last executing test programs: 5m57.391194706s ago: executing program 3 (id=3190): socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$uac1(0x2, 0x72, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd2, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x78, 0x8, 0xba, {0x7, 0x25, 0x1, 0x8, 0x4, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x3, 0x2, 0x1, {0x7, 0x25, 0x1, 0x0, 0xe, 0x3}}}}}}}}]}}, 0x0) syz_usb_connect$cdc_ncm(0x3, 0x71, &(0x7f00000009c0)=ANY=[], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4), 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x3d, 0x0, &(0x7f00000000c0)=0x37) socketpair$unix(0x1, 0x3, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0a00000007000000040000000d"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f00000004c0)={0x0, 0xb2, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000001, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x83b00, 0x800, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x80, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 5m53.001236761s ago: executing program 3 (id=3197): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x10a, 0x8000000000002}) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r1 = dup3(r0, 0xffffffffffffffff, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) accept4(r1, 0x0, &(0x7f0000000140), 0x80000) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x8) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r3, 0x29, 0x8, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) r4 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000100)=ANY=[@ANYBLOB="000003aaaaaaaaaa00080445000030006500000001907800000000ffffffff04009078000000004524000100680003021600030a01cf2a571a9bab"], 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, 0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000005580)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) io_uring_setup(0x6bb, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="00000000000000c9000000c7df", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b40)={0x3, 0x11, &(0x7f00000000c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x30}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2d}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000200)='\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00', 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 5m49.217016585s ago: executing program 3 (id=3201): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4b564d06, 0x0, 0x400}]}) 5m48.695898396s ago: executing program 3 (id=3203): sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20}, 0x4004000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000400)='mtd0\x00', 0x42, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5ce000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000002a80)=""/102392, 0x18ff8) mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) write$P9_RAUTH(r1, &(0x7f00000000c0)={0x14, 0x67, 0x2, {0x40}}, 0x14) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{'addr=127.0.0.1,port=2049,mountport=2049,proto=tcp,mountproto=tcp,nolock,soft,timeo=1,retrans=1\x00', 0x5e}]}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) write(r1, &(0x7f0000000500)='A', 0x1000) 5m47.450791382s ago: executing program 3 (id=3205): recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) connect$inet(0xffffffffffffffff, 0x0, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) sendto$inet6(r0, 0x0, 0x0, 0x40000, &(0x7f00000015c0)={0xa, 0x4e20, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40}, 0x1c) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xd) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x67) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000300)='./file0\x00', 0x0, 0x10400, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=rdma,port=0x0000000000004e24,posixacl,smackfsroot=+%']) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r4, &(0x7f0000000000)={0x1f, 0xffff, @any, 0x4, 0x1}, 0xe) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) listen(r5, 0x8000) accept4(r4, 0x0, 0x0, 0x80000) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c9"], 0x16) 5m42.236316969s ago: executing program 3 (id=3221): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x29, 0x6b, 0x7f, 0xfffffc01, 0x31, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, 0x700, 0x700, 0xff}}) bind$packet(r1, &(0x7f0000000240)={0x11, 0xf6, r2, 0x1, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}}, 0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x405, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gre={{0x8}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_PMTUDISC={0x5}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}]}}}]}, 0x44}}, 0x0) 5m41.784445575s ago: executing program 32 (id=3221): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x29, 0x6b, 0x7f, 0xfffffc01, 0x31, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, 0x700, 0x700, 0xff}}) bind$packet(r1, &(0x7f0000000240)={0x11, 0xf6, r2, 0x1, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}}, 0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x405, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gre={{0x8}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_PMTUDISC={0x5}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}]}}}]}, 0x44}}, 0x0) 1m53.537462846s ago: executing program 4 (id=3748): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0xc00) close(0xffffffffffffffff) r1 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt/f2\x00', 0x42, 0x1ff) sendfile(r1, r0, 0x0, 0xc00) sendfile(0xffffffffffffffff, r0, 0x0, 0xc00) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) sendfile(0xffffffffffffffff, r0, 0x0, 0xc00) io_setup(0xc, &(0x7f0000000100)=0x0) r3 = timerfd_create(0x0, 0x0) io_submit(r2, 0x1, &(0x7f00000009c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}]) timerfd_settime(r3, 0x3, &(0x7f00000001c0)={{0x77359400}}, 0x0) ioctl$TFD_IOC_SET_TICKS(r3, 0x40085400, &(0x7f0000000380)=0x66) read(r3, &(0x7f0000000040)=""/166, 0xa6) unlinkat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt/f1\x00', 0x0) listns(0x0, 0x0, 0x0, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000180)={0xa, 0x4e22, 0x1, @local, 0xb}, 0x1c) listen(r4, 0x402) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f00000000c0)=0x7) 1m52.962675989s ago: executing program 4 (id=3750): mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0']) (fail_nth: 3) 1m52.647271677s ago: executing program 4 (id=3752): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newtaction={0x68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_ctinfo={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x0, 0x0, 0x0, 0x800000}}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x2}]}, {0xffffffffffffff93}, {0xc}, {0xc}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$rxrpc(0x21, 0x2, 0xa) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r2) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000001bc0), 0x208, 0x2c41) syz_open_dev$swradio(&(0x7f0000000200), 0x1, 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x48840, 0x0) fsopen(&(0x7f0000000100)='ceph\x00', 0x0) socket(0xa, 0x80805, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r4}, 0x0, &(0x7f0000000100)=r3}, 0x1c) writev(r4, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) 1m52.23939039s ago: executing program 4 (id=3753): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) sendmsg$inet6(r0, &(0x7f0000000100)={&(0x7f00000022c0)={0xa, 0x2, 0x812, @dev={0xfe, 0x80, '\x00', 0x17}, 0x9}, 0x1c, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="280000000000000029000000040000003c0102000000040200020401"], 0x28}, 0xc0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) io_uring_setup(0x3c46, &(0x7f0000000880)={0x0, 0xeb7f, 0x3000, 0x2, 0x26c}) select(0x40, &(0x7f0000000400)={0x93d, 0xd0c, 0xe6, 0x0, 0x7, 0x201, 0x0, 0x4}, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000140)='1\n', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='1', 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a01020000000000000000070000000900010073797a30000000009c000000090a010400000000000000000700000009000a40000000000900020073797a32000000000900010073797a3000000000080005400000000d580012802c0001800a0001006c696d69740000001c0002800c00024000000000000010000c0001400000000000000087280001800e000100636f6e6e6c696d6974000000140002800800014000000bea08000240000000000800034000000110140000001000010000000000000000000584000a9327bfb0cb36f062f24e23df07a950"], 0xe4}, 0x1, 0x0, 0x0, 0x20004010}, 0x20050800) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) socket$can_raw(0x1d, 0x3, 0x1) mount(0x0, &(0x7f0000000340)='./dev\x00', &(0x7f0000000380)='devtmpfs\x00', 0x0, 0x0) socket$inet_sctp(0x2, 0xe, 0x84) r5 = openat(r4, &(0x7f00000003c0)='./dev/nullb1\x00', 0x2, 0x20) pwrite64(r5, &(0x7f0000000500)="53464f5a05abbf5900"/851, 0x353, 0x0) iopl(0x3) socket(0x2c, 0x2, 0x6) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r6 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r6, &(0x7f0000000140)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000440)='ZP', 0x2}], 0x1, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000084050000000000000000feff3a0002080041e3eace1100ebaf9bc73af2beca7510cfb6697fab9c3f406a317218e4c92c65db704ec3bc4c03177916f4c9fa7dfc77ae6a4617ccb8f280109c1dcb4ba63ecc170e249a6b"], 0x18, 0x4855}, 0x4000040) syz_clone3(&(0x7f00000014c0)={0x21000080, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x5b, 0x0, 0x0, 0x13, {r4}}, 0x58) select(0x40, &(0x7f0000000480)={0xe0, 0xffffffffffffffff, 0x7fffffffffffffff, 0x0, 0x0, 0x5, 0x8, 0xffffffff}, &(0x7f0000000900)={0xff, 0x8000000000000000, 0xffffffffffff5c21, 0x8, 0x7fffffffffffffff, 0x2, 0x3}, &(0x7f0000000940)={0x100, 0xfc9, 0x4, 0x1, 0x4, 0x3, 0xffffffff, 0x5c18}, &(0x7f0000000980)) openat$mice(0xffffffffffffff9c, &(0x7f0000000400), 0x26101) close(r5) 1m51.716335824s ago: executing program 4 (id=3758): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = fsopen(&(0x7f0000000180)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsmount(r1, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000000)='nodioread_nolock', &(0x7f0000000080)='\x00', 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000020603000a00000000000000"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r3, 0xc0145b0e, &(0x7f0000000040)={0x100000, 0x0, 0x0, 0x0, 0x3}) 1m44.90226385s ago: executing program 4 (id=3780): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040), 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000080)=r1) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='cmdline\x00') sendmsg$802154_raw(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)="c9060b23c1d83978f707c0939eec4dfd6263ee32aaf1170d569975e124f0d669e587", 0x22}, 0x1, 0x0, 0x0, 0x4000880}, 0x40) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f00000001c0)=0x1) sendmsg$nl_generic(r2, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000540)={&(0x7f0000000240)={0x2e0, 0x1a, 0x2, 0x70bd28, 0x25dfdbfd, {0x5}, [@typed={0xc, 0xc6, 0x0, 0x0, @u64=0x8}, @generic="6445b42b9f4313b0ff8a5144deb8149d350eb71b204b3554ce991ec55d9a0ca3d9393b101121dc5842302a0a1f6e97ad71dd7f00391ab56d35ffcb23b8022c60a65676f71fb4", @nested={0xfd, 0x110, 0x0, 0x1, [@generic="1762b42e5b4557a8312c1e984cab7954af", @typed={0xe2, 0xca, 0x0, 0x0, @binary="87c5a8feb233911f246a982681c3e418cb2cfcb6e944f9ffe1d3eddb52ff68c44ea18212f68f2907f6bbd2589fc79d9e40e3c7060e749ca9dfe2dbd26ceb5360265b52fb235acc0f8677cb91602d3c23e977c6d5ed6308f55ba54ff3bc3a25120af3af134e33ff81e5da5e093e75a1f94378032785365ce44d05af8eeda10e106f2304b82e02dae154efc3993931cea5f5321b384d184dd3ef77d97ea48e000f73b7cefb18f272452b4e9f484035fcc9b5a22781bd03f217df9bf9bc56f7d13b6e4b041e07022df3134b27b45ad40c656640b52ad66189ded0c61ed541ca"}, @nested={0x4, 0xc8}]}, @nested={0x170, 0x95, 0x0, 0x1, [@typed={0x8, 0x70, 0x0, 0x0, @fd=r0}, @typed={0xff, 0xc7, 0x0, 0x0, @binary="114d0ff0b8129df73d3a44d4239158ab7ed96c9a967ee65691a4e66bfffe71f423797ac15ef7e5929312b083dcc94c1d7f16c07aa9eb248a91dca3ba402f6be5679968ab4397c2f2b213fb2f1a69f59c2ded05f64f55fe8dbda9d91824ac5b177e135e8a01fa6fa6ed204d7e483d4d3be966b9079a117909aa27324d328c933aa2810a3c8181e39a59bd34a5c8e4ca796dddba6219de9f4d9d810d7345265721410489244b93564975376d216fc65bebd410c29b2820f6d15f65101e97931ed1f882276f85866e3738d15027e6532d08f189cbeaff0b5bb48ad877667677af42df59dbd85499ddb58295b59d9066fd8a9fd79c08f3f15001ee6e81"}, @nested={0x4, 0xb5}, @typed={0x8, 0x17, 0x0, 0x0, @u32}, @generic="76a2916ec7f6243dcd89c49aefa4ff0b51b3913720c208fdf547400bc833727d499eaf0c262240d3d49e9e91dfe1e8ebeb46202e534249f683d13766c741eab88145b932f3053f4286bd8aac05fffe5a7f4261ff0d13f1ff"]}, @typed={0x8, 0x4c, 0x0, 0x0, @ipv4=@remote}]}, 0x2e0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) read(r2, &(0x7f00000005c0)=""/104, 0x68) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) ioctl$BLKGETSIZE(r2, 0x1260, &(0x7f0000000680)) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000700)=0x0) ioctl$BTRFS_IOC_DEV_INFO(r3, 0xd000941e, &(0x7f0000000740)={0x0, "1c5d6733f6392787523ea397edbe3b85"}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000001740)={{r2}, r5, 0x16, @unused=[0x8, 0xc935, 0x1, 0x2685], @devid=r6}) readahead(r2, 0x200, 0x729) connect$inet(r2, &(0x7f0000002740)={0x2, 0x4e24, @local}, 0x10) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000002780)={'\x00', 0xf801, 0x7f, 0x9, 0x81, 0x1, 0xffffffffffffffff}) sched_setparam(r7, &(0x7f0000002800)=0xe) ioctl$BLKTRACESTART(r2, 0x1274, 0x0) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, &(0x7f0000002840)=""/201) ioctl$XFS_IOC_FSGROWFSRT(r1, 0x40105870, &(0x7f0000002940)={0x0, 0xffff0000}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f0000002980)={{@any, 0x5}, 0x1, 0x0, 0xce}) madvise(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xc) syz_open_dev$evdev(&(0x7f00000029c0), 0x101, 0x428002) ptrace$setopts(0x4200, r7, 0x10001, 0xa) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000002a00)={'vxcan0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000002a40)={@private1, r8}, 0x14) ftruncate(r4, 0x8) mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000) 1m44.58717882s ago: executing program 33 (id=3780): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040), 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000080)=r1) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='cmdline\x00') sendmsg$802154_raw(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)="c9060b23c1d83978f707c0939eec4dfd6263ee32aaf1170d569975e124f0d669e587", 0x22}, 0x1, 0x0, 0x0, 0x4000880}, 0x40) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f00000001c0)=0x1) sendmsg$nl_generic(r2, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000540)={&(0x7f0000000240)={0x2e0, 0x1a, 0x2, 0x70bd28, 0x25dfdbfd, {0x5}, [@typed={0xc, 0xc6, 0x0, 0x0, @u64=0x8}, @generic="6445b42b9f4313b0ff8a5144deb8149d350eb71b204b3554ce991ec55d9a0ca3d9393b101121dc5842302a0a1f6e97ad71dd7f00391ab56d35ffcb23b8022c60a65676f71fb4", @nested={0xfd, 0x110, 0x0, 0x1, [@generic="1762b42e5b4557a8312c1e984cab7954af", @typed={0xe2, 0xca, 0x0, 0x0, @binary="87c5a8feb233911f246a982681c3e418cb2cfcb6e944f9ffe1d3eddb52ff68c44ea18212f68f2907f6bbd2589fc79d9e40e3c7060e749ca9dfe2dbd26ceb5360265b52fb235acc0f8677cb91602d3c23e977c6d5ed6308f55ba54ff3bc3a25120af3af134e33ff81e5da5e093e75a1f94378032785365ce44d05af8eeda10e106f2304b82e02dae154efc3993931cea5f5321b384d184dd3ef77d97ea48e000f73b7cefb18f272452b4e9f484035fcc9b5a22781bd03f217df9bf9bc56f7d13b6e4b041e07022df3134b27b45ad40c656640b52ad66189ded0c61ed541ca"}, @nested={0x4, 0xc8}]}, @nested={0x170, 0x95, 0x0, 0x1, [@typed={0x8, 0x70, 0x0, 0x0, @fd=r0}, @typed={0xff, 0xc7, 0x0, 0x0, @binary="114d0ff0b8129df73d3a44d4239158ab7ed96c9a967ee65691a4e66bfffe71f423797ac15ef7e5929312b083dcc94c1d7f16c07aa9eb248a91dca3ba402f6be5679968ab4397c2f2b213fb2f1a69f59c2ded05f64f55fe8dbda9d91824ac5b177e135e8a01fa6fa6ed204d7e483d4d3be966b9079a117909aa27324d328c933aa2810a3c8181e39a59bd34a5c8e4ca796dddba6219de9f4d9d810d7345265721410489244b93564975376d216fc65bebd410c29b2820f6d15f65101e97931ed1f882276f85866e3738d15027e6532d08f189cbeaff0b5bb48ad877667677af42df59dbd85499ddb58295b59d9066fd8a9fd79c08f3f15001ee6e81"}, @nested={0x4, 0xb5}, @typed={0x8, 0x17, 0x0, 0x0, @u32}, @generic="76a2916ec7f6243dcd89c49aefa4ff0b51b3913720c208fdf547400bc833727d499eaf0c262240d3d49e9e91dfe1e8ebeb46202e534249f683d13766c741eab88145b932f3053f4286bd8aac05fffe5a7f4261ff0d13f1ff"]}, @typed={0x8, 0x4c, 0x0, 0x0, @ipv4=@remote}]}, 0x2e0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) read(r2, &(0x7f00000005c0)=""/104, 0x68) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) ioctl$BLKGETSIZE(r2, 0x1260, &(0x7f0000000680)) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000700)=0x0) ioctl$BTRFS_IOC_DEV_INFO(r3, 0xd000941e, &(0x7f0000000740)={0x0, "1c5d6733f6392787523ea397edbe3b85"}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000001740)={{r2}, r5, 0x16, @unused=[0x8, 0xc935, 0x1, 0x2685], @devid=r6}) readahead(r2, 0x200, 0x729) connect$inet(r2, &(0x7f0000002740)={0x2, 0x4e24, @local}, 0x10) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000002780)={'\x00', 0xf801, 0x7f, 0x9, 0x81, 0x1, 0xffffffffffffffff}) sched_setparam(r7, &(0x7f0000002800)=0xe) ioctl$BLKTRACESTART(r2, 0x1274, 0x0) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, &(0x7f0000002840)=""/201) ioctl$XFS_IOC_FSGROWFSRT(r1, 0x40105870, &(0x7f0000002940)={0x0, 0xffff0000}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f0000002980)={{@any, 0x5}, 0x1, 0x0, 0xce}) madvise(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xc) syz_open_dev$evdev(&(0x7f00000029c0), 0x101, 0x428002) ptrace$setopts(0x4200, r7, 0x10001, 0xa) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000002a00)={'vxcan0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000002a40)={@private1, r8}, 0x14) ftruncate(r4, 0x8) mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000) 8.180405708s ago: executing program 0 (id=4121): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c00090502020002020000090582020002"], 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000640)={0x24, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000800)={0x2c, 0x0, &(0x7f0000000700)={0x0, 0xa, 0x1, 0xd}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000780)={0x20, 0x1, 0x2f, "4ac9dc81f159251b73216204e3135f0582119dd109ca20a64d0437fe764c24ddbeddaf802dacaccab93ff9e68eddfa"}, &(0x7f00000007c0)={0x20, 0x3, 0x1, 0x1}}) syz_usb_control_io(r0, &(0x7f00000008c0)={0x2c, &(0x7f0000000200)={0x40, 0x22, 0x4, {0x4, 0x10, "2eb1"}}, &(0x7f0000000400)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c09}}, &(0x7f0000000440)={0x0, 0xf, 0xc4, {0x5, 0xf, 0xc4, 0x5, [@generic={0x89, 0x10, 0x2, "6ab81bd90347d63e61e5caa486ec1ffb32e54f1f4336e2baea2457401b2dd8528f99e3b7ef58fa2b7dad28266778ec804b94b77fe2f1414f5a33134753bf83f0a21632f0abcdc94aa09840dd98c072a4bb9ecbd2a0a5a3916df5458aebf258427fb2fbdb5f1557a66f480cdd3b3d93d7d5bebd6ef32d96593e1eee37d2227534c7cf7798b076"}, @ptm_cap={0x3}, @ssp_cap={0x18, 0x10, 0xa, 0xe, 0x3, 0xd, 0xf0f, 0x0, [0xcf, 0xff30, 0x3fff]}, @ss_container_id={0x14, 0x10, 0x4, 0x3, "29e6cb35cbc4ae0e70220235009ed80f"}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x0, 0x4, 0x4}]}}, &(0x7f0000000840)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x0, 0x4, 0x5, "4444e7ba", "70632385"}}, &(0x7f0000000880)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x0, 0x0, 0x4, 0x7, 0x3, 0x4}}}, &(0x7f0000000d80)={0x84, &(0x7f0000000900)={0x0, 0xd, 0xb0, "e003e5bc470235c820c4b51f3d867ada78644eee3a3840e050006ab9b589e84b5801f4a06d60701525eabc1ddd9d177beb73b4f9a4c45edda929c78585f781dc58cc90be08cc1fb07a37052995ce662c80d40cf9b5bf5680fe4eb24d3e8b531a6d504c21636adc68b6d7b2d19bce3318b8f7b903de440267dc74e7c666c6b999810557b4984e7bc30e2decd5f21c09d81f1cd6afa70b5ed6c4ed36f28e69110be25df1b98ee78be64051b01efd859ee7"}, &(0x7f00000009c0)={0x0, 0xa, 0x1, 0x29}, &(0x7f0000000a00)={0x0, 0x8, 0x1, 0xe}, &(0x7f0000000a40)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000a80)={0x20, 0x0, 0x4, {0x8, 0x4}}, &(0x7f0000000ac0)={0x40, 0x7, 0x2, 0x3}, &(0x7f0000000b00)={0x40, 0x9, 0x1, 0x4}, &(0x7f0000000b40)={0x40, 0xb, 0x2, "8f63"}, &(0x7f0000000b80)={0x40, 0xf, 0x2, 0x34}, &(0x7f0000000bc0)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000c00)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, &(0x7f0000000c40)={0x40, 0x19, 0x2, "7cc8"}, &(0x7f0000000c80)={0x40, 0x1a, 0x2, 0x6}, &(0x7f0000000cc0)={0x40, 0x1c, 0x1, 0x80}, &(0x7f0000000d00)={0x40, 0x1e, 0x1, 0x2}, &(0x7f0000000d40)={0x40, 0x21, 0x1, 0x2}}) 7.841072776s ago: executing program 6 (id=4124): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x93d, 0x7, 0x12, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x75, r0}, 0x38) 7.519027529s ago: executing program 6 (id=4128): openat$panthor(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$NLBL_MGMT_C_REMOVE(0xffffffffffffffff, 0x0, 0x840) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x80000) r1 = dup(r0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) (fail_nth: 