last executing test programs: 20m27.15398757s ago: executing program 4 (id=79): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003002000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000680)="fe55fc2733656cd94cd632f708d5edc9bbe8b3ec7b6726cb94dd7ef916602cfa318a03da4cd0bcbe7f74bdf1dc41427cb05cdcc0a6bf308e382b7641a7", 0x3d}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0xc0) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0x218, 0x238, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}, @common=@rt={{0x138}, {0x5, [0x1, 0x4], 0x1, 0x2, 0x2, [@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @broadcast}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @private2, @mcast1, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x44}, @local, @loopback, @remote, @mcast2, @remote], 0x6}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe482", 0x5f}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66627a", 0x55}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5fe5503da319f5261659f63d203e503fc3476bb556d4987fbf", 0xbc}, {&(0x7f0000000440)="126ce0a7ad2d3c4b1b140fc7402f00828a02ec6c4e59757eda3f13f9d8a4376fed93dd5b8c0ba901c5305f", 0x2b}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 20m26.898485774s ago: executing program 4 (id=83): r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) socket$kcm(0x10, 0x2, 0x10) socket$xdp(0x2c, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r1, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000540)={@broadcast, @random="6487a2bed3d6", @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x300, 0x0, 0x0, 0x6c, 0x0, @private}, {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}}}}}}}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usb3503/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='pcspkr', 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x708f6d38]}, 0x8, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./bus\x00', 0x800c4, 0x334e53aded47c559) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@version_9p2000}, {@access_client}, {@access_client}]}}) write$P9_RVERSION(r6, &(0x7f0000000440)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r5, @ANYBLOB="56d4f7a3e4a013bd58651a298534c2fcad760b1915a16a7edaf0659c32851b926596cd7f2530383bb79ed2361acad33d43747f4c8a9e9884b108e66d6b92"], 0x15) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x14, 0xe, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x4008894}, 0x0) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b0000000000060001"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) sendmsg$L2TP_CMD_TUNNEL_GET(r3, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, r7, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6=r3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004094}, 0xc050) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f00000001c0)={0x0, 0x7c, 0x22, 0x0, 0x80407}) 20m26.385270625s ago: executing program 4 (id=89): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{0x0}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0x218, 0x238, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}, @common=@rt={{0x138}, {0x5, [0x1, 0x4], 0x1, 0x2, 0x2, [@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @broadcast}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @private2, @mcast1, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x44}, @local, @loopback, @remote, @mcast2, @remote], 0x6}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32, @ANYBLOB], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 20m26.114391509s ago: executing program 4 (id=91): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f0000000ac0)='./file0/../file0\x00', 0x0, 0x44000, 0x0) 20m25.635685079s ago: executing program 4 (id=96): mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003002000851000000600000018000000", @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a"], &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x94) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000680)="fe55fc2733656cd94cd632f708d5edc9bbe8b3ec7b6726cb94dd7ef916602cfa318a03da4cd0bcbe7f74bdf1dc41427cb05cdcc0a6bf308e382b7641a7", 0x3d}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0xc0) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66627a", 0x55}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5fe5503da319f5261659f63d203e503fc3476bb556d4987fbfbf", 0xbd}, {&(0x7f0000000440)="126ce0a7ad2d3c4b1b140fc7402f00828a02ec6c4e59757eda3f13f9d8a4376fed93dd5b8c0ba901c5305f", 0x2b}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 20m23.923265658s ago: executing program 4 (id=112): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001800)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r6, {0x10}, {}, {0xa, 0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x0, 0x0, 0xc, 0x7ff, 0x1}, {0x4, 0x1, 0x0, 0xf, 0x0, 0x73}, 0xebd1, 0x5, 0x1480}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x48088}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) 20m23.666126646s ago: executing program 32 (id=112): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001800)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r6, {0x10}, {}, {0xa, 0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x0, 0x0, 0xc, 0x7ff, 0x1}, {0x4, 0x1, 0x0, 0xf, 0x0, 0x73}, 0xebd1, 0x5, 0x1480}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x48088}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) 8m1.91189158s ago: executing program 2 (id=6914): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000680)="fe55fc2733656cd94cd632f708d5edc9bbe8b3ec7b6726cb94dd7ef916602cfa318a03da4cd0bcbe7f74bdf1dc41427cb05cdcc0a6bf308e382b7641a7", 0x3d}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0xc0) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x10000, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0x218, 0x238, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}, @common=@rt={{0x138}, {0x5, [0x1, 0x4], 0x1, 0x2, 0x2, [@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @broadcast}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @private2, @mcast1, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x44}, @local, @loopback, @remote, @mcast2, @remote], 0x6}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe482", 0x5f}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5fe5503da319f5261659f63d203e503fc3476bb556d4987fbfbf", 0xbd}, {&(0x7f0000000440)="126ce0a7ad2d3c4b1b140fc7402f00828a02ec6c4e59757eda3f13f9d8a4376fed93dd5b8c0ba901c5305f", 0x2b}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 8m1.6902705s ago: executing program 2 (id=6917): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000680)="fe55fc2733656cd94cd632f708d5edc9bbe8b3ec7b6726cb94dd7ef916602cfa318a03da4cd0bcbe7f74bdf1dc41427cb05cdcc0a6bf308e382b7641a7", 0x3d}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0xc0) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x10000, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe482", 0x5f}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b2", 0x40}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5fe5503da319f5261659f63d203e503fc3476bb556d4987fbfbf", 0xbd}, {&(0x7f0000000440)="126ce0a7ad2d3c4b1b140fc7402f00828a02ec6c4e59757eda3f13f9d8a4376fed93dd5b8c0ba901c5305f", 0x2b}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYBLOB, @ANYRES32, @ANYRESHEX, @ANYRESHEX], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 8m1.516175553s ago: executing program 2 (id=6919): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000680)="fe55fc2733656cd94cd632f708d5edc9bbe8b3ec7b6726cb", 0x18}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0xc0) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0x218, 0x238, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}, @common=@rt={{0x138}, {0x5, [0x1, 0x4], 0x1, 0x2, 0x2, [@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @broadcast}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @private2, @mcast1, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x44}, @local, @loopback, @remote, @mcast2, @remote], 0x6}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe482", 0x5f}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66627a", 0x55}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5fe5503da319f5261659f63d203e503fc3476bb556d4987fbfbf", 0xbd}, {&(0x7f0000000440)="126ce0a7ad2d3c4b1b140fc7402f00828a02ec6c4e59757eda3f13f9d8a4376fed93dd5b8c0ba901c5305f", 0x2b}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 8m0.150302723s ago: executing program 2 (id=6922): creat(&(0x7f00000000c0)='./bus\x00', 0x107) mount(&(0x7f0000000240)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./bus/file0\x00', &(0x7f0000000200)='9p\x00', 0x44, &(0x7f0000000100)='trans=rdma,\xd6\xd2\x1e\x80\xc2W\xbe\xbf\x16.\x84j\xea1.\x8e\xe9\xc7.p*\xd9\x94Mk\xb9\xc6\x9e\xcf\xd7\x9eoc\xe2(\x03\xc3.{\x8aY\x17\xd0\xa3\xfe\xe3/\xc4\f\b2t\x1c4\x93/^\x91\xe8\xabK\x9e\x14j\xb3\x92\x13\x80\x96m\xc7\x96\"\xcb\xdc\xcc\xd8\x18\"\x9eT\x97Kh5i\x8f\xfc\xd8=\x8b\xe9\x1b\xce\xe4\xf5$\xf1sa,\x8f\xb6\x89\xd9Z\xa0\xae>Xs=\xadu\x9aQ\xe2z\xaf\x90\x90\x9b\x92\x9b\xeb\aQb#\xec}\xa79\xd7\xe6<6\xadL\xd8$\xd3\xa9\x1d\xd9W\x8a\xb9F\x982%g!\x8a\"@*\xb8\xc6\xddw\xefY\xefJ\x0e\xc5%S\xf09\xde\x95l\xd9\x1cPp\xb3\xfe+rY\xc24\x99\x88\xe7\njs\xb2\x8f') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000001000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000007000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000000000/0x14000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = io_uring_setup(0x4, &(0x7f0000000040)={0x0, 0x73e6, 0x1c402, 0x2, 0x1e1}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000900)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)}], 0x1}}], 0x1, 0x800) io_uring_enter(r0, 0x2cbe, 0x7f66, 0x13, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r1, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={0xffffffffffffffff, 0x3, 0x80, 0x1}) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) close(0x3) move_mount(r2, 0x0, 0xffffffffffffff9c, 0x0, 0x44) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x4000, 0x0) 7m59.62131272s ago: executing program 2 (id=6924): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000680)="fe55fc2733656cd94cd632f708d5edc9bbe8b3ec7b6726cb94dd7e", 0x1b}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0x218, 0x238, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}, @common=@rt={{0x138}, {0x5, [0x1, 0x4], 0x1, 0x2, 0x2, [@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @broadcast}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @private2, @mcast1, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x44}, @local, @loopback, @remote, @mcast2, @remote], 0x6}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe482", 0x5f}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5fe5503da319f5261659f63d203e503fc3476bb556", 0xb8}, {&(0x7f0000000440)="126ce0a7ad2d3c4b1b140fc7402f00828a02ec6c4e59757eda3f13f9d8a4376fed93dd5b8c0ba901c5305f", 0x2b}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYBLOB, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 7m57.44063619s ago: executing program 2 (id=6929): setresuid(0x0, 0xee00, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080)={0xa}, 0x1) sendto$inet6(r0, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$binfmt_aout(r1, 0x0, 0xff70) ioctl$TCXONC(r1, 0x540a, 0x0) ioctl$TCXONC(r1, 0x540a, 0x1) shutdown(r0, 0x1) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newsa={0x16c, 0x10, 0x713, 0x0, 0xa5dfdbfc, {{@in=@private=0xa010102, @in=@remote, 0xffff, 0x0, 0x4e21, 0x22, 0xa, 0x0, 0x0, 0x1d}, {@in6=@local, 0xfe, 0x32}, @in6=@empty, {0x0, 0x0, 0xfffffffffffffffd, 0x8, 0x1, 0xb, 0x7fffffff, 0x543}, {0x4, 0x8000000000000002, 0x0, 0x1}, {0x2}, 0x70bd2b, 0x3500, 0xa, 0x4, 0x0, 0x50}, [@encap={0x1c, 0x4, {0x2, 0x4e23, 0x4e20, @in6=@dev={0xfe, 0x80, '\x00', 0x2d}}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r2, 0x80489439, &(0x7f0000000040)) 7m56.834398688s ago: executing program 33 (id=6929): setresuid(0x0, 0xee00, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080)={0xa}, 0x1) sendto$inet6(r0, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$binfmt_aout(r1, 0x0, 0xff70) ioctl$TCXONC(r1, 0x540a, 0x0) ioctl$TCXONC(r1, 0x540a, 0x1) shutdown(r0, 0x1) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newsa={0x16c, 0x10, 0x713, 0x0, 0xa5dfdbfc, {{@in=@private=0xa010102, @in=@remote, 0xffff, 0x0, 0x4e21, 0x22, 0xa, 0x0, 0x0, 0x1d}, {@in6=@local, 0xfe, 0x32}, @in6=@empty, {0x0, 0x0, 0xfffffffffffffffd, 0x8, 0x1, 0xb, 0x7fffffff, 0x543}, {0x4, 0x8000000000000002, 0x0, 0x1}, {0x2}, 0x70bd2b, 0x3500, 0xa, 0x4, 0x0, 0x50}, [@encap={0x1c, 0x4, {0x2, 0x4e23, 0x4e20, @in6=@dev={0xfe, 0x80, '\x00', 0x2d}}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r2, 0x80489439, &(0x7f0000000040)) 55.531971537s ago: executing program 6 (id=9865): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003002000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000680)="fe55fc2733656cd94cd632f708d5edc9bbe8b3ec7b6726cb94dd7ef916602cfa318a03da4cd0bcbe7f74bdf1dc41427cb05cdcc0a6bf308e382b7641a7", 0x3d}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0xc0) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0x218, 0x238, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}, @common=@rt={{0x138}, {0x5, [0x1, 0x4], 0x1, 0x2, 0x2, [@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @broadcast}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @private2, @mcast1, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x44}, @local, @loopback, @remote, @mcast2, @remote], 0x6}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74", 0x54}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5fe5503da319f5261659f63d203e503fc3476bb556d4987fbf", 0xbc}, {&(0x7f0000000440)="126ce0a7ad2d3c4b1b140fc7402f00828a02ec6c4e59757eda3f13f9d8a4376fed93dd5b8c0ba901c5305f", 0x2b}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYBLOB, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {0x0}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 54.14267239s ago: executing program 6 (id=9873): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@ipv4_newrule={0x34, 0x20, 0x1, 0x70bd26, 0x25dfdbfb, {0x2, 0x10, 0x10, 0x0, 0x9, 0x0, 0x0, 0x6, 0x10006}, [@FRA_SRC={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x2a}}, @FRA_GENERIC_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7fffffff}, @FRA_DST={0x8, 0x1, @empty}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x4004804) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='L\x00\x00\x00!'], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) 53.920150032s ago: executing program 6 (id=9877): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000680)="fe55fc2733656cd94cd632f708d5edc9bbe8b3ec7b6726cb94dd7ef916602cfa318a03da4cd0bcbe7f74bdf1dc41427cb05cdcc0a6bf308e382b7641a7", 0x3d}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0xc0) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0x218, 0x238, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}, @common=@rt={{0x138}, {0x5, [0x1, 0x4], 0x1, 0x2, 0x2, [@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @broadcast}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @private2, @mcast1, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x44}, @local, @loopback, @remote, @mcast2, @remote], 0x6}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe482", 0x5f}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b2", 0x40}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5fe5503da319f5261659f63d203e503fc3476bb556d4987fbfbf", 0xbd}, {&(0x7f0000000440)="126ce0a7ad2d3c4b1b140fc7402f00828a02ec6c4e59757eda3f13f9d8a4376fed93dd5b8c0ba901c5", 0x29}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {0x0}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 53.696017266s ago: executing program 6 (id=9879): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0xd000943e, &(0x7f0000000380)={0x0, 0x0, "36d02c1ed9bbad4b369a1527406f94bad9f518aa9f37c3adab3354a09faddaf2fc0f13eecd86ad22a37a4fe3076fe3901e713e0920d894dd0016b8a6f98f7456231b5c91a18140b6530830ec5837be4f57ee265c0dea34578bada32cc0995b1b61f1d7372dd177d7faa3fb2b6b13aad1875c1a4f1c1bec24428c121bf333f560f577801c2402ea3d5207bbbf3cbcd6682ce4d544d077fd89319f7b863ba47e9a678a11bacd5d0e747f23c21eeafef0685f4f359b6f3f6996c5926dfa1d8703e2b84b72316a76c1739c347a66c68edcf02da50071667afe7c4f2bebac26f212649971b5fc69c65d5f0a0c3a5521f2cf33ae282d7e4e9679780d5cf83af249be8b", "04ac2016b1479958c421893c9d8fcbc863b0732f1b0120386b09f9c830a72ffc2050562fc9e3da49446882afefffa0ce97a0b0dc05512b4d6194b8a244bdbe8d02b1b0dedf5513a1ab835b7f8da9449d8673028ae05f296605a605317cd4af636e74253d735037807ee85e02953e99a4c2b8cc33c7ab9fd2ff7256699d17f7c1b478ec35dad78df001958131fa8c85ff7e123c4e86d079098ffeed553c288c2730e574d15e50d24e0f7686a771dd59326acb7cb7fb3f85a6988a00bbe69fe0bf79f031067e1c284f403f97ba2ba34acbd2ed3ab1f890a4f9adf5b0d3ee553705f27d675b2de5c41397127c44e2bcc85932c6db89f9e8e6083e355af6d5d46f12bff399e50b07640477e0e61db416ba960d9c1cf0d57f9e9813c30c73085446b209d6769c68569d708ee2bfc7938977126265509e7f3d3658c863ed7a60c583a370e85cee13d5dcd68225619eb393b4282544e86f39f0b024e27d83b4b55dd6637641214ec07a7550a7743bbf0b72ed5a02a638d3e8a7a4d71f2bc251fea45187714966eed742fb83d96e56e6880e5500e18d0cca35f19033e99109d75515e917a1ff53f2a18f006562c6bc3dac2a4ee8341b1acc5c0cf3ff0ea8d2a20963b590603b4254b29e3ab111ab34d24343b92fdb94dd56490a2f44427434f8afa32367efd5d77703004b643569cb1900d22b7bd66a7af08dcd614a4f3b9017ab6dcd832790d550091daa04f33c25c25524090a81ff5c30aa9d755f21ffe3c8d5ff88ec01835e908c09f9055fa1a0fca1ae55b81884d4f2ec94424a9781f42460053e737c28c3afa88c778b79bb32212888f302f10762d4fc6fce16c9cbe4ec132a3eb9d5455a99b6d24875456cba214380263913e9713d4fe0b2e15aa03d6c673a6e0dab58d501b6c3f0e840a2dbb1519e73e82821256b3f028f5d1792119aa4469c57b1916ceb2048923bb7451096819ab26f8ba4893352caf6050c68f839115b8dbc5d5a598d1c938c72e76daa67e0a20777482d6f0aff52713a236814d2e93a056ea7c8c9b72ed7fa30d9c3a62f8535a3a27a2c235e477d0adb6222be07418cfa5c614b3bd941601b70c1d6e302f405a0374ea348d18f8ec3428ff3f80c6236e382fbb306da4cd3ecb69eb9b90f6b20ca5bd93b3457203002a7fa10748f52d9b448357fe002d8b1a7d95c14c5d7e0285f713a57b2bd978f94b6c0d4b107f5989bb3f58bed6edc607446f7afe99802cec14b56f1353019556b5b3951dfc27689322f108a86da93ed5141c31a67d1f5df4dd173fbf6553fed1cb94b2d1c3c77d542e3d1841038411cd912837830c52e596fc19c9a01a5dcd16d74b93bf9c6f457fd29b1acf24aadc71b9d7a482703abffb68f62952d4235c06bac9da9bfa80c322a79c1af1b464dfbd54ba97a4f9ce03f3be6fcb392fea8be0be4c2e39bfc446e4d45a2cd1ec5ed48e36da21f606b328f752e777b1797e5345f2a189478ec66aa95017391f7fa70ca40d5eec4c63c501b66be17d80a50e57b172e2bd2b169b38f87b930b0b338576c943810c52975627d548bb2b0706dcf39fbf715ed2b7144aeab86020fa7bbda429487f3e696072cffa31db352bb970b51bf9645db78bf978bbac3ceb582c13a125acafdda4e8171cb424bb3e47d736ed537e8c2b73ec8d63452c9fa36aa9ee1b77995747e4e45c56ad733eb34580ca81033a2de676544ef6c134406f634b8782446b3e0735d3c461a91111322e9422b60a9753db8b48e3e1a0c61e83897e40526a8ab4e795b10477f1a529ae71a5a49dc58ecdeba14f4e37c97ed78689fb3473afac22ad27a1c96f7ddd8e92c00718fe34eefd59a5872c7c04cd288d009332b72a64698c2fb598f6e22de2ee29cf74ce105633d0396b077558a0d86e08f3827e0acf1f2d102369e563201e5540ffbb56148f75bcfcc6b015cd9b6d6ed8ab1ceeba9bdcdf9f02076e4e6fa2a4ae1374a9d84237bebf3f83d0f829ed0b92c076bf7085d4ffeebe3df61e694ff030ca3f23cb954da726aa05b251378cb93e6552416af94fc888e1ff135a58d21acf3422e766d3a69258643dd601dcdbfd8a2356c1c562a52c7006812b1b86a363b264d0de3808004c036d3c6794aa29b99fd7d2f7ca16c8fa589a96e8ceb7f5cde8dd6d121dff4d96bb5d2e58963ecd6aa205c7622efdb650e80434d523d3488790e7b84b5afb3fe24986e7493218f85db76ae39aa81c938fc9e04717d50af67b6123ef3961e44ef576b088bb9e7e38d4928e9f2222daede8da076efb23c86c119df38f632c56ed48dcd46a5ec9bd4cf0419fc4398cfea16bb3bfffb768b5131ed8570e62d16c25146e657ca0ce6598c224451028a7272e741284414a3cd9977da0a12838326333001679e73671b1745b23c64108775ca1a04e7cc1eb0b1c6293c01b68f200dc58227fad3cd9dbca79dc968ce84c2fd6120002db242807dd01f7a70ae872cb29b06ca8697f3cc74871fb8fd606068ae7d5b5342a89e08c5fd86180c6b5367656424cd6d5fddc056e6b6077c6f8d4bb7547227b07b3cbcbd4e212fb7c86ca9c5cd43cb5270b06197442abc3186a0cb6890275b61df8905a534b26e1da10fe220bf81ec8bdd1f7edf38e7ff9b18649c426dbd4a67b287a60b82caa7a471c64b0f0b69f28183f3879fb4ef60cc2773f0f5f0414fa9633e82c58500cf76a9e09288a4856e2e02bf474914213a21b1e28d73ae854d9f75c6ecea143b281a913208eeb0767ef19f999fb1547a071332f22f741904323806f5a569016b54aef1c6587ed09ae770e929f86687b4b3edcfa239dddbbf734770b8b397e7f27e01b26b09e6794d14f96ac1c51f4e8a4c82dba68f8a029af1ae66f9da60738a2b5cf09d1abd89f0c5f39dceb28091916d6e308203fc61ecb3ec5e95834e7792aa4aabe5fa85217af96b8ddc5a897c26c46423e5c3d418944333642168cbcd80510a3f6a204b6d505d2e2759d3a741cdafec4d1eb14faf640a96f9690afe3c1675d56c3a44901bd8731d4d3bea93e12ceb041a94b527741aea36cfd631bb272efddb50dc22a4f314dabd1df760124a61777eaf54615bc0a12373a0800ff6b1cb3479154800d26306f0552a2eadcf775d64120db460b7cc3e16f4e152d625736e593f0965b79e49a6d279ddf2907938068550f18a9542958bd5e66b5fb54997743a23d4fdb8fb2f21a5ca127c9e0c240937cf043cde7cceba75580e0e8f5e9629955e055ecdc2ba03018f21ce15f1a525c78f6c7712e4d78dd792124d7f79a9cd9324fd5090c87f89e686bafc522beb41fa78cf6de35ba621a7acae0e592ba9f69772ec50975fdae21bda273195efea867db26ba8189ea6c09305cd301fd02e59da1a3fb58315737dd26a74babff0b44393e462b8f298034388ef5a0af839b411e3b371c45a836a3f6c5ae6316e75e6e460847b1c44b2cb4e75b946239c94c4b97e188d927420dcad2c01921e5f47deb0664ddeb18a6d90ad6ea3ddd03a309a1f01d5d958c36b21bfbf9ae769f28b15d33a81b2fa5aa7df985036b860b8167a087c2e31841339c804bad8a5b3a9c96bd296eb05627067817dc01a91fe67b2474d24c8020c2a8ff24cac15f2adbfe3d89e3cc75134d2e6c7ed3b0884c738165dfad4b856c4f6e27fbefec0bb0ab4062d5dbb63c6362e6b87f2d1573e6d93391d6a42ade3d8535ca8ba1b126d732da8b6f57872187bda99f9cc9082d40292087a16e26e508565a18e6cb330d47fb1b0629cc80a9c42b2e502266a3100f80937835e8e3eca5d3d1313fcae16cbb49475607876079834997218ad73d17c4efc3bf538ef9fee9c67b103297d9d1319cbdd6273a5cc363ee12485e743266a9d1c9b5e5385d3872241a64604cbbbdfc8641c5c86231c6a8e8037850bf58f7018251ab912af8b5dd59e4ebcb9556e2d18720277f1872b8293dfd4daeb775a58b5aa5a949f4cab340634d36d72d2eb493fcede10ac5f317d62c4f6cd08408e68c8d2325132dd462d09d21b8d9a6618fb1541701ce24ac643eb078b6e55a56a2070534c7b688090607e325e8c2dbde4d4dd7ab843543a47e9c25421171e132920fdd2c4d14b537ed1e53e959dfb5bb251e9f3372e41a64ee5636a3d2f66fec57e53f85b7ef6c0c55b2c0b326fe9ad252d5223f5797ed65dabaeb9e335baa85d2525e03d6bf7ea62583093735433889a02113de7c273ea5b47063b0e72962f4ace33eafa373c8de482b95454a25851b8e12a8ed1dff138e78b79bb44e9cef325c5d801182d403994e1c412ea77f265dbc0de8e0cff1a962ba7a2876a9d32739c92caac36bbf60a14bdf7b3bb8107ed0979b7fd890afbec2a5cbf74c581db15afbc846f69fd1281388a40cee5b58da228f75a53e7068cb3904188b1b1b4ddd01e78b32bbb7998117c4a5625cf90292d4b1ec93abe1e115386f2d1e5b3db4d484fe23b8fc105671d3c541451466dc43305d6e0e1aa620e13a4b2a4cb0682d803e07989ff503102fafc13dc45eafb2d27b9d0335926b8395987fb8a9893254040ec92c18c415fbc2bba36ff0a629d50cc16d152cd9632e46a03dd32ca8d40e5b65c9c941ab7fea4e13be0ada7ca7b25c703c97fe34d96ff472a27359f567b0d8a52b0ea62112f6d2f0345c88dcf4198e5bed9594d6291a348d2c87a362a98eac4e229bd1a8344efba84c70f548b931ad086b65ea80ea961c240539f1c39a3c52e58a696525bdd8fce744d9e65bac94c97f47720a0cbef212eecc70a7754f0aa1d13411c750dfab6181165e0d66d6b0a4cfe37eab5a3ad00c4940f292b00bb07838500c924ce5d6bbc888c27a45325ad39928eb11aa06e64989a9f180a1f4fae529bcea91333dd3f5541ae85c058a0e8f1fff6bafa1c337cc93de81a68b43fa098482a237fd58e38c9b9062de825c0e32415c90c79cf969903147c8a212280b179ed13a3179fe286623be81cc767889c98084690cc49f8a4f2c79e4bead63079eb4656c2da614357c5a35732670e3f2832b8a5d3dfdb8f06cbdbb1feabc289e9f50be3b996b9597c05a0035cee8b5e2084c6f367a4dcf62f4a028b021ec621c2649eb9a158e04b374645faa7f3be92f47e0f833467324c157759ed09e34e89bc715dcd7939cd0c29b510b0d9f4ee475686ddf2cf29742791e1c0b3ed4a73a0dea6dfc9e3217199b715828bc3e5ad07a810fc3dfd522eca4a96194700ec262f3b5df516fd1a17b2ef9d23da6efdc0adf1d74af6219019c090d096c95f37743671076ab2227673b545f913940de9f8dd6cebb61264e19ee6e2bebb8aece1c3720832075159ce7e37b3d65728ced18fe7b4b64fcdf54e79adf62b15dfb4224a3f8c7c119146e1fe4cf2a105a4e435e6045833bb79b0e9939b9cdfc02defc68c4f8014c57931153e98"}) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0xd0009411, &(0x7f0000001380)={{r1, 