last executing test programs: 2m10.139091226s ago: executing program 4 (id=2746): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000004900)=ANY=[@ANYBLOB="120100008d1e502039102021a70201020301090212000100bfc0000904", @ANYRESOCT], 0x0) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000040)={0x5, 0xffffffffffffffff, 0x1}) syz_usb_disconnect(r0) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 2m8.302342698s ago: executing program 2 (id=2757): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x6) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x1c, 0x46, 0x107, 0xfffffffe, 0x25dfdbfc, {0x4, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0xab}]}]}, 0x1c}}, 0xc000) (fail_nth: 2) 2m8.25778776s ago: executing program 4 (id=2759): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r2, 0xa) landlock_restrict_self(r2, 0x0) landlock_restrict_self(r2, 0x0) landlock_restrict_self(r2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file0\x00', 0x1c0) r3 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000140)={0x100, r4}, 0x0) landlock_restrict_self(r3, 0x4) r5 = landlock_create_ruleset(&(0x7f0000000240)={0x20}, 0x18, 0x0) landlock_restrict_self(r5, 0x0) unlinkat(r4, &(0x7f0000000340)='./file0/file0/file0\x00', 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) 2m8.132394078s ago: executing program 4 (id=2761): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x249}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) readv(r0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/149, 0x95}], 0x1) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000734000/0x400000)=nil) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000800000/0x800000)=nil, 0x800000}) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f0000000480)={0x2c, &(0x7f00000002c0)={0x40, 0x14, 0x4, "b4865713"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e40)=ANY=[@ANYBLOB="00036c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f00000007c0)={0x2c, &(0x7f0000000680)={0x40, 0x7, 0x4, "292cc4ed"}, 0x0, 0x0, 0x0, 0x0}) r2 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$inet6_int(r2, 0x29, 0x7, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000340)={0x20, 0x9, 0x4, "fce890dc"}, 0x0, 0x0}) syz_usb_control_io$sierra_net(r1, &(0x7f00000004c0)={0x14, &(0x7f0000000580)={0x20, 0x31, 0x6f, {0x6f, 0x14, "a606a8dcc73b37162a127bd21ba829d58fbba4dd2d2f67381d80ea40cfc23193d453625f2f7262fe870193da1890f73d2271af45072d0a80d10f661faf8bc0b6e5a55cb2fd6e3dd0436129adfd88a5ffa4b8a0cfcdce09330512cff1061dd510cdc04bad2d2a697643b625e966"}}, &(0x7f0000000800)={0x0, 0x3, 0x100, @string={0x100, 0x3, "d164085d3da4f993f13bdd8e6ffa3432ddea7c23bb0a60b3048d28a6543c5ae88e9104b0f46efeae7dc94443790388fac1bf4d8ec4b84de9b1ff54584bf9cae6eabaaa06ec51ac15fe52660f1bd64fa0cbde037a37cf4c28026c2f0658488554fba7d65c7f56728a189aac24bb39d4c8d579bc8c36b86bf99367c5907f25ebb12d9c698bfcdf0674a00e8ade81e2226c7b4fea1f0128c7aaa801dbbbb21c8c3b2b77cc9ae381b73b05e3523872d72c563d226e79f51c904f914785c71a28df20ce1b7ab1420a724e63b0c6b13dc205468346c75414d3447108d4890e1aa3dec2e85263b2fba7fe943e5918cf9abec0ff9bd9a16caa665867b2f8d7395ef8"}}}, &(0x7f0000000700)={0x1c, &(0x7f0000000600)={0x40, 0x10, 0x53, "078adf6a26460a652c066b8baa89b8c5f32a7dac2965d608c2e5e8a9c2258fc9c7a5df569d33095f68fccdd2849b32939124f7ecfac19536c0f068b812ea10aa4c8eb84cc50e094aa4622c3c9f2acd165c8d6b"}, &(0x7f0000000e80)={0xa1, 0x1, 0x400, "61b5314636f82b47e91d64e4c2f88bad61e2bb5b4da83248473756d18bfe63322eef4c734282fc505f6832ca8a3a2db4799fd1414d96408acd3174fa7b6ec9ba547626d4458a2abbecfe08d49d356c1acfb7a208c343c1dae09b92f3ca7e45f52430dc96ecaf55f3fe5e8e5fa1e16daae5da62458ecc6d51fb66efaa598a1dec5fa1900c01bdd8b97b859ec0aa879eaf8e9bc826b97967590241a5297a65dcc80909a5c7e642a881bb09cc334b2afd7a4def7f07ef91f8c7744744ac511a6c4e386facd87bf2c9384385a90f2209db63454693294ad26f23176ec74998f76c01d7699c02dfa276a25069a1f1b837a7eec09f37341edefb507c4d5e16531e29166688495bbf2eda085c8556c19da98fe4d11cc091fa3a8554ee3e59becc518a8f5d5650ba09ca71768cc03bdecc4cbdb1c0f2a7995cf38251a8aa62fdb174f5d7ba65f17e564be9a799e907c39a474ccd348c4672fc47f75ac144478e2898dd42774f0e1592dcde6efe9bd466bb9ff701825be9479080161a847e837911ce7ed636e2ba69b92edbf72f7d481216d4d9080c60c958b6aabfb3752da22afbd5fe6b49711c7f61be5db9927419d280b7874b42fe263516788a2e48d632ab531a46772c90f9f2565241bf79b1094af3d46033a24c42f04983c753475d2988d10a5b3f1541ed92bd882b87f3b22d874833d00e6d81cff469919b4edbaf61698f0312336f3f8d3551cec24b57062dc83c9a288f426df4d50549e6a0fb860303eb038097a7b705695420c94f1b931db05b005aeaf85923233ea5fd0507b0b827d98de2f471b05a60ac46042c9e3663aec3bf7e3f7c1d922d1d8119ff032654d36902f5ae8266d37c6b288fe17725280987b4463f2432aa5bbec52525a5556c60651fd126f1cfce2bca8dd07683b7490eb43f83f776072308fffab9a928a477c481e08f2e7e33350fe3e165abb27d013f6068f0cd23ec7ae0c323993d542468e350c6adac7c1e9513e46c6c888dd635d48dc0c42c528ed687bfc3a43d25685b62d411c1bfd5335844ad223c42d8e51ed30f70bae9dade67a60b25e22ec998dba7ed25fcda181349b63712135658a8e2ac948d7d5f22ef467cc64a9536939cb37ee2a8e861ffee466fc7cf812926a596260cc767c5de3ae0503bc343e1bee2ddb6a8c8013153955c03c5b5474e6ea9a2705f807ca294a9e4793ea897807afc4db6ccedd6e5c8c679525bf789768559e8f27df8e7c7cb43f8cdb6f17c7d1fd1e4f55a1144a39574ecb3262f3bb1e6e03439ad23d0911898692a1e4cde7920e5b5fa83a9173e5d67857a54e8a152933068110ccdadc3bac4a63156da3b27eff90b2ad83daa671d32010dbda29197d8298b238248c82f0765662594fb87f007115047a30c97fa0e0cf78fb69bbad4ba6e7b7237ae19cd209f8b0fee6cd5b2707b101aa90edc03"}, &(0x7f00000006c0)={0x21, 0x0, 0x4, "6569de74"}}) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000b80)={0x44, &(0x7f0000000500)={0x40, 0x16, 0x4, "4e59aaf9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r1, &(0x7f00000000c0)={0x14, &(0x7f0000000000)={0x20, 0x22, 0x55, {0x55, 0x1, "390124a92ee6b0f6c68a169c0eb2f433f91d46c22d9e61718b3c9efe8b1a424a7acd644cd86486edb5ca4ce07ee872c6d4767262a400c5015faaf8356d52fb271f8ffa5c40eaf215cfc3f57d50f556c7e283b1"}}, &(0x7f0000000080)={0x0, 0x3, 0x13, @string={0x13, 0x3, "447ded5d8b7a7237b1ba0b5edbf635a72f"}}}, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)={0x0, 0xf, 0x25, "1603bcf7a3a24a654f7b87dc3545446d8fcce9bfa69678994b5d3f058b06d31cc27f13ea23"}, &(0x7f0000000140)={0x0, 0xa, 0x1, 0xff}, &(0x7f0000000180)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000280)={0xc0, 0x5, 0x2, "5a81"}, &(0x7f0000000300)={0x40, 0x5, 0x3, "02c262"}}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000540)={0x0, 0x18, 0x4, "4690097c"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m7.819690207s ago: executing program 2 (id=2766): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r3 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r2, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r1, @ANYRES8], 0x44}}, 0x2404000c) ioctl$sock_netdev_private(r1, 0x89fd, &(0x7f0000001240)="e223c7afd580c9ff0223303494934f09cd8f981c0469434172cd43477311a074e6eb1f2a20b1f2952db06709d84e6df7a3d38cd3954dd315dfcab73ad8ca14db5acc1d26041fbc7c2b79a4d688f93024da9d2d37f384b7024c421e42acbf80ff27a2407227a972a8885ec812cadfba583f9e47ba6e77600174948e50497b17eff877cadfbbb70f65aec7989c1b2d64c94a239bc8170d6eb342fc916ac3f81af437ed17b348ef6f408aa9a8dc78271f40c7289a6fe270ffe3deaf077ae02e437b578709b4afd8e2c1b4a868d3f7a387e12d137a7e12dca1a65419c9b867483b320ea4ef9315d83fc9823fe5bad00d6142cbc8a84a2853240b3f707234713da0aae137616109a1b09164986cbb42ab805ee04f59cca1ce1659e8b3534c4791414bb79498bf8423d1529e2e24c913fb666c14382ed6acaa43dbe4f3b5d32d14a8f3b67348802e9a35ee3ed4628b989cdba1354859895fe0a835fc2de1ba3da14800896d4c541caee64cdac2f1daca97cd0a1639ee7d09c7c29ce886fb8e0f093a83970aa853b72520795097615872ff160bdaa10ece6b2273ab5f8c87d7f4f37ae573ad625aeed0a97a02145a08b2af681bf4be165247a9e86c5e8fcfe2ccf36c3326af15866d1b339bbacb6c265ce434580e1422ba54e96c32755bcce3b61a63eda4d792bb913a25eff7a46580db2363eb765cfae88400c32f7af35031227070424d23dd08753391fb848ff23fc46ecd4f4d4d000a795b47ef671aab494e2006c216e9cd95ccdec6bae1f92cc0c0c7d2021a8ca4d1a5e2390840a2bba7c902a45a7165be7c991c19b6beae7d7eb3ec800fb29753965e1435e43e24bbd65105e8bdc5fdf82e0a28dfaa592c62754e8caa1590218950bd5fef591a1e0964ec6b0bb4f535630e2ffb5cf04d5090d3dc7c00dd5723de3da08b3bff4307d2392386da71d7f7c713ee279e9e2503620fd025175482a1e456dea6d2f5bd215606c832af90bd35303efcba5270cb26a19ac1874babd26e6983fdce1ca72f491bb6a273d42dd0d8f4dd71644e1bf90ef8e7111ae3ae1040a0a9c8ffee68ec890f2978f5189ad88e0f43d8f4404dd922cfc95942b1386be893bf7975176faa8b09d36e07ea25d75702afe25b1cfc97cfeea3ecd60133d69168df726e851ad3abb29409fcfae1a70a1fb9a9e4acbb47265c8cb42b446f2219afe7d0be28592731e3efbc5397624614f85c380fa6997daadffd82d163c90c1fc999fd2082c85eac79a9068fd862aa29e00e748fb28e873ee71c6052d820ec240c10b972d741e30224bee78470b751a0a30dd8d57979d4a6936ad6fe2710ba308127f3965d9acc06bea0b11825a1c2cff50004c4f3adb8affb219d953cc5c9acb33a05be573af7c6b4b1a3fb0ae3b67bc121a81e476c3f91a28db6b97eaecedfa75fffe40faea781e5ecda8bff575b739a8f79727af07c4692c1d8e1100c58eee157ecc0619edda8049cbcc576d7e7806e00dbac11d13a17b266b7a260f839f91157994f8e925763b3a4bd50c3a60b684cf919975d7cbe382b8db86ce7713da2f3a4b96d1426af98577ffc256e91930022251b61b9ace91a71a75e89a3e4b0471e71b77ffe0db428f32e1e89947ab2d9b49677c3db64c28a6c3a70d991f3ef4efa85f1ad98f23042e6b11e04ac4986aba1a52cd32996f06181d7ab6894234ea43702220dbab89d8f7ce46fbfbced0db25f8b4fd341b6c72e7b0c2d5c2eb6c24c1fb35ff41d0dcbc114e88da94932fb2cbae23662aea58b8899912da4d9610795b862ace31e8a7411cbc514902a56a696f295879e8334b20a91b512f2e082f840ca78354c683711d34c5af38771ce42892cdd123f312cc47f43c6230871484551046ccef754411b56cd54d98bd031d02dd682bbe76a88a0504ac5bea0fed4e6ab1215f807ff4a06ce61a482d007c0ff4de5cb99fabbed487f61b0c1ad5dd97a26c09c9b32d16337f3eddfaf48ae7a3bb2f601cdd47c96dda2cbdf041fbd6a0c1ab92604fcddae0f741f76376bbb39fd0f08a46a9d69df188ccf9bdc6374cf6336927163542d51c8d3513d2b42cada3746006f11c8a737627d8dffb6d389c80cd74b5cacd29b9f6240d8829c06bfd8dfa35a93431182a54cb3de743a65ca3657073c74550da492a8af4681169e5b2a02aaa29138265df230077ca2c43ca1e58727bde62ce5384f3a70aa42ce3893a351ed40ce3d28fa20e70cf5eaf0304d3a7af5c3329b697928f27930e6c22eeb27c30672ad8b166494d3bde3830d58399e10788dd667ca961109863c2550bef75947803a8b8772f77c90998f3a8693dd60aee0a4d28cfa9898964d1c1e763884455ae8269b48ac040b7be959a4820f40e7744c0a8f515b67d4f991468930c7c5c8d35814d2bd62799ce63b01d7e31fdcf8dbf0b4c1127ec31978700ccbc04af507cf865cadd21d01166b397bafc6ce267a2155b8b8ef10d65b6056abab894a4e3ba2c06ec31f87365d2acf7b495c2ef9ae27da294c41db04b2e83264fd79e7af50e1f8ad69477ea494f32986f1e9aac1aacf39adc49ff2defb81adeceb618029af97e6b30db96d9cff7eb67dd89efdee56ef71a1a0c35b36c5e1fbf582943a63486734d7f9954a0e05b18b0a5e8b9b90f2bd7c681e90a9a0d8a59e83f71438afe035030d1574eaff481c9b3b4f183140f09912f970d8efaa084fddf382c1f7611fe9dbbdb711be265d18d9133f26e780c9965e55f5929dee1f62483e3330524111154acfc577bce308244456052a2e9bab74e56e0cd9bdac806a48df84a7eadfdb46c0bc4dbbcd6c0c98da21ce781e246f2e8f22f7e0a380380959182af87549622d1857868d6ba6b3fe2c36b0ca46b55a565be673c0fd3546d14a46b2b41767f7bd2f7f93e9aabb1d3fb7cd4160eeb61287746911be74cf6c684466b233b484f8f1cfa8bf8d462940780eada2bfea493586e3425fdf540dff40563819de5ed5cdf94a05e4b245008279c0702fe85e70ba50a4a92c073adcb7b4f70d20fce7c6929d5f0da044ee9bd1e022404733b51d3607f2e939faac3a39b8c6dd0a87acd492dedae13699d20f921545c8e4b30e32db14ad0e59208be718d648c0d56e110f44d0080ce00bf631c1dd45cc4b8b69f15189a22136900dceed8e606aa7c32288e32cae71f57fd13a3d19f9826618844a8dbceb9249475466025ab5f89706fd637f58552a6ba4e5affc2262fe9b3a385dbdaf38a8a8e2f43fa04444b56677900f88b36a2ea4d53a9a1c81d32129d1900f42e771f09112adc4338e4b838e8c55f68598e3223c2ebf8b3ba5e4f42d815a2fa64ea98898cf63a28a9624b936ec0d26ebf6f4a762e616b238cebb9f9447d80cfda7239646bfb7f8e9b4debde91797af52b2fd0ef0abaccecfe03be9f7cabe9195cb4a24ac9322e91c7fcc0da2c75d64b51cbaffa3a796acb8ef369f7c087502c4037f7ba492cf98f18d0ac75c1e16579a10eca7a4a42f9098a4e1a74b71fe04ccc039279c89accfd75f603de1843b49265497b895218f55ea88cab082d8041222f5251e49e52ad98a1b0d7c445e79a334697aa2a4076db27edb6df51e7e86c7faddae4abd089205124460952eed7b4a72087efd2065c6fc63e49a4adf94133c836e2177076282ba04646158c914b06c5503a4beac5e7eba5d0eaf19fcadb0c52415bbdb03dfaff89495be0feca2cabd5dbfa53015037617a0b6cdd4847da2687c47dd68675f1c5c8382156d53abafcfca2c26b780f17bd437a1821f1dd8cdaa36c71b0fcd657b18371447ed1dab4fb682657409b2f3bc63612b2d6ecc8c1092eb985f1adff8b595ed0f284f7ddadd43fc0e09642dea935111b2fd3ab0bb8fd0a73fb919aede80e64490b102a4333890a12cced96c8b257eaff9a0a87196a27151193ed0b2425bc90eb166d4372fad96f0fcd65cb81cf4bcefcfe3f130539155b8e278d4c32fee8689c69b4363308dca9802ea8e56b33a54e25711ac2198dfcdd4152ab58e2e33b38ac44f410d021cf66831df16f7d89dbfd3fee7c7704d5f3e284095ed0601c581141206471ff910301d793f267fe88fab1bf7935a4924ff886c95684e120a43165ce56c334c148c2a1be775823da2f938de57a43e3fe4bbf2b73c1db8c92eb6ae63832411ac73ce53431aea583d8df0b7be1c08756e78daf6052ced0cd9169647fa86e5635bdab3fc88e03fc101f6aaed64a9afbc9756e7dbeb1fa55023e4e27c06ef6fe751476be183a54eaac55bad50c78079a8cd62c4cd5cec517b6c8e7442fd7b07426fcefb588d0c18e27849ef14b94450e3dcac31719a70777bee87b5e64afa97400f46aa2b65a5891c78f2bf872a6a6ee7b46134598bd12a8618038311b34395f2315ce205226bcdbfd71d831e3c5474d21a12143fec8e5029fb21b227dae17b2b25eaf193a7a3e33af474b3435c820724c5a6c10a0ecbc4fc2e12eda1f07b8dc247c56f7290eb9388b3d806a6fbf6304cc85f510f983d5e7de4bf5cfe9c3faf6d52ef5011f55bfbca1748e813bc129c20be5d38f368fef5ed37ed85854c7d2bf417393538b6ab5c030f4f2d37fec75a69e0fd4230446548a7211d532e707a1603684725b10712d626429fb91a1d890f8dc01ff1a1a99fb41b0f4074e4640e6d97541c194733d0f6036f29f2d66d2bead4cf8061e7f0ed27f8da2ddfdc24e194cdbdbaef2d80a4d4a56582d9c799483447fb9f17526b1fbe38faf8d90417dc6c121aecf2d68659ab96123e81320b54eb0789d3cd331e603c800233e692cfa229ab01c7a9053bc3ea0846f0dea1f7bed2ab7eb63faa751f77a669e3fa3c0af8c56a555371590df85a1bb06866d0f90128ae5a27934487baa021b7e78c916b4a383d4ee556b94078545556827f30fd83061fbbb12d78518b4801cbdccafd25c359bc19cf8d566ca82475d6c798a17ce0d7751917c1a1cd1ff96f0e52658a1d6bfba67e6c285e17bae786491b55318614b856e72339dced25caa054f84d1c9e419abb018e7235bc93f7f2a800f733006c84dc0f2e131e7421ddcf1a0571ec5c538e45ae827deac730af28ef851b4485d39e2c24a596da4d26f4f88a48fee0b7082f868f66809af7b9c98393a749a18491843a74dfba4fc3d7d5172586807fae12965bd6842b5b403742b4caf247a0d71f86065833394375b33ed990fbd7289b8efee2f229e2a44fff3bef99286a25a778e07acc8aadfc2a387f731e337a1a138ff4590b3c2db5b0557a773f3a05c8e6e01c52506324424791a1507708a95a1178af2c09ac45d51b35c53d757f1f277f2ce81f63dbd99b2231a55387c369881d09a21f3b898a528c61a8ad4714f961804db7c306cf7cc19b7637cc46a61af27035820b4537342e38e8efe1e93d0b0a2f3b6258193a82db33b1802fdf2e8544b02c619b154467cac9d125ec1f483d6fb4b6bd6f43f1b2c25010d7d04542b48bbe9cd6077349569ded234c369744631c69c696efa681082a3aacd4d9c4078cadb0f128d9568d27ee1fb9db4441175ceeaa98e666db376b1c4967301de2a9cf6c816ced44c14861bae84a59a35b6ac27170d0d6f9810a7b4ec40e3736e8722c8201138afb67be603356d5ce91b1a066856eff967d2dd9704b15edd57dab26cdd56b0f8c1d1af9686005329ae74155aaa118e4242de34957bbf593db2e206fbb2a1f45973d72d434e7937c4d55bbed94638a45b8fc46cecd110d2d835f94d3a665abb98b06a85c89bc39efcc8e4fc5d6177677553dbc73af86b981eabbbeb33a31ce89f77c27a690ee83") r4 = getpgrp(0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0xe559) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x2, 0x0) r5 = syz_open_procfs(r4, &(0x7f00000002c0)='attr/keycreate\x00') fchdir(r5) ioctl$TIOCCBRK(r5, 0x5428) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'gre0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0xfff}]}}]}, 0x3c}}, 0x4) 2m7.527046839s ago: executing program 2 (id=2769): r0 = syz_open_dev$vim2m(&(0x7f0000000280), 0x3, 0x2) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) socketpair$unix(0x1, 0x0, 0x0, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000040), 0x6, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000980)={0x1, @pix_mp={0x80c, 0x5, 0x35314258, 0x6, 0x0, [{0x7, 0x94}, {0x2, 0x8000}, {0x100, 0x1}, {0x8, 0x1ff}, {0x800, 0x7fff}, {0x8, 0xfffffffd}, {0x6, 0x9}, {0x7, 0xfffffffa}], 0x3, 0x9, 0x4, 0x2}}) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000480)={{0xfffc, 0x9, 0x0, 0x6}, 'syz0\x00', 0x3}) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000010000000080007000000020018000180140002006e657464657673696d300000000000000800060000100000080008"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000003c0), 0x600c0) sendmmsg$unix(r3, &(0x7f0000000440)=[{{&(0x7f0000000080)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000000100)=[{&(0x7f0000000340)="b1f0519f718bea3659bc5245d123288b432b655201f0509593451e973f985bdcdfcb59d76ea7cab5f745488f5e0529c20e34fd3af1e9010b8e6509a86ffb48110e249f726961be8c34062b1f43c0f0d6", 0x50}], 0x1, &(0x7f0000000400)=[@rights={{0x28, 0x1, 0x1, [r3, r0, 0xffffffffffffffff, r5, 0xffffffffffffffff, r6]}}], 0x28, 0x10000080}}], 0x1, 0x4000010) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000180)=0x2) write$tun(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="63000000000000000000000000000000fe8000000000000000000000000000242c0200fa00000000000000000000000000000000000000000000000000000000000000000000000a00004e2200004e249100000000000002000000010800000400000001"], 0x6c) setreuid(0xffffffffffffffff, 0xee01) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000003e040000000000003f000000000000005504000001ed0a002500000017ffffff4c040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9e104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f1300010000949b3aab06b1e042ff2164d80c8ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1e0600bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee6330000000000000000000000000000000000004000000000000000038600008fb854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8265e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb66701f4578ba4cb9b706e605a88c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f6a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cf026657a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2cccb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400090300000021911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a8f01bc4b73cc31df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21c24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a3c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d68000000000099347593f67da85d1c962bfb320d1553a74ec3bf003ba62b1784dbf0168a7e85f28b77bdebce96bf386a6dd5df162a16f2b7e8a4de0ffc464a87f91f81866d2ef0af71ebb07a739c3cb1b7000000000000"], &(0x7f00000001c0)='GPL\x00'}, 0x48) 2m6.439858127s ago: executing program 2 (id=2775): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="bbbbbbbbbbbb8a0a63cdec590806000108"], 0x0) sendto$packet(r3, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @link_local}, 0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000000203030100000000000000000400000a0800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x2000c010) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r6, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000000203010100000000000000000400001a"], 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x2000c010) sendmsg$NFQNL_MSG_VERDICT(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000000103b13a00"/18], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x10) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) ioctl$OCFS2_IOC_GROUP_EXTEND(r2, 0x40046f01, &(0x7f0000000040)=0x9) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) accept4(r2, &(0x7f0000000280)=@nfc_llcp, &(0x7f0000000300)=0x80, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) r7 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f00000001c0)={0x3ffe, 0x10001}, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001600010a00000000000000002d"], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 2m6.212236026s ago: executing program 0 (id=2778): syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003c85f620823040a000000e50103010902120009080600220904"], &(0x7f00000023c0)={0x0, 0x0, 0x0, 0x0}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000002100), &(0x7f0000000000)=0x30) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x6, &(0x7f0000000080)=[{0x40, 0xa0, 0x1, 0x2}, {0xe7, 0x46, 0xb, 0x5}, {0x3, 0x1, 0x0, 0x2}, {0x7, 0x1, 0x62, 0x10001}, {0x800, 0x81, 0x9, 0x1}, {0x1, 0x6, 0xc0, 0x8000}]}, 0x10) syz_usb_connect$sierra_net(0x4, 0x0, 0x0, 0x0) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='fd', &(0x7f00000000c0)='3', 0x0) syz_open_dev$vcsa(&(0x7f00000001c0), 0x7f, 0x10000) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x16, 