1) 6.157866812s ago: executing program 6 (id=4131): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005000100040000000600180000100000060019"], 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0xfffffffffffffff5, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x2, 0x2, 0x14000000}, @TCA_FQ_PLIMIT={0x1300, 0x1, 0x5}]}}]}, 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001c00010000000000000000a007000000", @ANYRES32=r1, @ANYBLOB="400096040a000200aaaaaaaaaa0c00000600050001"], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) 5.48084414s ago: executing program 6 (id=4135): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6(0xa, 0x80002, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000000)={0x8}, 0x9) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$sock_inet_udp_SIOCINQ(r4, 0x541b, 0x0) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000100)={0x0, 0x3, 0x1, 'x'}, 0x9) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000900)=[@in6={0xa, 0x4e23, 0x3f, @loopback, 0x5}], 0x1c) 5.224436184s ago: executing program 0 (id=4140): syz_emit_ethernet(0x46, &(0x7f0000000100)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa210104, @rand_addr=0x64010101, {[@timestamp_addr={0x44, 0x4, 0xa}, @generic={0x7, 0x9, "0990ec742f779f"}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) 4.903330171s ago: executing program 0 (id=4143): openat$rfkill(0xffffffffffffff9c, &(0x7f0000006040), 0x0, 0x0) unshare(0x2020400) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000690000/0x2000)=nil, 0x0}, 0x68) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x1, 0x800000c1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 4.698505004s ago: executing program 1 (id=4144): r0 = socket(0x11, 0x3, 0x0) connect$can_bcm(r0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000a538ae464632080045"], 0x0) sendto$packet(r1, &(0x7f0000000000)="114353012008ba00000037510800", 0x59f, 0x4008015, &(0x7f00000000c0)={0x11, 0xe5, r2, 0x1, 0x7}, 0x14) syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002"], 0x0) 4.564384333s ago: executing program 0 (id=4145): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x841}, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xe80, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68886dd87", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 4.563996063s ago: executing program 1 (id=4146): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001c00010429bd7000fddbdf2507000000", @ANYRES32=r1, @ANYBLOB="0200ee050a000200aae6dd462c0200000c000e8005"], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x20040040) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0xfffffffffffffe21, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r3, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x34, r3, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001500)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x55, 0x55, 0x7, [@enum={0x7, 0x6, 0x0, 0x6, 0x4, [{0x4, 0x394}, {0x10, 0x8ca}, {0xe, 0x9}, {0xf, 0x2}, {0x5}, {0x5, 0x9}]}, @datasec={0x5, 0x1, 0x0, 0xf, 0x1, [{0x3, 0x2, 0xf9b}], "9e"}]}, {0x0, [0x30, 0x61, 0x5f, 0x2e, 0x30]}}, &(0x7f0000000500)=""/4096, 0x77, 0x1000, 0x1}, 0x28) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x1, 0x4, 0x8, 0x8040, 0xffffffffffffffff, 0x10001, '\x00', r1, 0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0, @value=r4}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f0000000000), 0xcd, r5}, 0x38) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @empty}], 0x10) sendmsg$inet_sctp(r6, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1}, 0x1) r7 = dup(r6) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000000000)={0x2, 0x2, 0x201, 0x6, 0xd, 0x5, 0x7, 0x3}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x8003, 0x0, 0x13f, 0x1}}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r7, &(0x7f0000001540)="00d7d76385f8d7dad528684740f47165f8543fcdec0ba30a8ee2969fc3d15eb4a13d73b7aecf8a414c9435a3cc6a04c4a9e1493d195e776b59b9800155ebf994f0eb7debc84c4871835f2bb20c4e977078216f9578afc055f2fcd31291ab86822b917162ea62ca7a99c25834910223c2db4e151221e89ce2fcfc9b0dc9fc4afb2f5dc45345c8434dff90d21742ee5a348fb31dfaeec5881243e00306385da155d70f7e2d2f1bfda40eb6a4740dcc", 0x0}, 0x20) 4.47240511s ago: executing program 5 (id=4147): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@ipv6_newrule={0x3c, 0x20, 0x1, 0x0, 0x0, {0xa, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x7}, [@FRA_SRC={0x14, 0x2, @remote}, @FIB_RULE_POLICY=@FRA_UID_RANGE={0xc}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc011}, 0x40000) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r3 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r3, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x9}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000080)="1b", 0x1}], 0x1, 0x0, 0x0, 0x4855}, 0x24000052) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@ipv6_newrule={0x3c, 0x20, 0x1, 0x0, 0x0, {0xa, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x7}, [@FRA_SRC={0x14, 0x2, @remote}, @FIB_RULE_POLICY=@FRA_UID_RANGE={0xc}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc011}, 0x40000) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) (async) socket$key(0xf, 0x3, 0x2) (async) sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) (async) socket(0xa, 0x5, 0x0) (async) sendmsg$inet_sctp(r3, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x9}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000080)="1b", 0x1}], 0x1, 0x0, 0x0, 0x4855}, 0x24000052) (async) 4.410760643s ago: executing program 1 (id=4148): socket$rxrpc(0x21, 0x2, 0xa) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000001bc0), 0x208, 0x2c41) syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000100)={0x0, "00379bce195566778899aabbccddfcff00112233445566778899aabbccddeeff000011688e0346d524b29db701e5ddeeff8000", 0x40}, 0x48, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x48840, 0x0) fsopen(&(0x7f0000000100)='ceph\x00', 0x0) socket(0xa, 0x80805, 0x0) userfaultfd(0x80801) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$inet6(0xa, 0x2, 0x0) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, 0x0, &(0x7f0000000100)=r1}, 0x1c) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) 4.196474731s ago: executing program 1 (id=4149): socket$rxrpc(0x21, 0x2, 0xa) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000001bc0), 0x208, 0x2c41) syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) add_key$fscrypt_v1(0x0, 0x0, &(0x7f0000000100)={0x0, "00379bce195566778899aabbccddfcff00112233445566778899aabbccddeeff000011688e0346d524b29db701e5ddeeff8000", 0x40}, 0x48, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x48840, 0x0) fsopen(&(0x7f0000000100)='ceph\x00', 0x0) socket(0xa, 0x80805, 0x0) userfaultfd(0x80801) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$inet6(0xa, 0x2, 0x0) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, 0x0, &(0x7f0000000100)=r1}, 0x1c) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) (fail_nth: 1) 3.708127172s ago: executing program 1 (id=4150): r0 = socket$alg(0x26, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) accept4$alg(r1, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r2, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) (async) write$UHID_CREATE2(r2, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r2, 0x1000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r2, 0x1000) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) (async) r3 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) ioctl$HIDIOCGFEATURE(r3, 0xc0404807, &(0x7f0000000080)={0x5, "1f7f67491b5a90eeaddb94a4031a82687063ba6e44f7b91d902d0008424ad04b9634bef178be4ba64223a1d6da6d232b4ea6a453724e5a9c45a204ec36715596"}) write$UHID_GET_REPORT_REPLY(r2, &(0x7f0000000140)={0xa, {0x1, 0x3, 0xff}}, 0xa) ioctl$BTRFS_IOC_RESIZE(r3, 0x50009403, &(0x7f0000000100)=ANY=[@ANYRES32=r3]) (async) ioctl$BTRFS_IOC_RESIZE(r3, 0x50009403, &(0x7f0000000100)=ANY=[@ANYRES32=r3]) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000180)={0x9, 'vlan1\x00'}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) creat(0x0, 0x1ee) (async) creat(0x0, 0x1ee) syz_usb_connect(0x5, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="120100003b7431087d077a6201000102030109022400010000000009040000020338b20009050e"], 0x0) (async) syz_usb_connect(0x5, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="120100003b7431087d077a6201000102030109022400010000000009040000020338b20009050e"], 0x0) socket$can_j1939(0x1d, 0x2, 0x7) (async) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00'}) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) (async) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r4, &(0x7f0000001dc0)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000380)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}], 0x1}}], 0x1, 0x40008c1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x100000000000ff) unshare(0x50030480) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) close(r4) r5 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x18, 0x0) landlock_restrict_self(r5, 0xd) (async) landlock_restrict_self(r5, 0xd) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) 3.592039871s ago: executing program 0 (id=4152): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000002080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}, 0x1000}], 0x1, 0x10143, 0x0) 3.468214335s ago: executing program 5 (id=4153): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001", @ANYBLOB], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0x10, &(0x7f00000008c0)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000300000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000000000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001bc0)={r2, 0x0, 0x138, 0x4c, &(0x7f0000001cc0)="633268f83ca3000000a2029e3815bb2fa117d8326687688b2c969fd7267d546214af00d1ca2524d00f9e4d9555f3ab381b5d44fd6bda8c509e66101d296f10c805252e7c5d48d9814f46db8f07441878734b13270fe47fba418b7358984b9a61c2bbf964a520459fd0d90590b46cf1677d580a26933b6e35aee75996b73a15a25aa8ae2f1f9bc9699a505c0dc4050ab2255fc35f508ccc52f10ac12febf28652fe36f725714868675ca2a7042ab4b26904b2f000589694f69ab0b22a5aec72c5036ce1c8974690045e4ab412a70336b4c65b2dfc8121af4143c2e10a0e5632bcd44e0b000029da424d86f298656822dae2c002e289fbfa6fe0dfb2fd57713a7684dc166c628dc45027ac174c5db54f22e409eb4e94263dbc9919f90f1af3290918b9824c3e0268b300bf69cc2eb3fc58f655439bdbe2b905", &(0x7f0000001c40)=""/76, 0x4000, 0x0, 0x47, 0x50, &(0x7f0000001ac0)="9c01bd6f9a6028c80d7364240fd78867d9d62eca43c565f2c5ac65dd4a0fadceb6c65dcb07f2421e69087e0f17b4eb709e4805f2722709c46bef17c4cb9aed9fb1c342179ea349", &(0x7f0000001a40)="408fd0050dc7945b483103067eca9bd26ffbe35abf0f88a103f6893dc2b1d1cdc2195d4ae89abc04ff5fe5d2466892c81015df835a7d47be4f852161bc4015e7564b08584290fe1762f943a653008ac5", 0x1, 0x0, 0x13}, 0x22) close_range(r0, r0, 0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x6c, 0x10, 0xfffffffffffff4fb, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x2813, 0x2c21}, [@IFLA_LINK={0x8, 0x5, r4}, @IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x34, 0x2, 0x0, 0x1, [@IFLA_VLAN_INGRESS_QOS={0x28, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x5289, 0x1}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xffff}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x9, 0x200}}]}, @IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x24004841}, 0x4c040) socket$can_bcm(0x1d, 0x2, 0x2) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1f00000000000000000000000010"], 0x48) ioctl$BTRFS_IOC_SPACE_INFO(r3, 0xc0109414, &(0x7f0000001e00)={0x6b3, 0x0, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="00880020b713000000", @ANYRESHEX=r5, @ANYBLOB=',\x00']) 3.132551055s ago: executing program 2 (id=4154): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl818\x00', [0x140, 0x2, 0x3, 0xff, 0x1, 0x2, 0x7ffd, 0x6, 0x8, 0xf, 0x2, 0x10, 0xf8, 0x8, 0x4ce, 0x9e9b, 0x8000, 0x401, 0x9, 0x8, 0x4, 0xf, 0xa, 0x9, 0xffd, 0x200000, 0xaf, 0x0, 0x10001fc, 0x0, 0x2]}) ioctl$COMEDI_SETWSUBD(r0, 0x6411) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x6, &(0x7f0000000280)=ANY=[@ANYBLOB="050000000000000069111c00000000008510000002000000850000000500200095000000000000009500a50500000000980de0df5570c0921263ee42a07bbf755026975ed19747a7d87588ab09eb2533e8b3f33ec30aa41d23140f2ddadda7483b0bbc5095d8370f7f70d8a3b4f999036504875a9a5e02649ea7615f5ead3f2102f85d5caaa19fcee10cd26fdfc2fa99a107d32cbf5019a6dfa8663cdaee5a5fc76c51f3bda811865703d80b002e4ad99eb1128c46ce3635489fc1d9e9011208d96cf649c81930cc6924eb57e37cfc9f2053e02cf5265fdf47d6500c12b0786de0137600"/250], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fff8ffffff71a4f0fe0000000071102800000000001d400500000000004704000001ed00000f030000000000006f44000000000000730a00fe000000007203000000000006b500f3ffffff00009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000040)={@mcast2, r2}, 0x14) r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x12, &(0x7f0000000380)=ANY=[@ANYBLOB="18080000d0ff000000000000f8ed7da5273706e01eb4b0d78b75ab00ff00008510000006000000180000000500000000000000060000002608000000000000180000000000000000000000000000009500000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000d3000000950000000000000087391dfa238364696b20c9b7248a"], &(0x7f0000001080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="050000000002000000000000000000000000000089cc0348b5e79ba489292de5bf8b059fe649180be4f256b9676046dc84fcfb5a90e93b6914b4e94c6a9569ec0006d1c450acee0b258661e3a044a7c517998367e1622e59b367d7ce01b243cca8f28b917ec3780ddfd8a5a56363b3c93124d02b90d40e782903a5a44541512345c91e320e4ef48f6dd65a3c67a5a4fdbc12e1eb37d6c526b1f7b5ad4955ade4ce000f6ed88e9ad28554b8706456a2c5445b5b657a9b69e9d1ffa0773d8e489bd2e791c08b58", @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="04000000010000000500"/28], 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x200, r5, 0x4}, 0x38) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000840)={'ip_vti0\x00', &(0x7f0000000780)={'tunl0\x00', 0x0, 0x8, 0x10, 0x80000000, 0xfffffffe, {{0x1f, 0x4, 0x2, 0x2, 0x7c, 0x68, 0x0, 0x0, 0x29, 0x0, @empty, @multicast2, {[@end, @end, @timestamp_prespec={0x44, 0x44, 0x98, 0x3, 0x3, [{@local}, {@broadcast, 0xf}, {@broadcast, 0x5}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5}, {@local, 0xd}, {@local, 0x45d8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x5}, {@multicast2, 0x7}]}, @ra={0x94, 0x4}, @ssrr={0x89, 0xf, 0x4e, [@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x17}]}, @ssrr={0x89, 0x7, 0x14, [@empty]}, @noop, @ra={0x94, 0x4, 0x1}]}}}}}) socket$packet(0x11, 0x2, 0x300) socket$unix(0x1, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x7a22, 0xc000, 0x7, 0x337}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_DESTROY(r7, &(0x7f0000000180), 0x4) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRESOCT=r6, @ANYRES8=r6, @ANYRES8=0x0, @ANYRES8=r3, @ANYRES64=r7, @ANYRES8], 0x2c}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) socket$inet6_icmp(0xa, 0x2, 0x3a) socketpair$unix(0x1, 0x1, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_procfs(0x0, &(0x7f0000000040)='net/udp6\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) 2.768918223s ago: executing program 5 (id=4155): openat$rfkill(0xffffffffffffff9c, &(0x7f0000006040), 0x0, 0x0) unshare(0x2020400) socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000690000/0x2000)=nil, 0x0}, 0x68) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x1, 0x800000c1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.666358934s ago: executing program 2 (id=4156): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000500)=0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000040)=0x65) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r8, 0x84, 0x74, &(0x7f0000000a80)=""/4096, &(0x7f0000001a80)=0x1000) syz_ublk_setup_queues(r8, r6, &(0x7f00000002c0)={0x0, 0xfb87, 0x800, 0x3, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x4, 0xe, 0x15e, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x10, 0x10080000, 0x363}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x1, 0x2, 0x125, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x800, 0x82, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x42, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xf7f9, 0xd3, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000026c0)=ANY=[@ANYBLOB="7c010000190001000000000000000000e000000200000016d4a80546a1585442b72267109b4f00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000500000000000000fbffffffffffffff000000000000000000000000000040000000000000000002000000000000000002000080000000000000000000000000c4000500ffffffff000000000000000000000000000004d43c00000002000000fc0200000000000000000000000000000735000004000000070000000000000002000000ac1414aa000000000000000000000000000004d33c00000002000000ac1e00010000000000000000000000000000000004010c00070000000f00000008000000ac1414aa000000000000000000000000000004d43200000002000000ac1414aa000000000000000000000000ff34000003010900ffff00000500000097760000"], 0x17c}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 2.474535473s ago: executing program 6 (id=4157): sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="04000226", @ANYBLOB="00000000000000000004e800000008000317"], 0x1c}}, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000004000000020000000100000c02000000000000000100000d00000000000000000000000000005f"], 0x0, 0x3c, 0x0, 0x0, 0x3}, 0x28) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b28, &(0x7f0000000000)={'wlan0\x00'}) 2.164430494s ago: executing program 5 (id=4158): r0 = socket$unix(0x1, 0x2, 0x0) (async) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmmsg(r1, &(0x7f0000002600)=[{{0x0, 0x0, &(0x7f00000025c0)=[{&(0x7f00000024c0)="2477da", 0x3}], 0x1}}], 0x1, 0x4840) (async) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x9, 0x0, 0x6}}) (async) r2 = openat$kvm(0x0, &(0x7f00000002c0), 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x4) (async) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x26) ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000400)={0x5, 0x3}) r5 = add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000200)='foo#dnserror=1\x00', 0xf, 0xfffffffffffffffe) (async, rerun: 64) r6 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) (rerun: 64) r7 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r5, r6, r7, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r8, &(0x7f0000000100)={0x1, 0x6}, 0x2) (async) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f00000003c0)={0x80, @tick=0x6, 0x24, {0x94, 0x8}, 0x7, 0x0, 0x80}) pipe2(&(0x7f0000000000), 0x800) (async, rerun: 32) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async, rerun: 32) ioctl$BTRFS_IOC_DEFRAG_RANGE(0xffffffffffffffff, 0x40309410, &(0x7f0000000300)={0x6d28, 0xada4, 0x3, 0xffffff01, 0x0, [0x7, 0xff, 0x3, 0x80]}) write$USERIO_CMD_SEND_INTERRUPT(r8, &(0x7f0000000000)={0x2, 0x3}, 0x2) (async) writev(r3, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400191809004beafd0d3602028447000b4e230f02000500a2bc5603ca00000f7f89004e00200000000101ff05c00e03000200000000000100000000005839c97b910000", 0x48}], 0x1) (async) r9 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x35) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) (async) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r3) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f0000000ac0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000e80)=ANY=[@ANYBLOB="204673f6148905a6a18612989dc54aa7b99bc7482af3546409df9a84c1544f741aed762c4a45d295627b5bb5da14b2d71e0e57b1e1c7dd1eb61c15eb6d19d35267abab8d47bc4d0c6f1ad67442f358b0e0a5f0547d97173f9e7690b7247d9b45bd0095e609e752f122a14b4c8acaec8c039ad0e693ca63249ba31a2d708749914ab3a6d353de84b6fd3c6c3e7ad4f32a23e25962f85062510608b6398508b77ffccc6f495186288158827498487ff873621f093c020c12b4b439e97d2ae144fd9b04bee51e15c2782251154b803946d8bfa7da7400", @ANYRES16=r11, @ANYBLOB="280727bd7000fedbdf250b000000280002800800020071140000080002000f0000000800020007000000080002000900000004000400a4000580070001006962000008000100657468000800010075647000240002800800020000010000080004000600000008000200f9ffffff08000100190000000800010065746800070001006962000008000100657468004c00028008000400b70d0000080001000a000000080004000600000008000400060000000800010015000000080001000a00000008000200300f0000080002009285856208000100190000005801068008000600080000001a000300e10e61a37519346502d89b7ef59575e97f54db51da9b000004000200040002000800060029ffffffcb0003001a523c494d029629ebccf26bd967ec0d7836c1e0136ec25346e6d36b4d1ca9367cde19c78e8ec00bcf226c95f80ef854dde121acfa966cb17714ad192ccda0a5b9a4f31f15b64e26cd99e9a050e6858aebf527431fb41db5681c7ca18206f931c8f2828a0ed366a12a156d15b45be804aac663c2b9bbe442d3ba0dcc6ef5babe954cab3fc75ae2001fbf9288e4ddea05cd73589f2fbfb9876614d7ee47437fc52d8b302f5cb21a53c59cf51ce4bdb64bc1606b678611c8cb4fd89da94f4f90f9f3c0b5545709bf00080006000000010008000100070000004300040067636d28616573290000000000000000000000000000000000000000000000001b0000000e551460f407437db2a35566bac32ef87fa0f40a9cf0fcb05ade7b0020010580140002800800020005000000080003000100000007000100696200003c000280080004000600000008000400090000000800010002000000080002007a03000008000100150000000800030006000000080001001d000000040002803c00028008000400800000000800040003000000080004000600000008000400040000000800020003000000080002000400000008000100140000000c00028008000400ff0f0000080001007564700044000280080003000600000008000400060000000800010003000000080004000900000008000300820000000800040006000000080002000700000008000300080000002c000280080001001d00000008000300090000000800040007000000080001001a0000000800040000000000"], 