last executing test programs: 12.181687568s ago: executing program 2 (id=2297): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'ip6gre0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x1, 0x4, 0xcbf, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x0, 0x8, 0x0, 0xd65}}) r2 = syz_open_dev$evdev(&(0x7f0000000240), 0x0, 0x0) syz_usb_disconnect(r2) syz_usb_connect$rtl8150(0x0, 0x3f, &(0x7f0000000280)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) ioctl$EVIOCRMFF(r2, 0xc0085508, &(0x7f00000002c0)=0x18) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000140)={0x3, 0x40, 0xfa02, {{0x6000000, 0xfffe, 0x7, @local}, {0xa, 0x0, 0x7ffffffe, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xa8a9}, r1, 0x2}}, 0x48) 11.963429698s ago: executing program 4 (id=2298): syz_mount_image$fuse(0x0, &(0x7f0000000240)='./file0\x00', 0x10504e8, 0x0, 0x1, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) syz_open_dev$dvb_frontend(&(0x7f00000000c0), 0x0, 0x882) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f00000001c0)={0x3, 'veth0_to_batadv\x00', {0x6}, 0xf596}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r2, 0xc0285628, &(0x7f0000000080)={0x3, @win={{0x7, 0x4, 0x806, 0x4}, 0x2, 0x0, &(0x7f00000021c0)={{0x3, 0x2, 0x9, 0x4c}}, 0x3317, 0x0, 0x8}}) socket$inet6(0xa, 0x6, 0xffffffff) r3 = syz_clone3(&(0x7f0000000280)={0x801400, &(0x7f0000000300), 0x0, 0x0, {0x1c}, 0x0, 0x0, 0x0, 0x0}, 0x58) wait4(0xffffffffffffffff, 0x0, 0x40000000, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='ns\x00') getdents(r4, &(0x7f00000003c0)=""/72, 0x48) getdents64(r4, &(0x7f0000002200)=""/4123, 0x101b) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(r3, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) r5 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90f24fc60", 0x14}], 0x1}, 0x0) sendmmsg(r5, &(0x7f0000000fc0)=[{{&(0x7f00000005c0)=@ll={0x11, 0x1b, r1, 0x1, 0x42, 0x6, @remote}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000440)="0745509fe994f535cb2c6ac903a33ad02d18775d883eea20575572f9b2a6c7f907f7853f886a79a9bf1b16", 0x2b}, {&(0x7f0000000500)="0c00000041ee93c3db81e04cc75a5c84308a49c40ea22563e3f870051a0e2e96dc6baafe402923c693f8f91a787c28a11d727886c8000080cf995f603adc", 0x3e}], 0x2, &(0x7f0000000740)=ANY=[@ANYBLOB="180000000000000029000000030000008398630077ff94ee48000000000000000600000088000000071e10fd8f80ca24d075e67d2f012fe289981258c8753f91ecc00f83bb2b6a248405408ee1660ced499a00b48181bf42f2021a21ce000000900000000000000009010000ff0100001b0b2b37932458c54b3004f689bff044190e4a5e2a7e993aef28ccba5207571461224c13d31e8625b1e4cf1fda90ca769ff7952c2885a09d755454ab01f75dd8776a2c130185bb13f48b170aa5fe9d1ef5a46378116cb2433e29f4284842be95132c073bc49e"], 0x1b8}}, {{&(0x7f0000000940)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x4, 0x1, 0x1, 0x3, {0xa, 0x2, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x5}}}, 0x80, &(0x7f0000000dc0)=[{&(0x7f00000009c0)="9afd048a611c07a1b3763584b037f8feb0fb8eccdc6846624d6081568848c21496d864000000000000f7cdfb992735118dcd95fd420868cb04d73c6d80c9f4c29be9f784d7b8250600000000000000a728f8a2526e0954bbbc5c3521849259b9af640caa2109d81aa2469756158d030249e08b772ffb6bc1ad758b2eafe3cbad8df0f952da6ba12c8b1dde73892e42e87e3b4a4693b976c446294f674600"/172, 0xac}, {&(0x7f0000000a80)="e4e9787972f604585c0738b0956174cf6baf8ad342a5b666a244bfa266a937aa8a10abb98da16080581e555490346f66e26bec97faf7acb3efb00548c2cec2be29226bf2ebf79e06ce414226edf1955aa9692e74b78688d83b30059352387258de0d1effff8cee9fb1c3397db9c3ef19e3e70d44006c5625ba005a2fc6dafd421a09beb388170bfa03d5ecd436c82d54ecf9eecc1fed39ea026294d9ae0f137f68cf717e01d106fafc09803f760d1ef38f55773d", 0xb4}, {&(0x7f0000000b80)="ac39fbe9a242dcf6376873f7d56bf1714974bea7940d310b", 0x18}, {&(0x7f0000000bc0)="3483746891710ef34af0f88d120366fd1412f15a6cdff251c3f9a45897d10e000aa2a0ea90b60f3caa2eeede0082b22192347bb0f91b1b769ae50d8d1765b636a22ff00b396fddf103c5c4d871ea5a00bca9c463bd69e1280407ffb0644e77c884d6a1c58b99424374b8d461e1fba8a2f0a1647cbbf0c0d6a511a900842aee025c37655b688aba686c9939690b3cb7b9aca377a8d1e7feb500933cc710132fd6b299749c707025f43655b632f508303a04d9fb5cd5b7c59e7078da5f3750e876d5ff802eaf391c46250b3b1ef7532e0c3dddf147f50a1479f271dd912879610e598308d31c17d9aaf4422eaaddefcab0b2c1550aa49d83f121207b", 0xfb}, {&(0x7f0000000cc0)="d8b9789ffd6394c4b7d81363516a672d101454ee33d8753c9217cb65933e246919f454165cd1e5e30eedbc84a719e3c580f1cbb73090e4e2907bded6b90bbd730ce0647ab3b7fb40afd4ec4d2b36dc7fab53e59213d983b2e1d3f55c22cc102280bc758c1574ee91ac86de6ba9436f06b421002f61b2714427e3a3f410f2b6358bdc125683d06852ebb88358005a06ccecbcc51a6187c65a76b20672677bab3129a94f064de0d6469f853ed8ce6ccca36567480b7881ba6f70b1e3d6077a6b72c2f42a1ebce26a19b832f49632dbb96617c27318198aed63c1", 0xd9}], 0x5, &(0x7f0000001040)=ANY=[@ANYBLOB="00010000000000003a0000000300000536c12a01b2dc74402601287021d9ecd8449a19aa881b531669e8eda15d920db0ef3f382b1d65d7cea550aa82e28ca5443795b753b694b15931dd6cfde21cc7303cafda90d4d1e05da2a98e7a0a25940ba5d5f0c3f3d394dcb57dd4733598ebbcf82251ae11d53564876f85188f262963c9827fabed64493d1dde791e21b3af4326e603b5d06c24006fff5669fa7f37c25d7bdfd759faa54b92a52cc3edea35cf771f95ce66e68154e1e2707f83c341147d06bfc4a019f1688181d11292d3117569571d118e077cec83c8869e90e518bfbc028fecb5269af7a34b7a78ca4ad9660632e652146a0b4ab76ea38d3d8833bb446ce93eead1031bfdb2e469b838e87513000000fa174da7eb8e7989c402e973ade4c26050ecf2f5c3d4a47f2d02b0f820203abe078d5702c57df25a915b2a33c92b415036e08a02fe975b4e407c893018d285da7f40d912b47867362c02c5ae578c9427468087d1fec9324bc1d68a8bf43cea1d7ec34964ddce8f6720c3482f4bf89d5952b19160a5159524164502a5f7e8c82f82994f6fe216a6ae9d0ff946"], 0x100}}], 0x2, 0x4000) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x1c, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x1, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f6000203010902120001000000000904000000ff"], 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000f40)=ANY=[@ANYRESHEX, @ANYRESHEX=r1, @ANYRESDEC, @ANYRESHEX, @ANYRES8, @ANYRES16=r1, @ANYRES64, @ANYRES64], 0x1c}, 0x1, 0x0, 0x0, 0x4801d}, 0x20000804) r6 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r6, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7}, 0x30004084) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r7, 0xc03064ca, &(0x7f0000000140)={0x0, 0x0}) socket$inet_sctp(0x2, 0x1, 0x84) 10.557881193s ago: executing program 3 (id=2303): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@newnexthop={0x30, 0x68, 0x100, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x1, 0x0, 0x4}, [@NHA_BLACKHOLE={0x4}, @NHA_GROUP_TYPE={0x6}, @NHA_FDB={0x4}, @NHA_GROUP_TYPE={0x6}]}, 0x30}, 0x1, 0x0, 0x0, 0x204c815}, 0x8081) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000100)={0x12}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv6_getaddr={0x20, 0x16, 0x1, 0x70bd25, 0x25dfdbfe, {0xa, 0x1, 0x4, 0xfe}, [@IFA_FLAGS={0x8, 0x8, 0x20}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r4, 0xc0189374, &(0x7f0000000280)={{0x1, 0x1, 0x18, r3, {0x1}}, './file0\x00'}) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r6, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x1407, 0x2, 0x70bd2b, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz2\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz2\x00'}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000080) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000400)={'vcan0\x00', 0x0}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x4100, 0x0) getsockopt$inet_sctp_SCTP_NODELAY(r5, 0x84, 0x3, &(0x7f0000000480), &(0x7f00000004c0)=0x4) syz_kvm_setup_syzos_vm$x86(r5, &(0x7f0000c00000/0x400000)=nil) syz_clone(0x50280200, &(0x7f0000000500)="1393e2b60af8e9d117c80ee249505da0ba74975c5636e6571f861c8dd9074c33b170a3d48e97b40c068b6bda5f55d18578276d52b0b68f1c2202719dc8bbc3eee80d145784ab2dc922b0f18d3748b04e63f3f5c07ce9b3501c90cfe91d3d2d8f56b4de84ffaa0dbd1a8d574d4957609c78a979ccf8de6242281fcbcbd8e9ac5653ce0304a74332e5cf3c00ec293bad99e0b0efaa09651df8e201d84df2726cf81f9d4167ef9426d57425b52951b99974824e25", 0xb3, &(0x7f00000005c0), &(0x7f0000000600), &(0x7f0000000640)="20c2c3bbe93b1674f88c665fe9ec208c2ea93ec3f40ae9dac851b9ed79eca5c634451bdaa837db2bb5dc1a9d770c10bc3d00a8f2fccfdbeb25df1ee6858785ad91ea3ffe61efde40c7887dd52cc78a449e4b419695f1676cf732a5e5f26cb4a51a0623c6ce055f5db3ae01029efffad90ff29122e7b5dd7b4e2275de502b33939c91cc18a78e65bc2ca158663874b9a3128b108ac16676ef33ed20a9dc6ce57ab0c16e0bfd300c251037b8af3f42574dec1588953e6527ea04c42e8a6b7650ea206807b6fcc976097b93f1bc5efa4bcb0b0637a0423974a2d96e25c6f5ab9f6d3643dbd1e74bda3394eca062a19d30e0114085b5482e28101cc2e7263d4a4c69600eeb8edb033d34ca8b21ab1ca6d487ab06cce944a7a0059b40d4a5f5e2e0fc0bf73c1550f1ff8de3d1254f50a35ecc255bc6a2a2a7dcf1fbb64ae5b0c1576d259857193c1310c98f6002075bb2728ba555635c89edc86024f8e181caf2246bc865f5c3503e696ae48b9d8cb92c50046af60faeeecc767b61a3084a2f6096049bd87de9d4dbf53b995fd7c339f931cb8e4b69cfb1db649903cb86124861e850e718a4d38a331a898316a42aa2c63efd43bea3b85c5ad0c699a7930ee5259a77d309a2619c8b99d85ba899bc21208356768b43660ccd4eee30e8e5a172ed166dcd7ca4005b05275dafedc5aa722375c21e28d0131998993d2689ac1c4b54ed4d71e129a2f375be7fc5fb46e7d04b0766f6b75b34e53ca0b6dd44571a8a7fe8fca776d2a4d3f1fef3d49e447ce928c8af390ce46650fe8ae03ed37b2fb56d9b40cdfda8b8140ea0fc8f3d1e397ad696cc93dac1a9d3d6889317b534bb2d3e40934d69114c979f62c1ec8a57cb6eea7e53150728e9cd391831bc9e7916785ef2854a85d1b8e5caf82c587c4180563f1dd40444cb7ab8b0c61a1bb8455d4bbfa6c3b5ce49cbbf8f1b2b2180a0b3dad2a6879b28af39c5f29f12bb28fb9697576c5803678472bebcb784759ba9320ee0ffa969642b8a177a06e7fbd086eae855b41fe842a3ebf4718a7a90884f1d162c9129f9de076566d2f45a4acf97a216589e25848d34cd4426bdaa75df38eb5fa3a1da62f97668071b60c244f385b25d213527cffe6e58fe5b451b49ce00b614d54af303de1614dd4793d762f9653a278996fef315ddccb12a311ecdde351ccde64dad8053b2f1e63d1fbcbf76645c84c63ff7da7f699cad110a531f3960506101c6eb991a5355f437a5fd01c1304dad4fe7894b521c79dbcdc6fc03e2eec9bad62b18e010287360c2bbf4e2a262f142aead426c5c5d078dc97a567b1ebfa110be4a4c19192ad2b987f0402403026ba6fe3e6eec91eb00782e5d839e59b5b5c3e75bd64e1315733e353719287de5d993a4e49b82e74d00650cb5a046d394bfe31a20436a521255c6590b8d46169b977ffe7d78419db29299815c7870eefa39685555e2e42745902815ed575109ed1e11f91a75e3055b12f3a1f3bb6addb0a7d3e178acb213657a264d4a75042f7073a42b431870a7de721905a442c527a3d85d9c4cb427c428f7644b6858a87afb8171ba33be8faaf6a667a4bce4b7065e35a78c2d36af36b44fd94dc7e7977653ebcf4afe6d626cbe2646f22b799c463d1a7575ff21952fb86d7766ae04d07e11a3375617f91589c83c8200be4b3100dcddc8d97a411d2d0631de155c910bafd9ecdf505198b62a66c1721b48dcca7cce705624525475157ab8399160192217702e14b66da55c1fccfb3e37618f9669fe3c19b079e9df4d6106b02c27d1588c30df7e89ddd611b41ed1e4e2852c0de6ca756a258519a1f1d77784389318a06c859191d4ad5949699a044ce09962f3fb3cfbfe10a383da0f8f728cfa88ef8cf1c799fc880060ef56fe59ecb0c7dafe544d86a035543cf6780d45440e5fee125ccaba30fbc2d0415b926d1d22f5de37e0665a24139596b80512fec1c76700d73cb9bb56ddb3fd341d8eb2ab1e6911b6972d68c11a3e014c78819c6ddaca8d73028064a30b74f23673fb6a98a9847be3069bde8a8504984cc87baf79a1bc7ec2955d60a407d154c187cab342e8687cca6cff3beea53cebb309805af917194a9dfbca7cc03dae9da6928e5686008e63fb10e12a043fce4db584932cbdfa2b4332f85b41eac6f3e5453d55eed02a83a2ef182e409dc9d6f6ef3b86d759d522a9300f517074a99372aa8cf150a6e1bc317156214879ecabfc6c5eddd83984fac1e0d8d4cfa0e3ab256a270ff57f429bcfc320b0aab31ccb6bb302abc5b3f73e0df199eccc851dae96daa80aa6c6a086d0dd0c96320f85dea6f887ebba820a7a46e725ff77543f88799b1418069fb583d2dd88e38c9cce8966109998b4fff5946d41260bd1940432aea92beb9ba1111c8fb516dadd01efc09bb65f6a60b500022cf5de870c99be439342426ee2543585748420cb04edd13e808b75d6a4000ad000f21e57cf85ec139e58712fc74d2491b590db153ff2bf5e44cd5fff06bc34055ee20db418811c38e4d77ec1152c7c455d440fd5231b650811134c6e33042cbc8e51c9050e91ef628c2155fdf8f3a1b1ed26ff80a795c6fd098724452be207fbde48e18436fee692071c395a1b109a14902bde15ed801acc8a73cb2ec021a714f45bf4002f3490f3dc1fd1d390a738244cf4bb0e56f10b364f88b21f8edf5ab9273c629e2707bdde2710928b389b1b6c6d422321fe87f8c262882b87a50127a50fc3a521e0149d2f79bc0ef38465c7cf93c28eadab06e9412826b67030aa01002feb7fd10ad9c3c001f649cc8782abdf390d5c39ac1f2e54fc99554030aabb365db03ddc21e1a0ce729e1a2881c36a1b86981f8718e9c3ed5f17d90e9ca117b204b7103fb84b66b295b7c9c997b040b0e8647dec3e9d85b485ac522e3ab6e9fa07f3a26f792becbac998ddffb01b6da887fa5104f3b3cdda1595a2b0f7100cec4fe8f07b40e54364a49c167bcc2c706af6ef2a0c8975cc34488cb06517153bde4789862000b473ff12c8c8bafeeba449030c89349ef90b87e218a6a82c65cae1545c462b8300857de0dc7a03c6709c8b2a7d5eaa1814b2ba4b86ed6bc5bc95dd4d4516f3c2e1331e2d8a982007e89df6682f7350d4fde009e27b68d3a67ca3d5c02dae5a32c8b4801bd0315d37d130d1de3c82b2e190b76ab888e2034e92fdf1c65f0dd38deba8a7f011b15cdfe52d8d14e594ca78f06b07de0c36cf277657d75dada3f11b1c1b72978a0274afaebea6671b92ee41a80b0269f5222a7f98b26da6c7eb8985fde119f6c81b3582703c5d7f27bea65c4b696d453e6e8100bbec6d9ba652208adfc76c3287c569fd1ca2c27c2bfd2f6d00448832049b1d370031ce4d04a3428da5aeb00cc74dc592945a9923565ea93b65bd85125e36fcbf2ba8339bcc1297c68d5b98a938169f9bce17b80753dceec049fe8f040521a5e5cd6b7bd40c0294a9ffa6bad784e0087b5fd126082c5b0473dcadbd91f9b85941aefc91525c30a38465f0bc29b34ef87bdea0f0c97c3c054b3dfe0308cef0c03d918a580d40daaab99f6edf7a4a141a9f6aff6a33ea800b5b85ae0a301b98575d078a3c50b90775df1620e4c4edffbb34ef45eb9aeb5a4ff7055d43994dfb321eb1afed92e7ed9cc804690cf8b2c1a9ad2a77ec7b020098a9b452deb24c094bdf3ea79a0ebd03e088fd1adc0b6067ef446ad77206bb2d6a094ecd26830b95610b15cea77a8d6bb67bd4b3da40fbcd33cd77b01a32caf1e2df125a345d5ef5887c7b8f618cc5c6d8d42820861df05ee7182cd42f2eecd1054b9467712d4be80db0a8ba67a1f7cf1dd304ada32b1b80edd15538626afe188b0a7534ef4787eaf81db73e18af8e4c5bb9e7dbc0865ab4b645e6f7ff9edb91ce9c90edd3d5d05c7b5d46c0f44c0fa7bf05d1bbdfdf82d1b630d91db4d66cebf3be6b59ba6668b6d9d735474cb04add42ec8ea3db94c93b9f3ffafdf26cc409dc72bf20025f2cc0a537d8c4061848458d17ac857914caab33034f828d291599ce2c806f2195dbb6103baa1c3e4b88d58d83515c42ef64a8e8300cccbb80a3877cd0f305f8e8422f8e669c42341fa9ac498725c064b185804510cabc36c20c7bac5f86d61ccf62254dcb80e556e11e5477dfc02c50fc789477f9b9d80e894a6c22243d9566c58c725ea2049a70d6800d5be5120099f9f2b5e629526a37929f273d1e188ddfa7c638b7ee032385660e40a530b82640b6944c7c8c7850626e0e3788c0776cee1ebc5673e1ed1a93ccb073575bf828970ceb6ff84a74fec84828fe68080460c0e50127b6849b54f2c0d80094f26526313e46703139a95b4f780b4f501e9a4c35d54d227d4d3b8c504f9c688e41637c4ab6ae243c84d7c88e82544e91cb16af8d48058ae9c48ea88fce04bf526e9b5fe96caaf5557a3b145028cc933013315b8d5e88bb06f0bb491d7487186793f0d8c9e6e7fd647eab88dc1f7af8a44ee5685ab2acb89ff6bfb74f1db0a944b0c893cfce900cd278436d6158e2b6fe2b319fde9c05c373b6a054e7cb8d2af4203e19a1c62d7cb7c97977a02b03eb16a9b23983a58e54c1fcf8f9e5c4fd55a311d1f2cddb75fa062f9e1e564f58f020b88aed849fab1dc9f71bdadc2734e70bb0e1fd8ade7ca46f9fb51d487f9eb6bfebc26a56e3f4f91fa004db9fc01746d16db6a78bdb65eff90bbcfebff0d9640a0a26556db8283e8ee877c10adec4660937fa5bd29089036764453b2b2be06b041e2f36511a122a828244cc159e2a13536286f68f1019bcbbc2e2427ffcb9f87ebec755c5512283cd8ac287c49b050e80beb70df0569a27fa00eeadb6e17e648a26b4f337f6a78d353c42b2a02565071050d35f7d255edfbcef794de164b77fd6c41fea29aa84a1487c9581b9e92d70394f88748e4245eef47f825bd48a530afbe7263701e3f5bce2540bad974ad84d723c6a17ea0926d4648bb92ebcf140a9b529e8edc13001c2c58715f50075a4cfcfe1e4dbe9fc33231683d02a632793570b494547c31650db47733a25f3c88cf99bd2eb5c634999db23720b3c6e3ee85465e9fb964e52141ddefd2f4164cd317e94c331670b0205a4cb0639d93018154c2780a4e8798fe7fce5557ed807db9f38c6fd47c6433d890a74f6810d153d9c931c58c246db9138d0405617d40358fc4eeae3e5f9940cc254bc77e512ffd0ea562d1b0aede23d781775358d3efd534a0da5eea3fea9e61ae3120c05d134f473f6d2270061a782b047a44a98091ce6240aed72240956d39fda1c8391e6a9857d5e836bab15d216fd4bdfafc99fd05ca2ba9decbfef1de9e1593a8edce8cd11437d9b58a5c5c997c2c6cb2443084c6c9b845a7ebdb7bc523cd33b08f4764de22ba2fa0180c378efc0a6d9b6d7b8f5f15187784963e70df09307a4c1ebdb51f6b3a3a34e0b6f02f29d5ad71b6bf0016b948b6636dbc871c34c1a4c7d1b8591bcbd52371fb1b506b71fce9ce7e0150165ff21fd087d2ec6f633569c9b72c658a6915e2489679da93737a9ab79d220cd2d846d00d2004e21408131dcfc55d6c5dcbc0758113952b1bc4b503d3438f0f0c436f38d2776dd7d6b41e07cbb70b86addbe4f2cd525f518bc109d6557d91a6f5f08c759591d9071c13e6b0a868d1705d5dea2c8b5c7e95b79566d64de0a5581af93fe1c3b789c6b6c3ef74ccd5d7f814ec02de151dff7e5c47716967d407c0d321954ce6fb722ea28777eb54472256d03eb71497a68e66141f38450d08aad607b5265f282750e05bd") sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r5, &(0x7f0000001700)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000016c0)={&(0x7f0000001680)={0x18, 0x140c, 0x10, 0x70bd26, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) mprotect(&(0x7f0000f17000/0x2000)=nil, 0x2000, 0x2) ioctl$SNDCTL_DSP_GETIPTR(r5, 0x800c5011, &(0x7f0000001740)) mknodat$loop(r5, &(0x7f0000001780)='./file0\x00', 0x80, 0x1) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000017c0), 0x3) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f0000001800)={0x1, 0x4}, &(0x7f0000001840)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000001880)={r8, 0xa, "256c05c11927285adae4"}, &(0x7f00000018c0)=0x12) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGBITSW(r5, 0x80404525, &(0x7f0000001940)=""/206) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000001a40)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001cc0)={0x18, 0xa, &(0x7f0000001a80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x8}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @ldst={0x2, 0x3, 0x0, 0x7, 0x3, 0x8, 0xffffffffffffffff}, @call={0x85, 0x0, 0x0, 0x82}]}, &(0x7f0000001b00)='GPL\x00', 0x85, 0x8e, &(0x7f0000001b40)=""/142, 0x41000, 0x40, '\x00', r7, 0x0, r5, 0x8, &(0x7f0000001c00)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000001c40)={0x0, 0x5, 0x9d, 0x5}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000001c80)=[r5], 0x0, 0x10, 0x3}, 0x94) getsockopt$inet_sctp_SCTP_EXPOSE_POTENTIALLY_FAILED_STATE(r5, 0x84, 0x83, &(0x7f0000001d80)={r8}, &(0x7f0000001dc0)=0x8) r10 = dup3(r1, r9, 0x80000) ioctl$UI_DEV_CREATE(r10, 0x5501) 10.391563725s ago: executing program 3 (id=2305): r0 = syz_open_dev$sndpcmc(&(0x7f0000000180), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000480)={0x0, [[0xff7ffffe, 0xffffffff, 0xffffffff, 0x1, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xfffffffe, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x7, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}], '\x00', 0x4}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)={0x14, r2, 0x105, 0x70bd25, 0x25dfdbfb, {0x1c}}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x40006) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket(0x840000000002, 0x3, 0x100) connect$inet(r5, &(0x7f0000000a80)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r5, &(0x7f0000000ac0), 0x4000095, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r5, 0x0, 0x29, 0x0, &(0x7f0000000b00)) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a010400000000000000000200000a0900010073797a30000000000900030073797a300000000014000480080001400000000308000240000000004c000000060a010400000000000000000200000a0900010073797a30000000000900020073797a3000000000200004801c0001800a00010071756575650000000c000280060001400000000014000000110001"], 0xd4}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF_FLAGS(r1, 0x84, 0x7a, &(0x7f0000000980)={0x1, 0xffffffffffffffff, 0x80800}, &(0x7f00000009c0)=0xc) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r6, 0x84, 0x16, &(0x7f0000000a00)={0x1, [0x7]}, &(0x7f0000000a40)=0x6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r8, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x2, 0x4d2, @remote}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r8, &(0x7f0000000440)={0x90000019}) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000700), 0xa0201, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000780)='fd/3\x00') io_setup(0x7, &(0x7f00000007c0)=0x0) io_submit(r10, 0x1, &(0x7f0000000800)=[&(0x7f0000000840)={0x0, 0x0, 0x0, 0x5, 0x0, r9, 0x0, 0x0, 0x0, 0x0, 0x2}]) io_submit(0x0, 0x1, &(0x7f0000000b80)=[&(0x7f0000000bc0)={0x0, 0x0, 0x20, 0x8, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffbff}]) read$snddsp(0xffffffffffffffff, &(0x7f0000000c00)=""/219, 0xdb) 10.185256412s ago: executing program 2 (id=2306): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@ccm_128={{0x303}, "63a7d38a4937c1fc", "5f90d5f023d7bd5bd799356c95abffc8", "09fe0891", "0aa3b9dd5fe7a771"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) recvmmsg(r0, &(0x7f0000008140)=[{{0x0, 0x0, &(0x7f00000032c0)=[{&(0x7f00000022c0)=""/4096, 0x1000}], 0x1}, 0x1fff}], 0x1, 0x0, 0x0) writev(r0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 9.036726122s ago: executing program 1 (id=2307): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) writev(r0, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000000580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281", 0xab}, {&(0x7f0000000200)="de21cff472aa580c2ee9f8", 0xb}, {&(0x7f00000014c0)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a0858fe5c7e75ecf92e735452456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9", 0xb4b}], 0x5) 8.961571199s ago: executing program 2 (id=2308): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e23, @empty}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000300)=[@in={0x2, 0x4e21, @local}], 0x10) (async) sendmsg$inet_sctp(r1, &(0x7f0000000340)={&(0x7f0000000380)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000400)='N', 0x1}], 0x1, 0x0, 0x0, 0x8044000}, 0x1) (async) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000440)={0x0, 0x80000081, 0x30}, 0xc) (async) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000480)={0x0, 0x2}, 0x8) (async) write$cgroup_subtree(r2, &(0x7f00000004c0)=ANY=[], 0x32600) (async) write(r2, &(0x7f0000000500)="99", 0x1) (async) sendto$inet6(r0, &(0x7f0000000580)="02a3", 0x2, 0x8081, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000180)=0xb, 0x4) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002"], 0x110) r4 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (async) r5 = fsmount(r4, 0x0, 0x0) fchdir(r5) (async) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0) (async) creat(&(0x7f0000000100)='./file0\x00', 0xde) pwrite64(r7, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) rename(&(0x7f0000000000)='./file2\x00', &(0x7f0000000140)='./file1\x00') (async) syz_usb_connect(0x1, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d0009058223"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) lseek(r6, 0x1, 0x0) (async) setsockopt$inet_group_source_req(r3, 0x0, 0x2c, &(0x7f0000000000)={0x2, {{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e22, @local}}}, 0x108) (async) recvmsg(r0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=""/79, 0x4f}, 0x0) 8.513375586s ago: executing program 4 (id=2309): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@ccm_128={{0x303}, "63a7d38a4937c1fc", "5f90d5f023d7bd5bd799356c95abffc8", "09fe0891", "0aa3b9dd5fe7a771"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) recvmmsg(r0, &(0x7f0000008140)=[{{0x0, 