0x16, &(0x7f0000000f40)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000150400003d0301000000000095000f00000000006926000000000000bf67000000000000450700000fff070035060000f0000000170600000ee50014bf250000000000005d670000000000006507000006000000070500004c0001000f75000000000000bf54000000000000070400000400f9ff2d4401000000000095000000000000000500000000000000950007000000000001722fabb733a0e757c7c45402000000a2d23da04d1ffc187f9955911aa1a2ba7ba030c7267c2de00435fd253cc0f0d9b2c3127c46b0f4f95345de3188f0d808398d09ee4dc258d726eae098804de25df627a64ab8efde50fd7f1d58d67e684c45e506598bae66ea1a7cd29032de94983dfab0e5043daf1b46bef5135c65377bdbe65d525743d88ef4b2ee62652b07e8a4b6e6155cecc13a5ddf4157f2bfab7201112a30274101fceee66eca91bd5fecb254ab358488c400330171128be291297947d474c570a385a44dd9ff4ae730ae9d0ae42d8814a8c96f101df7da839bcdd7b7c33c8cfe74d599543ac604d8dd42fc66cdb79cd09ceeedce1e69f11967919f82b0276c90420d08897ee8514b43533f07132589a0a37110fd8571b1e69251bba35cd06c8bd430aafbecfd33757b7dc4803123e9107e5cceaec2a391f9b9b577295ac3864f6c1e30e6190a055953e18bedd1859acdd15af7209d15950f9195b401e74f8b5210e28d46dde2658b4695d9ac9ce7cbefc164a5454fc4da6104db281e18a8992b9f8c82b895da647e6ea4cb622314c5c48abfd620adf7757c23a31a619edcfb45a402c5fced05e5274e08a313d6c5fdd0a8d36b1a268056e6f7e9a6daa5632cda5ad2a9ebfac980c7db63137c226f71b7eb70c174d885232e522aad0f13b0e5b43d837d040f813d0115387e36f092d9aaafe7afc637d3d107451f4854613cfd43ac63ad6141ddb0311b8c96fef49af414e49be7c23b2e8eb686fbcdd2dab4cbdb02e30e4e1a6c25b2791facac56e4c5dc036c8d80e5c7c206d24603be75850927e02fd4eea168681498d1170478408c43bb90d9df3964b64fee41745f6785419ac8de8788398e3653f34970988866043136ada4771bf8d96eeb0f565d626a3e9089"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x253, 0x10, &(0x7f0000000000), 0x19f, 0x0, 0xffffffffffffffff, 0xffffffffffffff74}, 0x48) syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) 2m5.134750294s ago: executing program 2 (id=2780): r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x1c4}) unshare(0x22020600) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8002, 0x8, 0xf, 0x8, 0x83, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x2, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x6, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x5, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x0, 0x1004, 0x7, 0x20003, 0xc0000000, 0x2, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x3, 0x17, 0x1, 0x7, 0x5, 0x3f, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x7, 0x80, 0x0, 0x5, 0xc, 0x9, 0x8002, 0x1, 0x40], [0x10000007, 0x3, 0x8000012f, 0x8006, 0x5, 0xfffffff7, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x4, 0xfffffff8, 0x5, 0x0, 0x3, 0x5, 0x2f, 0xe, 0x1, 0x7, 0xea4, 0x100, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x8001, 0x6, 0x1, 0xff, 0x5, 0xfffff575, 0x5f30, 0x2, 0x200004e0, 0x381, 0x4, 0x8, 0x4, 0x9, 0x8, 0x1, 0x6, 0x47, 0x2, 0x1, 0xfe000000, 0xa, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x8, 0x0, 0x3, 0xbc45, 0xa, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x1, 0x8, 0x86, 0x3, 0x0, 0xfffffffa, 0xffffffff, 0x4, 0x2, 0x2, 0x400003, 0x20000008, 0x1, 0x2, 0x3, 0x107, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0x8001, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x200807ff, 0x2006, 0x80aaed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x4, 0x4, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x4184, 0x5, 0x3, 0x2, 0x5, 0x2, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0xffffffff, 0x2000002, 0x14c, 0x60a6, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x9622, 0x7, 0xb0, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x2800000, 0xa1f, 0xf40, 0xa, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x0, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (fail_nth: 2) 2m4.455764078s ago: executing program 2 (id=2782): sendmsg(0xffffffffffffffff, 0x0, 0x40000) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040), 0x0, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB="2c63616368653d667363616368652c63616368657461673d14e2c32fe2"]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x15, 0x3, &(0x7f0000000540)=@framed, &(0x7f00000005c0)='GPL\x00'}, 0x80) 2m3.958085363s ago: executing program 4 (id=2784): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(r1, 0x0, &(0x7f0000000000)={0x1, 0x0, 0x4, 0x800005fffffffff9}) (async) fcntl$lock(r1, 0x0, &(0x7f0000000000)={0x1, 0x0, 0x4, 0x800005fffffffff9}) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000840)=ANY=[@ANYBLOB="48000000030101040000000000000000020000032c00020fc4c169e6da0fcea413a613a3f1f2800600c6aca7eb427d83ea018008000100ac1414bb08000200e00000010c00028005"], 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) socket$kcm(0x11, 0x3, 0x0) (async) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, &(0x7f0000000280)}, 0x10) sendmsg$kcm(r4, &(0x7f0000000200)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x2c}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000000)='Gb', 0x1c}], 0x1}, 0x480c0) r5 = getpgrp(0x0) rt_sigqueueinfo(r5, 0x27, &(0x7f0000000240)={0x24, 0x10000, 0xfffffff9}) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) (async) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) (async) sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) sched_getparam(r6, &(0x7f0000000100)) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x9, 0xeeee0000, 0x1000, &(0x7f00004f1000/0x1000)=nil}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 2m3.526608737s ago: executing program 0 (id=2787): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = syz_open_dev$vbi(&(0x7f00000000c0), 0x1, 0x2) ioctl$VIDIOC_ENUMAUDOUT(r0, 0xc0345642, &(0x7f0000000300)={0x1, "7bc7b0eb07939da1ee8efc70c96ced7db5515f1f455fd01ec5750310cb20fa5e"}) chdir(&(0x7f00000003c0)='./bus\x00') r1 = socket(0x2, 0xa, 0x300) r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x4000000000010049) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000340), 0x0, 0x20000000) recvmmsg(r1, &(0x7f0000000280)=[{{0x0, 0xfffffffffffffe26, 0x0}, 0x105c7}], 0xa9, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000014}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCGSTAMPNS(r1, 0x8907, 0x0) 2m0.944541257s ago: executing program 0 (id=2791): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd70000e0000000100000008000100", @ANYRES32=0x0, @ANYBLOB="0800020000000000"], 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) 2m0.568180232s ago: executing program 0 (id=2793): r0 = syz_open_dev$vim2m(&(0x7f0000000280), 0x3, 0x2) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) socketpair$unix(0x1, 0x0, 0x0, 0x0) r4 = syz_open_dev$vim2m(0x0, 0x6, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000980)={0x1, @pix_mp={0x80c, 0x5, 0x35314258, 0x6, 0x0, [{0x7, 0x94}, {0x2, 0x8000}, {0x100, 0x1}, {0x8, 0x1ff}, {0x800, 0x7fff}, {0x8, 0xfffffffd}, {0x6, 0x9}, {0x7, 0xfffffffa}], 0x3, 0x9, 0x4, 0x2}}) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000480)={{0xfffc, 0x9, 0x0, 0x6}, 'syz0\x00', 0x3}) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000007c0)={0x1, 0x2, 0x1, 0x0, 0x8}) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000010000000080007000000020018000180140002006e657464657673696d3000000000000008000600"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000180)=0x2) r5 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) fcntl$dupfd(r5, 0x0, r5) 2m0.108832025s ago: executing program 4 (id=2794): r0 = syz_open_dev$loop(&(0x7f0000000140), 0xffff, 0x109040) ioctl$LOOP_CLR_FD(r0, 0x4c01) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000800)={0x0, 0xfffffffffffffd0e, &(0x7f0000000040)={&(0x7f0000002a80)=ANY=[@ANYBLOB="300000001800010000000000000200001d0108000c000b00040000600000004008000900", @ANYRES32=0x0, @ANYBLOB='\b\x00\n\x00', @ANYBLOB="af"], 0x30}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000180), 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002cbd70100400000005000000080009000200000008000c00a80a000008000b00000000000600010005"], 0x34}}, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x50, &(0x7f0000000300)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa2a8100000086dd60010100001611fffe8000000000000000000000000000bbfe8000000000000000002000000000aa00000e2200169078020300000000000030b00afe4e79008e16470d787d6919e67f2b3f9f81d797ba7eafdc970f844ada07c03fc3cd415345fef1f29b1b613adc08d3760ad589079838c532e6d4583299297b114b78b16ec03be7344731a6677d3f32acd23a7339655815c89d09594ccfa2b1640f0d19bcb274804f1eeca26605932ca36105394076a676b2c11be8d0d037bc8476dc3a2d67f01f6adf61efc1671f843972"], 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000026c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a48000000060a010400000000000000000a00060b1b00010073797a31000000001c0004800900020073797a3200000000140000001100010000000000000000000700000a"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) r9 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) read$FUSE(r9, &(0x7f0000002740)={0x2020}, 0x2020) connect$inet(r8, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r8, &(0x7f0000007fc0), 0x800001d, 0x0) bind$inet(r8, &(0x7f0000000200)={0x2, 0x4e21, @local}, 0x10) 1m59.402833611s ago: executing program 0 (id=2796): add_key(0x0, 0x0, &(0x7f0000000100)="a847094007ee2174c7282bb7c9a2658b69560e9e921e5f2e8d2cc4da4619d7f9cfa99bac1f47d4752bf8b6551b7e3d9007dfac4fed9cc0eba2c3d6872c9422679bf636f24a3b36f806aadafdd645a07da908f1e0ed5b542e051972be71e000b7831c12cbfb8e494eb3e2adfeb5e5b00198a053d66c55af18c03b54c0bc32e70ed30e4e53545ca3050693035923eeb938264effc87cf04f9cdf0e62689ab6c6a368753c58160d2cfeda601cc6eff09e54bb5d6f78f918a9d2ba00248bfa391ecf421791dfc5bf09fc2917199fa24e88cbf7e58675e824c52e10b52ee020b8630655d5c0e8cf3f8f6e3ef461615aa3c12218bca178b30d459d10cd13ddf3ced56080114e6f579d0e5867f20002461df46cf0872fdcd68d631f5231ec5b67c7f5a341408b529682a7cadd6933330421aa4754944b24e7cf9ed210ccca3a60b873a429d86636868deba97079914d8b020da1b5cd77565b041c1d0342ee127b0b2b15b443451f788c6e92b60a2abbbb7f19d21a4680ce5b673de158e91d8590d7bf5e623d571ac40342475e4bb3625af4c7d8cd4e99a1dff6f1d84fc348c2ea8d7d0fcaede3c73daf5133a9662218f865b03d0d5b19188eff66303b93cc2a4f3593760b8bffd5e578881ba461216097280f37a26263dfacfa71e315099cedd2cf3dc295f8ca609b570fcfc9ba684cb34d008e80c8c4f63dc66259ca69efcee2ab2fe8dca55d38354128b7d07363c2704ab53b5caac4201b9aee65689b73ab095bd3207826a5aabb58e59309efc7a455eac191829b1801f9db1189244d849c360644d8134c2ff3bcc1b3809621cf974baf8f5592a5829b1877327d8a651e5e731697b5e8bf0e7e457d78e3462ffab7b4e197946bc2e1d83ed8bafcbf7be571d49379e87bb6f2a01530dd68d90e3e3804ce67c63e0e8d44b684efe50b35d3e0f77d5b63cf0440e4dc16eef8822ac01e088b0a2617bbcdd02391de574c1b2494f8f81c345a1f2715a7d84e1a12e991810fff362c175f616b2a94904957f822dd927e36e245f1b5b83c4fff77761862bfdb8b08641194c04750eaf3eedd2b2303037af06804bd21db046ac53cb9e72fdebe80ffeb454b1d5751de13e3b7f5fe5dfb8f19f852ed8989e02497177d813b16fa9126ca05ff9b8dcf8087f54938cfe85db9f116664284e74088494f7e85afdf40f7285c94b5c5e201025ec44da9ffc365210f0f66e115da3926cf9a6f8a67647b6782883d179ce40ba89ccb14338a617faa84d8d5f615785ae6a29765f2aeea937edacd7dc6dada6fb303ee34a4489ff07773919ea44513d2a22e5f5f9c825ee2041f1130475a9ce8f934f23a703c3c2a33a1bf6a5ddb465c9224956177d6e01312ca377adbee837de4b9a6032f6e2259cf5e986a6e7a266f6ddcef940b5b7dd25a570430df9295ae2e284f3abfdb4d4c589ad251f45cfef7a21d9c54ff441b68b3b8fdc41dd6afda6a9a01cf85117e1352f70b77452103cfdafab845d85596850ac6bc5ab5cd36835108ac20196f0de53854bbc3d06037e5de4f50b0b28582355d4872df2b39c2aea2e213b96d54918a70e00501f2eefa2329ba2f37b16b6f0d1b5c6cba2b023175278c3736e33671bf4f88fbaee3c2583df13ca6badcd7e04c403b0774edf80e536c70c7e5ea8fe5f0d756ee19acb9979b23339910033c944e80cd0637213f5d8a051fb8c47dfaf5747aba07d13fc59f1961dc7a213428f11dc1c70c824c351a1f178ee31047e8ab738cfb45ed6d7b03b35b4c93b5426872f1c1959ca7f8b331aa5e52e82468eb52fb2dbd270871c36fab9c26ab79fbdee3d9577fb28d1fc57f8fd5f96ab879933d1385e8121deb327d872884acea6007217e4a7e0e6ad9b14b97602451b167b6e814bced0bad106d0a8683c97ec583d94a99ee9c65508418b021d8cd2d7cd3b588fd25c64c2f00063d2c74df9cfae84c1212895b26511f493fd8370d7125360e67fe2713ae5943b4e2550c3f09b971f93102e61a8efa4a7092d8c4e685de8ac434993d57a249f8d539979dbbee4d94c9cfdd1933eba4de8fba99fae781430fc7a2b55e8f33e74cfc79845a9f8f432ce1765cf603f81f6e23d148b62df1adab96a89ca29a9c0397c59000c2aef4d6bf317b294e5a780cc847ebb7b6498137fee259e964523441ec0b85d3d9beb184a6c6cd571a3fee6e630eac68df8e611cb63808167a17e90f68662211b46b5be18f59a750debc62ed0b6eb06241cf88dc588360f0dde2e97de4ff20b8744fb95c0de488436cc11eeb40a61c38aed2043ea1d026a233c0ee59ac820f523f75222dc1ee1d3bb5238a6a05b0e0a8c675ae220c675f640a94d2", 0x680, 0xfffffffffffffffd) 1m58.761523333s ago: executing program 0 (id=2798): syz_open_dev$MSR(0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000000)={0xd2f0, 0x2000, 0x8, 0xadea}) r0 = io_uring_setup(0x78eb, &(0x7f00000000c0)={0x0, 0xc63b, 0x3018, 0x2, 0x1f9}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000340)=@bpf_lsm={0x1d, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x40f00, 0x11, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x52, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) r1 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$inet6(r1, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x28}}], 0x1, 0x0) io_uring_enter(r0, 0x0, 0x2, 0xf, &(0x7f0000000000)={[0x2000000]}, 0x18) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f0000000200)="94", 0x1}, {0x0}], 0x2) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000180)={0x1}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x4, &(0x7f0000000100)=[{0x7c7, 0xb4, 0x8, 0x4}, {0xab0, 0x1, 0x82, 0x1}, {0x6, 0xc, 0x84}, {0x0, 0xa5, 0x5b, 0x27}]}, 0x10) r4 = socket$rds(0x15, 0x5, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r6, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r5, 0x0}]) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r4, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) 1m57.382131147s ago: executing program 4 (id=2801): syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) 1m52.74924809s ago: executing program 1 (id=2813): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000980)={&(0x7f0000000840)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3c, 0x3c, 0x2, [@restrict={0x0, 0x0, 0x0, 0xb, 0x3}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x1, 0x1c}}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x2, 0xe}}]}}, 0x0, 0x56, 0x0, 0x1}, 0x28) 1m52.521786189s ago: executing program 1 (id=2814): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x7}, 0x1c) r1 = gettid() ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x8) fcntl$setownex(r0, 0xf, &(0x7f0000000000)={0x2, r1}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0xfff}, 0x1c) r2 = syz_open_dev$vim2m(&(0x7f0000000200), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000400)={0x13, 0x1, 0x200, "33c500100000130040fcd828a45b729f09085780ee0f00", 0x32525942}) sendmmsg$inet6(r0, &(0x7f0000000d40)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="02", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000480)="de38", 0x2}], 0x1}}], 0x2, 0x404c851) 1m51.362128295s ago: executing program 1 (id=2816): r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f00000000c0), 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1000}}, './file0\x00'}) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f00000001c0), 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb2570000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) r6 = socket$igmp(0x2, 0x3, 0x2) sendmsg$inet(r6, &(0x7f0000001ec0)={&(0x7f0000000c00)={0x2, 0x4e23, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac14140f7f00000100e8ffff370000000000000000000000070000"], 0x58}, 0x4) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000001"], 0x6c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) readv(r7, &(0x7f0000000040)=[{&(0x7f0000000180)=""/163, 0xa3}], 0x1) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), r7) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000094c0)=ANY=[@ANYBLOB="8c45000043000701feff416ec366166e0314000004004580744501"], 0x458c}, 0x1, 0x0, 0x0, 0xc004}, 0xc000) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000d9bffc)=0x61, 0x4) sendto(r0, &(0x7f0000000380)="120000001200e7ef007b00000000000000a1", 0x12, 0x20000090, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000a80)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000001d40)=""/4101, 0x1005}], 0x1}, 0x10001}], 0x1, 0x10120, 0x0) 1m51.045533888s ago: executing program 1 (id=2818): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000840)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x0, 0x400, 0xffffffff, 0x0, 0xfffffffe}}}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x10001}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 1m49.708082293s ago: executing program 1 (id=2819): openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002e000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000d000000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000540)={r0, 0x0, 0x50, 0x0, &(0x7f00000006c0)="77844923fbde9d724bbda199f4d64d66af6c226d473d58a57d01eb104909843e0d8efd98b8ddfde95a2ebe4cd68ef0212b2a3fc4b60ca293a86b5fa16b17ba319b5f20923625bb7c73accfaf9b4fa51e", 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1m49.504259109s ago: executing program 1 (id=2820): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x10, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa4000000", @ANYRES32=r0, @ANYBLOB="0000000002000000b7050000080041e885000000c700000095"], &(0x7f0000000300)='GPL\x00', 0x7, 0xff8, &(0x7f0000001e00)=""/4088, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ef8}, 0x94) 1m47.863865834s ago: executing program 32 (id=2782): sendmsg(0xffffffffffffffff, 0x0, 0x40000) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040), 0x0, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB="2c63616368653d667363616368652c63616368657461673d14e2c32fe2"]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x15, 0x3, &(0x7f0000000540)=@framed, &(0x7f00000005c0)='GPL\x00'}, 0x80) 1m42.476611822s ago: executing program 33 (id=2798): syz_open_dev$MSR(0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000000)={0xd2f0, 0x2000, 0x8, 0xadea}) r0 = io_uring_setup(0x78eb, &(0x7f00000000c0)={0x0, 0xc63b, 0x3018, 0x2, 0x1f9}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000340)=@bpf_lsm={0x1d, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x40f00, 0x11, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x52, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) r1 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$inet6(r1, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x28}}], 0x1, 0x0) io_uring_enter(r0, 0x0, 0x2, 0xf, &(0x7f0000000000)={[0x2000000]}, 0x18) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f0000000200)="94", 0x1}, {0x0}], 0x2) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000180)={0x1}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x4, &(0x7f0000000100)=[{0x7c7, 0xb4, 0x8, 0x4}, {0xab0, 0x1, 0x82, 0x1}, {0x6, 0xc, 0x84}, {0x0, 0xa5, 0x5b, 0x27}]}, 0x10) r4 = socket$rds(0x15, 0x5, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r6, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r5, 0x0}]) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r4, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) 1m40.488113522s ago: executing program 34 (id=2801): syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) 35.602695566s ago: executing program 3 (id=2861): add_key(&(0x7f0000000000)='big_key\x00', 