0x358}, 0x1, 0x0, 0x0, 0x4000000}, 0x8090) (async) sendmsg$nl_route(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000020)={&(0x7f00000006c0)=ANY=[@ANYBLOB="300000001900050000000000000000002df00000000000010000000005000100110000000c000500000000000a"], 0xe1c}}, 0x0) (async) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r2, 0x40106e80, &(0x7f0000000040)={0x8001}) (async, rerun: 64) ioctl$KVM_CAP_SPLIT_IRQCHIP(r9, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) (rerun: 64) ioctl$KVM_SET_GSI_ROUTING(r9, 0x4008ae6a, &(0x7f0000000240)={0x2, 0x0, [{0xb, 0x4, 0x0, 0x0, @irqchip={0x9, 0x5}}, {0x80000000, 0x1, 0x0, 0x0, @adapter={0x1, 0xdb40, 0x6, 0x7, 0x53ab}}]}) socket(0x2, 0xa, 0x3) 2.000505269s ago: executing program 2 (id=4159): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f0000000480)={0x0, 0xffff, 0x0, 0x0, r0}) syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000880)={0x0, 0xfffffffe, 0x0, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x0, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x2, 0x40040001, 0x334, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) (fail_nth: 3) 696.986389ms ago: executing program 2 (id=4160): r0 = io_uring_setup(0x100115a, &(0x7f0000000440)={0x0, 0x3ca, 0x4, 0x0, 0x119}) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000040)) mmap$IORING_OFF_SQES(0x0, 0xfff, 0x8, 0x11, r0, 0x10000000) 555.375767ms ago: executing program 6 (id=4161): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000001bc6500850000008600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cdab01ef0001010203010902270001010080fa0904000003ff000000070581034000010705"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/usb/drivers/ushc/new_id\x00', 0x2, 0x0) syz_usb_control_io(r6, 0x0, 0x0) write(r7, &(0x7f0000000800)='abcd ef01', 0x9) close(0x3) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r8, 0x4) sendmsg$unix(r5, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000001600010000000000000000000a0000000c00008008000a"], 0x20}}, 0x0) r9 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x800, 0x640}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x0) syz_open_dev$evdev(&(0x7f0000000080), 0x7, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005280)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001d40)=""/61, 0x46}, {0x0, 0x20}], 0x2}, 0x10009}], 0x1, 0x10000, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000e0400000000000000000000000000000d000000000000000000000010040000000000000000000009030000000000000061"], 0x0, 0x52}, 0x28) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x14, 0x4e, 0x1, 0x70bd2a, 0x0, {0xa}}, 0x14}}, 0x0) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) 468.514361ms ago: executing program 5 (id=4162): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)=@newqdisc={0x34, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {0x0, 0xc}, {0xffff, 0xffff}, {0x2, 0xd}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}}, 0x0) (fail_nth: 3) 441.225849ms ago: executing program 2 (id=4163): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000005f40), r0) sendmsg$IEEE802154_ADD_IFACE(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)={0x20, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x48002}, 0x4000040) (fail_nth: 3) 411.790078ms ago: executing program 0 (id=4164): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x9, 0x32, 0xffffffffffffffff, 0x34d4b000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000004ac0)=[{{0x0, 0x0, &(0x7f0000003a40)=[{&(0x7f0000000a00)=""/109, 0x6d}, {&(0x7f0000002700)=""/4088, 0xff8}], 0x2}, 0x9}], 0x1, 0x0, 0x0) 459.577µs ago: executing program 1 (id=4165): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000900)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x80}}, 0x0) (fail_nth: 3) 177.228µs ago: executing program 2 (id=4166): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000100)='~', 0x1) setsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000180)="c165102731d462f52d86ec3583c601bc5cc56ca3d38ac637e4dff0a83ee9f8389dff538e3becd3", 0x27) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000280)={'syztnl0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x2f, 0x4, 0x6, 0x9, 0x73, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, 0x7f0, 0x1, 0x101, 0x2}}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000001d00070f000000000000000007000000", @ANYRES32=r2, @ANYBLOB="40002700060010"], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0x58, &(0x7f00000002c0)={0x0, 0x0}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000400)={'syztnl2\x00', &(0x7f0000000380)={'ip6_vti0\x00', 0x0, 0x2f, 0x5, 0x11, 0x8, 0x50, @private2={0xfc, 0x2, '\x00', 0x1}, @private2, 0x20, 0x700, 0x2, 0x33}}) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000008c0)={r3, 0x0, 0x10}, 0xc) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000a00)=0x6, 0x4) acct(&(0x7f0000000540)='./cgroup\x00') 0s ago: executing program 5 (id=4167): ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000}) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000180)) r1 = eventfd2(0x80, 0x800) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000001c0)={0x0, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x0, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) r2 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/4096}) connect$vsock_stream(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) kernel console output (not intermixed with test programs): th driver dvb_usb_gl861 failed with error -5 [ 1261.388036][T18785] netlink: 104 bytes leftover after parsing attributes in process `syz.5.3669'. [ 1262.287785][T17409] usb-storage 1-1:255.71: Quirks match for vid 052b pid 1804: 20 [ 1262.434510][ T31] usb 3-1: USB disconnect, device number 106 [ 1262.733591][T17409] usb 1-1: USB disconnect, device number 108 [ 1262.935821][ T31] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 1263.091808][ T31] usb 3-1: Using ep0 maxpacket: 8 [ 1263.092955][ T31] usb 3-1: New USB device found, idVendor=046d, idProduct=c22d, bcdDevice= 0.00 [ 1263.095127][ T31] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1263.095181][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1263.095893][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1263.200991][ T31] usb 3-1: config 0 descriptor?? [ 1263.591017][T16195] usb 2-1: USB disconnect, device number 102 [ 1263.860574][ T31] lg-g15 0003:046D:C22D.001B: unknown main item tag 0x7 [ 1263.860656][ T31] lg-g15 0003:046D:C22D.001B: ignoring exceeding usage max [ 1263.882901][ T31] lg-g15 0003:046D:C22D.001B: unknown main item tag 0x7 [ 1263.882942][ T31] lg-g15 0003:046D:C22D.001B: item fetching failed at offset 39/40 [ 1263.883820][ T31] lg-g15 0003:046D:C22D.001B: probe with driver lg-g15 failed with error -22 [ 1264.030353][ T5727] usb 3-1: USB disconnect, device number 107 [ 1264.995016][T18807] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 1264.995033][T18807] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 1267.605387][ T5727] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 1267.676581][T17409] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 1268.343037][T17409] usb 1-1: Using ep0 maxpacket: 8 [ 1268.498303][T17409] usb 1-1: New USB device found, idVendor=046d, idProduct=c22d, bcdDevice= 0.00 [ 1268.668576][T17409] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1268.668638][T17409] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1268.668687][T17409] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1268.804601][T18843] trusted_key: encrypted_key: master key parameter 'truste' is invalid [ 1268.806619][ T43] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 1269.036120][ T5727] usb 6-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1269.088067][ T5727] usb 6-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1269.088129][ T5727] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1269.339083][ T43] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 1269.920061][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1269.920142][ T43] usb 2-1: Product: syz [ 1269.920159][ T43] usb 2-1: Manufacturer: syz [ 1269.920209][ T43] usb 2-1: SerialNumber: syz [ 1270.629487][T17409] usb 1-1: config 0 descriptor?? [ 1270.844182][ T5727] usb 6-1: can't set config #4, error -71 [ 1270.873608][ T5727] usb 6-1: USB disconnect, device number 18 [ 1270.951478][T17409] usb 1-1: can't set config #0, error -71 [ 1270.989373][T17409] usb 1-1: USB disconnect, device number 109 [ 1271.190882][ T43] usb 2-1: can't set config #1, error -71 [ 1271.211737][ T43] usb 2-1: USB disconnect, device number 103 [ 1271.783363][T18861] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3694'. [ 1272.955735][ T5703] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 1273.108878][ T5703] usb 2-1: Using ep0 maxpacket: 8 [ 1273.130678][ T5703] usb 2-1: New USB device found, idVendor=046d, idProduct=c22d, bcdDevice= 0.00 [ 1273.132299][ T5703] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1273.132347][ T5703] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1273.132399][ T5703] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1273.188664][ T5703] usb 2-1: config 0 descriptor?? [ 1274.694398][ T5703] usbhid 2-1:0.0: can't add hid device: -71 [ 1274.694525][ T5703] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1274.745632][ T5703] usb 2-1: USB disconnect, device number 104 [ 1275.040126][T18897] netlink: 'syz.5.3705': attribute type 6 has an invalid length. [ 1275.095783][T18898] FAULT_INJECTION: forcing a failure. [ 1275.095783][T18898] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1275.095819][T18898] CPU: 0 UID: 0 PID: 18898 Comm: syz.0.3702 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1275.095845][T18898] Tainted: [L]=SOFTLOCKUP [ 1275.095852][T18898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1275.095863][T18898] Call Trace: [ 1275.095870][T18898] [ 1275.095879][T18898] dump_stack_lvl+0xe8/0x150 [ 1275.095912][T18898] should_fail_ex+0x46b/0x600 [ 1275.095939][T18898] _copy_from_user+0x2d/0xb0 [ 1275.095962][T18898] kstrtouint_from_user+0xd6/0x180 [ 1275.095996][T18898] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1275.096022][T18898] ? __lock_acquire+0x683/0x2ce0 [ 1275.096059][T18898] proc_fail_nth_write+0x8e/0x210 [ 1275.096085][T18898] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1275.096118][T18898] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1275.096142][T18898] vfs_write+0x29f/0xbb0 [ 1275.096176][T18898] ? __pfx_vfs_write+0x10/0x10 [ 1275.096202][T18898] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1275.096237][T18898] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1275.096258][T18898] ? mutex_lock_nested+0x152/0x1d0 [ 1275.096283][T18898] ? fdget_pos+0x252/0x320 [ 1275.096315][T18898] ksys_write+0x156/0x270 [ 1275.096342][T18898] ? __pfx_ksys_write+0x10/0x10 [ 1275.096377][T18898] do_syscall_64+0x166/0x520 [ 1275.096399][T18898] ? trace_irq_disable+0x3b/0x140 [ 1275.096417][T18898] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1275.096436][T18898] ? clear_bhb_loop+0x70/0xc0 [ 1275.096458][T18898] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1275.096477][T18898] RIP: 0033:0x7f2c666ee90e [ 1275.096495][T18898] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1275.096510][T18898] RSP: 002b:00007f2c64943fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1275.096531][T18898] RAX: ffffffffffffffda RBX: 00007f2c649446c0 RCX: 00007f2c666ee90e [ 1275.096545][T18898] RDX: 0000000000000001 RSI: 00007f2c649440a0 RDI: 0000000000000007 [ 1275.096557][T18898] RBP: 00007f2c64944090 R08: 0000000000000000 R09: 0000000000000000 [ 1275.096568][T18898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1275.096580][T18898] R13: 00007f2c669b6218 R14: 00007f2c669b6180 R15: 00007ffeb9d4c2b8 [ 1275.096611][T18898] [ 1275.165751][ T5727] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 1275.316927][ T5727] usb 5-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1275.335408][ T5703] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 1275.391118][ T5727] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1275.391188][ T5727] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1276.155739][ T5727] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1276.267903][ T5703] usb 2-1: device descriptor read/64, error -71 [ 1276.430686][T18908] FAULT_INJECTION: forcing a failure. [ 1276.430686][T18908] name failslab, interval 1, probability 0, space 0, times 0 [ 1276.430749][T18908] CPU: 0 UID: 0 PID: 18908 Comm: syz.2.3709 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1276.430776][T18908] Tainted: [L]=SOFTLOCKUP [ 1276.430783][T18908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1276.430794][T18908] Call Trace: [ 1276.430802][T18908] [ 1276.430811][T18908] dump_stack_lvl+0xe8/0x150 [ 1276.430841][T18908] should_fail_ex+0x46b/0x600 [ 1276.430868][T18908] should_failslab+0xa8/0x100 [ 1276.430891][T18908] __kmalloc_noprof+0xfe/0x780 [ 1276.430911][T18908] ? tomoyo_encode+0x2ad/0x570 [ 1276.430930][T18908] ? tomoyo_encode+0x2ad/0x570 [ 1276.430955][T18908] tomoyo_encode+0x2ad/0x570 [ 1276.430981][T18908] tomoyo_realpath_from_path+0x5fa/0x640 [ 1276.431010][T18908] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1276.431036][T18908] tomoyo_path_number_perm+0x246/0x5f0 [ 1276.431064][T18908] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1276.431089][T18908] ? __lock_acquire+0x683/0x2ce0 [ 1276.431125][T18908] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1276.431147][T18908] ? hook_file_ioctl+0x1f3/0x600 [ 1276.431190][T18908] ? __fget_files+0x2a/0x420 [ 1276.431216][T18908] ? __fget_files+0x2a/0x420 [ 1276.431236][T18908] ? __fget_files+0x3a8/0x420 [ 1276.431257][T18908] ? __fget_files+0x2a/0x420 [ 1276.431283][T18908] security_file_ioctl+0xc3/0x2a0 [ 1276.431312][T18908] __se_sys_ioctl+0x47/0x170 [ 1276.431341][T18908] do_syscall_64+0x166/0x520 [ 1276.431363][T18908] ? trace_irq_disable+0x3b/0x140 [ 1276.431382][T18908] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1276.431401][T18908] ? clear_bhb_loop+0x70/0xc0 [ 1276.431423][T18908] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1276.431441][T18908] RIP: 0033:0x7f0a1324e0d9 [ 1276.431459][T18908] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1276.431474][T18908] RSP: 002b:00007f0a114a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1276.431495][T18908] RAX: ffffffffffffffda RBX: 00007f0a134d5fa0 RCX: 00007f0a1324e0d9 [ 1276.431508][T18908] RDX: 0000200000001240 RSI: 0000000000004b49 RDI: 0000000000000003 [ 1276.431520][T18908] RBP: 00007f0a114a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1276.431532][T18908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1276.431542][T18908] R13: 00007f0a134d6038 R14: 00007f0a134d5fa0 R15: 00007ffe47e94b68 [ 1276.431573][T18908] [ 1276.431594][T18908] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1276.585420][ T5703] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 1276.755482][ T5703] usb 2-1: device descriptor read/64, error -71 [ 1276.866188][ T5703] usb usb2-port1: attempt power cycle [ 1276.897799][T18916] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3712'. [ 1276.972800][T18917] lo speed is unknown, defaulting to 1000 [ 1276.972906][T18917] lo speed is unknown, defaulting to 1000 [ 1276.980104][T18917] lo speed is unknown, defaulting to 1000 [ 1276.981497][T18917] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1276.981530][T18917] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1276.981569][T18917] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1276.994783][T18917] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 1277.061312][T18917] lo speed is unknown, defaulting to 1000 [ 1277.065319][T18917] lo speed is unknown, defaulting to 1000 [ 1277.068033][T18917] lo speed is unknown, defaulting to 1000 [ 1277.070729][T18917] lo speed is unknown, defaulting to 1000 [ 1277.073484][T18917] lo speed is unknown, defaulting to 1000 [ 1277.076236][T18917] lo speed is unknown, defaulting to 1000 [ 1277.079002][T18917] lo speed is unknown, defaulting to 1000 [ 1277.081674][T18917] lo speed is unknown, defaulting to 1000 [ 1277.084440][T18917] lo speed is unknown, defaulting to 1000 [ 1277.093383][T18917] lo speed is unknown, defaulting to 1000 [ 1277.096159][T18917] lo speed is unknown, defaulting to 1000 [ 1277.216275][ T5727] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -71 [ 1277.216298][ T5727] stv0680 5-1:4.0: STV(e): camera ping failed!! [ 1277.216684][ T5727] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1277.216710][ T5727] stv0680 5-1:4.0: last error: 0, command = 0x0 [ 1277.235393][ T5703] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 1277.256393][ T5703] usb 2-1: device descriptor read/8, error -71 [ 1277.277073][ T5727] usb 5-1: USB disconnect, device number 103 [ 1277.497929][ T5703] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 1277.535941][ T5703] usb 2-1: device descriptor read/8, error -71 [ 1277.649119][ T5703] usb usb2-port1: unable to enumerate USB device [ 1277.736909][ T5727] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 1277.885577][ T5727] usb 5-1: Using ep0 maxpacket: 32 [ 1277.889166][ T5727] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1277.890268][ T5727] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 1277.890283][ T5727] usb 5-1: config 0 has no interface number 0 [ 1277.890308][ T5727] usb 5-1: config 0 interface 12 has no altsetting 0 [ 1277.892098][ T5727] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1277.892112][ T5727] usb 5-1: Product: syz [ 1277.892119][ T5727] usb 5-1: Manufacturer: syz [ 1277.892127][ T5727] usb 5-1: SerialNumber: syz [ 1277.958774][ T5727] usb 5-1: config 0 descriptor?? [ 1277.975419][ T5875] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 1278.184431][T18935] batadv_slave_0: entered promiscuous mode [ 1278.195899][T18935] batadv_slave_0: left promiscuous mode [ 1278.300097][ T5875] usb 6-1: Using ep0 maxpacket: 32 [ 1278.339681][ T5875] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1278.341334][ T5875] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 1278.341360][ T5875] usb 6-1: config 0 has no interface number 0 [ 1278.341417][ T5875] usb 6-1: config 0 interface 12 has no altsetting 0 [ 1278.344645][ T5875] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1278.344671][ T5875] usb 6-1: Product: syz [ 1278.344686][ T5875] usb 6-1: Manufacturer: syz [ 1278.344699][ T5875] usb 6-1: SerialNumber: syz [ 1278.365822][ T5875] usb 6-1: config 0 descriptor?? [ 1279.042688][ T5727] f81534 5-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1279.042738][ T5727] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 1279.042755][ T5727] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1279.042836][ T5727] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 1279.086110][ T5727] usb 5-1: USB disconnect, device number 104 [ 1279.202679][T18947] program syz.0.3721 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1280.404030][T18962] FAULT_INJECTION: forcing a failure. [ 1280.404030][T18962] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1280.404066][T18962] CPU: 0 UID: 0 PID: 18962 Comm: syz.0.3726 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1280.404092][T18962] Tainted: [L]=SOFTLOCKUP [ 1280.404099][T18962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1280.404110][T18962] Call Trace: [ 1280.404118][T18962] [ 1280.404127][T18962] dump_stack_lvl+0xe8/0x150 [ 1280.404158][T18962] should_fail_ex+0x46b/0x600 [ 1280.404185][T18962] _copy_to_user+0x31/0xb0 [ 1280.404214][T18962] simple_read_from_buffer+0xe1/0x170 [ 1280.404243][T18962] proc_fail_nth_read+0x1be/0x230 [ 1280.404273][T18962] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1280.404301][T18962] ? rw_verify_area+0x250/0x4d0 [ 1280.404327][T18962] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1280.404351][T18962] vfs_read+0x219/0xa90 [ 1280.404383][T18962] ? __pfx_vfs_read+0x10/0x10 [ 1280.404410][T18962] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1280.404436][T18962] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1280.404466][T18962] ? mutex_lock_nested+0x152/0x1d0 [ 1280.404492][T18962] ? fdget_pos+0x252/0x320 [ 1280.404522][T18962] ksys_read+0x156/0x270 [ 1280.404549][T18962] ? __pfx_ksys_read+0x10/0x10 [ 1280.404585][T18962] do_syscall_64+0x166/0x520 [ 1280.404607][T18962] ? trace_irq_disable+0x3b/0x140 [ 1280.404626][T18962] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1280.404646][T18962] ? clear_bhb_loop+0x70/0xc0 [ 1280.404668][T18962] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1280.404687][T18962] RIP: 0033:0x7f2c666ee90e [ 1280.404704][T18962] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1280.404720][T18962] RSP: 002b:00007f2c64985fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1280.404740][T18962] RAX: ffffffffffffffda RBX: 00007f2c649866c0 RCX: 00007f2c666ee90e [ 1280.404753][T18962] RDX: 000000000000000f RSI: 00007f2c649860a0 RDI: 0000000000000005 [ 1280.404765][T18962] RBP: 00007f2c64986090 R08: 0000000000000000 R09: 0000000000000000 [ 1280.404777][T18962] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1280.404788][T18962] R13: 00007f2c669b6038 R14: 00007f2c669b5fa0 R15: 00007ffeb9d4c2b8 [ 1280.404819][T18962] [ 1280.695177][ T5875] f81534 6-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1280.695718][ T5875] f81534 6-1:0.12: f81534_find_config_idx: read failed: -71 [ 1280.695738][ T5875] f81534 6-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1280.695835][ T5875] f81534 6-1:0.12: probe with driver f81534 failed with error -71 [ 1280.710391][ T5875] usb 6-1: USB disconnect, device number 19 [ 1281.355507][ T31] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 1281.505981][ T31] usb 5-1: Using ep0 maxpacket: 16 [ 1281.506812][ T31] usb 5-1: New USB device found, idVendor=0925, idProduct=6d66, bcdDevice= 0.04 [ 1281.508836][ T31] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1281.508878][ T31] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1281.508917][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1281.582730][ T31] usb 5-1: config 0 descriptor?? [ 1281.584125][T18975] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1283.160939][ T31] hid (null): unknown global tag 0xc [ 1283.188621][ T31] hid-generic 0003:0925:6D66.001C: unknown global tag 0xc [ 1283.188644][ T31] hid-generic 0003:0925:6D66.001C: item 0 2 1 12 parsing failed [ 1283.191424][ T31] hid-generic 0003:0925:6D66.001C: probe with driver hid-generic failed with error -22 [ 1284.379329][T19002] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3736'. [ 1285.696991][ T43] usb 5-1: USB disconnect, device number 105 [ 1289.021178][T19028] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3744'. [ 1289.429699][T19028] workqueue: Failed to create a rescuer kthread for wq "nbd64-recv": -EINTR [ 1289.436573][T19028] block (null): Could not allocate knbd recv work queue. [ 1289.768680][T19037] jffs2: notice: (19037) jffs2_build_xattr_subsystem: complete building xattr subsystem, 3 of xdatum (0 unchecked, 2 orphan) and 5 of xref (0 dead, 4 orphan) found. [ 1289.879957][T19028] nbd: failed to add new device [ 1289.950586][T12451] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 1290.443027][T12451] hid-generic 0000:0000:0000.001D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1290.573713][T19046] netlink: 264 bytes leftover after parsing attributes in process `syz.5.3751'. [ 1290.706193][T19055] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3752'. [ 1290.706221][T19055] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3752'. [ 1291.129492][T19059] netlink: 'syz.4.3753': attribute type 10 has an invalid length. [ 1291.129513][T19059] netlink: 124 bytes leftover after parsing attributes in process `syz.4.3753'. [ 1293.329945][T19078] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1293.568381][T19084] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3763'. [ 1293.568409][T19084] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3763'. [ 1294.984224][ T43] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 1295.027471][T19104] usb usb8: usbfs: process 19104 (syz.5.3769) did not claim interface 0 before use [ 1295.137228][ T43] usb 2-1: device descriptor read/64, error -71 [ 1295.245197][T19103] ovs-s: entered promiscuous mode [ 1296.537942][ T43] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 1296.815517][ T10] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 1296.844453][T19114] netlink: NAT attribute type 0 has unexpected length (3 != 0) [ 1296.844491][T19114] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1296.876960][ T43] usb 2-1: device descriptor read/64, error -71 [ 1296.994867][ T43] usb usb2-port1: attempt power cycle [ 1296.996516][ T10] usb 6-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1297.003933][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1297.003957][ T10] usb 6-1: Product: syz [ 1297.003972][ T10] usb 6-1: Manufacturer: syz [ 1297.003986][ T10] usb 6-1: SerialNumber: syz [ 1297.012876][ T10] usb 6-1: config 0 descriptor?? [ 1297.034757][ T10] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1297.278723][T19123] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3775'. [ 1297.278751][T19123] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3775'. [ 1297.351792][T19125] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3774'. [ 1297.368828][T19125] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3774'. [ 1297.395409][ T43] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 1297.421957][ T43] usb 2-1: device descriptor read/8, error -71 [ 1297.676256][ T43] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 1297.762291][ T43] usb 2-1: device descriptor read/8, error -71 [ 1297.868026][ T43] usb usb2-port1: unable to enumerate USB device [ 1298.066905][T19135] usb usb8: usbfs: process 19135 (syz.1.3779) did not claim interface 0 before use [ 1298.713433][T19141] FAULT_INJECTION: forcing a failure. [ 1298.713433][T19141] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1298.713468][T19141] CPU: 1 UID: 0 PID: 19141 Comm: syz.1.3782 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1298.713495][T19141] Tainted: [L]=SOFTLOCKUP [ 1298.713501][T19141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1298.713512][T19141] Call Trace: [ 1298.713519][T19141] [ 1298.713527][T19141] dump_stack_lvl+0xe8/0x150 [ 1298.713569][T19141] should_fail_ex+0x46b/0x600 [ 1298.713594][T19141] _copy_to_user+0x31/0xb0 [ 1298.713618][T19141] simple_read_from_buffer+0xe1/0x170 [ 1298.713646][T19141] proc_fail_nth_read+0x1be/0x230 [ 1298.713675][T19141] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1298.713702][T19141] ? rw_verify_area+0x250/0x4d0 [ 1298.713727][T19141] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1298.713750][T19141] vfs_read+0x219/0xa90 [ 1298.713784][T19141] ? __pfx_vfs_read+0x10/0x10 [ 1298.713809][T19141] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1298.713835][T19141] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1298.713856][T19141] ? mutex_lock_nested+0x152/0x1d0 [ 1298.713880][T19141] ? fdget_pos+0x252/0x320 [ 1298.713910][T19141] ksys_read+0x156/0x270 [ 1298.713934][T19141] ? __pfx_ksys_read+0x10/0x10 [ 1298.713968][T19141] do_syscall_64+0x166/0x520 [ 1298.713988][T19141] ? trace_irq_disable+0x3b/0x140 [ 1298.714006][T19141] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1298.714024][T19141] ? clear_bhb_loop+0x70/0xc0 [ 1298.714046][T19141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1298.714064][T19141] RIP: 0033:0x7f559677e90e [ 1298.714082][T19141] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1298.714097][T19141] RSP: 002b:00007f5594a15fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1298.714116][T19141] RAX: ffffffffffffffda RBX: 00007f5594a166c0 RCX: 00007f559677e90e [ 1298.714129][T19141] RDX: 000000000000000f RSI: 00007f5594a160a0 RDI: 0000000000000004 [ 1298.714140][T19141] RBP: 00007f5594a16090 R08: 0000000000000000 R09: 0000000000000000 [ 1298.714151][T19141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1298.714163][T19141] R13: 00007f5596a46038 R14: 00007f5596a45fa0 R15: 00007ffe27141c68 [ 1298.714193][T19141] [ 1298.784330][T19112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1299.015679][ T10] gspca_stk1135: reg_w 0x200 err -110 [ 1299.016721][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1299.016735][ T10] gspca_stk1135: Sensor write failed [ 1299.016761][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1299.016772][ T10] gspca_stk1135: Sensor write failed [ 1299.016798][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1299.016808][ T10] gspca_stk1135: Sensor read failed [ 1299.016833][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1299.016841][ T10] gspca_stk1135: Sensor read failed [ 1299.016848][ T10] gspca_stk1135: Detected sensor type unknown (0x0) [ 1299.016878][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1299.016888][ T10] gspca_stk1135: Sensor read failed [ 1299.016914][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1299.016923][ T10] gspca_stk1135: Sensor read failed [ 1299.016946][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1299.016956][ T10] gspca_stk1135: Sensor write failed [ 1299.016980][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1299.016990][ T10] gspca_stk1135: Sensor write failed [ 1299.017080][ T10] stk1135 6-1:0.0: probe with driver stk1135 failed with error -110 [ 1299.055092][T19112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1299.591480][T13465] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1299.670684][T13465] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1299.698339][T13465] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1299.730213][T13465] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1299.731125][T13465] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1299.971287][T19157] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3784'. [ 1300.049354][T19156] syzkaller0: entered promiscuous mode [ 1300.049381][T19156] syzkaller0: entered allmulticast mode [ 1300.054262][T19156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1300.054884][T19156] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1301.015976][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 1301.016048][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 1302.015843][T13465] Bluetooth: hci0: command tx timeout [ 1302.070879][T19150] lo speed is unknown, defaulting to 1000 [ 1302.089663][T19188] ohci-platform QEMU0001:00: error -ENXIO: IRQ index 0 not found [ 1302.140532][ T1238] usb 6-1: USB disconnect, device number 20 [ 1302.215387][ T31] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 1302.385996][ T31] usb 3-1: Using ep0 maxpacket: 8 [ 1302.408256][ T31] usb 3-1: New USB device found, idVendor=046d, idProduct=c22d, bcdDevice= 0.00 [ 1302.411565][ T31] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1302.411611][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1302.411650][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1302.475473][ T31] usb 3-1: config 0 descriptor?? [ 1302.901799][ T31] lg-g15 0003:046D:C22D.001E: unknown main item tag 0x7 [ 1302.901897][ T31] lg-g15 0003:046D:C22D.001E: ignoring exceeding usage max [ 1302.922340][ T31] lg-g15 0003:046D:C22D.001E: unknown main item tag 0x7 [ 1302.922377][ T31] lg-g15 0003:046D:C22D.001E: item fetching failed at offset 39/40 [ 1302.924474][ T31] lg-g15 0003:046D:C22D.001E: probe with driver lg-g15 failed with error -22 [ 1303.112727][ T31] usb 3-1: USB disconnect, device number 108 [ 1303.348093][T19150] bridge0: port 1(bridge_slave_0) entered blocking state [ 1303.348298][T19150] bridge0: port 1(bridge_slave_0) entered disabled state [ 1303.348487][T19150] bridge_slave_0: entered allmulticast mode [ 1303.351897][T19150] bridge_slave_0: entered promiscuous mode [ 1303.354004][T19150] bridge0: port 2(bridge_slave_1) entered blocking state [ 1303.354133][T19150] bridge0: port 2(bridge_slave_1) entered disabled state [ 1303.354251][T19150] bridge_slave_1: entered allmulticast mode [ 1303.358612][T19150] bridge_slave_1: entered promiscuous mode [ 1303.404395][T19150] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1303.409101][T19150] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1303.476012][T19150] team0: Port device team_slave_0 added [ 1303.484652][T19150] team0: Port device team_slave_1 added [ 1303.513287][T19150] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1303.513304][T19150] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1303.513319][T19150] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1303.514820][T19150] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1303.514835][T19150] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1303.514852][T19150] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1303.653234][T19218] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3798'. [ 1303.878659][T19218] tipc: Started in network mode [ 1303.878695][T19218] tipc: Node identity e0000002, cluster identity 4711 [ 1303.878749][T19218] tipc: Enabling of bearer rejected, failed to enable media [ 1303.923543][T19150] hsr_slave_0: entered promiscuous mode [ 1303.928522][T19150] hsr_slave_1: entered promiscuous mode [ 1303.936853][T19150] debugfs: 'hsr0' already exists in 'hsr' [ 1303.936880][T19150] Cannot create hsr debugfs directory [ 1304.102511][T13465] Bluetooth: hci0: command tx timeout [ 1304.256069][ T31] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 1304.380864][T19239] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3806'. [ 1304.405394][ T31] usb 6-1: Using ep0 maxpacket: 32 [ 1304.550122][ T31] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1304.551904][ T31] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 1304.551930][ T31] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1304.551950][ T31] usb 6-1: config 0 has no interface number 0 [ 1304.551989][ T31] usb 6-1: config 0 interface 12 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1304.552015][ T31] usb 6-1: config 0 interface 12 has no altsetting 0 [ 1304.611863][ T31] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1304.611889][ T31] usb 6-1: Product: syz [ 1304.611902][ T31] usb 6-1: Manufacturer: syz [ 1304.611914][ T31] usb 6-1: SerialNumber: syz [ 1304.641096][ T31] usb 6-1: config 0 descriptor?? [ 1304.662676][ T31] f81534 6-1:0.12: required endpoints missing [ 1304.835740][T19236] usb usb8: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1305.767002][T19257] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3813'. [ 1305.767052][T19257] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3813'. [ 1305.874180][T19150] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1306.020232][T19150] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1306.045895][T19150] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1306.090765][T19150] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1306.094720][T19150] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1306.184093][T19150] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1306.186169][T13465] Bluetooth: hci0: command tx timeout [ 1306.186975][T19150] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1306.369243][T19150] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1306.398617][T19263] FAULT_INJECTION: forcing a failure. [ 1306.398617][T19263] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1306.398652][T19263] CPU: 0 UID: 0 PID: 19263 Comm: syz.0.3814 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1306.398677][T19263] Tainted: [L]=SOFTLOCKUP [ 1306.398683][T19263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1306.398694][T19263] Call Trace: [ 1306.398702][T19263] [ 1306.398710][T19263] dump_stack_lvl+0xe8/0x150 [ 1306.398740][T19263] should_fail_ex+0x46b/0x600 [ 1306.398765][T19263] _copy_to_user+0x31/0xb0 [ 1306.398788][T19263] sctp_getsockopt_local_addrs+0xafb/0xce0 [ 1306.398817][T19263] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1306.398841][T19263] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1306.398867][T19263] ? __pfx_sctp_getsockopt_local_addrs+0x10/0x10 [ 1306.398902][T19263] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 1306.398924][T19263] ? lockdep_hardirqs_on+0x7b/0x110 [ 1306.398950][T19263] sctp_getsockopt+0x68f/0xb90 [ 1306.398974][T19263] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1306.399010][T19263] do_sock_getsockopt+0x51d/0x7e0 [ 1306.399038][T19263] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1306.399069][T19263] ? __fget_files+0x3a8/0x420 [ 1306.399091][T19263] ? __fget_files+0x2a/0x420 [ 1306.399120][T19263] __x64_sys_getsockopt+0x1aa/0x250 [ 1306.399148][T19263] do_syscall_64+0x166/0x520 [ 1306.399169][T19263] ? trace_irq_disable+0x3b/0x140 [ 1306.399187][T19263] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1306.399206][T19263] ? clear_bhb_loop+0x70/0xc0 [ 1306.399227][T19263] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1306.399244][T19263] RIP: 0033:0x7f2c6672e0d9 [ 1306.399260][T19263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1306.399274][T19263] RSP: 002b:00007f2c64986028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1306.399293][T19263] RAX: ffffffffffffffda RBX: 00007f2c669b5fa0 RCX: 00007f2c6672e0d9 [ 1306.399307][T19263] RDX: 000000000000006d RSI: 0000000000000084 RDI: 0000000000000003 [ 1306.399318][T19263] RBP: 00007f2c64986090 R08: 0000200000003000 R09: 0000000000000000 [ 1306.399330][T19263] R10: 0000200000001f00 R11: 0000000000000246 R12: 0000000000000001 [ 1306.399341][T19263] R13: 00007f2c669b6038 R14: 00007f2c669b5fa0 R15: 00007ffeb9d4c2b8 [ 1306.399370][T19263] [ 1307.098085][ T1238] usb 6-1: USB disconnect, device number 21 [ 1307.219075][T13465] Bluetooth: hci1: Malformed LE Event: 0x02 [ 1307.493325][T19243] block device autoloading is deprecated and will be removed. [ 1307.499536][T19150] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1307.508907][T12451] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 1308.469778][T13465] Bluetooth: hci0: command tx timeout [ 1308.623773][T19150] 8021q: adding VLAN 0 to HW filter on device team0 [ 1308.665379][T10354] bridge0: port 1(bridge_slave_0) entered blocking state [ 1308.665466][T10354] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1308.788646][T12451] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1308.790415][T12451] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1308.819973][T12451] usb 2-1: config 0 descriptor?? [ 1308.836720][T10354] bridge0: port 2(bridge_slave_1) entered blocking state [ 1308.836866][T10354] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1309.328861][T12451] usb 2-1: Cannot set MAC address [ 1309.329140][T12451] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 1309.372131][T12451] usb 2-1: USB disconnect, device number 113 [ 1312.216772][ T5875] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1312.437190][ T5875] usb 6-1: Using ep0 maxpacket: 32 [ 1312.438013][ T5875] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1312.439610][ T5875] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 1312.439636][ T5875] usb 6-1: config 0 has no interface number 0 [ 1312.439682][ T5875] usb 6-1: config 0 interface 12 altsetting 2 has a duplicate endpoint with address 0x82, skipping [ 1312.439706][ T5875] usb 6-1: config 0 interface 12 has no altsetting 0 [ 1312.443686][ T5875] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1312.443712][ T5875] usb 6-1: Product: syz [ 1312.443727][ T5875] usb 6-1: Manufacturer: syz [ 1312.443741][ T5875] usb 6-1: SerialNumber: syz [ 1312.526985][ T5875] usb 6-1: config 0 descriptor?? [ 1312.533206][ T5875] f81534 6-1:0.12: required endpoints missing [ 1312.692989][T19150] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1312.979050][T16195] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 1313.127394][T16195] usb 3-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1313.128916][T16195] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1313.128973][T16195] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1314.135019][T16195] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1314.432003][T19344] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3834'. [ 1316.621124][T16195] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -71 [ 1316.621146][T16195] stv0680 3-1:4.0: STV(e): camera ping failed!! [ 1316.621518][T16195] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1316.621537][T16195] stv0680 3-1:4.0: last error: 0, command = 0x0 [ 1316.627467][T16195] usb 3-1: USB disconnect, device number 109 [ 1317.013204][T12451] usb 6-1: USB disconnect, device number 22 [ 1317.454319][T19355] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3837'. [ 1317.631611][T13465] Bluetooth: hci4: adv larger than maximum supported [ 1317.631631][T13465] Bluetooth: hci4: Malformed LE Event: 0x0d [ 1317.786391][T19361] Bluetooth: MGMT ver 1.23 [ 1318.177483][T19150] veth0_vlan: entered promiscuous mode [ 1318.199814][T19150] veth1_vlan: entered promiscuous mode [ 1318.381653][T19150] veth0_macvtap: entered promiscuous mode [ 1318.394003][T19150] veth1_macvtap: entered promiscuous mode [ 1319.243737][T19150] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1319.290969][T19150] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1319.345446][ T5595] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 