0x0, &(0x7f00000032c0)=[{&(0x7f00000022c0)=""/4096, 0x1000}], 0x1}, 0x1fff}], 0x1, 0x0, 0x0) writev(r0, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000000580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000000200)="de21cff472aa580c2ee9f858", 0xc}], 0x4) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 8.255630721s ago: executing program 3 (id=2310): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000240)={&(0x7f0000000a00)={0x2, 0x3, 0x0, 0x3, 0x10, 0x0, 0x70bd2c, 0x25dfdbff, [@sadb_key={0x2, 0x9, 0x8, 0x80ff, "1c"}, @sadb_address={0x5, 0x6, 0x3c, 0x0, 0x0, @in6={0xa, 0x4e24, 0x8, @mcast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xc, 0xc0000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x9, @empty, 0x6}}]}, 0x80}, 0x1, 0x7}, 0x0) 8.002134102s ago: executing program 4 (id=2311): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0xc0002, 0x0) fcntl$setpipe(r2, 0x407, 0x8) (async) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={'\x00', 0x8, 0xcbf, 0x800, 0x4, 0x3afb894e, 0xffffffffffffffff}) ptrace(0x8, r3) (async) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r4, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x60, 0x140a, 0x200, 0x70bd25, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x4008801}, 0x40881) (async) ioctl$XFS_IOC_FSBULKSTAT(r0, 0xc0205865, &(0x7f0000000380)={&(0x7f0000000240)=0x81, 0x5, &(0x7f0000000280)=[{}], &(0x7f0000000340)}) (async) io_setup(0x0, &(0x7f00000003c0)=0x0) io_destroy(r5) ioctl$KVM_TDX_INIT_VCPU(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000400)={0x2, 0x0, 0x10000}) r6 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r6, 0x111, 0x1, 0x4, 0x4) (async) set_mempolicy(0x2, &(0x7f0000000440)=0x6, 0x10000) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000480)={0x0, 0x0, {}, {0x0, @struct, 0x0}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000880)={r7, 0x0, 0x6, 0x1}) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r8, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x2002}, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000dc0), r8) sendmsg$SEG6_CMD_SET_TUNSRC(r9, &(0x7f0000000e80)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000e40)={&(0x7f0000000e00)={0x30, r10, 0x400, 0x70bd28, 0x25dfdbff, {}, [@SEG6_ATTR_SECRETLEN={0x5}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x1ff, 0x101, 0x754, 0x6]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4084}, 0x8000010) (async) r11 = socket$igmp(0x2, 0x3, 0x2) bind$inet(r11, &(0x7f0000000ec0)={0x2, 0x4e23, @empty}, 0x10) (async) r12 = openat2(0xffffffffffffffff, &(0x7f0000000f00)='./file0\x00', &(0x7f0000000f40)={0xa9280, 0x8}, 0x18) (async) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=@bloom_filter={0x1e, 0xc, 0x5, 0x6, 0x2040, 0x1, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x3, 0x8}, 0x50) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001540)={0xffffffffffffffff, 0xe0, &(0x7f0000001440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001240)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4, &(0x7f0000001280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001300)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x3e, &(0x7f0000001340)=[{}], 0x8, 0x10, &(0x7f0000001380), &(0x7f00000013c0), 0x8, 0xe7, 0x8, 0x8, &(0x7f0000001400)}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001880)={r4, 0xe0, &(0x7f0000001780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f00000015c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, &(0x7f0000001600)=[0x0], &(0x7f0000001640)=[0x0, 0x0, 0x0], 0x0, 0xdf, &(0x7f0000001680)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f00000016c0), &(0x7f0000001700), 0x8, 0xb7, 0x8, 0x8, &(0x7f0000001740)}}, 0x10) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f00000018c0)={{0x1, 0x1, 0x18, r9, {0x8001}}, './file0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000001940)={0x1c, 0x1b, &(0x7f0000001000)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r12}}, @map_fd={0x18, 0x6, 0x1, 0x0, r13}, @map_idx={0x18, 0x2, 0x5, 0x0, 0x1}, @map_idx={0x18, 0x1, 0x5, 0x0, 0x6}, @generic={0xb, 0x0, 0x2, 0x8, 0x3}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001100)='GPL\x00', 0x1f, 0xde, &(0x7f0000001140)=""/222, 0x41100, 0x0, '\x00', r14, @fallback=0xa, r2, 0x8, &(0x7f0000001580)={0x3, 0x4}, 0x8, 0x10, 0x0, 0x0, r15, 0xffffffffffffffff, 0x0, &(0x7f0000001900)=[r16], 0x0, 0x10, 0x80}, 0x94) 7.925373661s ago: executing program 1 (id=2312): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mknodat$loop(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1004, 0x1) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (fail_nth: 27) 7.361873403s ago: executing program 3 (id=2313): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000180)=ANY=[@ANYBLOB="3c1204"], 0x98) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000400)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00@'], 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000006c0)={0x0, 0x1c, &(0x7f0000000780)=[@in6={0xa, 0x4e20, 0x44, @dev={0xfe, 0x80, '\x00', 0x42}, 0x5}]}, &(0x7f00000007c0)=0x10) r1 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x4000000) syz_usb_connect(0x0, 0x45, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r2, &(0x7f0000000040)={&(0x7f00000000c0)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x3456, @local}}, 0x80, 0x0, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000000000000100100000100000001000000000000002f953e18f9f6343c4021428b0f31826478da48b0d83e82df978f4ed072b75dd0efcd2cf3469c0914f01bfd4a0abbc31d9fe3abfd"], 0x18}, 0x0) sendmsg(r2, &(0x7f0000000200)={&(0x7f0000000240)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x3456, @local}}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000300)='hello', 0x5}], 0x1, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000010010000010000000101000000000000140000000000000010010000020000000100000000"], 0x2c}, 0x0) close(r2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0) r3 = syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, &(0x7f0000000080)=0x0) syz_ublk_add_dev(r3, 0x0, r1, r4, 0x0, 0x0) r5 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000340), 0x88002, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000380)=0xd) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0x88800, 0x0) unshare(0x4e000400) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f00000001c0)={0x28, 0x7, 0x0, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f00000005c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) dup(0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000500), 0x202200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000440)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f0000000480)={0x48, 0x2, r8}) 7.352013635s ago: executing program 1 (id=2314): socket(0x2000000000000021, 0x2, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) openat$nullb(0xffffffffffffff9c, &(0x7f0000000640), 0x42042, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="38000000180001000b000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r0], 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x10) 7.034788302s ago: executing program 1 (id=2315): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000180)=ANY=[@ANYBLOB="3c1204"], 0x98) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000400)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00@'], 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000006c0)={0x0, 0x1c, &(0x7f0000000780)=[@in6={0xa, 0x4e20, 0x44, @dev={0xfe, 0x80, '\x00', 0x42}, 0x5}]}, &(0x7f00000007c0)=0x10) r1 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x4000000) syz_usb_connect(0x0, 0x45, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r2, &(0x7f0000000040)={&(0x7f00000000c0)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x3456, @local}}, 0x80, 0x0, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000000000000100100000100000001000000000000002f953e18f9f6343c4021428b0f31826478da48b0d83e82df978f4ed072b75dd0efcd2cf3469c0914f01bfd4a0abbc31d9fe3abfd"], 0x18}, 0x0) sendmsg(r2, &(0x7f0000000200)={&(0x7f0000000240)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x3456, @local}}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000300)='hello', 0x5}], 0x1, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000010010000010000000101000000000000140000000000000010010000020000000100000000"], 0x2c}, 0x0) close(r2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0) r3 = syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, &(0x7f0000000080)=0x0) syz_ublk_add_dev(r3, 0x0, r1, r4, 0x0, 0x0) r5 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000340), 0x88002, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000380)=0xd) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0x88800, 0x0) unshare(0x4e000400) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f00000001c0)={0x28, 0x7, 0x0, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f00000005c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) dup(0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000500), 0x202200, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000440)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f0000000480)={0x48, 0x2, r8}) 6.973990924s ago: executing program 4 (id=2316): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) write$char_usb(r2, 0x0, 0x0) syz_usb_control_io$uac3(r1, 0x0, 0x0) 4.725699329s ago: executing program 2 (id=2319): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000180)={&(0x7f00000001c0)=@hci, 0x80, &(0x7f0000000240), 0x0, 0x0, 0x0, 0xf5ffffff}, 0x3f01) close(r1) r2 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0xa) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x40100, 0x8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x8}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_fw={{0x7}, {0x58, 0x2, [@TCA_FW_ACT={0x54, 0x4, [@m_ctinfo={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x1, 0x3, 0x3, 0xfffffff9, 0x2}}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x4}]}, {0xfffffffffffffeea}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x26044028}, 0x800) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000000740)={'gre0\x00', &(0x7f0000000700)={'syztnl0\x00', 0x0, 0x40, 0x40, 0x4, 0x1, {{0x6, 0x4, 0x2, 0x5, 0x18, 0x67, 0x0, 0x2, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ra={0x94, 0x4}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000800)={'gretap0\x00', &(0x7f0000000780)={'syztnl1\x00', 0x0, 0x10, 0x80, 0x8, 0x1, {{0x9, 0x4, 0x1, 0x3c, 0x24, 0x67, 0x0, 0x4, 0x2f, 0x0, @multicast1, @broadcast, {[@rr={0x7, 0xf, 0x18, [@broadcast, @local, @loopback]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000008c0)={'ip6_vti0\x00', &(0x7f0000000840)={'ip6gre0\x00', 0x0, 0x4, 0x6, 0x2, 0x6, 0x40, @private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x33}, 0x8000, 0x8, 0x7, 0x7}}) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f0000000900)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000940)={'ip6gretap0\x00', 0x0}) sendmsg(r8, &(0x7f0000000980)={&(0x7f00000009c0)=@can={0x1d, r9}, 0x80, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="100000000000d2b54923e99a5f5fccff287654ca1401000009000000"], 0x10}, 0x8044) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000b00)={'erspan0\x00', &(0x7f0000000a80)={'syztnl1\x00', 0x0, 0xfb, 0x8050, 0xb9, 0xb5e7, {{0x13, 0x4, 0x0, 0x0, 0x4c, 0x65, 0x0, 0xe, 0x29, 0x0, @private=0xa010102, @private=0xaaf, {[@noop, @timestamp_addr={0x44, 0x24, 0x35, 0x1, 0x9, [{@broadcast, 0x4}, {@broadcast, 0xffff}, {@empty, 0x7}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7f}]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0xc, 0xca, 0x1, 0x0, [{@remote, 0x2f5b}]}]}}}}}) r11 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000b40)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000c00)=@newqdisc={0x154, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r12, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x124, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x3, 0x80000000, 0x101, 0x1e, 0x1b, 0x18, 0x4}}, @TCA_CHOKE_MAX_P={0x8, 0x3, 0x5}, @TCA_CHOKE_STAB={0x104, 0x2, "e518af9a9db4949de4fd6c0873d7813fe09c8f42011c6115f8b8e540c833e3713bbfb6f5d03a86c6f54be965a62ce187e99eadf60d299309cdcf8d6976e7a6a354311a2c4d5a8825807b2676f8e13b63d7608664579e4f7576c628c1dd41770c07d7119df5a8f759cad967e5db495af37c03d77e17d78b575cf21365e69b6abb4fa73300f7e7cdf951829e1cba4249496de8e9d3acf6ad96e29ddca3aaecefb4d46ce2f874e9285d6ab04a80b5ecee2b75a2751a70ca1d56491a3529804996085c81df96588e8429e422dd0bd3ef7521a307c695622d88dd9215233b8cff9637c253daa637c54348873a546d6b58e64e7cf45483537b5c647d1e2ac5953355b7"}]}}]}, 0x154}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000dc0)={'erspan0\x00', &(0x7f0000000d80)={'ip_vti0\x00', 0x0, 0x8000, 0x10, 0xcb9, 0x7, {{0x7, 0x4, 0x0, 0x3, 0x1c, 0x67, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010102, @broadcast, {[@ra={0x94, 0x4, 0x1}, @end]}}}}}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000e80)={r3, 0x58, &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000ec0)={'wg2\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000001540)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001500)={&(0x7f0000000f00)={0x59c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [{{0x8}, {0x1c4, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x1, 0x0, 0x5, 0x3}, {0x4, 0xf7, 0x2}, {0x5, 0xc, 0xfd}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8, 0x1, r5}, {0x1ec, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r6}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x10000}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x1c0, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x9, 0x4, 0xb8, 0x3}, {0x3ff, 0x0, 0xf9, 0x8}, {0x3, 0x5, 0x4, 0x1}, {0x2, 0x2, 0x62, 0x8cd}, {0x8, 0xa2, 0x4, 0x7}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x31}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r14}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r15}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x1000}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}]}}]}, 0x59c}, 0x1, 0x0, 0x0, 0x8040}, 0x90) fcntl$notify(r4, 0x402, 0x1a) mkdir(&(0x7f00000000c0)='./control\x00', 0x111) rmdir(&(0x7f0000000100)='./control\x00') fchdir(r3) chdir(&(0x7f0000000080)='./sys\x00') r16 = open(&(0x7f0000000040)='./debug\x00', 0x8000, 0x50) getdents(r16, &(0x7f0000001fc0)=""/184, 0xb8) 4.725470911s ago: executing program 0 (id=2320): r0 = syz_open_dev$video(&(0x7f00000008c0), 0x6, 0x40) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000940)={0x2, 0x9, 0x280, "0c337d4a5c68ba73bce7575e3c9ccad755c3ba93633a35a60e80ad0731ba694b", 0x7470060e}) 4.480845912s ago: executing program 3 (id=2321): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@ccm_128={{0x303}, "63a7d38a4937c1fc", "5f90d5f023d7bd5bd799356c95abffc8", "09fe0891", "0aa3b9dd5fe7a771"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) recvmmsg(r0, &(0x7f0000008140)=[{{0x0, 0x0, &(0x7f00000032c0)=[{&(0x7f00000022c0)=""/4096, 0x1000}], 0x1}, 0x1fff}], 0x1, 0x0, 0x0) writev(r0, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000000580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000000200)="de21cff472aa580c2ee9f858", 0xc}], 0x4) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 4.388037719s ago: executing program 0 (id=2322): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) writev(r0, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000000580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281", 0xab}, {&(0x7f0000000200)="de21cff472aa580c2ee9f8", 0xb}, {&(0x7f00000014c0)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a0858fe5c7e75ecf92e735452456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9", 0xb4b}], 0x5) 4.208638161s ago: executing program 2 (id=2323): r0 = syz_open_dev$sndpcmc(&(0x7f0000000180), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000480)={0x0, [[0xff7ffffe, 0xffffffff, 0xffffffff, 0x1, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xfffffffe, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x7, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}], '\x00', 0x4}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)={0x14, r2, 0x105, 0x70bd25, 0x25dfdbfb, {0x1c}}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x40006) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket(0x840000000002, 0x3, 0x100) connect$inet(r5, &(0x7f0000000a80)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r5, &(0x7f0000000ac0), 0x4000095, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r5, 0x0, 0x29, 0x0, &(0x7f0000000b00)) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a010400000000000000000200000a0900010073797a30000000000900030073797a300000000014000480080001400000000308000240000000004c000000060a010400000000000000000200000a0900010073797a30000000000900020073797a3000000000200004801c0001800a00010071756575650000000c000280060001400000000014000000110001"], 0xd4}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF_FLAGS(r1, 0x84, 0x7a, &(0x7f0000000980)={0x1, 0xffffffffffffffff, 0x80800}, &(0x7f00000009c0)=0xc) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r6, 0x84, 0x16, &(0x7f0000000a00)={0x1, [0x7]}, &(0x7f0000000a40)=0x6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r8, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x2, 0x4d2, @remote}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r8, &(0x7f0000000440)={0x90000019}) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000700), 0xa0201, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000780)='fd/3\x00') io_setup(0x7, &(0x7f00000007c0)=0x0) io_submit(r10, 0x1, &(0x7f0000000800)=[&(0x7f0000000840)={0x0, 0x0, 0x0, 0x5, 0x0, r9, 0x0, 0x0, 0x0, 0x0, 0x2}]) io_submit(0x0, 0x1, &(0x7f0000000b80)=[&(0x7f0000000bc0)={0x0, 0x0, 0x20, 0x8, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffbff}]) read$snddsp(0xffffffffffffffff, &(0x7f0000000c00)=""/219, 0xdb) 4.206645542s ago: executing program 1 (id=2324): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x9, 0xa08, 0x7, 0x3, 0x20004, 0xe8c0, 0x20000000000080, 0x2, 0x400, 0xb, 0x20040000004, 0x2, 0x7f, 0x40, 0x3, 0x4], 0x70000, 0x160a55}) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x31, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000040)) 4.061933978s ago: executing program 0 (id=2325): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="60000000100001060000000000000000000000000000000000000000000000000d000300626172657564703000000000300012000c00010062617265756470002000020006000100b51200000600020000080000060003"], 0x60}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x101, 0x2) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f00000002c0)={0xa, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x2, 0x5, 0x1, 0x8, 0xa, 0x0, 0x70bd27, 0x0, [@sadb_address={0x3, 0x6, 0x33, 0x0, 0x0, @in={0x2, 0x1000}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x5, 0xfc, 0xe0000001}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x50}, 0x1, 0x7}, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000180)={0x16, 0x1, 0x1, "ad01feffff4500000000b32cecd875596344abc87f8735e6fd84c387bd1e00", 0x38415261}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, &(0x7f0000000940)={'tunl0\x00', &(0x7f0000000a40)={'ip_vti0\x00', 0x0, 0x19, 0x10, 0xfffffffc, 0x2, {{0x5, 0x4, 0x0, 0x3c, 0x14, 0x65, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=ANY=[@ANYRESDEC], 0x0, 0x3, 0x0, 0x0, 0x41000, 0x61}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r5, &(0x7f00000003c0)=[{{&(0x7f0000000400)={0xa, 0x4e20, 0x9, @dev={0xfe, 0x80, '\x00', 0xe}, 0x5}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000480)="f2", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r5, 0x1) getsockopt$inet_sctp6_SCTP_ASCONF_SUPPORTED(r5, 0x84, 0x80, &(0x7f00000004c0)={0x0, 0x9}, &(0x7f0000000500)=0x8) recvmmsg(r5, &(0x7f0000000bc0)=[{{&(0x7f0000000d00)=@isdn, 0x80, &(0x7f0000000700)=[{&(0x7f00000005c0)=""/241, 0xf1}, {&(0x7f00000006c0)=""/40, 0x28}], 0x2, &(0x7f0000000740)=""/132, 0x84}, 0x9561}, {{&(0x7f0000000800)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000880)=""/54, 0x36}, {&(0x7f0000000d80)=""/144, 0x90}], 0x2, &(0x7f0000000ac0)=""/200, 0xc8}, 0x5}], 0x2, 0x12063, &(0x7f0000000c40)={0x77359400}) writev(r4, &(0x7f0000000140), 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_MSG_GETRULE(r4, &(0x7f0000000cc0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000900)={0x20, 0x7, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x8006) 4.048519409s ago: executing program 3 (id=2326): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5400000013000500010000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000034001a0006000000020000002800048024000880080004000100000006000200010000000800030002000000080004"], 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000180), 0x7, 0x40000) preadv(r3, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/4, 0x4}], 0x1, 0x1, 0x2) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r4, &(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="3801000010000100fdffffbf00010000e000000200000000000000000000000000000000000000000000ffff7f000001000320003c00"/64, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="7f000001000000000000000000000000000004d46c0000007f000001000000000000000000000000000000000000000009000000000000000600000000000000ffff0000000000001c25080000000000020000000000000083000000000000002b06000000000000fcffffffffffffffff7f0000000000001f00000000000000ff0100000000000006000000fcffffff000000002abd700000000000020000fd2000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x20000810) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000400)={{{@in=@empty, @in=@private=0xa010101, 0x0, 0x3, 0xffff, 0x0, 0x2}, {0x9, 0x0, 0xfffffffffffffffd, 0x8, 0x0, 0x0, 0xffffffffffffffff}, {0x401, 0x0, 0x1}, 0x2, 0x0, 0x1, 0x0, 0x6, 0x1}, {{@in=@rand_addr=0x64010102, 0x0, 0x6c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x3d}, 0x0, 0x0, 0x3, 0x0, 0x0, 0x400000, 0xffffffff}}, 0xe8) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) r8 = syz_usb_connect(0x0, 0x24, &(0x7f0000000540)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) r9 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f0000000840)=0x1, 0x4) connect$inet6(r9, &(0x7f0000000880)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) connect$inet6(r9, &(0x7f00000008c0)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, 0x0, 0x0) syz_usb_control_io(r8, &(0x7f0000000580)={0x2c, &(0x7f0000000780)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r8, 0x0, 0x0) r10 = syz_open_dev$dri(&(0x7f00000007c0), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(r10, 0xc00464be, &(0x7f0000000800)) sendmsg$nl_xfrm(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@updpolicy={0x13c, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x0, 0x3ffffffffffffc}, {0xffffffffffffffff, 0x0, 0x0, 0x17ffffffffffb}, 0x40}, [@tmpl={0x84, 0x5, [{{@in6=@private1, 0x0, 0x32}, 0x0, @in6=@rand_addr=' \x01\x00'}, {{@in=@rand_addr=0x64010101, 0x0, 0xff}, 0x0, @in=@local}]}]}, 0x13c}}, 0x0) connect$inet6(r6, &(0x7f0000000500)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) socket$xdp(0x2c, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)={{0x12, 0x1, 0xac877cbec12e8ed0, 0x5d, 0xb9, 0xa3, 0x8, 0xc2e, 0x720, 0xd429, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2b, 0x1, 0x8, 0x4, 0x40, 0x3, "", [{{0x9, 0x4, 0x6d, 0x0, 0x2, 0x78, 0x54, 0x99, 0x1, [], [{{0x9, 0x5, 0x3, 0x8, 0x200, 0x0, 0x5, 0x9, [@generic={0x7, 0x5, "8e33974a95"}]}}, {{0x9, 0x5, 0xb, 0x8, 0x8, 0x8, 0xc, 0x1}}]}}]}}]}}, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 3.565660493s ago: executing program 4 (id=2327): openat$fault_inject(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/fail_usercopy/probability\x00', 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="5400000012000100000000006b000000000a00000000004e22fcffffff000000007ecd00"/56, @ANYRES32=0x0, @ANYBLOB="010000000000000000000000002000000800030006"], 0x54}}, 0x20000080) syz_usb_connect$hid(0x3, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x24040045) io_uring_setup(0x1195, &(0x7f0000000140)={0x0, 0x214f, 0xc000, 0x3, 0xce}) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000780), 0x1c3902, 0x0) r3 = syz_clone(0x40000080, &(0x7f00000007c0)='=>H', 0x3, 0x0, &(0x7f0000001840), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, r3, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000001880)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r2, r2, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f00000018c0)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) timer_create(0x0, 0x0, &(0x7f0000001900)) syz_io_uring_setup(0x6c9a, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = socket$kcm(0x29, 0x5, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001940)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000001980), 0xffffff6a) sendfile(r4, r5, 0x0, 0xffffffff000) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f0000001a80)=0x100000001, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000001ac0)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x2, 0x4e21, @local}, 0x10) syz_clone(0x411, 0x0, 0x0, 0x0, 0x0, 0x0) 3.490653507s ago: executing program 1 (id=2328): ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000340)=@multiplanar_mmap={0x8, 0x2, 0x4, 0x40, 0xa87, {}, {0x2, 0x8, 0x2, 0xe, 0x80, 0x1, "aac9efaa"}, 0xd, 0x1, {&(0x7f0000000080)=[{0x4, 0x61a27bbd, {0xfff0000000000000}, 0x8}, {0x100, 0x158, {0x800}, 0x79000000}]}, 0x1}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001680)={&(0x7f00000016c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001700)={0x0, 0x0, &(0x7f0000001740)={&(0x7f0000001780)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) set_mempolicy(0x4005, &(0x7f0000001940)=0x4, 0x8) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000001980)=ANY=[@ANYBLOB="230000002300000002001200ff19010005"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000019c0)={{r5}, &(0x7f0000001a00), &(0x7f0000001a40)}, 0x20) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000001a80)={r5, &(0x7f0000001ac0), &(0x7f0000001b00)=""/86}, 0x20) sendmsg$nl_route_sched(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001800)={&(0x7f0000001840)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x3, {0x0, 0x0, 0x0, r4, {}, {}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) syz_open_dev$mouse(&(0x7f0000000000), 0x2, 0x12800) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000001440), 0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001480)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x40, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x1}, 0x50) set_mempolicy(0x0, &(0x7f0000001ac0), 0x100) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000001b80), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000001bc0)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000001c00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r8, &(0x7f0000001c40)={0x0, 0x0, &(0x7f0000001c80)={&(0x7f0000001cc0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWCHAIN={0x5c, 0x3, 0xa, 0x76a9bba1a690db0f, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3cb140bb}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1ff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xae60}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000001d80)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000001dc0)={0x0, 0x0, &(0x7f0000001e00)={&(0x7f0000001e40)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffdbc, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) socket(0x400000000010, 0x3, 0x0) move_pages(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2) 3.383676511s ago: executing program 0 (id=2329): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20040001) io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x37b9, 0xc000, 0x3, 0xce}) (fail_nth: 9) 2.849161503s ago: executing program 0 (id=2330): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c040000010201010000000000000000020000032c010a80300002802c00018014000300ff02000000000000000000000000000114000400000000000000000000000000000000005800028006000340000100000c00028005000100060000000c000280050001003a00000006000340000200001400018008000100ffffffff08000200e00000020c00028005000100010000000c00028005000100170000000800014000000000080001400000000008000140000000015800028006000340000100000c00028005000100060000000c000280050001008400000006000340000400002c00018014000300fc010000000000000000000000000001140004000000000000000000000000000000000130000280060003400002000006000340000400001400018008000108ac1414bb080002007f00000106000340000300006c00018006000340000400002c0001"], 0x42c}}, 0x4000000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000003c0)={'syztnl1\x00', &(0x7f00000002c0)={'syztnl0\x00', 0x0, 0x7800, 0x20, 0x41, 0x101, {{0x2e, 0x4, 0x1, 0x39, 0xb8, 0x66, 0x0, 0x0, 0x4, 0x0, @private=0xa010102, @local, {[@timestamp_prespec={0x44, 0x1c, 0xe8, 0x3, 0x4, [{@loopback, 0x1}, {@local, 0x2}, {@dev={0xac, 0x14, 0x14, 0x24}, 0xe}]}, @lsrr={0x83, 0x2b, 0x27, [@local, @multicast1, @broadcast, @multicast1, @rand_addr=0x64010100, @multicast2, @multicast2, @dev={0xac, 0x14, 0x14, 0x22}, @multicast1, @rand_addr=0x64010100]}, @cipso={0x86, 0x4f, 0x1, [{0x6, 0xf, "6080f266183c05722e1e32b953"}, {0x0, 0xc, "66f87c8e0d61727e7667"}, {0x7, 0xe, "ca81c61ace73fd3162cda470"}, {0x2, 0x10, "f376471b4f42d4d5e49afba549f2"}, {0x1, 0x10, "fc79abaa2e6fed733cb604720bdf"}]}, @ssrr={0x89, 0xb, 0xc7, [@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000400)={0x0, @local, @loopback}, &(0x7f0000000440)=0xc) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@delchain={0x17, 0x65, 0x100, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x1, 0x64181b046e585f2f}, {0x48cd5521565b8d04, 0xfff1}, {0xffff, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c0c0}, 0x20000000) getsockname$packet(r4, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e6400"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r5], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@rand_addr, @empty, 0x0}, &(0x7f0000000780)=0xc) r8 = syz_open_dev$vim2m(&(0x7f0000000100), 0x63, 0x2) ioctl$vim2m_VIDIOC_DQBUF(r8, 0xc0585611, &(0x7f00000008c0)=@multiplanar_overlay={0x9, 0x2, 0x4, 0x4000, 0x3, {}, {0x2, 0xc, 0xa, 0x7, 0x8, 0x3, ':&T0'}, 0x4, 0x3, {0x0}, 0xf}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@mpls_delroute={0xec, 0x19, 0x1, 0x70bd2a, 0x25dfdbff, {0x1c, 0x94, 0x0, 0x2, 0x0, 0x4, 0xfe, 0xa, 0x1200}, [@RTA_DST={0x8, 0x1, {0x5}}, @RTA_MULTIPATH={0xc, 0x9, {0x5, 0x11, 0xc, r2}}, @RTA_TTL_PROPAGATE={0x5, 0x1a, 0x5}, @RTA_OIF={0x8, 0x4, r3}, @RTA_TTL_PROPAGATE={0x5, 0x1a, 0x2}, @RTA_OIF={0x8, 0x4, r5}, @RTA_DST={0x8, 0x1, {0x1ff}}, @RTA_NEWDST={0x84, 0x13, [{0x3}, {0x1}, {0x8}, {0x0, 0x0, 0x1}, {0x9}, {0x7}, {0xfff}, {0x400}, {0x9}, {0x8}, {0x2, 0x0, 0x1}, {0x2, 0x0, 0x1}, {}, {0xe4e0, 0x0, 0x1}, {}, {0xb, 0x0, 0x1}, {}, {0x8}, {0x80}, {0x201}, {0x6}, {0x9}, {0x3}, {}, {}, {0x18}, {0x6}, {0x5}, {0x9}, {0x2}, {0xc11}, {0x2}]}, @RTA_DST={0x8, 0x1, {0xae1, 0x0, 0x1}}, @RTA_OIF={0x8, 0x4, r7}]}, 0xec}}, 0x0) 2.065142577s ago: executing program 2 (id=2331): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newqdisc={0xa4, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2a, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdffa], [0x0, 0x0, 0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcd}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x1}]}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000340)=[{&(0x7f0000000400)="290000001e00190f00003fffffffda060200000000e80001dd000804f4ff0900250000000005000000", 0x29}], 0x1) 1.843437002s ago: executing program 0 (id=2332): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000000)={0x0, 0x41, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="289bf521052e11bd94d2459fd3cdd88faa0b14cfd87b795a180108264a6aa03838df161a8eb96927a36d2623afde9974e96d894a4314b04b865153150b86bf85c1496e233a027a204b01ecf4001cafce2295"], 0x34}}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r2 = socket(0x1e, 0x4, 0xb7) connect$tipc(r2, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x1, 0x4}}, 0x10) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000440), &(0x7f00000004c0)=0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000240)={0x1, &(0x7f00000003c0)=[{0x6, 0x85, 0x9, 0x7}]}) syz_io_uring_setup(0x3eae, 0x0, 0x0, &(0x7f0000003580), &(0x7f0000000280)) syz_open_dev$usbmon(&(0x7f0000000300), 0x6, 0x48180) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b0001000010000904330001"], 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x0, 0x10, 0xffffffffffffffff, 0xef412000) r4 = syz_open_dev$sndctrl(&(0x7f0000000040), 0xe26, 0x101400) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r5, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = syz_open_dev$loop(&(0x7f0000000380), 0x7b, 0x1cb604) fadvise64(r6, 0x401, 0xffffffff, 0x4) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r4, 0xc0045520, &(0x7f00000000c0)=""/92) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x2004a001}, 0x8020) r7 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r7, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, 0x0}], 0x1, 0x38, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4400ae8f, &(0x7f0000000140)=@x86={0x4d, 0x3, 0x7, 0x0, 0xf84, 0x8, 0x0, 0xe4, 0x8, 0x7, 0x7, 0x3, 0x0, 0x0, 0x4, 0x8, 0x0, 0x0, 0x0, '\x00', 0x5, 0x20003}) 0s ago: executing program 4 (id=2333): ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000040)={0x8, 0x80000, 0xffffffffffffffff}) ioctl$PPPIOCGNPMODE(0xffffffffffffffff, 0xc008744c, &(0x7f00000002c0)={0x80fd, 0x1}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8983, &(0x7f0000000080)={0x7, 'pim6reg0\x00', {0xfffffffc}, 0x2}) r1 = socket(0xa, 0x80805, 0x0) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x270}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000280)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1}) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000390000/0x1000)=nil) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0xffffffdc, &(0x7f0000000140)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000200)=0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="3f0000000000000030000a000000000000006964676500002000028005000700080000000c002e0003000000030000000600270000000000"], 0x50}}, 0x800) kernel console output (not intermixed with test programs): es leftover after parsing attributes in process `syz.4.1979'. [ 490.001878][T12239] fuse: Bad value for 'user_id' [ 490.001939][T12239] fuse: Bad value for 'user_id' [ 495.686658][ T5679] usb 2-1: USB disconnect, device number 68 [ 496.025817][T12267] input: syz0 as /devices/virtual/input/input50 [ 496.147386][ T5679] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 496.298625][ T5679] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 496.300655][ T5679] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 496.300699][ T5679] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.302919][ T5679] usb 2-1: config 0 descriptor?? [ 496.525290][ T5679] usbhid 2-1:0.0: can't add hid device: -71 [ 496.525356][ T5679] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 496.547022][ T5679] usb 2-1: USB disconnect, device number 69 [ 497.019107][ T5679] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 497.081639][T12274] FAULT_INJECTION: forcing a failure. [ 497.081639][T12274] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 497.081661][T12274] CPU: 1 UID: 0 PID: 12274 Comm: syz.2.1988 Tainted: G L syzkaller #0 PREEMPT(full) [ 497.081676][T12274] Tainted: [L]=SOFTLOCKUP [ 497.081680][T12274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 497.081687][T12274] Call Trace: [ 497.081691][T12274] [ 497.081696][T12274] dump_stack_lvl+0xe8/0x150 [ 497.081720][T12274] should_fail_ex+0x410/0x560 [ 497.081739][T12274] _copy_to_user+0x31/0xb0 [ 497.081752][T12274] simple_read_from_buffer+0xe1/0x170 [ 497.081770][T12274] proc_fail_nth_read+0x1bb/0x230 [ 497.081785][T12274] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 497.081799][T12274] ? rw_verify_area+0x24a/0x4c0 [ 497.081810][T12274] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 497.081822][T12274] vfs_read+0x213/0xa80 [ 497.081834][T12274] ? __pfx___mutex_lock+0x10/0x10 [ 497.081849][T12274] ? __pfx_vfs_read+0x10/0x10 [ 497.081860][T12274] ? __fget_files+0x2a/0x420 [ 497.081874][T12274] ? __fget_files+0x3a2/0x420 [ 497.081887][T12274] ? __fget_files+0x2a/0x420 [ 497.081903][T12274] ? fdget+0x1ac/0x250 [ 497.081916][T12274] ksys_read+0x150/0x270 [ 497.081928][T12274] ? __pfx_ksys_read+0x10/0x10 [ 497.081944][T12274] do_syscall_64+0x166/0x520 [ 497.081957][T12274] ? trace_irq_disable+0x3b/0x140 [ 497.081968][T12274] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.081978][T12274] ? clear_bhb_loop+0x70/0xc0 [ 497.081991][T12274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.082001][T12274] RIP: 0033:0x7f1d54b5fd8e [ 497.082011][T12274] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 497.082027][T12274] RSP: 002b:00007f1d55b0dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 497.082039][T12274] RAX: ffffffffffffffda RBX: 00007f1d55b0e6c0 RCX: 00007f1d54b5fd8e [ 497.082046][T12274] RDX: 000000000000000f RSI: 00007f1d55b0e0a0 RDI: 0000000000000004 [ 497.082053][T12274] RBP: 00007f1d55b0e090 R08: 0000000000000000 R09: 0000000000000000 [ 497.082060][T12274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 497.082066][T12274] R13: 00007f1d54e26038 R14: 00007f1d54e25fa0 R15: 00007f1d54f4fa48 [ 497.082083][T12274] [ 497.204753][ T5679] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 497.218885][ T5679] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 497.218914][ T5679] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.236194][ T5679] usb 2-1: config 0 descriptor?? [ 497.677609][ T5679] usbhid 2-1:0.0: can't add hid device: -71 [ 497.677707][ T5679] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 497.704015][ T5679] usb 2-1: USB disconnect, device number 70 [ 498.657380][T11691] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 498.827589][T11691] usb 1-1: New USB device found, idVendor=057b, idProduct=0000, bcdDevice= 0.00 [ 498.831650][T11691] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 498.831675][T11691] usb 1-1: config 0 has no interfaces? [ 498.831716][T11691] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.877370][T11691] usb 1-1: config 0 descriptor?? [ 499.487438][T11691] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 499.658015][T11691] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 499.666003][T11691] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.666020][T11691] usb 3-1: Product: syz [ 499.666028][T11691] usb 3-1: Manufacturer: syz [ 499.666035][T11691] usb 3-1: SerialNumber: syz [ 499.851522][ T9] usb 1-1: USB disconnect, device number 58 [ 499.931902][T11691] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 500.224440][T12299] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1994'. [ 500.667838][T12295] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1993'. [ 500.920347][ T24] usb 3-1: USB disconnect, device number 65 [ 501.126624][T12312] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1998'. [ 501.181507][T12311] ip_tables: iptables: counters copy to user failed while replacing table [ 501.221889][T11691] usb 3-1: Service connection timeout for: 256 [ 501.221907][T11691] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services [ 501.223050][T11691] ath9k_htc: Failed to initialize the device [ 501.226106][ T24] usb 3-1: ath9k_htc: USB layer deinitialized [ 501.368518][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.368574][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.677447][ T5679] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 502.775981][T12328] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2004'. [ 502.828458][ T5679] usb 3-1: Using ep0 maxpacket: 16 [ 502.829326][ T5679] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 502.830775][ T5679] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 502.830797][ T5679] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 502.882440][ T5679] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.882467][ T5679] usb 3-1: Product: syz [ 502.882550][ T5679] usb 3-1: Manufacturer: syz [ 502.882559][ T5679] usb 3-1: SerialNumber: syz [ 502.913295][ T5679] usb 3-1: 0:2 : does not exist [ 503.105198][ T5679] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 503.175740][ T5679] usb 3-1: USB disconnect, device number 66 [ 503.275525][T12252] udevd[12252]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 504.257881][T11691] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 504.467263][T11691] usb 4-1: Using ep0 maxpacket: 16 [ 504.475173][T11691] usb 4-1: unable to get BOS descriptor or descriptor too short [ 504.475205][T11691] usb 4-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=61.f7 [ 504.502875][T11691] usb 4-1: config 9 has 0 interfaces, different from the descriptor's value: 1 [ 504.524696][T11691] usb 4-1: string descriptor 0 read error: -22 [ 504.524781][T11691] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.917117][ T29] kauditd_printk_skb: 40 callbacks suppressed [ 504.923477][ T29] audit: type=1326 audit(1792674314.380:1501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12346 comm="syz.1.2011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 504.923522][ T29] audit: type=1326 audit(1792674314.390:1502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12346 comm="syz.1.2011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 504.994702][ T29] audit: type=1326 audit(1792674314.460:1503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12346 comm="syz.1.2011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 504.996010][ T29] audit: type=1326 audit(1792674314.460:1504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12346 comm="syz.1.2011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 505.021729][ T29] audit: type=1326 audit(1792674314.470:1505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12346 comm="syz.1.2011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 505.077096][ T29] audit: type=1326 audit(1792674314.540:1506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12346 comm="syz.1.2011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 505.077324][ T29] audit: type=1326 audit(1792674314.540:1507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12346 comm="syz.1.2011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 505.077456][ T29] audit: type=1326 audit(1792674314.550:1508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12346 comm="syz.1.2011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 505.082415][ T29] audit: type=1326 audit(1792674314.550:1509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12346 comm="syz.1.2011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ff6aa7a0dc7 code=0x7ffc0000 [ 505.082877][ T29] audit: type=1326 audit(1792674314.550:1510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12346 comm="syz.1.2011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7ff6aa75fd8e code=0x7ffc0000 [ 505.224465][T12347] netlink: 'syz.1.2011': attribute type 7 has an invalid length. [ 505.224484][T12347] netlink: 'syz.1.2011': attribute type 8 has an invalid length. [ 505.528787][ T87] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 31488 - 0 [ 505.528819][ T87] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 31488 - 0 [ 505.528936][ T87] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 31488 - 0 [ 505.528956][ T87] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 31488 - 0 [ 505.529844][T12356] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2013'. [ 505.529944][T12356] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2013'. [ 505.835317][T12356] xt_CT: No such helper "netbios-ns" [ 506.958300][ T9] usb 4-1: USB disconnect, device number 75 [ 507.888754][T12385] kernel read not supported for file /! (pid: 12385 comm: syz.2.2021) [ 508.828951][ T5679] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 508.984220][ T5679] usb 3-1: Using ep0 maxpacket: 8 [ 508.985034][ T5679] usb 3-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 509.002329][ T5679] usb 3-1: config 64 interface 0 has no altsetting 0 [ 509.004765][ T5679] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.004781][ T5679] usb 3-1: Product: syz [ 509.004797][ T5679] usb 3-1: Manufacturer: syz [ 509.004806][ T5679] usb 3-1: SerialNumber: syz [ 509.050566][ T5679] snd_usb_toneport 3-1:64.0: Line 6 TonePort UX2 found [ 509.408406][ T5679] snd_usb_toneport 3-1:64.0: Line 6 TonePort UX2 now disconnected [ 509.469292][ T5679] snd_usb_toneport 3-1:64.0: probe with driver snd_usb_toneport failed with error -22 [ 509.490060][ T5679] usb 3-1: USB disconnect, device number 67 [ 510.221434][T12414] ip_tables: iptables: counters copy to user failed while replacing table [ 510.297266][T11691] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 510.430297][T12419] ip_tables: iptables: counters copy to user failed while replacing table [ 510.460171][T11691] usb 1-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 510.470237][T11691] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 