last executing test programs: 5m55.516744033s ago: executing program 1 (id=18): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000040)={0x1015000, 0x2}) ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r2}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1005000}) 5m54.827206585s ago: executing program 32 (id=19): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff8261c63790a91ee2c5ff9a21677b4bc7e73ddf2d0e46807c57bf64b0b9df7fc67ecba6521767dcc7d4299c740e73bc49cbcf0049faf222c48896378497c0a7be6238217f85c83a2c45376ddf1a8f631c22c8cf453e8a4fe7bf8160a82bd069be9a9e163724a7412bbc30b68bb31bd571f0571297726a309691408af62ecfc77ea52718c39e802f00a726aaa625407f3b18fd4f66db2bbd05dfd62e", 0x361}, {&(0x7f0000002200)="f610e61ac81cc3edc86f0500194d27a5a443f10dfd1ecda0fd0ed9a444b7fb76afe3a0", 0x23}], 0x2, 0x0, 0x0, 0x900}}], 0x1, 0x20004080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x66}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/92, 0x5c}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x7, &(0x7f0000000600)=""/191, 0xbf, 0xa6ff}}], 0x1, 0x0, &(0x7f0000003700)={0x77359400}) 5m54.393680952s ago: executing program 1 (id=23): r0 = userfaultfd(0x80001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r1, &(0x7f0000000040)='\x00', 0x1) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x80000000, 0x0, 'queue0\x00', 0x132a}) write$sndseq(r2, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r2, 0x80045300, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) read(r0, &(0x7f00000002c0)=""/153, 0x99) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0/protocol\x00', 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket$inet(0x2, 0x2, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000200)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x54, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_CONFIG={0x2c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0xf6}, @NL80211_MESHCONF_POWER_MODE={0x8, 0x1a, 0x2}, @NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT={0x6, 0xa, 0x1}, @NL80211_MESHCONF_PATH_REFRESH_TIME={0x8, 0x9, 0x401}, @NL80211_MESHCONF_CONNECTED_TO_GATE={0x5}]}]}, 0x54}}, 0x0) write(r3, &(0x7f0000000300)='1\n', 0x2) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x3}}, './file0\x00'}) 5m52.500962725s ago: executing program 1 (id=31): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0xc41, 0x3) fallocate(r1, 0x0, 0x2000, 0x18003) 5m52.10846066s ago: executing program 1 (id=35): getpid() mkdir(&(0x7f0000001c00)='./file0\x00', 0x0) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x290d010, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) r0 = getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9902) brk(0x7) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000000180)=""/175, 0xaf) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r2, 0x8983, &(0x7f00000002c0)={0x2, 'vlan1\x00', {0x1000082}, 0xd08}) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket(0x2, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r3, 0x8983, &(0x7f0000000000)={0x1, 'vlan1\x00', {}, 0x5832}) syz_pidfd_open(r0, 0x0) setns(r1, 0x20000) mkdir(&(0x7f0000001c00)='./file0\x00', 0x0) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x290d010, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05080000000000000000010000000900010073797a300000000040000000030a0101000000000000000001000000090003"], 0xd4}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 5m51.457275056s ago: executing program 1 (id=37): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, 0x7, 0x6, 0x401, 0x0, 0x0, {0x3, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x80) 5m50.767815449s ago: executing program 1 (id=38): unshare(0x400) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCEXCL(r0, 0x540c) 5m50.47599577s ago: executing program 33 (id=38): unshare(0x400) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCEXCL(r0, 0x540c) 5m29.490378624s ago: executing program 2 (id=99): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = memfd_secret(0x80000) ftruncate(r0, 0x3) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='p', 0x1) 5m29.388111969s ago: executing program 2 (id=100): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x103301, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r0, 0x80083313, &(0x7f0000000200)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x722f) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_EXTTS_REQUEST2(r2, 0x40103d0b, &(0x7f0000000500)={0x7f, 0x9}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x18) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000000)='3', 0x4e) close(0x3) 5m29.318514413s ago: executing program 2 (id=103): openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket(0x10, 0x803, 0x0) socket$xdp(0x2c, 0x3, 0x0) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x50}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket(0x1, 0x2, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) clock_adjtime(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0x1, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x200, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x105c87, 0x800, 0x0, 0x8003aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x80, 0x0, 0xffffffff}}], 0x1, 0x0, 0x0) 5m28.918707334s ago: executing program 2 (id=107): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/custom1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x20a}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x1100, 0x2}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000001040)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, 0x0}) 5m28.7481194s ago: executing program 2 (id=108): ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "e907f8cdf40c050023eb3d259266ec9c37865c6c1b4640ce2400bb3327ef4f8a1d34c07c3260049e4f8d3ee0878ae95bc7f52363c487b257ffb3baf7709f49f6dcfd54f11ed2c41d078b9c05fc8f72566153c97ffdc11f30ea6b16b694bb4a6e4606c3fb19d1d2bcd6850d00c27df0355808390666e827d61dcc3a633bb0b1250b5a293e3877adc1a1b44b99c93d57fd720a170e7f5670e419dc64febf7ddc73fd4a5a0b6c281e05c541471d8d2a58f5edac665f7f46c7084e17c809268103a2584ab40a68e528329d97afc3612e325c1eb4a3ab2e156a9744480000000000000000001b1300", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dc850718ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c87738d9679d31ce0108dc556e597655ba11bacc032a16fbefc64776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8fffb58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141fa4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3c35ca9a966036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb67c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0484084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835acdabd60da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bacc92dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d18366892b60d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc575341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3b49901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6fda0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e2f4046afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c12845ad85e69ee17de31e2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bd80000000b919341a2a7dda096d41070db245c2c424aebe4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374f000000000000000725e75c257834572026c511f57dce67153a4008f9e75e07edfd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb09370cebaaa80014e3ad280944eae6f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000000), 0x2, 0x640) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x82) r1 = fanotify_init(0x81, 0x40000) fanotify_mark(r1, 0x105, 0x800101b, r0, 0x0) read$FUSE(r1, &(0x7f0000004340)={0x2020}, 0x2020) 5m28.593695288s ago: executing program 2 (id=111): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x103301, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r0, 0x80083313, &(0x7f0000000200)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x722f) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_EXTTS_REQUEST2(r2, 0x40103d0b, &(0x7f0000000500)={0x7f, 0x9}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x18) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000000)='3', 0x4e) close(0x3) 5m13.465983707s ago: executing program 34 (id=111): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x103301, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r0, 0x80083313, &(0x7f0000000200)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x722f) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_EXTTS_REQUEST2(r2, 0x40103d0b, &(0x7f0000000500)={0x7f, 0x9}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x18) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000000)='3', 0x4e) close(0x3) 4m44.252251869s ago: executing program 5 (id=327): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000800)={0x0, 0x0, 0x1, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000980)=@IORING_OP_WRITEV={0x2, 0x0, 0x6000, @fd=r3, 0x6, 0x0, 0x0, 0x0, 0x0, {0x2}}) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f0000000440)) syz_open_dev$video(&(0x7f0000000040), 0x80000001, 0xa00) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={0x24, 0x0, 0x1, 0x0, 0x0, {}, [@NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x1}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x24}}, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x28}) 4m43.958900159s ago: executing program 5 (id=329): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x5}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000002c0)="13", 0x1}], 0x1}, 0x48043) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000100)={0x0, 0x2, 0x20}, 0xc) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r0, 0x0, 0xffff, 0x2) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0x0, &(0x7f0000001180)=[{&(0x7f0000001140)="db", 0x1}], 0x1}}], 0x1, 0x4040001) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0xfffffff7, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x3) shutdown(r5, 0x2) sendto$inet6(r5, 0x0, 0x0, 0x20044854, &(0x7f0000000340)={0xa, 0x2, 0x28, @loopback}, 0x1c) 4m43.059000968s ago: executing program 5 (id=334): socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close_range(r4, 0xffffffffffffffff, 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) (fail_nth: 3) 4m42.707286345s ago: executing program 5 (id=335): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000000000)=[{0x30, 0x0, 0xfd, 0x5ae9}, {0x6, 0x0, 0x7, 0x40000002}]}, 0x10) sendmmsg$inet(r0, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) syz_usb_connect$midi(0x5, 0x3e, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0x9e8, 0x62, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2c, 0x1, 0x1, 0x18, 0x10, 0x4, "", {{{0x9, 0x4, 0x0, 0x0, 0x2, 0x1, 0x3, 0x0, 0x6, [], [{{0x9, 0x5, 0x8e, 0xb, 0x400, 0xd, 0xd7, 0x5, {0x4}}}, {{0x9, 0x5, 0x8c, 0x2, 0x200, 0x6d, 0xf7, 0x80, {0x4}}}]}}}}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) r2 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f0000000040)={0x9, 0x1e, 0xa465, 0x34, "f346f493742cc6b1d560fde0054629ec5af82aae2a2f9a127e66bc5a4be57d7a"}) r3 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c43000101020301010902190001010080fa0904000001ffffff00070584"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4m41.40867s ago: executing program 5 (id=339): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond0/bonding/mode\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) copy_file_range(r1, 0x0, r1, 0x0, 0x400, 0x0) read$FUSE(r1, &(0x7f0000001a00)={0x2020}, 0x2020) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x61) r2 = syz_genetlink_get_family_id$smc(&(0x7f00000000c0), r0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010027bd7000fbd3df2502000000050004000100000005000400010000001400020076657468315f746f5f7465616d0000000900030073797a32000000000900010073"], 0x68}, 0x1, 0x0, 0x0, 0x4000145}, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_clone3(&(0x7f0000000040)={0x2a0a00300, 0x0, 0x0, 0x0, {0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, {r3}}, 0x58) 4m41.320136869s ago: executing program 5 (id=340): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r0, 0x40104d07, &(0x7f0000000a00)="0000020000000000000002") r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x40b00, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000080)={0xfffffffffffffe60}) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0x10, 0x0, 0x0}) socket$packet(0x11, 0x3, 0x300) syz_emit_vhci(&(0x7f0000001800)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x4}, @HCI_OP_LE_DEL_FROM_ACCEPT_LIST={{0xf4}, 0x4}}}, 0x7) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000600)={0x1, 0x0, [{0x5743260c1b7564cd, 0x5a, &(0x7f00000004c0)=""/90}]}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r1, 0x3b89, &(0x7f0000000300)={0x28, 0x1, r3, r2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl(r1, 0x3b90, &(0x7f0000000600)="2800000000000000efbeadde0300000005") 4m25.860533231s ago: executing program 35 (id=340): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r0, 0x40104d07, &(0x7f0000000a00)="0000020000000000000002") r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x40b00, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000080)={0xfffffffffffffe60}) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0x10, 0x0, 0x0}) socket$packet(0x11, 0x3, 0x300) syz_emit_vhci(&(0x7f0000001800)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x4}, @HCI_OP_LE_DEL_FROM_ACCEPT_LIST={{0xf4}, 0x4}}}, 0x7) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000600)={0x1, 0x0, [{0x5743260c1b7564cd, 0x5a, &(0x7f00000004c0)=""/90}]}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r1, 0x3b89, &(0x7f0000000300)={0x28, 0x1, r3, r2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl(r1, 0x3b90, &(0x7f0000000600)="2800000000000000efbeadde0300000005") 2m47.676117454s ago: executing program 3 (id=844): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) r2 = gettid() r3 = socket(0x2d, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f0000000080)={&(0x7f0000000000)={0x2d, 0x0, 0x20, 0x200000}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x40080}, 0xc0) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x1, 0x70bd35, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r2}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) socket$inet6(0xa, 0x4, 0x2) 2m45.215051289s ago: executing program 3 (id=857): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = fanotify_init(0x0, 0x80000) write$binfmt_elf64(r0, 0x0, 0x18) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) r1 = inotify_init1(0x80800) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYRESDEC=r1], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a50000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc14001180090001006c61737400000000040002801400000011000100"], 0x78}, 0x1, 0x0, 0x0, 0x4010}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c000180060001000000000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="40000000210a018800000000000000000a0000010900020073797a31000000000900010073797a310000000014000380100000800c000180060001"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000000780)=ANY=[@ANYBLOB="4844da445bb3d319145dd3bafbb9332362b92631d473eef8c5d89fe2a893e88963a5ce783a5d85545945e78f6e5a2e65673c28f4657eb23b4c4780005211abaea129000000000000", @ANYRES16=r5, @ANYBLOB="010027bd7000fedbdf250c0000002800018014000200776c616e31000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000300010000003000018014000200776730000000000000000000000000000800030000000000080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="5c00018008000100", @ANYRES32=0x0, @ANYBLOB="1400020070696d36726567310000000000000000140002000000000000000000000000000000000008000300010000000800030005000000080003000100000008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000"], 0xc8}, 0x1, 0x0, 0x0, 0x4004801}, 0x0) socket(0x2, 0x80805, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r7 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$bt_hci(r7, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r6], 0xc4}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x13e) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) mount(&(0x7f0000000200)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='befs\x00', 0x1a, 0x0) readahead(r1, 0x3, 0x4) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='fusectl\x00', 0x80, 0x0) 2m44.611953756s ago: executing program 3 (id=861): r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x2000000f5, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d000580090001007070747000000000200004801c000180050001"], 0xbc}}, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f00000003c0)={0x1, @pix_mp={0x8e0, 0xffff8000, 0x36315247, 0x9, 0x3, [{0x2, 0x6}, {0xc00}, {0x3, 0x5de3}, {0x14, 0x5}, {0x9, 0x4000069a}, {0x4, 0x3}, {0x81, 0x5}, {0x4, 0x17}], 0x7b, 0x2, 0x8, 0x1}}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0xff, 0x27, 0xa8, 0x40, 0x12d8, 0x1, 0x8330, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x72, 0x6, 0x10, 0x6, "", [{{0x9, 0x4, 0x33, 0xe8, 0x1, 0x2e, 0xd5, 0x48, 0x6, [], [{{0x9, 0x5, 0xeb3925d0f91dd4ca, 0x2, 0x10, 0x10, 0x2, 0x81}}]}}]}}]}}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={r5, @in6={{0xa, 0x3, 0x3, @mcast1}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x74, &(0x7f0000000080)={0x0, 0xfffe, 0x20, 0x3}, &(0x7f0000000840)=0x18) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f00000004c0)) r6 = gettid() sendmsg$nl_generic(r2, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f0000000080)={0x2ec, 0x13, 0x100, 0x70bd27, 0x25dfdbfe, {0xc}, [@nested={0xda, 0x116, 0x0, 0x1, [@generic="64e27444204ad2ff51201abd71ef47c29e19906d000550c1d064", @typed={0xe, 0x167, 0x0, 0x0, @binary="8a8c4d3b225082530a3a"}, @generic="618b65a7d3979ab785e50f4293013e78b0c828c60a5d1321d6d4ea38d352737bcc7ff7c7a747cd6760075821f0183dde0bd7197988121533a06555f053eb8e4ef25ac1bde4fc4a432ae48395948c9dfcad55ac24c240512495baa6b7946eacc743c8f716daf6a28ccba8490905ea908b474d3dcc7474f15083724964cc177e7b2dbcd14e43fe5fe1574c12616ecba6900eea7df6467448da0ac82bf6a48869e8", @typed={0x8, 0x11e, 0x0, 0x0, @pid=r6}, @nested={0x4, 0x81}]}, @generic="49ee23f61cca65475db3b31b2dcddc935d23180afee1ba9b0d24f97ebbd9c14142425f2ee1bf573d4d0e27ef22feff1e67cc09b59db6ffeede39238f1168e87ef8437e6c70524217dfda73ecc2e5405f454e7447b7ca662eae05016d591d0c90bcff6ca9d4ed8adfd9858e14ceb84f94ade65540218173af6c6eb3e07bcd78d156797b6fe4dad8ff184eb94edce94a0794d4057be74ca32ecda9f2261c0b1c3b70984debccfcfcb19efd", @generic="c3f2b457bbaad93c825274e0507717a4d7147d9d1b643c7676a167bc90dd2bcbb9cfe8831546284e31f5403869faab13663e10db14665253d689f3d2b30c609d8c908a6e05cca2dce118263d1c4b127b26797f96154d186a1bda3170f0caa7720135bb237e71589e3b973886f07c7741ea30aeb981b23446bd77986231cf94bc2bcb129083682832ced2da32a58eb8f557c470173c01ae07168a", @generic="ef333a51221f3544a6e2e572ca7205b55024004131146697f56dbfc61380939079458da3f00be1dd1a291ac3344c7ef316fc15d408106512aae4f7ae842afafc4fbe6b071ab4f3a7fbcf791fbe675e6c3459b0684ff2db2c6ebd00cc5ce6c1cee86bd6e534e345ceab6fc1a1e73485f071d7ba1abbb95b9e88123944db7365f98e55227bf08e05af3097dddbcb91bba71e2c1e267a8dcc7f608a5233b58bd4c407f658681362d31b658ae70d7d4087405fd3a36684a66564"]}, 0x2ec}, 0x1, 0x0, 0x0, 0x20008000}, 0x48000) 2m43.287542327s ago: executing program 3 (id=871): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000000c80)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x4, @private1, 0xffffffff}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)="18", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r0, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000180)={0x0, 0x7, 0x1, "e1"}, 0x9) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="01031e0003001400060066f7cb6e00140601fc000000000000000000000000000001ff0200000000000000000000000000014e244e", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5080"], 0x46) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r2) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f0000000000)='3', 0x4e) read$FUSE(r4, &(0x7f00000004c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) mount$nfs(&(0x7f0000000040)='/dev/net/tun\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0xe8142ebcd7d011a5, &(0x7f0000000240)=ANY=[@ANYBLOB="f3797a6b616c6c657231002c282a5b2db134b02c73797a6b616c64331e825b376c657231002c2f6465762f6e65742f74756e0091a52f3a636b6673726f6f743d70726f63002c61757365723d5d2c646f6e745f6d6561737572652c736d61637b66736861743d73797a6b616c6c657231002c7569643c000000f900000000000000004672ef48af", @ANYRESDEC=r5, @ANYBLOB=',\x00']) ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000440)={'\x00', 0x9, 0x6, 0x5, 0x0, 0x0, 0xffffffffffffffff}) 2m43.153188201s ago: executing program 3 (id=874): r0 = openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000040)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="61050a579bef027fa886901a3796c5bb2be12dfc009e00005539d6c01fd9834631c3"], 0xfd98) 2m42.927295751s ago: executing program 3 (id=877): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1cd) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) acct(&(0x7f0000000400)='./trace/trace\x00') mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='1', 0x1) read$FUSE(r0, &(0x7f0000000440)={0x2020, 0x0, 0x0, 0x0}, 0x2020) r2 = geteuid() getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000002480)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f0000002580)=0xe8) mount$9p_tcp(&(0x7f00000000c0), &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140), 0x40, &(0x7f00000025c0)={'trans=tcp,', {'port', 0x3d, 0x4e24}, 0x2c, {[{@access_uid={'access', 