0x0, &(0x7f0000000100)="a847094007ee2174c7282bb7c9a2658b69560e9e921e5f2e8d2cc4da4619d7f9cfa99bac1f47d4752bf8b6551b7e3d9007dfac4fed9cc0eba2c3d6872c9422679bf636f24a3b36f806aadafdd645a07da908f1e0ed5b542e051972be71e000b7831c12cbfb8e494eb3e2adfeb5e5b00198a053d66c55af18c03b54c0bc32e70ed30e4e53545ca3050693035923eeb938264effc87cf04f9cdf0e62689ab6c6a368753c58160d2cfeda601cc6eff09e54bb5d6f78f918a9d2ba00248bfa391ecf421791dfc5bf09fc2917199fa24e88cbf7e58675e824c52e10b52ee020b8630655d5c0e8cf3f8f6e3ef461615aa3c12218bca178b30d459d10cd13ddf3ced56080114e6f579d0e5867f20002461df46cf0872fdcd68d631f5231ec5b67c7f5a341408b529682a7cadd6933330421aa4754944b24e7cf9ed210ccca3a60b873a429d86636868deba97079914d8b020da1b5cd77565b041c1d0342ee127b0b2b15b443451f788c6e92b60a2abbbb7f19d21a4680ce5b673de158e91d8590d7bf5e623d571ac40342475e4bb3625af4c7d8cd4e99a1dff6f1d84fc348c2ea8d7d0fcaede3c73daf5133a9662218f865b03d0d5b19188eff66303b93cc2a4f3593760b8bffd5e578881ba461216097280f37a26263dfacfa71e315099cedd2cf3dc295f8ca609b570fcfc9ba684cb34d008e80c8c4f63dc66259ca69efcee2ab2fe8dca55d38354128b7d07363c2704ab53b5caac4201b9aee65689b73ab095bd3207826a5aabb58e59309efc7a455eac191829b1801f9db1189244d849c360644d8134c2ff3bcc1b3809621cf974baf8f5592a5829b1877327d8a651e5e731697b5e8bf0e7e457d78e3462ffab7b4e197946bc2e1d83ed8bafcbf7be571d49379e87bb6f2a01530dd68d90e3e3804ce67c63e0e8d44b684efe50b35d3e0f77d5b63cf0440e4dc16eef8822ac01e088b0a2617bbcdd02391de574c1b2494f8f81c345a1f2715a7d84e1a12e991810fff362c175f616b2a94904957f822dd927e36e245f1b5b83c4fff77761862bfdb8b08641194c04750eaf3eedd2b2303037af06804bd21db046ac53cb9e72fdebe80ffeb454b1d5751de13e3b7f5fe5dfb8f19f852ed8989e02497177d813b16fa9126ca05ff9b8dcf8087f54938cfe85db9f116664284e74088494f7e85afdf40f7285c94b5c5e201025ec44da9ffc365210f0f66e115da3926cf9a6f8a67647b6782883d179ce40ba89ccb14338a617faa84d8d5f615785ae6a29765f2aeea937edacd7dc6dada6fb303ee34a4489ff07773919ea44513d2a22e5f5f9c825ee2041f1130475a9ce8f934f23a703c3c2a33a1bf6a5ddb465c9224956177d6e01312ca377adbee837de4b9a6032f6e2259cf5e986a6e7a266f6ddcef940b5b7dd25a570430df9295ae2e284f3abfdb4d4c589ad251f45cfef7a21d9c54ff441b68b3b8fdc41dd6afda6a9a01cf85117e1352f70b77452103cfdafab845d85596850ac6bc5ab5cd36835108ac20196f0de53854bbc3d06037e5de4f50b0b28582355d4872df2b39c2aea2e213b96d54918a70e00501f2eefa2329ba2f37b16b6f0d1b5c6cba2b023175278c3736e33671bf4f88fbaee3c2583df13ca6badcd7e04c403b0774edf80e536c70c7e5ea8fe5f0d756ee19acb9979b23339910033c944e80cd0637213f5d8a051fb8c47dfaf5747aba07d13fc59f1961dc7a213428f11dc1c70c824c351a1f178ee31047e8ab738cfb45ed6d7b03b35b4c93b5426872f1c1959ca7f8b331aa5e52e82468eb52fb2dbd270871c36fab9c26ab79fbdee3d9577fb28d1fc57f8fd5f96ab879933d1385e8121deb327d872884acea6007217e4a7e0e6ad9b14b97602451b167b6e814bced0bad106d0a8683c97ec583d94a99ee9c65508418b021d8cd2d7cd3b588fd25c64c2f00063d2c74df9cfae84c1212895b26511f493fd8370d7125360e67fe2713ae5943b4e2550c3f09b971f93102e61a8efa4a7092d8c4e685de8ac434993d57a249f8d539979dbbee4d94c9cfdd1933eba4de8fba99fae781430fc7a2b55e8f33e74cfc79845a9f8f432ce1765cf603f81f6e23d148b62df1adab96a89ca29a9c0397c59000c2aef4d6bf317b294e5a780cc847ebb7b6498137fee259e964523441ec0b85d3d9beb184a6c6cd571a3fee6e630eac68df8e611cb63808167a17e90f68662211b46b5be18f59a750debc62ed0b6eb06241cf88dc588360f0dde2e97de4ff20b8744fb95c0de488436cc11eeb40a61c38aed2043ea1d026a233c0ee59ac820f523f75222dc1ee1d3bb5238a6a05b0", 0x673, 0xfffffffffffffffd) 35.1869561s ago: executing program 3 (id=2862): r0 = syz_open_dev$vim2m(&(0x7f0000000280), 0x3, 0x2) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) socketpair$unix(0x1, 0x0, 0x0, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000040), 0x6, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000980)={0x1, @pix_mp={0x80c, 0x5, 0x35314258, 0x6, 0x0, [{0x7, 0x94}, {0x2, 0x8000}, {0x100, 0x1}, {0x8, 0x1ff}, {0x800, 0x7fff}, {0x8, 0xfffffffd}, {0x6, 0x9}, {0x7, 0xfffffffa}], 0x3, 0x9, 0x4, 0x2}}) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000480)={{0xfffc, 0x9, 0x0, 0x6}, 'syz0\x00', 0x3}) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000007c0)={0x1, 0x2, 0x1, 0x0, 0x8}) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES16, @ANYBLOB="0100000000000000000010000000080007000000020018000180140002006e657464657673696d300000000000000800060000100000080008"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000003c0), 0x600c0) sendmmsg$unix(r3, &(0x7f0000000440)=[{{&(0x7f0000000080)=@abs={0x0, 0x0, 0x4e20}, 0x6e, 0x0, 0x0, &(0x7f0000000400)=[@rights={{0x28, 0x1, 0x1, [r3, r0, 0xffffffffffffffff, r5, 0xffffffffffffffff, r6]}}], 0x28, 0x10000080}}], 0x1, 0x4000010) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000180)=0x2) 33.09682373s ago: executing program 3 (id=2863): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) (async) socket(0x21, 0x1, 0x6) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0200000004000000040000000800000014100000", @ANYRES32, @ANYBLOB="00000000000000e9d56e01000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/13], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0c00000004000000040000000700000000000000", @ANYRES32=r1], 0x48) (async) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000006c0)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) fcntl$lock(r3, 0x25, &(0x7f0000000100)={0x0, 0x2, 0x80000000000fffe, 0x40000001}) (async, rerun: 64) fcntl$lock(r3, 0x6, &(0x7f0000000080)={0x0, 0x2, 0x1, 0x9}) (async, rerun: 64) fcntl$lock(r3, 0x5, &(0x7f00000000c0)={0x1, 0x1, 0x401, 0x401}) (async) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000000)=0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x3) (async, rerun: 64) sched_setaffinity(r6, 0x8, &(0x7f0000000240)=0x2) (async, rerun: 64) setpgid(r5, r6) (async) mount$fuseblk(&(0x7f0000002440), &(0x7f0000000040)='./file0\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000240)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x1000}}) (async) syz_usb_control_io$hid(r2, 0x0, 0x0) (async) r7 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000340)=ANY=[@ANYBLOB="12010003000000ff4e040b1240000102030109022d000101060000090400090203010109092109000001223604090581030004278189b56ec30339657b1b576146e002080209050203ff03400b08"], &(0x7f0000000080)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x250, 0x6, 0xf8, 0x8, 0x10, 0x9}, 0x43, &(0x7f0000000180)={0x5, 0xf, 0x43, 0x4, [@wireless={0xb, 0x10, 0x1, 0xc, 0x4, 0x98, 0x2, 0x5, 0x4}, @wireless={0xb, 0x10, 0x1, 0xc, 0x1, 0x1, 0x1, 0x2, 0x9b}, @ss_container_id={0x14, 0x10, 0x4, 0xd, "b89a455722ac58fa2ea7207a222c54db"}, @ss_container_id={0x14, 0x10, 0x4, 0x3, "633856a32755151686d79ea47ff815f5"}]}, 0x1, [{0x6f, &(0x7f00000002c0)=ANY=[@ANYBLOB="6f03ace7d4410f29d188298db7f4046666ca1f7ecc43a5fed4a6714c11051e7fc5efcaafe48eb0491564a1eecc3e1100016367d9e6b36e338904053e6710ea3582d0e6c6614fb53bd5c19873400558b8f818bd39f5ced6c8713626ba04bfa19c6a0b485ad33a8a6066917a305c9e8e"]}]}) syz_usb_control_io$hid(r7, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[], 0x0}, 0x0) r8 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x10f682) ioctl$HIDIOCSREPORT(r8, 0x81044804, 0x0) 20.105951766s ago: executing program 3 (id=2864): syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400"], 0x0) syz_usb_connect(0x0, 0x3f, 0x0, 0x0) read$char_usb(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="c00000001900674c0000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000001d000000000000000000000000000000000000ffffffffffffff7f00000000000000000000000000000000020000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000100000000000008001f0002"], 0xc0}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x15, 0x1, 0x70bd2b, 0x25dfdbfd, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x5, 0x0}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x0, 0x4e23, 0x0, 0xa, 0x10}, {0x8, 0x1, 0x0, 0x0, 0x8, 0x0, 0xffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x2}, 0x4, 0x6e6bb3, 0x0, 0x1, 0x3, 0x3}}, 0xb8}}, 0x0) 18.198798218s ago: executing program 3 (id=2865): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000280)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="610233005030"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x40000) 16.345580449s ago: executing program 3 (id=2866): mount$bpf(0x0, &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x10000, 0x0) syz_clone3(&(0x7f0000000140)={0x4000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x2}, 0x7a) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x40, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x100}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002800128009000100626f6e640000000018000280140008"], 0x48}}, 0x0) sendmmsg$inet(r0, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) 0s ago: executing program 35 (id=2866): mount$bpf(0x0, &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x10000, 0x0) syz_clone3(&(0x7f0000000140)={0x4000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x2}, 0x7a) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x40, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x100}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002800128009000100626f6e640000000018000280140008"], 0x48}}, 0x0) sendmmsg$inet(r0, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) kernel console output (not intermixed with test programs): ock_irqrestore+0x30/0x80 [ 489.378267][T12524] ? lockdep_hardirqs_on+0x7a/0x110 [ 489.378290][T12524] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 489.378313][T12524] ? mutex_lock_nested+0x152/0x1d0 [ 489.378333][T12524] ? fdget_pos+0x252/0x320 [ 489.378361][T12524] ksys_read+0x156/0x270 [ 489.378387][T12524] ? __pfx_ksys_read+0x10/0x10 [ 489.378421][T12524] do_syscall_64+0x14d/0xf80 [ 489.378444][T12524] ? trace_irq_disable+0x3b/0x150 [ 489.378464][T12524] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.378483][T12524] ? clear_bhb_loop+0x40/0x90 [ 489.378504][T12524] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.378526][T12524] RIP: 0033:0x7f4febd5cfce [ 489.378543][T12524] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 489.378560][T12524] RSP: 002b:00007f4fe9fedfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 489.378580][T12524] RAX: ffffffffffffffda RBX: 00007f4fe9fee6c0 RCX: 00007f4febd5cfce [ 489.378594][T12524] RDX: 000000000000000f RSI: 00007f4fe9fee0a0 RDI: 0000000000000009 [ 489.378605][T12524] RBP: 00007f4fe9fee090 R08: 0000000000000000 R09: 0000000000000000 [ 489.378614][T12524] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 489.378622][T12524] R13: 00007f4fec016038 R14: 00007f4fec015fa0 R15: 00007ffc8fb3b4c8 [ 489.378650][T12524] [ 491.594471][ T5801] Bluetooth: hci4: Malformed LE Event: 0x0b [ 493.335604][ T5806] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 493.351173][ T5806] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 493.359150][ T5806] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 493.373352][ T5806] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 493.379075][ T5806] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 493.944854][T12598] FAULT_INJECTION: forcing a failure. [ 493.944854][T12598] name failslab, interval 1, probability 0, space 0, times 0 [ 493.944882][T12598] CPU: 0 UID: 0 PID: 12598 Comm: syz.0.2481 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 493.944901][T12598] Tainted: [L]=SOFTLOCKUP [ 493.944907][T12598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 493.944915][T12598] Call Trace: [ 493.944921][T12598] [ 493.944928][T12598] dump_stack_lvl+0xe8/0x150 [ 493.944954][T12598] should_fail_ex+0x46b/0x600 [ 493.944978][T12598] should_failslab+0xa8/0x100 [ 493.944995][T12598] __kmalloc_noprof+0xdf/0x7b0 [ 493.945017][T12598] ? tomoyo_encode+0x28b/0x550 [ 493.945038][T12598] tomoyo_encode+0x28b/0x550 [ 493.945056][T12598] tomoyo_realpath_from_path+0x58d/0x5d0 [ 493.945078][T12598] ? tomoyo_path_number_perm+0x219/0x630 [ 493.945097][T12598] tomoyo_path_number_perm+0x246/0x630 [ 493.945118][T12598] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 493.945139][T12598] ? __lock_acquire+0x6b5/0x2cf0 [ 493.945190][T12598] ? __fget_files+0x2a/0x420 [ 493.945210][T12598] ? __fget_files+0x2a/0x420 [ 493.945224][T12598] ? __fget_files+0x3a6/0x420 [ 493.945240][T12598] ? __fget_files+0x2a/0x420 [ 493.945259][T12598] security_file_ioctl+0xc3/0x2a0 [ 493.945284][T12598] __se_sys_ioctl+0x47/0x170 [ 493.945307][T12598] do_syscall_64+0x14d/0xf80 [ 493.945328][T12598] ? trace_irq_disable+0x3b/0x150 [ 493.945346][T12598] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.945361][T12598] ? clear_bhb_loop+0x40/0x90 [ 493.945380][T12598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.945395][T12598] RIP: 0033:0x7f0a9a7ac799 [ 493.945412][T12598] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 493.945425][T12598] RSP: 002b:00007f0a98a06028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 493.945442][T12598] RAX: ffffffffffffffda RBX: 00007f0a9aa25fa0 RCX: 00007f0a9a7ac799 [ 493.945453][T12598] RDX: 0000200000002400 RSI: 00000000c018937e RDI: 0000000000000003 [ 493.945463][T12598] RBP: 00007f0a98a06090 R08: 0000000000000000 R09: 0000000000000000 [ 493.945472][T12598] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 493.945480][T12598] R13: 00007f0a9aa26038 R14: 00007f0a9aa25fa0 R15: 00007ffc6847a2e8 [ 493.945506][T12598] [ 493.945523][T12598] ERROR: Out of memory at tomoyo_realpath_from_path. [ 494.374206][T12587] chnl_net:caif_netlink_parms(): no params data found [ 495.431002][ T5801] Bluetooth: hci3: command tx timeout [ 495.642402][ T5794] bridge0: port 3(syz_tun) entered disabled state [ 495.779852][ T31] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 495.785692][T12639] overlayfs: failed to resolve './file1': -2 [ 495.794579][ T5794] syz_tun (unregistering): left allmulticast mode [ 495.794605][ T5794] syz_tun (unregistering): left promiscuous mode [ 495.794706][ T5794] bridge0: port 3(syz_tun) entered disabled state [ 495.808923][T12641] FAULT_INJECTION: forcing a failure. [ 495.808923][T12641] name failslab, interval 1, probability 0, space 0, times 0 [ 495.808970][T12641] CPU: 1 UID: 0 PID: 12641 Comm: syz.1.2496 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 495.808995][T12641] Tainted: [L]=SOFTLOCKUP [ 495.809002][T12641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 495.809013][T12641] Call Trace: [ 495.809021][T12641] [ 495.809029][T12641] dump_stack_lvl+0xe8/0x150 [ 495.809060][T12641] should_fail_ex+0x46b/0x600 [ 495.809087][T12641] should_failslab+0xa8/0x100 [ 495.809108][T12641] __kmalloc_noprof+0xdf/0x7b0 [ 495.809132][T12641] ? tomoyo_encode+0x28b/0x550 [ 495.809158][T12641] tomoyo_encode+0x28b/0x550 [ 495.809182][T12641] tomoyo_realpath_from_path+0x58d/0x5d0 [ 495.809210][T12641] ? tomoyo_path_number_perm+0x219/0x630 [ 495.809235][T12641] tomoyo_path_number_perm+0x246/0x630 [ 495.809262][T12641] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 495.809288][T12641] ? __lock_acquire+0x6b5/0x2cf0 [ 495.809337][T12641] ? __fget_files+0x2a/0x420 [ 495.809361][T12641] ? __fget_files+0x2a/0x420 [ 495.809381][T12641] ? __fget_files+0x3a6/0x420 [ 495.809400][T12641] ? __fget_files+0x2a/0x420 [ 495.809423][T12641] security_file_ioctl+0xc3/0x2a0 [ 495.809456][T12641] __se_sys_ioctl+0x47/0x170 [ 495.809486][T12641] do_syscall_64+0x14d/0xf80 [ 495.809511][T12641] ? trace_irq_disable+0x3b/0x150 [ 495.809531][T12641] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.809549][T12641] ? clear_bhb_loop+0x40/0x90 [ 495.809570][T12641] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.809588][T12641] RIP: 0033:0x7f4febd9c799 [ 495.809606][T12641] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 495.809622][T12641] RSP: 002b:00007f4fe9fee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 495.809641][T12641] RAX: ffffffffffffffda RBX: 00007f4fec015fa0 RCX: 00007f4febd9c799 [ 495.809655][T12641] RDX: 0000000000000000 RSI: 0000000040405515 RDI: 0000000000000003 [ 495.809666][T12641] RBP: 00007f4fe9fee090 R08: 0000000000000000 R09: 0000000000000000 [ 495.809678][T12641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 495.809689][T12641] R13: 00007f4fec016038 R14: 00007f4fec015fa0 R15: 00007ffc8fb3b4c8 [ 495.809717][T12641] [ 495.809836][T12641] ERROR: Out of memory at tomoyo_realpath_from_path. [ 495.980866][ T31] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 495.980897][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.980994][ T31] usb 1-1: Product: syz [ 495.981007][ T31] usb 1-1: Manufacturer: syz [ 495.981021][ T31] usb 1-1: SerialNumber: syz [ 496.858934][T12587] bridge0: port 1(bridge_slave_0) entered blocking state [ 496.859058][T12587] bridge0: port 1(bridge_slave_0) entered disabled state [ 496.859293][T12587] bridge_slave_0: entered allmulticast mode [ 496.862309][T12587] bridge_slave_0: entered promiscuous mode [ 496.872781][T12587] bridge0: port 2(bridge_slave_1) entered blocking state [ 496.872893][T12587] bridge0: port 2(bridge_slave_1) entered disabled state [ 496.873065][T12587] bridge_slave_1: entered allmulticast mode [ 496.875385][T12587] bridge_slave_1: entered promiscuous mode [ 496.988880][ T5878] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 497.139142][ T5878] usb 4-1: device descriptor read/64, error -71 [ 497.283921][ T31] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 497.283978][ T31] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 497.285063][ T31] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 497.360314][ T31] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 497.399078][ T5878] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 497.405834][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.459384][ T31] usb 1-1: USB disconnect, device number 50 [ 497.509298][ T5806] Bluetooth: hci3: command tx timeout [ 497.528877][ T5878] usb 4-1: device descriptor read/64, error -71 [ 497.604662][T12679] FAULT_INJECTION: forcing a failure. [ 497.604662][T12679] name failslab, interval 1, probability 0, space 0, times 0 [ 497.604697][T12679] CPU: 1 UID: 0 PID: 12679 Comm: syz.1.2514 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 497.604724][T12679] Tainted: [L]=SOFTLOCKUP [ 497.604731][T12679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 497.604743][T12679] Call Trace: [ 497.604752][T12679] [ 497.604760][T12679] dump_stack_lvl+0xe8/0x150 [ 497.604792][T12679] should_fail_ex+0x46b/0x600 [ 497.604821][T12679] should_failslab+0xa8/0x100 [ 497.604843][T12679] __kmalloc_noprof+0xdf/0x7b0 [ 497.604869][T12679] ? sock_kmalloc+0xd6/0x160 [ 497.604888][T12679] ? __local_bh_enable+0x1e1/0x2f0 [ 497.604916][T12679] sock_kmalloc+0xd6/0x160 [ 497.604938][T12679] af_alg_alloc_areq+0x99/0x200 [ 497.604996][T12679] skcipher_recvmsg+0x332/0x1140 [ 497.605034][T12679] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 497.605057][T12679] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 497.605081][T12679] ? security_socket_recvmsg+0x7e/0x2c0 [ 497.605106][T12679] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 497.605125][T12679] sock_recvmsg+0x172/0x1b0 [ 497.605151][T12679] ____sys_recvmsg+0x1f2/0x4b0 [ 497.605179][T12679] ? __pfx_____sys_recvmsg+0x10/0x10 [ 497.605214][T12679] ? import_iovec+0x73/0xa0 [ 497.605242][T12679] ___sys_recvmsg+0x215/0x590 [ 497.605273][T12679] ? __pfx____sys_recvmsg+0x10/0x10 [ 497.605316][T12679] ? __fget_files+0x3a6/0x420 [ 497.605348][T12679] __x64_sys_recvmsg+0x1c0/0x2a0 [ 497.605371][T12679] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 497.605399][T12679] ? __pfx_ksys_write+0x10/0x10 [ 497.605435][T12679] do_syscall_64+0x14d/0xf80 [ 497.605460][T12679] ? trace_irq_disable+0x3b/0x150 [ 497.605481][T12679] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.605500][T12679] ? clear_bhb_loop+0x40/0x90 [ 497.605522][T12679] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.605541][T12679] RIP: 0033:0x7f4febd9c799 [ 497.605559][T12679] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 497.605575][T12679] RSP: 002b:00007f4fe9fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 497.605595][T12679] RAX: ffffffffffffffda RBX: 00007f4fec015fa0 RCX: 00007f4febd9c799 [ 497.605608][T12679] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 497.605621][T12679] RBP: 00007f4fe9fee090 R08: 0000000000000000 R09: 0000000000000000 [ 497.605632][T12679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 497.605644][T12679] R13: 00007f4fec016038 R14: 00007f4fec015fa0 R15: 00007ffc8fb3b4c8 [ 497.605680][T12679] [ 497.639286][ T5878] usb usb4-port1: attempt power cycle [ 497.661966][T12587] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 497.976517][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.064622][T12587] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 498.088867][ T5878] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 498.110385][ T5878] usb 4-1: device descriptor read/8, error -71 [ 498.256382][T12696] overlayfs: failed to resolve './file1': -2 [ 498.378877][ T5878] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 498.381166][T12703] FAULT_INJECTION: forcing a failure. [ 498.381166][T12703] name failslab, interval 1, probability 0, space 0, times 0 [ 498.381198][T12703] CPU: 0 UID: 0 PID: 12703 Comm: syz.1.2524 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 498.381223][T12703] Tainted: [L]=SOFTLOCKUP [ 498.381230][T12703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 498.381242][T12703] Call Trace: [ 498.381250][T12703] [ 498.381258][T12703] dump_stack_lvl+0xe8/0x150 [ 498.381289][T12703] should_fail_ex+0x46b/0x600 [ 498.381316][T12703] should_failslab+0xa8/0x100 [ 498.381336][T12703] __kmalloc_noprof+0xdf/0x7b0 [ 498.381361][T12703] ? io_cache_alloc_new+0x40/0x100 [ 498.381381][T12703] ? __memcg_slab_post_alloc_hook+0x3e4/0xa20 [ 498.381406][T12703] io_cache_alloc_new+0x40/0x100 [ 498.381424][T12703] io_msg_alloc_async+0x212/0x380 [ 498.381445][T12703] io_recvmsg_prep+0x7da/0x10f0 [ 