510.470286][T11691] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 34503, setting to 1024 [ 510.470310][T11691] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 510.470331][T11691] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 510.470369][T11691] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.491337][T12413] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 511.987272][ T9] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 512.148911][ T9] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 512.150398][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 512.150423][ T9] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 512.195183][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.195209][ T9] usb 3-1: Product: syz [ 512.195224][ T9] usb 3-1: Manufacturer: syz [ 512.195237][ T9] usb 3-1: SerialNumber: syz [ 512.304505][T11691] usb 1-1: USB disconnect, device number 59 [ 512.486625][ T9] usb 3-1: Limiting number of CPorts to U8_MAX [ 512.690447][ C0] usb 3-1: invalid arpc response id received: 0 [ 512.908216][T12423] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2031'. [ 512.931856][T12423] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.932373][T12423] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.957223][T11691] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 513.049530][ T9] usb 3-1: failed to set cport flags for port 0 [ 513.049610][ T9] greybus greybus1: 0/0:0: failed to enable host cport: -110 [ 513.084557][ T9] es2_ap_driver 3-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 513.107279][T11691] usb 2-1: Using ep0 maxpacket: 32 [ 513.108344][T11691] usb 2-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 513.110362][T11691] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 513.110408][T11691] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 513.113609][T11691] usb 2-1: config 0 descriptor?? [ 513.205302][T12433] loop8: detected capacity change from 0 to 16384 [ 513.459832][T12434] loop8: detected capacity change from 16384 to 16383 [ 513.461611][ T9] usb 3-1: USB disconnect, device number 68 [ 513.524344][T12435] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2034'. [ 513.594212][T11691] magicmouse 0003:05AC:0265.001E: item fetching failed at offset 5/6 [ 513.602309][T11691] magicmouse 0003:05AC:0265.001E: magicmouse hid parse failed [ 513.602411][T11691] magicmouse 0003:05AC:0265.001E: probe with driver magicmouse failed with error -22 [ 513.915467][T12441] kvm: pic: non byte write [ 514.568075][T12447] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2038'. [ 514.610853][T12447] netlink: 'syz.0.2038': attribute type 1 has an invalid length. [ 514.631239][T12122] syz.3.1952 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 514.644374][T12122] CPU: 0 UID: 0 PID: 12122 Comm: syz.3.1952 Tainted: G L syzkaller #0 PREEMPT(full) [ 514.644406][T12122] Tainted: [L]=SOFTLOCKUP [ 514.644412][T12122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 514.644424][T12122] Call Trace: [ 514.644432][T12122] [ 514.644441][T12122] dump_stack_lvl+0xe8/0x150 [ 514.644476][T12122] dump_header+0xd3/0x4b0 [ 514.644503][T12122] oom_kill_process+0x3ab/0x9e0 [ 514.644535][T12122] out_of_memory+0x1064/0x1480 [ 514.644560][T12122] ? try_charge_memcg+0xc32/0x15e0 [ 514.644598][T12122] ? __pfx_out_of_memory+0x10/0x10 [ 514.644621][T12122] ? do_raw_spin_unlock+0xf5/0x200 [ 514.644658][T12122] try_charge_memcg+0xcdf/0x15e0 [ 514.644704][T12122] ? __pfx_try_charge_memcg+0x10/0x10 [ 514.644752][T12122] ? charge_memcg+0x47/0x310 [ 514.644779][T12122] charge_memcg+0x1dd/0x310 [ 514.644806][T12122] __mem_cgroup_charge+0x25/0x80 [ 514.644831][T12122] shmem_alloc_and_add_folio+0x7bb/0xf60 [ 514.644861][T12122] ? filemap_get_entry+0xcd/0x3f0 [ 514.644899][T12122] ? __pfx_filemap_get_entry+0x10/0x10 [ 514.644925][T12122] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 514.644958][T12122] ? shmem_allowable_huge_orders+0x34c/0x6c0 [ 514.644991][T12122] shmem_get_folio_gfp+0x5d5/0x16d0 [ 514.645031][T12122] shmem_write_begin+0x16c/0x330 [ 514.645065][T12122] generic_perform_write+0x2d5/0x8e0 [ 514.645097][T12122] ? __pfx_generic_perform_write+0x10/0x10 [ 514.645114][T12122] ? down_write+0x166/0x200 [ 514.645131][T12122] ? generic_write_checks_count+0x41a/0x520 [ 514.645161][T12122] ? file_update_time_flags+0x2d5/0x440 [ 514.645187][T12122] shmem_file_write_iter+0xf8/0x120 [ 514.645218][T12122] __kernel_write_iter+0x44a/0x8f0 [ 514.645245][T12122] ? __pfx___kernel_write_iter+0x10/0x10 [ 514.645263][T12122] ? get_dump_page+0x1e6/0x410 [ 514.645310][T12122] ? __asan_memset+0x22/0x50 [ 514.645331][T12122] ? iov_iter_bvec+0xb8/0x180 [ 514.645370][T12122] dump_user_range+0x715/0xca0 [ 514.645415][T12122] ? __pfx_dump_user_range+0x10/0x10 [ 514.645456][T12122] ? __pfx_writenote+0x10/0x10 [ 514.645485][T12122] ? elf_core_dump+0x28d0/0x3a70 [ 514.645519][T12122] elf_core_dump+0x346a/0x3a70 [ 514.645566][T12122] ? __pfx_elf_core_dump+0x10/0x10 [ 514.645592][T12122] ? kasan_save_track+0x4f/0x80 [ 514.645615][T12122] ? do_coredump+0x4ef0/0x69b0 [ 514.645638][T12122] ? vfs_coredump+0xac3/0x10c0 [ 514.645661][T12122] ? get_signal+0x108f/0x12c0 [ 514.645682][T12122] ? arch_do_signal_or_restart+0xbb/0x860 [ 514.645709][T12122] ? irqentry_exit+0x348/0x9b0 [ 514.645732][T12122] ? asm_exc_page_fault+0x26/0x30 [ 514.645803][T12122] ? lock_acquire+0x115/0x350 [ 514.645832][T12122] ? 0xffffffffff600000 [ 514.645866][T12122] do_coredump+0x5e46/0x69b0 [ 514.645920][T12122] ? lock_acquire+0x115/0x350 [ 514.645949][T12122] ? __pfx_do_coredump+0x10/0x10 [ 514.645987][T12122] ? __lock_acquire+0x747/0x2de0 [ 514.646031][T12122] ? __lock_acquire+0x747/0x2de0 [ 514.646076][T12122] ? lock_acquire+0x115/0x350 [ 514.646113][T12122] ? lock_acquire+0x115/0x350 [ 514.646151][T12122] ? is_bpf_text_address+0x26/0x2b0 [ 514.646182][T12122] ? is_bpf_text_address+0x292/0x2b0 [ 514.646205][T12122] ? is_bpf_text_address+0x26/0x2b0 [ 514.646233][T12122] ? kernel_text_address+0xa5/0xe0 [ 514.646254][T12122] ? __kernel_text_address+0xd/0x30 [ 514.646278][T12122] ? unwind_get_return_address+0x4d/0x90 [ 514.646302][T12122] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 514.646332][T12122] ? arch_stack_walk+0xfb/0x150 [ 514.646368][T12122] ? stack_trace_save+0xa9/0x100 [ 514.646397][T12122] ? __pfx_stack_trace_save+0x10/0x10 [ 514.646429][T12122] ? stack_depot_save_flags+0x33/0x7f0 [ 514.646457][T12122] ? kasan_save_track+0x4f/0x80 [ 514.646477][T12122] ? kasan_save_track+0x3e/0x80 [ 514.646497][T12122] ? __kasan_kmalloc+0x93/0xb0 [ 514.646518][T12122] ? __kmalloc_noprof+0x366/0x710 [ 514.646537][T12122] ? security_prepare_creds+0x52/0x360 [ 514.646563][T12122] ? prepare_creds+0x57d/0x820 [ 514.646580][T12122] ? vfs_coredump+0x28a/0x10c0 [ 514.646603][T12122] ? get_signal+0x108f/0x12c0 [ 514.646623][T12122] ? arch_do_signal_or_restart+0xbb/0x860 [ 514.646649][T12122] ? irqentry_exit+0x348/0x9b0 [ 514.646673][T12122] ? asm_exc_page_fault+0x26/0x30 [ 514.646728][T12122] ? __lock_acquire+0x747/0x2de0 [ 514.646787][T12122] ? do_raw_spin_lock+0x12b/0x2f0 [ 514.646824][T12122] ? _raw_spin_unlock_irq+0x23/0x50 [ 514.646852][T12122] vfs_coredump+0xac3/0x10c0 [ 514.646892][T12122] ? __pfx_vfs_coredump+0x10/0x10 [ 514.646951][T12122] ? _raw_spin_unlock_irq+0x23/0x50 [ 514.646980][T12122] get_signal+0x108f/0x12c0 [ 514.647027][T12122] arch_do_signal_or_restart+0xbb/0x860 [ 514.647059][T12122] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 514.647117][T12122] irqentry_exit+0x348/0x9b0 [ 514.647139][T12122] ? trace_irq_disable+0x3b/0x140 [ 514.647164][T12122] asm_exc_page_fault+0x26/0x30 [ 514.647181][T12122] RIP: 0033:0x0 [ 514.647195][T12122] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 514.647205][T12122] RSP: 002b:00002000000002c8 EFLAGS: 00010217 [ 514.647223][T12122] RAX: 0000000000000000 RBX: 00007f8b24626180 RCX: 00007f8b2439f559 [ 514.647237][T12122] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000000 [ 514.647249][T12122] RBP: 00007f8b24436b20 R08: 0000000000000000 R09: 0000000000000000 [ 514.647272][T12122] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 514.647284][T12122] R13: 00007f8b24626218 R14: 00007f8b24626180 R15: 00007f8b2474fa48 [ 514.647319][T12122] [ 515.110443][T12122] memory: usage 306924kB, limit 307200kB, failcnt 21211 [ 515.110465][T12122] memory+swap: usage 416768kB, limit 9007199254740988kB, failcnt 0 [ 515.110479][T12122] kmem: usage 5448kB, limit 9007199254740988kB, failcnt 0 [ 515.110491][T12122] Memory cgroup stats for /syz3: [ 515.110661][T12122] cache 308342784 [ 515.110670][T12122] rss 294912 [ 515.110677][T12122] rss_huge 0 [ 515.110684][T12122] shmem 308342784 [ 515.110691][T12122] mapped_file 8192 [ 515.110698][T12122] dirty 0 [ 515.110705][T12122] writeback 0 [ 515.110711][T12122] workingset_refault_anon 1636 [ 515.110719][T12122] workingset_refault_file 1060 [ 515.110726][T12122] swap 112480256 [ 515.110734][T12122] swapcached 135766016 [ 515.110740][T12122] pgpgin 479483 [ 515.110747][T12122] pgpgout 405662 [ 515.110754][T12122] pgfault 252522 [ 515.110761][T12122] pgmajfault 102 [ 515.110768][T12122] inactive_anon 252940288 [ 515.110775][T12122] active_anon 55447552 [ 515.110782][T12122] inactive_file 0 [ 515.110789][T12122] active_file 0 [ 515.110796][T12122] unevictable 0 [ 515.110803][T12122] hierarchical_memory_limit 314572800 [ 515.110811][T12122] hierarchical_memsw_limit 9223372036854771712 [ 515.110819][T12122] total_cache 308342784 [ 515.110826][T12122] total_rss 294912 [ 515.110838][T12122] total_rss_huge 0 [ 515.110845][T12122] total_shmem 308342784 [ 515.110852][T12122] total_mapped_file 8192 [ 515.110859][T12122] total_dirty 0 [ 515.110866][T12122] total_writeback 0 [ 515.110873][T12122] total_workingset_refault_anon 1677 [ 515.110881][T12122] total_workingset_refault_file 1067 [ 515.110889][T12122] total_swap 112480256 [ 515.110896][T12122] total_swapcached 136138752 [ 515.110904][T12122] total_pgpgin 479612 [ 515.110912][T12122] total_pgpgout 405791 [ 515.110919][T12122] total_pgfault 252836 [ 515.110926][T12122] total_pgmajfault 135 [ 515.110933][T12122] total_inactive_anon 252940288 [ 515.110941][T12122] total_active_anon 55447552 [ 515.110949][T12122] total_inactive_file 0 [ 515.110956][T12122] total_active_file 0 [ 515.110963][T12122] total_unevictable 0 [ 515.110970][T12122] anon_cost 0 [ 515.110977][T12122] file_cost 0 [ 515.110984][T12122] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1952,pid=12143,uid=0 [ 515.113176][T12122] Memory cgroup out of memory: Killed process 12143 (syz.3.1952) total-vm:98968kB, anon-rss:1316kB, file-rss:54080kB, shmem-rss:0kB, UID:0 pgtables:204kB oom_score_adj:1000 [ 515.469515][T12136] syz.3.1952 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 515.469551][T12136] CPU: 0 UID: 0 PID: 12136 Comm: syz.3.1952 Tainted: G L syzkaller #0 PREEMPT(full) [ 515.469577][T12136] Tainted: [L]=SOFTLOCKUP [ 515.469584][T12136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 515.469595][T12136] Call Trace: [ 515.469603][T12136] [ 515.469612][T12136] dump_stack_lvl+0xe8/0x150 [ 515.469646][T12136] dump_header+0xd3/0x4b0 [ 515.469675][T12136] oom_kill_process+0x3ab/0x9e0 [ 515.469706][T12136] out_of_memory+0x1064/0x1480 [ 515.469730][T12136] ? try_charge_memcg+0xc32/0x15e0 [ 515.469769][T12136] ? __pfx_out_of_memory+0x10/0x10 [ 515.469792][T12136] ? do_raw_spin_unlock+0xf5/0x200 [ 515.469828][T12136] try_charge_memcg+0xcdf/0x15e0 [ 515.469875][T12136] ? __pfx_try_charge_memcg+0x10/0x10 [ 515.469921][T12136] ? charge_memcg+0x47/0x310 [ 515.469947][T12136] charge_memcg+0x1dd/0x310 [ 515.469973][T12136] __mem_cgroup_charge+0x25/0x80 [ 515.469996][T12136] shmem_alloc_and_add_folio+0x7bb/0xf60 [ 515.470022][T12136] ? filemap_get_entry+0xcd/0x3f0 [ 515.470058][T12136] ? __pfx_filemap_get_entry+0x10/0x10 [ 515.470085][T12136] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 515.470116][T12136] ? shmem_allowable_huge_orders+0x34c/0x6c0 [ 515.470150][T12136] shmem_get_folio_gfp+0x5d5/0x16d0 [ 515.470199][T12136] shmem_write_begin+0x16c/0x330 [ 515.470234][T12136] generic_perform_write+0x2d5/0x8e0 [ 515.470267][T12136] ? __pfx_generic_perform_write+0x10/0x10 [ 515.470293][T12136] ? __mark_inode_dirty+0x4e7/0x13b0 [ 515.470320][T12136] ? mnt_put_write_access_file+0xc3/0x100 [ 515.470345][T12136] ? file_update_time_flags+0x3ab/0x440 [ 515.470372][T12136] shmem_file_write_iter+0xf8/0x120 [ 515.470403][T12136] __kernel_write_iter+0x44a/0x8f0 [ 515.470431][T12136] ? __pfx___kernel_write_iter+0x10/0x10 [ 515.470449][T12136] ? get_dump_page+0x1e6/0x410 [ 515.470482][T12136] ? __asan_memset+0x22/0x50 [ 515.470504][T12136] ? iov_iter_bvec+0xb8/0x180 [ 515.470536][T12136] dump_user_range+0x715/0xca0 [ 515.470581][T12136] ? __pfx_dump_user_range+0x10/0x10 [ 515.470621][T12136] ? __pfx_writenote+0x10/0x10 [ 515.470649][T12136] ? elf_core_dump+0x28d0/0x3a70 [ 515.470682][T12136] elf_core_dump+0x346a/0x3a70 [ 515.470728][T12136] ? __pfx_elf_core_dump+0x10/0x10 [ 515.470768][T12136] ? irqentry_exit+0x2a0/0x9b0 [ 515.470794][T12136] ? lockdep_hardirqs_on+0x7b/0x110 [ 515.470861][T12136] ? lock_acquire+0x115/0x350 [ 515.470890][T12136] ? 0xffffffffff600000 [ 515.470923][T12136] do_coredump+0x5e46/0x69b0 [ 515.470979][T12136] ? __pfx_do_coredump+0x10/0x10 [ 515.471003][T12136] ? __lock_acquire+0x747/0x2de0 [ 515.471040][T12136] ? __lock_acquire+0x747/0x2de0 [ 515.471083][T12136] ? __lock_acquire+0x747/0x2de0 [ 515.471126][T12136] ? lock_acquire+0x115/0x350 [ 515.471162][T12136] ? lock_acquire+0x115/0x350 [ 515.471195][T12136] ? __lock_acquire+0x747/0x2de0 [ 515.471232][T12136] ? is_bpf_text_address+0x292/0x2b0 [ 515.471255][T12136] ? is_bpf_text_address+0x26/0x2b0 [ 515.471282][T12136] ? kernel_text_address+0xa5/0xe0 [ 515.471308][T12136] ? __kernel_text_address+0xd/0x30 [ 515.471331][T12136] ? do_raw_spin_lock+0x12b/0x2f0 [ 515.471368][T12136] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 515.471395][T12136] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 515.471419][T12136] ? stack_depot_save_flags+0x404/0x7f0 [ 515.471447][T12136] ? kasan_save_track+0x4f/0x80 [ 515.471468][T12136] ? kasan_save_track+0x3e/0x80 [ 515.471488][T12136] ? __kasan_kmalloc+0x93/0xb0 [ 515.471509][T12136] ? __kmalloc_noprof+0x366/0x710 [ 515.471529][T12136] ? security_prepare_creds+0x52/0x360 [ 515.471555][T12136] ? prepare_creds+0x57d/0x820 [ 515.471572][T12136] ? vfs_coredump+0x28a/0x10c0 [ 515.471595][T12136] ? get_signal+0x108f/0x12c0 [ 515.471615][T12136] ? arch_do_signal_or_restart+0xbb/0x860 [ 515.471642][T12136] ? irqentry_exit+0x348/0x9b0 [ 515.471666][T12136] ? exc_general_protection+0x16b/0x1f0 [ 515.471685][T12136] ? asm_exc_general_protection+0x26/0x30 [ 515.471732][T12136] ? __lock_acquire+0x747/0x2de0 [ 515.471787][T12136] ? do_raw_spin_lock+0x12b/0x2f0 [ 515.471822][T12136] ? _raw_spin_unlock_irq+0x23/0x50 [ 515.471849][T12136] vfs_coredump+0xac3/0x10c0 [ 515.471884][T12136] ? __pfx_vfs_coredump+0x10/0x10 [ 515.471914][T12136] ? _raw_spin_unlock_irq+0x23/0x50 [ 515.471928][T12136] get_signal+0x108f/0x12c0 [ 515.471952][T12136] arch_do_signal_or_restart+0xbb/0x860 [ 515.471968][T12136] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 515.471986][T12136] ? force_sig+0xdd/0x130 [ 515.472001][T12136] irqentry_exit+0x348/0x9b0 [ 515.472014][T12136] ? rcu_is_watching+0x16/0xb0 [ 515.472028][T12136] exc_general_protection+0x16b/0x1f0 [ 515.472048][T12136] asm_exc_general_protection+0x26/0x30 [ 515.472059][T12136] RIP: 0033:0x7f8b2439f561 [ 515.472070][T12136] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 515.472079][T12136] RSP: 002b:00002000000002c0 EFLAGS: 00010217 [ 515.472089][T12136] RAX: 0000000000000000 RBX: 00007f8b24626180 RCX: 00007f8b2439f559 [ 515.472097][T12136] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000000 [ 515.472104][T12136] RBP: 00007f8b24436b20 R08: 0000000000000000 R09: 0000000000000000 [ 515.472110][T12136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 515.472117][T12136] R13: 00007f8b24626218 R14: 00007f8b24626180 R15: 00007f8b2474fa48 [ 515.472134][T12136] [ 515.524688][T12136] memory: usage 307200kB, limit 307200kB, failcnt 21224 [ 515.524708][T12136] memory+swap: usage 417044kB, limit 9007199254740988kB, failcnt 0 [ 515.524721][T12136] kmem: usage 5436kB, limit 9007199254740988kB, failcnt 0 [ 515.524733][T12136] Memory cgroup stats for /syz3: [ 515.981442][T12136] cache 308699136 [ 515.981458][T12136] rss 294912 [ 515.981465][T12136] rss_huge 0 [ 515.981473][T12136] shmem 308699136 [ 515.981480][T12136] mapped_file 8192 [ 515.981487][T12136] dirty 0 [ 515.981493][T12136] writeback 0 [ 515.981500][T12136] workingset_refault_anon 1636 [ 515.981508][T12136] workingset_refault_file 1060 [ 515.981515][T12136] swap 112480256 [ 515.981523][T12136] swapcached 135766016 [ 515.981530][T12136] pgpgin 479570 [ 515.981536][T12136] pgpgout 405662 [ 515.981543][T12136] pgfault 252522 [ 515.981550][T12136] pgmajfault 102 [ 515.981557][T12136] inactive_anon 248811520 [ 515.981564][T12136] active_anon 59998208 [ 515.981571][T12136] inactive_file 0 [ 515.981578][T12136] active_file 0 [ 515.981585][T12136] unevictable 0 [ 515.981593][T12136] hierarchical_memory_limit 314572800 [ 515.981601][T12136] hierarchical_memsw_limit 9223372036854771712 [ 515.981609][T12136] total_cache 308699136 [ 515.981616][T12136] total_rss 294912 [ 515.981623][T12136] total_rss_huge 0 [ 515.981631][T12136] total_shmem 308699136 [ 515.981638][T12136] total_mapped_file 8192 [ 515.981645][T12136] total_dirty 0 [ 515.981652][T12136] total_writeback 0 [ 515.981659][T12136] total_workingset_refault_anon 1677 [ 515.981667][T12136] total_workingset_refault_file 1067 [ 515.981675][T12136] total_swap 112480256 [ 515.981694][T12136] total_swapcached 136138752 [ 515.981701][T12136] total_pgpgin 479699 [ 515.981708][T12136] total_pgpgout 405791 [ 515.981716][T12136] total_pgfault 252836 [ 515.981723][T12136] total_pgmajfault 135 [ 515.981730][T12136] total_inactive_anon 248811520 [ 515.981738][T12136] total_active_anon 59998208 [ 515.981746][T12136] total_inactive_file 0 [ 515.981753][T12136] total_active_file 0 [ 515.981760][T12136] total_unevictable 0 [ 515.981767][T12136] anon_cost 0 [ 515.981773][T12136] file_cost 0 [ 515.981781][T12136] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1952,pid=12136,uid=0 [ 515.982493][T12136] Memory cgroup out of memory: Killed process 12136 (syz.3.1952) total-vm:98968kB, anon-rss:1316kB, file-rss:54080kB, shmem-rss:0kB, UID:0 pgtables:204kB oom_score_adj:1000 [ 516.319413][T12130] syz.3.1952 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 516.319448][T12130] CPU: 1 UID: 0 PID: 12130 Comm: syz.3.1952 Tainted: G L syzkaller #0 PREEMPT(full) [ 516.319473][T12130] Tainted: [L]=SOFTLOCKUP [ 516.319482][T12130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 516.319494][T12130] Call Trace: [ 516.319505][T12130] [ 516.319514][T12130] dump_stack_lvl+0xe8/0x150 [ 516.319547][T12130] dump_header+0xd3/0x4b0 [ 516.319576][T12130] oom_kill_process+0x3ab/0x9e0 [ 516.319608][T12130] out_of_memory+0x1064/0x1480 [ 516.319631][T12130] ? try_charge_memcg+0xc32/0x15e0 [ 516.319669][T12130] ? __pfx_out_of_memory+0x10/0x10 [ 516.319691][T12130] ? do_raw_spin_unlock+0xf5/0x200 [ 516.319727][T12130] try_charge_memcg+0xcdf/0x15e0 [ 516.319773][T12130] ? __pfx_try_charge_memcg+0x10/0x10 [ 516.319825][T12130] ? charge_memcg+0x47/0x310 [ 516.319854][T12130] charge_memcg+0x1dd/0x310 [ 516.319881][T12130] __mem_cgroup_charge+0x25/0x80 [ 516.319905][T12130] shmem_alloc_and_add_folio+0x7bb/0xf60 [ 516.319934][T12130] ? filemap_get_entry+0xcd/0x3f0 [ 516.319972][T12130] ? __pfx_filemap_get_entry+0x10/0x10 [ 516.319996][T12130] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 516.320028][T12130] ? shmem_allowable_huge_orders+0x34c/0x6c0 [ 516.320050][T12130] shmem_get_folio_gfp+0x5d5/0x16d0 [ 516.320073][T12130] shmem_write_begin+0x16c/0x330 [ 516.320091][T12130] generic_perform_write+0x2d5/0x8e0 [ 516.320108][T12130] ? __pfx_generic_perform_write+0x10/0x10 [ 516.320119][T12130] ? __mark_inode_dirty+0x4e7/0x13b0 [ 516.320132][T12130] ? mnt_put_write_access_file+0xc3/0x100 [ 516.320145][T12130] ? file_update_time_flags+0x3ab/0x440 [ 516.320160][T12130] shmem_file_write_iter+0xf8/0x120 [ 516.320175][T12130] __kernel_write_iter+0x44a/0x8f0 [ 516.320190][T12130] ? __pfx___kernel_write_iter+0x10/0x10 [ 516.320199][T12130] ? get_dump_page+0x1e6/0x410 [ 516.320216][T12130] ? __asan_memset+0x22/0x50 [ 516.320227][T12130] ? iov_iter_bvec+0xb8/0x180 [ 516.320244][T12130] dump_user_range+0x715/0xca0 [ 516.320267][T12130] ? __pfx_dump_user_range+0x10/0x10 [ 516.320291][T12130] ? __pfx_writenote+0x10/0x10 [ 516.320306][T12130] ? elf_core_dump+0x28d0/0x3a70 [ 516.320323][T12130] elf_core_dump+0x346a/0x3a70 [ 516.320347][T12130] ? __pfx_elf_core_dump+0x10/0x10 [ 516.320360][T12130] ? kasan_save_track+0x4f/0x80 [ 516.320372][T12130] ? do_coredump+0x4ef0/0x69b0 [ 516.320384][T12130] ? vfs_coredump+0xac3/0x10c0 [ 516.320395][T12130] ? get_signal+0x108f/0x12c0 [ 516.320406][T12130] ? arch_do_signal_or_restart+0xbb/0x860 [ 516.320421][T12130] ? irqentry_exit+0x348/0x9b0 [ 516.320434][T12130] ? asm_exc_page_fault+0x26/0x30 [ 516.320470][T12130] ? lock_acquire+0x115/0x350 [ 516.320486][T12130] ? 