0x2, 0x4, 0x2, 0x0, 0x10001, 0x8000, 0xfffffffb, 0xf, 0x2, 0x1000, 0x7fffffffffffffff, 0x0, 0xfb2, 0x29}}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xa, &(0x7f0000000200)=ANY=[@ANYBLOB="18060000000000800000000080000100851000020600000018490000fcffffff00000000000000003c08050000000000180000000000a8ce0000000000000000000095000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001100050000000001feffffff07000000", @ANYRES32=r3, @ANYBLOB="40200020001a80100004800c000900000000002f6874e8ac665651d0572ee87cca72c39c89dcfb04df390305a0c0ea92cfe36545ff474f74527d7f744b4effebeaccb6b7e74072c529393a9c4f5591"], 0x34}}, 0x800) pread64(r2, &(0x7f0000002380)=""/172, 0xac, 0x8001) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={@dev={0xfe, 0x80, '\x00', 0x23}, 0x8005c}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r4 = socket(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r6, @ANYBLOB="000000000000000010011a801000f4800400058008000900000000000800038030000180050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d80500060000000000130002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018000180140004004d2906d0880fc8acc30fe2020f9849675000018014000500a108417df341b9dc3d8008a2fe5bdaad140004009c7e472c916120fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af080001000000000008000100000000006000018005000600000000040500060000000000080001000000000005000600000000000c00020073797a746e6c30000800010000000000130002006272696467655f736c6176655f30000014000500e078d277f38ed3a40a448f3f6b6763e83c000c"], 0x270}}, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 52.473426581s ago: executing program 6 (id=9884): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300), 0xbd228beef318bda7, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 50.173052923s ago: executing program 6 (id=9903): socket$inet_icmp_raw(0x2, 0x3, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x800, 0x0, 0x3, 0x1, 0xd}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x801, 0x84) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000010280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x4008010) 49.067865044s ago: executing program 1 (id=9914): r0 = socket$kcm(0x29, 0x5, 0x0) write$cgroup_pressure(r0, &(0x7f0000000140)={'full'}, 0xfffffdef) sendmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x20000818) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0xe) setsockopt$sock_attach_bpf(r0, 0x1, 0x7, &(0x7f0000000340), 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x800000000000, 0x4}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0x0) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x44840) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x23, &(0x7f0000000040), &(0x7f0000000200)=0x38) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="020602000200000002"], 0x10}}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002380)=ANY=[@ANYBLOB="b702000006000000bfa300000000000007030000407effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca7ebfcd0cd00006ed3d09a6175037958e271b60dedf8937f02008b6d83923dd29c034055d47dafe6c8dc3d5d78c07f34e4d5b3185b310efd4989147a00000000f110026e6d2ef831ab7ea0c34f17e3adeef3bb622003b538dfd8e012e71f6420b90adddff61b5b0a341a2d7cbdb90000bdb2ca76050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132658555cf476619f28d9961b626c57c2691208171656d60a17e3c1c4b751ca532e6ea09c346df3d7cb4ebd31a08b32808b80200000000000000334d83239d1d2e9ff10ff2d27080e71113610e10c358e8327e7050b6c860dac12233f9a1fb9c2aec61ce63a38d316ef49b66d6e42fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a5f3d74ca891c4594e8a4399e01eadd3964663e88535c133f7130856f75643619f567d2e24f29e5dad9326edb697a6ea0182babc18cefd07e002cab5ebfcaad34732181feb215139f15eadddcb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f8cd3fccbdc3dec04b25dfc17975238345d4f71af35910b158e56657b7218baaa7cbf781c0a99bd50499ccff0f000000000000c7beba3da8223fe5308e4e2833baace04f4087c4f0da0d9a88f9dbb593ddeb3f0932a4d0175b889b8eccf707882042e716df9b57b290c661d4e85031086e97bcc5ca0e221a0e34323c129102b7b7a643e82e88a1940b3c02ed9c92d6f64b1282dc519b00159830d7617001154c46bd3ca96318c570f0721fc7aa2a580900000000000000b4f22cdf550ef091a78098534f0d973058594119d06d5ea9a8d085734000000000000000c12346e47ad97f4ead7cf754a52e4b2d0f22d428bd705414888700a30e2366c6a06b3367a389ca39059787790017b0689a1f3db9c24db65c1e00015c1d573dab18fd0600885f1ea8f2fd299fc3cdafda323e9c7080397bc49d70c060d57bc88fbe09baa058b040360ab9261503d2f363fb099408885afc2bf9a4f8c3506b669e889f5e4be1b8e0d634ebc1057b7e98186fc5141bd670dba6f43279f73db9dec75070cd9ab0fd969169ef6d2857b6bf955012cf7fe50d133da86e0477e42b98a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8e34fc7eac9e8af3904ea0f3698cd9492794b82649b50d726bff873339c4cad4ead1348474250eda2c8067ab730c1d85969b95a2a5687f2ed690000522a0b7426000000000000000000000000000000000000000093fc7a82b98f99d9dedf7ba17f5f0b6d15e552fbd21f7eecff10243a43af03eea84c4304a5d3f93c02000000000000000043e1ed82b9aa0ae92a499984a009000000937523f5292d12659906005cde64f903c3415c458a2b32c2318f0858f19c6def80e1481e8e1c0098fc3f38b7a57211adb15d824cfdcf229628c0de49860a44286fe0e257cfa4ce50f3d10763d442824414a73c06837fe08de62f8710ca977960b74d0000ce73da6022a8671d1a3575b4e18c28c73203bf134686dd65808452cb6b76fcb134252c78de9b240de7b4cd015a77f76bb6470c05fc980b3d8f3f964f432a4bf6cddd6222c2da006b6fdb9c8468ae1d986a893b9519444d16a6dfa92c04331a6698507048fab5ae402acd05fe621f22712dfd09004770b4278fa14547d8ce3c21188e5e4e2baacd98e8e451d6aaaf090000006ed1d9018000008dd952595d78e9583bf4ea5de36099e3cddcb24ebb6eddb9e87c9ece87a42c0000abdfc6ea55887dfa18d0aea1b6eca5a883702b0bf3aeebb225895db90e237157a34e9f447237ea5b391bddd1290f7ce987a0e36b8e71b1779bbe95ffa9c3e0f6ba66e4d48e75253e3d633811e4b3220616aafbe7a3a18375ae593eb58fd500426286472466823cb8e1800aaaa0d9463c0c4ea5541a55df6eeffec0b66482228816cdfccb98374c644eea45de7867a0efbad0ab2bc33b350440a90b791b2b33f74a112a3b91b40bed8db2df8633207f8387e04ca52ab0f3f7b058b13523b896800b992972d9609551c27a5916ea16069c5bf55b98d926d3c27e7945b2999600000000f857bc1332d200194f658b930780603134ae6b7f5092772bd5d880dbe21b790c475b14b7fe4fe002dffd651faa79bb0cee0cdac23c3218f2ddaa6f7ba04b696a30d313bed30ba8f35569a9b07ee7308da09c01a4b827aa17bc2213fc1572b0204dd456b11a454d1f3f14179974aae624ea59500f5e048b2780666de81a040663c57f49af25be909984aea1b81f33426f86b4b941c08dfe2bc8ec246ec1aae120c42405e428923f3a83d9ba5c373f5e8a54120b451e2806370f1ed60c9fd5d9af4d16cb0f413c324da52d4bd2e01d3ac2d578d72e2d63322dfc9245ce3e3a097fb82f4e3b61a57094616020f72f1c55ee3d325c7496a7c2f10cfea516ae436751227378f00ca0f1f6c1dcf879700dd90b96a330f92bff736c83ca53e7f02b734d1a9292896f5d7f244bfab4946c7042e88206f641eafcc5b4ba7a7880533cdeac995d1caf6936f356ecf07a0084e7adc2dc12417997b03087c7b3b44b06f6158a2a18ce0e56ffbeb22f40521dd9972583d413098aa80db98ef324a2bfb7961c07b47521973cf0bb6f5530f6216b447b35d6e06b72b22b29de42bb1bc8ce0a0e3500000000000000000000000000b92eb197e4149627920000008000000000801792756f90b37f0858efc387f559203f314a4b0ed750fa72e5948ac3fe5921c14ef578d413e7b2a9e2f87f7b44949fe14c00000000000047030c09f62d444b4981db81799776eeb444000000009705fa8b56779bc876ad4f8d8c8e50815c4c3b27487996c09121caf47f76158362c74904f89cbc588aae84567a83571ff72bb65c082b5a8dee145ff221159aed2768edc05a3167d84205d5af86553c21e1f023a51c0e179fccfbc201982e3ddcaa45613899d19082453b180ca0c525b8d3cfaf7d0bcddeb5d5c7166038f276a92941393ba5e51f77172822bd903d9f8b436656771774ed88daab0d0cfdd1bf4d30ab566e1a4cb3ad66d830e10f7c1de13218aea21e7def613204c2b7c1ad48b01c208f4032e93408000000000000e96db049b92fc32ee34fe7a3419c8fbf03d61c159dc5864e030000a2c55b614d622b8de966c97e1940026f96db3c78ca18c9f08d1c47edf1a4d7298109f31b6078711ee72eacab84213bf50000000000000000000000000000001217887d0452aa6d26e4614d511710abeec84b78c027c160ba375dfa55a49b832ce4dfb91122193d514ed992c07f8cd6d897b314907e15642da228dbc03429e6e0e7ac118ed351c3b0c44bf5d8b58be573f8333aa8cc2ec5b5e305b3dee2562d415b4b9ed530797f55f9fe8510423409629a09000000000000009a35d9ca93e4b4591679547b8de8af1782451f7b8e1de508f1e9e525210d62bc850f8035040ad9e562be58797515b737bfb21d35ac560f99dbd18dad5e6345a464955e8141d75b6177e4fa176a020b0000000000006e76f0294fee7d19a0f327f8796d77b6e24b8df4bb438b527d10e657d49b844198ea9f93c4fd6fd2daa9bd87fd1e02ecc8075dca1280c201043257e9bd3c9a7aa150eb1711632b76d4dc0555d4bfcfd057980136d6e9000003b24fa300ef90bfe4ad364256937796f941c2faad94785f48777941f0cd3dba54ab6a5d5e91e90ac9ae994c3d4108b2fe7eca9413ac9bc138c74800487eb19c48db3f79be964808f109b5e36fc7fdd41def361427b6b9c118e5c9a0a1d5ca24886e33a7f81b2188ec75a5fc9302e3695bdcc9ab11201ef940569c995c21eeaefe2e8fc02e0433dc7371d1f72124ba263e554c30fdd7cd8c2da1e8706417da9ad8916551a1182fac08603dfc2f2279ba161c13984cd753b54a85e6f3010975e9ff51318b09fa13e2d38ce013aab41524c298c3719e31bcb1f102eaeee69a19e006bcdb1acc2664efa949a1a07bb3d7848d5e1381fbe63c522053a3bb32eb6345e10f7a12bf84e0e196a00833f464dd2f6547f14ebf137fce33efeb813211f31ff24d7dbb00f2574ccda59b3ea068fc2a18c37ee579f5a9ecc47da73684bcadd209ae5bbb7147df74d027d8d0adcdb54182c9de8053fc8b1b9d19c16c53d34db6e26f6a88d449f6abf3010100007e206a758a3f02816b4e097cfa3d46e45e7949c5b10691d49b9693a798a330a1ccb32d49772e80862df36dc0156b3f72cd85083f8e96ca1697457ec722766bd46ee2424975a38149bd57e5c0eb4087fc243e7e51b0aca9f0ab0668d7f2ee9ad9f267d8804417aa7e36a64d489bb84a1483fd3c3ecb024060002858cbb1f7708f5b41fca2fee7c03b1f862ce88dc313d913e041dd7583a1ac41c466757c5dd07ea2c5d62a000000000000000019a4e9a9c2cbc906f97fd6eb71b18d09a5df123ebbdb2827b43aed6a29e9942e402c1ae52e9cb98f3019d364fc21ea12023db91ced3c2f06550cef8a79ed39091e4776001187d0ab2f82478431d36470cc008d745ce8fd64c9aa64da230bb080945a557081b767beb75b1ea856a55c71b8fda672289aa6088630d48ac8039f19fec3acbcc5944a4e6fd44af8f10110db730a8d0d41b4ea36f9510f843a471963bd4621b9e43f08d341bb69df430ac6398c1b28bdd33b69b4b86d7c5f30cf728294e8ea1861ce50c367498945285f73c94d91210652eb4f3077cab6be2a3512eddbcb63d091d69fb1b26c8ada9a9f9355aea34fe55fd0d3011cb83ac03268dc66dd108a4e9944241e1d4ba69212ee0e7526e72c19346d08d3c3c82cb987f1bd2fd9ce2c88082ea23abbf23c6bd43fc9f9f8ea7656e25d3d73cd056b1f782de1fe349fc33546558366ed99940c0fda039272d277a3576d4e0469779d711e10b6bf040f7274fd9577c1c33326d2e60ee611ae226ef00e2944fb727832dc8dad36a6072aacfc4bcefb808ab7b3b95e0f60616320b2a9e1f8fac812daac9983639b35184803b7d192ce1f226e97fa23c37df95d067a54a8b412644cad9ecc251fbe418a81aaf00cc8d15758ff0eb885a40630396ba76b8fadc09e62ef70c8a0121e7e8322cb8bc0f50ad33a17143a29c14ecadd1b6244e31b888d8f3fa03208d3e9a4826a98f31995509015ebdc89f2f3106e54d5898d3758b9bfc9e4924e9cedf7f8fd584e7185703cc5f23741ffb480b5a87cd7efcceb409d354bdab211ebd50ab12b13c1b8ce93093a59a0f952153c2efd10e72ec9ee5fa2a00f9637851ddb81d059f9a363c4ada68dd25f19ee9e4841acee7c1b35ad6f9d54cf4939ce78a55a04e655d7746a3989c6f33b02f8497aacb6bfca7456111900000000000000000048d35af24acb66fdd4d1fb150138f0ee6abfc7049c94346868ed76d3a5df7335184386a5c532d425f1a098ff93efd05e5dd8b765121fbdfe5ef44f6472b939c31883f45889142e82086c2448da60d7a40774d71c2da2e7f6d4fe5d36923213cc7b7d71a1c90006e8f8d84953f284b0eb4366beff5df5595827dcd736e8cfab28cfa416e83c06213ca7fd21af56e3de1d80e77060447e20a8b317a4c06e24e99239824d08abf670a685bc46c8168bee4cfc30cc6d0dc030a592925bad3e0f805f0d4b2b600dc3f0c4c6f75bb4e49982f4198ac90ab77c5572c956d415858bad5ee117b3e5f1507bbd0d7a30388865deb11106a93225a81feb08f5"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 47.179079118s ago: executing program 1 (id=9931): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f0000000140)='securityfs\x00', 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, 0x0, 0x0) recvmsg(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)=[{0x0}], 0x1}, 0x40000021) setsockopt$sock_int(r0, 0x1, 0x12, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0) write(r1, &(0x7f0000000100)="3c5c0f2397b4d84500b5f812365f00000000000000", 0xff40) 46.084438009s ago: executing program 1 (id=9934): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000280)={0x9}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket(0x2a, 0x2, 0x0) ioctl$SIOCSIFMTU(r4, 0x8931, &(0x7f0000000080)={'dummy0\x00'}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001c00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x24, 0x20040011}}], 0x1, 0x80) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000000)=0xff, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x15, &(0x7f0000000000)=@framed={{}, [@printk={@i, {0x3, 0x3, 0x3, 0xa, 0x1, 0xfe00}}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @printk={@x}]}, &(0x7f0000000100)='GPL\x00', 0x3}, 0x90) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10}) 36.815376299s ago: executing program 1 (id=9973): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {0xffe0, 0xb}, {0x7, 0xfff1}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x9}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x54815}, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000006c055080a115014cb62010203010902"], 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 35.088366517s ago: executing program 34 (id=9903): socket$inet_icmp_raw(0x2, 0x3, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x800, 0x0, 0x3, 0x1, 0xd}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x801, 0x84) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000010280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x4008010) 34.060295509s ago: executing program 0 (id=9994): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0xa800) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc00c64b5, &(0x7f00000004c0)={0x0}) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), r0) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x14, r2, 0x1, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x20000c1}, 0x4) 33.95253207s ago: executing program 0 (id=9995): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000800) dup(0xffffffffffffffff) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0xffffffffffffffa9, 0x0, 0x1, 0x70bd26, 0x25dfdbfb, {{}, {0x0, 0x410c}}}, 0x1c}, 0x1, 0x0, 0x0, 0x400c015}, 0x8000) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0105b08, &(0x7f0000000040)) 33.039957906s ago: executing program 1 (id=10005): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000300)={"7591273db7f9b25f105102d88c110b5a4a3ef6cb30e9df379ca600fee7429cd446f75fcab66c011295e024c81ecd0ce96d616dc461476ee77aeba5a0eb231ccca6dbc5a95a209956794cf6e04d5222b287320239d8160839d54a14530cd0216cf4ee6612c5454b8e578f6e11e0cd422842577d27683d4dfc8d6b07fb1220b0f9beb2d05724bba04a5d387c612b1ff798d84cd93701a30933fb7547126cc5bfb6c36fa21bcf6153b89cbc399e2ccfc085ce3f6abf678511584195f45a2a23506dd044e3f9ad51c1558c664a462ea3c7f3439117a7b6a579f04b4fe7a66b98191e0446f7363bb3476b502e6816aac03015d1bbe024575e510f7e3ee6c6e7dfff125182472402198548763f74f049945aea74a2c73f9dccce0bc3a17592883738bd41fdb831423e2779576eb2db93485e6499e84a2a88479bf7bed2dce066ba220e4b9a84dfcaa609fdf9f182beaf7d64f152f3ff7b48b3d35b64e5aa789af425e771e98e05d5164cd26a190fe05f6b9c1351e491738ef6475b713b55aeaedf3e692857a25506bb3757adc192d76fac58e95455843c88c89428219fecc44ccc62165b1238953554eaa0e0dc9ca7ad044243df81ba55989363cdbf8878091761923a46072ea851bc951bfee1c4507b9e2c841b27486f7c408d75ad7361e0103ff9f446309b5ed1b6ea8d26ea76ae6bffa730560d0c1afbe1d234d84cbc4b936078adef0875373d7a8d7ca374d0d04dc87c4fb0436d19d8a865d9e95267e92b0d4002074ff4bcfbea9f6d704b9d0f58fde50d59aa59b2500ff1158ee533b52534e3b49032c2d4615b518e3bf95951728ef7da07fdfa9530cd7f960e044cccfca64895db312a9b2152b2ba9e00baf16ff9bedc5373fc23e5fade6ba077037d42cc30fd5ac0cb0b5f3396327e8d08fc8a73899989c1ad1ba2fc9c84a9cf741a0af1e63000e99823f971d19d61f7e90117589d84834f009fa8fa9a352e386b0bb98ed1846b22d8387d00d1b0ca4cf380052982423405b9ff00767735655b1940b1a6be241cf37422a77de496a8a9e9a9f27c04b9ab0aa03e7aa1173d45c3a6af4d97cf68b5244d77d9629bf93b15bba5cd0c0ce3c3c27b44bc4ed2cf1298cefaf49d364d93943d1a6b9afdf13f3399958df20083931ef7aa6274daeabc58f108a7721be95350e09565987a4244f7fcdd76554ab57070561a33b36bd0cc22bf403171a0485c4f21fcaeb616f5d683f595615790bc38a271c768ef5d755c13934229a7b7ffda0ba53e610d7436d9525296c5a031c9e5a5eb5453fb2b54055b6e6eb6ad81d4340ea178c2acfa95752b8d24976fe238230064e1d6cccc36830c6f84f53c400e6e1155d6b6f4cd044f3e19ca7755a12369fd95672ec45c42eb1ffba25f4392aa9ad75bc0bb37cd24f7f8330800"}) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000100)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200000}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000800)={0x2, 0x0, [{0x1b, 0x0, 0xfee00d00}, {0x832, 0x0, 0x7}]}) 32.272391883s ago: executing program 1 (id=10015): fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$cgroup_devices(r0, &(0x7f00000000c0)=ANY=[@ANYRES32=r3, @ANYRESHEX], 0xffdd) 31.927494802s ago: executing program 0 (id=10020): r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, 0x0, &(0x7f0000000080)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="23000000081b000002000000ffff000005"], 0x48) getrandom(&(0x7f0000000580)=""/265, 0xffffff3f, 0x3) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000a80)={0x0, 0x0, &(0x7f00000003c0), &(0x7f00000009c0), 0x5b0, r2}, 0x38) syz_usb_connect(0x0, 0x24, 0x0, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x110, r0, 0x7077b000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="4400000010004b0401800000000000007a000000", @ANYRES32=0x0, @ANYBLOB="4800000000000000240012"], 0x44}}, 0x4) 30.401739855s ago: executing program 0 (id=10032): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000027c0)='attr/keycreate\x00') exit(0xffff) read$ptp(r0, 0x0, 0x0) 29.347764775s ago: executing program 0 (id=10043): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@local}) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(0xffffffffffffffff, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 29.179530277s ago: executing program 0 (id=10045): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f00000001c0)=0xffffffc3, 0x389) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006fcffff00000000000003000000000000000000000000000c0008"], 0xd8}, 0x1, 0x0, 0x0, 0x40044}, 0x20008004) bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=@bloom_filter={0x1e, 0x8, 0x9, 0x2, 0x2, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x2, 0xd}, 0x50) sendmsg$NFT_MSG_GETCHAIN(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80a0}, 0x4000) memfd_secret(0x0) r1 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000070904000001020d0000052406000105240000000d240f0100000000000000000006241a00000809058103000200fe000904010001020d00000904010102020d00000905820200020942f90905030210"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) r2 = syz_usb_connect$hid(0x7, 0x3f, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x56a, 0x32, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x90, 0x0, "", [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x3, 0x1, 0x3, 0x0, {0x9, 0x21, 0x0, 0x7, 0x1, {0x22, 0xd5f}}, {{{0x9, 0x5, 0x81, 0x3, 0x79f, 0xa1, 0x7, 0x80}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x8, 0x83, 0x6}}]}}}]}}]}}, &(0x7f0000000280)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x250, 0x2, 0x8, 0x7, 0xcf, 0xff}, 0x0, 0x0, 0x2, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x438}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0xfcff}}]}) syz_usb_control_io$hid(r2, &(0x7f0000000440)={0x14, &(0x7f00000002c0)={0x20, 0x5, 0x4c, {0x4c, 0x23, "aafb9850df283668d251c6775e2f9c24f9d16fe831cf2c29586b18a370f58db561789a1d63aeaee4bd319bd9524b4651a882dae40014188ae73ba38d5bb6062305800bc24adc4e5c8cd5"}}, &(0x7f0000000340)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41e}}, &(0x7f00000013c0)={0x0, 0x22, 0x12, {[@local=@item_012={0x2, 0x2, 0x0, "d5b1"}, @local=@item_4={0x3, 0x2, 0x8, "d3802a5e"}, @main=@item_4={0x3, 0x0, 0x9, "e193d688"}, @main=@item_4={0x3, 0x0, 0x8, "0be06073"}]}}, &(0x7f00000003c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x8, 0x1, 0x1, {0x22, 0x256}}}}, &(0x7f0000000780)={0x18, &(0x7f0000000480)=ANY=[@ANYBLOB="401523000000d9450fd2f5a318dcb4d98b5a31c63376438c696e4139e2c5465220898daf5b2221"], &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x97}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x11}, &(0x7f0000000600)={0x20, 0x1, 0x7e, "452af242f6efb241b1ee94bf0a6faeaadb866ba000977624320163423619f0b1969ea48e95ac3d9a595251b8bd51c1d11616969b8f61e4dc9f69c5bb00b28e385a1bfc49201500de4d63e312c99530b910f4c7a846c18bae4c9e6a8c59c1b07d2554fb26b2485b4148f67b539d8bf51374c32cb31577457a0629e2974364"}, &(0x7f0000000740)={0x20, 0x3, 0x1, 0x1a}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x480001, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000c40)='attr/fscreate\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x22, 0x3, 0x50000}]}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000d00), 0xffffffffffffffff) syz_clone3(&(0x7f0000000080)={0x1810000, 0x0, 0x0, 0x0, {0x20080027}, 0x0, 0x0, 0x0, 0x0}, 0x58) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socket(0x400000000010, 0x3, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2020) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000540)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x80, 0x1c, {0xb30, 0x539, 0xf, 0x7, 0xf, 0x40, 0x2, 0xfff, 0x7fff, 0x4, 0x5, 0x8}}, 0x0, 0x0, 0x0, 0x0}) 23.467168678s ago: executing program 5 (id=10076): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300), 0xbd228beef318bda7, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r3, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x4e}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0x6, r2, &(0x7f00000001c0)='m', 0x1, 0x1}]) ioctl$PTP_SYS_OFFSET(r1, 0x43403d05, &(0x7f0000000340)={0x19}) socket$nl_netfilter(0x10, 0x3, 0xc) 22.401426329s ago: executing program 5 (id=10089): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3) sendmsg$tipc(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x2, 0x3, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x48001}, 0x20044095) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x60048040}, 0xc040445) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_256={{0x303, 0x36}, "00000007e4008000", "8b3de2aabceef22f419e59f30000000004000000000200", "e73400", "000000d900"}, 0x38) 22.056081965s ago: executing program 5 (id=10093): r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000010"], 0xfe44, 0x0) 21.845346142s ago: executing program 5 (id=10095): sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, 0x0, 0xc114) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000280)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="20000000020701020000000000000000070000090c0007ffff00014000010000"], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0xc4) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r4 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) openat$hwrng(0xffffff9c, &(0x7f00000005c0), 0xa80, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYRESDEC=r4], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) kexec_load(0x2, 0x0, 0x0, 0x80000) socket$kcm(0x11, 0x200000000000002, 0x300) socket$nl_rdma(0x10, 0x3, 0x14) bpf$PROG_LOAD(0x5, 0x0, 0x0) mount(&(0x7f0000000040)=@sr0, &(0x7f0000000100)='.