0x3d, r1}}, {@access_uid={'access', 0x3d, r2}}], [{@uid_eq={'uid', 0x3d, r3}}]}}) 2m27.791694332s ago: executing program 36 (id=877): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1cd) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) acct(&(0x7f0000000400)='./trace/trace\x00') mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='1', 0x1) read$FUSE(r0, &(0x7f0000000440)={0x2020, 0x0, 0x0, 0x0}, 0x2020) r2 = geteuid() getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000002480)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f0000002580)=0xe8) mount$9p_tcp(&(0x7f00000000c0), &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140), 0x40, &(0x7f00000025c0)={'trans=tcp,', {'port', 0x3d, 0x4e24}, 0x2c, {[{@access_uid={'access', 0x3d, r1}}, {@access_uid={'access', 0x3d, r2}}], [{@uid_eq={'uid', 0x3d, r3}}]}}) 1m58.773970285s ago: executing program 6 (id=1094): socket$igmp6(0xa, 0x3, 0x3a) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x800800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000240)='./bus\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000100)={[{@volatile}, {@workdir={'workdir', 0x3d, './bus'}}, {@xino_on}]}) r1 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r2, 0x8b2a, &(0x7f0000000040)) 1m58.078398718s ago: executing program 6 (id=1099): syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040)) r2 = socket$netlink(0x10, 0x3, 0x4) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f0000000140)={0xbc, 0x0, 0x4}) writev(r2, &(0x7f0000000300)=[{&(0x7f0000000280)="580000001500192340834b80040d8c560aff820fffff5bab003a0000002058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100040c100000000000224e0000", 0x58}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x3, 0x1, 0x2ffc, 0x2000, &(0x7f000001f000/0x2000)=nil}) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f0000000100)={0x0, 0x40, 0x0, 0x0}) 1m57.544981456s ago: executing program 6 (id=1102): r0 = syz_open_procfs(0x0, &(0x7f000001a280)='maps\x00') r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x72d, 0x100, 0x8, 0x390}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x2c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) request_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000001ffb)={'syz', 0x3}, &(0x7f0000001fee)='y\xa9rustV\x1eS=\xd4\x16\x95::\x01\x00\x00', 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDCTL_DSP_SYNC(r5, 0x80105014, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) pread64(r0, &(0x7f0000001240)=""/102400, 0x19000, 0x80000000000000) 1m56.858050418s ago: executing program 6 (id=1105): r0 = syz_open_dev$loop(&(0x7f0000000040), 0xffffffff80000001, 0x1680a2) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/pm_test', 0x82802, 0x1f8) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1200, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf90000000900030000000000ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d665f985881a350000ddffffff00", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "715237601aaba5b07dce141802c4dacf162e43ac6126c370ec00000000a04100", [0xffffffff7ffffce8, 0xa]}}) 1m56.558354428s ago: executing program 6 (id=1106): mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40e8662e, 0x0) 1m56.397163366s ago: executing program 6 (id=1109): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x103301, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r0, 0x80083313, &(0x7f0000000200)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x722f) ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0x40103d0b, &(0x7f0000000500)={0x7f, 0x9}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x18) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x408000, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000000)='3', 0x4e) close(0x3) 1m41.312890771s ago: executing program 37 (id=1109): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x103301, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r0, 0x80083313, &(0x7f0000000200)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x722f) ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0x40103d0b, &(0x7f0000000500)={0x7f, 0x9}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x18) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x408000, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000000)='3', 0x4e) close(0x3) 1m24.802916615s ago: executing program 4 (id=1239): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/ttyS0\x00', 0x2, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000001c0)=0xfd) 1m24.290914978s ago: executing program 4 (id=1242): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000200)='2', 0x1}], 0x1) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000780)=ANY=[@ANYBLOB="ec01000000020103000000000000000007000010d8010a800800014000000001680002802c00018014000300fe80000000000000000000000000002114000400000000000000000000000000000000000c00028005000100a30000002c00018014000300fe80000000000000000000000000002614000400fe80000000000000000000000000002408000140000000019000028006000340000100000c00028005000100060000000c00028005000100360000000600034000000000060003400002000006000340000300000c000280050001001000000014000180080001007f000001080002007f0000012c00018014000300fc01000000000000000000000000000214000400fc02000000000000000000000000000106000348700000004c0002800c000280050001000600000006000340000400002c000180140003000000000000000000000000000000000114000400fc000000000000000000000000000000060003400004000008000140000000007800028006000340000100002c0001801400030200000000000000000000ffff6401010014000400000000000000000000000000000000012c00018014000300fc00000000000000000000000000000114000400fc0000000000000000000000000000000c00028005000100110000000600034000010000d5ebe88931ee9a8ff2f1982c0ec9b9e71425892fb9c965eeba91472e2da8ccee849724604e237de9f389142ec9d9a1637f17e97e8b859640cda0f99c901f118a685a47d124ad41e38c6e7e6d003445699b753be51830419c40215b90a262aabb79f17015bf36f387f9670c93a121b477532100"/622], 0x1ec}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x8880}, 0x4) syz_emit_vhci(&(0x7f00000006c0)=ANY=[@ANYBLOB="02c90012000e00050017420a008000008200020a004000fde5e64210233096b1d5a6ad6ce14fb110c765c35840461ca80ba09befb3d5313a915100b6a1c9688ed2e5feb0dd0695306a29661c070f3813ebce7504667b984f0323c04664beb433e594c12fddfa3f433b49d932943060be7c43bffff40009126e9b7c4e30f59c0692d83ddde3c6e0055afebb796ad968b3dd5bd2752d33728a394fb5532255a0fdf85f117264e31524c86bd782a4b2f74ecc676bfcfaec"], 0x17) syz_clone3(&(0x7f0000000500)={0x40040000, 0x0, 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = open(&(0x7f00009e1000)='./file0\x00', 0xda840, 0x14a) fcntl$setsig(r4, 0xa, 0x11) fcntl$setlease(r4, 0x400, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = getpid() fcntl$setownex(r5, 0xf, &(0x7f0000000100)={0x2, r6}) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00', 0x0}) sendto$packet(r7, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x11, 0x17, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) fcntl$setown(r4, 0x8, 0x0) truncate(&(0x7f0000000080)='./file0\x00', 0x4) fcntl$setlease(r4, 0x400, 0x2) 1m20.40725913s ago: executing program 4 (id=1254): r0 = syz_open_procfs(0x0, &(0x7f000001a280)='maps\x00') r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x72d, 0x100, 0x8, 0x390}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x2c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) request_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000001ffb)={'syz', 0x3}, &(0x7f0000001fee)='y\xa9rustV\x1eS=\xd4\x16\x95::\x01\x00\x00', 0x0) ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x80105014, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) r7 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x0, 0x10, 0x5, 0x2e3}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x880000, 0x20, 0x1000000, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdd52, 0x40000, 0x2, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x8c, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8af2, 0x2, 0x8, 0x9d7c}}], 0x1, &(0x7f00000014c0)={0x2e, 0x1f, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r5, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) pread64(r0, &(0x7f0000001240)=""/102400, 0x19000, 0x80000000000000) 1m18.605605712s ago: executing program 4 (id=1259): syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103e900000905a1e7", @ANYRESDEC], 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000001c0)=[{0x2, 0xa1, 0x1d, 0x401}]}) 1m15.359897346s ago: executing program 4 (id=1268): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000080)={0x1}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000180), 0x4, 0x2) ioctl$vim2m_VIDIOC_QUERYCAP(r1, 0x80685600, &(0x7f0000000200)) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000000)=0x0) quotactl_fd$Q_GETFMT(r0, 0xffffffff80000401, r2, &(0x7f00000000c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1bf) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000000)='3', 0x4e) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 1m14.439483653s ago: executing program 4 (id=1271): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @empty}, 0x10) listen(r0, 0x5) r1 = syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) syz_usb_disconnect(r1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x6, 0x3, 0x10007e, 0x20000006, 0x53, 0x6, 0x10000, 0x80005, 0x1, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x2, 0x26, 0xd, 0x1, 0x6, 0x7, 0xe661, 0x4, 0x7, 0x7, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x800080ee, 0xa, 0x17, 0x92c, 0x9, 0x200, 0x3e, 0x8c, 0x6, 0xca9, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x8445, 0x6, 0x5, 0x1, 0x40], [0x1000000b, 0x9, 0x80000130, 0x8004, 0x5, 0xfffffff3, 0x2, 0xc8, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x4, 0x0, 0x0, 0x5, 0x42f, 0xe, 0x312, 0x78, 0x1, 0x1e, 0x4, 0x7, 0x7fff, 0x6, 0x4400, 0x401, 0x6, 0x1, 0x3, 0x5, 0x1000005, 0x5f31, 0xd, 0x101, 0x1, 0x4, 0xffff80f1, 0x1, 0x6, 0x2, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0xfffffe01, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x4003, 0x3, 0xbc45, 0x48c93695, 0x43, 0x9], [0x7, 0xa, 0x4, 0x8005, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x5, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x5, 0x6, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x7e, 0x2000b, 0x5, 0x2, 0x2, 0x3, 0x4, 0x2, 0x6d03, 0x6, 0x11, 0x800003, 0x200, 0x400080, 0x3, 0x4, 0x2950bfaf, 0x2, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0x1ac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1001000a, 0x0, 0x5, 0x21c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x24], [0x9, 0x40bb33, 0x7, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xbb, 0xce7, 0x1ff, 0x2, 0xe16, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x1, 0x6, 0x96, 0xffffffff, 0x80000001, 0x7, 0x4, 0xc8, 0x1, 0xfffff000, 0x4010080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x2005, 0x5, 0x1, 0x30b1d79b, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x928, 0xb1e, 0xc7, 0x200, 0xffff2441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) rt_sigprocmask(0x2, &(0x7f0000000240)={[0xffffffffffffffff]}, 0x0, 0x8) syz_clone3(&(0x7f0000000600)={0x100000000, 0x0, 0x0, 0x0, {0xe}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = socket(0x11, 0xa, 0x5) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000040)={'ipvlan0\x00', {0x2, 0x4e20, @broadcast}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendto$inet(r2, &(0x7f0000000140)="0800d71fd0277f32754bfd0d0c3d", 0x5fd, 0x800, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) getsockopt$inet6_tcp_int(r2, 0x6, 0x2b, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs/custom0\x00', 0x802, 0x0) r5 = dup3(r4, r3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e"], 0xb8}}, 0x20004000) ioctl$XFS_IOC_ERROR_CLEARALL(r7, 0x40085875) write(r6, &(0x7f00000000c0)="ec66703e0d0a5fc56b0fd0f249751437", 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mq_getsetattr(0xffffffffffffffff, &(0x7f0000001200)={0x80, 0x7, 0x1, 0xc}, 0x0) munmap$IORING_OFF_SQES(0x0, 0xc5059c) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) 59.1491109s ago: executing program 38 (id=1271): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @empty}, 0x10) listen(r0, 0x5) r1 = syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) syz_usb_disconnect(r1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x6, 0x3, 0x10007e, 0x20000006, 0x53, 0x6, 0x10000, 0x80005, 0x1, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x2, 0x26, 0xd, 0x1, 0x6, 0x7, 0xe661, 0x4, 0x7, 0x7, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x800080ee, 0xa, 0x17, 0x92c, 0x9, 0x200, 0x3e, 0x8c, 0x6, 0xca9, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x8445, 0x6, 0x5, 0x1, 0x40], [0x1000000b, 0x9, 0x80000130, 0x8004, 0x5, 0xfffffff3, 0x2, 0xc8, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x4, 0x0, 0x0, 0x5, 0x42f, 0xe, 0x312, 0x78, 0x1, 0x1e, 0x4, 0x7, 0x7fff, 0x6, 0x4400, 0x401, 0x6, 0x1, 0x3, 0x5, 0x1000005, 0x5f31, 0xd, 0x101, 0x1, 0x4, 0xffff80f1, 0x1, 0x6, 0x2, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0xfffffe01, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x4003, 0x3, 0xbc45, 0x48c93695, 0x43, 0x9], [0x7, 0xa, 0x4, 0x8005, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x5, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x5, 0x6, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x7e, 0x2000b, 0x5, 0x2, 0x2, 0x3, 0x4, 0x2, 0x6d03, 0x6, 0x11, 0x800003, 0x200, 0x400080, 0x3, 0x4, 0x2950bfaf, 0x2, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0x1ac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1001000a, 0x0, 0x5, 0x21c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x24], [0x9, 0x40bb33, 0x7, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xbb, 0xce7, 0x1ff, 0x2, 0xe16, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x1, 0x6, 0x96, 0xffffffff, 0x80000001, 0x7, 0x4, 0xc8, 0x1, 0xfffff000, 0x4010080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x2005, 0x5, 0x1, 0x30b1d79b, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x928, 0xb1e, 0xc7, 0x200, 0xffff2441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) rt_sigprocmask(0x2, &(0x7f0000000240)={[0xffffffffffffffff]}, 0x0, 0x8) syz_clone3(&(0x7f0000000600)={0x100000000, 0x0, 0x0, 0x0, {0xe}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = socket(0x11, 0xa, 0x5) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000040)={'ipvlan0\x00', {0x2, 0x4e20, @broadcast}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendto$inet(r2, &(0x7f0000000140)="0800d71fd0277f32754bfd0d0c3d", 0x5fd, 0x800, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) getsockopt$inet6_tcp_int(r2, 0x6, 0x2b, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs/custom0\x00', 0x802, 0x0) r5 = dup3(r4, r3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e"], 0xb8}}, 0x20004000) ioctl$XFS_IOC_ERROR_CLEARALL(r7, 0x40085875) write(r6, &(0x7f00000000c0)="ec66703e0d0a5fc56b0fd0f249751437", 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mq_getsetattr(0xffffffffffffffff, &(0x7f0000001200)={0x80, 0x7, 0x1, 0xc}, 0x0) munmap$IORING_OFF_SQES(0x0, 0xc5059c) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) 6.193133361s ago: executing program 8 (id=1448): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000300)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r3 = gettid() rt_tgsigqueueinfo(0x0, r3, 0xb, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_dev$vbi(0x0, 0x2, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x40) syz_emit_vhci(&(0x7f00000001c0)=ANY=[@ANYBLOB="040e4f421f6e870f3b6bf40a7b7000fc48207ca621e476c9042e3e0cc8a9d7"], 0xffffff70) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0xda, 0xc9}}}, 0x6) r5 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4a320) ioctl$CEC_ADAP_S_LOG_ADDRS(r5, 0xc05c6104, &(0x7f0000000040)={"dfff00", 0x0, 0x5, 0x6, 0xfffffff9, 0xe, "00000000020000000000002100", "00000001", "0052008f", "0000f807", ["fdd5c01000", "0000000000000400", "00f638000000007c0300", "ffe9ff00"]}) ioctl$CEC_S_MODE(r5, 0x40046109, &(0x7f0000000240)=0x3) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='ip6_vti0\x00', 0x16) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r6, &(0x7f0000000140)='bbr\x00', 0x4) r7 = socket$inet(0x2, 0x801, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) 5.944965013s ago: executing program 0 (id=1450): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000380)={{0x84, @dev={0xac, 0x14, 0x14, 0x37}, 0x4e20, 0x3, 'ovf\x00', 0x0, 0x60000000, 0xd}, {@rand_addr=0x64010102, 0x4e23, 0x1, 0x8, 0x48001, 0x38}}, 0x44) 5.641114221s ago: executing program 0 (id=1451): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0x4) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(0xffffffffffffffff, 0x7a6, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000340)=0x1) r3 = syz_usb_connect(0x2, 0x3f, 0x0, 0x0) syz_usb_disconnect(r3) r4 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040810605000001000000010902"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x41) 4.439594559s ago: executing program 7 (id=1455): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYRES32=r2, @ANYBLOB="0500080000000000090007004ff5677c1a0000000800090001ac0f"], 0x38}}, 0x0) 4.265038113s ago: executing program 7 (id=1456): setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) read$FUSE(r1, &(0x7f00000004c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) mount$nfs(&(0x7f0000000040)='/dev/net/tun\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0xe8142ebcd7d011a5, &(0x7f0000000240)=ANY=[@ANYBLOB="f3797a6b616c6c657231002c282a5b2db134b02c73797a6b616c64331e825b376c657231002c2f6465762f6e65742f74756e0091a52f3a636b6673726f6f743d70726f63002c61757365723d5d2c646f6e745f6d6561737572652c736d61637b66736861743d73797a6b616c6c657231002c7569643c000000f900000000000000004672ef48af", @ANYRESDEC=r2, @ANYBLOB=',\x00']) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000440)={'\x00', 0x9, 0x6, 0x5, 0x0, 0x0, 0xffffffffffffffff}) 4.15532925s ago: executing program 9 (id=1457): r0 = socket$rds(0x15, 0x5, 0x0) setns(0xc9, 0x0) r1 = socket$netlink(0x10, 0x3, 0x14) sendmsg$netlink(r1, &(0x7f0000003f40)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000027c0)={0x10, 0x1001, 0x5c01}, 0x10}], 0x1, 0x0, 0x0, 0x440d0}, 0x10) recvfrom(r0, &(0x7f0000000080)=""/216, 0xd8, 0x2100, &(0x7f0000000180)=@xdp={0x2c, 0xe, 0x0, 0x3a}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x0) write$cgroup_subtree(r2, &(0x7f0000000200)={[{0x2b, 'rdma'}, {0x2d, 'perf_event'}, {0x0, 'cpu'}, {0x2d, 'pids'}, {0x2d, 'io'}, {0x2d, 'net_cls'}]}, 0x2a) write(r2, &(0x7f00000008c0)="05010906", 0x4) 4.039045271s ago: executing program 7 (id=1458): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) (async) r1 = openat$sysfs(0xffffff9c, &(0x7f0000000100)='/sys/power/resume_offset', 0x0, 0x0) readv(r1, &(0x7f0000000400)=[{&(0x7f0000001940)=""/4082, 0xff2}], 0x1) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) io_setup(0x5, &(0x7f0000000040)=0x0) io_submit(r2, 0x20000043, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x8, 0x0, r0, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) 3.707922321s ago: executing program 9 (id=1459): setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, &(0x7f0000000380)={{0x84, @dev={0xac, 0x14, 0x14, 0x37}, 0x4e20, 0x3, 'ovf\x00', 0x0, 0x60000000, 0xd}, {@rand_addr=0x64010102, 0x4e23, 0x1, 0x8, 0x48001, 0x38}}, 0x44) 3.707599312s ago: executing program 7 (id=1460): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x54c, 0x268, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x404c2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x18, {[@global=@item_4={0x3, 0x1, 0x0, "115de214"}, @local=@item_4={0x3, 0x2, 0x1, '\x00\x00jJ'}, @global=@item_012={0x1, 0x1, 0x2, "ff"}, @local=@item_012={0x2, 0x2, 0x2, "009f"}, @local=@item_012={0x2, 0x2, 0x2, 'Kv'}, @main=@item_4={0x3, 0x0, 0x9, "c148f81b"}, @main=@item_012={0x0, 0x0, 0x9}]}}, 0x0}, 0x0) 3.409022208s ago: executing program 9 (id=1461): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x2, 0x3a) setsockopt$inet6_int(r2, 0x29, 0x21, &(0x7f0000000100)=0x4000fff9, 0x4) sendto$inet6(r2, &(0x7f0000000000)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x80, 0x5, 0x7fff0003}]}) syz_usb_connect(0x3, 0x40, &(0x7f0000000300)=ANY=[@ANYBLOB="12011001000000085f0500a800010000000109022e0001010080320904000004ff", @ANYRESHEX], 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0x40082104, 0x0) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x101000, 0x0) ioctl$COMEDI_CMD(r4, 0x80506409, &(0x7f0000000180)={0x1, 0x1, 0x80, 0xd, 0x10, 0x3e8, 0x2, 0x0, 0x20, 0x1, 0x1, 0x0, &(0x7f0000000600)=[0x7], 0x1, 0x0}) sendmsg$netlink(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000240)={0x1c, 0x5e, 0x1, 0x0, 0x0, "", [@typed={0x4}, @nested={0x5, 0x0, 0x0, 0x1, [@generic='%']}]}, 0x1c}], 0x1}, 0x0) 2.937522536s ago: executing program 8 (id=1462): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140024001000010000000000000000000a00000a6c000000060a0104000000000000400002000000400004803c0001800a0001006d617463680000002c00028014000300f4f03b0200000001000000116b61979e090001006c3274700000000008000240000000000900010073797a30000000000900020073797a32"], 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 2.555986763s ago: executing program 8 (id=1463): socket$nl_generic(0x10, 0x3, 0x10) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x10040, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000400)={@loopback, @mcast1, @mcast1, 0x80006, 0x0, 0x5d, 0x200, 0x800001fe, 0x530371}) ioctl$sock_inet6_SIOCADDRT(r1, 0x894c, &(0x7f0000000980)={@initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, @private2, @mcast1, 