1319.508223][ T5595] usb 2-1: New USB device found, idVendor=056e, idProduct=010c, bcdDevice= 0.00 [ 1319.512600][ T5595] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1319.512648][ T5595] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1319.637002][ T5595] usb 2-1: config 0 descriptor?? [ 1320.285119][ T5595] usbhid 2-1:0.0: can't add hid device: -71 [ 1320.285609][ T5595] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1320.431116][ T5595] usb 2-1: USB disconnect, device number 114 [ 1320.872928][ T5576] hid-generic 0000:0000:0002.001F: unknown main item tag 0x0 [ 1320.872952][ T5576] hid-generic 0000:0000:0002.001F: unknown main item tag 0x0 [ 1320.872975][ T5576] hid-generic 0000:0000:0002.001F: unknown main item tag 0x0 [ 1320.872990][ T5576] hid-generic 0000:0000:0002.001F: unknown main item tag 0x0 [ 1320.873004][ T5576] hid-generic 0000:0000:0002.001F: unknown main item tag 0x0 [ 1320.873019][ T5576] hid-generic 0000:0000:0002.001F: unknown main item tag 0x0 [ 1320.873033][ T5576] hid-generic 0000:0000:0002.001F: unknown main item tag 0x0 [ 1320.873047][ T5576] hid-generic 0000:0000:0002.001F: unknown main item tag 0x0 [ 1320.873061][ T5576] hid-generic 0000:0000:0002.001F: unknown main item tag 0x0 [ 1320.873075][ T5576] hid-generic 0000:0000:0002.001F: unknown main item tag 0x0 [ 1321.887800][T19381] netlink: 96 bytes leftover after parsing attributes in process `syz.1.3845'. [ 1321.971940][T10335] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1321.972782][T10335] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1322.058256][T14867] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1322.113096][T15151] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1322.122090][ T5576] hid-generic 0000:0000:0002.001F: hidraw0: HID v0.03 Device [syz0] on syz0 [ 1323.292611][T16195] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 1323.448123][T16195] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1323.449657][T16195] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1323.449729][T16195] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1323.584359][T16195] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1323.658224][T10350] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1323.658246][T10350] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1324.714443][T16195] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -71 [ 1324.714469][T16195] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 1324.714895][T16195] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1324.714913][T16195] stv0680 2-1:4.0: last error: 0, command = 0x0 [ 1324.718371][T16195] usb 2-1: USB disconnect, device number 115 [ 1325.612695][T15165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1325.612715][T15165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1327.294401][T10346] IPVS: starting estimator thread 0... [ 1327.535445][T19427] IPVS: using max 9 ests per chain, 21600 per kthread [ 1328.524242][T19439] vivid-000: disconnect [ 1328.623648][T19436] ip6gretap1: entered allmulticast mode [ 1328.783374][T19443] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3863'. [ 1329.013607][T19438] vivid-000: reconnect [ 1329.542620][T12856] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 1329.595630][ T1238] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 1329.706308][T12856] usb 7-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 1329.707850][T12856] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1329.707905][T12856] usb 7-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1329.707927][T12856] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1329.710419][T12856] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1329.710435][T12856] usb 7-1: Product: syz [ 1329.710442][T12856] usb 7-1: Manufacturer: syz [ 1329.710450][T12856] usb 7-1: SerialNumber: syz [ 1329.797690][ T1238] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1329.798977][ T1238] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1329.799046][ T1238] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1329.870013][ T1238] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1329.981731][T12856] ushc 7-1:1.0: probe with driver ushc failed with error -110 [ 1330.582784][T19460] FAULT_INJECTION: forcing a failure. [ 1330.582784][T19460] name failslab, interval 1, probability 0, space 0, times 0 [ 1330.582820][T19460] CPU: 1 UID: 0 PID: 19460 Comm: syz.2.3869 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1330.582845][T19460] Tainted: [L]=SOFTLOCKUP [ 1330.582851][T19460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1330.582861][T19460] Call Trace: [ 1330.582868][T19460] [ 1330.582876][T19460] dump_stack_lvl+0xe8/0x150 [ 1330.582909][T19460] should_fail_ex+0x46b/0x600 [ 1330.582934][T19460] should_failslab+0xa8/0x100 [ 1330.582958][T19460] __kvmalloc_node_noprof+0x17a/0x8a0 [ 1330.582982][T19460] ? io_ring_ctx_alloc+0x1bd/0xba0 [ 1330.583000][T19460] ? io_ring_ctx_alloc+0x1bd/0xba0 [ 1330.583023][T19460] io_ring_ctx_alloc+0x1bd/0xba0 [ 1330.583042][T19460] ? io_prepare_config+0x8c8/0xc70 [ 1330.583071][T19460] io_uring_create+0x50/0x990 [ 1330.583093][T19460] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 1330.583117][T19460] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1330.583137][T19460] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1330.583175][T19460] ? __pfx_ksys_write+0x10/0x10 [ 1330.583209][T19460] do_syscall_64+0x166/0x520 [ 1330.583231][T19460] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1330.583250][T19460] ? clear_bhb_loop+0x70/0xc0 [ 1330.583272][T19460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1330.583290][T19460] RIP: 0033:0x7f0a1324e0d9 [ 1330.583308][T19460] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1330.583325][T19460] RSP: 002b:00007f0a114a5ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1330.583346][T19460] RAX: ffffffffffffffda RBX: 0000200000000a88 RCX: 00007f0a1324e0d9 [ 1330.583360][T19460] RDX: 0000200000000b08 RSI: 0000200000000a88 RDI: 00000000000003c9 [ 1330.583373][T19460] RBP: 0000200000000a80 R08: 0000000000000000 R09: 0000000000000000 [ 1330.583386][T19460] R10: 0000200000000b10 R11: 0000000000000206 R12: 0000200000000b08 [ 1330.583399][T19460] R13: 0000200000000b10 R14: 00007f0a114a5fd8 R15: 0000000000000000 [ 1330.583429][T19460] [ 1330.896172][ T1238] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -71 [ 1330.896196][ T1238] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 1330.896590][ T1238] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1330.896607][ T1238] stv0680 2-1:4.0: last error: 0, command = 0x0 [ 1330.900032][ T1238] usb 2-1: USB disconnect, device number 116 [ 1331.217498][T19466] netlink: 'syz.1.3870': attribute type 2 has an invalid length. [ 1333.122454][ T43] usb 7-1: USB disconnect, device number 2 [ 1333.329572][T12856] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 1333.408937][T19477] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 1333.409655][T19477] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1333.475436][T12856] usb 1-1: Using ep0 maxpacket: 32 [ 1333.476404][T12856] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1333.477567][T12856] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 1333.477582][T12856] usb 1-1: config 0 has no interface number 0 [ 1333.477608][T12856] usb 1-1: config 0 interface 12 has no altsetting 0 [ 1333.480128][T12856] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1333.480143][T12856] usb 1-1: Product: syz [ 1333.480151][T12856] usb 1-1: Manufacturer: syz [ 1333.480158][T12856] usb 1-1: SerialNumber: syz [ 1333.550756][T12856] usb 1-1: config 0 descriptor?? [ 1333.653379][T19488] loop5: detected capacity change from 0 to 6 [ 1333.701864][T19488] Dev loop5: unable to read RDB block 6 [ 1333.701898][T19488] loop5: AHDI p1 p2 [ 1333.701919][T19488] loop5: partition table partially beyond EOD, truncated [ 1333.763873][T19488] loop5: p1 start 1702059890 is beyond EOD, truncated [ 1333.792847][ T4955] Dev loop5: unable to read RDB block 6 [ 1333.792875][ T4955] loop5: AHDI p1 p2 [ 1333.792897][ T4955] loop5: partition table partially beyond EOD, truncated [ 1333.793154][ T4955] loop5: p1 start 1702059890 is beyond EOD, truncated [ 1333.881816][ T43] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 1334.026350][ T43] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1334.028918][ T43] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1334.028972][ T43] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1334.028995][ T43] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1334.029069][ T43] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1334.029113][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1334.053755][T19493] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3880'. [ 1334.053783][T19493] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3880'. [ 1334.053799][T19493] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3880'. [ 1334.535733][ T1238] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1334.553200][ T10] usb 2-1: USB disconnect, device number 117 [ 1334.621789][T12856] f81534 1-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1334.621843][T12856] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 1334.621860][T12856] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1334.621947][T12856] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 1334.676247][T12856] usb 1-1: USB disconnect, device number 110 [ 1334.705733][ T1238] usb 7-1: Using ep0 maxpacket: 32 [ 1334.707068][ T1238] usb 7-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1334.709563][ T1238] usb 7-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1334.711686][ T1238] usb 7-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1334.711716][ T1238] usb 7-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1334.711743][ T1238] usb 7-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1334.779497][ T1238] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1334.779525][ T1238] usb 7-1: Product: syz [ 1334.779539][ T1238] usb 7-1: Manufacturer: syz [ 1334.779552][ T1238] usb 7-1: SerialNumber: syz [ 1334.850238][ C1] imon 7-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1335.132015][ T1238] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:155.0/input/input21 [ 1335.265831][ T1238] imon 7-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1335.265853][ T1238] (id 0x00) [ 1335.527271][T19515] vivid-000: disconnect [ 1335.527589][T19514] vivid-000: reconnect [ 1335.585421][ T1238] rc_core: IR keymap rc-imon-pad not found [ 1335.585442][ T1238] Registered IR keymap rc-empty [ 1335.585603][ T1238] imon 7-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1335.585624][ T1238] imon 7-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1336.012638][T19531] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3893'. [ 1337.061108][ T5703] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 1337.157419][T19539] netlink: 'syz.2.3895': attribute type 1 has an invalid length. [ 1338.136159][ T5703] usb 1-1: Using ep0 maxpacket: 16 [ 1338.228765][ T5703] usb 1-1: New USB device found, idVendor=0925, idProduct=6d66, bcdDevice= 0.04 [ 1338.230222][ T5703] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1338.230267][ T5703] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1338.230310][ T5703] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1338.234566][ T10] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 1338.310909][ T5703] usb 1-1: config 0 descriptor?? [ 1338.438451][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 1338.460798][ T10] usb 6-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice= 1.00 [ 1338.478038][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 1338.478143][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1338.478190][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1338.570958][ T10] kobil_sct 6-1:1.0: KOBIL USB smart card terminal converter detected [ 1338.638362][ T1238] imon:send_packet: packet tx failed (-71) [ 1338.660530][ T1238] imon 7-1:155.0: remote input dev register failed [ 1338.660693][ T1238] imon 7-1:155.0: imon_init_intf0: rc device setup failed [ 1338.682551][ T10] usb 6-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 1338.750699][ T5703] hid (null): unknown global tag 0xc [ 1338.773177][T19523] 9p: Bad value for 'rfdno' [ 1338.851497][ T5703] hid-generic 0003:0925:6D66.0020: unknown global tag 0xc [ 1338.851518][ T5703] hid-generic 0003:0925:6D66.0020: item 0 2 1 12 parsing failed [ 1338.852170][ T5703] hid-generic 0003:0925:6D66.0020: probe with driver hid-generic failed with error -22 [ 1338.932660][ T10] usb 6-1: USB disconnect, device number 23 [ 1338.999059][T19548] vivid-000: disconnect [ 1338.999354][T19547] vivid-000: reconnect [ 1339.174020][ T5895] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 1339.979570][ T5895] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1339.983325][ T5895] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1339.983380][ T5895] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1339.983401][ T5895] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1339.983425][ T5895] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1339.983468][ T5895] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1340.020025][ T10] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 1340.020872][ T10] kobil_sct 6-1:1.0: device disconnected [ 1340.209268][ T10] usb 1-1: USB disconnect, device number 111 [ 1340.804444][ T10] usb 2-1: USB disconnect, device number 118 [ 1341.056324][ T5703] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1341.206216][ T5703] usb 6-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 1341.207438][ T5703] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1341.207483][ T5703] usb 6-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1341.207501][ T5703] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1341.209597][ T5703] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1341.209621][ T5703] usb 6-1: Product: syz [ 1341.209635][ T5703] usb 6-1: Manufacturer: syz [ 1341.209650][ T5703] usb 6-1: SerialNumber: syz [ 1341.520620][ T5703] ushc 6-1:1.0: probe with driver ushc failed with error -110 [ 1341.928164][T19581] netlink: 'syz.6.3908': attribute type 1 has an invalid length. [ 1341.979863][ T1238] imon 7-1:155.0: unable to initialize intf0, err 0 [ 1341.979885][ T1238] imon:imon_probe: failed to initialize context! [ 1341.979898][ T1238] imon 7-1:155.0: unable to register, err -19 [ 1341.986978][ T1238] usb 7-1: USB disconnect, device number 3 [ 1342.813647][T19589] vivid-000: disconnect [ 1342.814819][T19588] vivid-000: reconnect [ 1343.385949][T19583] ushc 6-1:1.0: probe with driver ushc failed with error -110 [ 1343.426009][ T10] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 1343.566266][ T5703] usb 6-1: USB disconnect, device number 24 [ 1343.623784][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 1343.633820][ T10] usb 2-1: New USB device found, idVendor=0925, idProduct=6d66, bcdDevice= 0.04 [ 1343.645485][ T10] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1343.645530][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1343.645570][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1343.654569][ T10] usb 2-1: config 0 descriptor?? [ 1343.685698][ T1238] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 1343.761272][T13465] Bluetooth: hci3: unexpected cc 0x0c05 length: 4 > 1 [ 1343.761307][T13465] Bluetooth: hci3: unexpected event for opcode 0x0c05 [ 1343.854758][ T1238] usb 3-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 1343.856573][ T1238] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1343.856625][ T1238] usb 3-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1343.856646][ T1238] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1343.859873][ T1238] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1343.859899][ T1238] usb 3-1: Product: syz [ 1343.859913][ T1238] usb 3-1: Manufacturer: syz [ 1343.859926][ T1238] usb 3-1: SerialNumber: syz [ 1344.077978][ T1238] ushc 3-1:1.0: probe with driver ushc failed with error -110 [ 1344.101535][ T10] hid (null): unknown global tag 0xc [ 1344.164932][ T36] kauditd_printk_skb: 30 callbacks suppressed [ 1344.164949][ T36] audit: type=1326 audit(1787362180.200:3715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19608 comm="syz.6.3917" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5daa8ce0d9 code=0x7ffc0000 [ 1344.164998][ T36] audit: type=1326 audit(1787362180.200:3716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19608 comm="syz.6.3917" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5daa8ce0d9 code=0x7ffc0000 [ 1344.165035][ T36] audit: type=1326 audit(1787362180.200:3717): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19608 comm="syz.6.3917" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5daa8ce0d9 code=0x7ffc0000 [ 1344.165071][ T36] audit: type=1326 audit(1787362180.200:3718): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19608 comm="syz.6.3917" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5daa8ce0d9 code=0x7ffc0000 [ 1344.165108][ T36] audit: type=1326 audit(1787362180.200:3719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19608 comm="syz.6.3917" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5daa8ce0d9 code=0x7ffc0000 [ 1344.171574][ T36] audit: type=1326 audit(1787362180.200:3720): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19608 comm="syz.6.3917" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5daa8ce0d9 code=0x7ffc0000 [ 1344.171627][ T36] audit: type=1326 audit(1787362180.210:3721): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19608 comm="syz.6.3917" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5daa8ce0d9 code=0x7ffc0000 [ 1344.171667][ T36] audit: type=1326 audit(1787362180.210:3722): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19608 comm="syz.6.3917" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f5daa8ce0d9 code=0x7ffc0000 [ 1344.171706][ T36] audit: type=1326 audit(1787362180.210:3723): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19608 comm="syz.6.3917" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5daa8ce0d9 code=0x7ffc0000 [ 1344.171758][ T36] audit: type=1326 audit(1787362180.210:3724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19608 comm="syz.6.3917" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5daa8ce0d9 code=0x7ffc0000 [ 1346.327191][T19617] ushc 3-1:1.0: probe with driver ushc failed with error -110 [ 1346.599392][ T10] hid-generic 0003:0925:6D66.0021: unknown global tag 0xc [ 1346.599418][ T10] hid-generic 0003:0925:6D66.0021: item 0 2 1 12 parsing failed [ 1346.600114][ T10] hid-generic 0003:0925:6D66.0021: probe with driver hid-generic failed with error -22 [ 1347.294642][ T10] usb 2-1: USB disconnect, device number 119 [ 1347.364863][ T5576] usb 3-1: USB disconnect, device number 110 [ 1348.952026][T17181] Bluetooth: hci1: command 0x0406 tx timeout [ 1350.285409][ T5576] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 1350.467195][T19649] input: syz0 as /devices/virtual/input/input23 [ 1350.653544][T19651] device-mapper: ioctl: Invalid ioctl structure: name my, dev f800 [ 1351.347404][ T5576] usb 2-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 1351.371899][ T10] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 1351.394901][ T5576] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1351.614845][ T5576] usb 2-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1351.614875][ T5576] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1351.654646][ T5576] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1351.654673][ T5576] usb 2-1: Product: syz [ 1351.654687][ T5576] usb 2-1: Manufacturer: syz [ 1351.654702][ T5576] usb 2-1: SerialNumber: syz [ 1351.700715][ T10] usb 6-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 1351.717918][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1351.717994][ T10] usb 6-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1351.718016][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1351.721489][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1351.721516][ T10] usb 6-1: Product: syz [ 1351.721531][ T10] usb 6-1: Manufacturer: syz [ 1351.721545][ T10] usb 6-1: SerialNumber: syz [ 1351.801747][T19654] FAULT_INJECTION: forcing a failure. [ 1351.801747][T19654] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1351.801777][T19654] CPU: 1 UID: 0 PID: 19654 Comm: syz.6.3924 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1351.801798][T19654] Tainted: [L]=SOFTLOCKUP [ 1351.801803][T19654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1351.801812][T19654] Call Trace: [ 1351.801817][T19654] [ 1351.801824][T19654] dump_stack_lvl+0xe8/0x150 [ 1351.801849][T19654] should_fail_ex+0x46b/0x600 [ 1351.801868][T19654] _copy_from_user+0x2d/0xb0 [ 1351.801886][T19654] bpf_test_init+0xd8/0x150 [ 