\x00', &(0x7f0000000000)='iso9660\x00', 0x1008081, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) socket(0x18, 0x4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f0000000200)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000006100f000000000006926000000000000bf67000000000000560602000f0200006706000020000000620a00fe0ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffcd35010000000000ce040000000000001c000000000000009500000000000000db13d5d8b741f2cdaabc8383c8f56bb5df3083d20f8c2bf304000000815dcf0066d7ded3c5c49a08a503ea6d54f7f3125a8200578ac0836d6454745e70a27444003c5b20451b624db6f5320e9befc1e00b8b32917c4d30d16b7edb732bc3ac330b16c442aff70d27659bc58e296b16750c5577c848754b4894b07f15bab1c640a5c0c4fd62f9db829b301ef67fd2b2736f3af0c54af2412313b17c4c8081c4ed0572261960e227d34cfbfdb247bc2351c9d8363a8cb18b7330604da78b0aba47545f9a25a80dd7d28a5ae41824f611dd2de6dd581c52698f9542a444a8a3969946faded5275c00"/420], &(0x7f0000000100)='GPL\x00'}, 0x48) 18.452141487s ago: executing program 5 (id=10128): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000020c0)={0x44, 0x0, 0x1, 0x300, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_LEVEL={0x24, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8}]}]}, 0x44}}, 0x0) 18.401026022s ago: executing program 5 (id=10130): r0 = syz_open_dev$sndctrl(&(0x7f0000000580), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0xffb) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) socket$packet(0x11, 0x3, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4038587a, &(0x7f00000002c0)={{0xffffffffffffffff, &(0x7f0000000040)=',}#})$\x00', 0x440400, &(0x7f00000000c0)={@align=0x80000000, {0xd7, 0x8, 0x8, 0x8000000000000001}}, 0x2, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x9}, {[0xffffffff, 0x5, 0x6, 0x5]}, 0x800000, 0xd0, &(0x7f0000000180)=""/208}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x5, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000fffbffff0000000000000000850800005200000085000000500000009500000000000000"], &(0x7f0000000680)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="1d1b00ba8d13cdea2aac8a25ec05", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000440)={r2, 0xfffffc00, 0x1, r2}) sendmsg$nl_route_sched(r3, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000cc0)=@newtaction={0x48, 0x30, 0x12f, 0x0, 0x0, {}, [{0x34, 0x1, [@m_police={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x2}}}}]}]}, 0x48}}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000340)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x8044) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a", 0x23}], 0x1}, 0x8000) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000000000000600170008000300", @ANYRES32=r8, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000fbdbdf252e00000008000300", @ANYRES32=r8, @ANYBLOB="0ab7137a640778e55681799640258900340002020202020200000a004f005050505050500000"], 0x34}, 0x1, 0x0, 0x0, 0x4044044}, 0x4000000) pselect6(0x40, &(0x7f0000000080)={0x9, 0x7, 0xffff, 0x0, 0x6200000000000000, 0x4, 0x8, 0x7ff}, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000080)={{0x1088, 0x4, 0x5, 0x80, 'syz0\x00', 0x200000}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) 16.965818851s ago: executing program 35 (id=10015): fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$cgroup_devices(r0, &(0x7f00000000c0)=ANY=[@ANYRES32=r3, @ANYRESHEX], 0xffdd) 14.088380503s ago: executing program 36 (id=10045): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f00000001c0)=0xffffffc3, 0x389) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006fcffff00000000000003000000000000000000000000000c0008"], 0xd8}, 0x1, 0x0, 0x0, 0x40044}, 0x20008004) bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=@bloom_filter={0x1e, 0x8, 0x9, 0x2, 0x2, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x2, 0xd}, 0x50) sendmsg$NFT_MSG_GETCHAIN(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80a0}, 0x4000) memfd_secret(0x0) r1 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000070904000001020d0000052406000105240000000d240f0100000000000000000006241a00000809058103000200fe000904010001020d00000904010102020d00000905820200020942f90905030210"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) r2 = syz_usb_connect$hid(0x7, 0x3f, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x56a, 0x32, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x90, 0x0, "", [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x3, 0x1, 0x3, 0x0, {0x9, 0x21, 0x0, 0x7, 0x1, {0x22, 0xd5f}}, {{{0x9, 0x5, 0x81, 0x3, 0x79f, 0xa1, 0x7, 0x80}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x8, 0x83, 0x6}}]}}}]}}]}}, &(0x7f0000000280)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x250, 0x2, 0x8, 0x7, 0xcf, 0xff}, 0x0, 0x0, 0x2, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x438}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0xfcff}}]}) syz_usb_control_io$hid(r2, &(0x7f0000000440)={0x14, &(0x7f00000002c0)={0x20, 0x5, 0x4c, {0x4c, 0x23, "aafb9850df283668d251c6775e2f9c24f9d16fe831cf2c29586b18a370f58db561789a1d63aeaee4bd319bd9524b4651a882dae40014188ae73ba38d5bb6062305800bc24adc4e5c8cd5"}}, &(0x7f0000000340)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41e}}, &(0x7f00000013c0)={0x0, 0x22, 0x12, {[@local=@item_012={0x2, 0x2, 0x0, "d5b1"}, @local=@item_4={0x3, 0x2, 0x8, "d3802a5e"}, @main=@item_4={0x3, 0x0, 0x9, "e193d688"}, @main=@item_4={0x3, 0x0, 0x8, "0be06073"}]}}, &(0x7f00000003c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x8, 0x1, 0x1, {0x22, 0x256}}}}, &(0x7f0000000780)={0x18, &(0x7f0000000480)=ANY=[@ANYBLOB="401523000000d9450fd2f5a318dcb4d98b5a31c63376438c696e4139e2c5465220898daf5b2221"], &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x97}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x11}, &(0x7f0000000600)={0x20, 0x1, 0x7e, "452af242f6efb241b1ee94bf0a6faeaadb866ba000977624320163423619f0b1969ea48e95ac3d9a595251b8bd51c1d11616969b8f61e4dc9f69c5bb00b28e385a1bfc49201500de4d63e312c99530b910f4c7a846c18bae4c9e6a8c59c1b07d2554fb26b2485b4148f67b539d8bf51374c32cb31577457a0629e2974364"}, &(0x7f0000000740)={0x20, 0x3, 0x1, 0x1a}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x480001, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000c40)='attr/fscreate\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x22, 0x3, 0x50000}]}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000d00), 0xffffffffffffffff) syz_clone3(&(0x7f0000000080)={0x1810000, 0x0, 0x0, 0x0, {0x20080027}, 0x0, 0x0, 0x0, 0x0}, 0x58) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socket(0x400000000010, 0x3, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2020) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000540)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x80, 0x1c, {0xb30, 0x539, 0xf, 0x7, 0xf, 0x40, 0x2, 0xfff, 0x7fff, 0x4, 0x5, 0x8}}, 0x0, 0x0, 0x0, 0x0}) 3.325572253s ago: executing program 37 (id=10130): r0 = syz_open_dev$sndctrl(&(0x7f0000000580), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0xffb) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) socket$packet(0x11, 0x3, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4038587a, &(0x7f00000002c0)={{0xffffffffffffffff, &(0x7f0000000040)=',}#})$\x00', 0x440400, &(0x7f00000000c0)={@align=0x80000000, {0xd7, 0x8, 0x8, 0x8000000000000001}}, 0x2, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x9}, {[0xffffffff, 0x5, 0x6, 0x5]}, 0x800000, 0xd0, &(0x7f0000000180)=""/208}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x5, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000fffbffff0000000000000000850800005200000085000000500000009500000000000000"], &(0x7f0000000680)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="1d1b00ba8d13cdea2aac8a25ec05", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000440)={r2, 0xfffffc00, 0x1, r2}) sendmsg$nl_route_sched(r3, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000cc0)=@newtaction={0x48, 0x30, 0x12f, 0x0, 0x0, {}, [{0x34, 0x1, [@m_police={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x2}}}}]}]}, 0x48}}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000340)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x8044) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a", 0x23}], 0x1}, 0x8000) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000000000000600170008000300", @ANYRES32=r8, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000fbdbdf252e00000008000300", @ANYRES32=r8, @ANYBLOB="0ab7137a640778e55681799640258900340002020202020200000a004f005050505050500000"], 0x34}, 0x1, 0x0, 0x0, 0x4044044}, 0x4000000) pselect6(0x40, &(0x7f0000000080)={0x9, 0x7, 0xffff, 0x0, 0x6200000000000000, 0x4, 0x8, 0x7ff}, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000080)={{0x1088, 0x4, 0x5, 0x80, 'syz0\x00', 0x200000}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) 609.177937ms ago: executing program 3 (id=10388): bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840), 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x0, r1}) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$int_in(r2, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f00000001c0)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) 452.227752ms ago: executing program 3 (id=10389): syz_io_uring_setup(0x141c, &(0x7f00000001c0)={0x0, 0x91c1, 0x3400, 0x1, 0x8}, &(0x7f0000000440)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)) syz_io_uring_modify_offsets$generic(r0, r1, 0x3c, 0x7) r2 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000180)=@ethtool_coalesce={0xe, 0x19bf, 0x0, 0x8, 0x4, 0x5, 0x6, 0x3, 0x2, 0x9, 0x8, 0x93cb, 0x3, 0x2, 0x3, 0x401, 0x4, 0x3ff, 0x10, 0x3, 0x0, 0x8000, 0xff}}) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x1, 0x7}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x4008855}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a44000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000018000480140003007465616d5f736c6176655f3100000000140000001100010000000000000000000000000adfaea10b380378390b1ae551466c3c36c9fe10d792f4f810b026d5993fd3ee4a600b97e6c04abbd8da7180008bf3d2aa3f30f12e55cc29f93b3ac41cab42881a5c64271e34f7fd041b4554042312b31b95f4ba72f96c9c9adcf5908183195d1a3c7845bb3a153ca7c449f6bf215b7ea4d76eb830b6ce5ccfd910448d3341b8207126a190c1be7642c23179e2684c7e6e992208fcf28c59b21f21da03af9f7ecab2d2f35c24fa63667bdb4734120c205020a4a3eec145c7e11afaed52027c"], 0x6c}, 0x1, 0x0, 0x0, 0x20040845}, 0x40000) sendmsg$NFT_BATCH(r5, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="14000000100001f500000000000000000100000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}, 0x1, 0x0, 0x0, 0x2004c040}, 0xc050) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000004c0)={'wlan0\x00'}) r7 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x20000) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r7, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000540), r4) sendmsg$TIPC_CMD_SHOW_STATS(r4, &(0x7f00000006c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r8, 0x200, 0x70bd27, 0x25dfdbfb, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x44010) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r7, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)}) ioctl$DRM_IOCTL_MODE_ATOMIC(r7, 0xc03864bc, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}) pipe(&(0x7f0000000240)) socket$inet6(0xa, 0x1, 0x7f) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) r9 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$cdc_ncm(r9, 0x0, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x20, 0x80, 0x1c, {0x2, 0x800, 0x3, 0x35c, 0xc, 0x8, 0xff, 0x3, 0x281, 0x1, 0x0, 0x40}}, 0x0, 0x0, 0x0, 0x0}) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r10, 0x80015b12, 0x0) 363.903306ms ago: executing program 3 (id=10390): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r1, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, 0x0) pread64(r4, 0x0, 0x0, 0x200) r5 = openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) write$nci(r5, 0x0, 0x102) bind$inet(r2, 0x0, 0x0) connect$inet(r2, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, 0x0, 0x0) sendmmsg(r2, 0x0, 0x0, 0x1c) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec02010902"], 0x0) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000300)=0x20, 0x4) write$binfmt_misc(r0, &(0x7f0000000300), 0x6) 306.438086ms ago: executing program 3 (id=10391): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000400)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800"], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/83, 0x53}], 0x1}, 0x0) 32.332551ms ago: executing program 3 (id=10392): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, 0x0) 0s ago: executing program 3 (id=10393): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004041, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='timerslack_ns\x00') write$binfmt_format(r1, &(0x7f0000000180)='0\x00', 0x2) kernel console output (not intermixed with test programs): 971/0x2140 [ 1186.085765][T28221] ? __pfx_udp_sendmsg+0x10/0x10 [ 1186.085773][T28221] ? __lock_acquire+0x683/0x2ce0 [ 1186.085794][T28221] ? __pfx_smack_socket_sendmsg+0x10/0x10 [ 1186.085829][T28221] ? __asan_memset+0x22/0x50 [ 1186.085847][T28221] ? sock_rps_record_flow+0x19/0x350 [ 1186.085864][T28221] ? inet_sendmsg+0x23e/0x320 [ 1186.085885][T28221] ? __pfx_inet_sendmsg+0x10/0x10 [ 1186.085898][T28221] sock_sendmsg_nosec+0x10e/0x180 [ 1186.085916][T28221] ____sys_sendmsg+0x565/0x870 [ 1186.085928][T28221] ? __might_fault+0xaf/0x130 [ 1186.085942][T28221] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1186.085959][T28221] ? import_iovec+0x73/0xa0 [ 1186.085973][T28221] ___sys_sendmsg+0x2a5/0x360 [ 1186.085984][T28221] ? __lock_acquire+0x683/0x2ce0 [ 1186.085996][T28221] ? __pfx____sys_sendmsg+0x10/0x10 [ 1186.086011][T28221] ? kstrtouint+0x6e/0xe0 [ 1186.086038][T28221] ? __fget_files+0x2a/0x420 [ 1186.086049][T28221] ? __fget_files+0x3a8/0x420 [ 1186.086065][T28221] __sys_sendmmsg+0x279/0x4d0 [ 1186.086079][T28221] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1186.086096][T28221] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1186.086120][T28221] ? ksys_write+0x248/0x270 [ 1186.086134][T28221] ? __pfx_ksys_write+0x10/0x10 [ 1186.086149][T28221] __x64_sys_sendmmsg+0xa0/0xc0 [ 1186.086161][T28221] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1186.086172][T28221] do_syscall_64+0x174/0x580 [ 1186.086185][T28221] ? trace_irq_disable+0x3b/0x140 [ 1186.086195][T28221] ? clear_bhb_loop+0x40/0x90 [ 1186.086208][T28221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1186.086218][T28221] RIP: 0033:0x7fd91cf9de99 [ 1186.086229][T28221] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1186.086237][T28221] RSP: 002b:00007fd91b1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1186.086249][T28221] RAX: ffffffffffffffda RBX: 00007fd91d225fa0 RCX: 00007fd91cf9de99 [ 1186.086256][T28221] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000003 [ 1186.086263][T28221] RBP: 00007fd91b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1186.086269][T28221] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1186.086275][T28221] R13: 00007fd91d226038 R14: 00007fd91d225fa0 R15: 00007fff394e8758 [ 1186.086290][T28221] [ 1186.942462][T28232] netlink: 28 bytes leftover after parsing attributes in process `syz.5.8939'. [ 1188.147364][T28249] devpts: Bad value for 'gid' [ 1188.147383][T28249] devpts: Bad value for 'gid' [ 1188.372218][T28257] netlink: 180 bytes leftover after parsing attributes in process `syz.3.8948'. [ 1188.372716][T28257] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8948'. [ 1191.030522][T28309] FAULT_INJECTION: forcing a failure. [ 1191.030522][T28309] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1191.030557][T28309] CPU: 0 UID: 0 PID: 28309 Comm: syz.1.8973 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1191.030583][T28309] Tainted: [L]=SOFTLOCKUP [ 1191.030590][T28309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1191.030602][T28309] Call Trace: [ 1191.030609][T28309] [ 1191.030617][T28309] dump_stack_lvl+0xe8/0x150 [ 1191.030654][T28309] should_fail_ex+0x467/0x600 [ 1191.030690][T28309] _copy_from_iter+0x1d3/0x1660 [ 1191.030714][T28309] ? rcu_is_watching+0x15/0xb0 [ 1191.030741][T28309] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1191.030762][T28309] ? __pfx__copy_from_iter+0x10/0x10 [ 1191.030779][T28309] ? __alloc_skb+0x276/0x7a0 [ 1191.030797][T28309] ? __alloc_skb+0x276/0x7a0 [ 1191.030819][T28309] ? netlink_sendmsg+0x650/0xb40 [ 1191.032116][T28309] ? skb_put+0x112/0x210 [ 1191.032145][T28309] netlink_sendmsg+0x6c0/0xb40 [ 1191.032177][T28309] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1191.032204][T28309] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1191.032240][T28309] ? __kernel_text_address+0xd/0x30 [ 1191.032261][T28309] ? unwind_get_return_address+0x4d/0x90 [ 1191.032287][T28309] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1191.032311][T28309] sock_sendmsg_nosec+0x13a/0x180 [ 1191.032342][T28309] ____sys_sendmsg+0x565/0x870 [ 1191.032367][T28309] ? __might_fault+0xaf/0x130 [ 1191.032395][T28309] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1191.032429][T28309] ? import_iovec+0x73/0xa0 [ 1191.032463][T28309] ___sys_sendmsg+0x2a5/0x360 [ 1191.032487][T28309] ? __lock_acquire+0x683/0x2ce0 [ 1191.032506][T28309] ? __pfx____sys_sendmsg+0x10/0x10 [ 1191.032562][T28309] ? __fget_files+0x2a/0x420 [ 1191.032582][T28309] ? __fget_files+0x3a8/0x420 [ 1191.032612][T28309] __x64_sys_sendmsg+0x1b7/0x290 [ 1191.032644][T28309] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1191.032685][T28309] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1191.032710][T28309] do_syscall_64+0x174/0x580 [ 1191.032734][T28309] ? trace_irq_disable+0x3b/0x140 [ 1191.032765][T28309] ? clear_bhb_loop+0x40/0x90 [ 1191.032789][T28309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1191.032808][T28309] RIP: 0033:0x7f69d6d3de99 [ 1191.032828][T28309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1191.032845][T28309] RSP: 002b:00007f69d4f96028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1191.032878][T28309] RAX: ffffffffffffffda RBX: 00007f69d6fc5fa0 RCX: 00007f69d6d3de99 [ 1191.032893][T28309] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1191.032906][T28309] RBP: 00007f69d4f96090 R08: 0000000000000000 R09: 0000000000000000 [ 1191.032923][T28309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1191.032934][T28309] R13: 00007f69d6fc6038 R14: 00007f69d6fc5fa0 R15: 00007ffe8f559fd8 [ 1191.032964][T28309] [ 1196.270691][T28400] NILFS (nullb0): couldn't find nilfs on the device [ 1197.083290][T28399] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.9008'. [ 1198.240673][T28433] NILFS (nullb0): couldn't find nilfs on the device [ 1201.449636][T28470] NILFS (nullb0): couldn't find nilfs on the device [ 1202.915308][ T10] usb 6-1: new low-speed USB device number 13 using dummy_hcd [ 1203.067339][ T10] usb 6-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1203.067372][ T10] usb 6-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1203.067398][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1203.067428][ T10] usb 6-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1203.067448][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1203.123128][ T10] usb 6-1: config 0 descriptor?? [ 1203.143157][T28487] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1203.144317][ T5594] usb 4-1: new low-speed USB device number 24 using dummy_hcd [ 1203.335875][ T5594] usb 4-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1203.335909][ T5594] usb 4-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1203.335934][ T5594] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1203.335965][ T5594] usb 4-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1203.335988][ T5594] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1203.352308][ T5594] usb 4-1: config 0 descriptor?? [ 1203.401804][T28498] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1203.647720][ T10] usbhid 6-1:0.0: can't add hid device: -71 [ 1203.647823][ T10] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1203.674687][ T10] usb 6-1: USB disconnect, device number 13 [ 1203.807364][ T5594] hid (null): unknown global tag 0xe [ 1203.839864][ T5594] uclogic 0003:5543:0003.000C: unknown main item tag 0x5 [ 1203.839901][ T5594] uclogic 0003:5543:0003.000C: unknown global tag 0xe [ 1203.839916][ T5594] uclogic 0003:5543:0003.000C: item 0 2 1 14 parsing failed [ 1203.840687][ T5594] uclogic 0003:5543:0003.000C: parse failed [ 1203.840789][ T5594] uclogic 0003:5543:0003.000C: probe with driver uclogic failed with error -22 [ 1204.064623][T28498] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1204.065189][T28498] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1204.077719][ T5594] usb 4-1: USB disconnect, device number 24 [ 1204.152848][T28532] NILFS (nullb0): couldn't find nilfs on the device [ 1208.187211][T28581] netlink: 'syz.6.9079': attribute type 6 has an invalid length. [ 1208.240980][T22884] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1208.308879][T22884] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1208.354570][ T5594] usb 6-1: new low-speed USB device number 14 using dummy_hcd [ 1208.508224][ T5594] usb 6-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1208.508259][ T5594] usb 6-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1208.508285][ T5594] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1208.508317][ T5594] usb 6-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1208.508339][ T5594] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1208.520890][ T5594] usb 6-1: config 0 descriptor?? [ 1208.521952][T28574] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1208.606776][ T10] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1208.714269][ T9] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 1208.873751][ T9] usb 4-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 1208.873784][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1208.873803][ T9] usb 4-1: Product: syz [ 1208.873817][ T9] usb 4-1: Manufacturer: syz [ 1208.873831][ T9] usb 4-1: SerialNumber: syz [ 1208.924824][T28575] ceph: No mds server is up or the cluster is laggy [ 1208.944665][ T5594] usbhid 6-1:0.0: can't add hid device: -71 [ 1208.944776][ T5594] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1208.990246][ T5594] usb 6-1: USB disconnect, device number 14 [ 1209.226719][T22884] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1209.515407][ T9] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 25 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 1209.574047][ T9] usb 4-1: USB disconnect, device number 25 [ 1209.584224][T22884] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1209.620798][ T9] usblp0: removed [ 1209.673195][T28618] netlink: 88 bytes leftover after parsing attributes in process `syz.6.9095'. [ 1209.755210][T22884] usb 2-1: Using ep0 maxpacket: 32 [ 1209.809923][T22884] usb 2-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1209.809952][T22884] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1209.834918][T22884] usb 2-1: config 0 descriptor?? [ 1209.870151][T22884] as10x_usb: device has been detected [ 1209.871757][T22884] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1210.268012][T22884] usb 2-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1210.344619][T28637] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.9103'. [ 1210.534583][ T5594] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 1211.123194][ T5594] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1211.123226][ T5594] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1211.123275][ T5594] usb 7-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 1211.123297][ T5594] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1211.167653][ T5594] usb 7-1: config 0 descriptor?? [ 1211.426458][T22884] as10x_usb: error during firmware upload part1 [ 1211.427093][T22884] Registered device nBox DVB-T Dongle [ 1211.487484][T22884] usb 2-1: USB disconnect, device number 23 [ 1211.698727][ T5594] cp2112 0003:10C4:EA90.000D: item fetching failed at offset 0/7 [ 1211.699416][ T5594] cp2112 0003:10C4:EA90.000D: parse failed [ 1211.699542][ T5594] cp2112 0003:10C4:EA90.000D: probe with driver cp2112 failed with error -22 [ 1211.755031][T22884] Unregistered device nBox DVB-T Dongle [ 1211.758174][T22884] as10x_usb: device has been disconnected [ 1212.703323][T28660] netlink: 'syz.1.9110': attribute type 1 has an invalid length. [ 1212.775648][T28660] bond2: entered promiscuous mode [ 1212.776173][T28660] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1212.805411][T28667] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9110'. [ 1212.929705][T28660] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1212.931959][T28660] bond2: (slave xfrm1): The slave device specified does not support setting the MAC address [ 1212.931985][T28660] bond2: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 1212.989490][T28660] bond2: (slave xfrm1): making interface the new active one [ 1212.989513][T28660] xfrm1: entered promiscuous mode [ 1212.993392][T28660] bond2: (slave xfrm1): Enslaving as an active interface with an up link [ 1213.052794][T28673] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.9116'. [ 1213.304293][ T5594] usb 6-1: new low-speed USB device number 15 using dummy_hcd [ 1213.466658][ T5594] usb 6-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1213.466691][ T5594] usb 6-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1213.466718][ T5594] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1213.466748][ T5594] usb 6-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1213.466769][ T5594] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1213.482162][ T5594] usb 6-1: config 0 descriptor?? [ 1213.483180][T28675] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1213.675326][T28703] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.9129'. [ 1213.903194][ T5594] hid (null): unknown global tag 0xe [ 1213.951683][ T5594] uclogic 0003:5543:0003.000E: unknown main item tag 0x5 [ 1213.951720][ T5594] uclogic 0003:5543:0003.000E: unknown global tag 0xe [ 1213.951735][ T5594] uclogic 0003:5543:0003.000E: item 0 2 1 14 parsing failed [ 1213.952470][ T5594] uclogic 0003:5543:0003.000E: parse failed [ 1213.952582][ T5594] uclogic 0003:5543:0003.000E: probe with driver uclogic failed with error -22 [ 1214.062311][ T5594] usb 7-1: USB disconnect, device number 16 [ 1214.247156][ T5821] usb 6-1: USB disconnect, device number 15 [ 1214.448615][T28730] netlink: 'syz.3.9140': attribute type 1 has an invalid length. [ 1214.481114][T28730] bond4: entered promiscuous mode [ 1214.485676][T28730] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1214.710203][T28731] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1216.820269][T28780] netlink: 'syz.6.9159': attribute type 2 has an invalid length. [ 1217.091895][T28794] netlink: 'syz.5.9165': attribute type 1 has an invalid length. [ 1217.136709][T28794] bond3: entered promiscuous mode [ 1217.137291][T28794] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1217.539506][T28811] FAULT_INJECTION: forcing a failure. [ 1217.539506][T28811] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1217.539543][T28811] CPU: 0 UID: 0 PID: 28811 Comm: syz.0.9173 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1217.539577][T28811] Tainted: [L]=SOFTLOCKUP [ 1217.539583][T28811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1217.539595][T28811] Call Trace: [ 1217.539603][T28811] [ 1217.539611][T28811] dump_stack_lvl+0xe8/0x150 [ 1217.539648][T28811] should_fail_ex+0x467/0x600 [ 1217.539686][T28811] prepare_alloc_pages+0x223/0x690 [ 1217.539718][T28811] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1217.539747][T28811] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1217.539775][T28811] ? __pfx_policy_nodemask+0x10/0x10 [ 1217.539812][T28811] alloc_pages_mpol+0xce/0x280 [ 1217.539840][T28811] alloc_pages_noprof+0xd2/0x2f0 [ 1217.539867][T28811] pte_alloc_one+0x22/0x380 [ 1217.539894][T28811] do_pte_missing+0x128d/0x28f0 [ 1217.539929][T28811] ? mt_find+0x481/0x630 [ 1217.539963][T28811] handle_mm_fault+0xd28/0x13f0 [ 1217.539990][T28811] ? handle_mm_fault+0xe8/0x13f0 [ 1217.540013][T28811] ? __pfx_handle_mm_fault+0x10/0x10 [ 1217.540047][T28811] ? __lock_acquire+0x683/0x2ce0 [ 1217.540073][T28811] ? lock_mm_and_find_vma+0xa7/0x340 [ 1217.540101][T28811] do_user_addr_fault+0x744/0x1340 [ 1217.540136][T28811] exc_page_fault+0x6a/0xc0 [ 1217.540162][T28811] asm_exc_page_fault+0x26/0x30 [ 1217.540182][T28811] RIP: 0010:rep_movs_alternative+0x30/0xa0 [ 1217.540214][T28811] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 8d 2a 05 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 1217.540230][T28811] RSP: 0018:ffffc9000f1e7c98 EFLAGS: 00050216 [ 1217.540248][T28811] RAX: 00007ffffffff001 RBX: 0000000000000020 RCX: 0000000000000020 [ 1217.540261][T28811] RDX: 0000000000000001 RSI: 0000200000000000 RDI: ffffc9000f1e7d00 [ 1217.540275][T28811] RBP: ffffc9000f1e7d90 R08: ffffc9000f1e7d1f R09: 1ffff92001e3cfa3 [ 1217.540289][T28811] R10: dffffc0000000000 R11: fffff52001e3cfa4 R12: dffffc0000000000 [ 1217.540304][T28811] R13: 1ffff92001e3cf9c R14: ffffc9000f1e7d00 R15: 0000200000000000 [ 1217.540342][T28811] _copy_from_user+0x7a/0xb0 [ 1217.540368][T28811] io_register_clone_buffers+0xaa/0x310 [ 1217.540472][T28811] ? __pfx_io_register_clone_buffers+0x10/0x10 [ 1217.540500][T28811] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1217.540525][T28811] ? mutex_lock_nested+0x152/0x1d0 [ 1217.540554][T28811] ? __se_sys_io_uring_register+0x221/0x1a20 [ 1217.540631][T28811] __se_sys_io_uring_register+0xf26/0x1a20 [ 1217.540660][T28811] ? __pfx___se_sys_io_uring_register+0x10/0x10 [ 1217.540684][T28811] ? ksys_write+0x248/0x270 [ 1217.540713][T28811] ? __pfx_ksys_write+0x10/0x10 [ 1217.540746][T28811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1217.540767][T28811] do_syscall_64+0x174/0x580 [ 1217.540790][T28811] ? trace_irq_disable+0x3b/0x140 [ 1217.540810][T28811] ? clear_bhb_loop+0x40/0x90 [ 1217.540835][T28811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1217.540853][T28811] RIP: 0033:0x7f194d8ede99 [ 1217.540871][T28811] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1217.540887][T28811] RSP: 002b:00007f194bb46028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 1217.540906][T28811] RAX: ffffffffffffffda RBX: 00007f194db75fa0 RCX: 00007f194d8ede99 [ 1217.540920][T28811] RDX: 0000200000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 1217.540932][T28811] RBP: 00007f194bb46090 R08: 0000000000000000 R09: 0000000000000000 [ 1217.540944][T28811] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 1217.540955][T28811] R13: 00007f194db76038 R14: 00007f194db75fa0 R15: 00007fffc8bc6818 [ 1217.540988][T28811] [ 1218.703829][T28828] netlink: 'syz.6.9180': attribute type 1 has an invalid length. [ 1218.796716][T28828] bond1: entered promiscuous mode [ 1218.823214][T28828] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1218.877722][ T5821] usb 6-1: new low-speed USB device number 16 using dummy_hcd [ 1218.962538][T28832] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1218.963250][T28832] bond1: (slave xfrm1): The slave device specified does not support setting the MAC address [ 1218.963272][T28832] bond1: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 1218.999408][T28832] bond1: (slave xfrm1): making interface the new active one [ 1218.999433][T28832] xfrm1: entered promiscuous mode [ 1219.001368][T28832] bond1: (slave xfrm1): Enslaving as an active interface with an up link [ 1219.030623][ T5821] usb 6-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1219.030655][ T5821] usb 6-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1219.030682][ T5821] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1219.030710][ T5821] usb 6-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1219.030732][ T5821] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1219.141904][ T5821] usb 6-1: config 0 descriptor?? [ 1219.142823][T28823] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1219.200446][T28847] netlink: 56 bytes leftover after parsing attributes in process `syz.1.9190'. [ 1219.535502][T28859] netlink: 'syz.3.9194': attribute type 3 has an invalid length. [ 1219.676236][ T5821] usbhid 6-1:0.0: can't add hid device: -71 [ 1219.676357][ T5821] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1219.703930][ T5821] usb 6-1: USB disconnect, device number 16 [ 1219.911545][T28871] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.9198'. [ 1223.268094][ T5743] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 1223.424073][ T5743] usb 7-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 1223.424198][ T5743] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1223.424219][ T5743] usb 7-1: Product: syz [ 1223.424237][ T5743] usb 7-1: Manufacturer: syz [ 1223.424251][ T5743] usb 7-1: SerialNumber: syz [ 1223.432268][T28955] netlink: 148 bytes leftover after parsing attributes in process `syz.0.9239'. [ 1223.484950][ T5743] ums-karma 7-1:1.0: USB Mass Storage device detected [ 1223.740417][ T5743] ums-karma 7-1:1.0: This device (045a,5210,0101 S 06 P f5) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1223.740417][ T5743] Please send a copy of this message to and [ 1223.884624][ T5743] ums-karma 7-1:1.0: probe with driver ums-karma failed with error -5 [ 1223.901662][ T5743] usb 7-1: USB disconnect, device number 17 [ 1224.864562][T28998] ieee802154 phy0 wpan0: encryption failed: -22 [ 1226.696514][T29079] FAULT_INJECTION: forcing a failure. [ 1226.696514][T29079] name failslab, interval 1, probability 0, space 0, times 0 [ 1226.696549][T29079] CPU: 1 UID: 0 PID: 29079 Comm: syz.0.9293 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1226.696577][T29079] Tainted: [L]=SOFTLOCKUP [ 1226.696584][T29079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1226.696596][T29079] Call Trace: [ 1226.696603][T29079] [ 1226.696616][T29079] dump_stack_lvl+0xe8/0x150 [ 1226.696654][T29079] should_fail_ex+0x467/0x600 [ 1226.696691][T29079] should_failslab+0xa8/0x100 [ 1226.696717][T29079] kmem_cache_alloc_node_noprof+0xae/0x670 [ 1226.696740][T29079] ? __alloc_skb+0x1d7/0x7a0 [ 1226.696760][T29079] ? __alloc_skb+0x1d7/0x7a0 [ 1226.696787][T29079] __alloc_skb+0x1d7/0x7a0 [ 1226.696811][T29079] alloc_skb_with_frags+0xc6/0x760 [ 1226.696911][T29079] ? __lock_acquire+0x683/0x2ce0 [ 1226.696939][T29079] sock_alloc_send_pskb+0x884/0x9a0 [ 1226.696969][T29079] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1226.696998][T29079] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1226.697026][T29079] ? dev_get_by_index+0x22/0x2d0 [ 1226.697051][T29079] ? dev_get_by_index+0x22/0x2d0 [ 1226.697081][T29079] packet_sendmsg+0x3258/0x5040 [ 1226.697192][T29079] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1226.697255][T29079] ? __lock_acquire+0x683/0x2ce0 [ 1226.697287][T29079] ? __lock_acquire+0x683/0x2ce0 [ 1226.697325][T29079] ? smack_socket_sendmsg+0x1f8/0x590 [ 1226.697353][T29079] ? get_pid_task+0x20/0x1f0 [ 1226.697382][T29079] ? __pfx_packet_sendmsg+0x10/0x10 [ 1226.697417][T29079] ? __might_fault+0xaf/0x130 [ 1226.697442][T29079] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1226.697479][T29079] ? __pfx_packet_sendmsg+0x10/0x10 [ 1226.697505][T29079] sock_sendmsg_nosec+0x13a/0x180 [ 1226.697538][T29079] __sys_sendto+0x41e/0x5d0 [ 1226.697565][T29079] ? __pfx___sys_sendto+0x10/0x10 [ 1226.697613][T29079] ? __pfx_ksys_write+0x10/0x10 [ 1226.697644][T29079] __x64_sys_sendto+0xde/0x100 [ 1226.697666][T29079] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1226.697688][T29079] do_syscall_64+0x174/0x580 [ 1226.697711][T29079] ? trace_irq_disable+0x3b/0x140 [ 1226.697731][T29079] ? clear_bhb_loop+0x40/0x90 [ 1226.697755][T29079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1226.697773][T29079] RIP: 0033:0x7f194d8ede99 [ 1226.697793][T29079] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1226.697808][T29079] RSP: 002b:00007f194bb46028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1226.697829][T29079] RAX: ffffffffffffffda RBX: 00007f194db75fa0 RCX: 00007f194d8ede99 [ 1226.697843][T29079] RDX: 000000000000002a RSI: 0000200000000100 RDI: 0000000000000003 [ 1226.697855][T29079] RBP: 00007f194bb46090 R08: 0000200000000200 R09: 0000000000000014 [ 1226.697868][T29079] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1226.697879][T29079] R13: 00007f194db76038 R14: 00007f194db75fa0 R15: 00007fffc8bc6818 [ 1226.697910][T29079] [ 1226.874807][ T9] usb 7-1: new full-speed USB device number 18 using dummy_hcd [ 1227.040109][ T9] usb 7-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 1227.040138][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1227.040157][ T9] usb 7-1: Product: syz [ 1227.040170][ T9] usb 7-1: Manufacturer: syz [ 1227.040184][ T9] usb 7-1: SerialNumber: syz [ 1227.084794][ T5821] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 1227.214623][ T5821] usb 4-1: device descriptor read/64, error -71 [ 1228.794315][ T9] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 18 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 1228.814242][ T5821] usb 4-1: new full-speed USB device number 27 using dummy_hcd [ 1228.838739][ T9] usb 7-1: USB disconnect, device number 18 [ 1228.860569][ T9] usblp0: removed [ 1228.964419][ T5821] usb 4-1: device descriptor read/64, error -71 [ 1229.075757][ T5821] usb usb4-port1: attempt power cycle [ 1229.415875][ T5821] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 1229.447134][ T5821] usb 4-1: device descriptor read/8, error -71 [ 1229.919207][T29122] bridge0: port 2(bridge_slave_1) entered disabled state [ 1229.921269][T29122] bridge0: port 1(bridge_slave_0) entered disabled state [ 1230.596665][T29122] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1230.607244][T29122] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1231.634582][T29122] bond2: left promiscuous mode [ 1231.634598][T29122] xfrm1: left promiscuous mode [ 1231.642439][T12528] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.642651][T12528] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.642734][T12528] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.642767][T12528] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.664224][T12123] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 1231.835337][T12123] usb 1-1: Using ep0 maxpacket: 8 [ 1231.842371][T12123] usb 1-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 1231.842400][T12123] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1231.842418][T12123] usb 1-1: Product: syz [ 1231.842431][T12123] usb 1-1: Manufacturer: syz [ 1231.842448][T12123] usb 1-1: SerialNumber: syz [ 1231.981684][T29210] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.9349'. [ 1232.085443][T29214] FAULT_INJECTION: forcing a failure. [ 1232.085443][T29214] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1232.085478][T29214] CPU: 1 UID: 0 PID: 29214 Comm: syz.1.9351 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1232.085506][T29214] Tainted: [L]=SOFTLOCKUP [ 1232.085513][T29214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1232.085524][T29214] Call Trace: [ 1232.085532][T29214] [ 1232.085541][T29214] dump_stack_lvl+0xe8/0x150 [ 1232.085578][T29214] should_fail_ex+0x467/0x600 [ 1232.085614][T29214] _copy_from_user+0x2d/0xb0 [ 1232.085639][T29214] simple_transaction_get+0x123/0x170 [ 1232.085664][T29214] smk_write_access+0x37/0x1a0 [ 1232.085700][T29214] vfs_writev+0x4c4/0x990 [ 1232.085721][T29214] ? __pfx_smk_write_access+0x10/0x10 [ 1232.085749][T29214] ? __pfx_vfs_writev+0x10/0x10 [ 1232.085782][T29214] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1232.085810][T29214] ? mutex_lock_nested+0x152/0x1d0 [ 1232.085837][T29214] ? fdget_pos+0x252/0x320 [ 1232.085865][T29214] do_writev+0x15a/0x2e0 [ 1232.085886][T29214] ? __pfx_do_writev+0x10/0x10 [ 1232.085908][T29214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1232.085929][T29214] do_syscall_64+0x174/0x580 [ 1232.085952][T29214] ? trace_irq_disable+0x3b/0x140 [ 1232.085971][T29214] ? clear_bhb_loop+0x40/0x90 [ 1232.085995][T29214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1232.086015][T29214] RIP: 0033:0x7f69d6d3de99 [ 1232.086032][T29214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1232.086048][T29214] RSP: 002b:00007f69d4f96028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1232.086068][T29214] RAX: ffffffffffffffda RBX: 00007f69d6fc5fa0 RCX: 00007f69d6d3de99 [ 1232.086082][T29214] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000003 [ 1232.086094][T29214] RBP: 00007f69d4f96090 R08: 0000000000000000 R09: 0000000000000000 [ 1232.086106][T29214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1232.086117][T29214] R13: 00007f69d6fc6038 R14: 00007f69d6fc5fa0 R15: 00007ffe8f559fd8 [ 1232.086145][T29214] [ 1232.492681][T12123] mxuport 1-1:254.0: mxuport_recv_ctrl_urb - usb_control_msg failed (-71) [ 1232.492867][T12123] mxuport 1-1:254.0: probe with driver mxuport failed with error -5 [ 1232.602466][T12123] usb 1-1: USB disconnect, device number 22 [ 1232.820554][T29227] 9p: Bad value for 'rfdno' [ 1233.920497][ T5594] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1234.154425][ T5594] usb 2-1: Using ep0 maxpacket: 32 [ 1234.157860][ T5594] usb 2-1: config 0 has an invalid interface number: 7 but max is 0 [ 1234.157885][ T5594] usb 2-1: config 0 has no interface number 0 [ 1234.157911][ T5594] usb 2-1: too many endpoints for config 0 interface 7 altsetting 0: 67, using maximum allowed: 30 [ 1234.157933][ T5594] usb 2-1: config 0 interface 7 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 67 [ 1234.157955][ T5594] usb 2-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 1234.157966][ T5594] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1234.244892][ T5594] usb 2-1: config 0 descriptor?? [ 1235.002477][ T5594] usb 2-1: string descriptor 0 read error: -71 [ 1235.023491][ T5594] gspca_main: sq930x-2.14.0 probing 041e:403c [ 1235.031699][ T5594] gspca_sq930x: reg_r 001f failed -71 [ 1235.031791][ T5594] sq930x 2-1:0.7: probe with driver sq930x failed with error -71 [ 1235.054623][ T5594] usb 2-1: USB disconnect, device number 24 [ 1235.720908][T29274] gtp0: entered promiscuous mode [ 1237.460181][T29290] FAULT_INJECTION: forcing a failure. [ 1237.460181][T29290] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1237.460217][T29290] CPU: 1 UID: 0 PID: 29290 Comm: syz.0.9379 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1237.460245][T29290] Tainted: [L]=SOFTLOCKUP [ 1237.460252][T29290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1237.460263][T29290] Call Trace: [ 1237.460279][T29290] [ 1237.460287][T29290] dump_stack_lvl+0xe8/0x150 [ 1237.460324][T29290] should_fail_ex+0x467/0x600 [ 1237.460360][T29290] _copy_from_iter+0x1d3/0x1660 [ 1237.460383][T29290] ? rcu_is_watching+0x15/0xb0 [ 1237.460410][T29290] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1237.460434][T29290] ? __pfx__copy_from_iter+0x10/0x10 [ 1237.460454][T29290] ? __alloc_skb+0x276/0x7a0 [ 1237.460474][T29290] ? __alloc_skb+0x276/0x7a0 [ 1237.460503][T29290] ? netlink_sendmsg+0x650/0xb40 [ 1237.460545][T29290] ? skb_put+0x112/0x210 [ 1237.460569][T29290] netlink_sendmsg+0x6c0/0xb40 [ 1237.460602][T29290] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1237.460628][T29290] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1237.460658][T29290] ? __kernel_text_address+0xd/0x30 [ 1237.460678][T29290] ? unwind_get_return_address+0x4d/0x90 [ 1237.460704][T29290] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1237.460727][T29290] sock_sendmsg_nosec+0x13a/0x180 [ 1237.460761][T29290] ____sys_sendmsg+0x565/0x870 [ 1237.460784][T29290] ? __might_fault+0xaf/0x130 [ 1237.460811][T29290] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1237.460841][T29290] ? import_iovec+0x73/0xa0 [ 1237.460865][T29290] ___sys_sendmsg+0x2a5/0x360 [ 1237.460886][T29290] ? __lock_acquire+0x683/0x2ce0 [ 1237.460908][T29290] ? __pfx____sys_sendmsg+0x10/0x10 [ 1237.460963][T29290] ? __fget_files+0x2a/0x420 [ 1237.460984][T29290] ? __fget_files+0x3a8/0x420 [ 1237.461013][T29290] __x64_sys_sendmsg+0x1b7/0x290 [ 1237.461040][T29290] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1237.461082][T29290] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1237.461103][T29290] do_syscall_64+0x174/0x580 [ 1237.461127][T29290] ? trace_irq_disable+0x3b/0x140 [ 1237.461147][T29290] ? clear_bhb_loop+0x40/0x90 [ 1237.461171][T29290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1237.461191][T29290] RIP: 0033:0x7f194d8ede99 [ 1237.461209][T29290] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1237.461226][T29290] RSP: 002b:00007f194bb46028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1237.461247][T29290] RAX: ffffffffffffffda RBX: 00007f194db75fa0 RCX: 00007f194d8ede99 [ 1237.461261][T29290] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 1237.461280][T29290] RBP: 00007f194bb46090 R08: 0000000000000000 R09: 0000000000000000 [ 1237.461292][T29290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1237.461304][T29290] R13: 00007f194db76038 R14: 00007f194db75fa0 R15: 00007fffc8bc6818 [ 1237.461334][T29290] [ 1237.724260][ T31] usb 2-1: new low-speed USB device number 25 using dummy_hcd [ 1237.897631][ T31] usb 2-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1237.897665][ T31] usb 2-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1237.897690][ T31] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1237.897721][ T31] usb 2-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1237.897742][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1237.954681][ T31] usb 2-1: config 0 descriptor?? [ 1237.955696][T29284] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1238.059797][T29301] FAULT_INJECTION: forcing a failure. [ 1238.059797][T29301] name failslab, interval 1, probability 0, space 0, times 0 [ 1238.059832][T29301] CPU: 1 UID: 0 PID: 29301 Comm: syz.5.9383 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1238.059862][T29301] Tainted: [L]=SOFTLOCKUP [ 1238.059869][T29301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1238.059881][T29301] Call Trace: [ 1238.059888][T29301] [ 1238.059896][T29301] dump_stack_lvl+0xe8/0x150 [ 1238.059933][T29301] should_fail_ex+0x467/0x600 [ 1238.059976][T29301] should_failslab+0xa8/0x100 [ 1238.060003][T29301] __kmalloc_noprof+0xfe/0x780 [ 1238.060023][T29301] ? rcu_is_watching+0x15/0xb0 [ 1238.060049][T29301] ? tomoyo_realpath_from_path+0xef/0x640 [ 1238.060076][T29301] ? tomoyo_realpath_from_path+0xef/0x640 [ 1238.060109][T29301] tomoyo_realpath_from_path+0xef/0x640 [ 1238.060149][T29301] tomoyo_mount_permission+0x927/0x9e0 [ 1238.060180][T29301] ? tomoyo_mount_permission+0x2b5/0x9e0 [ 1238.060207][T29301] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 1238.060230][T29301] ? kasan_save_track+0x4f/0x80 [ 1238.060297][T29301] ? kasan_quarantine_put+0xbb/0x1f0 [ 1238.060319][T29301] security_sb_mount+0xe4/0x320 [ 1238.060350][T29301] path_mount+0xbc/0x1040 [ 1238.060373][T29301] ? user_path_at+0xd4/0x160 [ 1238.060396][T29301] __se_sys_mount+0x31d/0x420 [ 1238.060517][T29301] ? __pfx___se_sys_mount+0x10/0x10 [ 1238.060542][T29301] ? __x64_sys_mount+0x20/0xc0 [ 1238.060561][T29301] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1238.060582][T29301] do_syscall_64+0x174/0x580 [ 1238.060604][T29301] ? trace_irq_disable+0x3b/0x140 [ 1238.060623][T29301] ? clear_bhb_loop+0x40/0x90 [ 1238.060646][T29301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1238.060663][T29301] RIP: 0033:0x7fd49779de99 [ 1238.060682][T29301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1238.060698][T29301] RSP: 002b:00007fd4959f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1238.060718][T29301] RAX: ffffffffffffffda RBX: 00007fd497a25fa0 RCX: 00007fd49779de99 [ 1238.060732][T29301] RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00002000000001c0 [ 1238.060746][T29301] RBP: 00007fd4959f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1238.060767][T29301] R10: 000000000000c458 R11: 0000000000000246 R12: 0000000000000002 [ 1238.060779][T29301] R13: 00007fd497a26038 R14: 00007fd497a25fa0 R15: 00007ffc5d241088 [ 1238.060811][T29301] [ 1238.060879][T29301] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1238.477841][ T31] hid (null): unknown global tag 0xe [ 1238.496071][ T31] uclogic 0003:5543:0003.000F: unknown main item tag 0x5 [ 1238.496106][ T31] uclogic 0003:5543:0003.000F: unknown global tag 0xe [ 1238.496121][ T31] uclogic 0003:5543:0003.000F: item 0 2 1 14 parsing failed [ 