498.381479][T12703] ? __pfx_io_recvmsg_prep+0x10/0x10 [ 498.381498][T12703] ? __pfx___io_alloc_req_refill+0x10/0x10 [ 498.381528][T12703] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 498.381557][T12703] ? io_task_refs_refill+0xba/0x180 [ 498.381584][T12703] io_submit_sqes+0xb6d/0x2400 [ 498.381633][T12703] __se_sys_io_uring_enter+0x2d2/0x18c0 [ 498.381651][T12703] ? lockdep_hardirqs_on+0x7a/0x110 [ 498.381676][T12703] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 498.381684][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.381710][T12703] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 498.381729][T12703] ? fput+0xa0/0xd0 [ 498.381750][T12703] ? ksys_write+0x248/0x270 [ 498.381774][T12703] ? __pfx_ksys_write+0x10/0x10 [ 498.381803][T12703] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 498.381823][T12703] do_syscall_64+0x14d/0xf80 [ 498.381844][T12703] ? trace_irq_disable+0x3b/0x150 [ 498.381864][T12703] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.381882][T12703] ? clear_bhb_loop+0x40/0x90 [ 498.381901][T12703] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.381917][T12703] RIP: 0033:0x7f4febd9c799 [ 498.381934][T12703] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.381948][T12703] RSP: 002b:00007f4fe9fee028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 498.381967][T12703] RAX: ffffffffffffffda RBX: 00007f4fec015fa0 RCX: 00007f4febd9c799 [ 498.381980][T12703] RDX: 0000000000000000 RSI: 00000000000027e2 RDI: 0000000000000005 [ 498.381990][T12703] RBP: 00007f4fe9fee090 R08: 0000000000000000 R09: 0000000000000000 [ 498.382001][T12703] R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000001 [ 498.382012][T12703] R13: 00007f4fec016038 R14: 00007f4fec015fa0 R15: 00007ffc8fb3b4c8 [ 498.382037][T12703] [ 498.429263][ T5878] usb 4-1: device descriptor read/8, error -71 [ 498.558918][ T5878] usb usb4-port1: unable to enumerate USB device [ 498.775794][T12587] team0: Port device team_slave_0 added [ 498.777823][T12587] team0: Port device team_slave_1 added [ 498.886295][T12716] FAULT_INJECTION: forcing a failure. [ 498.886295][T12716] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 498.886329][T12716] CPU: 1 UID: 0 PID: 12716 Comm: syz.1.2529 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 498.886353][T12716] Tainted: [L]=SOFTLOCKUP [ 498.886360][T12716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 498.886370][T12716] Call Trace: [ 498.886378][T12716] [ 498.886387][T12716] dump_stack_lvl+0xe8/0x150 [ 498.886417][T12716] should_fail_ex+0x46b/0x600 [ 498.886443][T12716] _copy_from_user+0x2d/0xb0 [ 498.886467][T12716] __copy_msghdr+0x3c5/0x5b0 [ 498.886486][T12716] ___sys_sendmsg+0x213/0x360 [ 498.886502][T12716] ? __pfx____sys_sendmsg+0x10/0x10 [ 498.886552][T12716] ? __fget_files+0x2a/0x420 [ 498.886572][T12716] ? __fget_files+0x3a6/0x420 [ 498.886601][T12716] __x64_sys_sendmsg+0x1c3/0x2a0 [ 498.886621][T12716] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 498.886648][T12716] ? __pfx_ksys_write+0x10/0x10 [ 498.886695][T12716] do_syscall_64+0x14d/0xf80 [ 498.886719][T12716] ? trace_irq_disable+0x3b/0x150 [ 498.886738][T12716] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.886757][T12716] ? clear_bhb_loop+0x40/0x90 [ 498.886777][T12716] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.886793][T12716] RIP: 0033:0x7f4febd9c799 [ 498.886811][T12716] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.886825][T12716] RSP: 002b:00007f4fe9fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 498.886844][T12716] RAX: ffffffffffffffda RBX: 00007f4fec015fa0 RCX: 00007f4febd9c799 [ 498.886857][T12716] RDX: 0000000000000080 RSI: 00002000000008c0 RDI: 0000000000000005 [ 498.886868][T12716] RBP: 00007f4fe9fee090 R08: 0000000000000000 R09: 0000000000000000 [ 498.886880][T12716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.886889][T12716] R13: 00007f4fec016038 R14: 00007f4fec015fa0 R15: 00007ffc8fb3b4c8 [ 498.886916][T12716] [ 499.344052][ T12] team0: Port device netdevsim0 removed [ 499.354571][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.480484][T12587] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 499.480500][T12587] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.480526][T12587] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 499.484896][T12587] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 499.484910][T12587] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.484933][T12587] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 499.589047][ T5806] Bluetooth: hci3: command tx timeout [ 499.802553][T12587] hsr_slave_0: entered promiscuous mode [ 499.803559][T12587] hsr_slave_1: entered promiscuous mode [ 499.804217][T12587] debugfs: 'hsr0' already exists in 'hsr' [ 499.804235][T12587] Cannot create hsr debugfs directory [ 499.957553][T12763] overlayfs: failed to resolve './file1': -2 [ 501.360231][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.360297][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.591866][ T12] bridge_slave_1: left allmulticast mode [ 501.591892][ T12] bridge_slave_1: left promiscuous mode [ 501.592119][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.668990][ T5806] Bluetooth: hci3: command tx timeout [ 501.708545][ T12] bridge_slave_0: left allmulticast mode [ 501.708572][ T12] bridge_slave_0: left promiscuous mode [ 501.715087][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 501.821135][ T12] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 501.860419][T12810] overlayfs: failed to resolve './file1': -2 [ 502.038853][ T31] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 502.200712][ T31] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 502.200741][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.220785][ T31] usb 4-1: config 0 descriptor?? [ 502.258074][ T31] cp210x 4-1:0.0: cp210x converter detected [ 502.270838][T12162] usb 1-1: new low-speed USB device number 51 using dummy_hcd [ 502.427938][T12162] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 502.427965][T12162] usb 1-1: config 0 has no interface number 0 [ 502.428059][T12162] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 502.428084][T12162] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 502.428122][T12162] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 502.428143][T12162] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.449412][T12162] usb 1-1: config 0 descriptor?? [ 502.451038][T12816] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 502.529590][T12162] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 502.576879][ T12] batman_adv: batadv0: Removing interface: ip6gretap1 [ 502.695261][ C1] iowarrior 1-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 502.697195][ T5783] usb 1-1: USB disconnect, device number 51 [ 502.715152][ T31] cp210x 4-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 502.749088][T12806] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2563'. [ 502.961807][ T31] cp210x 4-1:0.0: failed to get vendor val 0x370c size 15: -71 [ 502.961863][ T31] cp210x 4-1:0.0: GPIO initialisation failed: -71 [ 502.974113][ T31] usb 4-1: cp210x converter now attached to ttyUSB0 [ 502.979216][ T31] usb 4-1: USB disconnect, device number 15 [ 502.985176][ T31] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 502.986689][ T31] cp210x 4-1:0.0: device disconnected [ 503.293458][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 503.559620][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 504.327177][ T12] bond0 (unregistering): Released all slaves [ 504.793640][T12868] FAULT_INJECTION: forcing a failure. [ 504.793640][T12868] name failslab, interval 1, probability 0, space 0, times 0 [ 504.793696][T12868] CPU: 1 UID: 0 PID: 12868 Comm: syz.1.2589 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 504.793722][T12868] Tainted: [L]=SOFTLOCKUP [ 504.793729][T12868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 504.793739][T12868] Call Trace: [ 504.793747][T12868] [ 504.793756][T12868] dump_stack_lvl+0xe8/0x150 [ 504.793789][T12868] should_fail_ex+0x46b/0x600 [ 504.793819][T12868] should_failslab+0xa8/0x100 [ 504.793841][T12868] __kmalloc_noprof+0xdf/0x7b0 [ 504.793866][T12868] ? tomoyo_encode+0x68/0x550 [ 504.793885][T12868] ? tomoyo_encode+0x28b/0x550 [ 504.793911][T12868] tomoyo_encode+0x28b/0x550 [ 504.793936][T12868] tomoyo_realpath_from_path+0x58d/0x5d0 [ 504.793967][T12868] ? tomoyo_path_number_perm+0x219/0x630 [ 504.793993][T12868] tomoyo_path_number_perm+0x246/0x630 [ 504.794021][T12868] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 504.794050][T12868] ? __lock_acquire+0x6b5/0x2cf0 [ 504.794080][T12868] ? __pfx___schedule+0x10/0x10 [ 504.794132][T12868] ? __fget_files+0x2a/0x420 [ 504.794158][T12868] ? __fget_files+0x2a/0x420 [ 504.794177][T12868] ? __fget_files+0x3a6/0x420 [ 504.794197][T12868] ? __fget_files+0x2a/0x420 [ 504.794222][T12868] security_file_ioctl+0xc3/0x2a0 [ 504.794252][T12868] __se_sys_ioctl+0x47/0x170 [ 504.794280][T12868] do_syscall_64+0x14d/0xf80 [ 504.794305][T12868] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.794324][T12868] ? clear_bhb_loop+0x40/0x90 [ 504.794347][T12868] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.794365][T12868] RIP: 0033:0x7f4febd9c799 [ 504.794384][T12868] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 504.794400][T12868] RSP: 002b:00007f4fe9fac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 504.794421][T12868] RAX: ffffffffffffffda RBX: 00007f4fec016180 RCX: 00007f4febd9c799 [ 504.794435][T12868] RDX: 0000200000000380 RSI: 00000000000089e3 RDI: 0000000000000004 [ 504.794448][T12868] RBP: 00007f4fe9fac090 R08: 0000000000000000 R09: 0000000000000000 [ 504.794461][T12868] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 504.794472][T12868] R13: 00007f4fec016218 R14: 00007f4fec016180 R15: 00007ffc8fb3b4c8 [ 504.794503][T12868] [ 504.794657][T12868] ERROR: Out of memory at tomoyo_realpath_from_path. [ 505.541528][T12162] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 505.697938][T12162] usb 4-1: Using ep0 maxpacket: 32 [ 505.702277][T12162] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 505.702306][T12162] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 505.703910][T12162] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 505.703934][T12162] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 505.703952][T12162] usb 4-1: Product: syz [ 505.703964][T12162] usb 4-1: Manufacturer: syz [ 505.784991][T12162] hub 4-1:4.0: USB hub found [ 505.829444][ T31] usb 1-1: new low-speed USB device number 52 using dummy_hcd [ 505.982899][ T31] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 505.982926][ T31] usb 1-1: config 0 has no interface number 0 [ 505.983018][ T31] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 505.983045][ T31] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 505.983083][ T31] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 505.983104][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.011020][T12162] hub 4-1:4.0: 2 ports detected [ 506.013329][ T31] usb 1-1: config 0 descriptor?? [ 506.014775][T12874] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 506.098123][ T31] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 506.237451][ T31] usb 1-1: USB disconnect, device number 52 [ 506.667420][T12912] FAULT_INJECTION: forcing a failure. [ 506.667420][T12912] name failslab, interval 1, probability 0, space 0, times 0 [ 506.667453][T12912] CPU: 0 UID: 0 PID: 12912 Comm: syz.1.2606 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 506.667476][T12912] Tainted: [L]=SOFTLOCKUP [ 506.667482][T12912] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 506.667492][T12912] Call Trace: [ 506.667500][T12912] [ 506.667507][T12912] dump_stack_lvl+0xe8/0x150 [ 506.667535][T12912] should_fail_ex+0x46b/0x600 [ 506.667560][T12912] should_failslab+0xa8/0x100 [ 506.667579][T12912] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 506.667602][T12912] ? __alloc_skb+0x1d0/0x7d0 [ 506.667624][T12912] ? lockdep_hardirqs_on+0x7a/0x110 [ 506.667651][T12912] __alloc_skb+0x1d0/0x7d0 [ 506.667675][T12912] netlink_sendmsg+0x5d4/0xb40 [ 506.667705][T12912] ? __pfx_netlink_sendmsg+0x10/0x10 [ 506.667726][T12912] ? unwind_get_return_address+0x4d/0x90 [ 506.667746][T12912] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 506.667773][T12912] ____sys_sendmsg+0x94c/0x9c0 [ 506.667794][T12912] ? __pfx_____sys_sendmsg+0x10/0x10 [ 506.667818][T12912] ? import_iovec+0x73/0xa0 [ 506.667843][T12912] ___sys_sendmsg+0x2a5/0x360 [ 506.667863][T12912] ? __pfx____sys_sendmsg+0x10/0x10 [ 506.667906][T12912] ? __fget_files+0x2a/0x420 [ 506.667924][T12912] ? __fget_files+0x3a6/0x420 [ 506.667951][T12912] __x64_sys_sendmsg+0x1c3/0x2a0 [ 506.667970][T12912] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 506.667994][T12912] ? __pfx_ksys_write+0x10/0x10 [ 506.668025][T12912] do_syscall_64+0x14d/0xf80 [ 506.668047][T12912] ? trace_irq_disable+0x3b/0x150 [ 506.668065][T12912] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.668082][T12912] ? clear_bhb_loop+0x40/0x90 [ 506.668101][T12912] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.668117][T12912] RIP: 0033:0x7f4febd9c799 [ 506.668133][T12912] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 506.668147][T12912] RSP: 002b:00007f4fe9fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 506.668165][T12912] RAX: ffffffffffffffda RBX: 00007f4fec015fa0 RCX: 00007f4febd9c799 [ 506.668178][T12912] RDX: 0000000000004000 RSI: 0000200000000240 RDI: 0000000000000004 [ 506.668189][T12912] RBP: 00007f4fe9fee090 R08: 0000000000000000 R09: 0000000000000000 [ 506.668199][T12912] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 506.668210][T12912] R13: 00007f4fec016038 R14: 00007f4fec015fa0 R15: 00007ffc8fb3b4c8 [ 506.668236][T12912] [ 507.213435][T12162] hub 4-1:4.0: activate --> -90 [ 508.243641][T12872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.244201][T12872] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.248232][T12872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.248704][T12872] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.310546][T12162] usb 4-1-port2: cannot warm reset (err = -71) [ 508.310865][T12162] usb 4-1-port2: cannot warm reset (err = -71) [ 508.310868][ T5783] usb 4-1: USB disconnect, device number 16 [ 508.310881][T12162] usb 4-1-port2: Cannot enable. Maybe the USB cable is bad? [ 508.475118][T12945] overlayfs: failed to clone upperpath [ 511.138917][ T5996] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 511.158934][ T12] hsr_slave_0: left promiscuous mode [ 511.178920][ T12] hsr_slave_1: left promiscuous mode [ 511.179880][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 511.179903][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 511.250705][ T12] veth1_macvtap: left promiscuous mode [ 511.250876][ T12] veth0_macvtap: left promiscuous mode [ 511.252168][ T12] veth1_vlan: left promiscuous mode [ 511.252464][ T12] veth0_vlan: left promiscuous mode [ 511.288838][ T5996] usb 4-1: Using ep0 maxpacket: 8 [ 511.291767][ T5996] usb 4-1: unable to get BOS descriptor or descriptor too short [ 511.292923][ T5996] usb 4-1: config 8 has 1 interface, different from the descriptor's value: 9 [ 511.298965][ T5996] usb 4-1: New USB device found, idVendor=0423, idProduct=000a, bcdDevice= 0.00 [ 511.298989][ T5996] usb 4-1: New USB device strings: Mfr=229, Product=1, SerialNumber=3 [ 511.299007][ T5996] usb 4-1: Product: syz [ 511.299019][ T5996] usb 4-1: Manufacturer: syz [ 511.299032][ T5996] usb 4-1: SerialNumber: syz [ 511.679189][ T5996] usb 4-1: selecting invalid altsetting 1 [ 511.679213][ T5996] catc 4-1:8.0: Can't set altsetting 1. [ 511.679269][ T5996] catc 4-1:8.0: probe with driver catc failed with error -5 [ 511.686816][ T5996] usb 4-1: USB disconnect, device number 17 [ 512.031557][ T12] team0 (unregistering): Port device team_slave_1 removed [ 512.061679][ T12] team0 (unregistering): Port device team_slave_0 removed [ 512.471132][T13005] overlayfs: failed to clone upperpath [ 512.909029][T13021] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2648'. [ 513.680367][T12587] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 513.923247][T12587] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 514.719501][T12587] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 515.739288][T12587] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 516.570205][T13070] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 516.571912][ T36] audit: type=1326 audit(2000000363.700:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13069 comm="syz.0.2663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a9a7ac799 code=0x7ffc0000 [ 516.571956][ T36] audit: type=1326 audit(2000000363.700:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13069 comm="syz.0.2663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a9a7ac799 code=0x7ffc0000 [ 516.571992][ T36] audit: type=1326 audit(2000000363.700:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13069 comm="syz.0.2663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=107 compat=0 ip=0x7f0a9a7ac799 code=0x7ffc0000 [ 516.572031][ T36] audit: type=1326 audit(2000000363.700:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13069 comm="syz.0.2663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a9a7ac799 code=0x7ffc0000 [ 516.572067][ T36] audit: type=1326 audit(2000000363.700:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13069 comm="syz.0.2663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a9a7ac799 code=0x7ffc0000 [ 516.572104][ T36] audit: type=1326 audit(2000000363.700:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13069 comm="syz.0.2663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f0a9a7ac799 code=0x7ffc0000 [ 516.572140][ T36] audit: type=1326 audit(2000000363.700:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13069 comm="syz.0.2663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a9a7ac799 code=0x7ffc0000 [ 516.572178][ T36] audit: type=1326 audit(2000000363.700:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13069 comm="syz.0.2663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a9a7ac799 code=0x7ffc0000 [ 516.572215][ T36] audit: type=1326 audit(2000000363.700:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13069 comm="syz.0.2663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7f0a9a7ac799 code=0x7ffc0000 [ 516.572252][ T36] audit: type=1326 audit(2000000363.700:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13069 comm="syz.0.2663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a9a7ac799 code=0x7ffc0000 [ 517.717873][T13076] orangefs_mount: mount request failed with -4 [ 518.021591][T12587] 8021q: adding VLAN 0 to HW filter on device bond0 [ 518.091288][T13090] FAULT_INJECTION: forcing a failure. [ 518.091288][T13090] name failslab, interval 1, probability 0, space 0, times 0 [ 518.091345][T13090] CPU: 1 UID: 0 PID: 13090 Comm: syz.1.2666 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 518.091371][T13090] Tainted: [L]=SOFTLOCKUP [ 518.091379][T13090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 518.091390][T13090] Call Trace: [ 518.091399][T13090] [ 518.091408][T13090] dump_stack_lvl+0xe8/0x150 [ 518.091440][T13090] should_fail_ex+0x46b/0x600 [ 518.091468][T13090] should_failslab+0xa8/0x100 [ 518.091489][T13090] __kmalloc_noprof+0xdf/0x7b0 [ 518.091515][T13090] ? tomoyo_encode+0x28b/0x550 [ 518.091541][T13090] tomoyo_encode+0x28b/0x550 [ 518.091567][T13090] tomoyo_realpath_from_path+0x58d/0x5d0 [ 518.091599][T13090] ? tomoyo_path_number_perm+0x219/0x630 [ 518.091626][T13090] tomoyo_path_number_perm+0x246/0x630 [ 518.091651][T13090] ? rcu_is_watching+0x15/0xb0 [ 518.091672][T13090] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 518.091701][T13090] ? __lock_acquire+0x6b5/0x2cf0 [ 518.091720][T13090] ? __pfx___schedule+0x10/0x10 [ 518.091792][T13090] ? security_file_ioctl+0x246/0x2a0 [ 518.091824][T13090] security_file_ioctl+0xc3/0x2a0 [ 518.091851][T13090] __se_sys_ioctl+0x47/0x170 [ 518.091886][T13090] do_syscall_64+0x14d/0xf80 [ 518.091911][T13090] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.091929][T13090] ? clear_bhb_loop+0x40/0x90 [ 518.091952][T13090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.091970][T13090] RIP: 0033:0x7f4febd9c799 [ 518.091988][T13090] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 518.092005][T13090] RSP: 002b:00007f4fe9fac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 518.092025][T13090] RAX: ffffffffffffffda RBX: 00007f4fec016180 RCX: 