0xffffffffff600000 [ 516.320504][T12130] do_coredump+0x5e46/0x69b0 [ 516.320533][T12130] ? __pfx_do_coredump+0x10/0x10 [ 516.320546][T12130] ? lock_acquire+0x115/0x350 [ 516.320564][T12130] ? __lock_acquire+0x747/0x2de0 [ 516.320586][T12130] ? __lock_acquire+0x747/0x2de0 [ 516.320609][T12130] ? lock_acquire+0x115/0x350 [ 516.320627][T12130] ? lock_acquire+0x115/0x350 [ 516.320646][T12130] ? is_bpf_text_address+0x26/0x2b0 [ 516.320662][T12130] ? is_bpf_text_address+0x292/0x2b0 [ 516.320674][T12130] ? is_bpf_text_address+0x26/0x2b0 [ 516.320688][T12130] ? kernel_text_address+0xa5/0xe0 [ 516.320699][T12130] ? __kernel_text_address+0xd/0x30 [ 516.320709][T12130] ? unwind_get_return_address+0x4d/0x90 [ 516.320721][T12130] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 516.320737][T12130] ? arch_stack_walk+0xfb/0x150 [ 516.320756][T12130] ? stack_trace_save+0xa9/0x100 [ 516.320769][T12130] ? __pfx_stack_trace_save+0x10/0x10 [ 516.320792][T12130] ? stack_depot_save_flags+0x33/0x7f0 [ 516.320807][T12130] ? kasan_save_track+0x4f/0x80 [ 516.320817][T12130] ? kasan_save_track+0x3e/0x80 [ 516.320827][T12130] ? __kasan_kmalloc+0x93/0xb0 [ 516.320838][T12130] ? __kmalloc_noprof+0x366/0x710 [ 516.320848][T12130] ? security_prepare_creds+0x52/0x360 [ 516.320862][T12130] ? prepare_creds+0x57d/0x820 [ 516.320871][T12130] ? vfs_coredump+0x28a/0x10c0 [ 516.320883][T12130] ? get_signal+0x108f/0x12c0 [ 516.320892][T12130] ? arch_do_signal_or_restart+0xbb/0x860 [ 516.320906][T12130] ? irqentry_exit+0x348/0x9b0 [ 516.320918][T12130] ? asm_exc_page_fault+0x26/0x30 [ 516.320943][T12130] ? __lock_acquire+0x747/0x2de0 [ 516.320972][T12130] ? do_raw_spin_lock+0x12b/0x2f0 [ 516.320991][T12130] ? _raw_spin_unlock_irq+0x23/0x50 [ 516.321005][T12130] vfs_coredump+0xac3/0x10c0 [ 516.321026][T12130] ? __pfx_vfs_coredump+0x10/0x10 [ 516.321055][T12130] ? _raw_spin_unlock_irq+0x23/0x50 [ 516.321069][T12130] get_signal+0x108f/0x12c0 [ 516.321093][T12130] arch_do_signal_or_restart+0xbb/0x860 [ 516.321109][T12130] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 516.321135][T12130] irqentry_exit+0x348/0x9b0 [ 516.321147][T12130] ? trace_irq_disable+0x3b/0x140 [ 516.321162][T12130] asm_exc_page_fault+0x26/0x30 [ 516.321172][T12130] RIP: 0033:0x0 [ 516.321181][T12130] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 516.321186][T12130] RSP: 002b:00002000000002c8 EFLAGS: 00010217 [ 516.321197][T12130] RAX: 0000000000000000 RBX: 00007f8b24626180 RCX: 00007f8b2439f559 [ 516.321204][T12130] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000000 [ 516.321211][T12130] RBP: 00007f8b24436b20 R08: 0000000000000000 R09: 0000000000000000 [ 516.321217][T12130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 516.321223][T12130] R13: 00007f8b24626218 R14: 00007f8b24626180 R15: 00007f8b2474fa48 [ 516.321241][T12130] [ 516.537269][ T5601] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 516.728750][T11691] usb 2-1: USB disconnect, device number 71 [ 516.839939][ T5601] usb 1-1: Using ep0 maxpacket: 8 [ 516.878530][ T5601] usb 1-1: New USB device found, idVendor=04b4, idProduct=8613, bcdDevice=95.8f [ 516.895732][ T5601] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 516.895759][ T5601] usb 1-1: Product: syz [ 516.895773][ T5601] usb 1-1: Manufacturer: syz [ 516.895787][ T5601] usb 1-1: SerialNumber: syz [ 516.904436][T12130] memory: usage 307200kB, limit 307200kB, failcnt 21285 [ 516.904457][T12130] memory+swap: usage 417044kB, limit 9007199254740988kB, failcnt 0 [ 516.904470][T12130] kmem: usage 5216kB, limit 9007199254740988kB, failcnt 0 [ 516.904483][T12130] Memory cgroup stats for /syz3: [ 516.904598][T12130] cache 309043200 [ 516.904607][T12130] rss 143360 [ 516.904620][T12130] rss_huge 0 [ 516.904627][T12130] shmem 309043200 [ 516.904634][T12130] mapped_file 0 [ 516.904641][T12130] dirty 0 [ 516.904648][T12130] writeback 0 [ 516.904654][T12130] workingset_refault_anon 1636 [ 516.904662][T12130] workingset_refault_file 1060 [ 516.904670][T12130] swap 112480256 [ 516.904676][T12130] swapcached 135766016 [ 516.904683][T12130] pgpgin 479654 [ 516.904691][T12130] pgpgout 405699 [ 516.904697][T12130] pgfault 252522 [ 516.904704][T12130] pgmajfault 102 [ 516.904711][T12130] inactive_anon 244977664 [ 516.904718][T12130] active_anon 63918080 [ 516.904725][T12130] inactive_file 0 [ 516.904732][T12130] active_file 0 [ 516.904739][T12130] unevictable 0 [ 516.904746][T12130] hierarchical_memory_limit 314572800 [ 516.904754][T12130] hierarchical_memsw_limit 9223372036854771712 [ 516.904762][T12130] total_cache 309043200 [ 516.904769][T12130] total_rss 143360 [ 516.904776][T12130] total_rss_huge 0 [ 516.904783][T12130] total_shmem 309043200 [ 516.904791][T12130] total_mapped_file 0 [ 516.904798][T12130] total_dirty 0 [ 516.904804][T12130] total_writeback 0 [ 516.904811][T12130] total_workingset_refault_anon 1677 [ 516.904819][T12130] total_workingset_refault_file 1067 [ 516.904827][T12130] total_swap 112480256 [ 516.904834][T12130] total_swapcached 136138752 [ 516.904841][T12130] total_pgpgin 479783 [ 516.904849][T12130] total_pgpgout 405828 [ 516.904856][T12130] total_pgfault 252836 [ 516.904863][T12130] total_pgmajfault 135 [ 516.904870][T12130] total_inactive_anon 244977664 [ 516.904877][T12130] total_active_anon 63918080 [ 516.904885][T12130] total_inactive_file 0 [ 516.904892][T12130] total_active_file 0 [ 516.904900][T12130] total_unevictable 0 [ 516.904906][T12130] anon_cost 0 [ 516.904912][T12130] file_cost 0 [ 516.904920][T12130] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1952,pid=12131,uid=0 [ 516.906930][T12130] Memory cgroup out of memory: Killed process 12131 (syz.3.1952) total-vm:98836kB, anon-rss:1308kB, file-rss:54080kB, shmem-rss:0kB, UID:0 pgtables:200kB oom_score_adj:1000 [ 516.991820][ T5601] usb 1-1: config 0 descriptor?? [ 517.130219][ T5601] usbtest 1-1:0.0: FX2 device [ 517.130240][ T5601] usbtest 1-1:0.0: high-speed {control bulk-in bulk-out} tests (+alt) [ 517.380093][T12450] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 517.382905][T12450] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 517.457038][ T32] oom_reaper: reaped process 12143 (syz.3.1952), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB [ 517.457786][T12123] syz.3.1952 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 517.457824][T12123] CPU: 1 UID: 0 PID: 12123 Comm: syz.3.1952 Tainted: G L syzkaller #0 PREEMPT(full) [ 517.457851][T12123] Tainted: [L]=SOFTLOCKUP [ 517.457859][T12123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 517.457871][T12123] Call Trace: [ 517.457879][T12123] [ 517.457887][T12123] dump_stack_lvl+0xe8/0x150 [ 517.457919][T12123] dump_header+0xd3/0x4b0 [ 517.457947][T12123] oom_kill_process+0x3ab/0x9e0 [ 517.457977][T12123] out_of_memory+0x1064/0x1480 [ 517.458000][T12123] ? try_charge_memcg+0xc32/0x15e0 [ 517.458037][T12123] ? __pfx_out_of_memory+0x10/0x10 [ 517.458059][T12123] ? do_raw_spin_unlock+0xf5/0x200 [ 517.458102][T12123] try_charge_memcg+0xcdf/0x15e0 [ 517.458145][T12123] ? __pfx_try_charge_memcg+0x10/0x10 [ 517.458188][T12123] ? charge_memcg+0x47/0x310 [ 517.458214][T12123] charge_memcg+0x1dd/0x310 [ 517.458240][T12123] __mem_cgroup_charge+0x25/0x80 [ 517.458264][T12123] shmem_alloc_and_add_folio+0x7bb/0xf60 [ 517.458291][T12123] ? filemap_get_entry+0xcd/0x3f0 [ 517.458326][T12123] ? __pfx_filemap_get_entry+0x10/0x10 [ 517.458351][T12123] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 517.458382][T12123] ? shmem_allowable_huge_orders+0x34c/0x6c0 [ 517.458414][T12123] shmem_get_folio_gfp+0x5d5/0x16d0 [ 517.458457][T12123] shmem_write_begin+0x16c/0x330 [ 517.458490][T12123] generic_perform_write+0x2d5/0x8e0 [ 517.458522][T12123] ? __pfx_generic_perform_write+0x10/0x10 [ 517.458538][T12123] ? down_write+0x166/0x200 [ 517.458555][T12123] ? generic_write_checks_count+0x41a/0x520 [ 517.458585][T12123] ? file_update_time_flags+0x2d5/0x440 [ 517.458610][T12123] shmem_file_write_iter+0xf8/0x120 [ 517.458639][T12123] __kernel_write_iter+0x44a/0x8f0 [ 517.458663][T12123] ? __pfx___kernel_write_iter+0x10/0x10 [ 517.458680][T12123] ? get_dump_page+0x1e6/0x410 [ 517.458711][T12123] ? __asan_memset+0x22/0x50 [ 517.458731][T12123] ? iov_iter_bvec+0xb8/0x180 [ 517.458761][T12123] dump_user_range+0x715/0xca0 [ 517.458809][T12123] ? __pfx_dump_user_range+0x10/0x10 [ 517.458847][T12123] ? __pfx_writenote+0x10/0x10 [ 517.458875][T12123] ? elf_core_dump+0x28d0/0x3a70 [ 517.458907][T12123] elf_core_dump+0x346a/0x3a70 [ 517.458952][T12123] ? __pfx_elf_core_dump+0x10/0x10 [ 517.458976][T12123] ? kasan_save_track+0x4f/0x80 [ 517.458998][T12123] ? do_coredump+0x4ef0/0x69b0 [ 517.459020][T12123] ? vfs_coredump+0xac3/0x10c0 [ 517.459042][T12123] ? get_signal+0x108f/0x12c0 [ 517.459061][T12123] ? arch_do_signal_or_restart+0xbb/0x860 [ 517.459087][T12123] ? irqentry_exit+0x348/0x9b0 [ 517.459109][T12123] ? asm_exc_page_fault+0x26/0x30 [ 517.459176][T12123] ? lock_acquire+0x115/0x350 [ 517.459203][T12123] ? 0xffffffffff600000 [ 517.459234][T12123] do_coredump+0x5e46/0x69b0 [ 517.459288][T12123] ? __pfx_do_coredump+0x10/0x10 [ 517.459313][T12123] ? lock_acquire+0x115/0x350 [ 517.459346][T12123] ? __lock_acquire+0x747/0x2de0 [ 517.459386][T12123] ? __lock_acquire+0x747/0x2de0 [ 517.459429][T12123] ? lock_acquire+0x115/0x350 [ 517.459462][T12123] ? lock_acquire+0x115/0x350 [ 517.459499][T12123] ? is_bpf_text_address+0x26/0x2b0 [ 517.459527][T12123] ? is_bpf_text_address+0x292/0x2b0 [ 517.459549][T12123] ? is_bpf_text_address+0x26/0x2b0 [ 517.459573][T12123] ? kernel_text_address+0xa5/0xe0 [ 517.459593][T12123] ? __kernel_text_address+0xd/0x30 [ 517.459610][T12123] ? unwind_get_return_address+0x4d/0x90 [ 517.459633][T12123] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 517.459661][T12123] ? arch_stack_walk+0xfb/0x150 [ 517.459694][T12123] ? stack_trace_save+0xa9/0x100 [ 517.459721][T12123] ? __pfx_stack_trace_save+0x10/0x10 [ 517.459751][T12123] ? stack_depot_save_flags+0x33/0x7f0 [ 517.459777][T12123] ? kasan_save_track+0x4f/0x80 [ 517.459802][T12123] ? kasan_save_track+0x3e/0x80 [ 517.459822][T12123] ? __kasan_kmalloc+0x93/0xb0 [ 517.459842][T12123] ? __kmalloc_noprof+0x366/0x710 [ 517.459860][T12123] ? security_prepare_creds+0x52/0x360 [ 517.459884][T12123] ? prepare_creds+0x57d/0x820 [ 517.459900][T12123] ? vfs_coredump+0x28a/0x10c0 [ 517.459934][T12123] ? get_signal+0x108f/0x12c0 [ 517.459953][T12123] ? arch_do_signal_or_restart+0xbb/0x860 [ 517.459977][T12123] ? irqentry_exit+0x348/0x9b0 [ 517.459999][T12123] ? asm_exc_page_fault+0x26/0x30 [ 517.460045][T12123] ? __lock_acquire+0x747/0x2de0 [ 517.460100][T12123] ? do_raw_spin_lock+0x12b/0x2f0 [ 517.460133][T12123] ? _raw_spin_unlock_irq+0x23/0x50 [ 517.460160][T12123] vfs_coredump+0xac3/0x10c0 [ 517.460196][T12123] ? __pfx_vfs_coredump+0x10/0x10 [ 517.460252][T12123] ? _raw_spin_unlock_irq+0x23/0x50 [ 517.460277][T12123] get_signal+0x108f/0x12c0 [ 517.460320][T12123] arch_do_signal_or_restart+0xbb/0x860 [ 517.460350][T12123] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 517.460399][T12123] irqentry_exit+0x348/0x9b0 [ 517.460422][T12123] ? trace_irq_disable+0x3b/0x140 [ 517.460447][T12123] asm_exc_page_fault+0x26/0x30 [ 517.460465][T12123] RIP: 0033:0x0 [ 517.460479][T12123] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 517.460489][T12123] RSP: 002b:00002000000002c8 EFLAGS: 00010217 [ 517.460507][T12123] RAX: 0000000000000000 RBX: 00007f8b24626180 RCX: 00007f8b2439f559 [ 517.460520][T12123] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000000 [ 517.460532][T12123] RBP: 00007f8b24436b20 R08: 0000000000000000 R09: 0000000000000000 [ 517.460543][T12123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 517.460554][T12123] R13: 00007f8b24626218 R14: 00007f8b24626180 R15: 00007f8b2474fa48 [ 517.460586][T12123] [ 517.461342][T12123] memory: usage 307200kB, limit 307200kB, failcnt 21343 [ 517.461358][T12123] memory+swap: usage 416996kB, limit 9007199254740988kB, failcnt 0 [ 517.461371][T12123] kmem: usage 5188kB, limit 9007199254740988kB, failcnt 0 [ 517.461383][T12123] Memory cgroup stats for /syz3: [ 517.461503][T12123] cache 309084160 [ 517.461512][T12123] rss 143360 [ 517.461519][T12123] rss_huge 0 [ 517.461526][T12123] shmem 309084160 [ 517.461533][T12123] mapped_file 0 [ 517.461540][T12123] dirty 0 [ 517.461546][T12123] writeback 0 [ 517.461554][T12123] workingset_refault_anon 1636 [ 517.461561][T12123] workingset_refault_file 1060 [ 517.461568][T12123] swap 112431104 [ 517.461576][T12123] swapcached 135766016 [ 517.461583][T12123] pgpgin 479666 [ 517.461589][T12123] pgpgout 405701 [ 517.461596][T12123] pgfault 252525 [ 517.461602][T12123] pgmajfault 102 [ 517.461609][T12123] inactive_anon 241561600 [ 517.461617][T12123] active_anon 67416064 [ 517.461624][T12123] inactive_file 0 [ 517.461631][T12123] active_file 0 [ 517.461638][T12123] unevictable 0 [ 517.461645][T12123] hierarchical_memory_limit 314572800 [ 517.461653][T12123] hierarchical_memsw_limit 9223372036854771712 [ 517.461661][T12123] total_cache 309084160 [ 517.461669][T12123] total_rss 143360 [ 517.461675][T12123] total_rss_huge 0 [ 517.461682][T12123] total_shmem 309084160 [ 517.461689][T12123] total_mapped_file 0 [ 517.461696][T12123] total_dirty 0 [ 517.461703][T12123] total_writeback 0 [ 517.461710][T12123] total_workingset_refault_anon 1677 [ 517.462097][T12123] total_workingset_refault_file 1067 [ 517.462107][T12123] total_swap 112431104 [ 517.462114][T12123] total_swapcached 136138752 [ 517.462122][T12123] total_pgpgin 479795 [ 517.462129][T12123] total_pgpgout 405830 [ 517.462136][T12123] total_pgfault 252839 [ 517.462143][T12123] total_pgmajfault 135 [ 517.462151][T12123] total_inactive_anon 241561600 [ 517.462159][T12123] total_active_anon 67416064 [ 517.462166][T12123] total_inactive_file 0 [ 517.462173][T12123] total_active_file 0 [ 517.462180][T12123] total_unevictable 0 [ 517.462187][T12123] anon_cost 0 [ 517.462193][T12123] file_cost 0 [ 517.462200][T12123] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1952,pid=12130,uid=0 [ 517.462298][T12123] Memory cgroup out of memory: Killed process 12130 (syz.3.1952) total-vm:98836kB, anon-rss:1304kB, file-rss:54080kB, shmem-rss:0kB, UID:0 pgtables:200kB oom_score_adj:1000 [ 518.178357][ T32] oom_reaper: reaped process 12136 (syz.3.1952), now anon-rss:0kB, file-rss:34088kB, shmem-rss:0kB [ 518.429399][ T5631] syz-executor invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 518.429424][ T5631] CPU: 0 UID: 0 PID: 5631 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 518.429440][ T5631] Tainted: [L]=SOFTLOCKUP [ 518.429446][ T5631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 518.429452][ T5631] Call Trace: [ 518.429457][ T5631] [ 518.429462][ T5631] dump_stack_lvl+0xe8/0x150 [ 518.429482][ T5631] dump_header+0xd3/0x4b0 [ 518.429498][ T5631] oom_kill_process+0x3ab/0x9e0 [ 518.429515][ T5631] out_of_memory+0x1064/0x1480 [ 518.429527][ T5631] ? try_charge_memcg+0xc32/0x15e0 [ 518.429547][ T5631] ? __pfx_out_of_memory+0x10/0x10 [ 518.429559][ T5631] ? do_raw_spin_unlock+0xf5/0x200 [ 518.429578][ T5631] try_charge_memcg+0xcdf/0x15e0 [ 518.429601][ T5631] ? __pfx_try_charge_memcg+0x10/0x10 [ 518.429624][ T5631] ? charge_memcg+0x47/0x310 [ 518.429638][ T5631] charge_memcg+0x1dd/0x310 [ 518.429652][ T5631] __mem_cgroup_charge+0x25/0x80 [ 518.429664][ T5631] do_wp_page+0x11a3/0x4b70 [ 518.429689][ T5631] ? __pfx_do_wp_page+0x10/0x10 [ 518.429701][ T5631] ? do_raw_spin_lock+0x12b/0x2f0 [ 518.429715][ T5631] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 518.429733][ T5631] handle_mm_fault+0x15d7/0x3750 [ 518.429753][ T5631] ? handle_mm_fault+0xf1/0x3750 [ 518.429772][ T5631] ? __pfx_handle_mm_fault+0x10/0x10 [ 518.429785][ T5631] ? lock_vma_under_rcu+0x45a/0x500 [ 518.429809][ T5631] do_user_addr_fault+0xb35/0x1480 [ 518.429827][ T5631] ? trace_page_fault_user+0x84/0x1e0 [ 518.429839][ T5631] exc_page_fault+0x6a/0xc0 [ 518.429854][ T5631] asm_exc_page_fault+0x26/0x30 [ 518.429864][ T5631] RIP: 0033:0x7f8b24257f07 [ 518.429876][ T5631] Code: 00 e8 8d 53 ff ff 85 c0 74 54 49 8b 34 24 8b 54 24 0c 31 c0 48 8d 3d e3 eb 1d 00 e8 a3 b6 ff ff 8b 44 24 6c 8b 74 24 08 89 ef <49> 89 9c 24 b8 00 00 00 49 8d 4c 24 60 ba 40 00 00 00 41 89 84 24 [ 518.429884][ T5631] RSP: 002b:00007f8b2474f6c0 EFLAGS: 00010206 [ 518.429895][ T5631] RAX: 0000000000000005 RBX: 00007f8b2474f740 RCX: 0000000000000002 [ 518.429902][ T5631] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000003 [ 518.429908][ T5631] RBP: 0000000000000003 R08: 00007f8b2474f6dc R09: 0000000000000000 [ 518.429914][ T5631] R10: 00007f8b2474f740 R11: 0000000000000202 R12: 00007f8b245f7680 [ 518.429921][ T5631] R13: 00007f8b2474f6dc R14: 0000000000000000 R15: 00007f8b245f9180 [ 518.429939][ T5631] [ 518.777511][ T5631] memory: usage 306468kB, limit 307200kB, failcnt 21543 [ 518.777532][ T5631] memory+swap: usage 415848kB, limit 9007199254740988kB, failcnt 0 [ 518.777544][ T5631] kmem: usage 4924kB, limit 9007199254740988kB, failcnt 0 [ 518.777556][ T5631] Memory cgroup stats for /syz3: [ 518.777709][ T5631] cache 308183040 [ 518.777718][ T5631] rss 110592 [ 518.777725][ T5631] rss_huge 0 [ 518.777731][ T5631] shmem 308183040 [ 518.777737][ T5631] mapped_file 0 [ 518.777744][ T5631] dirty 0 [ 518.777750][ T5631] writeback 0 [ 518.777757][ T5631] workingset_refault_anon 1636 [ 518.777765][ T5631] workingset_refault_file 1060 [ 518.777772][ T5631] swap 112005120 [ 518.777779][ T5631] swapcached 136028160 [ 518.777786][ T5631] pgpgin 480013 [ 518.777792][ T5631] pgpgout 406273 [ 518.777798][ T5631] pgfault 252525 [ 518.777805][ T5631] pgmajfault 102 [ 518.777812][ T5631] inactive_anon 231354368 [ 518.777820][ T5631] active_anon 76701696 [ 518.777827][ T5631] inactive_file 0 [ 518.777835][ T5631] active_file 0 [ 518.777842][ T5631] unevictable 0 [ 518.777849][ T5631] hierarchical_memory_limit 314572800 [ 518.777857][ T5631] hierarchical_memsw_limit 9223372036854771712 [ 518.777865][ T5631] total_cache 308183040 [ 518.777872][ T5631] total_rss 110592 [ 518.777878][ T5631] total_rss_huge 0 [ 518.777885][ T5631] total_shmem 308183040 [ 518.777892][ T5631] total_mapped_file 0 [ 518.777899][ T5631] total_dirty 0 [ 518.777905][ T5631] total_writeback 0 [ 518.777912][ T5631] total_workingset_refault_anon 1677 [ 518.777920][ T5631] total_workingset_refault_file 1067 [ 518.777928][ T5631] total_swap 112005120 [ 518.777935][ T5631] total_swapcached 136400896 [ 518.777943][ T5631] total_pgpgin 480142 [ 518.777950][ T5631] total_pgpgout 406402 [ 518.777957][ T5631] total_pgfault 252839 [ 518.777964][ T5631] total_pgmajfault 135 [ 518.777972][ T5631] total_inactive_anon 231354368 [ 518.777980][ T5631] total_active_anon 76701696 [ 518.777988][ T5631] total_inactive_file 0 [ 518.777995][ T5631] total_active_file 0 [ 518.778011][ T5631] total_unevictable 0 [ 518.778018][ T5631] anon_cost 0 [ 518.778024][ T5631] file_cost 0 [ 518.778032][ T5631] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1952,pid=12127,uid=0 [ 518.778403][ T5631] Memory cgroup out of memory: Killed process 12127 (syz.3.1952) total-vm:98836kB, anon-rss:1304kB, file-rss:54080kB, shmem-rss:0kB, UID:0 pgtables:200kB oom_score_adj:1000 [ 519.000896][T11691] usb 1-1: USB disconnect, device number 60 [ 519.056929][T12461] ip_tables: iptables: counters copy to user failed while replacing table [ 519.576596][ T32] oom_reaper: reaped process 12130 (syz.3.1952), now anon-rss:0kB, file-rss:15980kB, shmem-rss:0kB [ 520.178912][T12483] trusted_key: encrypted_key: insufficient parameters specified [ 520.179222][T12483] trusted_key: encrypted_key: insufficient parameters specified [ 520.215946][T12480] IPVS: set_ctl: invalid protocol: 60 255.255.255.255:21 [ 520.267943][T12485] trusted_key: encrypted_key: insufficient parameters specified [ 520.285165][T12486] trusted_key: encrypted_key: insufficient parameters specified [ 521.617325][ T9] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 521.789413][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 521.792723][ T9] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 521.794285][ T9] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 521.795599][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 521.852567][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.852592][ T9] usb 2-1: Product: syz [ 521.852607][ T9] usb 2-1: Manufacturer: syz [ 521.852619][ T9] usb 2-1: SerialNumber: syz [ 521.912456][ T9] usb 2-1: config 0 descriptor?? [ 521.960684][ T9] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 521.960719][ T9] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 522.449937][ T9] em28xx 2-1:0.0: chip ID is em2884 [ 522.587970][ T9] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 522.588737][ T9] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 522.588756][ T9] em28xx 2-1:0.0: No AC97 audio processor [ 524.257618][T12524] fuse: Bad value for 'group_id' [ 524.257639][T12524] fuse: Bad value for 'group_id' [ 524.442946][T11691] usb 2-1: USB disconnect, device number 72 [ 524.444098][T11691] em28xx 2-1:0.0: Disconnecting em28xx [ 524.535255][T11691] em28xx: Freeing device [ 524.634927][T12527] ip_tables: iptables: counters copy to user failed while replacing table [ 524.867231][ T5601] usb 1-1: new full-speed USB device number 61 using dummy_hcd [ 525.020993][ T5601] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=df.bb [ 525.021922][ T5601] usb 1-1: config index 0 descriptor too short (expected 63186, got 210) [ 525.021945][ T5601] usb 1-1: config 0 has an invalid interface number: 106 but max is 0 [ 525.021956][ T5601] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 525.021965][ T5601] usb 1-1: config 0 has no interface number 0 [ 525.021987][ T5601] usb 1-1: config 0 interface 106 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 525.021999][ T5601] usb 1-1: config 0 interface 106 altsetting 0 has an endpoint descriptor with address 0xC7, changing to 0x87 [ 525.022011][ T5601] usb 1-1: config 0 interface 106 altsetting 0 endpoint 0x87 has invalid maxpacket 25401, setting to 64 [ 525.022024][ T5601] usb 1-1: config 0 interface 106 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 525.022046][ T5601] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.028719][ T5601] usb 1-1: config 0 descriptor?? [ 525.175657][ T5601] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 525.527301][ T9] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 525.678640][ T9] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 525.679959][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 525.680050][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.683484][ T9] usb 4-1: config 0 descriptor?? [ 526.068405][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 526.068533][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 526.072222][ T9] usb 4-1: USB disconnect, device number 76 [ 526.257779][T11880] usb 1-1: Failed to submit usb control message: -110 [ 526.257809][T11880] usb 1-1: unable to send the bmi data to the device: -110 [ 526.257819][T11880] usb 1-1: unable to get target info from device [ 526.257844][T11880] usb 1-1: could not get target info (-110) [ 526.257975][T11880] usb 1-1: could not probe fw (-110) [ 526.631360][ T9] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 526.794924][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 526.796379][ T9] usb 4-1: New USB device found, idVendor=0911, idProduct=3333, bcdDevice= 0.40 [ 526.797645][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 526.797690][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.804542][ T9] usb 4-1: config 0 descriptor?? [ 527.287192][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 527.287290][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 527.295979][ T9] usb 4-1: USB disconnect, device number 77 [ 527.356689][ T5601] usb 1-1: USB disconnect, device number 61 [ 527.442300][T12561] input: syz0 as /devices/virtual/input/input51 [ 528.199021][T12577] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 528.238168][T12577] input: syz0 as /devices/virtual/input/input52 [ 530.788388][T12588] socket: no more sockets [ 530.851084][T12588] warn_alloc: 1 callbacks suppressed [ 530.851098][T12588] syz.3.2074: vmalloc error: size 4096, failed to allocate pages, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 