1238.496833][ T31] uclogic 0003:5543:0003.000F: parse failed [ 1238.496934][ T31] uclogic 0003:5543:0003.000F: probe with driver uclogic failed with error -22 [ 1238.686108][ T9] usb 2-1: USB disconnect, device number 25 [ 1238.799092][T29312] netlink: 12 bytes leftover after parsing attributes in process `syz.5.9389'. [ 1238.985005][ T1341] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.985074][ T1341] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.356818][T29332] netlink: 'syz.1.9398': attribute type 1 has an invalid length. [ 1239.415219][T29335] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9398'. [ 1239.440713][T29332] bond3: entered promiscuous mode [ 1239.442128][T29332] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1239.740000][T29343] tipc: Started in network mode [ 1239.740034][T29343] tipc: Node identity ac1414aa, cluster identity 4711 [ 1239.809142][T29343] tipc: New replicast peer: 172.20.20.187 [ 1239.809633][T29347] 9pnet_virtio: no channels available for device c::: [ 1239.991893][T29343] tipc: Enabled bearer , priority 10 [ 1240.374228][T22884] usb 6-1: new low-speed USB device number 17 using dummy_hcd [ 1240.552504][T22884] usb 6-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1240.552536][T22884] usb 6-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1240.552561][T22884] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1240.552590][T22884] usb 6-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1240.552611][T22884] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1240.661114][T29369] FAULT_INJECTION: forcing a failure. [ 1240.661114][T29369] name failslab, interval 1, probability 0, space 0, times 0 [ 1240.661147][T29369] CPU: 1 UID: 0 PID: 29369 Comm: syz.1.9411 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1240.661174][T29369] Tainted: [L]=SOFTLOCKUP [ 1240.661180][T29369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1240.661191][T29369] Call Trace: [ 1240.661198][T29369] [ 1240.661206][T29369] dump_stack_lvl+0xe8/0x150 [ 1240.661241][T29369] should_fail_ex+0x467/0x600 [ 1240.661278][T29369] should_failslab+0xa8/0x100 [ 1240.661304][T29369] __kmalloc_cache_noprof+0xa0/0x6b0 [ 1240.661327][T29369] ? drm_atomic_commit_alloc+0xa9/0x100 [ 1240.661497][T29369] ? drm_atomic_commit_alloc+0xa9/0x100 [ 1240.661530][T29369] drm_atomic_commit_alloc+0xa9/0x100 [ 1240.661558][T29369] drm_mode_atomic_ioctl+0x4a3/0x24c0 [ 1240.661582][T29369] ? do_raw_spin_lock+0x12b/0x2f0 [ 1240.661623][T29369] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1240.661651][T29369] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 1240.661669][T29369] ? rt_mutex_slowunlock+0x4ee/0xa20 [ 1240.661715][T29369] ? rt_spin_unlock+0x157/0x200 [ 1240.661754][T29369] ? rt_spin_unlock+0x163/0x200 [ 1240.661786][T29369] ? drm_is_current_master+0x1a2/0x210 [ 1240.661809][T29369] drm_ioctl_kernel+0x2e2/0x3b0 [ 1240.661839][T29369] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 1240.661860][T29369] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 1240.661896][T29369] drm_ioctl+0x713/0xba0 [ 1240.661930][T29369] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 1240.661950][T29369] ? __pfx_drm_ioctl+0x10/0x10 [ 1240.661988][T29369] ? __fget_files+0x2a/0x420 [ 1240.662014][T29369] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1240.662034][T29369] ? __pfx_drm_ioctl+0x10/0x10 [ 1240.662061][T29369] __se_sys_ioctl+0xff/0x170 [ 1240.662088][T29369] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1240.662110][T29369] do_syscall_64+0x174/0x580 [ 1240.662133][T29369] ? trace_irq_disable+0x3b/0x140 [ 1240.662154][T29369] ? clear_bhb_loop+0x40/0x90 [ 1240.662178][T29369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1240.662198][T29369] RIP: 0033:0x7f69d6d3de99 [ 1240.662216][T29369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1240.662232][T29369] RSP: 002b:00007f69d4f96028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1240.662253][T29369] RAX: ffffffffffffffda RBX: 00007f69d6fc5fa0 RCX: 00007f69d6d3de99 [ 1240.662268][T29369] RDX: 0000200000000180 RSI: 00000000c03864bc RDI: 000000000000000d [ 1240.662281][T29369] RBP: 00007f69d4f96090 R08: 0000000000000000 R09: 0000000000000000 [ 1240.662294][T29369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1240.662305][T29369] R13: 00007f69d6fc6038 R14: 00007f69d6fc5fa0 R15: 00007ffe8f559fd8 [ 1240.662337][T29369] [ 1240.810788][ T5594] tipc: Node number set to 2886997162 [ 1240.857942][T22884] usb 6-1: config 0 descriptor?? [ 1240.877865][T29371] netlink: 96 bytes leftover after parsing attributes in process `syz.0.9412'. [ 1241.012317][T29357] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1241.447165][T22884] hid (null): unknown global tag 0xe [ 1241.473031][T22884] uclogic 0003:5543:0003.0010: unknown main item tag 0x5 [ 1241.473064][T22884] uclogic 0003:5543:0003.0010: unknown global tag 0xe [ 1241.473079][T22884] uclogic 0003:5543:0003.0010: item 0 2 1 14 parsing failed [ 1241.500310][T22884] uclogic 0003:5543:0003.0010: parse failed [ 1241.500467][T22884] uclogic 0003:5543:0003.0010: probe with driver uclogic failed with error -22 [ 1241.653041][T29357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1241.653770][T29357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1241.756051][ T9] usb 6-1: USB disconnect, device number 17 [ 1242.379944][ T36] audit: type=1800 audit(1785320577.194:3388): pid=29387 uid=0 auid=4294967295 ses=4294967295 subj=_ op=set_data cause=unavailable-hash-algorithm comm="syz.1.9418" name="/" dev="pipefs" ino=106849 res=0 errno=0 [ 1243.528717][T29443] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9439'. [ 1243.530188][T29445] FAULT_INJECTION: forcing a failure. [ 1243.530188][T29445] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1243.530209][T29445] CPU: 1 UID: 0 PID: 29445 Comm: syz.3.9441 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1243.530224][T29445] Tainted: [L]=SOFTLOCKUP [ 1243.530228][T29445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1243.530234][T29445] Call Trace: [ 1243.530238][T29445] [ 1243.530243][T29445] dump_stack_lvl+0xe8/0x150 [ 1243.530265][T29445] should_fail_ex+0x467/0x600 [ 1243.530295][T29445] _copy_to_user+0x31/0xb0 [ 1243.530325][T29445] simple_read_from_buffer+0xe1/0x170 [ 1243.530353][T29445] proc_fail_nth_read+0x1be/0x230 [ 1243.530370][T29445] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1243.530383][T29445] ? rw_verify_area+0x250/0x4d0 [ 1243.530398][T29445] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1243.530408][T29445] vfs_read+0x219/0xa90 [ 1243.530424][T29445] ? __pfx_vfs_read+0x10/0x10 [ 1243.530444][T29445] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1243.530458][T29445] ? lockdep_hardirqs_on+0x7a/0x110 [ 1243.530471][T29445] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1243.530483][T29445] ? mutex_lock_nested+0x152/0x1d0 [ 1243.530497][T29445] ? fdget_pos+0x252/0x320 [ 1243.530512][T29445] ksys_read+0x156/0x270 [ 1243.530526][T29445] ? __pfx_ksys_read+0x10/0x10 [ 1243.530542][T29445] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1243.530553][T29445] do_syscall_64+0x174/0x580 [ 1243.530565][T29445] ? trace_irq_disable+0x3b/0x140 [ 1243.530576][T29445] ? clear_bhb_loop+0x40/0x90 [ 1243.530587][T29445] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1243.530597][T29445] RIP: 0033:0x7fd91cf5e6ce [ 1243.530608][T29445] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1243.530616][T29445] RSP: 002b:00007fd91b1f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1243.530627][T29445] RAX: ffffffffffffffda RBX: 00007fd91b1f66c0 RCX: 00007fd91cf5e6ce [ 1243.530635][T29445] RDX: 000000000000000f RSI: 00007fd91b1f60a0 RDI: 0000000000000004 [ 1243.530641][T29445] RBP: 00007fd91b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1243.530647][T29445] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1243.530652][T29445] R13: 00007fd91d226038 R14: 00007fd91d225fa0 R15: 00007fff394e8758 [ 1243.530668][T29445] [ 1244.231767][T29468] netlink: 1624 bytes leftover after parsing attributes in process `syz.6.9451'. [ 1244.544303][ T5821] usb 6-1: new low-speed USB device number 18 using dummy_hcd [ 1244.696120][ T5821] usb 6-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1244.696141][ T5821] usb 6-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1244.696154][ T5821] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1244.696171][ T5821] usb 6-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1244.696183][ T5821] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1244.733160][ T5821] usb 6-1: config 0 descriptor?? [ 1244.740682][T29472] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1245.156737][ T5821] hid (null): unknown global tag 0xe [ 1245.204901][T29490] loop2: detected capacity change from 0 to 7 [ 1245.266414][ T5821] uclogic 0003:5543:0003.0011: unknown main item tag 0x5 [ 1245.266437][ T5821] uclogic 0003:5543:0003.0011: unknown global tag 0xe [ 1245.266454][ T5821] uclogic 0003:5543:0003.0011: item 0 2 1 14 parsing failed [ 1245.266918][ T5821] uclogic 0003:5543:0003.0011: parse failed [ 1245.266976][ T5821] uclogic 0003:5543:0003.0011: probe with driver uclogic failed with error -22 [ 1245.325564][T29490] Dev loop2: unable to read RDB block 7 [ 1245.325597][T29490] loop2: unable to read partition table [ 1245.326726][T29490] loop2: partition table beyond EOD, truncated [ 1245.326747][T29490] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 1245.366165][ T5594] usb 6-1: USB disconnect, device number 18 [ 1247.392993][T29525] netlink: 'syz.5.9470': attribute type 6 has an invalid length. [ 1248.148615][T29518] ceph: No mds server is up or the cluster is laggy [ 1248.714314][T29574] netlink: 308 bytes leftover after parsing attributes in process `syz.5.9494'. [ 1249.154635][ T31] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 1249.284201][ T31] usb 6-1: device descriptor read/64, error -71 [ 1249.490670][T29611] dvmrp0: entered allmulticast mode [ 1249.504601][T22884] usb 4-1: new low-speed USB device number 30 using dummy_hcd [ 1249.534705][ T31] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 1249.657402][T22884] usb 4-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1249.657435][T22884] usb 4-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1249.657460][T22884] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1249.657490][T22884] usb 4-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1249.657512][T22884] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1249.674316][ T31] usb 6-1: device descriptor read/64, error -71 [ 1249.723431][T22884] usb 4-1: config 0 descriptor?? [ 1249.732022][T29602] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1249.784692][ T31] usb usb6-port1: attempt power cycle [ 1249.912176][T29634] FAULT_INJECTION: forcing a failure. [ 1249.912176][T29634] name failslab, interval 1, probability 0, space 0, times 0 [ 1249.912205][T29634] CPU: 1 UID: 0 PID: 29634 Comm: syz.0.9522 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1249.912226][T29634] Tainted: [L]=SOFTLOCKUP [ 1249.912231][T29634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1249.912240][T29634] Call Trace: [ 1249.912246][T29634] [ 1249.912252][T29634] dump_stack_lvl+0xe8/0x150 [ 1249.912281][T29634] should_fail_ex+0x467/0x600 [ 1249.912309][T29634] should_failslab+0xa8/0x100 [ 1249.912328][T29634] __kmalloc_cache_node_noprof+0xa9/0x6a0 [ 1249.912347][T29634] ? __get_vm_area_node+0x136/0x300 [ 1249.912370][T29634] ? __get_vm_area_node+0x136/0x300 [ 1249.912397][T29634] __get_vm_area_node+0x136/0x300 [ 1249.912423][T29634] __vmalloc_node_range_noprof+0x358/0x1730 [ 1249.912441][T29634] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1249.912468][T29634] ? is_bpf_text_address+0x26/0x2b0 [ 1249.912497][T29634] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1249.912511][T29634] ? is_bpf_text_address+0x26/0x2b0 [ 1249.912529][T29634] ? kernel_text_address+0xa5/0xe0 [ 1249.912549][T29634] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1249.912564][T29634] __vmalloc_noprof+0xd2/0x120 [ 1249.912577][T29634] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1249.912594][T29634] bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1249.912608][T29634] ? bpf_prog_alloc+0x2a/0x1a0 [ 1249.912625][T29634] bpf_prog_alloc+0x3c/0x1a0 [ 1249.912646][T29634] bpf_prog_load+0x7f8/0x1c00 [ 1249.912678][T29634] ? __pfx_bpf_prog_load+0x10/0x10 [ 1249.912719][T29634] __sys_bpf+0xd0d/0xd90 [ 1249.912745][T29634] ? __pfx___sys_bpf+0x10/0x10 [ 1249.912765][T29634] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1249.912792][T29634] ? rt_mutex_slowunlock+0x219/0x460 [ 1249.912837][T29634] ? ksys_write+0x248/0x270 [ 1249.912873][T29634] ? __pfx_ksys_write+0x10/0x10 [ 1249.912901][T29634] __x64_sys_bpf+0xba/0xd0 [ 1249.912926][T29634] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1249.912943][T29634] do_syscall_64+0x174/0x580 [ 1249.912963][T29634] ? trace_irq_disable+0x3b/0x140 [ 1249.912982][T29634] ? clear_bhb_loop+0x40/0x90 [ 1249.913006][T29634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1249.913025][T29634] RIP: 0033:0x7f194d8ede99 [ 1249.913043][T29634] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1249.913058][T29634] RSP: 002b:00007f194bb46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1249.913076][T29634] RAX: ffffffffffffffda RBX: 00007f194db75fa0 RCX: 00007f194d8ede99 [ 1249.913090][T29634] RDX: 0000000000000094 RSI: 00002000000008c0 RDI: 0000000000000005 [ 1249.913104][T29634] RBP: 00007f194bb46090 R08: 0000000000000000 R09: 0000000000000000 [ 1249.913114][T29634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1249.913125][T29634] R13: 00007f194db76038 R14: 00007f194db75fa0 R15: 00007fffc8bc6818 [ 1249.913154][T29634] [ 1249.913218][T29634] syz.0.9522: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1249.913278][T29634] CPU: 1 UID: 0 PID: 29634 Comm: syz.0.9522 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1249.913304][T29634] Tainted: [L]=SOFTLOCKUP [ 1249.913310][T29634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1249.913322][T29634] Call Trace: [ 1249.913330][T29634] [ 1249.913337][T29634] dump_stack_lvl+0xe8/0x150 [ 1249.913368][T29634] warn_alloc+0x24c/0x270 [ 1249.913396][T29634] ? __pfx_warn_alloc+0x10/0x10 [ 1249.913426][T29634] ? __get_vm_area_node+0x2af/0x300 [ 1249.913461][T29634] __vmalloc_node_range_noprof+0x37d/0x1730 [ 1249.913489][T29634] ? is_bpf_text_address+0x26/0x2b0 [ 1249.913530][T29634] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1249.913549][T29634] ? is_bpf_text_address+0x26/0x2b0 [ 1249.913573][T29634] ? kernel_text_address+0xa5/0xe0 [ 1249.913598][T29634] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1249.913618][T29634] __vmalloc_noprof+0xd2/0x120 [ 1249.913638][T29634] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1249.913662][T29634] bpf_prog_alloc_no_stats+0x47/0x4f0 [ 1249.913682][T29634] ? bpf_prog_alloc+0x2a/0x1a0 [ 1249.913705][T29634] bpf_prog_alloc+0x3c/0x1a0 [ 1249.913727][T29634] bpf_prog_load+0x7f8/0x1c00 [ 1249.913759][T29634] ? __pfx_bpf_prog_load+0x10/0x10 [ 1249.913803][T29634] __sys_bpf+0xd0d/0xd90 [ 1249.913832][T29634] ? __pfx___sys_bpf+0x10/0x10 [ 1249.913854][T29634] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1249.913889][T29634] ? rt_mutex_slowunlock+0x219/0x460 [ 1249.913935][T29634] ? ksys_write+0x248/0x270 [ 1249.913962][T29634] ? __pfx_ksys_write+0x10/0x10 [ 1249.913991][T29634] __x64_sys_bpf+0xba/0xd0 [ 1249.914020][T29634] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1249.914042][T29634] do_syscall_64+0x174/0x580 [ 1249.914064][T29634] ? trace_irq_disable+0x3b/0x140 [ 1249.914086][T29634] ? clear_bhb_loop+0x40/0x90 [ 1249.914106][T29634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1249.914123][T29634] RIP: 0033:0x7f194d8ede99 [ 1249.914140][T29634] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1249.914156][T29634] RSP: 002b:00007f194bb46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1249.914173][T29634] RAX: ffffffffffffffda RBX: 00007f194db75fa0 RCX: 00007f194d8ede99 [ 1249.914187][T29634] RDX: 0000000000000094 RSI: 00002000000008c0 RDI: 0000000000000005 [ 1249.914200][T29634] RBP: 00007f194bb46090 R08: 0000000000000000 R09: 0000000000000000 [ 1249.914212][T29634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1249.914223][T29634] R13: 00007f194db76038 R14: 00007f194db75fa0 R15: 00007fffc8bc6818 [ 1249.914254][T29634] [ 1249.914818][ T5594] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 1249.924214][T29634] Mem-Info: [ 1249.924230][T29634] active_anon:195 inactive_anon:6651 isolated_anon:0 [ 1249.924230][T29634] active_file:26888 inactive_file:35767 isolated_file:0 [ 1249.924230][T29634] unevictable:768 dirty:243 writeback:0 [ 1249.924230][T29634] slab_reclaimable:12498 slab_unreclaimable:105112 [ 1249.924230][T29634] mapped:30539 shmem:1295 pagetables:1554 [ 1249.924230][T29634] sec_pagetables:0 bounce:0 [ 1249.924230][T29634] kernel_misc_reclaimable:0 [ 1249.924230][T29634] free:1277796 free_pcp:18971 free_cma:0 [ 1249.924285][T29634] Node 0 active_anon:780kB inactive_anon:26604kB active_file:107348kB inactive_file:143068kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:122156kB dirty:972kB writeback:0kB shmem:3644kB kernel_stack:13720kB pagetables:6076kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1249.924336][T29634] Node 1 active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1249.924381][T29634] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1249.924439][T29634] lowmem_reserve[]: 0 2500 2502 2502 2502 [ 1249.924470][T29634] Node 0 DMA32 free:1155520kB boost:0kB min:3920kB low:6452kB high:8984kB reserved_highatomic:0KB free_highatomic:0KB active_anon:780kB inactive_anon:26604kB active_file:107348kB inactive_file:143068kB unevictable:1536kB writepending:972kB zspages:0kB present:3129332kB managed:2560592kB mlocked:0kB bounce:0kB free_pcp:70224kB local_pcp:18924kB free_cma:0kB [ 1249.924527][T29634] lowmem_reserve[]: 0 0 1 1 1 [ 1249.929955][T29634] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1856kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 1249.930012][T29634] lowmem_reserve[]: 0 0 0 0 0 [ 1249.930042][T29634] Node 1 Normal free:3940304kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:5652kB local_pcp:3472kB free_cma:0kB [ 1249.930100][T29634] lowmem_reserve[]: 0 0 0 0 0 [ 1249.930130][T29634] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1249.930238][T29634] Node 0 DMA32: 1244*4kB (UM) 1436*8kB (UM) 663*16kB (UME) 344*32kB (UME) 185*64kB (UM) 184*128kB (UME) 125*256kB (UM) 59*512kB (UME) 26*1024kB (ME) 17*2048kB (M) 234*4096kB (UM) = 1155584kB [ 1249.930383][T29634] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1249.930475][T29634] Node 1 Normal: 6*4kB (UM) 9*8kB (UM) 13*16kB (UM) 5*32kB (UM) 8*64kB (UM) 2*128kB (UM) 5*256kB (M) 7*512kB (UM) 4*1024kB (UM) 1*2048kB (M) 959*4096kB (M) = 3940304kB [ 1249.930618][T29634] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1249.930633][T29634] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1249.930649][T29634] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1249.930664][T29634] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1249.930679][T29634] 63946 total pagecache pages [ 1249.930686][T29634] 0 pages in swap cache [ 1249.930693][T29634] Free swap = 124996kB [ 1249.930700][T29634] Total swap = 124996kB [ 1249.930707][T29634] 2097051 pages RAM [ 1249.930713][T29634] 0 pages HighMem/MovableOnly [ 1249.930719][T29634] 424824 pages reserved [ 1249.930725][T29634] 0 pages cma reserved [ 1250.054663][ T5594] usb 7-1: device descriptor read/64, error -71 [ 1250.134247][ T31] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 1250.155295][ T31] usb 6-1: device descriptor read/8, error -71 [ 1250.176653][T22884] hid (null): unknown global tag 0xe [ 1250.192049][T29641] FAULT_INJECTION: forcing a failure. [ 1250.192049][T29641] name failslab, interval 1, probability 0, space 0, times 0 [ 1250.192081][T29641] CPU: 1 UID: 0 PID: 29641 Comm: syz.1.9525 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1250.192110][T29641] Tainted: [L]=SOFTLOCKUP [ 1250.192117][T29641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1250.192129][T29641] Call Trace: [ 1250.192137][T29641] [ 1250.192144][T29641] dump_stack_lvl+0xe8/0x150 [ 1250.192178][T29641] should_fail_ex+0x467/0x600 [ 1250.192213][T29641] should_failslab+0xa8/0x100 [ 1250.192238][T29641] __kmalloc_noprof+0xfe/0x780 [ 1250.192260][T29641] ? tomoyo_init_log+0x1aaf/0x1fa0 [ 1250.192291][T29641] ? tomoyo_init_log+0x1aaf/0x1fa0 [ 1250.192322][T29641] tomoyo_init_log+0x1aaf/0x1fa0 [ 1250.192368][T29641] ? __pfx_tomoyo_init_log+0x10/0x10 [ 1250.192393][T29641] ? tomoyo_profile+0x11/0x50 [ 1250.192417][T29641] ? tomoyo_domain_quota_is_ok+0x422/0x570 [ 1250.192442][T29641] tomoyo_supervisor+0x35f/0x1560 [ 1250.192479][T29641] ? __pfx_tomoyo_supervisor+0x10/0x10 [ 1250.192515][T29641] ? snprintf+0xe8/0x140 [ 1250.192539][T29641] ? __pfx_snprintf+0x10/0x10 [ 1250.192559][T29641] ? tomoyo_check_acl+0x386/0x400 [ 1250.192585][T29641] tomoyo_check_inet_address+0x5e5/0x930 [ 1250.192610][T29641] ? __pfx_current_check_access_socket+0x10/0x10 [ 1250.192635][T29641] ? tomoyo_check_inet_address+0x27f/0x930 [ 1250.192660][T29641] ? __pfx_tomoyo_check_inet_address+0x10/0x10 [ 1250.192706][T29641] ? __asan_memset+0x22/0x50 [ 1250.192735][T29641] ? current_check_autobind_udp_socket+0x198/0x400 [ 1250.192762][T29641] tomoyo_socket_connect_permission+0x1cf/0x270 [ 1250.192796][T29641] security_socket_connect+0xc0/0x280 [ 1250.192818][T29641] __sys_connect+0x25d/0x470 [ 1250.192842][T29641] ? __pfx___sys_connect+0x10/0x10 [ 1250.192874][T29641] ? __pfx_ksys_write+0x10/0x10 [ 1250.192902][T29641] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1250.192922][T29641] __x64_sys_connect+0x7a/0x90 [ 1250.192943][T29641] do_syscall_64+0x174/0x580 [ 1250.192965][T29641] ? trace_irq_disable+0x3b/0x140 [ 1250.192984][T29641] ? clear_bhb_loop+0x40/0x90 [ 1250.193007][T29641] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1250.193025][T29641] RIP: 0033:0x7f69d6d3de99 [ 1250.193042][T29641] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1250.193058][T29641] RSP: 002b:00007f69d4f96028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1250.193079][T29641] RAX: ffffffffffffffda RBX: 00007f69d6fc5fa0 RCX: 00007f69d6d3de99 [ 1250.193092][T29641] RDX: 000000000000001c RSI: 00002000000002c0 RDI: 0000000000000003 [ 1250.193104][T29641] RBP: 00007f69d4f96090 R08: 0000000000000000 R09: 0000000000000000 [ 1250.193116][T29641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1250.193127][T29641] R13: 00007f69d6fc6038 R14: 00007f69d6fc5fa0 R15: 00007ffe8f559fd8 [ 1250.193158][T29641] [ 1250.294643][ T5594] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 1250.385920][T29602] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1250.386493][T29602] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1250.414313][ T31] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1250.429909][ T5594] usb 7-1: device descriptor read/64, error -71 [ 1250.438352][ T31] usb 6-1: device descriptor read/8, error -71 [ 1250.538805][ T5594] usb usb7-port1: attempt power cycle [ 1250.547794][ T31] usb usb6-port1: unable to enumerate USB device [ 1250.847039][T29655] FAULT_INJECTION: forcing a failure. [ 1250.847039][T29655] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1250.847074][T29655] CPU: 1 UID: 0 PID: 29655 Comm: syz.0.9531 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1250.847100][T29655] Tainted: [L]=SOFTLOCKUP [ 1250.847107][T29655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1250.847119][T29655] Call Trace: [ 1250.847127][T29655] [ 1250.847134][T29655] dump_stack_lvl+0xe8/0x150 [ 1250.847171][T29655] should_fail_ex+0x467/0x600 [ 1250.847207][T29655] _copy_to_user+0x31/0xb0 [ 1250.847231][T29655] simple_read_from_buffer+0xe1/0x170 [ 