00007f4febd9c799 [ 518.092039][T13090] RDX: 0000000000000000 RSI: 0000000000005646 RDI: 0000000000000003 [ 518.092051][T13090] RBP: 00007f4fe9fac090 R08: 0000000000000000 R09: 0000000000000000 [ 518.092063][T13090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 518.092074][T13090] R13: 00007f4fec016218 R14: 00007f4fec016180 R15: 00007ffc8fb3b4c8 [ 518.092105][T13090] [ 518.092213][T13090] ERROR: Out of memory at tomoyo_realpath_from_path. [ 518.092401][T13090] vivid-000: ================= START STATUS ================= [ 518.092548][T13090] vivid-000: Generate PTS: true [ 518.092757][T13090] vivid-000: Generate SCR: true [ 518.092906][T13090] tpg source WxH: 320x240 (Y'CbCr) [ 518.092994][T13090] tpg field: 1 [ 518.093022][T13090] tpg crop: (0,0)/320x240 [ 518.093056][T13090] tpg compose: (0,0)/320x240 [ 518.093089][T13090] tpg colorspace: 8 [ 518.093127][T13090] tpg transfer function: 0/0 [ 518.093158][T13090] tpg Y'CbCr encoding: 0/0 [ 518.093189][T13090] tpg quantization: 0/0 [ 518.093225][T13090] tpg RGB range: 0/2 [ 518.093256][T13090] vivid-000: ================== END STATUS ================== [ 518.742546][T12587] 8021q: adding VLAN 0 to HW filter on device team0 [ 518.779475][ T88] bridge0: port 1(bridge_slave_0) entered blocking state [ 518.781532][ T88] bridge0: port 1(bridge_slave_0) entered forwarding state [ 518.868419][ T88] bridge0: port 2(bridge_slave_1) entered blocking state [ 518.880704][ T88] bridge0: port 2(bridge_slave_1) entered forwarding state [ 518.884829][T13096] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2670'. [ 520.031171][T12587] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 521.375249][T13118] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2677'. [ 521.549763][T13117] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2676'. [ 521.887060][ T12] IPVS: stop unused estimator thread 0... [ 521.960917][T12587] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 521.997389][T13138] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2682'. [ 522.107628][T12587] veth0_vlan: entered promiscuous mode [ 522.191452][T12587] veth1_vlan: entered promiscuous mode [ 523.232397][T12587] veth0_macvtap: entered promiscuous mode [ 523.253269][T12587] veth1_macvtap: entered promiscuous mode [ 523.901662][T13160] netlink: 'syz.4.2690': attribute type 3 has an invalid length. [ 524.125711][T12587] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 524.194158][T13176] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2689'. [ 524.739595][T12587] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 524.932339][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.932383][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.932417][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.932449][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.016721][T13164] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2692'. [ 525.328965][ T31] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 525.329145][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 525.329161][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 525.390647][ T1296] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 525.390667][ T1296] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 525.478945][ T31] usb 4-1: Using ep0 maxpacket: 8 [ 525.481384][ T31] usb 4-1: unable to get BOS descriptor or descriptor too short [ 525.485660][ T31] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 525.485685][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.485704][ T31] usb 4-1: Product: syz [ 525.485717][ T31] usb 4-1: Manufacturer: syz [ 525.485730][ T31] usb 4-1: SerialNumber: syz [ 526.665029][ T31] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 526.670989][T13197] FAULT_INJECTION: forcing a failure. [ 526.670989][T13197] name failslab, interval 1, probability 0, space 0, times 0 [ 526.671023][T13197] CPU: 1 UID: 0 PID: 13197 Comm: syz.1.2702 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 526.671048][T13197] Tainted: [L]=SOFTLOCKUP [ 526.671055][T13197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 526.671066][T13197] Call Trace: [ 526.671073][T13197] [ 526.671082][T13197] dump_stack_lvl+0xe8/0x150 [ 526.671113][T13197] should_fail_ex+0x46b/0x600 [ 526.671140][T13197] should_failslab+0xa8/0x100 [ 526.671160][T13197] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 526.671186][T13197] ? __alloc_skb+0x1d0/0x7d0 [ 526.671209][T13197] ? lockdep_hardirqs_on+0x7a/0x110 [ 526.671238][T13197] __alloc_skb+0x1d0/0x7d0 [ 526.671265][T13197] netlink_sendmsg+0x5d4/0xb40 [ 526.671297][T13197] ? __pfx_netlink_sendmsg+0x10/0x10 [ 526.671320][T13197] ? unwind_get_return_address+0x4d/0x90 [ 526.671342][T13197] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 526.671370][T13197] ____sys_sendmsg+0x94c/0x9c0 [ 526.671393][T13197] ? __pfx_____sys_sendmsg+0x10/0x10 [ 526.671419][T13197] ? import_iovec+0x73/0xa0 [ 526.671445][T13197] ___sys_sendmsg+0x2a5/0x360 [ 526.671468][T13197] ? __pfx____sys_sendmsg+0x10/0x10 [ 526.671518][T13197] ? __fget_files+0x2a/0x420 [ 526.671537][T13197] ? __fget_files+0x3a6/0x420 [ 526.671567][T13197] __x64_sys_sendmsg+0x1c3/0x2a0 [ 526.671588][T13197] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 526.671614][T13197] ? __pfx_ksys_write+0x10/0x10 [ 526.671648][T13197] do_syscall_64+0x14d/0xf80 [ 526.671671][T13197] ? trace_irq_disable+0x3b/0x150 [ 526.671690][T13197] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.671709][T13197] ? clear_bhb_loop+0x40/0x90 [ 526.671729][T13197] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.671747][T13197] RIP: 0033:0x7f4febd9c799 [ 526.671765][T13197] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.671781][T13197] RSP: 002b:00007f4fe9fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 526.671800][T13197] RAX: ffffffffffffffda RBX: 00007f4fec015fa0 RCX: 00007f4febd9c799 [ 526.671812][T13197] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 526.671824][T13197] RBP: 00007f4fe9fee090 R08: 0000000000000000 R09: 0000000000000000 [ 526.671836][T13197] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.671847][T13197] R13: 00007f4fec016038 R14: 00007f4fec015fa0 R15: 00007ffc8fb3b4c8 [ 526.671876][T13197] [ 526.929585][T13201] FAULT_INJECTION: forcing a failure. [ 526.929585][T13201] name failslab, interval 1, probability 0, space 0, times 0 [ 526.929619][T13201] CPU: 1 UID: 0 PID: 13201 Comm: syz.2.2703 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 526.929645][T13201] Tainted: [L]=SOFTLOCKUP [ 526.929652][T13201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 526.929664][T13201] Call Trace: [ 526.929671][T13201] [ 526.929679][T13201] dump_stack_lvl+0xe8/0x150 [ 526.929710][T13201] should_fail_ex+0x46b/0x600 [ 526.929737][T13201] should_failslab+0xa8/0x100 [ 526.929757][T13201] __kmalloc_cache_node_noprof+0x8a/0x6c0 [ 526.929781][T13201] ? cap_safe_nice+0x312/0x390 [ 526.929799][T13201] ? cap_safe_nice+0x1f/0x390 [ 526.929815][T13201] ? sched_setaffinity+0x288/0x420 [ 526.929875][T13201] sched_setaffinity+0x288/0x420 [ 526.929899][T13201] ? __pfx_sched_setaffinity+0x10/0x10 [ 526.929935][T13201] __x64_sys_sched_setaffinity+0x106/0x170 [ 526.929963][T13201] ? __pfx___x64_sys_sched_setaffinity+0x10/0x10 [ 526.929998][T13201] do_syscall_64+0x14d/0xf80 [ 526.930021][T13201] ? trace_irq_disable+0x3b/0x150 [ 526.930041][T13201] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.930060][T13201] ? clear_bhb_loop+0x40/0x90 [ 526.930080][T13201] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.930097][T13201] RIP: 0033:0x7fcb3978c799 [ 526.930115][T13201] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.930130][T13201] RSP: 002b:00007fcb379e6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000cb [ 526.930150][T13201] RAX: ffffffffffffffda RBX: 00007fcb39a05fa0 RCX: 00007fcb3978c799 [ 526.930163][T13201] RDX: 0000200000000240 RSI: 0000000000000008 RDI: 0000000000000000 [ 526.930174][T13201] RBP: 00007fcb379e6090 R08: 0000000000000000 R09: 0000000000000000 [ 526.930186][T13201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.930197][T13201] R13: 00007fcb39a06038 R14: 00007fcb39a05fa0 R15: 00007ffd35e02a98 [ 526.930226][T13201] [ 527.032784][ T31] usb 4-1: USB disconnect, device number 18 [ 527.455675][T13212] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2706'. [ 528.716989][ T5970] udevd[5970]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 529.109759][T13230] 9p: Bad value for 'rfdno' [ 529.179454][ T9] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 529.198842][ T5996] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 529.358878][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 529.362280][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 529.362620][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 529.363407][ T5996] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 529.363453][ T5996] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 529.363477][ T5996] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 529.363552][ T5996] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 529.363573][ T5996] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 529.367419][ T5996] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 529.367445][ T5996] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 529.367515][ T5996] usb 4-1: Product: syz [ 529.367529][ T5996] usb 4-1: Manufacturer: syz [ 529.367542][ T5996] usb 4-1: SerialNumber: syz [ 529.489736][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 529.489763][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.489782][ T9] usb 3-1: Product: syz [ 529.489796][ T9] usb 3-1: Manufacturer: syz [ 529.489809][ T9] usb 3-1: SerialNumber: syz [ 529.551337][ T5996] usb 4-1: config 0 descriptor?? [ 529.554462][ T9] usb 3-1: config 0 descriptor?? [ 529.634993][T13248] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2721'. [ 530.076163][ T9] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 530.076254][ T9] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 530.330344][ T5996] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -32 [ 530.332284][ T5996] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -5 [ 530.407504][T13219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.429861][T13219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.709775][ T9] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 530.712447][ T9] em28xx 3-1:0.0: Config register raw data: 0x00 [ 530.816875][ T5996] usb 4-1: USB disconnect, device number 19 [ 530.895437][ T5970] udevd[5970]: setting owner of /dev/bus/usb/004/019 to uid=0, gid=0 failed: No such file or directory [ 531.130892][ T993] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 531.420930][ T993] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 531.420956][ T993] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 531.423518][ T993] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 531.423543][ T993] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 531.423562][ T993] usb 1-1: SerialNumber: syz [ 531.901034][T13284] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2736'. [ 533.063719][ T993] usb 1-1: 0:2 : does not exist [ 533.063808][ T993] usb 1-1: unit 5: unexpected type 0x09 [ 533.073497][T13289] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2739'. [ 533.096264][T13289] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2739'. [ 533.096290][T13289] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2739'. [ 533.096309][T13289] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2739'. [ 533.186594][ T5841] usb 3-1: USB disconnect, device number 47 [ 533.189134][ T5841] em28xx 3-1:0.0: Disconnecting em28xx [ 533.212034][ T5841] em28xx 3-1:0.0: Freeing device [ 533.250122][ T993] usb 1-1: USB disconnect, device number 53 [ 533.349609][T13300] overlayfs: failed to resolve './file1': -2 [ 533.484166][ T5935] udevd[5935]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 535.288476][T13342] FAULT_INJECTION: forcing a failure. [ 535.288476][T13342] name failslab, interval 1, probability 0, space 0, times 0 [ 535.288510][T13342] CPU: 0 UID: 0 PID: 13342 Comm: syz.2.2757 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 535.288536][T13342] Tainted: [L]=SOFTLOCKUP [ 535.288543][T13342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 535.288555][T13342] Call Trace: [ 535.288564][T13342] [ 535.288572][T13342] dump_stack_lvl+0xe8/0x150 [ 535.288602][T13342] should_fail_ex+0x46b/0x600 [ 535.288630][T13342] should_failslab+0xa8/0x100 [ 535.288651][T13342] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 535.288675][T13342] ? __alloc_skb+0x1d0/0x7d0 [ 535.288698][T13342] ? lockdep_hardirqs_on+0x7a/0x110 [ 535.288728][T13342] __alloc_skb+0x1d0/0x7d0 [ 535.288755][T13342] netlink_sendmsg+0x5d4/0xb40 [ 535.288787][T13342] ? __pfx_netlink_sendmsg+0x10/0x10 [ 535.288811][T13342] ? unwind_get_return_address+0x4d/0x90 [ 535.288833][T13342] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 535.288860][T13342] ____sys_sendmsg+0x94c/0x9c0 [ 535.288883][T13342] ? __pfx_____sys_sendmsg+0x10/0x10 [ 535.288910][T13342] ? import_iovec+0x73/0xa0 [ 535.288937][T13342] ___sys_sendmsg+0x2a5/0x360 [ 535.288953][T13342] ? get_pid_task+0x20/0x1f0 [ 535.288976][T13342] ? __pfx____sys_sendmsg+0x10/0x10 [ 535.289014][T13342] ? sb_end_write+0xe9/0x1c0 [ 535.289046][T13342] ? __pfx_vfs_write+0x10/0x10 [ 535.289078][T13342] __x64_sys_sendmsg+0x1c3/0x2a0 [ 535.289106][T13342] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 535.289133][T13342] ? __pfx_ksys_write+0x10/0x10 [ 535.289168][T13342] do_syscall_64+0x14d/0xf80 [ 535.289191][T13342] ? trace_irq_disable+0x3b/0x150 [ 535.289211][T13342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.289230][T13342] ? clear_bhb_loop+0x40/0x90 [ 535.289252][T13342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.289270][T13342] RIP: 0033:0x7fcb3978c799 [ 535.289288][T13342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.289304][T13342] RSP: 002b:00007fcb379e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 535.289323][T13342] RAX: ffffffffffffffda RBX: 00007fcb39a05fa0 RCX: 00007fcb3978c799 [ 535.289337][T13342] RDX: 000000000000c000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 535.289350][T13342] RBP: 00007fcb379e6090 R08: 0000000000000000 R09: 0000000000000000 [ 535.289361][T13342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 535.289373][T13342] R13: 00007fcb39a06038 R14: 00007fcb39a05fa0 R15: 00007ffd35e02a98 [ 535.289403][T13342] [ 535.453312][T13349] overlayfs: failed to resolve './file1': -2 [ 535.454883][ T993] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 535.614346][ T993] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 535.614374][ T993] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 535.614392][ T993] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 535.616802][ T993] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 535.616828][ T993] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 535.616846][ T993] usb 4-1: Product: syz [ 535.616858][ T993] usb 4-1: Manufacturer: syz [ 535.882381][T13336] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2758'. [ 535.913904][ T5996] usb 4-1: USB disconnect, device number 20 [ 537.413725][T13398] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2775'. [ 538.351296][T13396] FAULT_INJECTION: forcing a failure. [ 538.351296][T13396] name failslab, interval 1, probability 0, space 0, times 0 [ 538.351330][T13396] CPU: 1 UID: 0 PID: 13396 Comm: syz.1.2779 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 538.351358][T13396] Tainted: [L]=SOFTLOCKUP [ 538.351365][T13396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 538.351377][T13396] Call Trace: [ 538.351385][T13396] [ 538.351393][T13396] dump_stack_lvl+0xe8/0x150 [ 538.351423][T13396] should_fail_ex+0x46b/0x600 [ 538.351450][T13396] should_failslab+0xa8/0x100 [ 538.351470][T13396] __kmalloc_noprof+0xdf/0x7b0 [ 538.351495][T13396] ? tomoyo_encode+0x28b/0x550 [ 538.351521][T13396] tomoyo_encode+0x28b/0x550 [ 538.351547][T13396] tomoyo_realpath_from_path+0x58d/0x5d0 [ 538.351577][T13396] ? tomoyo_path_number_perm+0x219/0x630 [ 538.351603][T13396] tomoyo_path_number_perm+0x246/0x630 [ 538.351631][T13396] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 538.351658][T13396] ? __lock_acquire+0x6b5/0x2cf0 [ 538.351706][T13396] ? __fget_files+0x2a/0x420 [ 538.351731][T13396] ? __fget_files+0x2a/0x420 [ 538.351750][T13396] ? __fget_files+0x3a6/0x420 [ 538.351770][T13396] ? __fget_files+0x2a/0x420 [ 538.351794][T13396] security_file_ioctl+0xc3/0x2a0 [ 538.351821][T13396] __se_sys_ioctl+0x47/0x170 [ 538.351848][T13396] do_syscall_64+0x14d/0xf80 [ 538.351873][T13396] ? trace_irq_disable+0x3b/0x150 [ 538.351892][T13396] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.351910][T13396] ? clear_bhb_loop+0x40/0x90 [ 538.351931][T13396] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.351949][T13396] RIP: 0033:0x7f4febd9c799 [ 538.351967][T13396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 538.351984][T13396] RSP: 002b:00007f4fe9fee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 538.352002][T13396] RAX: ffffffffffffffda RBX: 00007f4fec015fa0 RCX: 00007f4febd9c799 [ 538.352016][T13396] RDX: 0000200000000540 RSI: 0000000040505331 RDI: 0000000000000004 [ 538.352028][T13396] RBP: 00007f4fe9fee090 R08: 0000000000000000 R09: 0000000000000000 [ 538.352040][T13396] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 538.352051][T13396] R13: 00007f4fec016038 R14: 00007f4fec015fa0 R15: 00007ffc8fb3b4c8 [ 538.352083][T13396] [ 538.352271][T13396] ERROR: Out of memory at tomoyo_realpath_from_path. [ 538.421719][T13401] FAULT_INJECTION: forcing a failure. [ 538.421719][T13401] name failslab, interval 1, probability 0, space 0, times 0 [ 538.421752][T13401] CPU: 1 UID: 0 PID: 13401 Comm: syz.2.2780 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 538.421777][T13401] Tainted: [L]=SOFTLOCKUP [ 538.421784][T13401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 538.421794][T13401] Call Trace: [ 538.421802][T13401] [ 538.421810][T13401] dump_stack_lvl+0xe8/0x150 [ 538.421840][T13401] should_fail_ex+0x46b/0x600 [ 538.421867][T13401] should_failslab+0xa8/0x100 [ 538.421886][T13401] __kmalloc_noprof+0xdf/0x7b0 [ 538.421911][T13401] ? do_sys_poll+0x30a/0xfa0 [ 538.421936][T13401] do_sys_poll+0x30a/0xfa0 [ 538.421969][T13401] ? __pfx_do_sys_poll+0x10/0x10 [ 538.421987][T13401] ? __lock_acquire+0x6b5/0x2cf0 [ 538.422010][T13401] ? is_bpf_text_address+0x26/0x2b0 [ 538.422116][T13401] ? set_user_sigmask+0xcd/0x1c0 [ 538.422141][T13401] ? __pfx_set_user_sigmask+0x10/0x10 [ 538.422162][T13401] ? kmem_cache_free+0x185/0x6b0 [ 538.422178][T13401] ? do_sys_openat2+0x14c/0x200 [ 538.422205][T13401] __se_sys_ppoll+0x209/0x2b0 [ 538.422230][T13401] ? __pfx___se_sys_ppoll+0x10/0x10 [ 538.422250][T13401] ? __pfx_ksys_write+0x10/0x10 [ 538.422286][T13401] ? __x64_sys_ppoll+0x20/0xc0 [ 538.422307][T13401] do_syscall_64+0x14d/0xf80 [ 538.422331][T13401] ? trace_irq_disable+0x3b/0x150 [ 538.422351][T13401] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.422369][T13401] ? clear_bhb_loop+0x40/0x90 [ 538.422390][T13401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.422407][T13401] RIP: 0033:0x7fcb3978c799 [ 538.422424][T13401] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 538.422439][T13401] RSP: 002b:00007fcb379e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 538.422458][T13401] RAX: ffffffffffffffda RBX: 00007fcb39a05fa0 RCX: 00007fcb3978c799 [ 538.422472][T13401] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 538.422484][T13401] RBP: 00007fcb379e6090 R08: 0000000000000000 R09: 0000000000000000 [ 538.422496][T13401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 538.422507][T13401] R13: 00007fcb39a06038 R14: 00007fcb39a05fa0 R15: 00007ffd35e02a98 [ 538.422536][T13401] [ 538.529101][ T9] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 538.742754][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 538.884357][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 538.885678][ T9] usb 1-1: config 8 has 1 interface, different from the descriptor's value: 9 [ 538.888084][ T9] usb 1-1: New USB device found, idVendor=0423, idProduct=000a, bcdDevice= 0.00 [ 538.888108][ T9] usb 1-1: New USB device strings: Mfr=229, Product=1, SerialNumber=3 [ 538.888127][ T9] usb 1-1: Product: syz [ 538.888140][ T9] usb 1-1: Manufacturer: syz [ 538.888153][ T9] usb 1-1: SerialNumber: syz [ 539.238367][ T9] usb 1-1: selecting invalid altsetting 