530.851139][T12588] CPU: 0 UID: 0 PID: 12588 Comm: syz.3.2074 Tainted: G L syzkaller #0 PREEMPT(full) [ 530.851154][T12588] Tainted: [L]=SOFTLOCKUP [ 530.851158][T12588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 530.851165][T12588] Call Trace: [ 530.851169][T12588] [ 530.851174][T12588] dump_stack_lvl+0xe8/0x150 [ 530.851198][T12588] warn_alloc+0x24d/0x270 [ 530.851213][T12588] ? __pfx_warn_alloc+0x10/0x10 [ 530.851227][T12588] ? alloc_pages_mpol+0x256/0x390 [ 530.851246][T12588] __vmalloc_node_range_noprof+0x11a9/0x1540 [ 530.851271][T12588] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 530.851281][T12588] ? futex_unqueue+0x22/0x240 [ 530.851297][T12588] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 530.851309][T12588] __vmalloc_noprof+0xd2/0x120 [ 530.851319][T12588] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 530.851332][T12588] bpf_prog_alloc_no_stats+0x47/0x560 [ 530.851343][T12588] ? bpf_prog_alloc+0x2a/0x1a0 [ 530.851356][T12588] bpf_prog_alloc+0x3c/0x1a0 [ 530.851368][T12588] bpf_prog_load+0x7f8/0x1c20 [ 530.851387][T12588] ? __pfx_bpf_prog_load+0x10/0x10 [ 530.851411][T12588] __sys_bpf+0xd0d/0xd90 [ 530.851426][T12588] ? __pfx___sys_bpf+0x10/0x10 [ 530.851440][T12588] ? do_futex+0x3e7/0x4e0 [ 530.851466][T12588] ? rcu_is_watching+0x16/0xb0 [ 530.851482][T12588] __x64_sys_bpf+0xba/0xd0 [ 530.851494][T12588] do_syscall_64+0x166/0x520 [ 530.851507][T12588] ? trace_irq_disable+0x3b/0x140 [ 530.851517][T12588] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.851528][T12588] ? clear_bhb_loop+0x70/0xc0 [ 530.851540][T12588] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.851550][T12588] RIP: 0033:0x7f8b2439f559 [ 530.851562][T12588] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 530.851571][T12588] RSP: 002b:00007f8b25200028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 530.851581][T12588] RAX: ffffffffffffffda RBX: 00007f8b24625fa0 RCX: 00007f8b2439f559 [ 530.851589][T12588] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 530.851596][T12588] RBP: 00007f8b24436b20 R08: 0000000000000000 R09: 0000000000000000 [ 530.851602][T12588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 530.851608][T12588] R13: 00007f8b24626038 R14: 00007f8b24625fa0 R15: 00007f8b2474fa48 [ 530.851624][T12588] [ 530.851629][T12588] Mem-Info: [ 530.851634][T12588] active_anon:14830 inactive_anon:12748 isolated_anon:25 [ 530.851634][T12588] active_file:155 inactive_file:60870 isolated_file:0 [ 530.851634][T12588] unevictable:0 dirty:503 writeback:0 [ 530.851634][T12588] slab_reclaimable:13903 slab_unreclaimable:94968 [ 530.851634][T12588] mapped:34541 shmem:18362 pagetables:1637 [ 530.851634][T12588] sec_pagetables:0 bounce:0 [ 530.851634][T12588] kernel_misc_reclaimable:0 [ 530.851634][T12588] free:1264778 free_pcp:12713 free_cma:0 [ 530.851660][T12588] Node 0 active_anon:59320kB inactive_anon:50992kB active_file:620kB inactive_file:243264kB unevictable:0kB isolated(anon):100kB isolated(file):0kB mapped:138152kB dirty:2008kB writeback:0kB shmem:73448kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12832kB pagetables:6088kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 530.851694][T12588] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:12kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:460kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 530.851719][T12588] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 530.851750][T12588] lowmem_reserve[]: 0 2468 2468 2468 2468 [ 530.851769][T12588] Node 0 DMA32 free:1114184kB boost:0kB min:33984kB low:42480kB high:50976kB reserved_highatomic:0kB free_highatomic:0kB active_anon:59320kB inactive_anon:50992kB active_file:620kB inactive_file:243264kB unevictable:0kB writepending:2008kB zspages:2372kB present:3129332kB managed:2527288kB mlocked:0kB bounce:0kB free_pcp:44380kB local_pcp:20184kB free_cma:0kB [ 530.851800][T12588] lowmem_reserve[]: 0 0 0 0 0 [ 530.851819][T12588] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 530.851846][T12588] lowmem_reserve[]: 0 0 0 0 0 [ 530.851865][T12588] Node 1 Normal free:3929568kB boost:0kB min:55916kB low:69892kB high:83868kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:6472kB local_pcp:0kB free_cma:0kB [ 530.851893][T12588] lowmem_reserve[]: 0 0 0 0 0 [ 530.851910][T12588] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 530.851969][T12588] Node 0 DMA32: 10740*4kB (UME) 6971*8kB (UME) 4504*16kB (UME) 3509*32kB (UME) 1854*64kB (UME) 838*128kB (UME) 220*256kB (UME) 72*512kB (UME) 12*1024kB (UME) 16*2048kB (UME) 114*4096kB (UM) = 1114184kB [ 530.852049][T12588] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 530.852098][T12588] Node 1 Normal: 5*4kB (UM) 10*8kB (UM) 9*16kB (UM) 5*32kB (UM) 8*64kB (UM) 9*128kB (UM) 8*256kB (UM) 5*512kB (UM) 3*1024kB (M) 2*2048kB (UM) 956*4096kB (UM) = 3929620kB [ 530.852176][T12588] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 530.852184][T12588] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 530.852196][T12588] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 530.852204][T12588] Node 1 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 530.862456][T12588] 79326 total pagecache pages [ 530.862471][T12588] 18 pages in swap cache [ 530.862478][T12588] Free swap = 98408kB [ 530.862487][T12588] Total swap = 124996kB [ 530.862496][T12588] 2097051 pages RAM [ 530.862503][T12588] 0 pages HighMem/MovableOnly [ 530.862511][T12588] 433613 pages reserved [ 530.862518][T12588] 0 pages cma reserved [ 531.837267][ T5601] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 531.987262][ T5601] usb 1-1: Using ep0 maxpacket: 8 [ 531.987924][ T5601] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 531.989363][ T5601] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 531.989386][ T5601] usb 1-1: config 0 has no interface number 0 [ 531.989413][ T5601] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 531.989425][ T5601] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 531.989437][ T5601] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 531.989450][ T5601] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 531.989472][ T5601] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.991101][ T5601] usb 1-1: config 0 descriptor?? [ 532.012329][ T5601] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 533.326485][T12654] binder_alloc: 12648: pid 12648 spamming oneway? 1 buffers allocated for a total size of 4096 [ 533.327529][T12654] binder_alloc: 12648: pid 12648 spamming oneway? 2 buffers allocated for a total size of 5120 [ 534.037563][T12667] ip_tables: iptables: counters copy to user failed while replacing table [ 534.160869][T12670] loop6: detected capacity change from 0 to 2640 [ 534.188173][T12252] Buffer I/O error on dev loop6, logical block 0, async page read [ 534.188668][T12252] Buffer I/O error on dev loop6, logical block 0, async page read [ 534.193778][T12252] Buffer I/O error on dev loop6, logical block 0, async page read [ 534.194201][T12252] Buffer I/O error on dev loop6, logical block 0, async page read [ 534.194657][T12252] Buffer I/O error on dev loop6, logical block 0, async page read [ 534.673866][ T5679] usb 1-1: USB disconnect, device number 62 [ 534.693689][ T5679] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 535.299482][T12683] FAULT_INJECTION: forcing a failure. [ 535.299482][T12683] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 535.299515][T12683] CPU: 0 UID: 0 PID: 12683 Comm: syz.0.2104 Tainted: G L syzkaller #0 PREEMPT(full) [ 535.299539][T12683] Tainted: [L]=SOFTLOCKUP [ 535.299546][T12683] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 535.299557][T12683] Call Trace: [ 535.299565][T12683] [ 535.299573][T12683] dump_stack_lvl+0xe8/0x150 [ 535.299605][T12683] should_fail_ex+0x410/0x560 [ 535.299640][T12683] _copy_from_user+0x2d/0xb0 [ 535.299660][T12683] core_sys_select+0x671/0xb40 [ 535.299683][T12683] ? get_pid_task+0x20/0x1f0 [ 535.299722][T12683] ? __pfx_core_sys_select+0x10/0x10 [ 535.299772][T12683] ? __pfx_set_user_sigmask+0x10/0x10 [ 535.299793][T12683] ? kmem_cache_free+0x182/0x650 [ 535.299832][T12683] __se_sys_pselect6+0x267/0x320 [ 535.299862][T12683] ? __pfx___se_sys_pselect6+0x10/0x10 [ 535.299886][T12683] ? __pfx_ksys_write+0x10/0x10 [ 535.299910][T12683] ? __x64_sys_pselect6+0x21/0xf0 [ 535.299937][T12683] do_syscall_64+0x166/0x520 [ 535.299962][T12683] ? trace_irq_disable+0x3b/0x140 [ 535.299982][T12683] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.300001][T12683] ? clear_bhb_loop+0x70/0xc0 [ 535.300024][T12683] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.300042][T12683] RIP: 0033:0x7fb4b6d9f559 [ 535.300060][T12683] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.300075][T12683] RSP: 002b:00007fb4b7c00028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 535.300094][T12683] RAX: ffffffffffffffda RBX: 00007fb4b7025fa0 RCX: 00007fb4b6d9f559 [ 535.300108][T12683] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000040 [ 535.300119][T12683] RBP: 00007fb4b7c00090 R08: 0000000000000000 R09: 0000000000000000 [ 535.300130][T12683] R10: 0000200000000640 R11: 0000000000000246 R12: 0000000000000001 [ 535.300141][T12683] R13: 00007fb4b7026038 R14: 00007fb4b7025fa0 R15: 00007fb4b714fa48 [ 535.300171][T12683] [ 536.137251][ T5601] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 536.288024][ T5601] usb 2-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 536.288936][ T5601] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 536.288954][ T5601] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 536.288965][ T5601] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 536.288978][ T5601] usb 2-1: config 0 interface 0 has no altsetting 0 [ 536.288997][ T5601] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 536.295708][ T5601] usb 2-1: config 0 descriptor?? [ 536.513738][T12697] binder: BINDER_SET_CONTEXT_MGR already set [ 536.513750][T12697] binder: 12696:12697 ioctl 4018620d 200000000380 returned -16 [ 536.596659][T12697] binder: 12696:12697 ioctl 40085618 200000000680 returned -22 [ 536.606778][T12697] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2112'. [ 536.656941][ T5601] usbhid 2-1:0.0: can't add hid device: -71 [ 536.657041][ T5601] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 536.681650][ T5601] usb 2-1: USB disconnect, device number 73 [ 540.310675][T12743] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 540.998409][ T5601] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 541.157713][ T5601] usb 3-1: Using ep0 maxpacket: 8 [ 541.171886][ T5601] usb 3-1: unable to get BOS descriptor or descriptor too short [ 541.172000][ T5601] usb 3-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 541.192534][ T5601] usb 3-1: config 0 has an invalid interface number: 88 but max is 0 [ 541.192551][ T5601] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 541.192560][ T5601] usb 3-1: config 0 has no interface number 0 [ 541.227561][ T5601] usb 3-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 541.227587][ T5601] usb 3-1: Product: syz [ 541.227601][ T5601] usb 3-1: Manufacturer: syz [ 541.227613][ T5601] usb 3-1: SerialNumber: syz [ 541.260690][ T5601] usb 3-1: config 0 descriptor?? [ 541.689406][ T5601] usb 3-1: USB disconnect, device number 69 [ 541.697400][ T9] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 541.853155][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 541.880863][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 541.913778][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 541.913804][ T9] usb 4-1: Product: syz [ 541.913813][ T9] usb 4-1: Manufacturer: syz [ 541.913820][ T9] usb 4-1: SerialNumber: syz [ 542.437265][ T5601] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 542.621919][ T5601] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 542.623236][ T5601] usb 1-1: config 0 has no interfaces? [ 542.643887][ T5601] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 542.643912][ T5601] usb 1-1: Product: syz [ 542.643926][ T5601] usb 1-1: Manufacturer: syz [ 542.643938][ T5601] usb 1-1: SerialNumber: syz [ 542.658608][ T5601] usb 1-1: config 0 descriptor?? [ 542.677291][ T5692] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 542.837431][ T5692] usb 3-1: Using ep0 maxpacket: 32 [ 542.838192][ T5692] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 542.839595][ T5692] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 542.839616][ T5692] usb 3-1: config 0 has no interface number 0 [ 542.844416][ T5692] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 542.844616][ T5692] usb 3-1: Product: syz [ 542.844632][ T5692] usb 3-1: Manufacturer: syz [ 542.844646][ T5692] usb 3-1: SerialNumber: syz [ 542.870391][ T5692] usb 3-1: config 0 descriptor?? [ 542.921381][T12785] overlayfs: missing 'lowerdir' [ 542.956262][T12774] loop9: detected capacity change from 0 to 7 [ 542.995345][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 542.995432][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 543.019062][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 543.019123][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 543.020263][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 543.020314][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 543.024933][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 543.024989][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 543.025229][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 543.025294][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 543.025509][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 543.025573][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 543.025846][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 543.025897][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 543.025973][T12774] ldm_validate_partition_table(): Disk read failed. [ 543.026092][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 543.026156][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 543.026395][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 543.026459][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 543.064528][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 543.064606][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 543.137202][T12774] Dev loop9: unable to read RDB block 0 [ 543.155630][T12774] loop9: unable to read partition table [ 543.155835][T12774] loop9: partition table beyond EOD, truncated [ 543.160481][T12774] loop_reread_partitions: partition scan of loop9 (ъщ) failed (rc=-5) [ 543.224453][ T5601] usb 1-1: USB disconnect, device number 63 [ 543.462051][ T5692] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 543.462081][ T5692] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 543.462848][T12792] FAULT_INJECTION: forcing a failure. [ 543.462848][T12792] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 543.462869][T12792] CPU: 0 UID: 0 PID: 12792 Comm: syz.1.2136 Tainted: G L syzkaller #0 PREEMPT(full) [ 543.462887][T12792] Tainted: [L]=SOFTLOCKUP [ 543.462891][T12792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 543.462898][T12792] Call Trace: [ 543.462902][T12792] [ 543.462908][T12792] dump_stack_lvl+0xe8/0x150 [ 543.462940][T12792] should_fail_ex+0x410/0x560 [ 543.462968][T12792] prepare_alloc_pages+0x21e/0x5f0 [ 543.462990][T12792] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 543.463004][T12792] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 543.463018][T12792] ? __pfx_policy_nodemask+0x10/0x10 [ 543.463032][T12792] ? try_to_migrate+0x33d/0x400 [ 543.463044][T12792] ? __pfx_try_to_migrate+0x10/0x10 [ 543.463057][T12792] alloc_pages_mpol+0x21e/0x390 [ 543.463073][T12792] folio_alloc_mpol_noprof+0x39/0x160 [ 543.463088][T12792] migrate_pages_batch+0xb11/0x4f30 [ 543.463114][T12792] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 543.463130][T12792] ? __pfx_migrate_pages_batch+0x10/0x10 [ 543.463144][T12792] ? walk_pgd_range+0x1cab/0x1dc0 [ 543.463175][T12792] ? __pfx_walk_pgd_range+0x10/0x10 [ 543.463194][T12792] migrate_pages+0x1b95/0x2910 [ 543.463208][T12792] ? vma_migratable+0x2ea/0x3e0 [ 543.463227][T12792] ? __pfx_alloc_migration_target_by_mpol+0x10/0x10 [ 543.463241][T12792] ? irqentry_exit+0x2a0/0x9b0 [ 543.463258][T12792] ? __pfx_migrate_pages+0x10/0x10 [ 543.463277][T12792] ? mas_next_node+0xbd1/0xe50 [ 543.463295][T12792] ? mas_next_slot+0xc91/0xd70 [ 543.463321][T12792] __se_sys_mbind+0xe82/0x10e0 [ 543.463338][T12792] ? __pfx___se_sys_mbind+0x10/0x10 [ 543.463350][T12792] ? __fget_files+0x3a2/0x420 [ 543.463370][T12792] ? fput+0xa0/0xd0 [ 543.463384][T12792] ? ksys_write+0x242/0x270 [ 543.463395][T12792] ? __pfx_ksys_write+0x10/0x10 [ 543.463408][T12792] ? __x64_sys_mbind+0x21/0xf0 [ 543.463421][T12792] do_syscall_64+0x166/0x520 [ 543.463434][T12792] ? trace_irq_disable+0x3b/0x140 [ 543.463445][T12792] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.463455][T12792] ? clear_bhb_loop+0x70/0xc0 [ 543.463468][T12792] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.463478][T12792] RIP: 0033:0x7ff6aa79f559 [ 543.463489][T12792] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.463498][T12792] RSP: 002b:00007ff6ab638028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed [ 543.463510][T12792] RAX: ffffffffffffffda RBX: 00007ff6aaa26090 RCX: 00007ff6aa79f559 [ 543.463517][T12792] RDX: 0000000000000000 RSI: 0000000000800000 RDI: 0000200000001000 [ 543.463524][T12792] RBP: 00007ff6ab638090 R08: 0000000000000000 R09: 0000000000000002 [ 543.463531][T12792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 543.463537][T12792] R13: 00007ff6aaa26128 R14: 00007ff6aaa26090 R15: 00007ff6aab4fa48 [ 543.463553][T12792] [ 545.090851][ T9] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 78 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 545.142669][ T9] usb 4-1: USB disconnect, device number 78 [ 545.172207][ T9] usblp0: removed [ 545.737435][ T9] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 545.888008][ T9] usb 4-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 545.890021][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 545.890060][ T9] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 545.890079][ T9] usb 4-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 545.890091][ T9] usb 4-1: config 1 interface 0 has no altsetting 0 [ 545.907393][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.907442][ T9] usb 4-1: Product: syz [ 545.907457][ T9] usb 4-1: Manufacturer: syz [ 545.907468][ T9] usb 4-1: SerialNumber: syz [ 546.008024][ T9] usb-storage 4-1:1.0: USB Mass Storage device detected [ 546.055625][ T9] usb-storage 4-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 546.273773][ T5692] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 546.273935][ T5692] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 546.316290][ T5692] usb 3-1: USB disconnect, device number 70 [ 546.347290][ T5601] usb 4-1: USB disconnect, device number 79 [ 547.197272][ T5601] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 547.258562][T12848] input: syz0 as /devices/virtual/input/input53 [ 547.348120][ T5601] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 1.00 [ 547.351621][ T5601] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 547.351673][ T5601] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 8 [ 547.351713][ T5601] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 547.438345][ T5601] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 548.335082][ T5692] usb 1-1: USB disconnect, device number 64 [ 548.337525][T11885] usb 1-1: Failed to submit usb control message: -71 [ 548.337557][T11885] usb 1-1: unable to send the bmi data to the device: -71 [ 548.337573][T11885] usb 1-1: unable to get target info from device [ 548.337588][T11885] usb 1-1: could not get target info (-71) [ 548.337617][T11885] usb 1-1: could not probe fw (-71) [ 549.885964][T12878] nvme_fabrics: missing parameter 'transport=%s' [ 549.885978][T12878] nvme_fabrics: missing parameter 'nqn=%s' [ 549.987661][ T5601] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 550.138237][ T5601] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 550.157837][ T5601] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.168653][ T5601] usb 1-1: config 0 descriptor?? [ 550.398791][ T5601] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 550.592073][T12893] netlink: 'syz.2.2162': attribute type 23 has an invalid length. [ 550.679813][ T5601] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 1 [ 550.679830][ T5601] [drm] Initialized udl on minor 1 [ 550.851511][T12882] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 550.851960][T12882] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 552.159510][T12912] input: syz0 as /devices/virtual/input/input54 [ 552.493447][T12920] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 555.797186][ T5601] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffff92 [ 555.864047][ T5601] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 555.916033][ T5601] usb 1-1: USB disconnect, device number 65 [ 555.924128][ T24] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 555.924470][ T24] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 556.037487][T11691] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 556.190380][T11691] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 556.221461][T11691] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 556.221487][T11691] usb 2-1: Product: syz [ 556.221527][T11691] usb 2-1: SerialNumber: syz [ 556.258463][T11691] usb 2-1: config 0 descriptor?? [ 556.606521][T12959] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 556.659777][T11691] usb 2-1: USB disconnect, device number 74 [ 557.195017][ T29] kauditd_printk_skb: 48 callbacks suppressed [ 557.195038][ T29] audit: type=1326 audit(1792674366.660:1559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12975 comm="syz.0.2187" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4b6d9f559 code=0x7ffc0000 [ 557.197314][ T29] audit: type=1326 audit(1792674366.660:1561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12975 comm="syz.0.2187" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb4b6d9f559 code=0x7ffc0000 [ 557.228439][ T29] audit: type=1326 audit(1792674366.670:1562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12975 comm="syz.0.2187" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4b6d9f559 code=0x7ffc0000 [ 557.228485][ T29] audit: type=1326 audit(1792674366.670:1563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12975 comm="syz.0.2187" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4b6d9f559 code=0x7ffc0000 [ 557.278139][ T29] audit: type=1326 audit(1792674366.720:1564): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12975 