1250.847258][T29655] proc_fail_nth_read+0x1be/0x230 [ 1250.847283][T29655] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1250.847306][T29655] ? rw_verify_area+0x250/0x4d0 [ 1250.847332][T29655] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1250.847351][T29655] vfs_read+0x219/0xa90 [ 1250.847382][T29655] ? __pfx_vfs_read+0x10/0x10 [ 1250.847408][T29655] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1250.847433][T29655] ? lockdep_hardirqs_on+0x7a/0x110 [ 1250.847455][T29655] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1250.847477][T29655] ? mutex_lock_nested+0x152/0x1d0 [ 1250.847504][T29655] ? fdget_pos+0x252/0x320 [ 1250.847533][T29655] ksys_read+0x156/0x270 [ 1250.847559][T29655] ? __pfx_ksys_read+0x10/0x10 [ 1250.847582][T29655] ? __pfx_rtc_dev_ioctl+0x10/0x10 [ 1250.847665][T29655] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1250.847687][T29655] do_syscall_64+0x174/0x580 [ 1250.847709][T29655] ? trace_irq_disable+0x3b/0x140 [ 1250.847734][T29655] ? clear_bhb_loop+0x40/0x90 [ 1250.847757][T29655] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1250.847776][T29655] RIP: 0033:0x7f194d8ae6ce [ 1250.847793][T29655] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1250.847809][T29655] RSP: 002b:00007f194bb45fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1250.847829][T29655] RAX: ffffffffffffffda RBX: 00007f194bb466c0 RCX: 00007f194d8ae6ce [ 1250.847844][T29655] RDX: 000000000000000f RSI: 00007f194bb460a0 RDI: 0000000000000004 [ 1250.847855][T29655] RBP: 00007f194bb46090 R08: 0000000000000000 R09: 0000000000000000 [ 1250.847867][T29655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1250.847878][T29655] R13: 00007f194db76038 R14: 00007f194db75fa0 R15: 00007fffc8bc6818 [ 1250.847909][T29655] [ 1250.975695][ T5594] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 1251.003317][ T5594] usb 7-1: device descriptor read/8, error -71 [ 1251.234449][ T5594] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 1251.268035][ T5594] usb 7-1: device descriptor read/8, error -71 [ 1251.375089][ T5594] usb usb7-port1: unable to enumerate USB device [ 1251.537784][T22884] uclogic 0003:5543:0003.0012: unknown main item tag 0x5 [ 1251.537820][T22884] uclogic 0003:5543:0003.0012: unknown global tag 0xe [ 1251.537836][T22884] uclogic 0003:5543:0003.0012: item 0 2 1 14 parsing failed [ 1251.538571][T22884] uclogic 0003:5543:0003.0012: parse failed [ 1251.622447][T22884] uclogic 0003:5543:0003.0012: probe with driver uclogic failed with error -22 [ 1251.654976][T22884] usb 4-1: USB disconnect, device number 30 [ 1252.462513][T22884] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1252.463986][T22884] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1252.488729][T29716] netlink: 'syz.3.9553': attribute type 6 has an invalid length. [ 1252.614323][ T5743] usb 6-1: new low-speed USB device number 23 using dummy_hcd [ 1252.654498][ T5821] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 1252.747581][T22884] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1252.768518][T29730] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1252.773388][ T5743] usb 6-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1252.773407][ T5743] usb 6-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1252.773421][ T5743] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1252.773438][ T5743] usb 6-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1252.773450][ T5743] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1252.777271][T29730] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1252.789514][ T5743] usb 6-1: config 0 descriptor?? [ 1252.796508][T29707] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1252.915849][ T5821] usb 2-1: Using ep0 maxpacket: 8 [ 1252.955908][ T5821] usb 2-1: config 2 has an invalid interface number: 31 but max is 0 [ 1252.955988][ T5821] usb 2-1: config 2 has no interface number 0 [ 1252.956141][ T5821] usb 2-1: config 2 interface 31 has no altsetting 0 [ 1253.057528][ T5821] usb 2-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 1253.057623][ T5821] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1253.057642][ T5821] usb 2-1: Product: syz [ 1253.057656][ T5821] usb 2-1: Manufacturer: syz [ 1253.058025][ T5821] usb 2-1: SerialNumber: syz [ 1253.680801][T22884] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1253.695046][T29712] ceph: No mds server is up or the cluster is laggy [ 1253.794561][ T5595] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 1253.939712][ T5595] usb 1-1: device descriptor read/64, error -71 [ 1254.010498][ T5743] usbhid 6-1:0.0: can't add hid device: -71 [ 1254.010621][ T5743] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1254.016494][ T5743] usb 6-1: USB disconnect, device number 23 [ 1254.367229][ T5595] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 1255.185254][ T5821] ch9200 2-1:2.31: probe with driver ch9200 failed with error -22 [ 1255.344179][ T5595] usb 1-1: device descriptor read/64, error -71 [ 1255.380226][ T5821] usb 2-1: USB disconnect, device number 26 [ 1255.470914][ T5595] usb usb1-port1: attempt power cycle [ 1255.604275][ T9] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 1255.763965][ T9] usb 4-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 1255.763993][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1255.764012][ T9] usb 4-1: Product: syz [ 1255.764024][ T9] usb 4-1: Manufacturer: syz [ 1255.764036][ T9] usb 4-1: SerialNumber: syz [ 1255.890407][T29766] FAULT_INJECTION: forcing a failure. [ 1255.890407][T29766] name failslab, interval 1, probability 0, space 0, times 0 [ 1255.890442][T29766] CPU: 0 UID: 0 PID: 29766 Comm: syz.6.9573 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1255.890468][T29766] Tainted: [L]=SOFTLOCKUP [ 1255.890475][T29766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1255.890490][T29766] Call Trace: [ 1255.890497][T29766] [ 1255.890504][T29766] dump_stack_lvl+0xe8/0x150 [ 1255.890539][T29766] should_fail_ex+0x467/0x600 [ 1255.890574][T29766] should_failslab+0xa8/0x100 [ 1255.890600][T29766] kmem_cache_alloc_noprof+0xa4/0x650 [ 1255.890621][T29766] ? skb_clone+0x212/0x3a0 [ 1255.890645][T29766] ? skb_clone+0x212/0x3a0 [ 1255.890675][T29766] skb_clone+0x212/0x3a0 [ 1255.890703][T29766] __netlink_deliver_tap+0x413/0x860 [ 1255.890740][T29766] ? netlink_deliver_tap+0x2e/0x1b0 [ 1255.890766][T29766] netlink_deliver_tap+0x19c/0x1b0 [ 1255.890799][T29766] netlink_unicast+0x7b8/0x990 [ 1255.890832][T29766] netlink_sendmsg+0x813/0xb40 [ 1255.890867][T29766] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1255.890894][T29766] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1255.890931][T29766] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1255.890955][T29766] sock_sendmsg_nosec+0x13a/0x180 [ 1255.890988][T29766] ____sys_sendmsg+0x565/0x870 [ 1255.891012][T29766] ? __might_fault+0xaf/0x130 [ 1255.891041][T29766] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1255.891074][T29766] ? import_iovec+0x73/0xa0 [ 1255.891102][T29766] ___sys_sendmsg+0x2a5/0x360 [ 1255.891125][T29766] ? __lock_acquire+0x683/0x2ce0 [ 1255.891151][T29766] ? __pfx____sys_sendmsg+0x10/0x10 [ 1255.891181][T29766] ? kstrtouint+0x6e/0xe0 [ 1255.891233][T29766] ? __fget_files+0x2a/0x420 [ 1255.891252][T29766] ? __fget_files+0x3a8/0x420 [ 1255.891280][T29766] __sys_sendmmsg+0x279/0x4d0 [ 1255.891307][T29766] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1255.891339][T29766] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1255.891380][T29766] ? ksys_write+0x248/0x270 [ 1255.891407][T29766] ? __pfx_ksys_write+0x10/0x10 [ 1255.891435][T29766] __x64_sys_sendmmsg+0xa0/0xc0 [ 1255.891455][T29766] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1255.891474][T29766] do_syscall_64+0x174/0x580 [ 1255.891496][T29766] ? trace_irq_disable+0x3b/0x140 [ 1255.891516][T29766] ? clear_bhb_loop+0x40/0x90 [ 1255.891539][T29766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1255.891558][T29766] RIP: 0033:0x7f511264de99 [ 1255.891576][T29766] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1255.891591][T29766] RSP: 002b:00007f51108a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1255.891612][T29766] RAX: ffffffffffffffda RBX: 00007f51128d5fa0 RCX: 00007f511264de99 [ 1255.891626][T29766] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 1255.891639][T29766] RBP: 00007f51108a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1255.891650][T29766] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1255.891661][T29766] R13: 00007f51128d6038 R14: 00007f51128d5fa0 R15: 00007ffef40c8a18 [ 1255.891690][T29766] [ 1255.891822][T29766] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9573'. [ 1256.389928][ T9] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 31 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 1256.449139][ T9] usb 4-1: USB disconnect, device number 31 [ 1256.482538][ T9] usblp0: removed [ 1257.472021][T29813] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1257.886736][ T5613] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1257.928645][ T5613] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1257.933823][ T5613] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1257.982597][ T5613] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1257.985554][ T5613] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1258.153335][T29831] FAULT_INJECTION: forcing a failure. [ 1258.153335][T29831] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1258.153369][T29831] CPU: 1 UID: 0 PID: 29831 Comm: syz.1.9599 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1258.153395][T29831] Tainted: [L]=SOFTLOCKUP [ 1258.153402][T29831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1258.153414][T29831] Call Trace: [ 1258.153422][T29831] [ 1258.153430][T29831] dump_stack_lvl+0xe8/0x150 [ 1258.153466][T29831] should_fail_ex+0x467/0x600 [ 1258.153503][T29831] _copy_to_user+0x31/0xb0 [ 1258.153530][T29831] simple_read_from_buffer+0xe1/0x170 [ 1258.153564][T29831] proc_fail_nth_read+0x1be/0x230 [ 1258.153590][T29831] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1258.153615][T29831] ? rw_verify_area+0x250/0x4d0 [ 1258.153644][T29831] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1258.153665][T29831] vfs_read+0x219/0xa90 [ 1258.153697][T29831] ? __pfx_vfs_read+0x10/0x10 [ 1258.153723][T29831] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1258.153748][T29831] ? lockdep_hardirqs_on+0x7a/0x110 [ 1258.153772][T29831] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1258.153795][T29831] ? mutex_lock_nested+0x152/0x1d0 [ 1258.153823][T29831] ? fdget_pos+0x252/0x320 [ 1258.153850][T29831] ksys_read+0x156/0x270 [ 1258.153876][T29831] ? __pfx_ksys_read+0x10/0x10 [ 1258.153908][T29831] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1258.153930][T29831] do_syscall_64+0x174/0x580 [ 1258.153952][T29831] ? trace_irq_disable+0x3b/0x140 [ 1258.153972][T29831] ? clear_bhb_loop+0x40/0x90 [ 1258.153996][T29831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1258.154016][T29831] RIP: 0033:0x7f69d6cfe6ce [ 1258.154033][T29831] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1258.154049][T29831] RSP: 002b:00007f69d4f95fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1258.154068][T29831] RAX: ffffffffffffffda RBX: 00007f69d4f966c0 RCX: 00007f69d6cfe6ce [ 1258.154082][T29831] RDX: 000000000000000f RSI: 00007f69d4f960a0 RDI: 0000000000000004 [ 1258.154093][T29831] RBP: 00007f69d4f96090 R08: 0000000000000000 R09: 0000000000000000 [ 1258.154103][T29831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1258.154113][T29831] R13: 00007f69d6fc6038 R14: 00007f69d6fc5fa0 R15: 00007ffe8f559fd8 [ 1258.154140][T29831] [ 1258.403733][T29838] netlink: 'syz.1.9602': attribute type 1 has an invalid length. [ 1258.456358][T29838] bond4: entered promiscuous mode [ 1258.457423][T29838] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1258.470389][T29841] netlink: 'syz.6.9603': attribute type 1 has an invalid length. [ 1258.605141][T29841] bond2: entered promiscuous mode [ 1258.605546][T29841] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1260.259551][T17208] Bluetooth: hci0: command tx timeout [ 1260.782763][T12531] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1260.947463][T29875] netlink: 56 bytes leftover after parsing attributes in process `syz.6.9613'. [ 1261.057368][T29877] netlink: 'syz.3.9614': attribute type 1 has an invalid length. [ 1261.089492][T29879] netlink: 276 bytes leftover after parsing attributes in process `syz.5.9615'. [ 1261.253064][T29877] bond5: entered promiscuous mode [ 1261.259878][T29877] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1261.732939][T12531] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1262.011296][T29905] loop3: detected capacity change from 0 to 7 [ 1262.051016][T29905] Dev loop3: unable to read RDB block 7 [ 1262.051058][T29905] loop3: AHDI p1 p2 [ 1262.051077][T29905] loop3: partition table partially beyond EOD, truncated [ 1262.105732][T29905] loop3: p1 start 1702000233 is beyond EOD, truncated [ 1262.224262][T12123] usb 2-1: new full-speed USB device number 27 using dummy_hcd [ 1262.335586][T17208] Bluetooth: hci0: command tx timeout [ 1263.263444][ T4972] Dev loop3: unable to read RDB block 7 [ 1263.263473][ T4972] loop3: AHDI p1 p2 [ 1263.263492][ T4972] loop3: partition table partially beyond EOD, truncated [ 1263.263716][ T4972] loop3: p1 start 1702000233 is beyond EOD, truncated [ 1263.292587][T12123] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1263.293292][T12123] usb 2-1: not running at top speed; connect to a high speed hub [ 1263.310860][T12123] usb 2-1: config 3 has an invalid interface number: 66 but max is 0 [ 1263.310886][T12123] usb 2-1: config 3 has no interface number 0 [ 1263.310931][T12123] usb 2-1: config 3 interface 66 altsetting 7 endpoint 0x9 has invalid maxpacket 512, setting to 64 [ 1263.310957][T12123] usb 2-1: config 3 interface 66 altsetting 7 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 1263.310980][T12123] usb 2-1: config 3 interface 66 has no altsetting 0 [ 1263.360050][T12123] usb 2-1: language id specifier not provided by device, defaulting to English [ 1263.390741][T12531] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1263.392447][T12123] usb 2-1: New USB device found, idVendor=05ab, idProduct=0060, bcdDevice=11.0d [ 1263.392474][T12123] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1263.392489][T12123] usb 2-1: Product: Я [ 1263.392501][T12123] usb 2-1: SerialNumber: Ì袐䛐詓↬╗℄黀陇뮰ꒃꀚᲸа⭃衩脰筓덯苐蕚ũ툡겉៥輦琨攅쌿噏뇟뀯뮳㼀短鄳왷繗棐ዺ鎒쮨௮炒䟤ꤏ껌윙㛄깃ଵ⩬咠騪見兂쏏ᄚ蓧㿠溜猅狕헞傁᫰㣐몢ᾪꗋე恞䡱૙톔᪪ꮰ䉬 [ 1263.493760][T29904] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1263.515514][ T4972] Dev loop3: unable to read RDB block 7 [ 1263.515544][ T4972] loop3: AHDI p1 p2 [ 1263.515564][ T4972] loop3: partition table partially beyond EOD, truncated [ 1263.515813][ T4972] loop3: p1 start 1702000233 is beyond EOD, truncated [ 1263.926755][T29929] i2c i2c-0: delete_device: Can't find device in list [ 1264.248112][T12123] usb-storage 2-1:3.66: USB Mass Storage device detected [ 1264.296121][T12123] usb-storage 2-1:3.66: Quirks match for vid 05ab pid 0060: 2 [ 1264.445291][T12531] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1264.448857][T17208] Bluetooth: hci0: command tx timeout [ 1264.458980][T12123] usb 2-1: USB disconnect, device number 27 [ 1264.922933][T29951] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.9644'. [ 1265.546053][ T5594] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1265.895082][ T5821] usb 7-1: new low-speed USB device number 23 using dummy_hcd [ 1266.053619][ T5821] usb 7-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1266.053653][ T5821] usb 7-1: config 0 interface 0 altsetting 1 endpoint 0x2 has invalid maxpacket 1040, setting to 8 [ 1266.053675][ T5821] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1266.053711][ T5821] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 1266.053733][ T5821] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1266.101247][ T5821] usb 7-1: config 0 descriptor?? [ 1266.117077][T29981] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1266.117273][T29981] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1266.484199][T17208] Bluetooth: hci0: command tx timeout [ 1266.725563][T29991] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 1266.725563][T29991] The task syz.6.9654 (29991) triggered the difference, watch for misbehavior. [ 1266.834557][ T5595] usb 2-1: new low-speed USB device number 28 using dummy_hcd [ 1266.836310][T29821] bridge0: port 1(bridge_slave_0) entered blocking state [ 1266.837443][T29821] bridge0: port 1(bridge_slave_0) entered disabled state [ 1266.838274][T29821] bridge_slave_0: entered allmulticast mode [ 1266.872061][T29821] bridge_slave_0: entered promiscuous mode [ 1266.933310][T29821] bridge0: port 2(bridge_slave_1) entered blocking state [ 1266.933504][T29821] bridge0: port 2(bridge_slave_1) entered disabled state [ 1266.933835][T29821] bridge_slave_1: entered allmulticast mode [ 1267.031956][T29821] bridge_slave_1: entered promiscuous mode [ 1267.088474][ T5595] usb 2-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1267.088508][ T5595] usb 2-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1267.088907][ T5595] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1267.088941][ T5595] usb 2-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1267.088964][ T5595] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1267.187418][ T5595] usb 2-1: config 0 descriptor?? [ 1267.193067][T29990] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1267.809456][ T5595] usbhid 2-1:0.0: can't add hid device: -71 [ 1267.810129][ T5595] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1267.858169][ T5595] usb 2-1: USB disconnect, device number 28 [ 1268.202311][T29821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1268.230044][T29821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1268.720035][ T5821] usb 7-1: string descriptor 0 read error: -71 [ 1268.746362][ T5821] usbhid 7-1:0.0: can't add hid device: -71 [ 1268.746481][ T5821] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1268.751608][T29821] team0: Port device team_slave_0 added [ 1268.793446][ T5821] usb 7-1: USB disconnect, device number 23 [ 1268.890309][T12531] bridge_slave_1: left allmulticast mode [ 1268.890343][T12531] bridge_slave_1: left promiscuous mode [ 1268.890601][T12531] bridge0: port 2(bridge_slave_1) entered disabled state [ 1268.970797][T30020] FAULT_INJECTION: forcing a failure. [ 1268.970797][T30020] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1268.970832][T30020] CPU: 1 UID: 0 PID: 30020 Comm: syz.3.9671 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1268.970858][T30020] Tainted: [L]=SOFTLOCKUP [ 1268.970866][T30020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1268.970878][T30020] Call Trace: [ 1268.970885][T30020] [ 1268.970894][T30020] dump_stack_lvl+0xe8/0x150 [ 1268.970930][T30020] should_fail_ex+0x467/0x600 [ 1268.970965][T30020] strncpy_from_user+0x36/0x2c0 [ 1268.970997][T30020] do_getname+0x77/0x250 [ 1268.971015][T30020] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.971036][T30020] __se_sys_unlinkat+0x4f/0x1a0 [ 1268.971063][T30020] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.971084][T30020] do_syscall_64+0x174/0x580 [ 1268.971107][T30020] ? trace_irq_disable+0x3b/0x140 [ 1268.971126][T30020] ? clear_bhb_loop+0x40/0x90 [ 1268.971150][T30020] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.971168][T30020] RIP: 0033:0x7fd91cf9de99 [ 1268.971186][T30020] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1268.971202][T30020] RSP: 002b:00007fd91b1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 1268.971223][T30020] RAX: ffffffffffffffda RBX: 00007fd91d225fa0 RCX: 00007fd91cf9de99 [ 1268.971238][T30020] RDX: 0000000000000200 RSI: 0000200000000440 RDI: ffffffffffffff9c [ 1268.971251][T30020] RBP: 00007fd91b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1268.971264][T30020] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1268.971275][T30020] R13: 00007fd91d226038 R14: 00007fd91d225fa0 R15: 00007fff394e8758 [ 1268.971304][T30020] [ 1269.049391][T12531] bridge_slave_0: left allmulticast mode [ 1269.078736][T12531] bridge_slave_0: left promiscuous mode [ 1269.079091][T12531] bridge0: port 1(bridge_slave_0) entered disabled state [ 1269.267918][T12531] dvmrp0: left allmulticast mode [ 1269.727622][T30041] FAULT_INJECTION: forcing a failure. [ 1269.727622][T30041] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1269.727658][T30041] CPU: 0 UID: 0 PID: 30041 Comm: syz.3.9680 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1269.727685][T30041] Tainted: [L]=SOFTLOCKUP [ 1269.727692][T30041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1269.727704][T30041] Call Trace: [ 1269.727711][T30041] [ 1269.727719][T30041] dump_stack_lvl+0xe8/0x150 [ 1269.727753][T30041] should_fail_ex+0x467/0x600 [ 1269.727789][T30041] prepare_alloc_pages+0x223/0x690 [ 1269.727819][T30041] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1269.727847][T30041] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1269.727875][T30041] ? __pfx_policy_nodemask+0x10/0x10 [ 1269.727903][T30041] ? __lock_acquire+0x683/0x2ce0 [ 1269.727930][T30041] alloc_pages_mpol+0xce/0x280 [ 1269.727958][T30041] alloc_pages_noprof+0xd2/0x2f0 [ 1269.727986][T30041] pte_alloc_one+0x22/0x380 [ 1269.728010][T30041] __pte_alloc+0x25/0x1a0 [ 1269.728044][T30041] do_pte_missing+0x1bda/0x28f0 [ 1269.728072][T30041] ? mt_find+0x186/0x630 [ 1269.728106][T30041] handle_mm_fault+0xd28/0x13f0 [ 1269.728127][T30041] ? mt_find+0x186/0x630 [ 1269.728156][T30041] ? handle_mm_fault+0xe8/0x13f0 [ 1269.728178][T30041] ? __pfx_handle_mm_fault+0x10/0x10 [ 1269.728198][T30041] ? kernel_text_address+0xa5/0xe0 [ 1269.728242][T30041] __get_user_pages+0x166b/0x2590 [ 1269.728383][T30041] get_user_pages_remote+0x307/0xb10 [ 1269.728403][T30041] ? __pfx_mtree_load+0x10/0x10 [ 1269.728434][T30041] ? __pfx_get_user_pages_remote+0x10/0x10 [ 1269.728464][T30041] ? lockdep_hardirqs_on+0x7a/0x110 [ 1269.728496][T30041] __access_remote_vm+0x222/0x6f0 [ 1269.728521][T30041] ? rt_spin_lock+0x1e0/0x400 [ 1269.728555][T30041] ? __pfx___access_remote_vm+0x10/0x10 [ 1269.728582][T30041] ? rt_spin_unlock+0x163/0x200 [ 1269.728612][T30041] environ_read+0x251/0x430 [ 1269.728651][T30041] vfs_readv+0x588/0x850 [ 1269.728670][T30041] ? __pfx_environ_read+0x10/0x10 [ 1269.728703][T30041] ? __pfx_vfs_readv+0x10/0x10 [ 1269.728734][T30041] ? __fget_files+0x2a/0x420 [ 1269.728759][T30041] ? __fget_files+0x3a8/0x420 [ 1269.728779][T30041] ? __fget_files+0x2a/0x420 [ 1269.728808][T30041] __x64_sys_preadv+0x19f/0x2c0 [ 1269.728837][T30041] ? __pfx___x64_sys_preadv+0x10/0x10 [ 1269.728873][T30041] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1269.728895][T30041] do_syscall_64+0x174/0x580 [ 1269.728918][T30041] ? trace_irq_disable+0x3b/0x140 [ 1269.728938][T30041] ? clear_bhb_loop+0x40/0x90 [ 1269.728962][T30041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1269.728981][T30041] RIP: 0033:0x7fd91cf9de99 [ 1269.728999][T30041] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1269.729015][T30041] RSP: 002b:00007fd91b1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 1269.729036][T30041] RAX: ffffffffffffffda RBX: 00007fd91d225fa0 RCX: 00007fd91cf9de99 [ 1269.729049][T30041] RDX: 0000000000000001 RSI: 0000200000001400 RDI: 0000000000000003 [ 1269.729061][T30041] RBP: 00007fd91b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1269.729071][T30041] R10: 0000000000c002a0 R11: 0000000000000246 R12: 0000000000000001 [ 1269.729082][T30041] R13: 00007fd91d226038 R14: 00007fd91d225fa0 R15: 00007fff394e8758 [ 1269.729113][T30041] [ 1270.205701][T30049] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 1270.205742][T30049] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 