0x6, 0x0, 0x40, 0x400, 0x480000000000000a, 0x10201}) 1.76435676s ago: executing program 8 (id=1464): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYRES32=r2, @ANYBLOB="0500080000000000090007004ff5677c1a0000000800090001ac0f"], 0x38}}, 0x0) 1.482466811s ago: executing program 8 (id=1465): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r1, 0x29, 0x49, 0x0, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0], 0x2, 0x800, 0x0, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x200}, 0x8) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000000)) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000040)=0x200000000) 1.311877136s ago: executing program 0 (id=1466): setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) read$FUSE(r1, &(0x7f00000004c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) mount$nfs(&(0x7f0000000040)='/dev/net/tun\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0xe8142ebcd7d011a5, &(0x7f0000000240)=ANY=[@ANYBLOB="f3797a6b616c6c657231002c282a5b2db134b02c73797a6b616c64331e825b376c657231002c2f6465762f6e65742f74756e0091a52f3a636b6673726f6f743d70726f63002c61757365723d5d2c646f6e745f6d6561737572652c736d61637b66736861743d73797a6b616c6c657231002c7569643c000000f900000000000000004672ef48af", @ANYRESDEC=r2, @ANYBLOB=',\x00']) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000440)={'\x00', 0x9, 0x6, 0x5, 0x0, 0x0, 0xffffffffffffffff}) 1.213330393s ago: executing program 7 (id=1467): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000000)) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) timerfd_gettime(r2, 0x0) r3 = socket(0x10, 0x3, 0x4) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000340)={'sit0\x00', 0x0}) r4 = syz_open_pts(r1, 0x25a682) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$TCSBRK(r4, 0x400455c8, 0x2) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000080)=0xc0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000080)=0x1) r5 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) openat$cgroup_subtree(r6, &(0x7f00000000c0), 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000100)={'tunl0\x00', 0x400}) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0xff) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000080)=0x2f) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000080)) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000080)=0xff) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000080)=0xc0) 1.206971856s ago: executing program 9 (id=1468): r0 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x8000, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0285628, &(0x7f0000000140)={0x1, @pix_mp={0x0, 0x80000000, 0x32314152, 0x0, 0x0, [{0xffffffff}, {}, {}, {}, {}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x1}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/ocfs2/node/node0/local\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='J\n', 0x2) 1.151825768s ago: executing program 8 (id=1469): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) r1 = open(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x0) fallocate(r0, 0x0, 0x0, 0x1000f4) sendfile(r0, r0, 0x0, 0x40000000800) sendfile(r1, r0, 0x0, 0x7ffff0f5) 989.282932ms ago: executing program 0 (id=1470): setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, &(0x7f0000000380)={{0x84, @dev={0xac, 0x14, 0x14, 0x37}, 0x4e20, 0x3, 'ovf\x00', 0x0, 0x60000000, 0xd}, {@rand_addr=0x64010102, 0x4e23, 0x1, 0x8, 0x48001, 0x38}}, 0x44) 751.844281ms ago: executing program 7 (id=1471): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000180)={0x1ff, 0x4, 0x0, 0xfffff6a8, 0x3, "c1d846f1120224c70b82426319d4c37ee7e4c0", 0x1, 0x6}) ioctl$TCSETS2(r0, 0x5453, &(0x7f0000000040)={0x7, 0xa40, 0xffffff81, 0x7fffffff, 0x6, "662ceb757dcb7495e121fcd1f20e485396a278", 0x2, 0x5}) 671.961473ms ago: executing program 0 (id=1472): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r0 = syz_clone(0x100000, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sndctrl(0x0, 0xfffffffffffffeff, 0x4000) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, 0x0) getpriority(0x2, r0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x0, 0x21) unshare(0x22020600) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$SO_BINDTODEVICE_wg(r3, 0x1, 0x19, &(0x7f0000000280)='wg2\x00', 0x4) bind$xdp(r3, &(0x7f0000000100), 0x10) setresuid(0xee01, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, 0xfffffffffffffffe) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000180)=ANY=[@ANYBLOB="0004000000000000ff"]) 550.076051ms ago: executing program 9 (id=1473): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYRES32=r2, @ANYBLOB="0500080000000000090007004ff5677c1a0000000800090001ac0f"], 0x38}}, 0x0) 169.912428ms ago: executing program 0 (id=1474): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x124}}}, &(0x7f0000000280)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) syz_ublk_setup_queues(r0, r5, &(0x7f0000000200)={0x0, 0x1463, 0x10700, 0x2, 0xb2, 0x0, r0}, &(0x7f0000000d40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x10002, 0x401, 0x31c, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8000, 0x1, 0x2000008, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x10, 0x1, 0x902c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x20, 0x2, 0x40021a, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x72ccfb459c83c565, {0x6}, 0x0, r4, '\x00', {0x3, 0x48b, 0x0, 0x0}}, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100), &(0x7f00000002c0), 0x2, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000280), 0x3000c11, &(0x7f0000000740)={[{@mpol={'mpol', 0x3d, {'interleave', '=relative', @val={0x3a, [0x30, 0x2d, 0x39, 0x3a, 0x2f]}}}, 0x4e}]}) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x56a, 0xc5, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x70, 0x8, "", [{{0x9, 0x4, 0x0, 0xfc, 0xdf, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x81, 0x3f, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x3, 0xc1}}}}}]}}]}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 0s ago: executing program 9 (id=1475): request_key(0x0, 0x0, &(0x7f0000000340)='-*.\x00', 0x0) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, 0x0, &(0x7f0000000080)={'enc=', 'raw', ' hash=', {'streebog256-generic\x00'}}, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000180)={0x0, 0xf9ef, &(0x7f0000000240)={&(0x7f0000000340)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x15}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @random="000300"}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x3004c047}, 0x4000050) kernel console output (not intermixed with test programs): x219/0x5f0 [ 325.807414][ T9905] ? tomoyo_path_number_perm+0x219/0x5f0 [ 325.807449][ T9905] ? do_vfs_ioctl+0x116f/0x1530 [ 325.807483][ T9905] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 325.807528][ T9905] ? do_futex+0x3e7/0x4e0 [ 325.807601][ T9905] blkdev_ioctl+0x4c1/0x740 [ 325.807639][ T9905] ? __pfx_blkdev_ioctl+0x10/0x10 [ 325.807677][ T9905] ? bpf_lsm_file_ioctl+0x9/0x20 [ 325.807706][ T9905] ? __pfx_blkdev_ioctl+0x10/0x10 [ 325.807757][ T9905] __se_sys_ioctl+0xfc/0x170 [ 325.807799][ T9905] do_syscall_64+0x166/0x520 [ 325.807821][ T9905] ? trace_irq_disable+0x3b/0x140 [ 325.807849][ T9905] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.807873][ T9905] ? clear_bhb_loop+0x70/0xc0 [ 325.807902][ T9905] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.807927][ T9905] RIP: 0033:0x7fa6e619e159 [ 325.807948][ T9905] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 325.807970][ T9905] RSP: 002b:00007fa6e70a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 325.807995][ T9905] RAX: ffffffffffffffda RBX: 00007fa6e6425fa0 RCX: 00007fa6e619e159 [ 325.808013][ T9905] RDX: 0000200000000440 RSI: 00000000c0481273 RDI: 0000000000000005 [ 325.808030][ T9905] RBP: 00007fa6e623506b R08: 0000000000000000 R09: 0000000000000000 [ 325.808046][ T9905] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 325.808060][ T9905] R13: 00007fa6e6426038 R14: 00007fa6e6425fa0 R15: 00007ffe201fd718 [ 325.808098][ T9905] [ 326.149791][ T9907] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 326.149837][ T9907] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 326.149850][ T9907] overlayfs: missing 'lowerdir' Hü[ 326.255745][ T54] Bluetooth: hci5: setting up ROME/QCA6390 ü[ 326.278310][ T9909] syzkaller1: entered promiscuous mode [ 326.278334][ T9909] syzkaller1: entered allmulticast mode [ 326.285664][ T9911] input: syz1 as /devices/virtual/input/input38 ü[ 326.611187][ T9917] IPVS: set_ctl: invalid protocol: 135 172.20.20.170:20000 [ 326.696579][ T9919] bonding: no command found in bonding_masters - use +ifname or -ifname [ 327.125661][ T9930] FAULT_INJECTION: forcing a failure. [ 327.125661][ T9930] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 327.125700][ T9930] CPU: 1 UID: 0 PID: 9930 Comm: syz.8.1093 Tainted: G L syzkaller #0 PREEMPT(full) [ 327.125741][ T9930] Tainted: [L]=SOFTLOCKUP [ 327.125751][ T9930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 327.125765][ T9930] Call Trace: [ 327.125775][ T9930] [ 327.125786][ T9930] dump_stack_lvl+0xe8/0x150 [ 327.125822][ T9930] should_fail_ex+0x3eb/0x540 [ 327.125865][ T9930] prepare_alloc_pages+0x21e/0x5f0 [ 327.125899][ T9930] __alloc_frozen_pages_noprof+0x17a/0x400 [ 327.125925][ T9930] ? __lock_acquire+0x747/0x2de0 [ 327.125954][ T9930] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 327.125992][ T9930] ? policy_nodemask+0x2cc/0x8e0 [ 327.126024][ T9930] ? lockdep_hardirqs_on+0x7b/0x110 [ 327.126065][ T9930] alloc_pages_mpol+0x21e/0x390 [ 327.126102][ T9930] alloc_pages_noprof+0xb1/0x2b0 [ 327.126138][ T9930] get_free_pages_noprof+0xf/0x80 [ 327.126167][ T9930] __kasan_populate_vmalloc+0x38/0x1c0 [ 327.126194][ T9930] ? do_raw_spin_unlock+0xf5/0x200 [ 327.126235][ T9930] alloc_vmap_area+0xd10/0x1410 [ 327.126289][ T9930] ? __pfx_alloc_vmap_area+0x10/0x10 [ 327.126322][ T9930] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 327.126345][ T9930] ? __get_vm_area_node+0x155/0x2f0 [ 327.126385][ T9930] __get_vm_area_node+0x200/0x2f0 [ 327.126425][ T9930] ? relay_open_buf+0x3b0/0xda0 [ 327.126462][ T9930] vmap+0x158/0x2f0 [ 327.126497][ T9930] ? relay_open_buf+0x3b0/0xda0 [ 327.126539][ T9930] relay_open_buf+0x3b0/0xda0 [ 327.126590][ T9930] relay_open+0x413/0x900 [ 327.126633][ T9930] blk_trace_setup_prepare+0x425/0x5a0 [ 327.126674][ T9930] blk_trace_setup+0x2f5/0x520 [ 327.126719][ T9930] ? __pfx_blk_trace_setup+0x10/0x10 [ 327.126775][ T9930] ? snprintf+0xe8/0x140 [ 327.126832][ T9930] blk_trace_ioctl+0x37f/0x910 [ 327.126872][ T9930] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 327.126909][ T9930] ? kasan_quarantine_put+0xbb/0x1f0 [ 327.126946][ T9930] ? tomoyo_path_number_perm+0x219/0x5f0 [ 327.126982][ T9930] ? tomoyo_path_number_perm+0x219/0x5f0 [ 327.127019][ T9930] ? do_vfs_ioctl+0x116f/0x1530 [ 327.127054][ T9930] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 327.127101][ T9930] ? do_futex+0x458/0x4e0 [ 327.127161][ T9930] blkdev_ioctl+0x4c1/0x740 [ 327.127200][ T9930] ? __pfx_blkdev_ioctl+0x10/0x10 [ 327.127240][ T9930] ? bpf_lsm_file_ioctl+0x9/0x20 [ 327.127271][ T9930] ? __pfx_blkdev_ioctl+0x10/0x10 [ 327.127307][ T9930] __se_sys_ioctl+0xfc/0x170 [ 327.127342][ T9930] do_syscall_64+0x166/0x520 [ 327.127364][ T9930] ? trace_irq_disable+0x3b/0x140 [ 327.127391][ T9930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 327.127415][ T9930] ? clear_bhb_loop+0x70/0xc0 [ 327.127454][ T9930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 327.127476][ T9930] RIP: 0033:0x7fa6e619e159 [ 327.127499][ T9930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 327.127518][ T9930] RSP: 002b:00007fa6e70a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 327.127543][ T9930] RAX: ffffffffffffffda RBX: 00007fa6e6425fa0 RCX: 00007fa6e619e159 [ 327.127561][ T9930] RDX: 0000200000000440 RSI: 00000000c0481273 RDI: 0000000000000005 [ 327.127577][ T9930] RBP: 00007fa6e623506b R08: 0000000000000000 R09: 0000000000000000 [ 327.127592][ T9930] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 327.127606][ T9930] R13: 00007fa6e6426038 R14: 00007fa6e6425fa0 R15: 00007ffe201fd718 [ 327.127643][ T9930] [ 327.537933][ T9932] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 327.537969][ T9932] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 327.537983][ T9932] overlayfs: missing 'lowerdir' [ 327.865175][ T9941] random: crng reseeded on system resumption [ 327.964221][ T9941] FAULT_INJECTION: forcing a failure. [ 327.964221][ T9941] name failslab, interval 1, probability 0, space 0, times 0 [ 327.964254][ T9941] CPU: 1 UID: 0 PID: 9941 Comm: syz.4.1098 Tainted: G L syzkaller #0 PREEMPT(full) [ 327.964287][ T9941] Tainted: [L]=SOFTLOCKUP [ 327.964296][ T9941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 327.964311][ T9941] Call Trace: [ 327.964320][ T9941] [ 327.964331][ T9941] dump_stack_lvl+0xe8/0x150 [ 327.964367][ T9941] should_fail_ex+0x3eb/0x540 [ 327.964409][ T9941] should_failslab+0xa8/0x100 [ 327.964443][ T9941] __kmalloc_cache_noprof+0x9e/0x600 [ 327.964471][ T9941] ? __raw_spin_lock_init+0x45/0x100 [ 327.964505][ T9941] ? __kthread_create_on_node+0x115/0x3d0 [ 327.964539][ T9941] ? __kthread_create_on_node+0x115/0x3d0 [ 327.964575][ T9941] ? __init_swait_queue_head+0xa8/0x150 [ 327.964609][ T9941] ? __pfx_hwrng_fillfn+0x10/0x10 [ 327.964640][ T9941] __kthread_create_on_node+0x115/0x3d0 [ 327.964687][ T9941] ? __pfx___kthread_create_on_node+0x10/0x10 [ 327.964737][ T9941] ? __pfx_hwrng_fillfn+0x10/0x10 [ 327.964767][ T9941] ? __pfx_hwrng_fillfn+0x10/0x10 [ 327.964795][ T9941] kthread_create_on_node+0xeb/0x140 [ 327.964831][ T9941] ? __pfx___mutex_lock+0x10/0x10 [ 327.964853][ T9941] ? random_pm_notification+0x16d/0x230 [ 327.964887][ T9941] ? __pfx_kthread_create_on_node+0x10/0x10 [ 327.964937][ T9941] hwrng_start_hwrng_fillfn+0xc6/0x130 [ 327.964965][ T9941] hwrng_pm_notifier+0x9a/0x1a0 [ 327.964992][ T9941] notifier_call_chain+0x1a5/0x3d0 [ 327.965024][ T9941] blocking_notifier_call_chain+0x6a/0x90 [ 327.965052][ T9941] snapshot_release+0x13c/0x210 [ 327.965081][ T9941] ? __pfx_snapshot_release+0x10/0x10 [ 327.965109][ T9941] __fput+0x413/0xa50 [ 327.965152][ T9941] fput_close_sync+0x11f/0x240 [ 327.965188][ T9941] ? __pfx_fput_close_sync+0x10/0x10 [ 327.965225][ T9941] ? do_raw_spin_unlock+0xf5/0x200 [ 327.965267][ T9941] __se_sys_close+0xa2/0x160 [ 327.965292][ T9941] do_syscall_64+0x166/0x520 [ 327.965314][ T9941] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 327.965339][ T9941] ? clear_bhb_loop+0x70/0xc0 [ 327.965368][ T9941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 327.965391][ T9941] RIP: 0033:0x7f6fe299e159 [ 327.965413][ T9941] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 327.965435][ T9941] RSP: 002b:00007f6fe3890028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 327.965462][ T9941] RAX: ffffffffffffffda RBX: 00007f6fe2c25fa0 RCX: 00007f6fe299e159 [ 327.965481][ T9941] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 327.965497][ T9941] RBP: 00007f6fe2a3506b R08: 0000000000000000 R09: 0000000000000000 [ 327.965512][ T9941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 327.965528][ T9941] R13: 00007f6fe2c26038 R14: 00007f6fe2c25fa0 R15: 00007ffc7c97fd88 [ 327.965567][ T9941] [ 327.965613][ T9941] hwrng_fill thread creation failed [ 328.536398][ T7894] usb 5-1: new high-speed USB device number 70 using dummy_hcd Hü[ 328.586467][ T5610] Bluetooth: hci5: command 0xfc00 tx timeout [ 328.592358][ T54] Bluetooth: hci5: Reading QCA version information failed (-110) [ 328.592416][ T54] Bluetooth: hci5: Retry BT power ON:0 [ 328.696392][ T7894] usb 5-1: Using ep0 maxpacket: 32 [ 328.698018][ T7894] usb 5-1: New USB device found: idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 328.699182][ T7894] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 328.704069][ T7894] usb 5-1: config 0 descriptor?? ü[ 328.910432][ T7894] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 328.911741][ T7894] usb 5-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 328.911770][ T7894] usb 5-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw ü[ 329.085534][ T9962] syzkaller1: entered promiscuous mode [ 329.085563][ T9962] syzkaller1: entered allmulticast mode [ 329.175665][ T9972] Invalid logical block size (4608) [ 329.205430][ T9973] blktrace: Concurrent blktraces are not allowed on loop15 [ 329.485161][ T9977] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 329.485189][ T9977] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 329.485201][ T9977] overlayfs: missing 'lowerdir' [ 329.551955][ T9963] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.552439][ T9963] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 329.582688][ T9982] random: crng reseeded on system resumption [ 329.730258][ T9986] FAULT_INJECTION: forcing a failure. [ 329.730258][ T9986] name fail_futex, interval 1, probability 0, space 0, times 0 [ 329.730297][ T9986] CPU: 1 UID: 0 PID: 9986 Comm: syz.6.1109 Tainted: G L syzkaller #0 PREEMPT(full) [ 329.730331][ T9986] Tainted: [L]=SOFTLOCKUP [ 329.730342][ T9986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 329.730357][ T9986] Call Trace: [ 329.730367][ T9986] [ 329.730378][ T9986] dump_stack_lvl+0xe8/0x150 [ 329.730415][ T9986] should_fail_ex+0x3eb/0x540 [ 329.730475][ T9986] get_futex_key+0x1b4/0x1580 [ 329.730512][ T9986] ? __pfx_futex_wake_mark+0x10/0x10 [ 329.730544][ T9986] ? __pfx_get_futex_key+0x10/0x10 [ 329.730589][ T9986] futex_wake+0x119/0x5f0 [ 329.730618][ T9986] ? __pfx_futex_wait+0x10/0x10 [ 329.730643][ T9986] ? __pfx_futex_wake+0x10/0x10 [ 329.730672][ T9986] ? __asan_memset+0x22/0x50 [ 329.730696][ T9986] ? locks_remove_posix+0x14f/0x6a0 [ 329.730734][ T9986] do_futex+0x458/0x4e0 [ 329.730774][ T9986] ? __pfx_do_futex+0x10/0x10 [ 329.730836][ T9986] __se_sys_futex+0x3a8/0x450 [ 329.730877][ T9986] ? fput_close_sync+0x1f8/0x240 [ 329.730914][ T9986] ? __pfx___se_sys_futex+0x10/0x10 [ 329.730948][ T9986] ? do_raw_spin_unlock+0xf5/0x200 [ 329.730988][ T9986] ? __x64_sys_futex+0x21/0xf0 [ 329.731028][ T9986] do_syscall_64+0x166/0x520 [ 329.731052][ T9986] ? trace_irq_disable+0x3b/0x140 [ 329.731080][ T9986] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.731106][ T9986] ? clear_bhb_loop+0x70/0xc0 [ 329.731136][ T9986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.731161][ T9986] RIP: 0033:0x7fb90b79e159 [ 329.731184][ T9986] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 329.731206][ T9986] RSP: 002b:00007fb90c5860e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 329.731245][ T9986] RAX: ffffffffffffffda RBX: 00007fb90ba26098 RCX: 00007fb90b79e159 [ 329.731268][ T9986] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb90ba2609c [ 329.731284][ T9986] RBP: 00007fb90ba26090 R08: 3fffffffffffffff R09: 0000000000000000 [ 329.731301][ T9986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 329.731316][ T9986] R13: 00007fb90ba26128 R14: 00007ffcc91514f0 R15: 00007ffcc91515d8 [ 329.731352][ T9986] [ 330.216449][ T5692] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 330.337888][ T5705] usb 8-1: new high-speed USB device number 52 using dummy_hcd [ 330.366396][ T5692] usb 9-1: Using ep0 maxpacket: 8 [ 330.368218][ T5692] usb 9-1: New USB device found: idVendor=046d, idProduct=c50c, bcdDevice=0.00 [ 330.369363][ T5692] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 330.369397][ T5692] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 330.369445][ T5692] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.373103][ T5692] usb 9-1: config 0 descriptor?? [ 330.507304][ T5705] usb 8-1: Using ep0 maxpacket: 8 [ 330.509450][ T5705] usb 8-1: unable to get BOS descriptor or descriptor too short [ 330.509504][ T5705] usb 8-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 330.510668][ T5705] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 330.510694][ T5705] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 330.510740][ T5705] usb 8-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 330.513222][ T5705] usb 8-1: New USB device strings: Mfr=1, Product=232, SerialNumber=3 [ 330.513251][ T5705] usb 8-1: Product: syz [ 330.513269][ T5705] usb 8-1: Manufacturer: syz [ 330.513285][ T5705] usb 8-1: SerialNumber: syz [ 330.722201][ T5692] usbhid 9-1:0.0: can't add hid device: -71 [ 330.722295][ T5692] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 330.743242][ T5692] usb 9-1: USB disconnect, device number 6 [ 330.781824][ T5705] cdc_ncm 8-1:1.0: CDC Union missing and no IAD found [ 330.781883][ T5705] cdc_ncm 8-1:1.0: bind() failure [ 330.810358][ T5705] usb 8-1: USB disconnect, device number 52 Hü[ 330.906772][ T5610] Bluetooth: hci5: command 0xfc00 tx timeout [ 330.906827][ T54] Bluetooth: hci5: Reading QCA version information failed (-110) [ 330.906853][ T54] Bluetooth: hci5: Retry BT power ON:1 ü[ 331.651830][ T9995] smpboot: CPU 1 is now offline ü[ 332.148164][T10007] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 332.148187][T10007] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 332.148196][T10007] overlayfs: missing 'lowerdir' [ 332.436463][ T5692] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 332.546359][ T10] usb 8-1: new high-speed USB device number 53 using dummy_hcd [ 332.598309][ T5692] usb 9-1: New USB device found: idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 332.601394][ T5692] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.601413][ T5692] usb 9-1: Product: syz [ 332.601425][ T5692] usb 9-1: Manufacturer: syz [ 332.601436][ T5692] usb 9-1: SerialNumber: syz [ 332.605274][ T5692] usb 9-1: config 0 descriptor?? [ 332.706359][ T10] usb 8-1: device descriptor read/64, error -71 [ 332.947958][ T10] usb 8-1: new high-speed USB device number 54 using dummy_hcd [ 333.037612][ T5692] usb 9-1: Firmware: major: 165, minor: 173, hardware type: UNKNOWN (213) [ 333.086428][ T10] usb 8-1: device descriptor read/64, error -71 [ 333.196755][ T10] usb usb8-port1: attempt power cycle Hü[ 333.230956][ T5610] Bluetooth: hci5: command 0xfc00 tx timeout [ 333.231422][ T54] Bluetooth: hci5: Reading QCA version information failed (-110) [ 333.231438][ T54] Bluetooth: hci5: Retry BT power ON:2 [ 333.259340][ T5692] usb 9-1: no permanent extended address found, random address set [ 333.259360][ T5692] usb 9-1: atusb_probe: initialization failed, error = -524 [ 333.259745][ T5692] atusb 9-1:0.0: probe with driver atusb failed with error -524 [ 333.465760][ T9] usb 9-1: USB disconnect, device number 7 ü[ 333.556370][ T10] usb 8-1: new high-speed USB device number 55 using dummy_hcd [ 333.577408][ T10] usb 8-1: device descriptor read/8, error -71 [ 333.816538][ T10] usb 8-1: new high-speed USB device number 56 using dummy_hcd [ 333.837643][ T10] usb 8-1: device descriptor read/8, error -71 [ 333.947605][ T10] usb usb8-port1: unable to enumerate USB device [ 334.105831][T10014] MTD: Couldn't look up './sys/file0': -2 [ 334.466431][ T9] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 334.617573][ T9] usb 9-1: New USB device found: idVendor=0d8c, idProduct=0014, bcdDevice=0.40 [ 334.618411][ T9] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 334.618428][ T9] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 334.620101][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.620118][ T9] usb 9-1: Product: syz [ 334.620129][ T9] usb 9-1: Manufacturer: syz [ 334.620139][ T9] usb 9-1: SerialNumber: syz [ 334.696865][ T9] usb 9-1: 0:1 : does not exist [ 334.863212][T10016] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4013772623 (16055090492 ns) > initial count (2788997612 ns). Using initial count to start timer. [ 334.888726][ T9] usb 9-1: 3:0: failed to get current value for ch 0 (-71) [ 334.902369][ T9] usb 9-1: unit 13 not found! [ 334.986593][ T9] usb 9-1: USB disconnect, device number 8 [ 335.042742][ T5621] udevd[5621]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 335.548511][ T5610] Bluetooth: hci5: command 0xfc00 tx timeout [ 335.548558][ T54] Bluetooth: hci5: Reading QCA version information failed (-110) [ 335.767796][ T9] usb 8-1: new high-speed USB device number 57 using dummy_hcd [ 335.916519][ T9] usb 8-1: Using ep0 maxpacket: 32 [ 335.919503][ T9] usb 8-1: New USB device found: idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 335.920922][ T9] usb 8-1: config 0 has an invalid interface number: 119 but max is 0 [ 335.920940][ T9] usb 8-1: config 0 has no interface number 0 [ 335.920967][ T9] usb 8-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 335.920984][ T9] usb 8-1: config 0 interface 119 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 335.921004][ T9] usb 8-1: config 0 interface 119 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 27 [ 335.921022][ T9] usb 8-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 335.958980][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.959000][ T9] usb 8-1: Product: syz [ 335.959012][ T9] usb 8-1: Manufacturer: syz [ 335.959023][ T9] usb 8-1: SerialNumber: syz [ 336.055587][ T9] usb 8-1: config 0 descriptor?? [ 336.056248][T10022] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 336.094655][ T9] input: bcm5974 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.119/input/input39 [ 336.108487][ T4961] usb 8-1: BOGUS urb xfer, pipe 1 != type 3 [ 336.360989][ T10] usb 8-1: USB disconnect, device number 57 [ 337.086402][ T5692] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 337.109394][T10044] vcan0 speed is unknown, defaulting to 1000 [ 337.239267][ T5692] usb 9-1: Using ep0 maxpacket: 8 [ 337.241047][ T5692] usb 9-1: New USB device found: idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 337.241865][ T5692] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 337.243587][ T5692] usb 9-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 337.243604][ T5692] usb 9-1: Product: syz [ 337.243615][ T5692] usb 9-1: Manufacturer: syz [ 337.243626][ T5692] usb 9-1: SerialNumber: syz [ 337.366362][ T10] usb 8-1: new high-speed USB device number 58 using dummy_hcd [ 337.520894][ T10] usb 8-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 337.521619][ T10] usb 8-1: config 0 has no interfaces? [ 337.523434][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.523475][ T10] usb 8-1: Product: syz [ 337.523486][ T10] usb 8-1: Manufacturer: syz [ 337.523497][ T10] usb 8-1: SerialNumber: syz [ 337.571793][ T5692] usb 9-1: Invalid connection information received from device [ 337.593208][ T10] usb 8-1: config 0 descriptor?? [ 337.801891][ T5692] usb 9-1: USB disconnect, device number 9 [ 337.860695][T10044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.861022][T10044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.903193][ T10] usb 8-1: USB disconnect, device number 58 [ 338.265478][T10054] netlink: 'syz.4.1139': attribute type 21 has an invalid length. [ 340.588283][ T10] usb 8-1: new high-speed USB device number 59 using dummy_hcd [ 340.719515][ T10] usb 8-1: device descriptor read/64, error -71 [ 340.956646][ T10] usb 8-1: new high-speed USB device number 60 using dummy_hcd [ 341.086600][ T10] usb 8-1: device descriptor read/64, error -71 [ 341.197369][ T10] usb usb8-port1: attempt power cycle ü[ 341.424578][T10108] netlink: 'syz.8.1156': attribute type 10 has an invalid length. [ 341.542200][ T10] usb 8-1: new high-speed USB device number 61 using dummy_hcd [ 341.557788][ T10] usb 8-1: device descriptor read/8, error -71 [ 341.604566][T10113] openvswitch: netlink: IP tunnel attribute has 5405 unknown bytes. [ 341.796425][ T10] usb 8-1: new high-speed USB device number 62 using dummy_hcd [ 341.818166][ T10] usb 8-1: device descriptor read/8, error -71 [ 341.928298][ T10] usb usb8-port1: unable to enumerate USB device [ 342.324930][T10120] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 342.837290][ T10] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 342.987865][ T10] usb 9-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 342.988867][ T10] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 342.988885][ T10] usb 9-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 342.988900][ T10] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 342.988942][ T10] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 342.988962][ T10] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 342.992757][ T10] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 342.992775][ T10] usb 9-1: Product: syz [ 342.992786][ T10] usb 9-1: Manufacturer: syz [ 343.080960][ T10] cdc_wdm 9-1:1.0: skipping garbage [ 343.080976][ T10] cdc_wdm 9-1:1.0: skipping garbage [ 343.104951][ T10] cdc_wdm 9-1:1.0: cdc-wdm0: USB WDM device [ 343.104981][ T10] cdc_wdm 9-1:1.0: Unknown control protocol ü[ 343.569116][ C0] cdc_wdm 9-1:1.0: Unexpected error -71 [ 343.570060][ C0] cdc_wdm 9-1:1.0: nonzero urb status received: -71 [ 343.570143][ C0] cdc_wdm 9-1:1.0: wdm_int_callback - 0 bytes [ 343.570336][ C0] cdc_wdm 9-1:1.0: nonzero urb status received: -71 [ 343.570350][ C0] cdc_wdm 9-1:1.0: wdm_int_callback - 0 bytes [ 343.570685][ C0] cdc_wdm 9-1:1.0: nonzero urb status received: -71 [ 343.570699][ C0] cdc_wdm 9-1:1.0: wdm_int_callback - 0 bytes [ 343.572208][ C0] cdc_wdm 9-1:1.0: nonzero urb status received: -71 [ 343.572223][ C0] cdc_wdm 9-1:1.0: wdm_int_callback - 0 bytes [ 343.575004][ C0] cdc_wdm 9-1:1.0: nonzero urb status received: -71 [ 343.575019][ C0] cdc_wdm 9-1:1.0: wdm_int_callback - 0 bytes [ 343.575214][ C0] cdc_wdm 9-1:1.0: nonzero urb status received: -71 [ 343.575228][ C0] cdc_wdm 9-1:1.0: wdm_int_callback - 0 bytes [ 343.575298][ T5691] usb 9-1: USB disconnect, device number 10 [ 343.575411][ C0] cdc_wdm 9-1:1.0: nonzero urb status received: -71 [ 343.575423][ C0] cdc_wdm 9-1:1.0: wdm_int_callback - 0 bytes [ 343.575435][ C0] cdc_wdm 9-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 343.825587][T10132] ./dev/sda1: Can't lookup blockdev [ 344.620082][T10137] netlink: 44 bytes leftover after parsing attributes in process `syz.7.1167'. [ 344.620141][T10137] ksmbd: Unknown IPC event: 0, ignore. [ 344.767427][T10137] overlayfs: missing 'workdir' [ 345.049762][ T5617] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 345.065540][ T5617] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 345.073834][ T5617] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 345.088971][ T5617] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 345.094092][ T5617] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 345.727459][ T5691] usb 8-1: new high-speed USB device number 63 using dummy_hcd [ 345.880083][ T5691] usb 8-1: New USB device found: idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 345.884285][ T5691] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.884304][ T5691] usb 8-1: Product: syz [ 345.884316][ T5691] usb 8-1: Manufacturer: syz [ 345.884327][ T5691] usb 8-1: SerialNumber: syz [ 345.922767][ T5691] usb 8-1: config 0 descriptor?? [ 345.942846][ T5691] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 346.018517][ T5691] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 346.020671][ T5691] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 346.020719][ T5691] usb 8-1: media controller created [ 346.124583][ T5691] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 346.151721][T10152] dvb-usb: bulk message failed: -22 (7/0) [ 346.167404][T10152] netlink: 60 bytes leftover after parsing attributes in process `syz.7.1171'. [ 346.329704][T10143] vcan0 speed is unknown, defaulting to 1000 [ 346.391026][ T5691] DVB: Unable to find symbol mt352_attach() [ 346.505956][ T5691] DVB: Unable to find symbol nxt6000_attach() [ 346.505969][ T5691] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 346.506117][T10167] dlm: no locking on control device [ 346.537387][ T5691] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.7/usb8/8-1/input/input40 [ 346.564315][ T5691] dvb-usb: schedule remote query interval to 1000 msecs. [ 346.564332][ T5691] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 346.564344][ T5691] dvb-usb: bulk message failed: -22 (7/0) [ 346.564355][ T5691] dvb-usb: bulk message failed: -22 (7/0) [ 346.623899][ T5691] usb 8-1: USB disconnect, device number 63 [ 346.653461][T10165] kvm_intel: kvm [10164]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x23 [ 346.895179][ T5691] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 347.058982][T10172] ªªªªªª: renamed from vlan0 (while UP) [ 347.147082][ T5610] Bluetooth: hci6: command tx timeout [ 347.262046][T10174] pim6reg: entered allmulticast mode [ 347.327779][T10174] /dev/nullb0: Can't open blockdev [ 348.223302][T10192] netlink: 'syz.4.1183': attribute type 58 has an invalid length. [ 348.415546][T10143] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.418204][T10143] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.418314][T10143] bridge_slave_0: entered allmulticast mode [ 348.423477][T10143] bridge_slave_0: entered promiscuous mode [ 348.463261][T10143] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.464836][T10143] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.464945][T10143] bridge_slave_1: entered allmulticast mode [ 348.493422][T10143] bridge_slave_1: entered promiscuous mode [ 348.656528][T10143] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 348.687265][T10143] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 348.800167][T10143] team0: Port device team_slave_0 added [ 348.813709][T10143] team0: Port device team_slave_1 added [ 348.945247][T10143] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 348.945261][T10143] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 348.945281][T10143] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 349.033991][T10143] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 349.034005][T10143] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 349.034025][T10143] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 349.228334][ T5610] Bluetooth: hci6: command tx timeout [ 349.235585][T10143] hsr_slave_0: entered promiscuous mode [ 349.260239][T10143] hsr_slave_1: entered promiscuous mode [ 349.260895][T10143] debugfs: 'hsr0' already exists in 'hsr' [ 349.260911][T10143] Cannot create hsr debugfs directory [ 349.414638][T10209] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 349.488776][T10209] /dev/nullb0: Can't open blockdev [ 350.435659][T10143] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 350.460601][T10143] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 350.461301][T10143] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 350.512726][T10143] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 350.514095][T10143] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 350.549965][ T5610] Bluetooth: hci2: connection err: -111 [ 350.573670][T10143] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 350.574747][T10143] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 350.606529][T10143] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 350.901101][T10143] 8021q: adding VLAN 0 to HW filter on device bond0 [ 350.944643][T10143] 8021q: adding VLAN 0 to HW filter on device team0 [ 350.965372][ T6133] bridge0: port 1(bridge_slave_0) entered blocking state [ 350.965461][ T6133] bridge0: port 1(bridge_slave_0) entered forwarding state [ 350.999764][ T6132] bridge0: port 2(bridge_slave_1) entered blocking state [ 350.999839][ T6132] bridge0: port 2(bridge_slave_1) entered forwarding state [ 351.307724][ T5610] Bluetooth: hci6: command tx timeout [ 351.843762][T10242] kernel profiling enabled (shift: 63) [ 351.843776][T10242] profiling shift: 63 too large [ 352.842036][T10143] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 353.387139][ T5610] Bluetooth: hci6: command tx timeout [ 353.639627][T10143] veth0_vlan: entered promiscuous mode [ 353.680158][T10143] veth1_vlan: entered promiscuous mode [ 353.737225][ T10] usb 8-1: new high-speed USB device number 64 using dummy_hcd [ 353.768137][T10143] veth0_macvtap: entered promiscuous mode [ 353.789854][T10143] veth1_macvtap: entered promiscuous mode [ 353.834821][T10143] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 353.865724][T10143] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 353.900704][ T10] usb 8-1: New USB device found: idVendor=1b96, idProduct=0011, bcdDevice=0.00 [ 353.901657][ T10] usb 8-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 353.901679][ T10] usb 8-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 353.901697][ T10] usb 8-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 353.901716][ T10] usb 8-1: config 0 interface 0 has no altsetting 0 [ 353.901740][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.984999][ T10] usb 8-1: config 0 descriptor?? [ 354.062758][ T8876] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.078359][ T9857] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.080100][ T8874] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.080130][ T8874] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.383671][ T8887] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 354.383690][ T8887] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 354.492102][ T10] input: HID 1b96:0011 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:1B96:0011.0015/input/input41 [ 354.590499][ T85] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 354.590516][ T85] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 354.613641][ T10] ntrig 0003:1B96:0011.0015: offset (1) exceeds report_count (1) [ 354.614330][ T10] ntrig 0003:1B96:0011.0015: offset (2) exceeds report_count (1) [ 354.614348][ T10] ntrig 0003:1B96:0011.0015: offset (3) exceeds report_count (1) [ 354.614364][ T10] ntrig 0003:1B96:0011.0015: offset (4) exceeds report_count (1) [ 354.614377][ T10] ntrig 0003:1B96:0011.0015: offset (5) exceeds report_count (1) [ 354.614391][ T10] ntrig 0003:1B96:0011.0015: offset (39) exceeds report_count (1) [ 354.614406][ T10] ntrig 0003:1B96:0011.0015: offset (9) exceeds report_count (1) [ 354.614420][ T10] ntrig 0003:1B96:0011.0015: offset (25) exceeds report_count (1) [ 354.983909][T10291] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 354.984249][T10291] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.492686][ T10] ntrig 0003:1B96:0011.0015: input,hidraw0: USB HID v0.04 Joystick [HID 1b96:0011] on usb-dummy_hcd.7-1/input0 [ 355.840442][T10313] block nbd8: not configured, cannot reconfigure [ 355.962072][ T10] usb 8-1: reset high-speed USB device number 64 using dummy_hcd [ 356.820214][ T5691] usb 8-1: USB disconnect, device number 64 [ 358.057055][ T5691] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 358.106748][ T5692] usb 10-1: new full-speed USB device number 2 using dummy_hcd [ 358.221715][ T5691] usb 9-1: New USB device found: idVendor=04e8, idProduct=6889, bcdDevice=1.00 [ 358.243669][ T5691] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.243690][ T5691] usb 9-1: Product: syz [ 358.243701][ T5691] usb 9-1: Manufacturer: syz [ 358.243713][ T5691] usb 9-1: SerialNumber: syz [ 358.283318][ T5692] usb 10-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 358.298724][ T5692] usb 10-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 358.298749][ T5692] usb 10-1: config 0 interface 0 altsetting 255 endpoint 0x8F has invalid wMaxPacketSize 0 [ 358.298766][ T5692] usb 10-1: config 0 interface 0 has no altsetting 0 [ 358.339342][ T5692] usb 10-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 358.339363][ T5692] usb 10-1: Product: syz [ 358.339374][ T5692] usb 10-1: Manufacturer: syz [ 358.339385][ T5692] usb 10-1: SerialNumber: syz [ 358.346872][ T5692] usb 10-1: config 0 descriptor?? [ 358.415273][ T5692] usb 10-1: selecting invalid altsetting 0 [ 358.575986][T10358] netlink: 822 bytes leftover after parsing attributes in process `syz.4.1230'. [ 358.602012][ T33] audit: type=1326 audit(1790398447.487:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10350 comm="syz.9.1227" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f67b759e159 code=0x0 [ 359.191441][ T5691] kalmia 9-1:1.0 wwan0: register 'kalmia' at usb-dummy_hcd.8-1, Samsung Kalmia LTE USB dongle, 02:00:00:00:00:01 [ 359.488186][ T5691] usb 8-1: new high-speed USB device number 65 using dummy_hcd [ 359.638058][ T5691] usb 8-1: New USB device found: idVendor=108c, idProduct=0159, bcdDevice=0.01 [ 359.648673][ T5691] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 359.648702][ T5691] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 359.680551][ T5691] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.680572][ T5691] usb 8-1: Product: syz [ 359.680604][ T5691] usb 8-1: Manufacturer: syz [ 359.680616][ T5691] usb 8-1: SerialNumber: syz [ 359.736638][ T5691] etas_es58x 8-1:1.0: Starting syz syz (Serial Number syz) [ 360.235261][ T5691] etas_es58x 8-1:1.0: could not retrieve the product info string [ 360.390241][ T5691] usb 8-1: USB disconnect, device number 65 [ 360.407544][ T5691] etas_es58x 8-1:1.0: Disconnecting syz syz [ 360.479329][ T5343] usb 9-1: USB disconnect, device number 11 [ 360.501857][ T5343] kalmia 9-1:1.0 wwan0: unregister 'kalmia' usb-dummy_hcd.8-1, Samsung Kalmia LTE USB dongle [ 360.956061][ T5691] usb 10-1: USB disconnect, device number 2 [ 361.513264][T10413] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1241'. [ 362.072421][T10424] FAULT_INJECTION: forcing a failure. [ 362.072421][T10424] name failslab, interval 1, probability 0, space 0, times 0 [ 362.072478][T10424] CPU: 0 UID: 0 PID: 10424 Comm: syz.9.1243 Tainted: G L syzkaller #0 PREEMPT(full) [ 362.072502][T10424] Tainted: [L]=SOFTLOCKUP [ 362.072521][T10424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 362.072531][T10424] Call Trace: [ 362.072559][T10424] [ 362.072638][T10424] dump_stack_lvl+0xe8/0x150 [ 362.072758][T10424] should_fail_ex+0x3eb/0x540 [ 362.072852][T10424] should_failslab+0xa8/0x100 [ 362.072892][T10424] __kmalloc_cache_noprof+0x9e/0x600 [ 362.072914][T10424] ? relay_open_buf+0x129/0xda0 [ 362.072995][T10424] ? relay_open_buf+0x129/0xda0 [ 362.073025][T10424] relay_open_buf+0x129/0xda0 [ 362.073059][T10424] relay_open+0x413/0x900 [ 362.073088][T10424] blk_trace_setup_prepare+0x425/0x5a0 [ 362.073119][T10424] blk_trace_setup+0x2f5/0x520 [ 362.073144][T10424] ? __pfx_blk_trace_setup+0x10/0x10 [ 362.073180][T10424] ? snprintf+0xe8/0x140 [ 362.073267][T10424] blk_trace_ioctl+0x37f/0x910 [ 362.073294][T10424] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 362.073319][T10424] ? kasan_quarantine_put+0xbb/0x1f0 [ 362.073344][T10424] ? tomoyo_path_number_perm+0x219/0x5f0 [ 362.073400][T10424] ? tomoyo_path_number_perm+0x219/0x5f0 [ 362.073424][T10424] ? do_vfs_ioctl+0x116f/0x1530 [ 362.073483][T10424] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 362.073515][T10424] ? do_futex+0x3e7/0x4e0 [ 362.073555][T10424] blkdev_ioctl+0x4c1/0x740 [ 362.073617][T10424] ? __pfx_blkdev_ioctl+0x10/0x10 [ 362.073645][T10424] ? bpf_lsm_file_ioctl+0x9/0x20 [ 362.073677][T10424] ? __pfx_blkdev_ioctl+0x10/0x10 [ 362.073701][T10424] __se_sys_ioctl+0xfc/0x170 [ 362.073724][T10424] do_syscall_64+0x166/0x520 [ 362.073758][T10424] ? trace_irq_disable+0x3b/0x140 [ 362.073778][T10424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.073811][T10424] ? clear_bhb_loop+0x70/0xc0 [ 362.073832][T10424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.073849][T10424] RIP: 0033:0x7f67b759e159 [ 362.073869][T10424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 362.073903][T10424] RSP: 002b:00007f67b8427028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 362.073941][T10424] RAX: ffffffffffffffda RBX: 00007f67b7825fa0 RCX: 00007f67b759e159 [ 362.073954][T10424] RDX: 0000200000000440 RSI: 00000000c0481273 RDI: 0000000000000005 [ 362.073965][T10424] RBP: 00007f67b763506b R08: 0000000000000000 R09: 0000000000000000 [ 362.073976][T10424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 362.073986][T10424] R13: 00007f67b7826038 R14: 00007f67b7825fa0 R15: 00007ffc274fa518 [ 362.074012][T10424] [ 362.635040][T10422] vcan0 speed is unknown, defaulting to 1000 [ 363.136414][ T5692] usb 8-1: new high-speed USB device number 66 using dummy_hcd [ 363.298841][ T5692] usb 8-1: New USB device found: idVendor=0bda, idProduct=8150, bcdDevice=0.00 [ 363.337709][ T5692] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.337731][ T5692] usb 8-1: Product: syz [ 363.337742][ T5692] usb 8-1: Manufacturer: syz [ 363.337754][ T5692] usb 8-1: SerialNumber: syz [ 363.762934][ T5692] rtl8150 8-1:1.0: couldn't reset the device [ 363.763166][ T5692] rtl8150 8-1:1.0: probe with driver rtl8150 failed with error -5 [ 363.803924][ T5692] usb 8-1: USB disconnect, device number 66 [ 364.485213][T10458] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1248'. [ 364.989226][T10467] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 365.094097][T10468] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 365.174867][T10420] syz.4.1242 (10420): drop_caches: 2 [ 365.804048][T10465] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 367.368944][ T5692] usb 8-1: new full-speed USB device number 67 using dummy_hcd [ 367.517191][ T5692] usb 8-1: New USB device found: idVendor=056a, idProduct=0318, bcdDevice=0.00 [ 367.518788][ T5692] usb 8-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 367.518813][ T5692] usb 8-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 367.518832][ T5692] usb 8-1: config 0 interface 0 has no altsetting 0 [ 367.518857][ T5692] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 367.622325][ T5692] usb 8-1: config 0 descriptor?? [ 367.737132][ T5343] usb 10-1: new high-speed USB device number 3 using dummy_hcd ü[ 367.888239][ T5343] usb 10-1: New USB device found: idVendor=0bda, idProduct=8150, bcdDevice=0.00 [ 367.892772][ T5343] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.892792][ T5343] usb 10-1: Product: syz [ 367.892803][ T5343] usb 10-1: Manufacturer: syz [ 367.892815][ T5343] usb 10-1: SerialNumber: syz [ 368.230695][ T5343] rtl8150 10-1:1.0: couldn't reset the device [ 368.230917][ T5343] rtl8150 10-1:1.0: probe with driver rtl8150 failed with error -5 [ 368.268794][ T5343] usb 10-1: USB disconnect, device number 3 [ 368.396363][ T5691] usb 9-1: new full-speed USB device number 12 using dummy_hcd [ 368.548378][ T5691] usb 9-1: New USB device found: idVendor=0d46, idProduct=2012, bcdDevice=4d.ec [ 368.549242][ T5691] usb 9-1: config 0 has an invalid interface number: 148 but max is 0 [ 368.549260][ T5691] usb 9-1: config 0 has no interface number 0 [ 368.549289][ T5691] usb 9-1: config 0 interface 148 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 10 [ 368.549308][ T5691] usb 9-1: config 0 interface 148 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 368.550996][ T5691] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.551014][ T5691] usb 9-1: Product: syz [ 368.551026][ T5691] usb 9-1: Manufacturer: syz [ 368.551037][ T5691] usb 9-1: SerialNumber: syz [ 368.653506][ T5691] usb 9-1: config 0 descriptor?? [ 368.664848][ T5691] kobil_sct 9-1:0.148: KOBIL USB smart card terminal converter detected [ 368.684034][ T5691] usb 9-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 368.749658][T10496] 9pnet_virtio: no channels available for device syz [ 368.871926][ T5692] usb 9-1: USB disconnect, device number 12 [ 368.894532][ T5692] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 368.895014][ T5692] kobil_sct 9-1:0.148: device disconnected [ 369.949382][ T5691] usb 8-1: USB disconnect, device number 67 ü[ 370.731844][T10530] FAULT_INJECTION: forcing a failure. [ 370.731844][T10530] name failslab, interval 1, probability 0, space 0, times 0 [ 370.731871][T10530] CPU: 0 UID: 0 PID: 10530 Comm: syz.4.1268 Tainted: G L syzkaller #0 PREEMPT(full) [ 370.731901][T10530] Tainted: [L]=SOFTLOCKUP [ 370.731907][T10530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 370.731917][T10530] Call Trace: [ 370.731924][T10530] [ 370.731932][T10530] dump_stack_lvl+0xe8/0x150 [ 370.731958][T10530] should_fail_ex+0x3eb/0x540 [ 370.731985][T10530] ? dup_task_struct+0x52/0xa00 [ 370.732043][T10530] should_failslab+0xa8/0x100 [ 370.732065][T10530] ? dup_task_struct+0x52/0xa00 [ 370.732082][T10530] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 370.732101][T10530] ? dup_task_struct+0x52/0xa00 [ 370.732124][T10530] dup_task_struct+0x52/0xa00 [ 370.732144][T10530] ? _raw_spin_unlock_irq+0x23/0x50 [ 370.732233][T10530] copy_process+0x7db/0x4430 [ 370.732253][T10530] ? __futex_wait+0x3c7/0x470 [ 370.732277][T10530] ? __pfx___futex_wait+0x10/0x10 [ 370.732297][T10530] ? __pfx_futex_wake_mark+0x10/0x10 [ 370.732317][T10530] ? try_to_wake_up+0x8c5/0x14d0 [ 370.732349][T10530] ? __pfx_copy_process+0x10/0x10 [ 370.732376][T10530] kernel_clone+0x2d7/0x940 [ 370.732401][T10530] ? __pfx_kernel_clone+0x10/0x10 [ 370.732429][T10530] ? do_futex+0x3e7/0x4e0 [ 370.732456][T10530] __x64_sys_clone+0x1b6/0x230 [ 370.732479][T10530] ? __pfx___x64_sys_clone+0x10/0x10 [ 370.732511][T10530] ? rcu_is_watching+0x16/0xb0 [ 370.732546][T10530] do_syscall_64+0x166/0x520 [ 370.732561][T10530] ? trace_irq_disable+0x3b/0x140 [ 370.732580][T10530] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.732596][T10530] ? clear_bhb_loop+0x70/0xc0 [ 370.732615][T10530] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.732631][T10530] RIP: 0033:0x7f6fe299e159 [ 370.732646][T10530] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 370.732660][T10530] RSP: 002b:00007f6fe388ffd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 370.732677][T10530] RAX: ffffffffffffffda RBX: 00007f6fe2c25fa0 RCX: 00007f6fe299e159 [ 370.732689][T10530] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 370.732699][T10530] RBP: 00007f6fe2a3506b R08: 0000000000000000 R09: 0000000000000000 [ 370.732709][T10530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 370.732718][T10530] R13: 00007f6fe2c26038 R14: 00007f6fe2c25fa0 R15: 00007ffc7c97fd88 [ 370.732742][T10530] [ 371.037539][ T5610] Bluetooth: hci6: Malformed HCI Event: 0x22 [ 371.524961][T10539] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1270'. [ 372.211556][T10545] netlink: 16402 bytes leftover after parsing attributes in process `syz.8.1273'. [ 373.097946][ T5691] usb 10-1: new high-speed USB device number 4 using dummy_hcd ü[ 373.247945][ T5691] usb 10-1: New USB device found: idVendor=2040, idProduct=5530, bcdDevice=a8.82 [ 373.251115][ T5691] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 373.251134][ T5691] usb 10-1: config 0 has no interfaces? [ 373.251156][ T5691] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.253241][ T5691] usb 10-1: config 0 descriptor?? [ 373.706139][T10567] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1280'. [ 374.536502][T10574] vcan0 speed is unknown, defaulting to 1000 [ 374.748908][T10574] FAULT_INJECTION: forcing a failure. [ 374.748908][T10574] name failslab, interval 1, probability 0, space 0, times 0 [ 374.748935][T10574] CPU: 0 UID: 0 PID: 10574 Comm: syz.8.1282 Tainted: G L syzkaller #0 PREEMPT(full) [ 374.748958][T10574] Tainted: [L]=SOFTLOCKUP [ 374.748964][T10574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 374.748974][T10574] Call Trace: [ 374.748980][T10574] [ 374.748987][T10574] dump_stack_lvl+0xe8/0x150 [ 374.749014][T10574] should_fail_ex+0x3eb/0x540 [ 374.749043][T10574] should_failslab+0xa8/0x100 [ 374.749066][T10574] __kmalloc_node_track_caller_noprof+0xf6/0x720 [ 374.749086][T10574] ? media_pipeline_add_pad+0x297/0x760 [ 374.749178][T10574] ? media_pipeline_add_pad+0x297/0x760 [ 374.749208][T10574] ? media_pipeline_add_pad+0x297/0x760 [ 374.749229][T10574] krealloc_node_align_noprof+0x19a/0x390 [ 374.749272][T10574] media_pipeline_add_pad+0x297/0x760 [ 374.749298][T10574] __media_pipeline_start+0x1fb/0x2440 [ 374.749328][T10574] ? __pfx_vimc_capture_start_streaming+0x10/0x10 [ 374.749391][T10574] media_pipeline_start+0x51/0x70 [ 374.749409][T10574] vimc_capture_start_streaming+0x7c/0x410 [ 374.749430][T10574] ? do_raw_spin_unlock+0xf5/0x200 [ 374.749462][T10574] ? __pfx_vimc_capture_start_streaming+0x10/0x10 [ 374.749484][T10574] vb2_start_streaming+0x11e/0x450 [ 374.749527][T10574] ? __bitmap_weight+0xac/0x100 [ 374.749606][T10574] vb2_core_streamon+0x2c0/0x4d0 [ 374.749638][T10574] __video_do_ioctl+0x8af/0xc70 [ 374.749828][T10574] ? __pfx___video_do_ioctl+0x10/0x10 [ 374.749865][T10574] ? __might_fault+0xaf/0x130 [ 374.749912][T10574] video_usercopy+0x860/0x1430 [ 374.749943][T10574] ? __pfx___video_do_ioctl+0x10/0x10 [ 374.749968][T10574] ? __pfx_video_usercopy+0x10/0x10 [ 374.750009][T10574] v4l2_ioctl+0x18d/0x1e0 [ 374.750032][T10574] ? __pfx_v4l2_ioctl+0x10/0x10 [ 374.750054][T10574] __se_sys_ioctl+0xfc/0x170 [ 374.750078][T10574] do_syscall_64+0x166/0x520 [ 374.750094][T10574] ? trace_irq_disable+0x3b/0x140 [ 374.750114][T10574] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.750131][T10574] ? clear_bhb_loop+0x70/0xc0 [ 374.750152][T10574] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.750169][T10574] RIP: 0033:0x7fa6e619e159 [ 374.750185][T10574] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 374.750199][T10574] RSP: 002b:00007fa6e70a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 374.750216][T10574] RAX: ffffffffffffffda RBX: 00007fa6e6425fa0 RCX: 00007fa6e619e159 [ 374.750228][T10574] RDX: 0000200000000700 RSI: 0000000040045612 RDI: 0000000000000003 [ 374.750239][T10574] RBP: 00007fa6e623506b R08: 0000000000000000 R09: 0000000000000000 [ 374.750250][T10574] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 374.750260][T10574] R13: 00007fa6e6426038 R14: 00007fa6e6425fa0 R15: 00007ffe201fd718 [ 374.750286][T10574] [ 374.790759][T10574] loop5: detected capacity change from 0 to 7 [ 374.792205][T10574] Dev loop5: unable to read RDB block 7 [ 374.792234][T10574] loop5: unable to read partition table [ 374.792370][T10574] loop5: partition table beyond EOD, truncated [ 374.792389][T10574] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 375.518034][T10580] Dead loop on virtual device ip6_vti0 (net 134), fix it urgently! [ 376.417410][ T5343] hid_parser_main: 254 callbacks suppressed [ 376.417508][ T5343] hid-generic 0000:0000:0000.0017: unknown main item tag 0x0 [ 376.544027][ T5343] hid-generic 0000:0000:0000.0017: hidraw0: HID v0.00 Device [syz1] on syz0 [ 376.934388][ T5343] usb 10-1: USB disconnect, device number 4 [ 377.588233][ T5691] usb 8-1: new low-speed USB device number 68 using dummy_hcd [ 377.736405][ T5691] usb 8-1: Invalid ep0 maxpacket: 32 [ 377.866574][ T5691] usb 8-1: new low-speed USB device number 69 using dummy_hcd ü[ 378.016420][ T5691] usb 8-1: Invalid ep0 maxpacket: 32 [ 378.016636][ T5691] usb usb8-port1: attempt power cycle [ 378.356589][ T5691] usb 8-1: new low-speed USB device number 70 using dummy_hcd [ 378.378227][ T5691] usb 8-1: Invalid ep0 maxpacket: 32 [ 378.510275][ T5691] usb 8-1: new low-speed USB device number 71 using dummy_hcd [ 378.528003][ T5691] usb 8-1: Invalid ep0 maxpacket: 32 [ 378.528182][ T5691] usb usb8-port1: unable to enumerate USB device [ 378.673923][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.431050][ T5343] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 379.600187][ T5343] usb 10-1: New USB device found: idVendor=108c, idProduct=0159, bcdDevice=0.01 [ 379.615576][ T5343] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 379.615598][ T5343] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 379.652518][ T5343] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.652538][ T5343] usb 10-1: Product: syz [ 379.652550][ T5343] usb 10-1: Manufacturer: syz [ 379.652561][ T5343] usb 10-1: SerialNumber: syz [ 379.693033][ T5343] etas_es58x 10-1:1.0: Starting syz syz (Serial Number syz) [ 379.921683][ T5343] etas_es58x 10-1:1.0: could not parse product info: 'Б' [ 380.211380][ T5343] usb 10-1: USB disconnect, device number 5 [ 380.229636][ T5343] etas_es58x 10-1:1.0: Disconnecting syz syz [ 380.506445][ T5691] usb 8-1: new high-speed USB device number 72 using dummy_hcd [ 380.659315][ T5691] usb 8-1: New USB device found: idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 380.660499][ T5691] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.687597][ T5691] usb 8-1: config 0 descriptor?? [ 380.708710][ T5691] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 380.943429][T10614] FAULT_INJECTION: forcing a failure. [ 380.943429][T10614] name failslab, interval 1, probability 0, space 0, times 0 [ 380.943457][T10614] CPU: 0 UID: 0 PID: 10614 Comm: syz.8.1294 Tainted: G L syzkaller #0 PREEMPT(full) [ 380.943479][T10614] Tainted: [L]=SOFTLOCKUP [ 380.943485][T10614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 380.943495][T10614] Call Trace: [ 380.943502][T10614] [ 380.943509][T10614] dump_stack_lvl+0xe8/0x150 [ 380.943536][T10614] should_fail_ex+0x3eb/0x540 [ 380.943567][T10614] should_failslab+0xa8/0x100 [ 380.943589][T10614] ? security_file_alloc+0x34/0x310 [ 380.943686][T10614] kmem_cache_alloc_noprof+0x9c/0x600 [ 380.943713][T10614] ? rcu_is_watching+0x16/0xb0 [ 380.943734][T10614] ? security_file_alloc+0x34/0x310 [ 380.943758][T10614] security_file_alloc+0x34/0x310 [ 380.943778][T10614] init_file+0x90/0x2b0 [ 380.943829][T10614] alloc_empty_file+0x74/0x1d0 [ 380.943854][T10614] path_openat+0x9d/0x1da0 [ 380.943916][T10614] do_file_open+0x23e/0x4a0 [ 380.943939][T10614] ? __pfx_do_file_open+0x10/0x10 [ 380.943974][T10614] ? _raw_spin_unlock+0x28/0x50 [ 380.943996][T10614] ? alloc_fd+0x6af/0x760 [ 380.944057][T10614] do_sys_openat2+0x115/0x200 [ 380.944113][T10614] ? __se_sys_futex+0x3a8/0x450 [ 380.944137][T10614] ? __pfx_do_sys_openat2+0x10/0x10 [ 380.944164][T10614] ? rcu_is_watching+0x16/0xb0 [ 380.944188][T10614] __x64_sys_openat+0x138/0x170 [ 380.944216][T10614] do_syscall_64+0x166/0x520 [ 380.944230][T10614] ? trace_irq_disable+0x3b/0x140 [ 380.944249][T10614] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.944265][T10614] ? clear_bhb_loop+0x70/0xc0 [ 380.944284][T10614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.944300][T10614] RIP: 0033:0x7fa6e619e159 [ 380.944316][T10614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 380.944329][T10614] RSP: 002b:00007fa6e70a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 380.944347][T10614] RAX: ffffffffffffffda RBX: 00007fa6e6425fa0 RCX: 00007fa6e619e159 [ 380.944359][T10614] RDX: 0000000000000002 RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 380.944370][T10614] RBP: 00007fa6e623506b R08: 0000000000000000 R09: 0000000000000000 [ 380.944380][T10614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 380.944389][T10614] R13: 00007fa6e6426038 R14: 00007fa6e6425fa0 R15: 00007ffe201fd718 [ 380.944413][T10614] [ 381.243743][ T5691] gp8psk: usb in 128 operation failed. [ 381.244051][ T5691] gp8psk: usb in 137 operation failed. [ 381.244102][ T5691] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 381.267311][ T5691] dvbdev: DVB: registering new adapter (Genpix SkyWalker-1 DVB-S receiver) [ 381.267401][ T5691] usb 8-1: media controller created [ 381.345102][ T5691] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 381.444984][ T5691] gp8psk_fe: Frontend attached [ 381.445360][ T5691] usb 8-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 381.445845][ T5691] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 381.756378][ T5691] gp8psk: usb in 138 operation failed. [ 381.756393][ T5691] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully initialized and connected. [ 381.756402][ T5691] gp8psk: found Genpix USB device pID = 203 (hex) [ 381.765990][ T5691] usb 8-1: USB disconnect, device number 72 [ 381.944329][T10617] netlink: 28 bytes leftover after parsing attributes in process `syz.9.1295'. [ 382.056157][T10619] FAULT_INJECTION: forcing a failure. [ 382.056157][T10619] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.056184][T10619] CPU: 0 UID: 0 PID: 10619 Comm: syz.8.1296 Tainted: G L syzkaller #0 PREEMPT(full) [ 382.056205][T10619] Tainted: [L]=SOFTLOCKUP [ 382.056211][T10619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 382.056221][T10619] Call Trace: [ 382.056227][T10619] [ 382.056234][T10619] dump_stack_lvl+0xe8/0x150 [ 382.056263][T10619] should_fail_ex+0x3eb/0x540 [ 382.056291][T10619] _copy_from_iter+0x1d3/0x1660 [ 382.056326][T10619] ? __pfx__copy_from_iter+0x10/0x10 [ 382.056361][T10619] file_tty_write+0x48c/0xa20 [ 382.056485][T10619] vfs_write+0x612/0xba0 [ 382.056510][T10619] ? __pfx_vfs_write+0x10/0x10 [ 382.056535][T10619] ? __fget_files+0x3a2/0x420 [ 382.056551][T10619] ? __fget_files+0x2a/0x420 [ 382.056569][T10619] ? fdget+0x1ac/0x250 [ 382.056589][T10619] ksys_write+0x150/0x270 [ 382.056608][T10619] ? __pfx_ksys_write+0x10/0x10 [ 382.056633][T10619] do_syscall_64+0x166/0x520 [ 382.056648][T10619] ? trace_irq_disable+0x3b/0x140 [ 382.056667][T10619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.056683][T10619] ? clear_bhb_loop+0x70/0xc0 [ 382.056702][T10619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.056718][T10619] RIP: 0033:0x7fa6e619e159 [ 382.056732][T10619] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 382.056746][T10619] RSP: 002b:00007fa6e70a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 382.056763][T10619] RAX: ffffffffffffffda RBX: 00007fa6e6425fa0 RCX: 00007fa6e619e159 [ 382.056775][T10619] RDX: 0000000000001006 RSI: 0000200000000000 RDI: 0000000000000003 [ 382.056785][T10619] RBP: 00007fa6e70a7090 R08: 0000000000000000 R09: 0000000000000000 [ 382.056795][T10619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 382.056805][T10619] R13: 00007fa6e6426038 R14: 00007fa6e6425fa0 R15: 00007ffe201fd718 [ 382.056829][T10619] [ 382.759141][ T5691] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully deinitialized and disconnected. [ 382.876226][T10626] ima: rule for LSM 'u' is undefined [ 382.912920][ T33] audit: type=1807 audit(1790398471.757:19): action=measure func=FILE_CHECK obj_type=u res=0 [ 382.933086][ T33] audit: type=1802 audit(1790398471.817:20): pid=10626 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.7.1299" res=0 errno=0 [ 383.207470][ T5691] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 383.336569][ T5691] usb 10-1: device descriptor read/64, error -71 [ 383.484897][T10624] ima: policy update failed [ 383.486524][ T33] audit: type=1802 audit(1790398472.367:21): pid=10624 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.7.1299" res=0 errno=0 [ 383.577918][ T5691] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 383.713833][ T5691] usb 10-1: device descriptor read/64, error -71 [ 383.817451][ T5691] usb usb10-port1: attempt power cycle [ 384.157458][ T5691] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 384.185316][ T5691] usb 10-1: device descriptor read/8, error -71 [ 384.314404][ T5692] hid-generic 0000:0005:0001.0018: unknown main item tag 0x0 [ 384.314430][ T5692] hid-generic 0000:0005:0001.0018: unknown main item tag 0x0 [ 384.314449][ T5692] hid-generic 0000:0005:0001.0018: unknown main item tag 0x0 [ 384.314467][ T5692] hid-generic 0000:0005:0001.0018: unknown main item tag 0x0 [ 384.314486][ T5692] hid-generic 0000:0005:0001.0018: unknown main item tag 0x0 [ 384.314504][ T5692] hid-generic 0000:0005:0001.0018: unknown main item tag 0x0 [ 384.316066][ T5692] hid-generic 0000:0005:0001.0018: unknown main item tag 0x0 [ 384.316089][ T5692] hid-generic 0000:0005:0001.0018: unknown main item tag 0x0 [ 384.316107][ T5692] hid-generic 0000:0005:0001.0018: unknown main item tag 0x0 [ 384.316125][ T5692] hid-generic 0000:0005:0001.0018: unknown main item tag 0x0 [ 384.447478][ T5692] hid-generic 0000:0005:0001.0018: hidraw0: HID v0.03 Device [syz0] on syz1 [ 384.474861][ T5691] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 384.498571][ T5691] usb 10-1: device descriptor read/8, error -71 [ 384.607403][ T5691] usb usb10-port1: unable to enumerate USB device [ 384.775790][T10642] fido_id[10642]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 385.327662][ T5691] usb 8-1: new full-speed USB device number 73 using dummy_hcd [ 385.440969][T10656] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1308'. [ 385.482193][ T5691] usb 8-1: New USB device found: idVendor=086a, idProduct=0003, bcdDevice=f7.3f [ 385.496188][ T5691] usb 8-1: config 0 has an invalid interface number: 2 but max is 0 [ 385.496208][ T5691] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 385.496221][ T5691] usb 8-1: config 0 has no interface number 0 [ 385.515589][ T5691] usb 8-1: config 0 interface 2 altsetting 2 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 385.515614][ T5691] usb 8-1: config 0 interface 2 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 385.515634][ T5691] usb 8-1: config 0 interface 2 has no altsetting 0 [ 385.574046][ T5691] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.574066][ T5691] usb 8-1: Product: syz [ 385.574078][ T5691] usb 8-1: Manufacturer: syz [ 385.574088][ T5691] usb 8-1: SerialNumber: syz [ 385.612585][ T5691] usb 8-1: config 0 descriptor?? [ 385.613113][T10646] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 385.640285][ T5691] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 385.662203][ T5691] usb 8-1: invalid MIDI in EP 0 [ 386.082647][ T6139] IPVS: starting estimator thread 0... [ 386.166379][T10661] IPVS: using max 38 ests per chain, 91200 per kthread [ 386.289836][ T5691] snd-usb-audio 8-1:0.2: probe with driver snd-usb-audio failed with error -22 [ 386.319799][ T5691] usb 8-1: USB disconnect, device number 73 [ 386.379264][ T6930] udevd[6930]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 387.275622][T10671] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 387.342748][ T5617] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 387.346678][ T5617] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 387.356501][ T5617] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 387.376828][ T5617] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 387.377270][ T5617] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 387.950461][T10683] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1317'. [ 388.486371][ T5343] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 388.638662][ T5343] usb 9-1: New USB device found: idVendor=18d1, idProduct=1eaf, bcdDevice=0.00 [ 388.639553][ T5343] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 388.639572][ T5343] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 388.656732][ T5343] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.656751][ T5343] usb 9-1: Product: syz [ 388.656762][ T5343] usb 9-1: Manufacturer: syz [ 388.656773][ T5343] usb 9-1: SerialNumber: syz [ 389.044730][T10673] vcan0 speed is unknown, defaulting to 1000 [ 389.148905][ T5343] usb 9-1: Limiting number of CPorts to U8_MAX [ 389.351495][T10686] netlink: 16 bytes leftover after parsing attributes in process `syz.8.1319'. [ 389.466575][ T5610] Bluetooth: hci7: command tx timeout [ 389.774953][ C0] greybus greybus1: nonexistent connection (8 bytes dropped) [ 389.986466][ T5343] usb 9-1: USB disconnect, device number 13 [ 389.987286][ C0] usb 9-1: failed to resubmit arpc in-urb: -19 [ 389.987317][ C0] usb 9-1: failed to resubmit arpc in-urb: -19 [ 389.987343][ C0] usb 9-1: failed to resubmit in-urb: -19 [ 389.987370][ C0] usb 9-1: failed to resubmit in-urb: -19 [ 389.987395][ C0] usb 9-1: failed to resubmit in-urb: -19 [ 389.987421][ C0] usb 9-1: failed to resubmit in-urb: -19 [ 390.069811][ T5343] usb 9-1: failed to send ARPC request 4: -19 [ 390.069867][ T5343] usb 9-1: failed to execute ARPC: -19 [ 390.069879][ T5343] usb 9-1: failed to flush cport 0: -19 [ 390.069892][ T5343] greybus greybus1: 0/0:0: failed to flush host cport: -19 [ 390.071676][ T5343] usb 9-1: failed to send ARPC request 2: -19 [ 390.071727][ T5343] usb 9-1: failed to execute ARPC: -19 [ 390.071738][ T5343] usb 9-1: failed to quiesce cport 0: -19 (0) [ 390.071752][ T5343] greybus greybus1: 0/0:0: failed to quiesce host cport: -19 [ 390.071845][ T5343] usb 9-1: failed to send ARPC request 3: -19 [ 390.071891][ T5343] usb 9-1: failed to execute ARPC: -19 [ 390.071902][ T5343] usb 9-1: failed to clear cport 0: -19 [ 390.071913][ T5343] greybus greybus1: 0/0:0: failed to clear host cport: -19 [ 390.440801][T10709] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1324'. [ 390.578881][T10712] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 390.884160][T10720] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1327'. [ 390.986850][ T5610] Bluetooth: hci0: command 0x0406 tx timeout [ 391.003918][T10673] bridge0: port 1(bridge_slave_0) entered blocking state [ 391.003988][T10673] bridge0: port 1(bridge_slave_0) entered disabled state [ 391.004127][T10673] bridge_slave_0: entered allmulticast mode [ 391.036433][T10673] bridge_slave_0: entered promiscuous mode [ 391.051718][T10673] bridge0: port 2(bridge_slave_1) entered blocking state [ 391.051793][T10673] bridge0: port 2(bridge_slave_1) entered disabled state [ 391.051918][T10673] bridge_slave_1: entered allmulticast mode [ 391.089319][T10673] bridge_slave_1: entered promiscuous mode [ 391.272823][T10673] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 391.292530][T10673] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 391.318703][T10726] input: syz0 as /devices/virtual/input/input45 [ 391.387349][ T5692] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 391.471478][T10673] team0: Port device team_slave_0 added [ 391.490492][T10673] team0: Port device team_slave_1 added [ 391.536428][ T5692] usb 9-1: Using ep0 maxpacket: 8 [ 391.537252][ T5692] usb 9-1: New USB device found: idVendor=05ac, idProduct=0262, bcdDevice=0.40 [ 391.538675][ T5692] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 391.538707][ T5692] usb 9-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 391.538726][ T5692] usb 9-1: config 1 interface 0 has no altsetting 0 [ 391.540669][ T5692] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.540685][ T5692] usb 9-1: Product: syz [ 391.540696][ T5692] usb 9-1: Manufacturer: syz [ 391.540706][ T5692] usb 9-1: SerialNumber: syz [ 391.546943][ T5617] Bluetooth: hci7: command tx timeout [ 391.746674][T10673] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 391.746688][T10673] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 391.746708][T10673] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 391.814954][T10673] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 391.814969][T10673] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 391.815010][T10673] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 391.918211][T10722] netlink: 40 bytes leftover after parsing attributes in process `syz.8.1329'. [ 391.918250][T10722] netlink: 40 bytes leftover after parsing attributes in process `syz.8.1329'. [ 391.970511][ T5692] input: bcm5974 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/input/input46 [ 391.975675][ T4961] bcm5974 9-1:1.0: could not read from device [ 391.999292][ T4961] bcm5974 9-1:1.0: could not read from device [ 392.020302][ T4961] bcm5974 9-1:1.0: could not read from device [ 392.024567][ T5692] usb 9-1: USB disconnect, device number 14 [ 392.096242][ T4961] bcm5974 9-1:1.0: could not read from device [ 392.207107][T10673] hsr_slave_0: entered promiscuous mode [ 392.236587][ T5615] udevd[5615]: Error opening device "/dev/input/event4": No such file or directory [ 392.236682][ T5615] udevd[5615]: Unable to EVIOCGABS device "/dev/input/event4" [ 392.240328][ T5615] udevd[5615]: Unable to EVIOCGABS device "/dev/input/event4" [ 392.240407][ T5615] udevd[5615]: Unable to EVIOCGABS device "/dev/input/event4" [ 392.240479][ T5615] udevd[5615]: Unable to EVIOCGABS device "/dev/input/event4" [ 392.244971][T10673] hsr_slave_1: entered promiscuous mode [ 392.245527][T10673] debugfs: 'hsr0' already exists in 'hsr' [ 392.245541][T10673] Cannot create hsr debugfs directory [ 392.863983][T10731] vcan0 speed is unknown, defaulting to 1000 [ 393.574576][T10741] FAULT_INJECTION: forcing a failure. [ 393.574576][T10741] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 393.574603][T10741] CPU: 0 UID: 0 PID: 10741 Comm: syz.8.1333 Tainted: G L syzkaller #0 PREEMPT(full) [ 393.574635][T10741] Tainted: [L]=SOFTLOCKUP [ 393.574644][T10741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 393.574658][T10741] Call Trace: [ 393.574665][T10741] [ 393.574672][T10741] dump_stack_lvl+0xe8/0x150 [ 393.574701][T10741] should_fail_ex+0x3eb/0x540 [ 393.574733][T10741] prepare_alloc_pages+0x21e/0x5f0 [ 393.574760][T10741] __alloc_frozen_pages_noprof+0x17a/0x400 [ 393.574782][T10741] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 393.574801][T10741] ? __alloc_frozen_pages_noprof+0x24a/0x400 [ 393.574822][T10741] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 393.574849][T10741] __alloc_pages_noprof+0x10/0x100 [ 393.574869][T10741] alloc_pages_bulk_noprof+0x668/0x890 [ 393.574895][T10741] ? alloc_pages_noprof+0x140/0x2b0 [ 393.574921][T10741] __kasan_populate_vmalloc+0xb7/0x1c0 [ 393.574944][T10741] alloc_vmap_area+0xd10/0x1410 [ 393.574976][T10741] ? __kasan_kmalloc+0x93/0xb0 [ 393.574997][T10741] ? __pfx_alloc_vmap_area+0x10/0x10 [ 393.575020][T10741] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 393.575037][T10741] ? __get_vm_area_node+0x155/0x2f0 [ 393.575069][T10741] __get_vm_area_node+0x200/0x2f0 [ 393.575097][T10741] ? relay_open_buf+0x3b0/0xda0 [ 393.575132][T10741] vmap+0x158/0x2f0 [ 393.575155][T10741] ? relay_open_buf+0x3b0/0xda0 [ 393.575183][T10741] relay_open_buf+0x3b0/0xda0 [ 393.575217][T10741] relay_open+0x413/0x900 [ 393.575246][T10741] blk_trace_setup_prepare+0x425/0x5a0 [ 393.575273][T10741] blk_trace_setup+0x2f5/0x520 [ 393.575299][T10741] ? __pfx_blk_trace_setup+0x10/0x10 [ 393.575335][T10741] ? snprintf+0xe8/0x140 [ 393.575375][T10741] blk_trace_ioctl+0x37f/0x910 [ 393.575400][T10741] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 393.575425][T10741] ? kasan_quarantine_put+0xbb/0x1f0 [ 393.575450][T10741] ? tomoyo_path_number_perm+0x219/0x5f0 [ 393.575474][T10741] ? tomoyo_path_number_perm+0x219/0x5f0 [ 393.575499][T10741] ? do_vfs_ioctl+0x116f/0x1530 [ 393.575523][T10741] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 393.575555][T10741] ? do_futex+0x458/0x4e0 [ 393.575595][T10741] blkdev_ioctl+0x4c1/0x740 [ 393.575622][T10741] ? __pfx_blkdev_ioctl+0x10/0x10 [ 393.575649][T10741] ? bpf_lsm_file_ioctl+0x9/0x20 [ 393.575671][T10741] ? __pfx_blkdev_ioctl+0x10/0x10 [ 393.575695][T10741] __se_sys_ioctl+0xfc/0x170 [ 393.575730][T10741] do_syscall_64+0x166/0x520 [ 393.575756][T10741] ? trace_irq_disable+0x3b/0x140 [ 393.575774][T10741] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.575790][T10741] ? clear_bhb_loop+0x70/0xc0 [ 393.575808][T10741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.575823][T10741] RIP: 0033:0x7fa6e619e159 [ 393.575837][T10741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 393.575851][T10741] RSP: 002b:00007fa6e70a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 393.575867][T10741] RAX: ffffffffffffffda RBX: 00007fa6e6425fa0 RCX: 00007fa6e619e159 [ 393.575878][T10741] RDX: 0000200000000440 RSI: 00000000c0481273 RDI: 0000000000000004 [ 393.575888][T10741] RBP: 00007fa6e623506b R08: 0000000000000000 R09: 0000000000000000 [ 393.575897][T10741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 393.575906][T10741] R13: 00007fa6e6426038 R14: 00007fa6e6425fa0 R15: 00007ffe201fd718 [ 393.575946][T10741] [ 393.628304][ T5617] Bluetooth: hci7: command tx timeout [ 394.134659][ T7894] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 394.134714][ T7894] dvb_usb_az6027 5-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 394.389819][ T7894] usb 5-1: USB disconnect, device number 70 [ 395.706650][ T5617] Bluetooth: hci7: command tx timeout [ 395.817243][T10763] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1337'. [ 396.853732][ T8879] netdevsim netdevsim6 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 396.979612][T10772] fuse: Unknown parameter '00000000000000000000' [ 397.471564][ T8879] netdevsim netdevsim6 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.635662][ T8879] netdevsim netdevsim6 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.790242][ T8879] netdevsim netdevsim6 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.864169][T10783] JFS: discard option not supported on device [ 397.864830][T10783] Mount JFS Failure: -5 [ 397.864841][T10783] jfs_mount failed w/return code = -5 [ 398.138737][T10788] FAULT_INJECTION: forcing a failure. [ 398.138737][T10788] name failslab, interval 1, probability 0, space 0, times 0 [ 398.138763][T10788] CPU: 0 UID: 0 PID: 10788 Comm: syz.8.1341 Tainted: G L syzkaller #0 PREEMPT(full) [ 398.138826][T10788] Tainted: [L]=SOFTLOCKUP [ 398.138833][T10788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 398.138844][T10788] Call Trace: [ 398.138851][T10788] [ 398.138858][T10788] dump_stack_lvl+0xe8/0x150 [ 398.138886][T10788] should_fail_ex+0x3eb/0x540 [ 398.138923][T10788] should_failslab+0xa8/0x100 [ 398.138947][T10788] __kvmalloc_node_noprof+0x171/0x820 [ 398.138967][T10788] ? __kmalloc_noprof+0x387/0x710 [ 398.138984][T10788] ? relay_open_buf+0x208/0xda0 [ 398.139008][T10788] ? relay_open_buf+0x208/0xda0 [ 398.139038][T10788] relay_open_buf+0x208/0xda0 [ 398.139083][T10788] relay_open+0x413/0x900 [ 398.139111][T10788] blk_trace_setup_prepare+0x425/0x5a0 [ 398.139137][T10788] blk_trace_setup+0x2f5/0x520 [ 398.139180][T10788] ? __pfx_blk_trace_setup+0x10/0x10 [ 398.139230][T10788] ? snprintf+0xe8/0x140 [ 398.139266][T10788] blk_trace_ioctl+0x37f/0x910 [ 398.139291][T10788] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 398.139315][T10788] ? kasan_quarantine_put+0xbb/0x1f0 [ 398.139339][T10788] ? tomoyo_path_number_perm+0x219/0x5f0 [ 398.139362][T10788] ? tomoyo_path_number_perm+0x219/0x5f0 [ 398.139386][T10788] ? do_vfs_ioctl+0x116f/0x1530 [ 398.139409][T10788] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 398.139439][T10788] ? do_futex+0x3e7/0x4e0 [ 398.139477][T10788] blkdev_ioctl+0x4c1/0x740 [ 398.139503][T10788] ? __pfx_blkdev_ioctl+0x10/0x10 [ 398.139529][T10788] ? bpf_lsm_file_ioctl+0x9/0x20 [ 398.139550][T10788] ? __pfx_blkdev_ioctl+0x10/0x10 [ 398.139573][T10788] __se_sys_ioctl+0xfc/0x170 [ 398.139595][T10788] do_syscall_64+0x166/0x520 [ 398.139610][T10788] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.139627][T10788] ? clear_bhb_loop+0x70/0xc0 [ 398.139646][T10788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.139662][T10788] RIP: 0033:0x7fa6e619e159 [ 398.139677][T10788] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 398.139690][T10788] RSP: 002b:00007fa6e70a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 398.139708][T10788] RAX: ffffffffffffffda RBX: 00007fa6e6425fa0 RCX: 00007fa6e619e159 [ 398.139720][T10788] RDX: 0000200000000440 RSI: 00000000c0481273 RDI: 0000000000000004 [ 398.139730][T10788] RBP: 00007fa6e623506b R08: 0000000000000000 R09: 0000000000000000 [ 398.139740][T10788] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 398.139753][T10788] R13: 00007fa6e6426038 R14: 00007fa6e6425fa0 R15: 00007ffe201fd718 [ 398.139777][T10788] [ 399.236966][ T7894] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 399.387870][ T7894] usb 9-1: Using ep0 maxpacket: 16 [ 399.390461][ T7894] usb 9-1: New USB device found: idVendor=04f2, idProduct=1236, bcdDevice=0.00 [ 399.412179][ T7894] usb 9-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 399.412202][ T7894] usb 9-1: config 0 interface 0 has no altsetting 0 [ 399.412226][ T7894] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.445179][ T7894] usb 9-1: config 0 descriptor?? [ 399.482258][T10673] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 399.496757][ T5692] usb 8-1: new high-speed USB device number 74 using dummy_hcd [ 399.535092][T10673] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 399.573558][ T8879] bridge_slave_1: left allmulticast mode [ 399.573579][ T8879] bridge_slave_1: left promiscuous mode [ 399.573751][ T8879] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.606766][ T8879] bridge_slave_0: left allmulticast mode [ 399.606787][ T8879] bridge_slave_0: left promiscuous mode [ 399.606959][ T8879] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.646405][ T5692] usb 8-1: Using ep0 maxpacket: 16 [ 399.647066][ T5692] usb 8-1: New USB device found: idVendor=1d6b, idProduct=0101, bcdDevice=f.89 [ 399.652832][ T5692] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 399.652850][ T5692] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 399.653916][ T5692] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 399.653934][ T5692] usb 8-1: SerialNumber: syz [ 399.710335][ T8879] dvmrp8: left allmulticast mode [ 399.778699][ T5692] usb 8-1: 0:2 : does not exist [ 399.959278][ T7894] input: HID 04f2:1236 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:04F2:1236.0019/input/input47 [ 400.013137][ T5692] usb 8-1: USB disconnect, device number 74 [ 400.140492][T10793] binder: Write failure EFAULT in pid:369 [ 400.145412][ T7894] chicony 0003:04F2:1236.0019: input,hidraw0: USB HID v80.00 Joystick [HID 04f2:1236] on usb-dummy_hcd.8-1/input0 [ 400.169497][ T5621] udevd[5621]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 400.315578][T10793] kvm [10791]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x80000074 [ 401.113383][T10815] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1345'. [ 401.211793][ T8879] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 401.236103][ T8879] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 401.252214][ T8879] bond0 (unregistering): Released all slaves [ 401.294145][T10673] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 401.313766][T10673] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 401.329683][T10673] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 401.396462][T10673] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 401.402337][T10673] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 401.444174][T10673] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 401.460310][ T8879] tipc: Left network mode [ 402.016821][ T5343] usb 8-1: new high-speed USB device number 75 using dummy_hcd [ 402.100472][ T7894] usb 9-1: USB disconnect, device number 15 [ 402.175250][ T5343] usb 8-1: New USB device found: idVendor=0bda, idProduct=8150, bcdDevice=0.00 [ 402.208756][ T5343] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.208778][ T5343] usb 8-1: Product: syz [ 402.208790][ T5343] usb 8-1: Manufacturer: syz [ 402.208800][ T5343] usb 8-1: SerialNumber: syz [ 402.409070][T10673] 8021q: adding VLAN 0 to HW filter on device bond0 [ 402.482027][T10825] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.482387][T10825] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 402.610410][T10673] 8021q: adding VLAN 0 to HW filter on device team0 [ 402.696544][ T6135] bridge0: port 1(bridge_slave_0) entered blocking state [ 402.696621][ T6135] bridge0: port 1(bridge_slave_0) entered forwarding state [ 402.737948][ T8891] bridge0: port 2(bridge_slave_1) entered blocking state [ 402.738019][ T8891] bridge0: port 2(bridge_slave_1) entered forwarding state [ 403.271370][ T5343] rtl8150 8-1:1.0: couldn't reset the device [ 403.271614][ T5343] rtl8150 8-1:1.0: probe with driver rtl8150 failed with error -5 [ 403.348107][ T5343] usb 8-1: USB disconnect, device number 75 [ 403.388400][T10835] bond0: entered promiscuous mode [ 403.388416][T10835] bond_slave_0: entered promiscuous mode [ 403.388563][T10835] bond_slave_1: entered promiscuous mode [ 403.603884][T10842] FAULT_INJECTION: forcing a failure. [ 403.603884][T10842] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 403.603910][T10842] CPU: 0 UID: 0 PID: 10842 Comm: syz.8.1349 Tainted: G L syzkaller #0 PREEMPT(full) [ 403.603931][T10842] Tainted: [L]=SOFTLOCKUP [ 403.603937][T10842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 403.603947][T10842] Call Trace: [ 403.603953][T10842] [ 403.603972][T10842] dump_stack_lvl+0xe8/0x150 [ 403.603996][T10842] should_fail_ex+0x3eb/0x540 [ 403.604023][T10842] prepare_alloc_pages+0x21e/0x5f0 [ 403.604044][T10842] __alloc_frozen_pages_noprof+0x17a/0x400 [ 403.604067][T10842] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 403.604087][T10842] ? relay_open_buf+0x208/0xda0 [ 403.604111][T10842] ? policy_nodemask+0x2cc/0x8e0 [ 403.604135][T10842] alloc_pages_mpol+0x21e/0x390 [ 403.604158][T10842] alloc_pages_noprof+0xb1/0x2b0 [ 403.604180][T10842] relay_open_buf+0x288/0xda0 [ 403.604211][T10842] relay_open+0x413/0x900 [ 403.604237][T10842] blk_trace_setup_prepare+0x425/0x5a0 [ 403.604261][T10842] blk_trace_setup+0x2f5/0x520 [ 403.604284][T10842] ? __pfx_blk_trace_setup+0x10/0x10 [ 403.604316][T10842] ? snprintf+0xe8/0x140 [ 403.604351][T10842] blk_trace_ioctl+0x37f/0x910 [ 403.604374][T10842] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 403.604396][T10842] ? kasan_quarantine_put+0xbb/0x1f0 [ 403.604419][T10842] ? tomoyo_path_number_perm+0x219/0x5f0 [ 403.604440][T10842] ? tomoyo_path_number_perm+0x219/0x5f0 [ 403.604469][T10842] ? do_vfs_ioctl+0x116f/0x1530 [ 403.604491][T10842] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 403.604519][T10842] ? do_futex+0x3e7/0x4e0 [ 403.604558][T10842] blkdev_ioctl+0x4c1/0x740 [ 403.604582][T10842] ? __pfx_blkdev_ioctl+0x10/0x10 [ 403.604627][T10842] ? bpf_lsm_file_ioctl+0x9/0x20 [ 403.604647][T10842] ? __pfx_blkdev_ioctl+0x10/0x10 [ 403.604672][T10842] __se_sys_ioctl+0xfc/0x170 [ 403.604694][T10842] do_syscall_64+0x166/0x520 [ 403.604709][T10842] ? trace_irq_disable+0x3b/0x140 [ 403.604729][T10842] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.604745][T10842] ? clear_bhb_loop+0x70/0xc0 [ 403.604765][T10842] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.604781][T10842] RIP: 0033:0x7fa6e619e159 [ 403.604797][T10842] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 403.604812][T10842] RSP: 002b:00007fa6e70a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 403.604829][T10842] RAX: ffffffffffffffda RBX: 00007fa6e6425fa0 RCX: 00007fa6e619e159 [ 403.604842][T10842] RDX: 0000200000000440 RSI: 00000000c0481273 RDI: 0000000000000004 [ 403.604853][T10842] RBP: 00007fa6e623506b R08: 0000000000000000 R09: 0000000000000000 [ 403.604863][T10842] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 403.604873][T10842] R13: 00007fa6e6426038 R14: 00007fa6e6425fa0 R15: 00007ffe201fd718 [ 403.604898][T10842] [ 403.990186][ T8879] hsr_slave_0: left promiscuous mode [ 404.004837][ T8879] hsr_slave_1: left promiscuous mode [ 404.008431][ T8879] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 404.048001][ T8879] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 404.048019][ T8879] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 404.153369][ T8879] veth1_macvtap: left promiscuous mode [ 404.153397][ T8879] veth0_macvtap: left promiscuous mode [ 404.153462][ T8879] veth1_vlan: left promiscuous mode [ 404.153506][ T8879] veth0_vlan: left promiscuous mode [ 404.313988][ T5343] hid_parser_main: 74 callbacks suppressed [ 404.314008][ T5343] hid-generic 0000:0000:0000.001A: unknown main item tag 0x0 [ 404.358684][ T5343] hid-generic 0000:0000:0000.001A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 405.337366][ T8879] team0 (unregistering): Port device team_slave_1 removed [ 405.396964][ T8879] team0 (unregistering): Port device team_slave_0 removed [ 406.582992][T10869] jffs2: notice: (10869) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 407.300799][T10673] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 407.554657][T10673] veth0_vlan: entered promiscuous mode [ 407.592936][T10673] veth1_vlan: entered promiscuous mode [ 407.640525][T10880] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 407.727613][T10673] veth0_macvtap: entered promiscuous mode [ 407.755814][T10673] veth1_macvtap: entered promiscuous mode [ 407.830455][T10673] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 407.867993][T10673] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 407.947517][ T8891] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 407.947988][ T8891] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 407.948107][ T8891] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 407.948552][ T8891] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.266554][ T5610] Bluetooth: hci0: command 0x0406 tx timeout [ 408.266599][ T5617] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 408.342799][ T8891] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 408.342816][ T8891] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 408.537742][ T9859] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 408.537759][ T9859] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 408.607831][T10898] blktrace: Concurrent blktraces are not allowed on loop15 [ 409.009194][ T6136] IPVS: starting estimator thread 0... [ 409.096390][T10912] IPVS: using max 39 ests per chain, 93600 per kthread [ 409.176555][ T5691] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 409.268234][ T5692] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 409.329120][ T5691] usb 10-1: New USB device found: idVendor=1e7d, idProduct=2d5a, bcdDevice=0.00 [ 409.372368][ T5691] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 409.372405][ T5691] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 409.374460][ T5691] usb 10-1: config 0 descriptor?? [ 409.426783][ T5692] usb 1-1: New USB device found: idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 409.431779][ T5692] usb 1-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 409.431819][ T5692] usb 1-1: config 36 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 409.431839][ T5692] usb 1-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 409.435426][ T5692] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 409.435463][ T5692] usb 1-1: Manufacturer: syz [ 409.435475][ T5692] usb 1-1: SerialNumber: syz [ 409.771733][ T5692] yealink 1-1:36.0: invalid payload size 0, expected 16 [ 409.823547][ T5692] input: Yealink usb-p1k as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:36.0/input/input48 [ 409.902108][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 409.902379][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 409.902594][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 409.902787][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 409.902977][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 409.903170][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 409.903349][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 409.903528][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 409.903542][ C0] yealink 1-1:36.0: urb_ctl_callback - usb_submit_urb failed -90 [ 409.958674][ T5691] savu 0003:1E7D:2D5A.001B: collection stack underflow [ 409.958699][ T5691] savu 0003:1E7D:2D5A.001B: item 0 2 0 12 parsing failed [ 409.959243][ T5691] savu 0003:1E7D:2D5A.001B: parse failed [ 409.959292][ T5691] savu 0003:1E7D:2D5A.001B: probe with driver savu failed with error -22 [ 410.060860][ T5692] usb 1-1: USB disconnect, device number 2 [ 410.657680][ T5692] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 410.809034][ T5692] usb 1-1: New USB device found: idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 410.810812][ T5692] usb 1-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 410.810835][ T5692] usb 1-1: config 36 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 410.810875][ T5692] usb 1-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 410.816074][ T5692] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 410.816093][ T5692] usb 1-1: Manufacturer: syz [ 410.816105][ T5692] usb 1-1: SerialNumber: syz [ 410.876905][ T5691] usb 8-1: new high-speed USB device number 76 using dummy_hcd [ 411.011291][T10286] usb 10-1: USB disconnect, device number 10 [ 411.055139][ T5691] usb 8-1: unable to get BOS descriptor or descriptor too short [ 411.055179][ T5691] usb 8-1: New USB device found: idVendor=0867, idProduct=9812, bcdDevice=b0.82 [ 411.065687][ T5691] usb 8-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 411.096566][ T5691] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.096586][ T5691] usb 8-1: Product: syz [ 411.096597][ T5691] usb 8-1: Manufacturer: syz [ 411.096608][ T5691] usb 8-1: SerialNumber: syz [ 411.269443][ T5692] yealink 1-1:36.0: invalid payload size 0, expected 16 [ 411.287550][ T5692] input: Yealink usb-p1k as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:36.0/input/input49 [ 411.317152][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 411.317361][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 411.317560][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 411.317758][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 411.317969][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 411.318168][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 411.318358][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 411.318535][ C0] yealink 1-1:36.0: urb_ctl_callback - urb status -71 [ 411.318550][ C0] yealink 1-1:36.0: urb_ctl_callback - usb_submit_urb failed -90 [ 411.447880][ T5691] comedi comedi5: Wrong number of endpoints [ 411.447899][ T5691] dt9812 8-1:5.0: driver 'dt9812' failed to auto-configure device. [ 411.513921][ T5692] usb 1-1: USB disconnect, device number 3 [ 411.515497][ T5691] usb 8-1: USB disconnect, device number 76 [ 411.926343][ T192] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 412.081410][ T192] usb 9-1: New USB device found: idVendor=1e7d, idProduct=2d50, bcdDevice=0.00 [ 412.099417][ T192] usb 9-1: config 0 interface 0 altsetting 11 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 412.099443][ T192] usb 9-1: config 0 interface 0 has no altsetting 0 [ 412.099468][ T192] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 412.147656][ T192] usb 9-1: config 0 descriptor?? [ 412.164780][T10953] FAULT_INJECTION: forcing a failure. [ 412.164780][T10953] name failslab, interval 1, probability 0, space 0, times 0 [ 412.164806][T10953] CPU: 0 UID: 0 PID: 10953 Comm: syz.0.1368 Tainted: G L syzkaller #0 PREEMPT(full) [ 412.164829][T10953] Tainted: [L]=SOFTLOCKUP [ 412.164835][T10953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 412.164846][T10953] Call Trace: [ 412.164853][T10953] [ 412.164860][T10953] dump_stack_lvl+0xe8/0x150 [ 412.164886][T10953] should_fail_ex+0x3eb/0x540 [ 412.164915][T10953] should_failslab+0xa8/0x100 [ 412.164940][T10953] __kmalloc_noprof+0xf9/0x710 [ 412.164957][T10953] ? __kmalloc_cache_noprof+0x148/0x600 [ 412.164973][T10953] ? relay_open_buf+0x17f/0xda0 [ 412.164998][T10953] ? relay_open_buf+0x17f/0xda0 [ 412.165028][T10953] relay_open_buf+0x17f/0xda0 [ 412.165062][T10953] relay_open+0x413/0x900 [ 412.165090][T10953] blk_trace_setup_prepare+0x425/0x5a0 [ 412.165117][T10953] blk_trace_setup+0x2f5/0x520 [ 412.165143][T10953] ? __pfx_blk_trace_setup+0x10/0x10 [ 412.165178][T10953] ? snprintf+0xe8/0x140 [ 412.165216][T10953] blk_trace_ioctl+0x37f/0x910 [ 412.165242][T10953] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 412.165267][T10953] ? kasan_quarantine_put+0xbb/0x1f0 [ 412.165292][T10953] ? tomoyo_path_number_perm+0x219/0x5f0 [ 412.165316][T10953] ? tomoyo_path_number_perm+0x219/0x5f0 [ 412.165340][T10953] ? do_vfs_ioctl+0x116f/0x1530 [ 412.165364][T10953] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 412.165395][T10953] ? do_futex+0x3e7/0x4e0 [ 412.165434][T10953] blkdev_ioctl+0x4c1/0x740 [ 412.165461][T10953] ? __pfx_blkdev_ioctl+0x10/0x10 [ 412.165488][T10953] ? bpf_lsm_file_ioctl+0x9/0x20 [ 412.165509][T10953] ? __pfx_blkdev_ioctl+0x10/0x10 [ 412.165534][T10953] __se_sys_ioctl+0xfc/0x170 [ 412.165556][T10953] do_syscall_64+0x166/0x520 [ 412.165571][T10953] ? trace_irq_disable+0x3b/0x140 [ 412.165590][T10953] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.165607][T10953] ? clear_bhb_loop+0x70/0xc0 [ 412.165627][T10953] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.165644][T10953] RIP: 0033:0x7f503459e159 [ 412.165659][T10953] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 412.165673][T10953] RSP: 002b:00007f50354e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 412.165690][T10953] RAX: ffffffffffffffda RBX: 00007f5034825fa0 RCX: 00007f503459e159 [ 412.165703][T10953] RDX: 0000200000000440 RSI: 00000000c0481273 RDI: 0000000000000003 [ 412.165714][T10953] RBP: 00007f503463506b R08: 0000000000000000 R09: 0000000000000000 [ 412.165725][T10953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 412.165756][T10953] R13: 00007f5034826038 R14: 00007f5034825fa0 R15: 00007ffe03c0cf18 [ 412.165781][T10953] [ 412.739131][ T192] kovaplus 0003:1E7D:2D50.001C: unknown main item tag 0x0 [ 412.739159][ T192] kovaplus 0003:1E7D:2D50.001C: unknown main item tag 0x0 [ 412.739179][ T192] kovaplus 0003:1E7D:2D50.001C: unknown main item tag 0x0 [ 412.739197][ T192] kovaplus 0003:1E7D:2D50.001C: unknown main item tag 0x0 [ 412.739215][ T192] kovaplus 0003:1E7D:2D50.001C: unknown main item tag 0x0 [ 412.739234][ T192] kovaplus 0003:1E7D:2D50.001C: unknown main item tag 0x0 [ 412.739252][ T192] kovaplus 0003:1E7D:2D50.001C: unknown main item tag 0x0 [ 412.739271][ T192] kovaplus 0003:1E7D:2D50.001C: unknown main item tag 0x0 [ 412.739289][ T192] kovaplus 0003:1E7D:2D50.001C: unknown main item tag 0x0 [ 412.739308][ T192] kovaplus 0003:1E7D:2D50.001C: unknown main item tag 0x0 [ 412.888436][ T192] kovaplus 0003:1E7D:2D50.001C: hidraw0: USB HID v80.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.8-1/input0 [ 412.932986][ T192] usb 9-1: USB disconnect, device number 16 [ 413.218435][T10963] fido_id[10963]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 413.246803][T10286] usb 10-1: new full-speed USB device number 11 using dummy_hcd [ 413.397022][T10286] usb 10-1: New USB device found: idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 413.415865][T10286] usb 10-1: config 0 has an invalid interface number: 41 but max is 0 [ 413.415888][T10286] usb 10-1: config 0 has no interface number 0 [ 413.415939][T10286] usb 10-1: config 0 interface 41 has no altsetting 0 [ 413.459320][T10286] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.459342][T10286] usb 10-1: Product: syz [ 413.459354][T10286] usb 10-1: Manufacturer: syz [ 413.459365][T10286] usb 10-1: SerialNumber: syz [ 413.501992][T10286] usb 10-1: config 0 descriptor?? [ 413.880530][T10973] FAULT_INJECTION: forcing a failure. [ 413.880530][T10973] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 413.880556][T10973] CPU: 0 UID: 0 PID: 10973 Comm: syz.8.1373 Tainted: G L syzkaller #0 PREEMPT(full) [ 413.880578][T10973] Tainted: [L]=SOFTLOCKUP [ 413.880585][T10973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 413.880595][T10973] Call Trace: [ 413.880602][T10973] [ 413.880609][T10973] dump_stack_lvl+0xe8/0x150 [ 413.880635][T10973] should_fail_ex+0x3eb/0x540 [ 413.880672][T10973] _copy_from_user+0x2d/0xb0 [ 413.880760][T10973] do_sock_getsockopt+0x1fa/0x640 [ 413.880833][T10973] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 413.880868][T10973] ? __fget_files+0x3a2/0x420 [ 413.880884][T10973] ? __fget_files+0x2a/0x420 [ 413.880906][T10973] __x64_sys_getsockopt+0x1a4/0x240 [ 413.880937][T10973] do_syscall_64+0x166/0x520 [ 413.880952][T10973] ? trace_irq_disable+0x3b/0x140 [ 413.880971][T10973] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 413.880987][T10973] ? clear_bhb_loop+0x70/0xc0 [ 413.881006][T10973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 413.881022][T10973] RIP: 0033:0x7fa6e619e159 [ 413.881037][T10973] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 413.881051][T10973] RSP: 002b:00007fa6e70a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 413.881069][T10973] RAX: ffffffffffffffda RBX: 00007fa6e6425fa0 RCX: 00007fa6e619e159 [ 413.881087][T10973] RDX: 0000000000000070 RSI: 0000000000000084 RDI: 0000000000000004 [ 413.881097][T10973] RBP: 00007fa6e70a7090 R08: 0000200000000080 R09: 0000000000000000 [ 413.881108][T10973] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000001 [ 413.881119][T10973] R13: 00007fa6e6426038 R14: 00007fa6e6425fa0 R15: 00007ffe201fd718 [ 413.881143][T10973] [ 414.608796][T10984] netlink: 'syz.7.1376': attribute type 14 has an invalid length. [ 414.907883][ T5691] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 415.057339][ T5691] usb 1-1: Using ep0 maxpacket: 32 [ 415.060586][ T5691] usb 1-1: New USB device found: idVendor=046d, idProduct=c31c, bcdDevice=0.40 [ 415.062963][ T5691] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 415.063005][ T5691] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 415.063033][ T5691] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 415.143245][ T5691] usb 1-1: config 0 descriptor?? [ 415.168169][ T5691] hub 1-1:0.0: USB hub found [ 415.368996][ T5691] hub 1-1:0.0: 1 port detected [ 415.455938][T10995] blktrace: Concurrent blktraces are not allowed on loop15 [ 415.774486][ T5691] hub 1-1:0.0: config failed, can't get hub status (err -71) [ 415.813211][ T5691] usbhid 1-1:0.0: can't add hid device: -71 [ 415.813288][ T5691] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 415.867697][ T5691] usb 1-1: USB disconnect, device number 4 [ 416.893474][T11014] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 417.320113][T11022] tmpfs: Using encoding : utf8-12.1.0 [ 418.194295][T11033] jffs2: notice: (11033) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 418.816165][ T33] audit: type=1800 audit(1790398507.697:22): pid=10977 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.1369" name="file1" dev="sda1" ino=2043 res=0 errno=0 [ 419.716401][ T5691] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 419.869418][ T5691] usb 1-1: Using ep0 maxpacket: 16 [ 419.876224][ T5691] usb 1-1: New USB device found: idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 419.905235][ T5691] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.905256][ T5691] usb 1-1: Product: syz [ 419.905268][ T5691] usb 1-1: Manufacturer: syz [ 419.905279][ T5691] usb 1-1: SerialNumber: syz [ 419.975425][ T5691] usb 1-1: config 0 descriptor?? [ 420.000847][ T5691] visor 1-1:0.0: Sony Clie 3.5 converter detected [ 420.827120][T10286] CoreChips 10-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffff92 [ 420.827163][T10286] CoreChips 10-1:0.41 (unnamed net_device) (uninitialized): Failed to reset PHY: -110 [ 420.827349][T10286] CoreChips 10-1:0.41: probe with driver CoreChips failed with error -110 [ 420.988475][ T5692] usb 8-1: new high-speed USB device number 77 using dummy_hcd [ 421.118322][ T5692] usb 8-1: device descriptor read/64, error -71 [ 421.356574][ T5692] usb 8-1: new high-speed USB device number 78 using dummy_hcd [ 421.487270][ T5692] usb 8-1: device descriptor read/64, error -71 [ 421.598438][ T5692] usb usb8-port1: attempt power cycle [ 421.707072][ T5617] Bluetooth: hci2: command 0x0406 tx timeout [ 421.936711][ T5692] usb 8-1: new high-speed USB device number 79 using dummy_hcd [ 421.958008][ T5692] usb 8-1: device descriptor read/8, error -71 [ 422.197889][ T5692] usb 8-1: new high-speed USB device number 80 using dummy_hcd [ 422.219290][ T5692] usb 8-1: device descriptor read/8, error -71 [ 422.326579][ T5692] usb usb8-port1: unable to enumerate USB device [ 422.580693][ T5691] usb 1-1: clie_3_5_startup: get config number failed: -71 [ 422.580860][ T5691] visor 1-1:0.0: probe with driver visor failed with error -71 [ 422.610200][ T5691] usb 1-1: USB disconnect, device number 5 [ 422.834686][T11086] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1393'. [ 423.194994][T11089] fuse: Unknown parameter '00000000000000000000' [ 423.196376][ T5691] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 423.238969][T11089] tmpfs: Bad value for 'mpol' [ 423.357348][ T5691] usb 1-1: Using ep0 maxpacket: 16 [ 423.357843][ T5691] usb 1-1: New USB device found: idVendor=04f2, idProduct=1236, bcdDevice=0.00 [ 423.360334][ T5691] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 423.360357][ T5691] usb 1-1: config 0 interface 0 has no altsetting 0 [ 423.360382][ T5691] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.422374][ T5691] usb 1-1: config 0 descriptor?? [ 423.601434][ T7894] usb 10-1: USB disconnect, device number 11 [ 423.904116][ T5691] input: HID 04f2:1236 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:04F2:1236.001D/input/input50 [ 424.019181][ T5691] chicony 0003:04F2:1236.001D: input,hidraw0: USB HID v80.00 Joystick [HID 04f2:1236] on usb-dummy_hcd.0-1/input0 [ 424.070903][ T5691] usb 1-1: USB disconnect, device number 6 [ 424.402368][T11101] fido_id[11101]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 424.770942][T11109] vcan0 speed is unknown, defaulting to 1000 [ 424.846358][ T5691] usb 8-1: new high-speed USB device number 81 using dummy_hcd [ 425.003665][ T5691] usb 8-1: New USB device found: idVendor=056a, idProduct=0063, bcdDevice=0.00 [ 425.004875][ T5691] usb 8-1: config index 0 descriptor too short (expected 28277, got 36) [ 425.004894][ T5691] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 425.004908][ T5691] usb 8-1: config 0 has no interfaces? [ 425.004929][ T5691] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.064219][ T5691] usb 8-1: config 0 descriptor?? [ 425.634063][T11110] sctp: Trying to GSO but underlying device doesn't support it. [ 426.554188][ T6138] IPVS: starting estimator thread 0... [ 426.636366][T11141] IPVS: using max 39 ests per chain, 93600 per kthread [ 426.712968][T11145] loop5: detected capacity change from 0 to 4095 [ 426.836396][ T5691] usb 10-1: new full-speed USB device number 12 using dummy_hcd [ 426.989884][ T5691] usb 10-1: New USB device found: idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 427.009494][ T5691] usb 10-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 427.009519][ T5691] usb 10-1: config 36 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 427.009539][ T5691] usb 10-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 427.057010][ T5691] usb 10-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 427.057032][ T5691] usb 10-1: Manufacturer: syz [ 427.057043][ T5691] usb 10-1: SerialNumber: syz [ 427.405744][ T5691] yealink 10-1:36.0: invalid payload size 0, expected 16 [ 427.432245][ T5691] input: Yealink usb-p1k as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:36.0/input/input51 [ 427.492299][T11147] buffer_io_error: 60 callbacks suppressed [ 427.492317][T11147] Buffer I/O error on dev loop5, logical block 511, async page read [ 427.495283][ T5621] Buffer I/O error on dev loop5, logical block 511, async page read [ 427.527852][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 427.528061][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 427.528251][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 427.528427][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 427.528604][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 427.528777][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 427.528952][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 427.529127][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 427.529142][ C0] yealink 10-1:36.0: urb_ctl_callback - usb_submit_urb failed -90 [ 427.634715][ T5691] usb 10-1: USB disconnect, device number 12 [ 428.099111][ T7894] usb 8-1: USB disconnect, device number 81 [ 428.117144][ T5691] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 428.270984][ T5691] usb 10-1: New USB device found: idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 428.292694][ T5691] usb 10-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 428.292719][ T5691] usb 10-1: config 36 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 428.292739][ T5691] usb 10-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 428.355536][ T5691] usb 10-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 428.355566][ T5691] usb 10-1: Manufacturer: syz [ 428.355578][ T5691] usb 10-1: SerialNumber: syz [ 428.662128][ T7894] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 428.818927][ T5691] yealink 10-1:36.0: invalid payload size 0, expected 16 [ 428.835889][ T7894] usb 1-1: not running at top speed; connect to a high speed hub [ 428.835914][ T7894] usb 1-1: New USB device found: idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 