comm="syz.0.2187" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4b6d9f559 code=0x7ffc0000 [ 557.329307][ T29] audit: type=1326 audit(1792674366.800:1565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12975 comm="syz.0.2187" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=460 compat=0 ip=0x7fb4b6d9f559 code=0x7ffc0000 [ 557.329461][ T29] audit: type=1326 audit(1792674366.800:1566): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12975 comm="syz.0.2187" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4b6d9f559 code=0x7ffc0000 [ 557.331336][ T29] audit: type=1326 audit(1792674366.800:1568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12975 comm="syz.0.2187" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4b6d9f559 code=0x7ffc0000 [ 557.335470][ T29] audit: type=1326 audit(1792674366.800:1569): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12975 comm="syz.0.2187" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4b6d9f559 code=0x7ffc0000 [ 557.335515][ T29] audit: type=1326 audit(1792674366.800:1570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12975 comm="syz.0.2187" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4b6d9f559 code=0x7ffc0000 [ 558.206381][ T5692] wiimote 0005:057E:0306.001F: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 558.239066][ T5692] wiimote 0005:057E:0306.001F: New device registered [ 559.309254][ T5692] wiimote 0005:057E:0306.001F: detected device: Nintendo Wii Remote (Gen 1) [ 559.524185][T13014] input: syz0 as /devices/virtual/input/input56 [ 559.555831][ T5692] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.001F/input/input57 [ 559.660294][T13015] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2198'. [ 559.684291][ T5692] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.001F/input/input58 [ 559.740048][ T5692] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.001F/input/input55 [ 560.557303][ T9] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 560.711847][ T9] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 560.722849][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 560.722877][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.747404][ T9] usb 3-1: config 0 descriptor?? [ 561.002249][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 561.002312][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 561.027664][ T9] usb 3-1: USB disconnect, device number 71 [ 561.149182][T12993] wiimote 0005:057E:0306.001F: Device removed [ 561.487365][ T9] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 561.638007][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 561.638659][ T9] usb 3-1: New USB device found, idVendor=0911, idProduct=3333, bcdDevice= 0.40 [ 561.640620][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 561.640665][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.680199][ T9] usb 3-1: config 0 descriptor?? [ 562.092792][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 562.092860][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 562.122600][ T9] usb 3-1: USB disconnect, device number 72 [ 562.272413][T13035] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2205'. [ 562.610946][T13042] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2207'. [ 562.808488][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.808546][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.230767][T13065] syzkaller0: entered promiscuous mode [ 564.230781][T13065] syzkaller0: entered allmulticast mode [ 564.604916][T13069] syzkaller0: left promiscuous mode [ 564.604931][T13069] syzkaller0: left allmulticast mode [ 566.387694][T11691] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 566.565871][T11691] usb 1-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 566.580222][T11691] usb 1-1: config 1 has an invalid descriptor of length 151, skipping remainder of the config [ 566.580274][T11691] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 504 [ 566.580297][T11691] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 566.580338][T11691] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.651873][T13084] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 568.774301][T13099] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3481609219 (111411495008 ns) > initial count (97790769952 ns). Using initial count to start timer. [ 569.490486][T11691] usb 1-1: USB disconnect, device number 66 [ 569.587664][ T5692] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 569.738442][ T5692] usb 2-1: Using ep0 maxpacket: 8 [ 569.739172][ T5692] usb 2-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 569.765020][ T5692] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 569.765046][ T5692] usb 2-1: Product: syz [ 569.765059][ T5692] usb 2-1: Manufacturer: syz [ 569.765072][ T5692] usb 2-1: SerialNumber: syz [ 569.798437][ T5692] usb 2-1: config 0 descriptor?? [ 569.817330][ T5692] gspca_main: se401-2.14.0 probing 047d:5003 [ 570.216683][ T5692] gspca_se401: ExtraFeatures: 255 [ 570.216698][ T5692] gspca_se401: Frame size: 0x0 1/16th janggu [ 570.216706][ T5692] gspca_se401: Frame size: 0x0 1/16th janggu [ 570.216712][ T5692] gspca_se401: Frame size: 0x0 1/16th janggu [ 570.216719][ T5692] gspca_se401: Frame size: 0x0 1/16th janggu [ 570.216725][ T5692] gspca_se401: Frame size: 0x0 1/16th janggu [ 570.703659][ T5692] input: se401 as /devices/platform/dummy_hcd.1/usb2/2-1/input/input60 [ 570.755643][ T5692] usb 2-1: USB disconnect, device number 75 [ 571.507613][T13130] fuse: Unknown parameter '0xffffffffffffffff' [ 571.911646][T13144] xt_cgroup: no path or classid specified [ 571.997390][ T5601] usb 1-1: new full-speed USB device number 67 using dummy_hcd [ 572.158003][ T5601] usb 1-1: unable to get BOS descriptor or descriptor too short [ 572.158726][ T5601] usb 1-1: not running at top speed; connect to a high speed hub [ 572.158758][ T5601] usb 1-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 572.171139][ T5601] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 572.171163][ T5601] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 572.215669][ T5601] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.215696][ T5601] usb 1-1: Product: syz [ 572.215710][ T5601] usb 1-1: Manufacturer: syz [ 572.215722][ T5601] usb 1-1: SerialNumber: syz [ 572.392865][ T29] kauditd_printk_skb: 438 callbacks suppressed [ 572.392885][ T29] audit: type=1326 audit(1792674381.860:2007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13146 comm="syz.1.2238" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 572.425360][ T29] audit: type=1326 audit(1792674381.900:2008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13146 comm="syz.1.2238" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 572.457204][ T29] audit: type=1326 audit(1792674381.920:2009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13146 comm="syz.1.2238" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 572.458006][ T29] audit: type=1326 audit(1792674381.930:2010): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13146 comm="syz.1.2238" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 572.458232][ T29] audit: type=1326 audit(1792674381.930:2011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13146 comm="syz.1.2238" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 572.458615][ T29] audit: type=1326 audit(1792674381.930:2012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13146 comm="syz.1.2238" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 572.458848][ T29] audit: type=1326 audit(1792674381.930:2013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13146 comm="syz.1.2238" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 572.459268][ T29] audit: type=1326 audit(1792674381.930:2014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13146 comm="syz.1.2238" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 572.459682][ T29] audit: type=1326 audit(1792674381.930:2015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13146 comm="syz.1.2238" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 572.460131][ T29] audit: type=1326 audit(1792674381.930:2016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13146 comm="syz.1.2238" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa79f559 code=0x7ffc0000 [ 572.671024][ T5601] usb 1-1: unit 3 not found! [ 572.859427][ T5601] usb 1-1: USB disconnect, device number 67 [ 573.268921][ T9] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 573.427431][ T9] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 573.428512][ T9] usb 2-1: config 1 has an invalid descriptor of length 12, skipping remainder of the config [ 573.428557][ T9] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 29500, setting to 1024 [ 573.428582][ T9] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 573.428604][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 573.428642][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.501535][T13154] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 573.947445][ T5601] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 574.088490][T13167] FAULT_INJECTION: forcing a failure. [ 574.088490][T13167] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 574.088516][T13167] CPU: 0 UID: 0 PID: 13167 Comm: syz.3.2243 Tainted: G L syzkaller #0 PREEMPT(full) [ 574.088530][T13167] Tainted: [L]=SOFTLOCKUP [ 574.088535][T13167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 574.088542][T13167] Call Trace: [ 574.088547][T13167] [ 574.088551][T13167] dump_stack_lvl+0xe8/0x150 [ 574.088571][T13167] should_fail_ex+0x410/0x560 [ 574.088591][T13167] prepare_alloc_pages+0x21e/0x5f0 [ 574.088607][T13167] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 574.088621][T13167] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 574.088638][T13167] ? __pfx_policy_nodemask+0x10/0x10 [ 574.088653][T13167] ? __lock_acquire+0x747/0x2de0 [ 574.088672][T13167] alloc_pages_mpol+0x21e/0x390 [ 574.088688][T13167] alloc_pages_noprof+0xb1/0x2b0 [ 574.088702][T13167] pte_alloc_one+0x22/0x370 [ 574.088717][T13167] __pte_alloc+0x25/0x1a0 [ 574.088731][T13167] do_pte_missing+0x2db7/0x34b0 [ 574.088745][T13167] ? do_raw_spin_unlock+0xf5/0x200 [ 574.088760][T13167] ? __pmd_alloc+0x40a/0x5c0 [ 574.088775][T13167] handle_mm_fault+0x1a53/0x3750 [ 574.088808][T13167] ? handle_mm_fault+0xf1/0x3750 [ 574.088843][T13167] ? __pfx_handle_mm_fault+0x10/0x10 [ 574.088883][T13167] ? __lock_acquire+0x747/0x2de0 [ 574.088913][T13167] ? lock_mm_and_find_vma+0xa7/0x340 [ 574.088936][T13167] do_user_addr_fault+0x7f6/0x1480 [ 574.088973][T13167] exc_page_fault+0x6a/0xc0 [ 574.088999][T13167] asm_exc_page_fault+0x26/0x30 [ 574.089018][T13167] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 574.089039][T13167] Code: 75 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 8f 75 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 574.089055][T13167] RSP: 0018:ffffc90005cafc28 EFLAGS: 00050206 [ 574.089073][T13167] RAX: ffffffff84e1a601 RBX: 0000000000000090 RCX: 0000000000000090 [ 574.089087][T13167] RDX: 0000000000000000 RSI: ffffc90005cafca0 RDI: 0000200000000480 [ 574.089100][T13167] RBP: ffffc90005cafee0 R08: ffffc90005cafd2f R09: 1ffff92000b95fa5 [ 574.089114][T13167] R10: dffffc0000000000 R11: fffff52000b95fa6 R12: 0000200000000510 [ 574.089128][T13167] R13: 00007ffffffff000 R14: ffffc90005cafca0 R15: 0000200000000480 [ 574.089170][T13167] ? _copy_from_user+0x91/0xb0 [ 574.089199][T13167] _copy_to_user+0x8a/0xb0 [ 574.089220][T13167] __se_sys_newfstatat+0x307/0x3a0 [ 574.089238][T13167] ? __pfx___se_sys_newfstatat+0x10/0x10 [ 574.089259][T13167] ? __fget_files+0x2a/0x420 [ 574.089273][T13167] ? __fget_files+0x3a2/0x420 [ 574.089298][T13167] ? __pfx_ksys_write+0x10/0x10 [ 574.089315][T13167] do_syscall_64+0x166/0x520 [ 574.089328][T13167] ? trace_irq_disable+0x3b/0x140 [ 574.089339][T13167] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 574.089349][T13167] ? clear_bhb_loop+0x70/0xc0 [ 574.089361][T13167] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 574.089371][T13167] RIP: 0033:0x7f8b2439f559 [ 574.089381][T13167] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 574.089389][T13167] RSP: 002b:00007f8b25200028 EFLAGS: 00000246 ORIG_RAX: 0000000000000106 [ 574.089401][T13167] RAX: ffffffffffffffda RBX: 00007f8b24625fa0 RCX: 00007f8b2439f559 [ 574.089408][T13167] RDX: 0000200000000480 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 574.089415][T13167] RBP: 00007f8b25200090 R08: 0000000000000000 R09: 0000000000000000 [ 574.089421][T13167] R10: 0000000000001000 R11: 0000000000000246 R12: 0000000000000001 [ 574.089428][T13167] R13: 00007f8b24626038 R14: 00007f8b24625fa0 R15: 00007f8b2474fa48 [ 574.089444][T13167] [ 574.123815][ T5601] usb 3-1: Using ep0 maxpacket: 32 [ 574.129278][ T5601] usb 3-1: New USB device found, idVendor=0545, idProduct=800d, bcdDevice= 3.0a [ 574.139483][ T5601] usb 3-1: config 7 has an invalid interface number: 160 but max is 0 [ 574.139507][ T5601] usb 3-1: config 7 has an invalid interface association descriptor of length 2, skipping [ 574.139525][ T5601] usb 3-1: config 7 has no interface number 0 [ 574.139563][ T5601] usb 3-1: config 7 interface 160 altsetting 6 has a duplicate endpoint with address 0x5, skipping [ 574.139585][ T5601] usb 3-1: config 7 interface 160 has no altsetting 0 [ 574.222548][ T5601] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.222573][ T5601] usb 3-1: Product: syz [ 574.222586][ T5601] usb 3-1: Manufacturer: syz [ 574.222600][ T5601] usb 3-1: SerialNumber: syz [ 574.948559][T13169] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2244'. [ 575.041842][ T5601] usb 3-1: USB disconnect, device number 73 [ 576.493551][ T9] usb 2-1: USB disconnect, device number 76 [ 577.052311][T13194] input: syz0 as /devices/virtual/input/input61 [ 579.310922][T13216] pimreg0: tun_chr_ioctl cmd 2147767507 [ 580.210130][T13223] FAULT_INJECTION: forcing a failure. [ 580.210130][T13223] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 580.210154][T13223] CPU: 1 UID: 0 PID: 13223 Comm: syz.2.2255 Tainted: G L syzkaller #0 PREEMPT(full) [ 580.210169][T13223] Tainted: [L]=SOFTLOCKUP [ 580.210173][T13223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 580.210180][T13223] Call Trace: [ 580.210185][T13223] [ 580.210190][T13223] dump_stack_lvl+0xe8/0x150 [ 580.210209][T13223] should_fail_ex+0x410/0x560 [ 580.210228][T13223] _copy_from_user+0x2d/0xb0 [ 580.210241][T13223] ucma_write+0x158/0x2f0 [ 580.210257][T13223] ? __pfx_ucma_write+0x10/0x10 [ 580.210270][T13223] ? security_file_permission+0x75/0x260 [ 580.210284][T13223] ? rw_verify_area+0x203/0x4c0 [ 580.210297][T13223] vfs_writev+0x4bb/0x990 [ 580.210310][T13223] ? __pfx_ucma_write+0x10/0x10 [ 580.210325][T13223] ? __pfx_vfs_writev+0x10/0x10 [ 580.210345][T13223] ? __fget_files+0x2a/0x420 [ 580.210358][T13223] ? __fget_files+0x3a2/0x420 [ 580.210375][T13223] ? fdget+0x1ac/0x250 [ 580.210387][T13223] do_writev+0x154/0x2e0 [ 580.210401][T13223] ? __pfx_do_writev+0x10/0x10 [ 580.210419][T13223] do_syscall_64+0x166/0x520 [ 580.210433][T13223] ? trace_irq_disable+0x3b/0x140 [ 580.210444][T13223] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.210454][T13223] ? clear_bhb_loop+0x70/0xc0 [ 580.210467][T13223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.210477][T13223] RIP: 0033:0x7f1d54b9f559 [ 580.210487][T13223] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 580.210496][T13223] RSP: 002b:00007f1d55b0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 580.210509][T13223] RAX: ffffffffffffffda RBX: 00007f1d54e25fa0 RCX: 00007f1d54b9f559 [ 580.210517][T13223] RDX: 0000000000000001 RSI: 0000200000000340 RDI: 0000000000000003 [ 580.210523][T13223] RBP: 00007f1d55b0e090 R08: 0000000000000000 R09: 0000000000000000 [ 580.210530][T13223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 580.210537][T13223] R13: 00007f1d54e26038 R14: 00007f1d54e25fa0 R15: 00007f1d54f4fa48 [ 580.210553][T13223] [ 580.614846][T13225] kvm: pic: non byte write [ 580.982589][T13230] FAULT_INJECTION: forcing a failure. [ 580.982589][T13230] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 580.982613][T13230] CPU: 0 UID: 0 PID: 13230 Comm: syz.3.2261 Tainted: G L syzkaller #0 PREEMPT(full) [ 580.982628][T13230] Tainted: [L]=SOFTLOCKUP [ 580.982632][T13230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 580.982639][T13230] Call Trace: [ 580.982643][T13230] [ 580.982648][T13230] dump_stack_lvl+0xe8/0x150 [ 580.982671][T13230] should_fail_ex+0x410/0x560 [ 580.982690][T13230] _copy_to_user+0x31/0xb0 [ 580.982703][T13230] io_uring_create+0x4e5/0x980 [ 580.982721][T13230] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 580.982736][T13230] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 580.982751][T13230] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 580.982773][T13230] ? __pfx_ksys_write+0x10/0x10 [ 580.982789][T13230] do_syscall_64+0x166/0x520 [ 580.982805][T13230] ? trace_irq_disable+0x3b/0x140 [ 580.982816][T13230] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.982827][T13230] ? clear_bhb_loop+0x70/0xc0 [ 580.982839][T13230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.982849][T13230] RIP: 0033:0x7f8b2439f559 [ 580.982860][T13230] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 580.982868][T13230] RSP: 002b:00007f8b251ffee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 580.982881][T13230] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007f8b2439f559 [ 580.982888][T13230] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e26 [ 580.982895][T13230] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 580.982902][T13230] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 580.982909][T13230] R13: 0000200000000890 R14: 00007f8b251fffd8 R15: 0000000000000000 [ 580.982925][T13230] [ 581.515140][T13241] FAULT_INJECTION: forcing a failure. [ 581.515140][T13241] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 581.515173][T13241] CPU: 0 UID: 0 PID: 13241 Comm: syz.0.2266 Tainted: G L syzkaller #0 PREEMPT(full) [ 581.515199][T13241] Tainted: [L]=SOFTLOCKUP [ 581.515207][T13241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 581.515219][T13241] Call Trace: [ 581.515228][T13241] [ 581.515237][T13241] dump_stack_lvl+0xe8/0x150 [ 581.515268][T13241] should_fail_ex+0x410/0x560 [ 581.515303][T13241] _copy_to_user+0x31/0xb0 [ 581.515326][T13241] simple_read_from_buffer+0xe1/0x170 [ 581.515360][T13241] proc_fail_nth_read+0x1bb/0x230 [ 581.515386][T13241] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 581.515412][T13241] ? rw_verify_area+0x24a/0x4c0 [ 581.515436][T13241] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 581.515457][T13241] vfs_read+0x213/0xa80 [ 581.515482][T13241] ? __pfx___mutex_lock+0x10/0x10 [ 581.515509][T13241] ? __pfx_vfs_read+0x10/0x10 [ 581.515530][T13241] ? __fget_files+0x2a/0x420 [ 581.515556][T13241] ? __fget_files+0x3a2/0x420 [ 581.515582][T13241] ? __fget_files+0x2a/0x420 [ 581.515613][T13241] ? fdget+0x1ac/0x250 [ 581.515637][T13241] ksys_read+0x150/0x270 [ 581.515660][T13241] ? __pfx_ksys_read+0x10/0x10 [ 581.515691][T13241] do_syscall_64+0x166/0x520 [ 581.515716][T13241] ? trace_irq_disable+0x3b/0x140 [ 581.515735][T13241] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.515755][T13241] ? clear_bhb_loop+0x70/0xc0 [ 581.515779][T13241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.515798][T13241] RIP: 0033:0x7fb4b6d5fd8e [ 581.515816][T13241] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 581.515831][T13241] RSP: 002b:00007fb4b7bfffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 581.515852][T13241] RAX: ffffffffffffffda RBX: 00007fb4b7c006c0 RCX: 00007fb4b6d5fd8e [ 581.515867][T13241] RDX: 000000000000000f RSI: 00007fb4b7c000a0 RDI: 0000000000000005 [ 581.515878][T13241] RBP: 00007fb4b7c00090 R08: 0000000000000000 R09: 0000000000000000 [ 581.515889][T13241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 581.515900][T13241] R13: 00007fb4b7026038 R14: 00007fb4b7025fa0 R15: 00007fb4b714fa48 [ 581.515931][T13241] [ 583.127681][ T9] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 583.279263][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 583.282872][ T9] usb 3-1: New USB device found, idVendor=0f11, idProduct=0021, bcdDevice= 0.00 [ 583.282910][ T9] usb 3-1: no configurations [ 583.282923][ T9] usb 3-1: can't read configurations, error -22 [ 583.407265][ T9] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 583.554217][T13273] input: syz0 as /devices/virtual/input/input62 [ 583.557958][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 583.562620][ T9] usb 3-1: New USB device found, idVendor=0f11, idProduct=0021, bcdDevice= 0.00 [ 583.562645][ T9] usb 3-1: no configurations [ 583.562652][ T9] usb 3-1: can't read configurations, error -22 [ 583.563980][ T9] usb usb3-port1: attempt power cycle [ 583.907376][ T9] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 583.928051][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 583.928631][ T9] usb 3-1: New USB device found, idVendor=0f11, idProduct=0021, bcdDevice= 0.00 [ 583.928668][ T9] usb 3-1: no configurations [ 583.928680][ T9] usb 3-1: can't read configurations, error -22 [ 584.057322][ T9] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 584.078053][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 584.079468][ T9] usb 3-1: New USB device found, idVendor=0f11, idProduct=0021, bcdDevice= 0.00 [ 584.080909][ T9] usb 3-1: no configurations [ 584.080924][ T9] usb 3-1: can't read configurations, error -22 [ 584.081122][ T9] usb usb3-port1: unable to enumerate USB device [ 584.167410][ T5692] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 584.332006][ T5692] usb 4-1: unable to get BOS descriptor or descriptor too short [ 584.332056][ T5692] usb 4-1: New USB device found, idVendor=0590, idProduct=004c, bcdDevice= 0.40 [ 584.345908][ T5692] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 584.345925][ T5692] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 584.384763][ T5692] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 584.384780][ T5692] usb 4-1: Product: syz [ 584.384788][ T5692] usb 4-1: Manufacturer: syz [ 584.384796][ T5692] usb 4-1: SerialNumber: syz [ 584.853136][ T5692] usb 4-1: USB disconnect, device number 80 [ 584.970884][T12252] udevd[12252]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 585.447517][ T5692] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 585.600483][ T5692] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.00 [ 585.600512][ T5692] usb 2-1: no configurations [ 585.600519][ T5692] usb 2-1: can't read configurations, error -22 [ 585.727345][ T5692] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 585.877970][ T5692] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.00 [ 585.877998][ T5692] usb 2-1: no configurations [ 585.878005][ T5692] usb 2-1: can't read configurations, error -22 [ 585.878181][ T5692] usb usb2-port1: attempt power cycle [ 585.977253][T13301] input: syz0 as /devices/virtual/input/input63 [ 586.217381][ T5692] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 586.238532][ T5692] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.00 [ 586.238558][ T5692] usb 2-1: no configurations [ 586.238565][ T5692] usb 2-1: can't read configurations, error -22 [ 586.367363][ T5692] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 586.389035][ T5692] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.00 [ 586.389074][ T5692] usb 2-1: no configurations [ 586.389082][ T5692] usb 2-1: can't read configurations, error -22 [ 586.389229][ T5692] usb usb2-port1: unable to enumerate USB device [ 587.128561][T13311] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2286'. [ 588.327712][ T5692] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 588.477282][ T5692] usb 4-1: Using ep0 maxpacket: 32 [ 588.477997][ T5692] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 588.478872][ T5692] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 588.478895][ T5692] usb 4-1: config 0 has no interface number 0 [ 588.478918][ T5692] usb 4-1: config 0 interface 184 has no altsetting 0 [ 588.550053][ T5692] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.550079][ T5692] usb 4-1: Product: syz [ 588.550087][ T5692] usb 4-1: Manufacturer: syz [ 588.550094][ T5692] usb 4-1: SerialNumber: syz [ 588.598354][ T5692] usb 4-1: config 0 descriptor?? [ 588.960400][T13320] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 590.006394][ T5692] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 590.006426][ T5692] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 590.006443][ T5692] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 590.006869][ T5692] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 590.068306][ T5692] usb 4-1: USB disconnect, device number 81 [ 590.500618][T13343] input: syz0 as /devices/virtual/input/input64 [ 590.938433][ T5692] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 590.997737][ T9] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 591.088060][ T5692] usb 3-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 591.107725][ T5692] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 591.107742][ T5692] usb 3-1: Product: syz [ 591.107749][ T5692] usb 3-1: Manufacturer: syz [ 591.107757][ T5692] usb 3-1: SerialNumber: syz [ 591.159926][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 591.160598][ T9] usb 2-1: config 0 has no interfaces? [ 591.183864][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 591.183883][ T9] usb 2-1: Product: syz [ 591.183891][ T9] usb 2-1: Manufacturer: syz [ 591.183898][ T9] usb 2-1: SerialNumber: syz [ 591.211914][ T9] usb 2-1: config 0 descriptor?? [ 591.491915][ T5692] rtl8150 3-1:1.0: couldn't reset the device [ 591.492122][ T5692] rtl8150 3-1:1.0: probe with driver rtl8150 failed with error -5 [ 591.521059][ T5692] usb 3-1: USB disconnect, device number 78 [ 591.541529][T13357] FAULT_INJECTION: forcing a failure. [ 591.541529][T13357] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 591.541561][T13357] CPU: 1 UID: 0 PID: 13357 Comm: syz.3.2301 Tainted: G L syzkaller #0 PREEMPT(full) [ 591.541590][T13357] Tainted: [L]=SOFTLOCKUP [ 591.541598][T13357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 591.541609][T13357] Call Trace: [ 591.541617][T13357] [ 591.541626][T13357] dump_stack_lvl+0xe8/0x150 [ 591.541656][T13357] should_fail_ex+0x410/0x560 [ 591.541685][T13357] _copy_to_user+0x31/0xb0 [ 591.541705][T13357] simple_read_from_buffer+0xe1/0x170 [ 591.541734][T13357] proc_fail_nth_read+0x1bb/0x230 [ 591.541756][T13357] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 591.541780][T13357] ? rw_verify_area+0x24a/0x4c0 [ 591.541800][T13357] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 591.541828][T13357] vfs_read+0x213/0xa80 [ 591.541855][T13357] ? __pfx_vfs_read+0x10/0x10 [ 591.541871][T13357] ? l2tp_ip6_connect+0xc8/0x410 [ 591.541892][T13357] ? inet_dgram_connect+0x108/0x350 [ 591.541915][T13357] ? __sys_connect+0x32f/0x450 [ 591.541937][T13357] ? fdget+0x16b/0x250 [ 591.541961][T13357] ksys_read+0x150/0x270 [ 591.541981][T13357] ? __pfx_ksys_read+0x10/0x10 [ 591.542009][T13357] do_syscall_64+0x166/0x520 [ 591.542034][T13357] ? trace_irq_disable+0x3b/0x140 [ 591.542053][T13357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.542073][T13357] ? clear_bhb_loop+0x70/0xc0 [ 591.542096][T13357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.542115][T13357] RIP: 0033:0x7f8b2435fd8e [ 591.542134][T13357] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 591.542150][T13357] RSP: 002b:00007f8b251fffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 591.542170][T13357] RAX: ffffffffffffffda RBX: 00007f8b252006c0 RCX: 00007f8b2435fd8e [ 591.542185][T13357] RDX: 000000000000000f RSI: 00007f8b252000a0 RDI: 0000000000000004 [ 591.542197][T13357] RBP: 00007f8b25200090 R08: 0000000000000000 R09: 0000000000000000 [ 591.542208][T13357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 591.542220][T13357] R13: 00007f8b24626038 R14: 00007f8b24625fa0 R15: 00007f8b2474fa48 [ 591.542251][T13357] [ 592.282565][ T5692] usb 2-1: USB disconnect, device number 81 [ 594.147602][ T5601] usb 3-1: new low-speed USB device number 79 using dummy_hcd [ 594.313332][ T5601] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 594.314204][ T5601] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 594.314219][ T5601] usb 3-1: config 0 has no interface number 0 [ 594.314247][ T5601] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 594.314261][ T5601] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 594.314281][ T5601] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 594.370057][ T5601] usb 3-1: config 0 descriptor?? [ 594.420123][ T5601] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 594.614802][T13379] iowarrior 3-1:0.1: Error -90 while submitting URB [ 594.739378][T13390] FAULT_INJECTION: forcing a failure. [ 594.739378][T13390] name failslab, interval 1, probability 0, space 0, times 0 [ 594.739400][T13390] CPU: 0 UID: 0 PID: 13390 Comm: syz.1.2312 Tainted: G L syzkaller #0 PREEMPT(full) [ 594.739416][T13390] Tainted: [L]=SOFTLOCKUP [ 594.739420][T13390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 594.739427][T13390] Call Trace: [ 594.739432][T13390] [ 594.739437][T13390] dump_stack_lvl+0xe8/0x150 [ 594.739456][T13390] should_fail_ex+0x410/0x560 [ 594.739476][T13390] should_failslab+0xa8/0x100 [ 594.739491][T13390] __kmalloc_cache_node_noprof+0xa5/0x620 [ 594.739505][T13390] ? bdi_alloc+0x51/0x110 [ 594.739516][T13390] ? bdi_alloc+0x51/0x110 [ 594.739530][T13390] bdi_alloc+0x51/0x110 [ 594.739543][T13390] super_setup_bdi_name+0xa8/0x210 [ 594.739555][T13390] ? rcu_is_watching+0x16/0xb0 [ 594.739569][T13390] ? __pfx_super_setup_bdi_name+0x10/0x10 [ 594.739580][T13390] ? fuse_dax_conn_alloc+0x4df/0x910 [ 594.739596][T13390] ? __init_waitqueue_head+0xa8/0x150 [ 594.739611][T13390] fuse_fill_super_common+0x624/0x10e0 [ 594.739636][T13390] ? __pfx_fuse_fill_super_common+0x10/0x10 [ 594.739652][T13390] ? __pfx_set_anon_super_fc+0x10/0x10 [ 594.739663][T13390] ? __pfx_sget_fc+0x10/0x10 [ 594.739696][T13390] fuse_fill_super+0x98/0x120 [ 594.739713][T13390] ? __pfx_fuse_fill_super+0x10/0x10 [ 594.739731][T13390] get_tree_nodev+0xbb/0x150 [ 594.739751][T13390] fuse_get_tree+0x29d/0x3b0 [ 594.739772][T13390] vfs_get_tree+0x92/0x2a0 [ 594.739793][T13390] do_new_mount+0x325/0xb00 [ 594.739824][T13390] ? __pfx_do_new_mount+0x10/0x10 [ 594.739853][T13390] ? ns_capable+0x84/0xe0 [ 594.739878][T13390] ? path_mount+0x647/0x1050 [ 594.739906][T13390] ? user_path_at+0xd4/0x160 [ 594.739927][T13390] __se_sys_mount+0x31d/0x420 [ 594.739960][T13390] ? __pfx___se_sys_mount+0x10/0x10 [ 594.739993][T13390] ? __x64_sys_mount+0x20/0xc0 [ 594.740020][T13390] do_syscall_64+0x166/0x520 [ 594.740044][T13390] ? trace_irq_disable+0x3b/0x140 [ 594.740063][T13390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.740083][T13390] ? clear_bhb_loop+0x70/0xc0 [ 594.740106][T13390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.740134][T13390] RIP: 0033:0x7ff6aa79f559 [ 594.740152][T13390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 594.740168][T13390] RSP: 002b:00007ff6ab659028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 594.740189][T13390] RAX: ffffffffffffffda RBX: 00007ff6aaa25fa0 RCX: 00007ff6aa79f559 [ 594.740203][T13390] RDX: 0000200000000000 RSI: 00002000000020c0 RDI: 0000000000000000 [ 594.740216][T13390] RBP: 00007ff6ab659090 R08: 0000200000000040 R09: 0000000000000000 [ 594.740228][T13390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 594.740240][T13390] R13: 00007ff6aaa26038 R14: 00007ff6aaa25fa0 R15: 00007ff6aab4fa48 [ 594.740270][T13390] [ 597.206344][ T5679] usb 3-1: USB disconnect, device number 79 [ 598.658762][T13430] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 598.679908][T13435] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2325'. [ 599.009148][ T9] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 599.158258][ T9] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 599.162028][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 599.189807][ T9] usb 4-1: config 0 descriptor?? [ 599.237755][T13446] FAULT_INJECTION: forcing a failure. [ 599.237755][T13446] name failslab, interval 1, probability 0, space 0, times 0 [ 599.237779][T13446] CPU: 0 UID: 0 PID: 13446 Comm: syz.0.2329 Tainted: G L syzkaller #0 PREEMPT(full) [ 599.237797][T13446] Tainted: [L]=SOFTLOCKUP [ 599.237801][T13446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 599.237808][T13446] Call Trace: [ 599.237819][T13446] [ 599.237824][T13446] dump_stack_lvl+0xe8/0x150 [ 599.237843][T13446] should_fail_ex+0x410/0x560 [ 599.237862][T13446] should_failslab+0xa8/0x100 [ 599.237877][T13446] __kvmalloc_node_noprof+0x171/0x820 [ 599.237891][T13446] ? __kvmalloc_node_noprof+0x340/0x820 [ 599.237902][T13446] ? io_alloc_cache_init+0x42/0x140 [ 599.237914][T13446] ? io_alloc_cache_init+0x42/0x140 [ 599.237929][T13446] io_alloc_cache_init+0x42/0x140 [ 599.237943][T13446] io_ring_ctx_alloc+0x57d/0xb80 [ 599.237962][T13446] io_uring_create+0x50/0x980 [ 599.237979][T13446] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 599.237994][T13446] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 599.238009][T13446] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 599.238030][T13446] ? __pfx_ksys_write+0x10/0x10 [ 599.238047][T13446] do_syscall_64+0x166/0x520 [ 599.238060][T13446] ? trace_irq_disable+0x3b/0x140 [ 599.238071][T13446] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.238082][T13446] ? clear_bhb_loop+0x70/0xc0 [ 599.238094][T13446] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.238104][T13446] RIP: 0033:0x7fb4b6d9f559 [ 599.238115][T13446] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 599.238124][T13446] RSP: 002b:00007fb4b7c00028 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 599.238135][T13446] RAX: ffffffffffffffda RBX: 00007fb4b7025fa0 RCX: 00007fb4b6d9f559 [ 599.238143][T13446] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000001195 [ 599.238150][T13446] RBP: 00007fb4b7c00090 R08: 0000000000000000 R09: 0000000000000000 [ 599.238157][T13446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 599.238163][T13446] R13: 00007fb4b7026038 R14: 00007fb4b7025fa0 R15: 00007fb4b714fa48 [ 599.238179][T13446] [ 599.502275][ T9] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 599.526166][T13447] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2328'. [ 599.749618][ T9] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 1 [ 599.749636][ T9] [drm] Initialized udl on minor 1 [ 599.911326][T13452] netlink: 640 bytes leftover after parsing attributes in process `syz.0.2330'. [ 599.911346][T13452] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2330'. [ 599.911354][T13452] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2330'. [ 599.947582][T13449] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2328'. [ 599.952477][T13452] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2330'. [ 600.030346][T13433] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 600.031582][T13433] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 600.356424][T13452] 8021q: adding VLAN 0 to HW filter on device bond1 [ 600.441874][T13454] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 600.442006][T13456] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2328'. [ 608.278210][T13460] netlink: 13 bytes leftover after parsing attributes in process `syz.2.2331'. [ 707.267167][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 707.283054][ C1] rcu: 0-...!: (1 GPs behind) idle=03dc/0/0x1 softirq=80229/80230 fqs=120 [ 707.291672][ C1] rcu: (detected by 1, t=10504 jiffies, g=108901, q=202 ncpus=2) [ 707.299487][ C1] Sending NMI from CPU 1 to CPUs 0: [ 707.304704][ C0] NMI backtrace for cpu 0 [ 707.304727][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 707.304754][ C0] Tainted: [L]=SOFTLOCKUP [ 707.304762][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 707.304775][ C0] RIP: 0010:timerqueue_linked_add+0x2e/0x2e0 [ 707.304805][ C0] Code: 55 41 57 41 56 41 55 41 54 53 48 83 ec 10 49 89 f5 48 89 fb 48 bd 00 00 00 00 00 fc ff df e8 59 2c e0 f5 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 e4 26 51 f6 4c 8b 33 4d 85 f6 0f 84 [ 707.304821][ C0] RSP: 0018:ffffc90000007d40 EFLAGS: 00000802 [ 707.304839][ C0] RAX: 1ffff110170850e3 RBX: ffff8880b8428718 RCX: ffffffff8fa8f000 [ 707.304855][ C0] RDX: 8000000001000001 RSI: 0000000001000001 RDI: ffff8880b8428718 [ 707.304869][ C0] RBP: dffffc0000000000 R08: 0000000001000001 R09: 1ffffffff22f5077 [ 707.304884][ C0] R10: dffffc0000000000 R11: fffffbfff22f5078 R12: 1ffff110170850d8 [ 707.304900][ C0] R13: ffff888082123300 R14: ffff888082123300 R15: ffff8880b8428644 [ 707.304915][ C0] FS: 0000000000000000(0000) GS:ffff888123aaa000(0000) knlGS:0000000000000000 [ 707.304932][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 707.304945][ C0] CR2: 000000110c34c0f6 CR3: 0000000056056000 CR4: 00000000003526f0 [ 707.304962][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000066 [ 707.304974][ C0] DR3: 0000000000004be6 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 707.304987][ C0] Call Trace: [ 707.304997][ C0] [ 707.305007][ C0] ? trace_hrtimer_start+0x82/0x200 [ 707.305040][ C0] enqueue_hrtimer+0x18e/0x2c0 [ 707.305071][ C0] __hrtimer_run_queues+0x4ce/0xa10 [ 707.305109][ C0] hrtimer_interrupt+0x4cd/0xaa0 [ 707.305161][ C0] __sysvec_apic_timer_interrupt+0x102/0x430 [ 707.305188][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 707.305215][ C0] [ 707.305222][ C0] [ 707.305230][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 707.305252][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 707.305278][ C0] Code: fb 87 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 68 1d 00 fb f4 bc 0b 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 707.305294][ C0] RSP: 0018:ffffffff8fa07ca0 EFLAGS: 00000246 [ 707.305310][ C0] RAX: 0000000000a1c733 RBX: ffffffff819bbc50 RCX: 8000000000000001 [ 707.305325][ C0] RDX: 0000000000000001 RSI: ffffffff8e46e275 RDI: ffffffff8c6e0480 [ 707.305338][ C0] RBP: ffffffff8fa07d78 R08: ffff8880b8433d9b R09: 1ffff110170867b3 [ 707.305353][ C0] R10: dffffc0000000000 R11: ffffed10170867b4 R12: 0000000000000000 [ 707.305368][ C0] R13: 1ffffffff1f51e00 R14: 1ffffffff1f40f9c R15: dffffc0000000000 [ 707.305385][ C0] ? do_idle+0x2e0/0x540 [ 707.305420][ C0] default_idle+0x9/0x20 [ 707.305448][ C0] default_idle_call+0x72/0xb0 [ 707.305466][ C0] do_idle+0x2e0/0x540 [ 707.305495][ C0] ? __pfx_do_idle+0x10/0x10 [ 707.305529][ C0] cpu_startup_entry+0x43/0x60 [ 707.305557][ C0] rest_init+0x378/0x3a0 [ 707.305577][ C0] ? __pfx_rest_init+0x10/0x10 [ 707.305601][ C0] ? __pfx_kernel_init+0x10/0x10 [ 707.305621][ C0] ? __pfx_acpi_hw_get_mode+0x10/0x10 [ 707.305650][ C0] ? acpi_ut_status_exit+0x120/0x1f0 [ 707.305671][ C0] ? acpi_ut_status_exit+0x120/0x1f0 [ 707.305694][ C0] ? acpi_enable_subsystem+0x286/0x3c0 [ 707.305726][ C0] start_kernel+0x392/0x3e0 [ 707.305760][ C0] x86_64_start_reservations+0x24/0x30 [ 707.305783][ C0] x86_64_start_kernel+0x137/0x1b0 [ 707.305805][ C0] common_startup_64+0x13e/0x157 [ 707.305842][ C0] [ 707.651621][ C1] rcu: rcu_preempt kthread starved for 9904 jiffies! g108901 f0x0 RCU_GP_WAIT_FQS(5) ->state=R ->cpu=1 [ 707.662645][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 707.672615][ C1] rcu: RCU grace-period kthread stack dump: [ 707.678496][ C1] task:rcu_preempt state:R running task stack:27496 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 707.692006][ C1] Call Trace: [ 707.695296][ C1] [ 707.698241][ C1] __schedule+0x17dd/0x5820 [ 707.702795][ C1] ? __pfx___schedule+0x10/0x10 [ 707.707656][ C1] ? lock_acquire+0x115/0x350 [ 707.712357][ C1] ? schedule+0x90/0x2b0 [ 707.716606][ C1] schedule+0x164/0x2b0 [ 707.720775][ C1] schedule_timeout+0x152/0x2c0 [ 707.725630][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 707.731010][ C1] ? __pfx_process_timeout+0x10/0x10 [ 707.736312][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 707.742123][ C1] ? prepare_to_swait_event+0x220/0x3e0 [ 707.747669][ C1] ? prepare_to_swait_event+0x35e/0x3e0 [ 707.753225][ C1] rcu_gp_fqs_loop+0x30c/0x1230 [ 707.758091][ C1] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 707.764248][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 707.769530][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 707.774738][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 707.780555][ C1] rcu_gp_kthread+0x9c/0x340 [ 707.785151][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 707.790355][ C1] ? __kthread_parkme+0x71/0x1f0 [ 707.795301][ C1] ? __kthread_parkme+0x199/0x1f0 [ 707.800340][ C1] kthread+0x38b/0x480 [ 707.804422][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 707.809621][ C1] ? __pfx_kthread+0x10/0x10 [ 707.814226][ C1] ret_from_fork+0x514/0xb70 [ 707.818821][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 707.823934][ C1] ? __switch_to+0xc78/0x1410 [ 707.828623][ C1] ? __pfx_kthread+0x10/0x10 [ 707.833229][ C1] ret_from_fork_asm+0x1a/0x30 [ 707.838705][ C1] [ 707.841723][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 707.848047][ C1] CPU: 1 UID: 0 PID: 13460 Comm: syz.2.2331 Tainted: G L syzkaller #0 PREEMPT(full) [ 707.858985][ C1] Tainted: [L]=SOFTLOCKUP [ 707.863298][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 707.873349][ C1] RIP: 0010:smp_call_function_many_cond+0x62d/0x1500 [ 707.880032][ C1] Code: 89 fe 83 e6 01 31 ff e8 a1 64 0c 00 41 83 e7 01 75 07 e8 96 5f 0c 00 eb 3f f3 90 48 b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 <84> c0 75 0f f7 03 01 00 00 00 74 1d e8 72 5f 0c 00 eb dc 89 d9 80 [ 707.899650][ C1] RSP: 0018:ffffc900061cf320 EFLAGS: 00000293 [ 707.905721][ C1] RAX: 0000000000000000 RBX: ffff8880b8443b28 RCX: ffff88802a0bbe80 [ 707.913693][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 707.921658][ C1] RBP: ffffc900061cf470 R08: ffff88802a0bd41f R09: 1ffff11005417a83 [ 707.929635][ C1] R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff11017088765 [ 707.937608][ C1] R13: 0000000000000000 R14: ffff8880b8443b20 R15: 0000000000000001 [ 707.945583][ C1] FS: 0000000000000000(0000) GS:ffff888123baa000(0000) knlGS:0000000000000000 [ 707.954514][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 707.961106][ C1] CR2: 000000110c301f69 CR3: 0000000056056000 CR4: 00000000003526f0 [ 707.969081][ C1] DR0: 00000000ffffffff DR1: 000000000000000a DR2: 4000000000000003 [ 707.977054][ C1] DR3: 0000000000000001 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 707.985025][ C1] Call Trace: [ 707.988306][ C1] [ 707.991246][ C1] ? __pfx_flush_tlb_func+0x10/0x10 [ 707.996465][ C1] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 708.002800][ C1] ? rcu_is_watching+0x16/0xb0 [ 708.007573][ C1] ? trace_tlb_flush+0x3c/0x160 [ 708.012445][ C1] flush_tlb_mm_range+0x910/0x10b0 [ 708.017579][ C1] ? stack_depot_save_flags+0x33/0x7f0 [ 708.023067][ C1] ? kasan_save_track+0x4f/0x80 [ 708.027937][ C1] ? __pfx_flush_tlb_mm_range+0x10/0x10 [ 708.033503][ C1] ? kmem_cache_free+0x182/0x650 [ 708.038445][ C1] ? netlink_unicast+0x8f7/0xa80 [ 708.043390][ C1] ? netlink_sendmsg+0x7f0/0xb20 [ 708.048322][ C1] ? sock_sendmsg_nosec+0x13a/0x180 [ 708.053522][ C1] ? sock_write_iter+0x2de/0x3e0 [ 708.058482][ C1] ? __lock_acquire+0x747/0x2de0 [ 708.063438][ C1] ? free_pgd_range+0x1356/0x13c0 [ 708.068470][ C1] ? __lock_acquire+0x747/0x2de0 [ 708.073426][ C1] tlb_flush_mmu+0x1af/0xa30 [ 708.078027][ C1] tlb_finish_mmu+0xf4/0x220 [ 708.082619][ C1] free_ldt_pgtables+0x192/0x360 [ 708.087565][ C1] ? __pfx_free_ldt_pgtables+0x10/0x10 [ 708.093043][ C1] ? down_read+0x2b9/0x320 [ 708.097478][ C1] exit_mmap+0x1bf/0x9f0 [ 708.101723][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 708.106508][ C1] ? __pfx_exit_aio+0x10/0x10 [ 708.111208][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 708.116420][ C1] __mmput+0x118/0x420 [ 708.120495][ C1] exit_mm+0x18e/0x240 [ 708.124581][ C1] do_exit+0x6a8/0x2360 [ 708.128756][ C1] ? __pfx_do_exit+0x10/0x10 [ 708.133357][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 708.138395][ C1] do_group_exit+0x22d/0x2f0 [ 708.142991][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 708.148196][ C1] get_signal+0x1216/0x12c0 [ 708.152719][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 708.158277][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 708.164448][ C1] ? do_writev+0x2b1/0x2e0 [ 708.168878][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 708.174252][ C1] ? rcu_is_watching+0x16/0xb0 [ 708.179024][ C1] do_syscall_64+0x328/0x520 [ 708.183623][ C1] ? trace_irq_disable+0x3b/0x140 [ 708.188652][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.194721][ C1] ? clear_bhb_loop+0x70/0xc0 [ 708.199401][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.205295][ C1] RIP: 0033:0x7f1d54b9f559 [ 708.209713][ C1] Code: Unable to access opcode bytes at 0x7f1d54b9f52f. [ 708.216724][ C1] RSP: 002b:00007f1d55b0e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 708.225136][ C1] RAX: 0000000000000001 RBX: 00007f1d54e25fa8 RCX: 00007f1d54b9f559 [ 708.233106][ C1] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1d54e25fac [ 708.241073][ C1] RBP: 00007f1d54e25fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 708.249042][ C1] R10: 0000000000000029 R11: 0000000000000246 R12: 0000000000000000 [ 708.257007][ C1] R13: 00007f1d54e26038 R14: 00007f1d54f4f960 R15: 00007f1d54f4fa48 [ 708.264998][ C1]