1351.801905][T19654] bpf_prog_test_run_xdp+0x4cc/0x11d0 [ 1351.801931][T19654] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1351.801951][T19654] ? __fget_files+0x2a/0x420 [ 1351.801973][T19654] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1351.801990][T19654] bpf_prog_test_run+0x2cb/0x340 [ 1351.802010][T19654] __sys_bpf+0xa22/0xd90 [ 1351.802032][T19654] ? __pfx___sys_bpf+0x10/0x10 [ 1351.802051][T19654] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1351.802073][T19654] ? rt_mutex_slowunlock+0x219/0x460 [ 1351.802101][T19654] ? ksys_write+0x248/0x270 [ 1351.802123][T19654] ? __pfx_ksys_write+0x10/0x10 [ 1351.802146][T19654] __x64_sys_bpf+0xba/0xd0 [ 1351.802162][T19654] do_syscall_64+0x166/0x520 [ 1351.802179][T19654] ? trace_irq_disable+0x3b/0x140 [ 1351.802192][T19654] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1351.802207][T19654] ? clear_bhb_loop+0x70/0xc0 [ 1351.802224][T19654] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1351.802237][T19654] RIP: 0033:0x7f5daa8ce0d9 [ 1351.802251][T19654] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1351.802273][T19654] RSP: 002b:00007f5da8b26028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1351.802289][T19654] RAX: ffffffffffffffda RBX: 00007f5daab55fa0 RCX: 00007f5daa8ce0d9 [ 1351.802299][T19654] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1351.802308][T19654] RBP: 00007f5da8b26090 R08: 0000000000000000 R09: 0000000000000000 [ 1351.802316][T19654] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1351.802324][T19654] R13: 00007f5daab56038 R14: 00007f5daab55fa0 R15: 00007ffe8af2e9c8 [ 1351.802346][T19654] [ 1352.275884][ T5576] ushc 2-1:1.0: probe with driver ushc failed with error -110 [ 1352.305670][ T10] ushc 6-1:1.0: probe with driver ushc failed with error -110 [ 1352.325723][ T5595] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 1352.461934][T19659] ushc 2-1:1.0: probe with driver ushc failed with error -32 [ 1352.475654][ T5595] usb 7-1: Using ep0 maxpacket: 32 [ 1352.484621][ T5595] usb 7-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1352.509188][ T5595] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1352.509232][ T5595] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1352.509260][ T5595] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1352.509283][ T5595] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1352.543149][ T5595] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1352.543177][ T5595] usb 7-1: Product: syz [ 1352.543191][ T5595] usb 7-1: Manufacturer: syz [ 1352.543205][ T5595] usb 7-1: SerialNumber: syz [ 1352.615774][ T5703] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 1352.638058][ T5595] usb 7-1: config 0 descriptor?? [ 1352.770214][ T5703] usb 1-1: Using ep0 maxpacket: 16 [ 1352.771155][ T5703] usb 1-1: New USB device found, idVendor=0925, idProduct=6d66, bcdDevice= 0.04 [ 1352.773695][ T5703] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1352.773723][ T5703] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1352.773747][ T5703] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1352.790279][T19646] ushc 2-1:1.0: probe with driver ushc failed with error -32 [ 1352.790809][ T5703] usb 1-1: config 0 descriptor?? [ 1352.906798][T19659] ushc 6-1:1.0: probe with driver ushc failed with error -32 [ 1352.912912][T19656] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1352.934213][T19656] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1352.977173][T19667] vivid-000: disconnect [ 1352.977391][T19666] vivid-000: reconnect [ 1353.062042][ T1238] usb 2-1: USB disconnect, device number 120 [ 1353.107986][T19671] netlink: 'syz.2.3937': attribute type 1 has an invalid length. [ 1353.212269][ T5703] hid (null): unknown global tag 0xc [ 1353.237363][ T5595] usb 7-1: USB disconnect, device number 4 [ 1353.279954][ T5703] hid-generic 0003:0925:6D66.0022: unknown global tag 0xc [ 1353.279979][ T5703] hid-generic 0003:0925:6D66.0022: item 0 2 1 12 parsing failed [ 1353.282480][ T5703] hid-generic 0003:0925:6D66.0022: probe with driver hid-generic failed with error -22 [ 1353.359107][T19646] ushc 6-1:1.0: probe with driver ushc failed with error -32 [ 1353.435698][ T1238] usb 1-1: USB disconnect, device number 112 [ 1353.514931][ T5703] usb 6-1: USB disconnect, device number 25 [ 1354.288620][T19695] netlink: 'syz.0.3945': attribute type 3 has an invalid length. [ 1354.288973][T19695] netlink: 'syz.0.3945': attribute type 3 has an invalid length. [ 1354.292528][T19695] netlink: 'syz.0.3945': attribute type 6 has an invalid length. [ 1356.966851][T19703] netlink: 'syz.2.3948': attribute type 1 has an invalid length. [ 1358.706579][T19714] vivid-000: disconnect [ 1358.709443][T19713] vivid-000: reconnect [ 1359.139008][ T5595] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 1359.235939][T12451] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 1359.573137][ T5595] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1360.372231][T12451] usb 7-1: device descriptor read/64, error -71 [ 1360.754587][T12451] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 1361.072716][T12451] usb 7-1: device descriptor read/64, error -71 [ 1361.184742][T12451] usb usb7-port1: attempt power cycle [ 1361.521090][ T5595] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1361.521121][ T5595] usb 1-1: Product: syz [ 1361.521136][ T5595] usb 1-1: Manufacturer: syz [ 1361.521150][ T5595] usb 1-1: SerialNumber: syz [ 1361.599637][ T5595] usb 1-1: config 0 descriptor?? [ 1361.809690][ T5595] usb 1-1: Firmware version (0.0) predates our first public release. [ 1361.809715][ T5595] usb 1-1: Please update to version 0.2 or newer [ 1361.946168][ T1323] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.946223][ T1323] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.958521][T12451] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 1362.832515][T12451] usb 7-1: device descriptor read/8, error -71 [ 1362.958679][ T5576] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1363.051844][T19761] FAULT_INJECTION: forcing a failure. [ 1363.051844][T19761] name failslab, interval 1, probability 0, space 0, times 0 [ 1363.051880][T19761] CPU: 0 UID: 0 PID: 19761 Comm: syz.2.3968 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1363.051905][T19761] Tainted: [L]=SOFTLOCKUP [ 1363.051911][T19761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1363.051922][T19761] Call Trace: [ 1363.051929][T19761] [ 1363.051937][T19761] dump_stack_lvl+0xe8/0x150 [ 1363.051967][T19761] should_fail_ex+0x46b/0x600 [ 1363.051992][T19761] should_failslab+0xa8/0x100 [ 1363.052014][T19761] kmem_cache_alloc_node_noprof+0xae/0x670 [ 1363.052042][T19761] ? __alloc_skb+0x1db/0x7a0 [ 1363.052067][T19761] ? __alloc_skb+0x1db/0x7a0 [ 1363.052096][T19761] __alloc_skb+0x1db/0x7a0 [ 1363.052125][T19761] netlink_sendmsg+0x5d4/0xb40 [ 1363.052153][T19761] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1363.052175][T19761] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1363.052199][T19761] ? __kernel_text_address+0xd/0x30 [ 1363.052217][T19761] ? unwind_get_return_address+0x4d/0x90 [ 1363.052240][T19761] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1363.052259][T19761] sock_sendmsg_nosec+0x13a/0x180 [ 1363.052286][T19761] ____sys_sendmsg+0x565/0x870 [ 1363.052305][T19761] ? __might_fault+0xaf/0x130 [ 1363.052328][T19761] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1363.052354][T19761] ? import_iovec+0x73/0xa0 [ 1363.052378][T19761] ___sys_sendmsg+0x2a5/0x360 [ 1363.052396][T19761] ? __lock_acquire+0x683/0x2ce0 [ 1363.052417][T19761] ? __pfx____sys_sendmsg+0x10/0x10 [ 1363.052466][T19761] ? __fget_files+0x2a/0x420 [ 1363.052487][T19761] ? __fget_files+0x3a8/0x420 [ 1363.052515][T19761] __x64_sys_sendmsg+0x1b7/0x290 [ 1363.052546][T19761] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1363.052585][T19761] do_syscall_64+0x166/0x520 [ 1363.052607][T19761] ? trace_irq_disable+0x3b/0x140 [ 1363.052626][T19761] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1363.052643][T19761] ? clear_bhb_loop+0x70/0xc0 [ 1363.052662][T19761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1363.052679][T19761] RIP: 0033:0x7f0a1324e0d9 [ 1363.052695][T19761] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1363.052710][T19761] RSP: 002b:00007f0a114a6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1363.052730][T19761] RAX: ffffffffffffffda RBX: 00007f0a134d5fa0 RCX: 00007f0a1324e0d9 [ 1363.052742][T19761] RDX: 0000000020008040 RSI: 0000200000009b40 RDI: 0000000000000004 [ 1363.052753][T19761] RBP: 00007f0a114a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1363.052763][T19761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1363.052773][T19761] R13: 00007f0a134d6038 R14: 00007f0a134d5fa0 R15: 00007ffe47e94b68 [ 1363.052799][T19761] [ 1363.116448][ T5576] usb 6-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 1363.118231][ T5576] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1363.118286][ T5576] usb 6-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1363.118308][ T5576] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1363.247509][ T5576] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1363.247537][ T5576] usb 6-1: Product: syz [ 1363.247552][ T5576] usb 6-1: Manufacturer: syz [ 1363.247575][ T5576] usb 6-1: SerialNumber: syz [ 1363.335290][T19764] netlink: 428 bytes leftover after parsing attributes in process `syz.0.3962'. [ 1363.405690][T12451] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 1363.428269][T12451] usb 7-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1363.431494][T12451] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1363.431578][T12451] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1363.431601][T12451] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1363.431624][T12451] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1363.431666][T12451] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1363.676117][ T5576] ushc 6-1:1.0: probe with driver ushc failed with error -110 [ 1364.391962][T12451] usb 7-1: USB disconnect, device number 8 [ 1364.487797][T19795] FAULT_INJECTION: forcing a failure. [ 1364.487797][T19795] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1364.487833][T19795] CPU: 0 UID: 0 PID: 19795 Comm: syz.2.3981 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1364.487858][T19795] Tainted: [L]=SOFTLOCKUP [ 1364.487865][T19795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1364.487875][T19795] Call Trace: [ 1364.487883][T19795] [ 1364.487891][T19795] dump_stack_lvl+0xe8/0x150 [ 1364.487922][T19795] should_fail_ex+0x46b/0x600 [ 1364.487948][T19795] prepare_alloc_pages+0x223/0x650 [ 1364.487975][T19795] __alloc_frozen_pages_noprof+0x1a1/0x5c0 [ 1364.488000][T19795] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1364.488022][T19795] ? __pfx_policy_nodemask+0x10/0x10 [ 1364.488048][T19795] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1364.488073][T19795] alloc_pages_mpol+0xd4/0x280 [ 1364.488097][T19795] alloc_pages_noprof+0xd2/0x2f0 [ 1364.488121][T19795] get_free_pages_noprof+0xf/0x80 [ 1364.488142][T19795] __kasan_populate_vmalloc+0x38/0x1c0 [ 1364.488170][T19795] ? rt_spin_unlock+0x165/0x200 [ 1364.488190][T19795] alloc_vmap_area+0xd1a/0x1420 [ 1364.488228][T19795] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1364.488254][T19795] ? __get_vm_area_node+0x155/0x2f0 [ 1364.488282][T19795] __get_vm_area_node+0x200/0x2f0 [ 1364.488315][T19795] __vmalloc_node_range_noprof+0x34e/0x1560 [ 1364.488338][T19795] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1364.488379][T19795] ? __lock_acquire+0x683/0x2ce0 [ 1364.488407][T19795] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1364.488432][T19795] ? kernel_text_address+0xa5/0xe0 [ 1364.488455][T19795] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1364.488473][T19795] __vmalloc_noprof+0xd2/0x120 [ 1364.488498][T19795] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1364.488521][T19795] bpf_prog_alloc_no_stats+0x47/0x560 [ 1364.488541][T19795] ? bpf_prog_alloc+0x2a/0x1a0 [ 1364.488564][T19795] bpf_prog_alloc+0x3c/0x1a0 [ 1364.488588][T19795] bpf_prog_load+0x7f8/0x1c20 [ 1364.488620][T19795] ? __pfx_bpf_prog_load+0x10/0x10 [ 1364.488666][T19795] __sys_bpf+0xd0d/0xd90 [ 1364.488695][T19795] ? __pfx___sys_bpf+0x10/0x10 [ 1364.488717][T19795] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1364.488745][T19795] ? rt_mutex_slowunlock+0x219/0x460 [ 1364.488780][T19795] ? ksys_write+0x248/0x270 [ 1364.488805][T19795] ? __pfx_ksys_write+0x10/0x10 [ 1364.488832][T19795] __x64_sys_bpf+0xba/0xd0 [ 1364.488853][T19795] do_syscall_64+0x166/0x520 [ 1364.488874][T19795] ? trace_irq_disable+0x3b/0x140 [ 1364.488890][T19795] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1364.488909][T19795] ? clear_bhb_loop+0x70/0xc0 [ 1364.488931][T19795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1364.488945][T19795] RIP: 0033:0x7f0a1324e0d9 [ 1364.488961][T19795] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1364.488975][T19795] RSP: 002b:00007f0a114a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1364.488995][T19795] RAX: ffffffffffffffda RBX: 00007f0a134d5fa0 RCX: 00007f0a1324e0d9 [ 1364.489009][T19795] RDX: 0000000000000094 RSI: 0000200000000340 RDI: 0000000000000005 [ 1364.489019][T19795] RBP: 00007f0a114a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1364.489031][T19795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1364.489042][T19795] R13: 00007f0a134d6038 R14: 00007f0a134d5fa0 R15: 00007ffe47e94b68 [ 1364.489070][T19795] [ 1364.489427][T19795] syz.2.3981: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1364.489493][T19795] CPU: 0 UID: 0 PID: 19795 Comm: syz.2.3981 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1364.489520][T19795] Tainted: [L]=SOFTLOCKUP [ 1364.489526][T19795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1364.489535][T19795] Call Trace: [ 1364.489542][T19795] [ 1364.489549][T19795] dump_stack_lvl+0xe8/0x150 [ 1364.489578][T19795] warn_alloc+0x24d/0x270 [ 1364.489598][T19795] ? lockdep_hardirqs_on+0x7b/0x110 [ 1364.489622][T19795] ? __pfx_warn_alloc+0x10/0x10 [ 1364.489639][T19795] ? kfree+0x1c5/0x6d0 [ 1364.489669][T19795] ? __get_vm_area_node+0x219/0x2f0 [ 1364.489700][T19795] __vmalloc_node_range_noprof+0x376/0x1560 [ 1364.489738][T19795] ? __lock_acquire+0x683/0x2ce0 [ 1364.489763][T19795] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1364.489787][T19795] ? kernel_text_address+0xa5/0xe0 [ 1364.489808][T19795] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1364.489825][T19795] __vmalloc_noprof+0xd2/0x120 [ 1364.489848][T19795] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1364.489868][T19795] bpf_prog_alloc_no_stats+0x47/0x560 [ 1364.489884][T19795] ? bpf_prog_alloc+0x2a/0x1a0 [ 1364.489904][T19795] bpf_prog_alloc+0x3c/0x1a0 [ 1364.489925][T19795] bpf_prog_load+0x7f8/0x1c20 [ 1364.489956][T19795] ? __pfx_bpf_prog_load+0x10/0x10 [ 1364.490000][T19795] __sys_bpf+0xd0d/0xd90 [ 1364.490028][T19795] ? __pfx___sys_bpf+0x10/0x10 [ 1364.490051][T19795] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1364.490079][T19795] ? rt_mutex_slowunlock+0x219/0x460 [ 1364.490115][T19795] ? ksys_write+0x248/0x270 [ 1364.490140][T19795] ? __pfx_ksys_write+0x10/0x10 [ 1364.490169][T19795] __x64_sys_bpf+0xba/0xd0 [ 1364.490190][T19795] do_syscall_64+0x166/0x520 [ 1364.490211][T19795] ? trace_irq_disable+0x3b/0x140 [ 1364.490228][T19795] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1364.490247][T19795] ? clear_bhb_loop+0x70/0xc0 [ 1364.490268][T19795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1364.490285][T19795] RIP: 0033:0x7f0a1324e0d9 [ 1364.490303][T19795] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1364.490317][T19795] RSP: 002b:00007f0a114a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1364.490336][T19795] RAX: ffffffffffffffda RBX: 00007f0a134d5fa0 RCX: 00007f0a1324e0d9 [ 1364.490349][T19795] RDX: 0000000000000094 RSI: 0000200000000340 RDI: 0000000000000005 [ 1364.490369][T19795] RBP: 00007f0a114a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1364.490380][T19795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1364.490391][T19795] R13: 00007f0a134d6038 R14: 00007f0a134d5fa0 R15: 00007ffe47e94b68 [ 1364.490421][T19795] [ 1364.490441][T19795] Mem-Info: [ 1364.490450][T19795] active_anon:221 inactive_anon:7719 isolated_anon:0 [ 1364.490450][T19795] active_file:29614 inactive_file:35928 isolated_file:0 [ 1364.490450][T19795] unevictable:0 dirty:227 writeback:0 [ 1364.490450][T19795] slab_reclaimable:13760 slab_unreclaimable:134859 [ 1364.490450][T19795] mapped:35492 shmem:536 pagetables:1339 [ 1364.490450][T19795] sec_pagetables:0 bounce:0 [ 1364.490450][T19795] kernel_misc_reclaimable:0 [ 1364.490450][T19795] free:1245525 free_pcp:6814 free_cma:0 [ 1364.490499][T19795] Node 0 active_anon:884kB inactive_anon:30876kB active_file:80024kB inactive_file:143712kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:141884kB dirty:908kB writeback:0kB shmem:2144kB kernel_stack:16112kB pagetables:5204kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1364.490547][T19795] Node 1 active_anon:0kB inactive_anon:0kB active_file:38432kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:84kB dirty:0kB writeback:0kB shmem:0kB kernel_stack:32kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1364.490592][T19795] Node 0 DMA free:15344kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1364.490647][T19795] lowmem_reserve[]: 0 2499 2501 2501 2501 [ 1364.490674][T19795] Node 0 DMA32 free:1060736kB boost:0kB min:3920kB low:6452kB high:8984kB reserved_highatomic:0KB free_highatomic:0KB active_anon:884kB inactive_anon:30876kB active_file:80024kB inactive_file:143712kB unevictable:0kB writepending:908kB zspages:0kB present:3129332kB managed:2559548kB mlocked:0kB bounce:0kB free_pcp:27248kB local_pcp:21560kB free_cma:0kB [ 1364.490733][T19795] lowmem_reserve[]: 0 0 1 1 1 [ 1364.490761][T19795] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1840kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 1364.490814][T19795] lowmem_reserve[]: 0 0 0 0 0 [ 1364.490843][T19795] Node 1 Normal free:3906020kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:38432kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1364.490921][T19795] lowmem_reserve[]: 0 0 0 0 0 [ 1364.490949][T19795] Node 0 DMA: 0*4kB 0*8kB 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15344kB [ 1364.491076][T19795] Node 0 DMA32: 364*4kB (UME) 673*8kB (UME) 1175*16kB (UME) 691*32kB (ME) 577*64kB (UM) 351*128kB (UME) 173*256kB (UME) 116*512kB (UME) 24*1024kB (M) 10*2048kB (UM) 191*4096kB (UM) = 1060680kB [ 1364.491217][T19795] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1364.491306][T19795] Node 1 Normal: 7*4kB (UM) 5*8kB (M) 6*16kB (UM) 14*32kB (UM) 4*64kB (U) 5*128kB (UM) 4*256kB (UM) 2*512kB (M) 3*1024kB (UM) 2*2048kB (UM) 951*4096kB (M) = 3906020kB [ 1364.491450][T19795] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1364.491466][T19795] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 1364.491482][T19795] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1364.491497][T19795] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1364.491512][T19795] 66074 total pagecache pages [ 1364.491520][T19795] 0 pages in swap cache [ 1364.491526][T19795] Free swap = 124996kB [ 1364.491534][T19795] Total swap = 124996kB [ 1364.491541][T19795] 2097051 pages RAM [ 1364.491548][T19795] 0 pages HighMem/MovableOnly [ 1364.491555][T19795] 425089 pages reserved [ 1364.491561][T19795] 0 pages cma reserved [ 1365.756605][ T5895] usb 6-1: USB disconnect, device number 26 [ 1366.120747][T19764] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3962'. [ 1366.133809][T19826] FAULT_INJECTION: forcing a failure. [ 1366.133809][T19826] name failslab, interval 1, probability 0, space 0, times 0 [ 1366.133846][T19826] CPU: 1 UID: 0 PID: 19826 Comm: syz.1.3993 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1366.133912][T19826] Tainted: [L]=SOFTLOCKUP [ 1366.133919][T19826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1366.133931][T19826] Call Trace: [ 1366.133939][T19826] [ 1366.133947][T19826] dump_stack_lvl+0xe8/0x150 [ 1366.133979][T19826] should_fail_ex+0x46b/0x600 [ 1366.134004][T19826] should_failslab+0xa8/0x100 [ 1366.134028][T19826] __kvmalloc_node_noprof+0x17a/0x8a0 [ 1366.134053][T19826] ? traverse+0xf1/0x620 [ 1366.134070][T19826] ? traverse+0xf1/0x620 [ 1366.134095][T19826] traverse+0xf1/0x620 [ 1366.134116][T19826] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1366.134141][T19826] ? seq_read_iter+0xa5/0xcb0 [ 1366.134162][T19826] seq_read_iter+0xb6b/0xcb0 [ 1366.134196][T19826] seq_read+0x36a/0x490 [ 1366.134213][T19826] ? kstrtouint+0x6e/0xe0 [ 1366.134245][T19826] ? __pfx_seq_read+0x10/0x10 [ 1366.134277][T19826] ? rw_verify_area+0x250/0x4d0 [ 1366.134306][T19826] vfs_readv+0x588/0x850 [ 1366.134327][T19826] ? __pfx_seq_read+0x10/0x10 [ 1366.134350][T19826] ? __pfx_vfs_readv+0x10/0x10 [ 1366.134379][T19826] ? __fget_files+0x2a/0x420 [ 1366.134406][T19826] ? __fget_files+0x3a8/0x420 [ 1366.134427][T19826] ? __fget_files+0x2a/0x420 [ 1366.134459][T19826] __x64_sys_preadv+0x19f/0x2c0 [ 1366.134487][T19826] ? __pfx___x64_sys_preadv+0x10/0x10 [ 1366.134522][T19826] do_syscall_64+0x166/0x520 [ 1366.134543][T19826] ? trace_irq_disable+0x3b/0x140 [ 1366.134561][T19826] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1366.134579][T19826] ? clear_bhb_loop+0x70/0xc0 [ 1366.134603][T19826] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1366.134622][T19826] RIP: 0033:0x7f55967be0d9 [ 1366.134640][T19826] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1366.134657][T19826] RSP: 002b:00007f5594a16028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 1366.134677][T19826] RAX: ffffffffffffffda RBX: 00007f5596a45fa0 RCX: 00007f55967be0d9 [ 1366.134692][T19826] RDX: 0000000000000001 RSI: 0000200000000480 RDI: 0000000000000004 [ 1366.134705][T19826] RBP: 00007f5594a16090 R08: 0000000000000041 R09: 0000000000000000 [ 1366.134717][T19826] R10: 0000000000000808 R11: 0000000000000246 R12: 0000000000000001 [ 1366.134729][T19826] R13: 00007f5596a46038 R14: 00007f5596a45fa0 R15: 00007ffe27141c68 [ 1366.134761][T19826] [ 1366.158085][ T5595] usb 1-1: USB disconnect, device number 113 [ 1366.510723][T12451] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 1366.706239][T12451] usb 7-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00 [ 1366.707745][T12451] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1366.707776][T12451] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1366.707799][T12451] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1366.707832][T12451] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1366.735073][T12451] usb 7-1: config 0 descriptor?? [ 1369.330649][T12451] usbhid 7-1:0.0: can't add hid device: -71 [ 1369.330776][T12451] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1369.339384][T12451] usb 7-1: USB disconnect, device number 9 [ 1369.542237][ T10] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 1369.689376][ T10] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1369.690905][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1369.690959][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1369.690982][ T10] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1369.691015][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1369.691057][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1369.888795][T19845] FAULT_INJECTION: forcing a failure. [ 1369.888795][T19845] name failslab, interval 1, probability 0, space 0, times 0 [ 1369.888831][T19845] CPU: 1 UID: 0 PID: 19845 Comm: syz.1.3998 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1369.888858][T19845] Tainted: [L]=SOFTLOCKUP [ 1369.888864][T19845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1369.888875][T19845] Call Trace: [ 1369.888883][T19845] [ 1369.888892][T19845] dump_stack_lvl+0xe8/0x150 [ 1369.888923][T19845] should_fail_ex+0x46b/0x600 [ 1369.888949][T19845] should_failslab+0xa8/0x100 [ 1369.888973][T19845] __kvmalloc_node_noprof+0x17a/0x8a0 [ 1369.888997][T19845] ? io_ring_ctx_alloc+0x1bd/0xba0 [ 1369.889013][T19845] ? io_ring_ctx_alloc+0x1bd/0xba0 [ 1369.889037][T19845] io_ring_ctx_alloc+0x1bd/0xba0 [ 1369.889056][T19845] ? io_prepare_config+0x8c8/0xc70 [ 1369.889084][T19845] io_uring_create+0x50/0x990 [ 1369.889107][T19845] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 1369.889130][T19845] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1369.889151][T19845] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1369.889190][T19845] ? __pfx_ksys_write+0x10/0x10 [ 1369.889225][T19845] do_syscall_64+0x166/0x520 [ 1369.889247][T19845] ? trace_irq_disable+0x3b/0x140 [ 1369.889266][T19845] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1369.889285][T19845] ? clear_bhb_loop+0x70/0xc0 [ 1369.889307][T19845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1369.889326][T19845] RIP: 0033:0x7f55967be0d9 [ 1369.889343][T19845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1369.889359][T19845] RSP: 002b:00007f55949d3ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1369.889379][T19845] RAX: ffffffffffffffda RBX: 0000200000000488 RCX: 00007f55967be0d9 [ 1369.889393][T19845] RDX: 0000200000000508 RSI: 0000200000000488 RDI: 00000000000003c9 [ 1369.889405][T19845] RBP: 0000200000000480 R08: 0000000000000000 R09: 0000000000000101 [ 1369.889418][T19845] R10: 0000200000000510 R11: 0000000000000206 R12: 0000200000000508 [ 1369.889431][T19845] R13: 0000200000000510 R14: 00007f55949d3fd8 R15: 0000000000000000 [ 1369.889460][T19845] [ 1371.363692][T13465] Bluetooth: hci0: unexpected cc 0x0c05 length: 4 > 1 [ 1371.643494][T12451] usb 3-1: USB disconnect, device number 111 [ 1372.972624][T19876] FAULT_INJECTION: forcing a failure. [ 1372.972624][T19876] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1372.972646][T19876] CPU: 1 UID: 0 PID: 19876 Comm: syz.1.4008 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1372.972661][T19876] Tainted: [L]=SOFTLOCKUP [ 1372.972665][T19876] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1372.972672][T19876] Call Trace: [ 1372.972677][T19876] [ 1372.972682][T19876] dump_stack_lvl+0xe8/0x150 [ 1372.972701][T19876] should_fail_ex+0x46b/0x600 [ 1372.972717][T19876] _copy_to_user+0x31/0xb0 [ 1372.972731][T19876] simple_read_from_buffer+0xe1/0x170 [ 1372.972757][T19876] proc_fail_nth_read+0x1be/0x230 [ 1372.972774][T19876] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1372.972789][T19876] ? rw_verify_area+0x250/0x4d0 [ 1372.972804][T19876] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1372.972817][T19876] vfs_read+0x219/0xa90 [ 1372.972834][T19876] ? __pfx_vfs_read+0x10/0x10 [ 1372.972848][T19876] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1372.972864][T19876] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1372.972875][T19876] ? mutex_lock_nested+0x152/0x1d0 [ 1372.972890][T19876] ? fdget_pos+0x252/0x320 [ 1372.972906][T19876] ksys_read+0x156/0x270 [ 1372.972918][T19876] ? __pfx_filldir+0x10/0x10 [ 1372.972930][T19876] ? __pfx_ksys_read+0x10/0x10 [ 1372.972949][T19876] do_syscall_64+0x166/0x520 [ 1372.972961][T19876] ? trace_irq_disable+0x3b/0x140 [ 1372.972972][T19876] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.972983][T19876] ? clear_bhb_loop+0x70/0xc0 [ 1372.972995][T19876] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.973005][T19876] RIP: 0033:0x7f559677e90e [ 1372.973015][T19876] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1372.973025][T19876] RSP: 002b:00007f5594a15fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1372.973036][T19876] RAX: ffffffffffffffda RBX: 00007f5594a166c0 RCX: 00007f559677e90e [ 1372.973043][T19876] RDX: 000000000000000f RSI: 00007f5594a160a0 RDI: 0000000000000007 [ 1372.973050][T19876] RBP: 00007f5594a16090 R08: 0000000000000000 R09: 0000000000000000 [ 1372.973056][T19876] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1372.973062][T19876] R13: 00007f5596a46038 R14: 00007f5596a45fa0 R15: 00007ffe27141c68 [ 1372.973096][T19876] [ 1373.218998][T19884] openvswitch: netlink: Missing key (keys=40, expected=100) [ 1373.769953][T19891] netlink: 104 bytes leftover after parsing attributes in process `syz.6.4012'. [ 1375.257882][ T5595] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 1375.903276][ T5595] usb 1-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1375.907130][ T5595] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1375.907187][ T5595] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1375.907210][ T5595] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1375.907233][ T5595] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1375.907275][ T5595] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1377.204562][ T5595] usb 1-1: USB disconnect, device number 114 [ 1378.215777][ T5595] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 1378.386570][ T5595] usb 1-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 1378.388956][ T5595] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1378.389010][ T5595] usb 1-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1378.389175][ T5595] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1378.422197][ T5595] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1378.422225][ T5595] usb 1-1: Product: syz [ 1378.422240][ T5595] usb 1-1: Manufacturer: syz [ 1378.422254][ T5595] usb 1-1: SerialNumber: syz [ 1378.606210][ T5595] ushc 1-1:1.0: probe with driver ushc failed with error -110 [ 1378.861658][T19964] FAULT_INJECTION: forcing a failure. [ 1378.861658][T19964] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1378.861694][T19964] CPU: 0 UID: 0 PID: 19964 Comm: syz.5.4040 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1378.861720][T19964] Tainted: [L]=SOFTLOCKUP [ 1378.861727][T19964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1378.861738][T19964] Call Trace: [ 1378.861747][T19964] [ 1378.861755][T19964] dump_stack_lvl+0xe8/0x150 [ 1378.861789][T19964] should_fail_ex+0x46b/0x600 [ 1378.861816][T19964] _copy_to_user+0x31/0xb0 [ 1378.861851][T19964] copy_to_sockptr_offset+0x66/0xa0 [ 1378.861878][T19964] do_ipv6_getsockopt+0x1e57/0x2510 [ 1378.861896][T19964] ? is_bpf_text_address+0x292/0x2b0 [ 1378.861928][T19964] ? __pfx_do_ipv6_getsockopt+0x10/0x10 [ 1378.861965][T19964] ? __lock_acquire+0x683/0x2ce0 [ 1378.861984][T19964] ? kstrtouint+0x6e/0xe0 [ 1378.862005][T19964] ? get_pid_task+0x20/0x1f0 [ 1378.862030][T19964] ? __lock_acquire+0x683/0x2ce0 [ 1378.862055][T19964] ? __might_fault+0xaf/0x130 [ 1378.862081][T19964] ipv6_getsockopt+0xbd/0x2c0 [ 1378.862103][T19964] ? __pfx_ipv6_getsockopt+0x10/0x10 [ 1378.862124][T19964] ? sock_common_getsockopt+0x2d/0xb0 [ 1378.862149][T19964] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1378.862171][T19964] do_sock_getsockopt+0x51d/0x7e0 [ 1378.862196][T19964] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1378.862230][T19964] ? __fget_files+0x3a8/0x420 [ 1378.862253][T19964] ? __fget_files+0x2a/0x420 [ 1378.862281][T19964] __x64_sys_getsockopt+0x1aa/0x250 [ 1378.862308][T19964] do_syscall_64+0x166/0x520 [ 1378.862331][T19964] ? trace_irq_disable+0x3b/0x140 [ 1378.862352][T19964] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1378.862372][T19964] ? clear_bhb_loop+0x70/0xc0 [ 1378.862394][T19964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1378.862412][T19964] RIP: 0033:0x7fa9cb6de0d9 [ 1378.862430][T19964] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1378.862446][T19964] RSP: 002b:00007fa9c9936028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1378.862467][T19964] RAX: ffffffffffffffda RBX: 00007fa9cb965fa0 RCX: 00007fa9cb6de0d9 [ 1378.862480][T19964] RDX: 0000000000000006 RSI: 0000000000000029 RDI: 0000000000000003 [ 1378.862492][T19964] RBP: 00007fa9c9936090 R08: 0000200000000280 R09: 0000000000000000 [ 1378.862504][T19964] R10: 0000200000000400 R11: 0000000000000246 R12: 0000000000000001 [ 1378.862517][T19964] R13: 00007fa9cb966038 R14: 00007fa9cb965fa0 R15: 00007fffb59d4de8 [ 1378.862547][T19964] [ 1380.348198][T19987] netlink: 96 bytes leftover after parsing attributes in process `syz.5.4044'. [ 1380.348222][T19987] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4044'. [ 1380.348235][T19987] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4044'. [ 1380.778371][T19975] ushc 1-1:1.0: probe with driver ushc failed with error -110 [ 1380.852300][ T5595] usb 1-1: USB disconnect, device number 115 [ 1381.340432][T20014] netlink: 264 bytes leftover after parsing attributes in process `syz.6.4054'. [ 1383.309876][T20041] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4065'. [ 1383.309905][T20041] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4065'. [ 1385.385991][ T5703] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 1385.853325][ T5703] usb 3-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 1385.859645][ T5703] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1385.859681][ T5703] usb 3-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1385.859692][ T5703] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1385.861969][ T5703] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1385.861985][ T5703] usb 3-1: Product: syz [ 1385.861992][ T5703] usb 3-1: Manufacturer: syz [ 1385.861999][ T5703] usb 3-1: SerialNumber: syz [ 1386.390174][ T5703] ushc 3-1:1.0: probe with driver ushc failed with error -110 [ 1387.360021][ T5703] usb 3-1: USB disconnect, device number 112 [ 1387.818946][ T5895] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 1387.968022][T20075] FAULT_INJECTION: forcing a failure. [ 1387.968022][T20075] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1387.968053][T20075] CPU: 1 UID: 0 PID: 20075 Comm: syz.1.4080 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1387.968072][T20075] Tainted: [L]=SOFTLOCKUP [ 1387.968077][T20075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1387.968087][T20075] Call Trace: [ 1387.968093][T20075] [ 1387.968099][T20075] dump_stack_lvl+0xe8/0x150 [ 1387.968125][T20075] should_fail_ex+0x46b/0x600 [ 1387.968146][T20075] _copy_from_user+0x2d/0xb0 [ 1387.968164][T20075] bpf_test_init+0xd8/0x150 [ 1387.968184][T20075] bpf_prog_test_run_xdp+0x4cc/0x11d0 [ 1387.968221][T20075] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1387.968240][T20075] ? __fget_files+0x2a/0x420 [ 1387.968262][T20075] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1387.968279][T20075] bpf_prog_test_run+0x2cb/0x340 [ 1387.968299][T20075] __sys_bpf+0xa22/0xd90 [ 1387.968319][T20075] ? __pfx___sys_bpf+0x10/0x10 [ 1387.968335][T20075] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1387.968356][T20075] ? rt_mutex_slowunlock+0x219/0x460 [ 1387.968382][T20075] ? ksys_write+0x248/0x270 [ 1387.968402][T20075] ? __pfx_ksys_write+0x10/0x10 [ 1387.968423][T20075] __x64_sys_bpf+0xba/0xd0 [ 1387.968438][T20075] do_syscall_64+0x166/0x520 [ 1387.968454][T20075] ? trace_irq_disable+0x3b/0x140 [ 1387.968468][T20075] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1387.968482][T20075] ? clear_bhb_loop+0x70/0xc0 [ 1387.968498][T20075] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1387.968511][T20075] RIP: 0033:0x7f55967be0d9 [ 1387.968526][T20075] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1387.968537][T20075] RSP: 002b:00007f5594a16028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1387.968552][T20075] RAX: ffffffffffffffda RBX: 00007f5596a45fa0 RCX: 00007f55967be0d9 [ 1387.968562][T20075] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1387.968570][T20075] RBP: 00007f5594a16090 R08: 0000000000000000 R09: 0000000000000000 [ 1387.968579][T20075] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1387.968588][T20075] R13: 00007f5596a46038 R14: 00007f5596a45fa0 R15: 00007ffe27141c68 [ 1387.968609][T20075] [ 1387.976584][ T5895] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1388.040047][ T5895] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1388.040109][ T5895] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1388.557694][ T5895] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1389.082194][T20084] FAULT_INJECTION: forcing a failure. [ 1389.082194][T20084] name failslab, interval 1, probability 0, space 0, times 0 [ 1389.082253][T20084] CPU: 1 UID: 0 PID: 20084 Comm: syz.5.4077 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1389.082277][T20084] Tainted: [L]=SOFTLOCKUP [ 1389.082283][T20084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1389.082293][T20084] Call Trace: [ 1389.082301][T20084] [ 1389.082309][T20084] dump_stack_lvl+0xe8/0x150 [ 1389.082339][T20084] should_fail_ex+0x46b/0x600 [ 1389.082366][T20084] should_failslab+0xa8/0x100 [ 1389.082391][T20084] __kmalloc_noprof+0xfe/0x780 [ 1389.082411][T20084] ? ceph_monc_init+0x148/0xb10 [ 1389.082518][T20084] ? ceph_monc_init+0x148/0xb10 [ 1389.082543][T20084] ceph_monc_init+0x148/0xb10 [ 1389.082564][T20084] ? ceph_messenger_init+0x490/0x750 [ 1389.082624][T20084] ceph_create_client+0x225/0x310 [ 1389.082649][T20084] ceph_get_tree+0x1ca/0x1a40 [ 1389.082688][T20084] vfs_get_tree+0x92/0x2a0 [ 1389.082717][T20084] vfs_cmd_create+0xa2/0x200 [ 1389.082741][T20084] __se_sys_fsconfig+0x6bf/0x810 [ 1389.082806][T20084] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 1389.082836][T20084] ? __x64_sys_fsconfig+0x2f/0xc0 [ 1389.082856][T20084] ? __x64_sys_fsconfig+0x20/0xc0 [ 1389.082878][T20084] do_syscall_64+0x166/0x520 [ 1389.082901][T20084] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1389.082921][T20084] ? clear_bhb_loop+0x70/0xc0 [ 1389.082943][T20084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1389.082962][T20084] RIP: 0033:0x7fa9cb6de0d9 [ 1389.082982][T20084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1389.082998][T20084] RSP: 002b:00007fa9c98f4028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 1389.083018][T20084] RAX: ffffffffffffffda RBX: 00007fa9cb966180 RCX: 00007fa9cb6de0d9 [ 1389.083032][T20084] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 000000000000000b [ 1389.083044][T20084] RBP: 00007fa9c98f4090 R08: 0000000000000000 R09: 0000000000000000 [ 1389.083056][T20084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1389.083068][T20084] R13: 00007fa9cb966218 R14: 00007fa9cb966180 R15: 00007fffb59d4de8 [ 1389.083099][T20084] [ 1389.883149][ T5895] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -71 [ 1389.883166][ T5895] stv0680 1-1:4.0: STV(e): camera ping failed!! [ 1389.883641][ T5895] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1389.883652][ T5895] stv0680 1-1:4.0: last error: 0, command = 0x0 [ 1389.928447][ T5895] usb 1-1: USB disconnect, device number 116 [ 1390.205368][ T10] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 1390.355531][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 1390.356792][ T10] usb 7-1: New USB device found, idVendor=0925, idProduct=6d66, bcdDevice= 0.04 [ 1390.358361][ T10] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1390.358405][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1390.358446][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1390.419159][ T10] usb 7-1: config 0 descriptor?? [ 1390.727588][T20113] Bluetooth: MGMT ver 1.23 [ 1390.834460][ T10] usbhid 7-1:0.0: can't add hid device: -71 [ 1390.834588][ T10] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1390.903517][ T10] usb 7-1: USB disconnect, device number 10 [ 1391.140097][T20120] FAULT_INJECTION: forcing a failure. [ 1391.140097][T20120] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1391.140133][T20120] CPU: 1 UID: 0 PID: 20120 Comm: syz.2.4098 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1391.140160][T20120] Tainted: [L]=SOFTLOCKUP [ 1391.140167][T20120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1391.140178][T20120] Call Trace: [ 1391.140186][T20120] [ 1391.140195][T20120] dump_stack_lvl+0xe8/0x150 [ 1391.140226][T20120] should_fail_ex+0x46b/0x600 [ 1391.140251][T20120] _copy_from_user+0x2d/0xb0 [ 1391.140275][T20120] mptcp_get_subflow_data+0xa0/0x250 [ 1391.140394][T20120] mptcp_getsockopt+0x3b4/0x1ed0 [ 1391.140420][T20120] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1391.140445][T20120] ? __pfx_mptcp_getsockopt+0x10/0x10 [ 1391.140462][T20120] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1391.140483][T20120] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1391.140513][T20120] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1391.140539][T20120] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1391.140570][T20120] ? __lock_acquire+0x683/0x2ce0 [ 1391.140598][T20120] ? __lock_acquire+0x683/0x2ce0 [ 1391.140625][T20120] ? __lock_acquire+0x683/0x2ce0 [ 1391.140647][T20120] ? unwind_next_frame+0x8f/0x2550 [ 1391.140675][T20120] ? is_bpf_text_address+0x26/0x2b0 [ 1391.140707][T20120] ? __lock_acquire+0x683/0x2ce0 [ 1391.140731][T20120] ? is_bpf_text_address+0x292/0x2b0 [ 1391.140753][T20120] ? is_bpf_text_address+0x26/0x2b0 [ 1391.140777][T20120] ? kernel_text_address+0xa5/0xe0 [ 1391.140797][T20120] ? __kernel_text_address+0xd/0x30 [ 1391.140814][T20120] ? unwind_get_return_address+0x4d/0x90 [ 1391.140833][T20120] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1391.140858][T20120] ? __lock_acquire+0x683/0x2ce0 [ 1391.140881][T20120] ? _parse_integer_limit+0x192/0x1e0 [ 1391.140914][T20120] ? __lock_acquire+0x683/0x2ce0 [ 1391.140935][T20120] ? kstrtouint+0x6e/0xe0 [ 1391.140962][T20120] ? get_pid_task+0x20/0x1f0 [ 1391.141136][T20120] ? __lock_acquire+0x683/0x2ce0 [ 1391.141167][T20120] ? __might_fault+0xaf/0x130 [ 1391.141187][T20120] ? __might_fault+0xaf/0x130 [ 1391.141220][T20120] ? sock_common_getsockopt+0x2d/0xb0 [ 1391.141246][T20120] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1391.141271][T20120] do_sock_getsockopt+0x51d/0x7e0 [ 1391.141296][T20120] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1391.141330][T20120] ? __fget_files+0x3a8/0x420 [ 1391.141352][T20120] ? __fget_files+0x2a/0x420 [ 1391.141380][T20120] __x64_sys_getsockopt+0x1aa/0x250 [ 1391.141407][T20120] do_syscall_64+0x166/0x520 [ 1391.141430][T20120] ? trace_irq_disable+0x3b/0x140 [ 