428.861858][ T7894] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.879006][ T7894] usb 1-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 428.879028][ T7894] usb 1-1: Product: syz [ 428.879039][ T7894] usb 1-1: Manufacturer: syz [ 428.908193][ T33] audit: type=1800 audit(1790398517.797:23): pid=11160 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1406" name="devlink" dev="sda1" ino=2064 res=0 errno=0 [ 428.914394][T11160] EXT4-fs warning (device sda1): verify_group_input:137: Cannot add at group 0 (only 8 groups) [ 429.035603][ T5691] input: Yealink usb-p1k as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:36.0/input/input52 [ 429.090153][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 429.090359][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 429.090545][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 429.090731][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 429.090915][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 429.091096][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 429.091278][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 429.091461][ C0] yealink 10-1:36.0: urb_ctl_callback - urb status -71 [ 429.091476][ C0] yealink 10-1:36.0: urb_ctl_callback - usb_submit_urb failed -90 [ 429.176673][ T7894] uvcvideo 1-1:1.0: Found UVC 1.00 device syz (225a:e1d4) [ 429.245405][ T5691] usb 10-1: USB disconnect, device number 13 [ 429.275555][ T7894] uvcvideo 1-1:1.0: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 429.291761][ T7894] uvcvideo 1-1:1.1: Failed to query (GET_CUR) UVC probe control : -71 (exp. 26). [ 429.291805][ T7894] uvcvideo 1-1:1.1: Failed to initialize the device (-71). [ 429.293601][ T7894] uvcvideo 1-1:1.0: probe with driver uvcvideo failed with error -71 [ 429.408374][ T7894] usb 1-1: USB disconnect, device number 7 [ 429.973884][T11172] netlink: 'syz.8.1410': attribute type 20 has an invalid length. [ 430.663811][T11189] FAULT_INJECTION: forcing a failure. [ 430.663811][T11189] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 430.663848][T11189] CPU: 0 UID: 0 PID: 11189 Comm: syz.0.1416 Tainted: G L syzkaller #0 PREEMPT(full) [ 430.663868][T11189] Tainted: [L]=SOFTLOCKUP [ 430.663873][T11189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 430.663886][T11189] Call Trace: [ 430.663894][T11189] [ 430.663901][T11189] dump_stack_lvl+0xe8/0x150 [ 430.663925][T11189] should_fail_ex+0x3eb/0x540 [ 430.663951][T11189] _copy_from_user+0x2d/0xb0 [ 430.663968][T11189] ___sys_sendmsg+0x1c6/0x360 [ 430.664049][T11189] ? __lock_acquire+0x747/0x2de0 [ 430.664070][T11189] ? __pfx____sys_sendmsg+0x10/0x10 [ 430.664096][T11189] ? kstrtouint+0x6e/0xe0 [ 430.664133][T11189] ? __fget_files+0x3a2/0x420 [ 430.664148][T11189] ? __fget_files+0x2a/0x420 [ 430.664168][T11189] __sys_sendmmsg+0x273/0x4d0 [ 430.664194][T11189] ? __pfx___sys_sendmmsg+0x10/0x10 [ 430.664224][T11189] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 430.664249][T11189] ? ksys_write+0x242/0x270 [ 430.664267][T11189] ? __pfx_ksys_write+0x10/0x10 [ 430.664287][T11189] __x64_sys_sendmmsg+0xa0/0xc0 [ 430.664311][T11189] do_syscall_64+0x166/0x520 [ 430.664323][T11189] ? trace_irq_disable+0x3b/0x140 [ 430.664341][T11189] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.664355][T11189] ? clear_bhb_loop+0x70/0xc0 [ 430.664373][T11189] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.664393][T11189] RIP: 0033:0x7f503459e159 [ 430.664407][T11189] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 430.664420][T11189] RSP: 002b:00007f50354e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 430.664437][T11189] RAX: ffffffffffffffda RBX: 00007f5034825fa0 RCX: 00007f503459e159 [ 430.664447][T11189] RDX: 0000000000000001 RSI: 0000200000000b80 RDI: 0000000000000003 [ 430.664456][T11189] RBP: 00007f50354e1090 R08: 0000000000000000 R09: 0000000000000000 [ 430.664466][T11189] R10: 0000000000008054 R11: 0000000000000246 R12: 0000000000000001 [ 430.664475][T11189] R13: 00007f5034826038 R14: 00007f5034825fa0 R15: 00007ffe03c0cf18 [ 430.664496][T11189] [ 431.098072][ T5691] usb 8-1: new high-speed USB device number 82 using dummy_hcd [ 431.196952][ T7894] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 431.256464][ T5691] usb 8-1: Using ep0 maxpacket: 32 [ 431.258730][ T5691] usb 8-1: New USB device found: idVendor=0763, idProduct=2081, bcdDevice=0.40 [ 431.259748][ T5691] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 431.259766][ T5691] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 431.263862][ T5691] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.263881][ T5691] usb 8-1: Product: syz [ 431.263892][ T5691] usb 8-1: Manufacturer: syz [ 431.263904][ T5691] usb 8-1: SerialNumber: syz [ 431.347067][ T7894] usb 10-1: New USB device found: idVendor=0525, idProduct=1080, bcdDevice=1.00 [ 431.373956][ T7894] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.724953][ T7894] net1080 10-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.9-1, NetChip TurboCONNECT, ce:59:e1:40:23:6b [ 431.936024][ T5271] 8021q: adding VLAN 0 to HW filter on device eth1 [ 431.987108][T10286] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 432.067146][ T5691] usb 8-1: USB disconnect, device number 82 [ 432.116513][T10286] usb 1-1: device descriptor read/64, error -71 [ 432.356432][T10286] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 432.486380][T10286] usb 1-1: device descriptor read/64, error -71 [ 432.596625][T10286] usb usb1-port1: attempt power cycle [ 432.640060][T11210] jffs2: notice: (11210) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 432.936718][T10286] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 432.957025][T10286] usb 1-1: device descriptor read/8, error -71 [ 433.065402][T11217] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1425'. [ 433.104907][T11200] net1080 10-1:1.0 usb0: port A, peer connected [ 433.176186][T11219] netlink: 40 bytes leftover after parsing attributes in process `syz.8.1426'. [ 433.207238][T10286] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 433.227869][T10286] usb 1-1: device descriptor read/8, error -71 [ 433.336889][T10286] usb usb1-port1: unable to enumerate USB device [ 433.873595][T11225] i2c-slave-eeprom 0-0010: i2c_slave_register: client slave flag not set. You might see address collisions [ 433.873640][T11225] i2c-slave-eeprom 0-0010: i2c_slave_register: not supported by adapter [ 433.873844][T11225] i2c-slave-eeprom 0-0010: probe with driver i2c-slave-eeprom failed with error -95 [ 433.874229][T11225] i2c i2c-0: new_device: Instantiated device slave-24c02 at 0x10 [ 434.047134][ T5691] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 434.215492][ T5691] usb 9-1: unable to get BOS descriptor or descriptor too short [ 434.215530][ T5691] usb 9-1: New USB device found: idVendor=0423, idProduct=000a, bcdDevice=5f.d8 [ 434.227040][ T5691] usb 9-1: config 4 has an invalid interface number: 138 but max is 0 [ 434.227087][ T5691] usb 9-1: config 4 has no interface number 0 [ 434.227109][ T5691] usb 9-1: config 4 interface 138 has no altsetting 0 [ 434.273960][ T5691] usb 9-1: string descriptor 0 read error: -22 [ 434.274079][ T5691] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.614964][T11226] syzkaller1: entered promiscuous mode [ 434.614982][T11226] syzkaller1: entered allmulticast mode [ 434.845820][T10286] usb 10-1: USB disconnect, device number 14 [ 434.867956][T10286] net1080 10-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.9-1, NetChip TurboCONNECT [ 434.944996][T11236] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 435.004868][T11236] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.375040][T11243] tipc: Started in network mode [ 435.375097][T11243] tipc: Node identity 01000001, cluster identity 4711 [ 435.375242][T11228] i2c i2c-0: delete_device: Deleting device slave-24c02 at 0x10 [ 435.455714][T11243] tipc: New replicast peer: 127.0.0.1 [ 435.480143][T11243] tipc: Enabled bearer , priority 10 [ 436.084893][ T5271] 8021q: adding VLAN 0 to HW filter on device eth2 [ 436.566769][T10286] tipc: Node number set to 16777217 [ 436.567877][ T7894] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 436.605834][ T8885] IPVS: starting estimator thread 0... [ 436.631222][T11254] netlink: 132 bytes leftover after parsing attributes in process `syz.9.1432'. [ 436.688534][T11260] IPVS: using max 39 ests per chain, 93600 per kthread [ 436.726395][ T7894] usb 1-1: Using ep0 maxpacket: 8 [ 436.727628][ T7894] usb 1-1: New USB device found: idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 436.768744][ T7894] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.768777][ T7894] usb 1-1: Product: syz [ 436.768787][ T7894] usb 1-1: Manufacturer: syz [ 436.768797][ T7894] usb 1-1: SerialNumber: syz [ 436.804173][ T7894] usb 1-1: config 0 descriptor?? [ 436.839628][ T7894] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 437.114847][T11267] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1436'. [ 437.232366][ T5691] catc 9-1:4.138: Can't set altsetting 1. [ 437.232410][ T5691] catc 9-1:4.138: probe with driver catc failed with error -5 [ 437.264496][ T5691] usb 9-1: USB disconnect, device number 17 [ 438.140154][T11284] jffs2: notice: (11284) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 438.653450][ T5271] 8021q: adding VLAN 0 to HW filter on device eth3 [ 438.699722][ T7894] gspca_sonixj: reg_r err -32 [ 438.737903][ T7894] sonixj 1-1:0.0: probe with driver sonixj failed with error -32 [ 439.002136][T11304] xt_l2tp: invalid flags combination: 0 [ 439.298385][T11319] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1446'. [ 439.902016][ T7894] usb 1-1: USB disconnect, device number 12 [ 440.109932][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.258254][T11337] netlink: 40 bytes leftover after parsing attributes in process `syz.9.1449'. [ 440.791669][T11347] syzkaller1: entered promiscuous mode [ 440.791687][T11347] syzkaller1: entered allmulticast mode [ 440.834277][ T5271] 8021q: adding VLAN 0 to HW filter on device eth4 [ 440.942488][ T7894] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 441.108332][ T7894] usb 1-1: New USB device found: idVendor=0681, idProduct=0005, bcdDevice=1.00 [ 441.108969][ T7894] usb 1-1: config 0 has no interfaces? [ 441.108993][ T7894] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.112279][ T7894] usb 1-1: config 0 descriptor?? [ 441.728884][T11362] blktrace: Concurrent blktraces are not allowed on loop15 [ 442.488476][ T192] usb 8-1: new high-speed USB device number 83 using dummy_hcd [ 442.638332][ T192] usb 8-1: New USB device found: idVendor=054c, idProduct=0268, bcdDevice=0.00 [ 442.640042][ T192] usb 8-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 442.640065][ T192] usb 8-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 442.640084][ T192] usb 8-1: config 0 interface 0 has no altsetting 0 [ 442.640107][ T192] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.645615][ T192] usb 8-1: config 0 descriptor?? [ 443.027802][ T7894] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 443.176420][ T7894] usb 10-1: Using ep0 maxpacket: 8 [ 443.178297][ T7894] usb 10-1: New USB device found: idVendor=055f, idProduct=a800, bcdDevice=1.00 [ 443.179621][ T7894] usb 10-1: config 1 has an invalid descriptor of length 102, skipping remainder of the config [ 443.179654][ T7894] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 443.179683][ T7894] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.397620][ T192] sony 0003:054C:0268.001E: ignoring exceeding usage max [ 443.418677][ T192] sony 0003:054C:0268.001E: ignoring exceeding usage max [ 443.495920][ T192] sony 0003:054C:0268.001E: hiddev0,hidraw0: USB HID v80.00 Device [HID 054c:0268] on usb-dummy_hcd.7-1/input0 [ 443.495947][ T192] sony 0003:054C:0268.001E: failed to claim input [ 443.555561][T10286] usb 1-1: USB disconnect, device number 13 [ 443.605934][ T7894] usb 10-1: string descriptor 0 read error: -71 [ 443.624886][ T7894] mdc800 10-1:1.0: probe fails -> wrong Interface [ 443.669899][ T192] usb 8-1: USB disconnect, device number 83 [ 443.674633][ T7894] usb 10-1: USB disconnect, device number 15 [ 443.683465][T11393] FAULT_INJECTION: forcing a failure. [ 443.683465][T11393] name failslab, interval 1, probability 0, space 0, times 0 [ 443.683489][T11393] CPU: 0 UID: 0 PID: 11393 Comm: syz.8.1463 Tainted: G L syzkaller #0 PREEMPT(full) [ 443.683511][T11393] Tainted: [L]=SOFTLOCKUP [ 443.683517][T11393] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 443.683527][T11393] Call Trace: [ 443.683535][T11393] [ 443.683542][T11393] dump_stack_lvl+0xe8/0x150 [ 443.683567][T11393] should_fail_ex+0x3eb/0x540 [ 443.683596][T11393] should_failslab+0xa8/0x100 [ 443.683619][T11393] __kmalloc_noprof+0xf9/0x710 [ 443.683635][T11393] ? rcu_is_watching+0x16/0xb0 [ 443.683657][T11393] ? tomoyo_realpath_from_path+0xef/0x640 [ 443.683737][T11393] ? tomoyo_realpath_from_path+0xef/0x640 [ 443.683757][T11393] tomoyo_realpath_from_path+0xef/0x640 [ 443.683780][T11393] ? tomoyo_path_number_perm+0x219/0x5f0 [ 443.683802][T11393] tomoyo_path_number_perm+0x246/0x5f0 [ 443.683826][T11393] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 443.683846][T11393] ? __lock_acquire+0x747/0x2de0 [ 443.683875][T11393] ? do_futex+0x3e7/0x4e0 [ 443.683911][T11393] ? __fget_files+0x2a/0x420 [ 443.683929][T11393] ? __fget_files+0x2a/0x420 [ 443.683944][T11393] ? __fget_files+0x2a/0x420 [ 443.683963][T11393] security_file_ioctl+0xc3/0x2a0 [ 443.683987][T11393] __se_sys_ioctl+0x47/0x170 [ 443.684009][T11393] do_syscall_64+0x166/0x520 [ 443.684024][T11393] ? trace_irq_disable+0x3b/0x140 [ 443.684043][T11393] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.684059][T11393] ? clear_bhb_loop+0x70/0xc0 [ 443.684078][T11393] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.684094][T11393] RIP: 0033:0x7fa6e619e159 [ 443.684109][T11393] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 443.684122][T11393] RSP: 002b:00007fa6e70a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 443.684139][T11393] RAX: ffffffffffffffda RBX: 00007fa6e6425fa0 RCX: 00007fa6e619e159 [ 443.684151][T11393] RDX: 0000200000000980 RSI: 000000000000894c RDI: 0000000000000005 [ 443.684161][T11393] RBP: 00007fa6e623506b R08: 0000000000000000 R09: 0000000000000000 [ 443.684172][T11393] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 443.684181][T11393] R13: 00007fa6e6426038 R14: 00007fa6e6425fa0 R15: 00007ffe201fd718 [ 443.684205][T11393] [ 443.684212][T11393] ERROR: Out of memory at tomoyo_realpath_from_path. [ 444.114482][T11394] fido_id[11394]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.7/usb8/report_descriptor': No such file or directory [ 444.892294][ T33] audit: type=1800 audit(1790398533.777:24): pid=11407 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.1469" name=08 dev="sda1" ino=2050 res=0 errno=0 [ 445.866690][ T34] INFO: task syz.3.877:9245 blocked for more than 143 seconds. [ 445.866714][ T34] Tainted: G L syzkaller #0 [ 445.866723][ T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 445.866731][ T34] task:syz.3.877 state:D stack:28808 pid:9245 tgid:9241 ppid:5609 task_flags:0x400040 flags:0x00080002 [ 445.866783][ T34] Call Trace: [ 445.866789][ T34] [ 445.866799][ T34] __schedule+0x1b47/0x5c60 [ 445.867041][ T34] ? __pfx___schedule+0x10/0x10 [ 445.867072][ T34] ? schedule+0x90/0x2b0 [ 445.867096][ T34] schedule+0x164/0x2b0 [ 445.867120][ T34] schedule_preempt_disabled+0x13/0x30 [ 445.867143][ T34] __mutex_lock+0x7c4/0x15a0 [ 445.867161][ T34] ? __mutex_lock+0x5cd/0x15a0 [ 445.867179][ T34] ? fdget_pos+0x118/0x160 [ 445.867198][ T34] ? __pfx___mutex_lock+0x10/0x10 [ 445.867214][ T34] ? __fget_files+0x2a/0x420 [ 445.867232][ T34] ? __fget_files+0x2a/0x420 [ 445.867254][ T34] ? __fget_files+0x3a2/0x420 [ 445.867269][ T34] ? __fget_files+0x2a/0x420 [ 445.867287][ T34] ? fdget+0x1ac/0x250 [ 445.867304][ T34] fdget_pos+0x118/0x160 [ 445.867322][ T34] ksys_read+0x79/0x270 [ 445.867341][ T34] ? __pfx_ksys_read+0x10/0x10 [ 445.867366][ T34] do_syscall_64+0x166/0x520 [ 445.867381][ T34] ? trace_irq_disable+0x3b/0x140 [ 445.867400][ T34] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.867416][ T34] ? clear_bhb_loop+0x70/0xc0 [ 445.867436][ T34] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.867452][ T34] RIP: 0033:0x7f8cb3d9e159 [ 445.867467][ T34] RSP: 002b:00007f8cb4c8a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 445.867483][ T34] RAX: ffffffffffffffda RBX: 00007f8cb4026090 RCX: 00007f8cb3d9e159 [ 445.867495][ T34] RDX: 0000000000002020 RSI: 0000200000000440 RDI: 0000000000000003 [ 445.867506][ T34] RBP: 00007f8cb3e3506b R08: 0000000000000000 R09: 0000000000000000 [ 445.867516][ T34] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 445.867526][ T34] R13: 00007f8cb4026128 R14: 00007f8cb4026090 R15: 00007ffe3a015818 [ 445.867549][ T34] [ 445.867599][ T34] [ 445.867599][ T34] Showing all locks held in the system: [ 445.867609][ T34] locks held by khungtaskd/34: 1, last CPU#0: [ 445.867678][ T34] #0: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 445.867814][ T34] locks held by udevd/4976: 1, last CPU#0: [ 445.867825][ T34] #0: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: __d_lookup+0x66/0x790 [ 445.867871][ T34] locks held by getty/8097: 2, last CPU#0: [ 445.867882][ T34] #0: ffff8880360950a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 445.867946][ T34] #1: ffff888036095128 (&tty->atomic_write_lock){+.+.}-{4:4}, at: file_tty_write+0x1e2/0xa20 [ 445.867990][ T34] locks held by syz.3.877/9242: 3, on CPU#0: [ 445.868000][ T34] #0: ffff888079991cf0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 445.868034][ T34] #1: ffff888020b9c460 (sb_writers#27){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 445.868072][ T34] #2: ffffffff8f49f8e0 (nfsd_mutex){+.+.}-{4:4}, at: write_threads+0x3b1/0x610 [ 445.868201][ T34] locks held by syz.3.877/9245: 1, on CPU#1: [ 445.868212][ T34] #0: ffff888079991cf0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 445.868256][ T34] locks held by syz-executor/10143: 1, last CPU#0: [ 445.868267][ T34] #0: ffff88803241e2e0 (&xt[i].mutex){+.+.}-{4:4}, at: xt_find_table_lock+0x55/0x400 [ 445.868360][ T34] locks held by syz-executor/10673: 4, last CPU#0: [ 445.868371][ T34] #0: ffffffff8f238430 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10a/0x470 [ 445.868411][ T34] #1: ffff88807f034cc0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 445.868456][ T34] #2: ffff8880298e8f80 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 445.868524][ T34] #3: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 445.868567][ T34] locks held by syz.8.1469/11407: 2, last CPU#0: [ 445.868578][ T34] #0: ffff888029a94cc0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 445.868620][ T34] #1: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 445.868661][ T34] locks held by syz.7.1471/11422: 2, last CPU#0: [ 445.868671][ T34] #0: ffff888032c57180 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 445.868713][ T34] #1: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 445.868754][ T34] locks held by dhcpcd-run-hook/11428: 2, last CPU#0: [ 445.868765][ T34] #0: ffff88807bf78f80 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 [ 445.868806][ T34] #1: ffff8880681f2ac0 (&anon_vma->rwsem){++++}-{4:4}, at: unlink_anon_vmas+0x119/0x720 [ 445.868850][ T34] [ 445.868875][ T34] ============================================= [ 445.868875][ T34] [ 445.868883][ T34] NMI backtrace for cpu 0 [ 445.868895][ T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 445.868915][ T34] Tainted: [L]=SOFTLOCKUP [ 445.868921][ T34] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 445.868930][ T34] Call Trace: [ 445.868936][ T34] [ 445.868943][ T34] dump_stack_lvl+0xe8/0x150 [ 445.868963][ T34] nmi_cpu_backtrace+0x274/0x2d0 [ 445.869002][ T34] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 445.869034][ T34] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 445.869056][ T34] sys_info+0x135/0x170 [ 445.869073][ T34] watchdog+0x1058/0x10d0 [ 445.869097][ T34] ? watchdog+0x209/0x10d0 [ 445.869119][ T34] kthread+0x38b/0x480 [ 445.869139][ T34] ? __pfx_watchdog+0x10/0x10 [ 445.869156][ T34] ? __pfx_kthread+0x10/0x10 [ 445.869172][ T34] ret_from_fork+0x514/0xb70 [ 445.869203][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 445.869225][ T34] ? __switch_to+0xc78/0x1410 [ 445.869253][ T34] ? __pfx_kthread+0x10/0x10 [ 445.869270][ T34] ret_from_fork_asm+0x1a/0x30 [ 445.869302][ T34] [ 445.869316][ T34] Kernel panic - not syncing: hung_task: blocked tasks [ 446.442246][ T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 446.453016][ T34] Tainted: [L]=SOFTLOCKUP [ 446.457334][ T34] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 446.467388][ T34] Call Trace: [ 446.470691][ T34] [ 446.473621][ T34] vpanic+0x26f/0x710 [ 446.477616][ T34] panic+0xc5/0xd0 [ 446.481343][ T34] ? __pfx_panic+0x10/0x10 [ 446.485765][ T34] ? nmi_cpu_backtrace+0x2b0/0x2d0 [ 446.490881][ T34] ? nmi_trigger_cpumask_backtrace+0x24d/0x390 [ 446.497055][ T34] watchdog+0x10cc/0x10d0 [ 446.501394][ T34] ? watchdog+0x209/0x10d0 [ 446.505821][ T34] kthread+0x38b/0x480 [ 446.509889][ T34] ? __pfx_watchdog+0x10/0x10 [ 446.514564][ T34] ? __pfx_kthread+0x10/0x10 [ 446.519178][ T34] ret_from_fork+0x514/0xb70 [ 446.523778][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 446.528893][ T34] ? __switch_to+0xc78/0x1410 [ 446.533571][ T34] ? __pfx_kthread+0x10/0x10 [ 446.538156][ T34] ret_from_fork_asm+0x1a/0x30 [ 446.542942][ T34] [ 446.546017][ T34] Kernel Offset: disabled [ 446.550359][ T34] Rebooting in 86400 seconds..