T11645] RDX: ffffc9000bea1000 RSI: 000000000000b62c RDI: 000000000000b62d [ 864.318813][T11645] RBP: 0000000000000002 R08: ffff8881489fd27b R09: 1ffff1102913fa4f [ 864.326895][T11645] R10: dffffc0000000000 R11: ffffed102913fa50 R12: dffffc0000000000 [ 864.334896][T11645] R13: dffffc0000000000 R14: ffff8881489fd374 R15: ffff8881489fd278 [ 864.343001][T11645] FS: 00007f76e1c256c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 864.352105][T11645] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 864.358979][T11645] CR2: 000000110c42d6f4 CR3: 0000000023bfa000 CR4: 00000000003506e0 [ 864.367092][T11645] Call Trace: [ 864.370494][T11645] [ 864.373487][T11645] ? blkdev_put+0x492/0x7a0 [ 864.378138][T11645] blkdev_put+0x49a/0x7a0 [ 864.382539][T11645] block2mtd_setup2+0x98f/0xe30 [ 864.387655][T11645] ? block2mtd_setup+0xd0/0xd0 [ 864.392508][T11645] ? rcu_is_watching+0x15/0xb0 [ 864.397522][T11645] ? mutex_lock_nested+0x20/0x20 [ 864.402510][T11645] ? __virt_addr_valid+0x10c/0x380 [ 864.407749][T11645] ? kernfs_fop_write_iter+0x1dc/0x520 [ 864.413334][T11645] block2mtd_setup+0x27/0xd0 [ 864.418031][T11645] param_attr_store+0x20e/0x300 [ 864.423014][T11645] ? param_attr_show+0x170/0x170 [ 864.428053][T11645] ? sysfs_kf_read+0x360/0x360 [ 864.432872][T11645] module_attr_store+0x5f/0x80 [ 864.437757][T11645] kernfs_fop_write_iter+0x3a4/0x520 [ 864.443104][T11645] vfs_write+0x474/0x9a0 [ 864.447503][T11645] ? file_end_write+0x250/0x250 [ 864.452437][T11645] ? __fget_files+0x3fc/0x460 [ 864.457304][T11645] ? __fdget_pos+0x2a3/0x330 [ 864.461976][T11645] ? ksys_write+0x74/0x260 [ 864.466656][T11645] ksys_write+0x151/0x260 [ 864.471069][T11645] ? __ia32_sys_read+0x90/0x90 [ 864.476045][T11645] ? lockdep_hardirqs_on+0x98/0x150 [ 864.481291][T11645] do_syscall_64+0x55/0xb0 [ 864.485781][T11645] ? clear_bhb_loop+0x40/0x90 [ 864.490520][T11645] ? clear_bhb_loop+0x40/0x90 [ 864.495217][T11645] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 864.501225][T11645] RIP: 0033:0x7f76e0d9e159 [ 864.505688][T11645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 864.525604][T11645] RSP: 002b:00007f76e1c25028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 864.534111][T11645] RAX: ffffffffffffffda RBX: 00007f76e1025fa0 RCX: 00007f76e0d9e159 [ 864.542417][T11645] RDX: 000000000000000c RSI: 0000200000000250 RDI: 0000000000000003 [ 864.550480][T11645] RBP: 00007f76e0e3506b R08: 0000000000000000 R09: 0000000000000000 [ 864.558963][T11645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 864.567111][T11645] R13: 00007f76e1026038 R14: 00007f76e1025fa0 R15: 00007fff42c0e0f8 [ 864.575281][T11645] [ 864.578366][T11645] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 864.585737][T11645] CPU: 1 PID: 11645 Comm: syz.0.1518 Not tainted syzkaller #0 [ 864.593221][T11645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 864.603470][T11645] Call Trace: [ 864.606764][T11645] [ 864.609697][T11645] dump_stack_lvl+0x18c/0x250 [ 864.614406][T11645] ? show_regs_print_info+0x20/0x20 [ 864.619636][T11645] ? load_image+0x420/0x420 [ 864.624176][T11645] panic+0x2ca/0x720 [ 864.628121][T11645] ? bpf_jit_dump+0xd0/0xd0 [ 864.632660][T11645] __warn+0x2e0/0x470 [ 864.636670][T11645] ? blkdev_flush_mapping+0xac/0x290 [ 864.642073][T11645] ? blkdev_flush_mapping+0xac/0x290 [ 864.647362][T11645] report_bug+0x2be/0x4f0 [ 864.651748][T11645] ? blkdev_flush_mapping+0xac/0x290 [ 864.657043][T11645] ? blkdev_flush_mapping+0xac/0x290 [ 864.662351][T11645] ? blkdev_flush_mapping+0xae/0x290 [ 864.667686][T11645] handle_bug+0xcf/0x120 [ 864.672131][T11645] exc_invalid_op+0x1a/0x50 [ 864.676679][T11645] asm_exc_invalid_op+0x1a/0x20 [ 864.681584][T11645] RIP: 0010:blkdev_flush_mapping+0xac/0x290 [ 864.687510][T11645] Code: 42 80 3c 28 00 74 08 4c 89 f7 e8 4f d2 cb fd 49 8b 3e 48 ba ff ff ff ff ff ff ff 7f 31 f6 e8 4b 57 a1 fd eb 11 e8 14 46 73 fd <0f> 0b 48 85 db 75 9f e8 08 46 73 fd 48 89 1c 24 4c 8d b3 80 00 00 [ 864.707394][T11645] RSP: 0018:ffffc9000351f970 EFLAGS: 00010287 [ 864.713466][T11645] RAX: ffffffff8414453c RBX: ffff8881489fd240 RCX: 0000000000080000 [ 864.721962][T11645] RDX: ffffc9000bea1000 RSI: 000000000000b62c RDI: 000000000000b62d [ 864.730046][T11645] RBP: 0000000000000002 R08: ffff8881489fd27b R09: 1ffff1102913fa4f [ 864.738025][T11645] R10: dffffc0000000000 R11: ffffed102913fa50 R12: dffffc0000000000 [ 864.746033][T11645] R13: dffffc0000000000 R14: ffff8881489fd374 R15: ffff8881489fd278 [ 864.754019][T11645] ? blkdev_flush_mapping+0xac/0x290 [ 864.759344][T11645] ? blkdev_put+0x492/0x7a0 [ 864.763861][T11645] blkdev_put+0x49a/0x7a0 [ 864.768196][T11645] block2mtd_setup2+0x98f/0xe30 [ 864.773060][T11645] ? block2mtd_setup+0xd0/0xd0 [ 864.777832][T11645] ? rcu_is_watching+0x15/0xb0 [ 864.782644][T11645] ? mutex_lock_nested+0x20/0x20 [ 864.787609][T11645] ? __virt_addr_valid+0x10c/0x380 [ 864.792742][T11645] ? kernfs_fop_write_iter+0x1dc/0x520 [ 864.798239][T11645] block2mtd_setup+0x27/0xd0 [ 864.802844][T11645] param_attr_store+0x20e/0x300 [ 864.807714][T11645] ? param_attr_show+0x170/0x170 [ 864.812653][T11645] ? sysfs_kf_read+0x360/0x360 [ 864.817517][T11645] module_attr_store+0x5f/0x80 [ 864.822310][T11645] kernfs_fop_write_iter+0x3a4/0x520 [ 864.827600][T11645] vfs_write+0x474/0x9a0 [ 864.831920][T11645] ? file_end_write+0x250/0x250 [ 864.836787][T11645] ? __fget_files+0x3fc/0x460 [ 864.841478][T11645] ? __fdget_pos+0x2a3/0x330 [ 864.846067][T11645] ? ksys_write+0x74/0x260 [ 864.850520][T11645] ksys_write+0x151/0x260 [ 864.854864][T11645] ? __ia32_sys_read+0x90/0x90 [ 864.859708][T11645] ? lockdep_hardirqs_on+0x98/0x150 [ 864.864925][T11645] do_syscall_64+0x55/0xb0 [ 864.869403][T11645] ? clear_bhb_loop+0x40/0x90 [ 864.874266][T11645] ? clear_bhb_loop+0x40/0x90 [ 864.878962][T11645] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 864.884973][T11645] RIP: 0033:0x7f76e0d9e159 [ 864.889391][T11645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 864.909013][T11645] RSP: 002b:00007f76e1c25028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 864.917428][T11645] RAX: ffffffffffffffda RBX: 00007f76e1025fa0 RCX: 00007f76e0d9e159 [ 864.925411][T11645] RDX: 000000000000000c RSI: 0000200000000250 RDI: 0000000000000003 [ 864.933396][T11645] RBP: 00007f76e0e3506b R08: 0000000000000000 R09: 0000000000000000 [ 864.941372][T11645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 864.949361][T11645] R13: 00007f76e1026038 R14: 00007f76e1025fa0 R15: 00007fff42c0e0f8 [ 864.957452][T11645] [ 864.960746][T11645] Kernel Offset: disabled [ 864.965167][T11645] Rebooting in 86400 seconds..