1391.141449][T20120] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1391.141467][T20120] ? clear_bhb_loop+0x70/0xc0 [ 1391.141491][T20120] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1391.141521][T20120] RIP: 0033:0x7f0a1324e0d9 [ 1391.141541][T20120] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1391.141558][T20120] RSP: 002b:00007f0a114a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1391.141579][T20120] RAX: ffffffffffffffda RBX: 00007f0a134d5fa0 RCX: 00007f0a1324e0d9 [ 1391.141593][T20120] RDX: 0000000000000002 RSI: 000000000000011c RDI: 0000000000000003 [ 1391.141605][T20120] RBP: 00007f0a114a6090 R08: 0000200000000000 R09: 0000000000000000 [ 1391.141617][T20120] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000001 [ 1391.141630][T20120] R13: 00007f0a134d6038 R14: 00007f0a134d5fa0 R15: 00007ffe47e94b68 [ 1391.141660][T20120] [ 1391.417989][T20123] FAULT_INJECTION: forcing a failure. [ 1391.417989][T20123] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1391.418046][T20123] CPU: 0 UID: 0 PID: 20123 Comm: syz.5.4097 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1391.418073][T20123] Tainted: [L]=SOFTLOCKUP [ 1391.418080][T20123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1391.418091][T20123] Call Trace: [ 1391.418099][T20123] [ 1391.418108][T20123] dump_stack_lvl+0xe8/0x150 [ 1391.418139][T20123] should_fail_ex+0x46b/0x600 [ 1391.418167][T20123] _copy_to_user+0x31/0xb0 [ 1391.418192][T20123] simple_read_from_buffer+0xe1/0x170 [ 1391.418222][T20123] proc_fail_nth_read+0x1be/0x230 [ 1391.418252][T20123] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1391.418281][T20123] ? rw_verify_area+0x250/0x4d0 [ 1391.418307][T20123] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1391.418332][T20123] vfs_read+0x219/0xa90 [ 1391.418364][T20123] ? __pfx_vfs_read+0x10/0x10 [ 1391.418391][T20123] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1391.418418][T20123] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1391.418440][T20123] ? mutex_lock_nested+0x152/0x1d0 [ 1391.418466][T20123] ? fdget_pos+0x252/0x320 [ 1391.418497][T20123] ksys_read+0x156/0x270 [ 1391.418523][T20123] ? __pfx_ksys_read+0x10/0x10 [ 1391.418559][T20123] do_syscall_64+0x166/0x520 [ 1391.418582][T20123] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1391.418601][T20123] ? clear_bhb_loop+0x70/0xc0 [ 1391.418624][T20123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1391.418642][T20123] RIP: 0033:0x7fa9cb69e90e [ 1391.418660][T20123] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1391.418676][T20123] RSP: 002b:00007fa9c98f3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1391.418697][T20123] RAX: ffffffffffffffda RBX: 00007fa9c98f46c0 RCX: 00007fa9cb69e90e [ 1391.418711][T20123] RDX: 000000000000000f RSI: 00007fa9c98f40a0 RDI: 0000000000000007 [ 1391.418723][T20123] RBP: 00007fa9c98f4090 R08: 0000000000000000 R09: 0000000000000000 [ 1391.418735][T20123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1391.418747][T20123] R13: 00007fa9cb966218 R14: 00007fa9cb966180 R15: 00007fffb59d4de8 [ 1391.418778][T20123] [ 1394.632736][T20162] jffs2: notice: (20162) jffs2_build_xattr_subsystem: complete building xattr subsystem, 3 of xdatum (1 unchecked, 2 orphan) and 6 of xref (0 dead, 4 orphan) found. [ 1394.951536][T20175] sch_fq: defrate 0 ignored. [ 1395.315619][T17409] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 1395.465366][T17409] usb 1-1: Using ep0 maxpacket: 32 [ 1395.466224][T17409] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1395.467675][T17409] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 1395.467713][T17409] usb 1-1: config 0 has no interface number 0 [ 1395.467760][T17409] usb 1-1: config 0 interface 12 has no altsetting 0 [ 1395.474037][T17409] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1395.474063][T17409] usb 1-1: Product: syz [ 1395.474077][T17409] usb 1-1: Manufacturer: syz [ 1395.474091][T17409] usb 1-1: SerialNumber: syz [ 1395.571167][T17409] usb 1-1: config 0 descriptor?? [ 1397.317982][T17409] f81534 1-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1397.318020][T17409] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 1397.318033][T17409] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1397.318091][T17409] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 1397.404263][T17409] usb 1-1: USB disconnect, device number 117 [ 1397.711892][T20223] FAULT_INJECTION: forcing a failure. [ 1397.711892][T20223] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1397.711928][T20223] CPU: 0 UID: 0 PID: 20223 Comm: syz.1.4134 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1397.711953][T20223] Tainted: [L]=SOFTLOCKUP [ 1397.711960][T20223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1397.711971][T20223] Call Trace: [ 1397.711979][T20223] [ 1397.711987][T20223] dump_stack_lvl+0xe8/0x150 [ 1397.712026][T20223] should_fail_ex+0x46b/0x600 [ 1397.712053][T20223] strncpy_from_user+0x36/0x2c0 [ 1397.712076][T20223] __se_sys_add_key+0xdb/0x420 [ 1397.712107][T20223] ? __pfx___se_sys_add_key+0x10/0x10 [ 1397.712141][T20223] ? __x64_sys_add_key+0x20/0xc0 [ 1397.712166][T20223] do_syscall_64+0x166/0x520 [ 1397.712189][T20223] ? trace_irq_disable+0x3b/0x140 [ 1397.712207][T20223] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.712226][T20223] ? clear_bhb_loop+0x70/0xc0 [ 1397.712249][T20223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.712267][T20223] RIP: 0033:0x7f55967be0d9 [ 1397.712285][T20223] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1397.712302][T20223] RSP: 002b:00007f5594a16028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 1397.712322][T20223] RAX: ffffffffffffffda RBX: 00007f5596a45fa0 RCX: 00007f55967be0d9 [ 1397.712336][T20223] RDX: 00002000000001c0 RSI: 0000200000000180 RDI: 0000200000000140 [ 1397.712349][T20223] RBP: 00007f5594a16090 R08: 000000001269fd48 R09: 0000000000000000 [ 1397.712362][T20223] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 1397.712373][T20223] R13: 00007f5596a46038 R14: 00007f5596a45fa0 R15: 00007ffe27141c68 [ 1397.712404][T20223] [ 1397.865435][T17914] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 1398.016476][T17914] usb 3-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 1398.018045][T17914] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1398.018099][T17914] usb 3-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1398.018121][T17914] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1398.021133][T17914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1398.021157][T17914] usb 3-1: Product: syz [ 1398.021173][T17914] usb 3-1: Manufacturer: syz [ 1398.021187][T17914] usb 3-1: SerialNumber: syz [ 1398.194405][T20239] FAULT_INJECTION: forcing a failure. [ 1398.194405][T20239] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1398.194439][T20239] CPU: 1 UID: 0 PID: 20239 Comm: syz.1.4142 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1398.194464][T20239] Tainted: [L]=SOFTLOCKUP [ 1398.194470][T20239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1398.194481][T20239] Call Trace: [ 1398.194489][T20239] [ 1398.194498][T20239] dump_stack_lvl+0xe8/0x150 [ 1398.194529][T20239] should_fail_ex+0x46b/0x600 [ 1398.194556][T20239] _copy_from_user+0x2d/0xb0 [ 1398.194583][T20239] bpf_test_init+0xd8/0x150 [ 1398.194608][T20239] bpf_prog_test_run_xdp+0x4cc/0x11d0 [ 1398.194644][T20239] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1398.194670][T20239] ? __fget_files+0x2a/0x420 [ 1398.194699][T20239] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1398.194721][T20239] bpf_prog_test_run+0x2cb/0x340 [ 1398.194748][T20239] __sys_bpf+0xa22/0xd90 [ 1398.194777][T20239] ? __pfx___sys_bpf+0x10/0x10 [ 1398.194800][T20239] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1398.194829][T20239] ? rt_mutex_slowunlock+0x219/0x460 [ 1398.194866][T20239] ? ksys_write+0x248/0x270 [ 1398.194893][T20239] ? __pfx_ksys_write+0x10/0x10 [ 1398.194919][T20239] __x64_sys_bpf+0xba/0xd0 [ 1398.194939][T20239] do_syscall_64+0x166/0x520 [ 1398.194959][T20239] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.194989][T20239] ? clear_bhb_loop+0x70/0xc0 [ 1398.195011][T20239] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.195029][T20239] RIP: 0033:0x7f55967be0d9 [ 1398.195047][T20239] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1398.195062][T20239] RSP: 002b:00007f5594a16028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1398.195081][T20239] RAX: ffffffffffffffda RBX: 00007f5596a45fa0 RCX: 00007f55967be0d9 [ 1398.195094][T20239] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1398.195106][T20239] RBP: 00007f5594a16090 R08: 0000000000000000 R09: 0000000000000000 [ 1398.195118][T20239] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1398.195129][T20239] R13: 00007f5596a46038 R14: 00007f5596a45fa0 R15: 00007ffe27141c68 [ 1398.195160][T20239] [ 1398.305778][T17914] ushc 3-1:1.0: probe with driver ushc failed with error -110 [ 1399.042831][T20250] ushc 3-1:1.0: probe with driver ushc failed with error -110 [ 1399.274367][T20273] FAULT_INJECTION: forcing a failure. [ 1399.274367][T20273] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1399.274402][T20273] CPU: 0 UID: 0 PID: 20273 Comm: syz.1.4149 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1399.274427][T20273] Tainted: [L]=SOFTLOCKUP [ 1399.274433][T20273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1399.274443][T20273] Call Trace: [ 1399.274451][T20273] [ 1399.274459][T20273] dump_stack_lvl+0xe8/0x150 [ 1399.274491][T20273] should_fail_ex+0x46b/0x600 [ 1399.274526][T20273] _copy_from_user+0x2d/0xb0 [ 1399.274550][T20273] ucma_write+0x166/0x2f0 [ 1399.274577][T20273] ? __pfx_ucma_write+0x10/0x10 [ 1399.274597][T20273] ? security_file_permission+0x75/0x260 [ 1399.274625][T20273] ? rw_verify_area+0x209/0x4d0 [ 1399.274653][T20273] vfs_writev+0x4c4/0x990 [ 1399.274674][T20273] ? __pfx_ucma_write+0x10/0x10 [ 1399.274698][T20273] ? __pfx_vfs_writev+0x10/0x10 [ 1399.274730][T20273] ? __fget_files+0x2a/0x420 [ 1399.274755][T20273] ? __fget_files+0x3a8/0x420 [ 1399.274775][T20273] ? __fget_files+0x2a/0x420 [ 1399.274805][T20273] do_writev+0x15a/0x2e0 [ 1399.274825][T20273] ? __pfx_do_writev+0x10/0x10 [ 1399.274853][T20273] do_syscall_64+0x166/0x520 [ 1399.274874][T20273] ? trace_irq_disable+0x3b/0x140 [ 1399.274892][T20273] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1399.274910][T20273] ? clear_bhb_loop+0x70/0xc0 [ 1399.274931][T20273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1399.274948][T20273] RIP: 0033:0x7f55967be0d9 [ 1399.274966][T20273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1399.274982][T20273] RSP: 002b:00007f5594a16028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1399.275001][T20273] RAX: ffffffffffffffda RBX: 00007f5596a45fa0 RCX: 00007f55967be0d9 [ 1399.275014][T20273] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000013 [ 1399.275027][T20273] RBP: 00007f5594a16090 R08: 0000000000000000 R09: 0000000000000000 [ 1399.275038][T20273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1399.275049][T20273] R13: 00007f5596a46038 R14: 00007f5596a45fa0 R15: 00007ffe27141c68 [ 1399.275078][T20273] [ 1399.476923][T12451] usb 3-1: USB disconnect, device number 113 [ 1400.093438][T20280] 9pnet_fd: Insufficient options for proto=fd [ 1400.110413][ T5595] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 1400.305631][ T5595] usb 2-1: Using ep0 maxpacket: 32 [ 1400.306527][ T5595] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1400.307608][ T5595] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1400.370914][ T5595] usb 2-1: config 0 descriptor?? [ 1400.393665][ T5595] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1400.974080][ T5595] gspca_vc032x: reg_r err -110 [ 1400.974215][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974229][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974239][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974249][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974258][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974267][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974277][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974286][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974295][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974304][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974314][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974323][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974333][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974342][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974351][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974360][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974369][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974379][ T5595] gspca_vc032x: I2c Bus Busy Wait 00 [ 1400.974387][ T5595] gspca_vc032x: Unknown sensor... [ 1400.974473][ T5595] vc032x 2-1:0.0: probe with driver vc032x failed with error -22 [ 1401.120105][T20299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1401.803754][T20306] FAULT_INJECTION: forcing a failure. [ 1401.803754][T20306] name failslab, interval 1, probability 0, space 0, times 0 [ 1401.803834][T20306] CPU: 0 UID: 0 PID: 20306 Comm: syz.2.4159 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1401.803861][T20306] Tainted: [L]=SOFTLOCKUP [ 1401.803869][T20306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1401.803881][T20306] Call Trace: [ 1401.803889][T20306] [ 1401.803897][T20306] dump_stack_lvl+0xe8/0x150 [ 1401.803929][T20306] should_fail_ex+0x46b/0x600 [ 1401.803955][T20306] should_failslab+0xa8/0x100 [ 1401.803979][T20306] __kvmalloc_node_noprof+0x17a/0x8a0 [ 1401.804000][T20306] ? lockdep_init_map_type+0x10d/0x2e0 [ 1401.804023][T20306] ? io_ring_ctx_alloc+0x1bd/0xba0 [ 1401.804041][T20306] ? io_ring_ctx_alloc+0x1bd/0xba0 [ 1401.804065][T20306] io_ring_ctx_alloc+0x1bd/0xba0 [ 1401.804084][T20306] ? io_prepare_config+0x8c8/0xc70 [ 1401.804113][T20306] io_uring_create+0x50/0x990 [ 1401.804136][T20306] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 1401.804160][T20306] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1401.804182][T20306] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1401.804234][T20306] do_syscall_64+0x166/0x520 [ 1401.804257][T20306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1401.804276][T20306] ? clear_bhb_loop+0x70/0xc0 [ 1401.804299][T20306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1401.804318][T20306] RIP: 0033:0x7f0a1324e0d9 [ 1401.804336][T20306] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1401.804352][T20306] RSP: 002b:00007f0a11463ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1401.804372][T20306] RAX: ffffffffffffffda RBX: 0000200000000a88 RCX: 00007f0a1324e0d9 [ 1401.804386][T20306] RDX: 0000200000000b08 RSI: 0000200000000a88 RDI: 00000000000003c9 [ 1401.804399][T20306] RBP: 0000200000000a80 R08: 0000000000000000 R09: 0000000000000101 [ 1401.804411][T20306] R10: 0000200000000b10 R11: 0000000000000206 R12: 0000200000000b08 [ 1401.804424][T20306] R13: 0000200000000b10 R14: 00007f0a11463fd8 R15: 0000000000000000 [ 1401.804454][T20306] [ 1402.969034][ T5895] usb 2-1: USB disconnect, device number 121 [ 1403.025719][ T5595] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 1403.176578][ T5595] usb 7-1: New USB device found, idVendor=abcd, idProduct=ef01, bcdDevice= 1.00 [ 1403.178124][ T5595] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1403.178177][ T5595] usb 7-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1403.178198][ T5595] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint[ 1403.178198][ T5595] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1403.225494][ T5895] ================================================================== [ 1403.225509][ T5895] BUG: KASAN: vmalloc-out-of-bounds in __list_add_valid_or_report+0x4e/0x130 [ 1403.225539][ T5895] Read of size 8 at addr ffffc90010621008 by task kworker/1:9/5895 [ 1403.225564][ T5895] [ 1403.225578][ T5895] CPU: 1 UID: 0 PID: 5895 Comm: kworker/1:9 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1403.225601][ T5895] Tainted: [L]=SOFTLOCKUP [ 1403.225609][ T5895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1403.225621][ T5895] Workqueue: usb_hub_wq hub_event [ 1403.225729][ T5895] Call Trace: [ 1403.225738][ T5895] [ 1403.225746][ T5895] dump_stack_lvl+0xe8/0x150 [ 1403.225772][ T5895] print_address_description+0x55/0x1e0 [ 1403.225797][ T5895] ? __list_add_valid_or_report+0x4e/0x130 [ 1403.225815][ T5895] print_report+0x58/0x70 [ 1403.225836][ T5895] kasan_report+0x117/0x150 [ 1403.225857][ T5895] ? __list_add_valid_or_report+0x4e/0x130 [ 1403.225879][ T5895] __list_add_valid_or_report+0x4e/0x130 [ 1403.225900][ T5895] kcov_remote_stop+0x46d/0x6a0 [ 1403.225920][ T5895] hub_event+0x4789/0x4cf0 [ 1403.225935][ T5895] ? __lock_acquire+0x683/0x2ce0 [ 1403.225951][ T5895] ? __lock_acquire+0x683/0x2ce0 [ 1403.225964][ T5895] ? register_lock_class+0x31/0x2e0 [ 1403.225990][ T5895] ? __pfx_hub_event+0x10/0x10 [ 1403.226002][ T5895] ? process_scheduled_works+0x97a/0x1630 [ 1403.226020][ T5895] ? rcu_is_watching+0x16/0xb0 [ 1403.226038][ T5895] ? process_scheduled_works+0x97a/0x1630 [ 1403.226054][ T5895] process_scheduled_works+0xc3d/0x1630 [ 1403.226079][ T5895] ? __pfx_process_scheduled_works+0x10/0x10 [ 1403.226095][ T5895] ? assign_work+0x3cf/0x5d0 [ 1403.226111][ T5895] worker_thread+0xa47/0xfb0 [ 1403.226131][ T5895] ? __kthread_parkme+0x71/0x1f0 [ 1403.226150][ T5895] kthread+0x38b/0x470 [ 1403.226168][ T5895] ? __pfx_worker_thread+0x10/0x10 [ 1403.226182][ T5895] ? __pfx_kthread+0x10/0x10 [ 1403.226199][ T5895] ret_from_fork+0x514/0xb70 [ 1403.226219][ T5895] ? __pfx_ret_from_fork+0x10/0x10 [ 1403.226236][ T5895] ? __switch_to+0xc89/0x1420 [ 1403.226252][ T5895] ? __pfx_kthread+0x10/0x10 [ 1403.226271][ T5895] ret_from_fork_asm+0x1a/0x30 [ 1403.226296][ T5895] [ 1403.226302][ T5895] [ 1403.226306][ T5895] The buggy address belongs to a vmalloc virtual mapping [ 1403.226320][ T5895] Memory state around the buggy address: [ 1403.226329][ T5895] ffffc90010620f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1403.226338][ T5895] ffffc90010620f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1403.226348][ T5895] >ffffc90010621000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1403.226356][ T5895] ^ [ 1403.226363][ T5895] ffffc90010621080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1403.226372][ T5895] ffffc90010621100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1403.226379][ T5895] ================================================================== [ 1403.226405][ T5895] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1403.226418][ T5895] CPU: 1 UID: 0 PID: 5895 Comm: kworker/1:9 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1403.226437][ T5895] Tainted: [L]=SOFTLOCKUP [ 1403.226442][ T5895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1403.226451][ T5895] Workqueue: usb_hub_wq hub_event [ 1403.226466][ T5895] Call Trace: [ 1403.226472][ T5895] [ 1403.226477][ T5895] vpanic+0x56d/0xa60 [ 1403.226497][ T5895] ? __pfx_vpanic+0x10/0x10 [ 1403.226518][ T5895] panic+0xc5/0xd0 [ 1403.226536][ T5895] ? __pfx_panic+0x10/0x10 [ 1403.226563][ T5895] ? __list_add_valid_or_report+0x4e/0x130 [ 1403.226578][ T5895] ? rcu_is_watching+0x16/0xb0 [ 1403.226597][ T5895] ? __list_add_valid_or_report+0x4e/0x130 [ 1403.226612][ T5895] check_panic_on_warn+0x89/0xb0 [ 1403.226632][ T5895] ? __list_add_valid_or_report+0x4e/0x130 [ 1403.226648][ T5895] end_report+0x73/0x170 [ 1403.226664][ T5895] ? __list_add_valid_or_report+0x4e/0x130 [ 1403.226681][ T5895] kasan_report+0x128/0x150 [ 1403.226698][ T5895] ? __list_add_valid_or_report+0x4e/0x130 [ 1403.226717][ T5895] __list_add_valid_or_report+0x4e/0x130 [ 1403.226735][ T5895] kcov_remote_stop+0x46d/0x6a0 [ 1403.226751][ T5895] hub_event+0x4789/0x4cf0 [ 1403.226763][ T5895] ? __lock_acquire+0x683/0x2ce0 [ 1403.226780][ T5895] ? __lock_acquire+0x683/0x2ce0 [ 1403.226795][ T5895] ? register_lock_class+0x31/0x2e0 [ 1403.226820][ T5895] ? __pfx_hub_event+0x10/0x10 [ 1403.226835][ T5895] ? process_scheduled_works+0x97a/0x1630 [ 1403.226854][ T5895] ? rcu_is_watching+0x16/0xb0 [ 1403.226873][ T5895] ? process_scheduled_works+0x97a/0x1630 [ 1403.226890][ T5895] process_scheduled_works+0xc3d/0x1630 [ 1403.226923][ T5895] ? __pfx_process_scheduled_works+0x10/0x10 [ 1403.226942][ T5895] ? assign_work+0x3cf/0x5d0 [ 1403.226963][ T5895] worker_thread+0xa47/0xfb0 [ 1403.226985][ T5895] ? __kthread_parkme+0x71/0x1f0 [ 1403.227004][ T5895] kthread+0x38b/0x470 [ 1403.227021][ T5895] ? __pfx_worker_thread+0x10/0x10 [ 1403.227035][ T5895] ? __pfx_kthread+0x10/0x10 [ 1403.227054][ T5895] ret_from_fork+0x514/0xb70 [ 1403.227073][ T5895] ? __pfx_ret_from_fork+0x10/0x10 [ 1403.227090][ T5895] ? __switch_to+0xc89/0x1420 [ 1403.227107][ T5895] ? __pfx_kthread+0x10/0x10 [ 1403.227124][ T5895] ret_from_fork_asm+0x1a/0x30 [ 1403.227148][ T5895] [ 1403.230411][ T5895] Kernel Offset: disabled