1270.218810][T30052] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 1270.218835][T30052] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 1270.300828][T30055] FAULT_INJECTION: forcing a failure. [ 1270.300828][T30055] name failslab, interval 1, probability 0, space 0, times 0 [ 1270.300850][T30055] CPU: 0 UID: 0 PID: 30055 Comm: syz.3.9685 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1270.300866][T30055] Tainted: [L]=SOFTLOCKUP [ 1270.300869][T30055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1270.300875][T30055] Call Trace: [ 1270.300879][T30055] [ 1270.300883][T30055] dump_stack_lvl+0xe8/0x150 [ 1270.300904][T30055] should_fail_ex+0x467/0x600 [ 1270.300923][T30055] should_failslab+0xa8/0x100 [ 1270.300937][T30055] __kmalloc_noprof+0xfe/0x780 [ 1270.300950][T30055] ? tomoyo_encode+0x2ad/0x570 [ 1270.300963][T30055] ? tomoyo_encode+0x2ad/0x570 [ 1270.300979][T30055] tomoyo_encode+0x2ad/0x570 [ 1270.300995][T30055] tomoyo_realpath_from_path+0x5fa/0x640 [ 1270.301013][T30055] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1270.301024][T30055] tomoyo_path_number_perm+0x246/0x5f0 [ 1270.301036][T30055] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1270.301047][T30055] ? __lock_acquire+0x683/0x2ce0 [ 1270.301066][T30055] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1270.301082][T30055] ? hook_file_ioctl+0x1f3/0x600 [ 1270.301108][T30055] ? lockdep_hardirqs_on+0x7a/0x110 [ 1270.301148][T30055] ? __fget_files+0x2a/0x420 [ 1270.301170][T30055] ? __fget_files+0x2a/0x420 [ 1270.301188][T30055] ? __fget_files+0x3a8/0x420 [ 1270.301203][T30055] ? __fget_files+0x2a/0x420 [ 1270.301223][T30055] security_file_ioctl+0xc3/0x2a0 [ 1270.301237][T30055] __se_sys_ioctl+0x47/0x170 [ 1270.301251][T30055] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1270.301262][T30055] do_syscall_64+0x174/0x580 [ 1270.301274][T30055] ? trace_irq_disable+0x3b/0x140 [ 1270.301285][T30055] ? clear_bhb_loop+0x40/0x90 [ 1270.301298][T30055] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1270.301308][T30055] RIP: 0033:0x7fd91cf9de99 [ 1270.301318][T30055] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1270.301327][T30055] RSP: 002b:00007fd91b1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1270.301338][T30055] RAX: ffffffffffffffda RBX: 00007fd91d225fa0 RCX: 00007fd91cf9de99 [ 1270.301346][T30055] RDX: 0000200000000000 RSI: 00000000c0105512 RDI: 0000000000000003 [ 1270.301352][T30055] RBP: 00007fd91b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1270.301359][T30055] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1270.301364][T30055] R13: 00007fd91d226038 R14: 00007fd91d225fa0 R15: 00007fff394e8758 [ 1270.301380][T30055] [ 1270.301392][T30055] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1271.199237][T12531] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1271.266368][T30081] FAULT_INJECTION: forcing a failure. [ 1271.266368][T30081] name failslab, interval 1, probability 0, space 0, times 0 [ 1271.266403][T30081] CPU: 0 UID: 0 PID: 30081 Comm: syz.3.9698 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1271.266429][T30081] Tainted: [L]=SOFTLOCKUP [ 1271.266436][T30081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1271.266447][T30081] Call Trace: [ 1271.266454][T30081] [ 1271.266462][T30081] dump_stack_lvl+0xe8/0x150 [ 1271.266498][T30081] should_fail_ex+0x467/0x600 [ 1271.266533][T30081] should_failslab+0xa8/0x100 [ 1271.266558][T30081] __kmalloc_noprof+0xfe/0x780 [ 1271.266581][T30081] ? tomoyo_encode+0x2ad/0x570 [ 1271.266613][T30081] ? tomoyo_encode+0x2ad/0x570 [ 1271.266646][T30081] tomoyo_encode+0x2ad/0x570 [ 1271.266676][T30081] tomoyo_realpath_from_path+0x5fa/0x640 [ 1271.266713][T30081] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1271.266735][T30081] tomoyo_path_number_perm+0x246/0x5f0 [ 1271.266759][T30081] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1271.266780][T30081] ? __lock_acquire+0x683/0x2ce0 [ 1271.266815][T30081] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1271.266838][T30081] ? hook_file_ioctl+0x1f3/0x600 [ 1271.266867][T30081] ? lockdep_hardirqs_on+0x7a/0x110 [ 1271.266908][T30081] ? __fget_files+0x2a/0x420 [ 1271.266933][T30081] ? __fget_files+0x2a/0x420 [ 1271.266952][T30081] ? __fget_files+0x3a8/0x420 [ 1271.266971][T30081] ? __fget_files+0x2a/0x420 [ 1271.266995][T30081] security_file_ioctl+0xc3/0x2a0 [ 1271.267020][T30081] __se_sys_ioctl+0x47/0x170 [ 1271.267051][T30081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1271.267071][T30081] do_syscall_64+0x174/0x580 [ 1271.267093][T30081] ? trace_irq_disable+0x3b/0x140 [ 1271.267112][T30081] ? clear_bhb_loop+0x40/0x90 [ 1271.267136][T30081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1271.267156][T30081] RIP: 0033:0x7fd91cf9de99 [ 1271.267173][T30081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1271.267188][T30081] RSP: 002b:00007fd91b1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1271.267208][T30081] RAX: ffffffffffffffda RBX: 00007fd91d225fa0 RCX: 00007fd91cf9de99 [ 1271.267223][T30081] RDX: 0000200000000180 RSI: 0000000000000720 RDI: 0000000000000003 [ 1271.267235][T30081] RBP: 00007fd91b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1271.267246][T30081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1271.267256][T30081] R13: 00007fd91d226038 R14: 00007fd91d225fa0 R15: 00007fff394e8758 [ 1271.267286][T30081] [ 1271.267412][T30081] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1271.324758][T12531] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1271.549784][T12531] bond0 (unregistering): Released all slaves [ 1271.599156][T29821] team0: Port device team_slave_1 added [ 1271.777099][T30096] FAULT_INJECTION: forcing a failure. [ 1271.777099][T30096] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1271.777134][T30096] CPU: 1 UID: 0 PID: 30096 Comm: syz.6.9704 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1271.777161][T30096] Tainted: [L]=SOFTLOCKUP [ 1271.777167][T30096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1271.777177][T30096] Call Trace: [ 1271.777184][T30096] [ 1271.777192][T30096] dump_stack_lvl+0xe8/0x150 [ 1271.777228][T30096] should_fail_ex+0x467/0x600 [ 1271.777267][T30096] prepare_alloc_pages+0x223/0x690 [ 1271.777299][T30096] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1271.777328][T30096] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1271.777356][T30096] ? __pfx_policy_nodemask+0x10/0x10 [ 1271.777383][T30096] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1271.777415][T30096] alloc_pages_mpol+0xce/0x280 [ 1271.777444][T30096] folio_alloc_mpol_noprof+0x3b/0x1e0 [ 1271.777472][T30096] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1271.777500][T30096] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1271.777536][T30096] do_wp_page+0x115e/0x3d90 [ 1271.777561][T30096] ? rt_spin_lock+0x1e0/0x400 [ 1271.777592][T30096] ? rt_spin_lock+0x1e0/0x400 [ 1271.777627][T30096] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1271.777653][T30096] ? preempt_count_add+0x91/0x190 [ 1271.777789][T30096] ? __pfx_do_wp_page+0x10/0x10 [ 1271.777806][T30096] ? rt_spin_lock+0x2ce/0x400 [ 1271.777836][T30096] ? __pfx_rt_spin_lock+0x10/0x10 [ 1271.777869][T30096] ? pte_offset_map_rw_nolock+0xea/0x160 [ 1271.777903][T30096] handle_mm_fault+0xa03/0x13f0 [ 1271.777931][T30096] ? handle_mm_fault+0xe8/0x13f0 [ 1271.777953][T30096] ? __pfx_handle_mm_fault+0x10/0x10 [ 1271.777988][T30096] ? __lock_acquire+0x683/0x2ce0 [ 1271.778014][T30096] ? lock_mm_and_find_vma+0xa7/0x340 [ 1271.778042][T30096] do_user_addr_fault+0x744/0x1340 [ 1271.778078][T30096] exc_page_fault+0x6a/0xc0 [ 1271.778104][T30096] asm_exc_page_fault+0x26/0x30 [ 1271.778124][T30096] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 1271.778152][T30096] Code: 2a 05 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 1271.778167][T30096] RSP: 0018:ffffc9000e72f8d8 EFLAGS: 00050206 [ 1271.778185][T30096] RAX: ffffffff84c08701 RBX: ffff88802c270000 RCX: 0000000000000980 [ 1271.778199][T30096] RDX: 0000000000000000 RSI: ffff88802c270680 RDI: 0000200000001000 [ 1271.778217][T30096] RBP: ffffc9000e72fa48 R08: ffff88802c270fff R09: 1ffff1100584e1ff [ 1271.778232][T30096] R10: dffffc0000000000 R11: ffffed100584e200 R12: 1ffff92001ce5faf [ 1271.778246][T30096] R13: 0000200000000980 R14: ffffc9000e72fd88 R15: 0000000000001000 [ 1271.778267][T30096] ? _copy_to_iter+0x1e1/0x1810 [ 1271.778295][T30096] _copy_to_iter+0x255/0x1810 [ 1271.778314][T30096] ? finish_task_switch+0x412/0xc60 [ 1271.778349][T30096] ? __pfx__copy_to_iter+0x10/0x10 [ 1271.778380][T30096] ? lockdep_hardirqs_on+0x7a/0x110 [ 1271.778405][T30096] copy_page_to_iter+0x23f/0x330 [ 1271.778430][T30096] anon_pipe_read+0x4fd/0x10c0 [ 1271.778509][T30096] ? __lock_acquire+0x683/0x2ce0 [ 1271.778539][T30096] ? __pfx_anon_pipe_read+0x10/0x10 [ 1271.778583][T30096] ? bpf_lsm_file_permission+0x9/0x20 [ 1271.778613][T30096] ? security_file_permission+0x75/0x260 [ 1271.778645][T30096] vfs_read+0x59e/0xa90 [ 1271.778679][T30096] ? __pfx_vfs_read+0x10/0x10 [ 1271.778714][T30096] ? __fget_files+0x2a/0x420 [ 1271.778745][T30096] ksys_read+0x156/0x270 [ 1271.778772][T30096] ? __pfx_ksys_read+0x10/0x10 [ 1271.778806][T30096] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1271.778827][T30096] do_syscall_64+0x174/0x580 [ 1271.778850][T30096] ? trace_irq_disable+0x3b/0x140 [ 1271.778870][T30096] ? clear_bhb_loop+0x40/0x90 [ 1271.778894][T30096] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1271.778914][T30096] RIP: 0033:0x7f511264de99 [ 1271.778932][T30096] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1271.778945][T30096] RSP: 002b:00007f5110885028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1271.778963][T30096] RAX: ffffffffffffffda RBX: 00007f51128d6090 RCX: 00007f511264de99 [ 1271.778976][T30096] RDX: 0000000000002020 RSI: 0000200000000980 RDI: 0000000000000003 [ 1271.778986][T30096] RBP: 00007f5110885090 R08: 0000000000000000 R09: 0000000000000000 [ 1271.778997][T30096] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1271.779006][T30096] R13: 00007f51128d6128 R14: 00007f51128d6090 R15: 00007ffef40c8a18 [ 1271.779032][T30096] [ 1272.119724][T29821] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1272.119741][T29821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1272.119766][T29821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1272.137444][T29821] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1272.137461][T29821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1272.137485][T29821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1273.169108][T29821] hsr_slave_0: entered promiscuous mode [ 1273.170305][T29821] hsr_slave_1: entered promiscuous mode [ 1273.171008][T29821] debugfs: 'hsr0' already exists in 'hsr' [ 1273.171024][T29821] Cannot create hsr debugfs directory [ 1274.721372][T30153] FAULT_INJECTION: forcing a failure. [ 1274.721372][T30153] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1274.721409][T30153] CPU: 1 UID: 0 PID: 30153 Comm: syz.3.9724 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1274.721436][T30153] Tainted: [L]=SOFTLOCKUP [ 1274.721442][T30153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1274.721458][T30153] Call Trace: [ 1274.721465][T30153] [ 1274.721473][T30153] dump_stack_lvl+0xe8/0x150 [ 1274.721510][T30153] should_fail_ex+0x467/0x600 [ 1274.721547][T30153] _copy_from_user+0x2d/0xb0 [ 1274.721572][T30153] ___sys_sendmsg+0x1c6/0x360 [ 1274.721599][T30153] ? __lock_acquire+0x683/0x2ce0 [ 1274.721626][T30153] ? __pfx____sys_sendmsg+0x10/0x10 [ 1274.721681][T30153] ? __fget_files+0x2a/0x420 [ 1274.721702][T30153] ? __fget_files+0x3a8/0x420 [ 1274.721733][T30153] __x64_sys_sendmsg+0x1b7/0x290 [ 1274.721761][T30153] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1274.721803][T30153] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1274.721825][T30153] do_syscall_64+0x174/0x580 [ 1274.721850][T30153] ? trace_irq_disable+0x3b/0x140 [ 1274.721870][T30153] ? clear_bhb_loop+0x40/0x90 [ 1274.721893][T30153] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1274.721913][T30153] RIP: 0033:0x7fd91cf9de99 [ 1274.721931][T30153] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1274.721946][T30153] RSP: 002b:00007fd91b1f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1274.721968][T30153] RAX: ffffffffffffffda RBX: 00007fd91d225fa0 RCX: 00007fd91cf9de99 [ 1274.721982][T30153] RDX: 0000000004000000 RSI: 0000200000000380 RDI: 0000000000000003 [ 1274.721995][T30153] RBP: 00007fd91b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1274.722007][T30153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1274.722018][T30153] R13: 00007fd91d226038 R14: 00007fd91d225fa0 R15: 00007fff394e8758 [ 1274.722049][T30153] [ 1274.762838][T30147] netlink: 'syz.1.9719': attribute type 6 has an invalid length. [ 1275.256739][ T5267] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1277.107306][T12531] hsr_slave_0: left promiscuous mode [ 1277.688144][T12531] hsr_slave_1: left promiscuous mode [ 1277.690691][T12531] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1277.690718][T12531] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1277.701845][T30196] netlink: 'syz.1.9737': attribute type 6 has an invalid length. [ 1277.767955][T12531] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1277.767983][T12531] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1277.917042][T12531] veth1_macvtap: left promiscuous mode [ 1277.917107][T12531] veth0_macvtap: left promiscuous mode [ 1277.927805][T12531] veth1_vlan: left promiscuous mode [ 1277.928005][T12531] veth0_vlan: left promiscuous mode [ 1277.955259][T30193] ceph: No mds server is up or the cluster is laggy [ 1279.075307][T12531] team0 (unregistering): Port device team_slave_1 removed [ 1279.196534][T12531] team0 (unregistering): Port device team_slave_0 removed [ 1281.028390][T30251] FAULT_INJECTION: forcing a failure. [ 1281.028390][T30251] name failslab, interval 1, probability 0, space 0, times 0 [ 1281.028424][T30251] CPU: 1 UID: 0 PID: 30251 Comm: syz.3.9756 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1281.028451][T30251] Tainted: [L]=SOFTLOCKUP [ 1281.028458][T30251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1281.028469][T30251] Call Trace: [ 1281.028476][T30251] [ 1281.028484][T30251] dump_stack_lvl+0xe8/0x150 [ 1281.028521][T30251] should_fail_ex+0x467/0x600 [ 1281.028558][T30251] should_failslab+0xa8/0x100 [ 1281.028584][T30251] __kmalloc_noprof+0xfe/0x780 [ 1281.028607][T30251] ? tomoyo_encode+0x2ad/0x570 [ 1281.028631][T30251] ? tomoyo_encode+0x2ad/0x570 [ 1281.028663][T30251] tomoyo_encode+0x2ad/0x570 [ 1281.028693][T30251] tomoyo_realpath_from_path+0x5fa/0x640 [ 1281.028734][T30251] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1281.028759][T30251] tomoyo_path_number_perm+0x246/0x5f0 [ 1281.028789][T30251] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1281.028810][T30251] ? __lock_acquire+0x683/0x2ce0 [ 1281.028845][T30251] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1281.028867][T30251] ? hook_file_ioctl+0x1f3/0x600 [ 1281.028898][T30251] ? lockdep_hardirqs_on+0x7a/0x110 [ 1281.028938][T30251] ? __fget_files+0x2a/0x420 [ 1281.028962][T30251] ? __fget_files+0x2a/0x420 [ 1281.028982][T30251] ? __fget_files+0x3a8/0x420 [ 1281.029001][T30251] ? __fget_files+0x2a/0x420 [ 1281.029026][T30251] security_file_ioctl+0xc3/0x2a0 [ 1281.029051][T30251] __se_sys_ioctl+0x47/0x170 [ 1281.029078][T30251] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1281.029100][T30251] do_syscall_64+0x174/0x580 [ 1281.029122][T30251] ? trace_irq_disable+0x3b/0x140 [ 1281.029141][T30251] ? clear_bhb_loop+0x40/0x90 [ 1281.029164][T30251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1281.029182][T30251] RIP: 0033:0x7fd91cf9de99 [ 1281.029199][T30251] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1281.029214][T30251] RSP: 002b:00007fd91b1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1281.029232][T30251] RAX: ffffffffffffffda RBX: 00007fd91d225fa0 RCX: 00007fd91cf9de99 [ 1281.029253][T30251] RDX: 00002000000006c0 RSI: 00000000c0d05640 RDI: 0000000000000003 [ 1281.029266][T30251] RBP: 00007fd91b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1281.029278][T30251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1281.029289][T30251] R13: 00007fd91d226038 R14: 00007fd91d225fa0 R15: 00007fff394e8758 [ 1281.029320][T30251] [ 1281.029350][T30251] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1282.135921][T30277] FAULT_INJECTION: forcing a failure. [ 1282.135921][T30277] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1282.135979][T30277] CPU: 1 UID: 0 PID: 30277 Comm: syz.3.9765 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1282.136007][T30277] Tainted: [L]=SOFTLOCKUP [ 1282.136014][T30277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1282.136027][T30277] Call Trace: [ 1282.136035][T30277] [ 1282.136043][T30277] dump_stack_lvl+0xe8/0x150 [ 1282.136081][T30277] should_fail_ex+0x467/0x600 [ 1282.136117][T30277] strncpy_from_user+0x36/0x2c0 [ 1282.136158][T30277] do_getname+0x77/0x250 [ 1282.136185][T30277] do_sys_openat2+0xcc/0x200 [ 1282.136210][T30277] ? __pfx_do_sys_openat2+0x10/0x10 [ 1282.136235][T30277] ? ksys_write+0x248/0x270 [ 1282.136267][T30277] ? __pfx_ksys_write+0x10/0x10 [ 1282.136295][T30277] __x64_sys_openat+0x138/0x170 [ 1282.136318][T30277] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1282.136338][T30277] do_syscall_64+0x174/0x580 [ 1282.136363][T30277] ? trace_irq_disable+0x3b/0x140 [ 1282.136383][T30277] ? clear_bhb_loop+0x40/0x90 [ 1282.136408][T30277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1282.136428][T30277] RIP: 0033:0x7fd91cf5e6ce [ 1282.136446][T30277] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1282.136462][T30277] RSP: 002b:00007fd91b1f5b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1282.136483][T30277] RAX: ffffffffffffffda RBX: 00007fd91b1f66c0 RCX: 00007fd91cf5e6ce [ 1282.136497][T30277] RDX: 00000000000a2c25 RSI: 00007fd91b1f5c00 RDI: ffffffffffffff9c [ 1282.136511][T30277] RBP: 00007fd91b1f5c00 R08: 0000000000000000 R09: 0000000000000000 [ 1282.136524][T30277] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 1282.136537][T30277] R13: 00007fd91d226038 R14: 00007fd91d225fa0 R15: 00007fff394e8758 [ 1282.136568][T30277] [ 1282.339612][ T5267] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1283.586750][T30300] Bluetooth: MGMT ver 1.23 [ 1283.586795][T30300] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 1284.596185][T30334] FAULT_INJECTION: forcing a failure. [ 1284.596185][T30334] name failslab, interval 1, probability 0, space 0, times 0 [ 1284.596219][T30334] CPU: 1 UID: 0 PID: 30334 Comm: syz.3.9785 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1284.596245][T30334] Tainted: [L]=SOFTLOCKUP [ 1284.596253][T30334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1284.596265][T30334] Call Trace: [ 1284.596273][T30334] [ 1284.596282][T30334] dump_stack_lvl+0xe8/0x150 [ 1284.596318][T30334] should_fail_ex+0x467/0x600 [ 1284.596355][T30334] should_failslab+0xa8/0x100 [ 1284.596382][T30334] __kmalloc_noprof+0xfe/0x780 [ 1284.596406][T30334] ? tomoyo_encode+0x2ad/0x570 [ 1284.596431][T30334] ? tomoyo_encode+0x2ad/0x570 [ 1284.596462][T30334] tomoyo_encode+0x2ad/0x570 [ 1284.596490][T30334] tomoyo_realpath_from_path+0x5fa/0x640 [ 1284.596526][T30334] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1284.596548][T30334] tomoyo_path_number_perm+0x246/0x5f0 [ 1284.596570][T30334] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1284.596591][T30334] ? __lock_acquire+0x683/0x2ce0 [ 1284.596626][T30334] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1284.596648][T30334] ? hook_file_ioctl+0x1f3/0x600 [ 1284.596676][T30334] ? lockdep_hardirqs_on+0x7a/0x110 [ 1284.596717][T30334] ? __fget_files+0x2a/0x420 [ 1284.596750][T30334] ? __fget_files+0x2a/0x420 [ 1284.596768][T30334] ? __fget_files+0x3a8/0x420 [ 1284.596790][T30334] ? __fget_files+0x2a/0x420 [ 1284.596815][T30334] security_file_ioctl+0xc3/0x2a0 [ 1284.596839][T30334] __se_sys_ioctl+0x47/0x170 [ 1284.596866][T30334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1284.596888][T30334] do_syscall_64+0x174/0x580 [ 1284.596911][T30334] ? trace_irq_disable+0x3b/0x140 [ 1284.596936][T30334] ? clear_bhb_loop+0x40/0x90 [ 1284.596960][T30334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1284.596980][T30334] RIP: 0033:0x7fd91cf9de99 [ 1284.596998][T30334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1284.597014][T30334] RSP: 002b:00007fd91b1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1284.597035][T30334] RAX: ffffffffffffffda RBX: 00007fd91d225fa0 RCX: 00007fd91cf9de99 [ 1284.597049][T30334] RDX: 0000200000000540 RSI: 00000000000007a8 RDI: 0000000000000003 [ 1284.597063][T30334] RBP: 00007fd91b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1284.597074][T30334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1284.597086][T30334] R13: 00007fd91d226038 R14: 00007fd91d225fa0 R15: 00007fff394e8758 [ 1284.597118][T30334] [ 1284.597292][T30334] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1285.298854][T30344] Driver unsupported XDP return value 0 on prog (id 1276) dev N/A, expect packet loss! [ 1286.628195][T30398] netlink: zone id is out of range [ 1286.628210][T30398] netlink: zone id is out of range [ 1286.628219][T30398] netlink: zone id is out of range [ 1286.628227][T30398] netlink: zone id is out of range [ 1286.628235][T30398] netlink: zone id is out of range [ 1286.628243][T30398] netlink: zone id is out of range [ 1286.628558][T30398] netlink: get zone limit has 8 unknown bytes [ 1289.352902][T29821] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1289.381105][T29821] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1289.383814][T29821] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1289.615717][T29821] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1289.634519][T29821] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1289.710356][T29821] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1289.715942][T29821] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1289.827340][T29821] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1290.232386][T29821] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1290.344046][T29821] 8021q: adding VLAN 0 to HW filter on device team0 [ 1290.473155][T12534] bridge0: port 1(bridge_slave_0) entered blocking state [ 1290.473343][T12534] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1290.501972][T30509] netlink: 1688 bytes leftover after parsing attributes in process `syz.1.9844'. [ 1290.566027][T12531] bridge0: port 2(bridge_slave_1) entered blocking state [ 1290.566157][T12531] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1291.030693][T30539] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9855'. [ 1291.158883][T30532] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1291.503498][T30555] netlink: 1688 bytes leftover after parsing attributes in process `syz.5.9859'. [ 1293.502444][T30600] netlink: 24 bytes leftover after parsing attributes in process `syz.6.9873'. [ 1293.514334][T29821] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1293.703027][T29821] veth0_vlan: entered promiscuous mode [ 1293.743294][T29821] veth1_vlan: entered promiscuous mode [ 1294.115140][T29821] veth0_macvtap: entered promiscuous mode [ 1294.161010][T29821] veth1_macvtap: entered promiscuous mode [ 1295.165701][T29821] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1295.180658][T29821] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1295.289897][T12531] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1295.291085][T12531] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1295.296398][T12531] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1295.296837][T12531] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1296.007621][ T4104] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1296.007641][ T4104] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1296.530005][T30664] tmpfs: Unsupported parameter 'huge' [ 1296.749308][T12531] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1296.749322][T12531] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1297.368985][T30680] tmpfs: Bad value for 'mpol' [ 1300.039072][T30739] netlink: 'syz.0.9924': attribute type 4 has an invalid length. [ 1300.149216][T30733] bridge_slave_0: left allmulticast mode [ 1300.149237][T30733] bridge_slave_0: left promiscuous mode [ 1300.149405][T30733] bridge0: port 1(bridge_slave_0) entered disabled state [ 1300.407644][ T1341] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.407698][ T1341] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.763820][T30733] bridge_slave_1: left allmulticast mode [ 1300.763851][T30733] bridge_slave_1: left promiscuous mode [ 1300.765136][T30733] bridge0: port 2(bridge_slave_1) entered disabled state [ 1302.390824][T30733] bond0: (slave bond_slave_0): Releasing backup interface [ 1302.475273][T30733] bond0: (slave bond_slave_1): Releasing backup interface [ 1302.597390][T30733] team0: Port device team_slave_0 removed [ 1302.812740][T30733] team0: Port device team_slave_1 removed [ 1302.813154][T30733] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1302.882398][T30733] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1302.933132][T30733] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1303.370409][T30779] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1304.037137][ T36] audit: type=1804 audit(1785320638.854:3389): pid=30790 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.0.9945" name="/newroot/8/cgroup.controllers" dev="tmpfs" ino=63 res=1 errno=0 [ 1304.277356][ T36] audit: type=1800 audit(1785320639.074:3390): pid=30790 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.0.9945" name="cgroup.controllers" dev="tmpfs" ino=63 res=0 errno=0 [ 1306.034012][T17208] Bluetooth: hci1: Malformed LE Event: 0x0b [ 1311.112812][T30866] tipc: Enabled bearer , priority 0 [ 1311.322617][ T36] audit: type=1326 audit(1785320646.194:3391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=30869 comm="syz.0.9976" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa4c803de99 code=0x0 [ 1311.435146][ T9] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 1311.604457][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 1311.612237][ T9] usb 2-1: config 0 has no interfaces? [ 1311.625213][ T9] usb 2-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 1311.625241][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1311.625261][ T9] usb 2-1: Product: syz [ 1311.625275][ T9] usb 2-1: Manufacturer: syz [ 1311.625289][ T9] usb 2-1: SerialNumber: syz [ 1311.643858][ T9] usb 2-1: config 0 descriptor?? [ 1312.664031][ T5613] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1312.703528][ T5613] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1312.722083][ T5613] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1312.775944][ T5613] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1312.779189][ T5613] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1313.330709][ T5743] usb 2-1: USB disconnect, device number 29 [ 1313.690432][T30861] tipc: Disabling bearer [ 1313.864200][ T5743] usb 1-1: new full-speed USB device number 26 using dummy_hcd [ 1314.076388][ T5743] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1314.076418][ T5743] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1314.076457][ T5743] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1314.076479][ T5743] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1314.462211][ T5743] usb 1-1: usb_control_msg returned -32 [ 1314.462257][ T5743] usbtmc 1-1:16.0: can't read capabilities [ 1314.965873][T17208] Bluetooth: hci2: command tx timeout [ 1314.985666][T30951] usbtmc 1-1:16.0: usbtmc_ioctl_request failed -32 [ 1314.992368][T12123] usb 1-1: USB disconnect, device number 26 [ 1315.423077][ T1028] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1316.343135][ T5821] libceph: connect (1)[c::]:6789 error -101 [ 1316.343319][ T5821] libceph: mon0 (1)[c::]:6789 connect error [ 1316.347254][ T5821] libceph: connect (1)[c::]:6789 error -101 [ 1316.347421][ T5821] libceph: mon0 (1)[c::]:6789 connect error [ 1316.508363][T30992] ceph: No mds server is up or the cluster is laggy [ 1316.625738][ T5821] libceph: connect (1)[c::]:6789 error -101 [ 1316.626259][ T5821] libceph: mon0 (1)[c::]:6789 connect error [ 1317.045152][T17208] Bluetooth: hci2: command tx timeout [ 1317.817644][T17208] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 1317.817672][T17208] CPU: 1 UID: 0 PID: 17208 Comm: kworker/u9:0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1317.817702][T17208] Tainted: [L]=SOFTLOCKUP [ 1317.817709][T17208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1317.817722][T17208] Workqueue: hci1 hci_rx_work [ 1317.817845][T17208] Call Trace: [ 1317.817854][T17208] [ 1317.817864][T17208] dump_stack_lvl+0xe8/0x150 [ 1317.817899][T17208] sysfs_create_dir_ns+0x271/0x2a0 [ 1317.817957][T17208] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1317.817983][T17208] ? rt_spin_unlock+0x163/0x200 [ 1317.818018][T17208] kobject_add_internal+0x62c/0xce0 [ 1317.818083][T17208] kobject_add+0x163/0x240 [ 1317.818110][T17208] ? rt_spin_unlock+0x157/0x200 [ 1317.818147][T17208] ? __pfx_kobject_add+0x10/0x10 [ 1317.818182][T17208] ? get_device_parent+0x370/0x3a0 [ 1317.818277][T17208] device_add+0x3fa/0xb80 [ 1317.818304][T17208] hci_conn_add_sysfs+0xd5/0x210 [ 1317.818368][T17208] le_conn_complete_evt+0xfef/0x1580 [ 1317.818455][T17208] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1317.818480][T17208] ? lockdep_hardirqs_on+0x7a/0x110 [ 1317.818505][T17208] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1317.818530][T17208] ? rt_mutex_slowunlock+0x219/0x460 [ 1317.818558][T17208] ? skb_pull_data+0xf0/0x200 [ 1317.818591][T17208] hci_le_conn_complete_evt+0x187/0x470 [ 1317.818622][T17208] hci_event_packet+0x67a/0xf10 [ 1317.818680][T17208] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1317.818706][T17208] ? __pfx_hci_event_packet+0x10/0x10 [ 1317.818728][T17208] ? rt_spin_unlock+0x157/0x200 [ 1317.818766][T17208] ? hci_send_to_monitor+0xe2/0x590 [ 1317.818824][T17208] hci_rx_work+0x3ee/0x1020 [ 1317.818853][T17208] ? process_scheduled_works+0xa20/0x14e0 [ 1317.818878][T17208] process_scheduled_works+0xa8e/0x14e0 [ 1317.818932][T17208] ? __pfx_process_scheduled_works+0x10/0x10 [ 1317.818964][T17208] ? assign_work+0x3cf/0x5d0 [ 1317.818992][T17208] worker_thread+0xa47/0xfb0 [ 1317.819040][T17208] kthread+0x388/0x470 [ 1317.819070][T17208] ? __pfx_worker_thread+0x10/0x10 [ 1317.819091][T17208] ? __pfx_kthread+0x10/0x10 [ 1317.819122][T17208] ret_from_fork+0x514/0xb70 [ 1317.819190][T17208] ? __pfx_ret_from_fork+0x10/0x10 [ 1317.819217][T17208] ? __switch_to+0xc89/0x1420 [ 1317.819288][T17208] ? __pfx_kthread+0x10/0x10 [ 1317.819319][T17208] ret_from_fork_asm+0x1a/0x30 [ 1317.819362][T17208] [ 1317.819499][T17208] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1317.819539][T17208] Bluetooth: hci1: failed to register connection device [ 1318.674265][T29738] usb 1-1: new full-speed USB device number 27 using dummy_hcd [ 1318.866802][T29738] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1318.866836][T29738] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1318.866873][T29738] usb 1-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1318.866925][T29738] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1318.869292][T29738] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1318.869320][T29738] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1318.869339][T29738] usb 1-1: Product: syz [ 1318.869353][T29738] usb 1-1: Manufacturer: syz [ 1318.869367][T29738] usb 1-1: SerialNumber: syz [ 1318.905159][T31042] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1319.111161][T31042] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1319.124690][T17208] Bluetooth: hci2: command tx timeout [ 1321.233378][T17208] Bluetooth: hci2: command tx timeout [ 1328.414498][T29738] cdc_ncm 1-1:1.0: bind() failure [ 1328.423328][T29738] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 1328.423378][T29738] cdc_ncm 1-1:1.1: bind() failure [ 1329.317653][T31232] netlink: 'syz.5.10130': attribute type 10 has an invalid length. [ 1329.438762][T31237] netlink: 24 bytes leftover after parsing attributes in process `syz.5.10130'. [ 1330.712256][ T5613] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1330.803407][ T5613] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1330.813549][ T5613] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1330.858198][ T5613] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1330.859048][ T5613] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1333.064475][T17208] Bluetooth: hci3: command tx timeout [ 1333.727591][ T5613] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1333.800871][ T5613] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1333.812880][ T5613] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1333.823770][ T5613] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1333.839049][ T5613] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1335.149841][T17208] Bluetooth: hci3: command tx timeout [ 1336.049518][T17208] Bluetooth: hci6: command tx timeout [ 1337.204922][T17208] Bluetooth: hci3: command tx timeout [ 1338.084259][T17208] Bluetooth: hci6: command tx timeout [ 1339.284821][T17208] Bluetooth: hci3: command tx timeout [ 1340.191515][T17208] Bluetooth: hci6: command tx timeout [ 1342.266619][T17208] Bluetooth: hci6: command tx timeout [ 1344.390147][ T5613] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1344.428460][ T5613] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1344.429777][ T5613] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1344.432066][ T5613] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1344.432721][ T5613] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1345.779731][ T1028] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1346.129423][T31232] team0: Port device dummy0 added [ 1346.704809][T17208] Bluetooth: hci7: command tx timeout [ 1346.854908][ T1028] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1347.646963][T31237] ================================================================== [ 1347.646973][T31237] BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x400 [ 1347.647053][T31237] Read of size 1 at addr ffff888011cc87e8 by task syz.5.10130/31237 [ 1347.647063][T31237] [ 1347.647099][T31237] CPU: 0 UID: 0 PID: 31237 Comm: syz.5.10130 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1347.647114][T31237] Tainted: [L]=SOFTLOCKUP [ 1347.647118][T31237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1347.647125][T31237] Call Trace: [ 1347.647130][T31237] [ 1347.647135][T31237] dump_stack_lvl+0xe8/0x150 [ 1347.647154][T31237] print_address_description+0x55/0x1e0 [ 1347.647169][T31237] ? rt_spin_lock+0x83/0x400 [ 1347.647186][T31237] print_report+0x58/0x70 [ 1347.647199][T31237] kasan_report+0x117/0x150 [ 1347.647212][T31237] ? rt_spin_lock+0x83/0x400 [ 1347.647227][T31237] ? bt_accept_unlink+0x7d/0x2f0 [ 1347.647275][T31237] __kasan_check_byte+0x2a/0x40 [ 1347.647287][T31237] lock_acquire+0x84/0x350 [ 1347.647299][T31237] ? __local_bh_disable_ip+0x3c/0x420 [ 1347.647314][T31237] rt_spin_lock+0x83/0x400 [ 1347.647327][T31237] ? bt_accept_unlink+0x7d/0x2f0 [ 1347.647339][T31237] ? __pfx_rt_spin_lock+0x10/0x10 [ 1347.647353][T31237] ? rcu_is_watching+0x15/0xb0 [ 1347.647366][T31237] ? __local_bh_disable_ip+0x3c/0x420 [ 1347.647378][T31237] ? bt_accept_unlink+0x61/0x2f0 [ 1347.647390][T31237] bt_accept_unlink+0x7d/0x2f0 [ 1347.647402][T31237] ? bt_accept_unlink+0x61/0x2f0 [ 1347.647414][T31237] l2cap_sock_teardown_cb+0x17e/0x490 [ 1347.647447][T31237] l2cap_chan_del+0x98/0x600 [ 1347.647459][T31237] l2cap_conn_del+0x2f2/0x520 [ 1347.647474][T31237] ? __pfx_l2cap_disconn_cfm+0x10/0x10 [ 1347.647489][T31237] hci_conn_hash_flush+0x105/0x260 [ 1347.647500][T31237] hci_dev_close_sync+0x7fc/0x10a0 [ 1347.647541][T31237] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 1347.647554][T31237] ? lockdep_hardirqs_on+0x7a/0x110 [ 1347.647566][T31237] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1347.647579][T31237] ? mutex_lock_nested+0x152/0x1d0 [ 1347.647592][T31237] ? hci_unregister_dev+0x22a/0x5b0 [ 1347.647604][T31237] hci_unregister_dev+0x232/0x5b0 [ 1347.647616][T31237] vhci_release+0x170/0x1c0 [ 1347.647669][T31237] ? __pfx_vhci_release+0x10/0x10 [ 1347.647679][T31237] __fput+0x42a/0xa80 [ 1347.647691][T31237] task_work_run+0x1d9/0x270 [ 1347.647701][T31237] ? __pfx_task_work_run+0x10/0x10 [ 1347.647711][T31237] ? do_exit+0x735/0x2360 [ 1347.647719][T31237] ? kmem_cache_free+0x187/0x6c0 [ 1347.647731][T31237] ? put_net+0x191/0x260 [ 1347.647772][T31237] ? do_exit+0x735/0x2360 [ 1347.647781][T31237] do_exit+0x73a/0x2360 [ 1347.647790][T31237] ? lockdep_hardirqs_on+0x7a/0x110 [ 1347.647801][T31237] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1347.647813][T31237] ? __pfx_do_exit+0x10/0x10 [ 1347.647822][T31237] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1347.647835][T31237] ? rt_spin_lock+0x1e0/0x400 [ 1347.647851][T31237] ? rt_spin_unlock+0x157/0x200 [ 1347.647865][T31237] do_group_exit+0x22d/0x2f0 [ 1347.647874][T31237] ? rt_spin_unlock+0x163/0x200 [ 1347.647888][T31237] get_signal+0x121b/0x12c0 [ 1347.647925][T31237] arch_do_signal_or_restart+0xbb/0x860 [ 1347.647942][T31237] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1347.647955][T31237] ? __x64_sys_sendmsg+0x263/0x290 [ 1347.647973][T31237] exit_to_user_mode_loop+0x104/0x730 [ 1347.648021][T31237] ? rcu_is_watching+0x15/0xb0 [ 1347.648034][T31237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.648045][T31237] do_syscall_64+0x353/0x580 [ 1347.648056][T31237] ? trace_irq_disable+0x3b/0x140 [ 1347.648067][T31237] ? clear_bhb_loop+0x40/0x90 [ 1347.648078][T31237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.648089][T31237] RIP: 0033:0x7fd49779de99 [ 1347.648099][T31237] Code: Unable to access opcode bytes at 0x7fd49779de6f. [ 1347.648131][T31237] RSP: 002b:00007fd494d4b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1347.648146][T31237] RAX: 0000000000000034 RBX: 00007fd497a26450 RCX: 00007fd49779de99 [ 1347.648154][T31237] RDX: 0000000004000000 RSI: 00002000000001c0 RDI: 000000000000000a [ 1347.648162][T31237] RBP: 00007fd497833eaf R08: 0000000000000000 R09: 0000000000000000 [ 1347.648169][T31237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1347.648175][T31237] R13: 00007fd497a264e8 R14: 00007fd497a26450 R15: 00007ffc5d241088 [ 1347.648186][T31237] [ 1347.648190][T31237] [ 1347.648197][T31237] Allocated by task 5592: [ 1347.648227][T31237] kasan_save_track+0x3e/0x80 [ 1347.648237][T31237] __kasan_kmalloc+0x93/0xb0 [ 1347.648250][T31237] __kmalloc_cache_noprof+0x3d2/0x6b0 [ 1347.648260][T31237] __pollwait+0x27f/0x430 [ 1347.648273][T31237] pipe_poll+0xf3/0x4b0 [ 1347.648285][T31237] do_select+0x104c/0x1610 [ 1347.648298][T31237] core_sys_select+0x86f/0xb40 [ 1347.648310][T31237] __se_sys_pselect6+0x267/0x320 [ 1347.648324][T31237] do_syscall_64+0x174/0x580 [ 1347.648334][T31237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.648343][T31237] [ 1347.648345][T31237] Freed by task 5592: [ 1347.648349][T31237] kasan_save_track+0x3e/0x80 [ 1347.648358][T31237] kasan_save_free_info+0x40/0x50 [ 1347.648371][T31237] __kasan_slab_free+0x5c/0x80 [ 1347.648380][T31237] kfree+0x1c5/0x6c0 [ 1347.648387][T31237] poll_freewait+0x1d2/0x240 [ 1347.648400][T31237] do_select+0x157c/0x1610 [ 1347.648412][T31237] core_sys_select+0x86f/0xb40 [ 1347.648424][T31237] __se_sys_pselect6+0x267/0x320 [ 1347.648437][T31237] do_syscall_64+0x174/0x580 [ 1347.648447][T31237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.648456][T31237] [ 1347.648459][T31237] The buggy address belongs to the object at ffff888011cc8000 [ 1347.648459][T31237] which belongs to the cache kmalloc-4k of size 4096 [ 1347.648470][T31237] The buggy address is located 2024 bytes inside of [ 1347.648470][T31237] freed 4096-byte region [ffff888011cc8000, ffff888011cc9000) [ 1347.648481][T31237] [ 1347.648484][T31237] The buggy address belongs to the physical page: [ 1347.648494][T31237] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cc8 [ 1347.648504][T31237] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1347.648512][T31237] flags: 0x80000000000040(head|node=0|zone=1) [ 1347.648521][T31237] page_type: f5(slab) [ 1347.648531][T31237] raw: 0080000000000040 ffff88813ffb2140 dead000000000100 dead000000000122 [ 1347.648540][T31237] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 1347.648549][T31237] head: 0080000000000040 ffff88813ffb2140 dead000000000100 dead000000000122 [ 1347.648557][T31237] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 1347.648566][T31237] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1347.648574][T31237] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 1347.648579][T31237] page dumped because: kasan: bad access detected [ 1347.648587][T31237] page_owner tracks the page as allocated [ 1347.648591][T31237] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4972, tgid 4972 (udevd), ts 222885548016, free_ts 218721310617 [ 1347.648609][T31237] post_alloc_hook+0x1f9/0x250 [ 1347.648618][T31237] get_page_from_freelist+0x262a/0x26a0 [ 1347.648629][T31237] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1347.648640][T31237] allocate_slab+0x79/0x5e0 [ 1347.648652][T31237] refill_objects+0x2d8/0x350 [ 1347.648664][T31237] __pcs_replace_empty_main+0x330/0x690 [ 1347.648675][T31237] __kmalloc_cache_noprof+0x468/0x6b0 [ 1347.648684][T31237] kernfs_iop_get_link+0x66/0x6c0 [ 1347.648720][T31237] vfs_readlink+0x24a/0x540 [ 1347.648728][T31237] do_readlinkat+0x218/0x510 [ 1347.648737][T31237] __x64_sys_readlink+0x7f/0x90 [ 1347.648751][T31237] do_syscall_64+0x174/0x580 [ 1347.648761][T31237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.648773][T31237] page last free pid 4972 tgid 4972 stack trace: [ 1347.648779][T31237] __free_frozen_pages+0x10e7/0x11c0 [ 1347.648789][T31237] __slab_free+0x252/0x2a0 [ 1347.648798][T31237] qlist_free_all+0x99/0x100 [ 1347.648806][T31237] kasan_quarantine_reduce+0x148/0x160 [ 1347.648814][T31237] __kasan_slab_alloc+0x22/0x80 [ 1347.648824][T31237] kmem_cache_alloc_noprof+0x355/0x650 [ 1347.648832][T31237] do_getname+0x2e/0x250 [ 1347.648839][T31237] do_sys_openat2+0xcc/0x200 [ 1347.648847][T31237] __x64_sys_openat+0x138/0x170 [ 1347.648856][T31237] do_syscall_64+0x174/0x580 [ 1347.648866][T31237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.648875][T31237] [ 1347.648877][T31237] Memory state around the buggy address: [ 1347.648883][T31237] ffff888011cc8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1347.648890][T31237] ffff888011cc8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1347.648896][T31237] >ffff888011cc8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1347.648901][T31237] ^ [ 1347.648907][T31237] ffff888011cc8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1347.648913][T31237] ffff888011cc8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1347.648918][T31237] ================================================================== [ 1347.648965][T31237] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1347.648977][T31237] CPU: 0 UID: 0 PID: 31237 Comm: syz.5.10130 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1347.648991][T31237] Tainted: [L]=SOFTLOCKUP [ 1347.648994][T31237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1347.649001][T31237] Call Trace: [ 1347.649005][T31237] [ 1347.649010][T31237] vpanic+0x56c/0xa60 [ 1347.649022][T31237] ? __pfx_vpanic+0x10/0x10 [ 1347.649031][T31237] ? __pfx___schedule+0x10/0x10 [ 1347.649043][T31237] panic+0xc5/0xd0 [ 1347.649052][T31237] ? __pfx_panic+0x10/0x10 [ 1347.649061][T31237] ? preempt_schedule_common+0x82/0xd0 [ 1347.649073][T31237] ? rt_spin_lock+0x83/0x400 [ 1347.649087][T31237] check_panic_on_warn+0x89/0xb0 [ 1347.649120][T31237] ? rt_spin_lock+0x83/0x400 [ 1347.649133][T31237] end_report+0x73/0x170 [ 1347.649145][T31237] ? rt_spin_lock+0x83/0x400 [ 1347.649158][T31237] kasan_report+0x128/0x150 [ 1347.649169][T31237] ? rt_spin_lock+0x83/0x400 [ 1347.649185][T31237] ? bt_accept_unlink+0x7d/0x2f0 [ 1347.649196][T31237] __kasan_check_byte+0x2a/0x40 [ 1347.649207][T31237] lock_acquire+0x84/0x350 [ 1347.649232][T31237] ? __local_bh_disable_ip+0x3c/0x420 [ 1347.649247][T31237] rt_spin_lock+0x83/0x400 [ 1347.649262][T31237] ? bt_accept_unlink+0x7d/0x2f0 [ 1347.649274][T31237] ? __pfx_rt_spin_lock+0x10/0x10 [ 1347.649287][T31237] ? rcu_is_watching+0x15/0xb0 [ 1347.649299][T31237] ? __local_bh_disable_ip+0x3c/0x420 [ 1347.649316][T31237] ? bt_accept_unlink+0x61/0x2f0 [ 1347.649328][T31237] bt_accept_unlink+0x7d/0x2f0 [ 1347.649341][T31237] ? bt_accept_unlink+0x61/0x2f0 [ 1347.649353][T31237] l2cap_sock_teardown_cb+0x17e/0x490 [ 1347.649365][T31237] l2cap_chan_del+0x98/0x600 [ 1347.649376][T31237] l2cap_conn_del+0x2f2/0x520 [ 1347.649392][T31237] ? __pfx_l2cap_disconn_cfm+0x10/0x10 [ 1347.649406][T31237] hci_conn_hash_flush+0x105/0x260 [ 1347.649417][T31237] hci_dev_close_sync+0x7fc/0x10a0 [ 1347.649433][T31237] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 1347.649446][T31237] ? lockdep_hardirqs_on+0x7a/0x110 [ 1347.649457][T31237] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1347.649469][T31237] ? mutex_lock_nested+0x152/0x1d0 [ 1347.649482][T31237] ? hci_unregister_dev+0x22a/0x5b0 [ 1347.649494][T31237] hci_unregister_dev+0x232/0x5b0 [ 1347.649506][T31237] vhci_release+0x170/0x1c0 [ 1347.649517][T31237] ? __pfx_vhci_release+0x10/0x10 [ 1347.649526][T31237] __fput+0x42a/0xa80 [ 1347.649538][T31237] task_work_run+0x1d9/0x270 [ 1347.649548][T31237] ? __pfx_task_work_run+0x10/0x10 [ 1347.649558][T31237] ? do_exit+0x735/0x2360 [ 1347.649566][T31237] ? kmem_cache_free+0x187/0x6c0 [ 1347.649576][T31237] ? put_net+0x191/0x260 [ 1347.649587][T31237] ? do_exit+0x735/0x2360 [ 1347.649596][T31237] do_exit+0x73a/0x2360 [ 1347.649604][T31237] ? lockdep_hardirqs_on+0x7a/0x110 [ 1347.649616][T31237] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1347.649628][T31237] ? __pfx_do_exit+0x10/0x10 [ 1347.649636][T31237] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1347.649650][T31237] ? rt_spin_lock+0x1e0/0x400 [ 1347.649666][T31237] ? rt_spin_unlock+0x157/0x200 [ 1347.649680][T31237] do_group_exit+0x22d/0x2f0 [ 1347.649689][T31237] ? rt_spin_unlock+0x163/0x200 [ 1347.649703][T31237] get_signal+0x121b/0x12c0 [ 1347.649720][T31237] arch_do_signal_or_restart+0xbb/0x860 [ 1347.649734][T31237] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1347.649752][T31237] ? __x64_sys_sendmsg+0x263/0x290 [ 1347.649768][T31237] exit_to_user_mode_loop+0x104/0x730 [ 1347.649779][T31237] ? rcu_is_watching+0x15/0xb0 [ 1347.649791][T31237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.649801][T31237] do_syscall_64+0x353/0x580 [ 1347.649812][T31237] ? trace_irq_disable+0x3b/0x140 [ 1347.649822][T31237] ? clear_bhb_loop+0x40/0x90 [ 1347.649834][T31237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.649844][T31237] RIP: 0033:0x7fd49779de99 [ 1347.649852][T31237] Code: Unable to access opcode bytes at 0x7fd49779de6f. [ 1347.649858][T31237] RSP: 002b:00007fd494d4b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1347.649869][T31237] RAX: 0000000000000034 RBX: 00007fd497a26450 RCX: 00007fd49779de99 [ 1347.649876][T31237] RDX: 0000000004000000 RSI: 00002000000001c0 RDI: 000000000000000a [ 1347.649883][T31237] RBP: 00007fd497833eaf R08: 0000000000000000 R09: 0000000000000000 [ 1347.649890][T31237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1347.649897][T31237] R13: 00007fd497a264e8 R14: 00007fd497a26450 R15: 00007ffc5d241088 [ 1347.649908][T31237] [ 1347.650068][T31237] Kernel Offset: disabled