1 [ 539.238389][ T9] catc 1-1:8.0: Can't set altsetting 1. [ 539.238444][ T9] catc 1-1:8.0: probe with driver catc failed with error -5 [ 539.340259][ T9] usb 1-1: USB disconnect, device number 54 [ 539.643522][T13412] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2784'. [ 540.720489][T13420] overlayfs: failed to resolve './file1': -2 [ 544.739838][T13443] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2794'. [ 545.864212][ T5801] Bluetooth: hci5: command 0x0406 tx timeout [ 550.952137][T13486] FAULT_INJECTION: forcing a failure. [ 550.952137][T13486] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 550.952172][T13486] CPU: 1 UID: 0 PID: 13486 Comm: syz.3.2812 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 550.952196][T13486] Tainted: [L]=SOFTLOCKUP [ 550.952204][T13486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 550.952214][T13486] Call Trace: [ 550.952222][T13486] [ 550.952230][T13486] dump_stack_lvl+0xe8/0x150 [ 550.952261][T13486] should_fail_ex+0x46b/0x600 [ 550.952287][T13486] _copy_from_user+0x2d/0xb0 [ 550.952311][T13486] core_sys_select+0x6ff/0xc30 [ 550.952348][T13486] ? __pfx_core_sys_select+0x10/0x10 [ 550.952390][T13486] ? __pfx_set_user_sigmask+0x10/0x10 [ 550.952413][T13486] ? rt_mutex_slowunlock+0x1cb/0x300 [ 550.952435][T13486] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 550.952462][T13486] __se_sys_pselect6+0x267/0x320 [ 550.952488][T13486] ? __pfx___se_sys_pselect6+0x10/0x10 [ 550.952508][T13486] ? __pfx_ksys_write+0x10/0x10 [ 550.952537][T13486] ? __x64_sys_pselect6+0x21/0xf0 [ 550.952560][T13486] do_syscall_64+0x14d/0xf80 [ 550.952583][T13486] ? trace_irq_disable+0x3b/0x150 [ 550.952603][T13486] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.952621][T13486] ? clear_bhb_loop+0x40/0x90 [ 550.952643][T13486] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.952661][T13486] RIP: 0033:0x7f3a511ac799 [ 550.952679][T13486] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 550.952695][T13486] RSP: 002b:00007f3a4f364028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 550.952715][T13486] RAX: ffffffffffffffda RBX: 00007f3a51426090 RCX: 00007f3a511ac799 [ 550.952729][T13486] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 550.952741][T13486] RBP: 00007f3a4f364090 R08: 0000000000000000 R09: 0000000000000000 [ 550.952753][T13486] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 550.952765][T13486] R13: 00007f3a51426128 R14: 00007f3a51426090 R15: 00007fff5ee96be8 [ 550.952795][T13486] [ 552.022579][T13490] overlayfs: failed to resolve './file1': -2 [ 557.680917][ T5801] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 557.702272][ T5801] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 557.704427][ T5801] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 557.707105][ T5801] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 557.707800][ T5801] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 559.100951][ T5806] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 559.120645][ T5806] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 559.128935][ T5806] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 559.131062][ T5806] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 559.132566][ T5806] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 559.956186][ T5806] Bluetooth: hci0: command tx timeout [ 561.321103][T12162] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 561.878021][T12162] usb 4-1: Using ep0 maxpacket: 32 [ 561.879923][T12162] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 561.879946][T12162] usb 4-1: config 0 has no interface number 0 [ 561.882571][T12162] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 561.882596][T12162] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 561.882614][T12162] usb 4-1: Product: syz [ 561.882626][T12162] usb 4-1: Manufacturer: syz [ 561.882641][T12162] usb 4-1: SerialNumber: syz [ 561.956086][T12162] usb 4-1: config 0 descriptor?? [ 561.961598][T12162] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 561.961699][T12162] usb 4-1: selecting invalid altsetting 1 [ 561.961715][T12162] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 562.007495][ T5806] Bluetooth: hci6: command tx timeout [ 562.033178][T12162] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 562.033717][T12162] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 562.033766][T12162] usb 4-1: media controller created [ 562.080697][T12162] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 562.178486][ T5806] Bluetooth: hci0: command tx timeout [ 563.315231][T13525] syz_tun: entered allmulticast mode [ 563.327825][T13523] syz_tun: left allmulticast mode [ 563.352793][T12162] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 563.352855][T12162] zl10353_read_register: readreg error (reg=127, ret==-71) [ 563.355522][T12162] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 564.171918][T13532] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 564.184537][ T5801] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 564.195317][ T5801] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 564.198330][ T5801] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 564.232415][ T5801] Bluetooth: hci6: command tx timeout [ 564.237158][ T5801] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 564.293475][ T5801] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 564.432062][ T5801] Bluetooth: hci0: command tx timeout [ 564.833995][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 564.834058][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.912929][T12162] usb 4-1: USB disconnect, device number 21 [ 565.962139][T12162] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 566.169719][ T5801] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 566.184101][ T5801] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 566.193365][ T5801] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 566.309057][T12162] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 566.309087][T12162] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 55 [ 566.334977][ T5801] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 566.335734][ T5801] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 566.477628][ T5806] Bluetooth: hci6: command tx timeout [ 566.588394][T12162] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 566.588425][T12162] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.588443][T12162] usb 4-1: Product: syz [ 566.588455][T12162] usb 4-1: Manufacturer: syz [ 566.588468][T12162] usb 4-1: SerialNumber: syz [ 566.593628][T12162] usb 4-1: config 0 descriptor?? [ 566.594438][T13536] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 566.600012][T12162] usb 4-1: 0:0 : invalid sync pipe. bmAttributes 3a, bLength 9, bSynchAddress 00 [ 566.622635][ T5806] Bluetooth: hci0: command tx timeout [ 567.042892][ T5806] Bluetooth: hci1: command tx timeout [ 568.588869][ T5806] Bluetooth: hci7: command tx timeout [ 568.674413][ T5806] Bluetooth: hci6: command tx timeout [ 568.815228][T13507] chnl_net:caif_netlink_parms(): no params data found [ 569.198078][ T5806] Bluetooth: hci1: command tx timeout [ 570.891525][ T5806] Bluetooth: hci7: command tx timeout [ 571.410027][ T5806] Bluetooth: hci1: command tx timeout [ 571.442565][T12162] usb 4-1: USB disconnect, device number 22 [ 571.519869][T13553] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2830'. [ 571.756980][T13507] bridge0: port 1(bridge_slave_0) entered blocking state [ 571.757281][T13507] bridge0: port 1(bridge_slave_0) entered disabled state [ 571.757483][T13507] bridge_slave_0: entered allmulticast mode [ 571.759969][T13507] bridge_slave_0: entered promiscuous mode [ 571.918118][T13507] bridge0: port 2(bridge_slave_1) entered blocking state [ 571.918238][T13507] bridge0: port 2(bridge_slave_1) entered disabled state [ 571.918433][T13507] bridge_slave_1: entered allmulticast mode [ 571.927928][T13507] bridge_slave_1: entered promiscuous mode [ 572.965810][T13507] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 573.034264][ T5806] Bluetooth: hci7: command tx timeout [ 573.035769][T13507] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 573.062226][T13511] chnl_net:caif_netlink_parms(): no params data found [ 573.100414][T12162] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 573.479166][T13561] FAULT_INJECTION: forcing a failure. [ 573.479166][T13561] name failslab, interval 1, probability 0, space 0, times 0 [ 573.479189][T13561] CPU: 1 UID: 0 PID: 13561 Comm: syz.3.2831 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 573.479203][T13561] Tainted: [L]=SOFTLOCKUP [ 573.479207][T13561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 573.479213][T13561] Call Trace: [ 573.479218][T13561] [ 573.479223][T13561] dump_stack_lvl+0xe8/0x150 [ 573.479243][T13561] should_fail_ex+0x46b/0x600 [ 573.479260][T13561] should_failslab+0xa8/0x100 [ 573.479271][T13561] __kmalloc_noprof+0xdf/0x7b0 [ 573.479285][T13561] ? __lock_acquire+0x6b5/0x2cf0 [ 573.479304][T13561] ? bpf_test_init+0x9f/0x150 [ 573.479383][T13561] bpf_test_init+0x9f/0x150 [ 573.479397][T13561] bpf_prog_test_run_flow_dissector+0x209/0x610 [ 573.479419][T13561] ? __pfx_bpf_prog_test_run_flow_dissector+0x10/0x10 [ 573.479443][T13561] ? __fget_files+0x2a/0x420 [ 573.479466][T13561] ? __fget_files+0x2a/0x420 [ 573.479479][T13561] ? __fget_files+0x3a6/0x420 [ 573.479498][T13561] ? __fget_files+0x2a/0x420 [ 573.479522][T13561] ? __pfx_bpf_prog_test_run_flow_dissector+0x10/0x10 [ 573.479546][T13561] bpf_prog_test_run+0x2cd/0x340 [ 573.479572][T13561] __sys_bpf+0x643/0x950 [ 573.479595][T13561] ? __pfx___sys_bpf+0x10/0x10 [ 573.479613][T13561] ? rt_mutex_slowunlock+0x1cb/0x300 [ 573.479634][T13561] ? ksys_write+0x248/0x270 [ 573.479650][T13561] ? __pfx_ksys_write+0x10/0x10 [ 573.479667][T13561] __x64_sys_bpf+0x7c/0x90 [ 573.479679][T13561] do_syscall_64+0x14d/0xf80 [ 573.479693][T13561] ? trace_irq_disable+0x3b/0x150 [ 573.479705][T13561] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.479715][T13561] ? clear_bhb_loop+0x40/0x90 [ 573.479727][T13561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.479738][T13561] RIP: 0033:0x7f3a511ac799 [ 573.479748][T13561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 573.479757][T13561] RSP: 002b:00007f3a4f3e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 573.479770][T13561] RAX: ffffffffffffffda RBX: 00007f3a51426090 RCX: 00007f3a511ac799 [ 573.479777][T13561] RDX: 000000000000004c RSI: 0000200000000240 RDI: 000000000000000a [ 573.479784][T13561] RBP: 00007f3a4f3e5090 R08: 0000000000000000 R09: 0000000000000000 [ 573.479790][T13561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 573.479799][T13561] R13: 00007f3a51426128 R14: 00007f3a51426090 R15: 00007fff5ee96be8 [ 573.479815][T13561] [ 573.633212][ T5806] Bluetooth: hci1: command tx timeout [ 573.705668][T13507] team0: Port device team_slave_0 added [ 573.832523][T13507] team0: Port device team_slave_1 added [ 575.257902][ T5806] Bluetooth: hci7: command tx timeout [ 575.571658][T12162] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 575.790986][T12162] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 575.791013][T12162] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 575.793757][T12162] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 575.793783][T12162] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 575.793802][T12162] usb 4-1: Product: syz [ 575.793816][T12162] usb 4-1: Manufacturer: syz [ 575.793828][T12162] usb 4-1: SerialNumber: syz [ 575.799483][T12162] usb 4-1: config 0 descriptor?? [ 576.143436][T13564] FAULT_INJECTION: forcing a failure. [ 576.143436][T13564] name failslab, interval 1, probability 0, space 0, times 0 [ 576.143470][T13564] CPU: 1 UID: 0 PID: 13564 Comm: syz.3.2832 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 576.143495][T13564] Tainted: [L]=SOFTLOCKUP [ 576.143503][T13564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 576.143514][T13564] Call Trace: [ 576.143521][T13564] [ 576.143529][T13564] dump_stack_lvl+0xe8/0x150 [ 576.143560][T13564] should_fail_ex+0x46b/0x600 [ 576.143585][T13564] should_failslab+0xa8/0x100 [ 576.143606][T13564] __kmalloc_noprof+0xdf/0x7b0 [ 576.143631][T13564] ? sock_kmalloc+0xd6/0x160 [ 576.143650][T13564] ? unwind_get_return_address+0x4d/0x90 [ 576.143673][T13564] sock_kmalloc+0xd6/0x160 [ 576.143693][T13564] ____sys_sendmsg+0x1b5/0x9c0 [ 576.143714][T13564] ? __asan_memset+0x22/0x50 [ 576.143736][T13564] ? __pfx_____sys_sendmsg+0x10/0x10 [ 576.143766][T13564] ? import_iovec+0x73/0xa0 [ 576.143791][T13564] ___sys_sendmsg+0x2a5/0x360 [ 576.143814][T13564] ? __pfx____sys_sendmsg+0x10/0x10 [ 576.143864][T13564] ? __fget_files+0x2a/0x420 [ 576.143884][T13564] ? __fget_files+0x3a6/0x420 [ 576.143915][T13564] __x64_sys_sendmsg+0x1c3/0x2a0 [ 576.143936][T13564] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 576.143963][T13564] ? __pfx_ksys_write+0x10/0x10 [ 576.143997][T13564] do_syscall_64+0x14d/0xf80 [ 576.144021][T13564] ? trace_irq_disable+0x3b/0x150 [ 576.144040][T13564] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.144059][T13564] ? clear_bhb_loop+0x40/0x90 [ 576.144087][T13564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.144106][T13564] RIP: 0033:0x7f3a511ac799 [ 576.144124][T13564] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 576.144140][T13564] RSP: 002b:00007f3a4f406028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 576.144161][T13564] RAX: ffffffffffffffda RBX: 00007f3a51425fa0 RCX: 00007f3a511ac799 [ 576.144174][T13564] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 576.144186][T13564] RBP: 00007f3a4f406090 R08: 0000000000000000 R09: 0000000000000000 [ 576.144198][T13564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 576.144210][T13564] R13: 00007f3a51426038 R14: 00007f3a51425fa0 R15: 00007fff5ee96be8 [ 576.144239][T13564] [ 576.167363][ T5996] usb 4-1: USB disconnect, device number 24 [ 577.382745][T13507] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 577.382761][T13507] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 577.382785][T13507] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 577.534008][T13507] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 577.534025][T13507] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 577.534050][T13507] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 579.107247][T13530] chnl_net:caif_netlink_parms(): no params data found [ 579.229538][T13511] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.229659][T13511] bridge0: port 1(bridge_slave_0) entered disabled state [ 579.229867][T13511] bridge_slave_0: entered allmulticast mode [ 579.247443][T13511] bridge_slave_0: entered promiscuous mode [ 580.399610][T13511] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.399782][T13511] bridge0: port 2(bridge_slave_1) entered disabled state [ 580.400018][T13511] bridge_slave_1: entered allmulticast mode [ 580.402553][T13511] bridge_slave_1: entered promiscuous mode [ 580.853845][T13537] chnl_net:caif_netlink_parms(): no params data found [ 582.686582][T13507] hsr_slave_0: entered promiscuous mode [ 582.872079][T13507] hsr_slave_1: entered promiscuous mode [ 583.558258][T13511] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 583.602757][T13599] fuse: Unknown parameter '00000000000000000003' [ 585.943789][T13511] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 589.176442][T13511] team0: Port device team_slave_0 added [ 589.178830][T13530] bridge0: port 1(bridge_slave_0) entered blocking state [ 589.178948][T13530] bridge0: port 1(bridge_slave_0) entered disabled state [ 589.179512][T13530] bridge_slave_0: entered allmulticast mode [ 589.212594][T13530] bridge_slave_0: entered promiscuous mode [ 589.893990][T13511] team0: Port device team_slave_1 added [ 589.902974][T13530] bridge0: port 2(bridge_slave_1) entered blocking state [ 589.903090][T13530] bridge0: port 2(bridge_slave_1) entered disabled state [ 589.903278][T13530] bridge_slave_1: entered allmulticast mode [ 589.967102][T13530] bridge_slave_1: entered promiscuous mode [ 591.757871][T13537] bridge0: port 1(bridge_slave_0) entered blocking state [ 591.757995][T13537] bridge0: port 1(bridge_slave_0) entered disabled state [ 591.758227][T13537] bridge_slave_0: entered allmulticast mode [ 591.760591][T13537] bridge_slave_0: entered promiscuous mode [ 591.819226][T13625] FAULT_INJECTION: forcing a failure. [ 591.819226][T13625] name failslab, interval 1, probability 0, space 0, times 0 [ 591.819260][T13625] CPU: 1 UID: 0 PID: 13625 Comm: syz.3.2843 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 591.819285][T13625] Tainted: [L]=SOFTLOCKUP [ 591.819292][T13625] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 591.819303][T13625] Call Trace: [ 591.819311][T13625] [ 591.819319][T13625] dump_stack_lvl+0xe8/0x150 [ 591.819351][T13625] should_fail_ex+0x46b/0x600 [ 591.819378][T13625] should_failslab+0xa8/0x100 [ 591.819398][T13625] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 591.819423][T13625] ? __alloc_skb+0x1d0/0x7d0 [ 591.819445][T13625] ? lockdep_hardirqs_on+0x7a/0x110 [ 591.819473][T13625] __alloc_skb+0x1d0/0x7d0 [ 591.819500][T13625] netlink_sendmsg+0x5d4/0xb40 [ 591.819533][T13625] ? __pfx_netlink_sendmsg+0x10/0x10 [ 591.819557][T13625] ? unwind_get_return_address+0x4d/0x90 [ 591.819579][T13625] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 591.819606][T13625] ____sys_sendmsg+0x94c/0x9c0 [ 591.819630][T13625] ? __pfx_____sys_sendmsg+0x10/0x10 [ 591.819658][T13625] ? import_iovec+0x73/0xa0 [ 591.819684][T13625] ___sys_sendmsg+0x2a5/0x360 [ 591.819708][T13625] ? __pfx____sys_sendmsg+0x10/0x10 [ 591.819758][T13625] ? __fget_files+0x2a/0x420 [ 591.819778][T13625] ? __fget_files+0x3a6/0x420 [ 591.819808][T13625] __x64_sys_sendmsg+0x1c3/0x2a0 [ 591.819829][T13625] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 591.819856][T13625] ? __pfx_ksys_write+0x10/0x10 [ 591.819890][T13625] do_syscall_64+0x14d/0xf80 [ 591.819914][T13625] ? trace_irq_disable+0x3b/0x150 [ 591.819933][T13625] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.819951][T13625] ? clear_bhb_loop+0x40/0x90 [ 591.819981][T13625] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.819999][T13625] RIP: 0033:0x7f3a511ac799 [ 591.820017][T13625] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 591.820034][T13625] RSP: 002b:00007f3a4f406028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 591.820054][T13625] RAX: ffffffffffffffda RBX: 00007f3a51425fa0 RCX: 00007f3a511ac799 [ 591.820068][T13625] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 591.820080][T13625] RBP: 00007f3a4f406090 R08: 0000000000000000 R09: 0000000000000000 [ 591.820092][T13625] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 591.820104][T13625] R13: 00007f3a51426038 R14: 00007f3a51425fa0 R15: 00007fff5ee96be8 [ 591.820134][T13625] [ 592.346666][T13537] bridge0: port 2(bridge_slave_1) entered blocking state [ 592.386845][T13537] bridge0: port 2(bridge_slave_1) entered disabled state [ 592.387088][T13537] bridge_slave_1: entered allmulticast mode [ 592.394351][T13537] bridge_slave_1: entered promiscuous mode [ 592.964720][T13511] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 592.964737][T13511] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 592.964761][T13511] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 594.449620][T13530] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 594.994160][T13511] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 594.994178][T13511] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 594.994212][T13511] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 595.125872][T13530] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 595.308607][T13537] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 595.561739][T13537] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 595.776814][T13530] team0: Port device team_slave_0 added [ 596.481003][T13530] team0: Port device team_slave_1 added [ 600.882472][ T5783] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 601.384520][ T5783] usb 4-1: Using ep0 maxpacket: 32 [ 601.388085][ T5783] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 601.388114][ T5783] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 601.390053][ T5783] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 601.390077][ T5783] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 601.390096][ T5783] usb 4-1: Product: syz [ 601.390109][ T5783] usb 4-1: Manufacturer: syz [ 601.587993][ T5783] hub 4-1:4.0: USB hub found [ 601.636087][ T5783] hub 4-1:4.0: 2 ports detected [ 602.263092][T13537] team0: Port device team_slave_0 added [ 602.308957][T13511] hsr_slave_0: entered promiscuous mode [ 602.320343][T13511] hsr_slave_1: entered promiscuous mode [ 602.321245][T13511] debugfs: 'hsr0' already exists in 'hsr' [ 602.321269][T13511] Cannot create hsr debugfs directory [ 602.499345][T13537] team0: Port device team_slave_1 added [ 602.516039][T13530] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 602.516054][T13530] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 602.516078][T13530] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 602.841386][T13530] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 602.841401][T13530] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 602.841436][T13530] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 603.239610][ T9] hub 4-1:4.0: activate --> -90 [ 603.946410][T13650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 603.949173][T13650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 603.954654][T13650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 603.957116][T13650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 603.967782][ T5876] usb 4-1: USB disconnect, device number 25 [ 606.801421][T13507] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.615208][T13664] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2855'. [ 612.903901][T12162] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 613.362474][T12162] usb 4-1: Using ep0 maxpacket: 32 [ 613.426131][T12162] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 613.426162][T12162] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 613.448915][T12162] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 613.448943][T12162] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 613.448962][T12162] usb 4-1: Product: syz [ 613.448975][T12162] usb 4-1: Manufacturer: syz [ 613.495599][T12162] hub 4-1:4.0: USB hub found [ 613.522241][T13537] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 613.522257][T13537] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 613.522283][T13537] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 613.891699][T13537] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 613.891716][T13537] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 613.891741][T13537] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 614.079573][T12162] hub 4-1:4.0: 2 ports detected [ 615.520190][ T5841] hub 4-1:4.0: activate --> -90 [ 616.235828][T13530] hsr_slave_0: entered promiscuous mode [ 616.242985][T13530] hsr_slave_1: entered promiscuous mode [ 616.247343][T13530] debugfs: 'hsr0' already exists in 'hsr' [ 616.247420][T13530] Cannot create hsr debugfs directory [ 616.415431][T13667] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 616.845149][T13667] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 617.349458][ T5783] usb 4-1: USB disconnect, device number 26 [ 618.202460][T13675] FAULT_INJECTION: forcing a failure. [ 618.202460][T13675] name failslab, interval 1, probability 0, space 0, times 0 [ 618.202519][T13675] CPU: 1 UID: 0 PID: 13675 Comm: syz.3.2857 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 618.202546][T13675] Tainted: [L]=SOFTLOCKUP [ 618.202553][T13675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 618.202565][T13675] Call Trace: [ 618.202573][T13675] [ 618.202582][T13675] dump_stack_lvl+0xe8/0x150 [ 618.202613][T13675] should_fail_ex+0x46b/0x600 [ 618.202641][T13675] should_failslab+0xa8/0x100 [ 618.202662][T13675] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 618.202688][T13675] ? __alloc_skb+0x1d0/0x7d0 [ 618.202711][T13675] ? lockdep_hardirqs_on+0x7a/0x110 [ 618.202741][T13675] __alloc_skb+0x1d0/0x7d0 [ 618.202769][T13675] netlink_sendmsg+0x5d4/0xb40 [ 618.202802][T13675] ? __pfx_netlink_sendmsg+0x10/0x10 [ 618.202832][T13675] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 618.202861][T13675] ____sys_sendmsg+0x94c/0x9c0 [ 618.202885][T13675] ? __pfx_____sys_sendmsg+0x10/0x10 [ 618.202919][T13675] ? import_iovec+0x73/0xa0 [ 618.202947][T13675] ___sys_sendmsg+0x2a5/0x360 [ 618.202971][T13675] ? __pfx____sys_sendmsg+0x10/0x10 [ 618.203023][T13675] ? __fget_files+0x2a/0x420 [ 618.203044][T13675] ? __fget_files+0x3a6/0x420 [ 618.203074][T13675] __x64_sys_sendmsg+0x1c3/0x2a0 [ 618.203095][T13675] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 618.203136][T13675] do_syscall_64+0x14d/0xf80 [ 618.203160][T13675] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.203179][T13675] ? clear_bhb_loop+0x40/0x90 [ 618.203201][T13675] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.203219][T13675] RIP: 0033:0x7f3a511ac799 [ 618.203237][T13675] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 618.203253][T13675] RSP: 002b:00007f3a4f3c4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 618.203273][T13675] RAX: ffffffffffffffda RBX: 00007f3a51426180 RCX: 00007f3a511ac799 [ 618.203288][T13675] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 618.203300][T13675] RBP: 00007f3a4f3c4090 R08: 0000000000000000 R09: 0000000000000000 [ 618.203311][T13675] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 618.203322][T13675] R13: 00007f3a51426218 R14: 00007f3a51426180 R15: 00007fff5ee96be8 [ 618.203351][T13675] [ 619.528828][T13537] hsr_slave_0: entered promiscuous mode [ 619.562312][T13537] hsr_slave_1: entered promiscuous mode [ 619.563009][T13537] debugfs: 'hsr0' already exists in 'hsr' [ 619.563028][T13537] Cannot create hsr debugfs directory [ 621.424321][T13686] netlink: 'syz.3.2859': attribute type 25 has an invalid length. [ 621.424342][T13686] netlink: 'syz.3.2859': attribute type 9 has an invalid length. [ 621.682789][T13682] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 621.735348][T13682] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 621.736871][T13682] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 621.737981][T13682] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 621.740252][T13682] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 621.766210][T13682] Bluetooth: hci3: command 0x0406 tx timeout [ 622.618209][T13686] batman_adv: batadv0: Adding interface: dummy0 [ 622.618225][T13686] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 622.618254][T13686] batman_adv: batadv0: Interface activated: dummy0 [ 622.787064][T13688] batadv0: mtu less than device minimum [ 622.880545][T13688] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 623.038463][T13688] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 623.095898][T13688] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 623.475382][ T5806] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 623.493578][ T5806] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 623.495430][ T5806] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 623.538177][ T5806] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 623.543943][ T5806] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 623.910857][ T5806] Bluetooth: hci2: command tx timeout [ 624.011763][T13688] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 624.036938][T13688] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 624.058111][T13688] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 624.664064][T13688] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 624.736173][T13688] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 624.743691][T13688] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 625.791415][ T5806] Bluetooth: hci4: command tx timeout [ 626.122530][ T5806] Bluetooth: hci2: command tx timeout [ 626.501100][ T5801] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 626.522988][ T5801] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 626.524635][ T5801] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 626.551442][ T5801] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 626.552493][ T5801] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 628.020147][ T5801] Bluetooth: hci4: command tx timeout [ 628.400406][ T5801] Bluetooth: hci2: command tx timeout [ 628.772679][ T5801] Bluetooth: hci8: command tx timeout [ 630.293809][ T5801] Bluetooth: hci4: command tx timeout [ 630.633901][T13682] Bluetooth: hci2: command tx timeout [ 630.634567][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 630.634631][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 630.863051][T13682] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 630.885191][T13682] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 630.904795][T13682] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 630.912538][T13682] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 630.921111][T13682] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 630.996120][T13682] Bluetooth: hci8: command tx timeout [ 631.366949][ T5876] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 632.502024][T13682] Bluetooth: hci4: command tx timeout [ 633.288213][T13682] Bluetooth: hci9: command tx timeout [ 633.579452][ T5801] Bluetooth: hci8: command tx timeout [ 635.842138][ T5801] Bluetooth: hci8: command tx timeout [ 635.842170][ T5801] Bluetooth: hci9: command tx timeout [ 637.830378][ T5876] usb 4-1: device descriptor read/64, error -110 [ 638.016255][T13682] Bluetooth: hci9: command tx timeout [ 638.361794][ T5876] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 638.539727][ T5876] usb 4-1: device descriptor read/64, error -32 [ 638.658910][ T5876] usb usb4-port1: attempt power cycle [ 639.041974][ T5876] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 639.074481][ T5876] usb 4-1: device descriptor read/8, error -32 [ 639.194257][ T5876] raw-gadget.0 gadget.3: failed to queue suspend event [ 639.230142][ T5876] raw-gadget.0 gadget.3: failed to queue reset event [ 639.298879][ T5876] raw-gadget.0 gadget.3: failed to queue resume event [ 639.374007][ T5876] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 639.405584][ C0] raw-gadget.0 gadget.3: ignoring, device is not running [ 639.405683][ T5876] usb 4-1: device descriptor read/8, error -32 [ 639.522882][ T5876] raw-gadget.0 gadget.3: failed to queue suspend event [ 639.523206][ T5876] usb usb4-port1: unable to enumerate USB device [ 640.235917][ T5801] Bluetooth: hci9: command tx timeout [ 643.272689][T13708] raw-gadget.0 gadget.3: failed to queue disconnect event [ 643.904234][ T5876] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 644.419668][ T5876] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 644.419696][ T5876] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 644.419714][ T5876] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 644.421764][ T5876] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 644.421789][ T5876] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 644.421807][ T5876] usb 4-1: Product: syz [ 644.421820][ T5876] usb 4-1: Manufacturer: syz [ 644.649823][T13722] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2864'. [ 644.946728][ T5876] usb 4-1: USB disconnect, device number 31 [ 645.277723][T13727] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2865'. [ 648.612245][T13731] bond1 (unregistering): Released all slaves [ 654.309470][T13687] chnl_net:caif_netlink_parms(): no params data found [ 654.512931][T13693] chnl_net:caif_netlink_parms(): no params data found [ 655.220677][T13690] chnl_net:caif_netlink_parms(): no params data found [ 657.174097][T13704] chnl_net:caif_netlink_parms(): no params data found [ 657.974735][T13687] bridge0: port 1(bridge_slave_0) entered blocking state [ 657.974921][T13687] bridge0: port 1(bridge_slave_0) entered disabled state [ 657.975130][T13687] bridge_slave_0: entered allmulticast mode [ 658.011773][T13687] bridge_slave_0: entered promiscuous mode [ 658.375613][T13687] bridge0: port 2(bridge_slave_1) entered blocking state [ 658.375730][T13687] bridge0: port 2(bridge_slave_1) entered disabled state [ 658.375931][T13687] bridge_slave_1: entered allmulticast mode [ 658.414403][T13687] bridge_slave_1: entered promiscuous mode [ 658.644674][T13690] bridge0: port 1(bridge_slave_0) entered blocking state [ 658.644794][T13690] bridge0: port 1(bridge_slave_0) entered disabled state [ 658.645014][T13690] bridge_slave_0: entered allmulticast mode [ 658.683083][T13690] bridge_slave_0: entered promiscuous mode [ 659.147252][T13693] bridge0: port 1(bridge_slave_0) entered blocking state [ 659.147369][T13693] bridge0: port 1(bridge_slave_0) entered disabled state [ 659.147558][T13693] bridge_slave_0: entered allmulticast mode [ 659.150141][T13693] bridge_slave_0: entered promiscuous mode [ 659.583412][T13690] bridge0: port 2(bridge_slave_1) entered blocking state [ 659.583533][T13690] bridge0: port 2(bridge_slave_1) entered disabled state [ 659.583815][T13690] bridge_slave_1: entered allmulticast mode [ 659.586499][T13690] bridge_slave_1: entered promiscuous mode [ 659.588781][T13693] bridge0: port 2(bridge_slave_1) entered blocking state [ 659.588914][T13693] bridge0: port 2(bridge_slave_1) entered disabled state [ 659.589155][T13693] bridge_slave_1: entered allmulticast mode [ 659.609494][T13693] bridge_slave_1: entered promiscuous mode [ 661.243333][T13687] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 662.299644][T13687] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 662.309040][T13690] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 662.315638][T13693] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 663.184644][T13693] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 663.713179][T13690] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 663.713402][T13704] bridge0: port 1(bridge_slave_0) entered blocking state [ 663.713506][T13704] bridge0: port 1(bridge_slave_0) entered disabled state [ 663.713723][T13704] bridge_slave_0: entered allmulticast mode [ 663.738098][T13704] bridge_slave_0: entered promiscuous mode [ 665.343036][T13682] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 665.366706][T13682] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 665.371979][T13682] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 665.404593][T13682] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 665.415423][T13682] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 665.993985][T13704] bridge0: port 2(bridge_slave_1) entered blocking state [ 665.994105][T13704] bridge0: port 2(bridge_slave_1) entered disabled state [ 665.994358][T13704] bridge_slave_1: entered allmulticast mode [ 666.004637][T13704] bridge_slave_1: entered promiscuous mode [ 666.008602][T13687] team0: Port device team_slave_0 added [ 666.991277][T13687] team0: Port device team_slave_1 added [ 666.996510][T13693] team0: Port device team_slave_0 added [ 667.021300][T13690] team0: Port device team_slave_0 added [ 667.930947][T13690] team0: Port device team_slave_1 added [ 667.959205][T13693] team0: Port device team_slave_1 added [ 667.963524][T13704] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 668.113121][T13682] Bluetooth: hci1: command tx timeout [ 668.246510][T13704] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 668.593401][T13687] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 668.593418][T13687] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 668.593444][T13687] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 669.570676][T13687] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 669.570693][T13687] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 669.570718][T13687] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 669.572462][T13690] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 669.572473][T13690] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 669.572492][T13690] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 669.795973][T13690] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 669.796001][T13690] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 669.796027][T13690] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 670.320197][T13682] Bluetooth: hci1: command tx timeout [ 671.068943][T13693] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 671.068960][T13693] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 671.068985][T13693] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 671.073272][T13704] team0: Port device team_slave_0 added [ 671.712077][T13693] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 671.712094][T13693] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 671.712118][T13693] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 671.714994][T13704] team0: Port device team_slave_1 added [ 672.542755][T13682] Bluetooth: hci1: command tx timeout [ 672.918273][T13704] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 672.918290][T13704] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 672.918316][T13704] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 673.296060][T13687] hsr_slave_0: entered promiscuous mode [ 673.308152][T13687] hsr_slave_1: entered promiscuous mode [ 673.318807][T13687] debugfs: 'hsr0' already exists in 'hsr' [ 673.318835][T13687] Cannot create hsr debugfs directory [ 673.375941][T13704] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 673.375957][T13704] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 673.375980][T13704] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 674.107628][T13690] hsr_slave_0: entered promiscuous mode [ 674.109011][T13690] hsr_slave_1: entered promiscuous mode [ 674.109944][T13690] debugfs: 'hsr0' already exists in 'hsr' [ 674.109967][T13690] Cannot create hsr debugfs directory [ 674.765394][T13682] Bluetooth: hci1: command tx timeout [ 675.272573][T13693] hsr_slave_0: entered promiscuous mode [ 675.504663][T13693] hsr_slave_1: entered promiscuous mode [ 675.505740][T13693] debugfs: 'hsr0' already exists in 'hsr' [ 675.505774][T13693] Cannot create hsr debugfs directory [ 677.862749][T13704] hsr_slave_0: entered promiscuous mode [ 677.864124][T13704] hsr_slave_1: entered promiscuous mode [ 678.294543][T13704] debugfs: 'hsr0' already exists in 'hsr' [ 678.294572][T13704] Cannot create hsr debugfs directory [ 687.414817][T13757] chnl_net:caif_netlink_parms(): no params data found [ 687.587074][ T5801] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 687.635256][ T5801] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 687.650190][ T5801] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 687.673084][ T5801] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 687.730506][ T5801] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 687.775186][ T5806] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 687.791112][ T5806] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 687.792744][ T5806] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 687.793901][ T5806] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 687.795064][ T5806] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 689.627742][T13757] bridge0: port 1(bridge_slave_0) entered blocking state [ 689.627898][T13757] bridge0: port 1(bridge_slave_0) entered disabled state [ 689.628123][T13757] bridge_slave_0: entered allmulticast mode [ 689.631327][T13757] bridge_slave_0: entered promiscuous mode [ 689.651160][T13757] bridge0: port 2(bridge_slave_1) entered blocking state [ 689.651272][T13757] bridge0: port 2(bridge_slave_1) entered disabled state [ 689.651778][T13757] bridge_slave_1: entered allmulticast mode [ 689.654242][T13757] bridge_slave_1: entered promiscuous mode [ 690.217420][ T5806] Bluetooth: hci7: command tx timeout [ 690.218135][ T5806] Bluetooth: hci6: command tx timeout [ 690.243703][T13757] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 691.726541][T13757] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 691.727677][T13682] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 691.751768][T13682] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 691.755063][T13682] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 691.757653][T13682] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 691.779583][T13682] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 692.379028][ T5801] Bluetooth: hci6: command tx timeout [ 692.379039][T13682] Bluetooth: hci7: command tx timeout [ 692.720743][T13757] team0: Port device team_slave_0 added [ 693.027100][ T5801] Bluetooth: hci0: command 0x0406 tx timeout [ 694.182170][ T5806] Bluetooth: hci10: command tx timeout [ 694.242673][ T5801] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 694.299990][ T5801] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 694.302779][ T5801] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 694.305662][ T5801] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 694.306659][ T5801] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 694.598692][ T5806] Bluetooth: hci7: command tx timeout [ 694.612867][ T5806] Bluetooth: hci6: command tx timeout [ 695.188424][T13757] team0: Port device team_slave_1 added [ 696.142452][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 696.142549][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 696.394335][ T5806] Bluetooth: hci10: command tx timeout [ 696.564976][ T5806] Bluetooth: hci2: command tx timeout [ 696.821427][ T5806] Bluetooth: hci6: command tx timeout [ 696.821458][ T5806] Bluetooth: hci7: command tx timeout [ 697.005868][T13757] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 697.005886][T13757] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 697.005911][T13757] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 697.177110][T13757] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 697.177127][T13757] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 697.177153][T13757] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 698.619068][ T5801] Bluetooth: hci10: command tx timeout [ 698.789715][ T5801] Bluetooth: hci2: command tx timeout [ 700.839547][ T5801] Bluetooth: hci10: command tx timeout [ 701.021027][ T5801] Bluetooth: hci2: command tx timeout [ 702.181042][T13766] chnl_net:caif_netlink_parms(): no params data found [ 702.340855][T13757] hsr_slave_0: entered promiscuous mode [ 702.341730][T13757] hsr_slave_1: entered promiscuous mode [ 702.342314][T13757] debugfs: 'hsr0' already exists in 'hsr' [ 702.342329][T13757] Cannot create hsr debugfs directory [ 703.233860][ T5801] Bluetooth: hci2: command tx timeout [ 708.313277][T13768] chnl_net:caif_netlink_parms(): no params data found [ 712.194681][T13766] bridge0: port 1(bridge_slave_0) entered blocking state [ 712.225356][T13766] bridge0: port 1(bridge_slave_0) entered disabled state [ 712.225669][T13766] bridge_slave_0: entered allmulticast mode [ 712.228364][T13766] bridge_slave_0: entered promiscuous mode [ 712.882729][T13766] bridge0: port 2(bridge_slave_1) entered blocking state [ 712.882849][T13766] bridge0: port 2(bridge_slave_1) entered disabled state [ 712.883454][T13766] bridge_slave_1: entered allmulticast mode [ 712.886223][T13766] bridge_slave_1: entered promiscuous mode [ 715.783797][T13766] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 716.305646][T13766] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 716.306069][T13768] bridge0: port 1(bridge_slave_0) entered blocking state [ 716.306185][T13768] bridge0: port 1(bridge_slave_0) entered disabled state [ 716.306446][T13768] bridge_slave_0: entered allmulticast mode [ 716.308939][T13768] bridge_slave_0: entered promiscuous mode [ 716.551886][T13768] bridge0: port 2(bridge_slave_1) entered blocking state [ 716.552008][T13768] bridge0: port 2(bridge_slave_1) entered disabled state [ 716.552322][T13768] bridge_slave_1: entered allmulticast mode [ 716.555243][T13768] bridge_slave_1: entered promiscuous mode [ 716.945975][T13778] chnl_net:caif_netlink_parms(): no params data found [ 717.019566][T13766] team0: Port device team_slave_0 added [ 717.261820][T13766] team0: Port device team_slave_1 added [ 717.270053][T13768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 717.424481][T13781] chnl_net:caif_netlink_parms(): no params data found [ 717.658609][T13768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 721.430773][T13766] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 721.430791][T13766] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 721.430816][T13766] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 722.148299][T13766] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 722.148316][T13766] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 722.148342][T13766] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 722.207393][T13768] team0: Port device team_slave_0 added [ 723.199193][T13768] team0: Port device team_slave_1 added [ 725.738140][T13778] bridge0: port 1(bridge_slave_0) entered blocking state [ 725.763141][T13778] bridge0: port 1(bridge_slave_0) entered disabled state [ 725.763460][T13778] bridge_slave_0: entered allmulticast mode [ 725.766117][T13778] bridge_slave_0: entered promiscuous mode [ 726.043454][T13768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 726.043471][T13768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 726.043498][T13768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 726.757725][T13778] bridge0: port 2(bridge_slave_1) entered blocking state [ 726.757878][T13778] bridge0: port 2(bridge_slave_1) entered disabled state [ 726.758187][T13778] bridge_slave_1: entered allmulticast mode [ 726.790046][T13778] bridge_slave_1: entered promiscuous mode [ 726.970845][T13768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 726.970863][T13768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 726.970889][T13768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 728.639342][T13766] hsr_slave_0: entered promiscuous mode [ 728.777078][T13766] hsr_slave_1: entered promiscuous mode [ 728.778260][T13766] debugfs: 'hsr0' already exists in 'hsr' [ 728.778284][T13766] Cannot create hsr debugfs directory [ 728.909449][T13781] bridge0: port 1(bridge_slave_0) entered blocking state [ 728.909570][T13781] bridge0: port 1(bridge_slave_0) entered disabled state [ 728.909868][T13781] bridge_slave_0: entered allmulticast mode [ 728.945639][T13781] bridge_slave_0: entered promiscuous mode [ 729.050584][T13781] bridge0: port 2(bridge_slave_1) entered blocking state [ 729.072822][T13781] bridge0: port 2(bridge_slave_1) entered disabled state [ 729.073145][T13781] bridge_slave_1: entered allmulticast mode [ 729.100830][T13781] bridge_slave_1: entered promiscuous mode [ 729.140611][T13778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 729.525703][T13778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 730.707892][ T5806] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 730.712175][ T5806] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 730.714036][ T5806] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 730.717394][ T5806] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 730.739057][ T5806] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 732.993674][ T5801] Bluetooth: hci3: command tx timeout [ 733.104204][T13768] hsr_slave_0: entered promiscuous mode [ 733.109324][T13768] hsr_slave_1: entered promiscuous mode [ 733.110316][T13768] debugfs: 'hsr0' already exists in 'hsr' [ 733.110340][T13768] Cannot create hsr debugfs directory [ 733.259712][T13781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 733.445422][T13778] team0: Port device team_slave_0 added [ 733.540552][T13781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 733.684161][T13778] team0: Port device team_slave_1 added [ 734.494699][T13781] team0: Port device team_slave_0 added [ 734.725162][T13778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 734.725179][T13778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 734.725204][T13778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 734.728229][T13781] team0: Port device team_slave_1 added [ 735.206081][ T5801] Bluetooth: hci3: command tx timeout [ 735.291506][T13778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 735.291524][T13778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 735.291550][T13778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 737.439055][ T5801] Bluetooth: hci3: command tx timeout [ 737.618880][T13781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 737.618899][T13781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 737.618925][T13781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 738.362281][T13781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 738.362301][T13781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 738.362327][T13781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 739.651108][ T5801] Bluetooth: hci3: command tx timeout [ 739.794027][T13778] hsr_slave_0: entered promiscuous mode [ 739.795598][T13778] hsr_slave_1: entered promiscuous mode [ 739.796611][T13778] debugfs: 'hsr0' already exists in 'hsr' [ 739.796636][T13778] Cannot create hsr debugfs directory [ 741.450958][T13781] hsr_slave_0: entered promiscuous mode [ 741.635695][T13781] hsr_slave_1: entered promiscuous mode [ 741.636808][T13781] debugfs: 'hsr0' already exists in 'hsr' [ 741.636832][T13781] Cannot create hsr debugfs directory [ 749.531000][T13815] chnl_net:caif_netlink_parms(): no params data found [ 752.945298][ T5806] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 752.953934][ T5806] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 752.984262][T13682] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 753.006697][T13682] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 753.021844][T13682] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 753.038534][T13682] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 753.039277][T13682] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 753.073475][T13832] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 753.080906][T13432] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 753.081918][T13432] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 753.462509][T13815] bridge0: port 1(bridge_slave_0) entered blocking state [ 753.463012][T13815] bridge0: port 1(bridge_slave_0) entered disabled state [ 753.463349][T13815] bridge_slave_0: entered allmulticast mode [ 753.465933][T13815] bridge_slave_0: entered promiscuous mode [ 753.618679][T13815] bridge0: port 2(bridge_slave_1) entered blocking state [ 753.618812][T13815] bridge0: port 2(bridge_slave_1) entered disabled state [ 753.619049][T13815] bridge_slave_1: entered allmulticast mode [ 753.621771][T13815] bridge_slave_1: entered promiscuous mode [ 754.200538][T13815] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 754.409905][T13815] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 755.607994][T13432] Bluetooth: hci12: command tx timeout [ 755.608394][T13432] Bluetooth: hci11: command tx timeout [ 757.668982][T13832] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 757.714174][T13839] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 757.717450][T13839] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 757.719787][T13839] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 757.720858][T13839] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 757.785342][T13839] Bluetooth: hci11: command tx timeout [ 757.785375][T13839] Bluetooth: hci12: command tx timeout [ 758.562100][T13682] Bluetooth: hci4: command 0x0406 tx timeout [ 758.562144][T13682] Bluetooth: hci8: command 0x0406 tx timeout [ 758.919360][T13682] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 758.945560][T13682] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 758.947666][T13682] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 758.948766][T13682] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 758.949886][T13682] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 759.221233][T13815] team0: Port device team_slave_0 added [ 759.454829][T13815] team0: Port device team_slave_1 added [ 760.008035][T13839] Bluetooth: hci12: command tx timeout [ 760.008069][T13839] Bluetooth: hci11: command tx timeout [ 760.015547][ T5801] Bluetooth: hci13: command tx timeout [ 760.555703][T13815] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 760.555715][T13815] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 760.555730][T13815] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 760.582830][T13815] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 760.582848][T13815] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 760.582878][T13815] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 761.226220][ T5806] Bluetooth: hci14: command tx timeout [ 761.872643][T13815] hsr_slave_0: entered promiscuous mode [ 761.874412][T13815] hsr_slave_1: entered promiscuous mode [ 761.875509][T13815] debugfs: 'hsr0' already exists in 'hsr' [ 761.875534][T13815] Cannot create hsr debugfs directory [ 762.275143][ T1271] ieee802154 phy0 wpan0: encryption failed: -22 [ 762.275217][ T1271] ieee802154 phy1 wpan1: encryption failed: -22 [ 762.283181][ T5806] Bluetooth: hci13: command tx timeout [ 762.283227][ T5806] Bluetooth: hci11: command tx timeout [ 762.283249][ T5806] Bluetooth: hci12: command tx timeout [ 763.417157][ T5801] Bluetooth: hci14: command tx timeout [ 764.452106][ T5801] Bluetooth: hci13: command tx timeout [ 764.452142][ T5801] Bluetooth: hci9: command 0x0406 tx timeout [ 765.648466][ T5806] Bluetooth: hci14: command tx timeout [ 766.729652][ T5806] Bluetooth: hci13: command tx timeout [ 767.862540][ T5806] Bluetooth: hci14: command tx timeout [ 768.277272][T13828] chnl_net:caif_netlink_parms(): no params data found [ 769.608997][T13827] chnl_net:caif_netlink_parms(): no params data found [ 775.829082][T13841] chnl_net:caif_netlink_parms(): no params data found [ 776.316027][T13836] chnl_net:caif_netlink_parms(): no params data found [ 776.353712][T13828] bridge0: port 1(bridge_slave_0) entered blocking state [ 776.353924][T13828] bridge0: port 1(bridge_slave_0) entered disabled state [ 776.354239][T13828] bridge_slave_0: entered allmulticast mode [ 776.363574][T13828] bridge_slave_0: entered promiscuous mode [ 776.590307][T13828] bridge0: port 2(bridge_slave_1) entered blocking state [ 776.593286][T13828] bridge0: port 2(bridge_slave_1) entered disabled state [ 776.593624][T13828] bridge_slave_1: entered allmulticast mode [ 776.601012][T13828] bridge_slave_1: entered promiscuous mode [ 778.289446][T13827] bridge0: port 1(bridge_slave_0) entered blocking state [ 778.289633][T13827] bridge0: port 1(bridge_slave_0) entered disabled state [ 778.289926][T13827] bridge_slave_0: entered allmulticast mode [ 778.308346][T13827] bridge_slave_0: entered promiscuous mode [ 778.520401][T13827] bridge0: port 2(bridge_slave_1) entered blocking state [ 778.520520][T13827] bridge0: port 2(bridge_slave_1) entered disabled state [ 778.520863][T13827] bridge_slave_1: entered allmulticast mode [ 778.559343][T13827] bridge_slave_1: entered promiscuous mode [ 778.596594][T13828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 779.942573][T13828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 781.908416][T13827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 782.260773][T13841] bridge0: port 1(bridge_slave_0) entered blocking state [ 782.260940][T13841] bridge0: port 1(bridge_slave_0) entered disabled state [ 782.261174][T13841] bridge_slave_0: entered allmulticast mode [ 782.263802][T13841] bridge_slave_0: entered promiscuous mode [ 782.450961][T13827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 782.468902][T13828] team0: Port device team_slave_0 added [ 782.475852][T13841] bridge0: port 2(bridge_slave_1) entered blocking state [ 782.476020][T13841] bridge0: port 2(bridge_slave_1) entered disabled state [ 782.476351][T13841] bridge_slave_1: entered allmulticast mode [ 782.479060][T13841] bridge_slave_1: entered promiscuous mode [ 782.491781][T13836] bridge0: port 1(bridge_slave_0) entered blocking state [ 782.491909][T13836] bridge0: port 1(bridge_slave_0) entered disabled state [ 782.492225][T13836] bridge_slave_0: entered allmulticast mode [ 782.494912][T13836] bridge_slave_0: entered promiscuous mode [ 782.687220][T13828] team0: Port device team_slave_1 added [ 783.688946][ T37] INFO: task kworker/u8:4:67 blocked for more than 143 seconds. [ 783.688974][ T37] Tainted: G L syzkaller #0 [ 783.688985][ T37] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 783.688994][ T37] task:kworker/u8:4 state:D stack:20608 pid:67 tgid:67 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 783.689042][ T37] Workqueue: netns cleanup_net [ 783.689180][ T37] Call Trace: [ 783.689188][ T37] [ 783.689201][ T37] __schedule+0x1553/0x5240 [ 783.689247][ T37] ? _raw_spin_unlock_irq+0x23/0x50 [ 783.689277][ T37] ? rt_mutex_adjust_prio_chain+0x21fd/0x23f0 [ 783.689300][ T37] ? __pfx___schedule+0x10/0x10 [ 783.689337][ T37] rt_mutex_schedule+0x76/0xf0 [ 783.689368][ T37] rt_mutex_slowlock_block+0x508/0x680 [ 783.689402][ T37] ? rt_mutex_slowlock_block+0x2e9/0x680 [ 783.689426][ T37] rt_mutex_slowlock+0x2dc/0x7b0 [ 783.689450][ T37] ? rt_mutex_slowlock+0x1fd/0x7b0 [ 783.689472][ T37] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 783.689511][ T37] ? devlink_pernet_pre_exit+0x117/0x3f0 [ 783.689588][ T37] ? devlink_pernet_pre_exit+0x117/0x3f0 [ 783.689608][ T37] mutex_lock_nested+0x168/0x1d0 [ 783.689628][ T37] ? devlinks_xa_find_get+0x2b/0x310 [ 783.689657][ T37] devlink_pernet_pre_exit+0x117/0x3f0 [ 783.689682][ T37] ? __pfx_devlink_pernet_pre_exit+0x10/0x10 [ 783.689711][ T37] ? class_remove_file_ns+0x124/0x160 [ 783.689763][ T37] ops_undo_list+0x187/0x940 [ 783.689790][ T37] ? rt_spin_unlock+0x1f0/0x200 [ 783.689812][ T37] ? __pfx_ops_undo_list+0x10/0x10 [ 783.689838][ T37] ? rt_spin_unlock+0x14f/0x200 [ 783.689861][ T37] ? idr_destroy+0x21b/0x2a0 [ 783.689918][ T37] ? rt_spin_unlock+0x160/0x200 [ 783.689941][ T37] cleanup_net+0x56e/0x800 [ 783.689968][ T37] ? __pfx_cleanup_net+0x10/0x10 [ 783.689999][ T37] ? process_scheduled_works+0xa8d/0x18c0 [ 783.690022][ T37] ? process_scheduled_works+0xa8d/0x18c0 [ 783.690048][ T37] process_scheduled_works+0xb6e/0x18c0 [ 783.690096][ T37] ? __pfx_process_scheduled_works+0x10/0x10 [ 783.690123][ T37] ? assign_work+0x3d5/0x5e0 [ 783.690156][ T37] worker_thread+0xa53/0xfc0 [ 783.690204][ T37] kthread+0x388/0x470 [ 783.690222][ T37] ? __pfx_worker_thread+0x10/0x10 [ 783.690241][ T37] ? __pfx_kthread+0x10/0x10 [ 783.690258][ T37] ret_from_fork+0x51e/0xb90 [ 783.690281][ T37] ? __pfx_ret_from_fork+0x10/0x10 [ 783.690300][ T37] ? __switch_to+0xc7d/0x1450 [ 783.690346][ T37] ? __pfx_kthread+0x10/0x10 [ 783.690366][ T37] ret_from_fork_asm+0x1a/0x30 [ 783.690407][ T37] [ 783.690615][ T37] [ 783.690615][ T37] Showing all locks held in the system: [ 783.690625][ T37] 5 locks held by kworker/u8:0/12: [ 783.690638][ T37] 3 locks held by rcuc/0/20: [ 783.690650][ T37] 6 locks held by ktimers/1/29: [ 783.690661][ T37] 1 lock held by khungtaskd/37: [ 783.690671][ T37] #0: ffffffff8ddcb8c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 783.690738][ T37] 4 locks held by kworker/u8:4/67: [ 783.690748][ T37] #0: ffff88801aee1138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 783.690795][ T37] #1: ffffc9000152fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 783.690841][ T37] #2: ffffffff8f14c0c0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 783.690887][ T37] #3: ffff88805be8d0d8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x117/0x3f0 [ 783.690937][ T37] 5 locks held by kworker/u8:8/1125: [ 783.690960][ T37] 2 locks held by getty/5554: [ 783.690970][ T37] #0: ffff8880370c90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 783.691041][ T37] #1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13c0 [ 783.691090][ T37] 1 lock held by syz.2.2782/13407: [ 783.691100][ T37] #0: ffffffff8ddd1b30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 783.691154][ T37] 7 locks held by syz-executor/13507: [ 783.691164][ T37] #0: ffff888037880480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 [ 783.691217][ T37] #1: ffff88805ccab478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 783.691273][ T37] #2: ffff888027a27a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 783.691328][ T37] #3: ffffffff8e9c8258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 783.691431][ T37] #4: ffff88805be8d0d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 [ 783.691477][ T37] #5: ffff888021776300 (&devlink->lock_key#3){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 [ 783.691530][ T37] #6: ffffffff8ddd1b30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 783.691575][ T37] 1 lock held by syz-executor/13511: [ 783.691587][ T37] #0: ffffffff8ddd1b30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 783.691631][ T37] 1 lock held by syz-executor/13530: [ 783.691642][ T37] #0: ffffffff8ddd1b30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 783.691686][ T37] 1 lock held by syz-executor/13537: [ 783.691697][ T37] #0: ffffffff8ddd1b30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 783.691744][ T37] 8 locks held by kworker/u8:17/13678: [ 783.691755][ T37] 1 lock held by syz-executor/13687: [ 783.691766][ T37] #0: ffffffff8ddd1b30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 783.691810][ T37] 4 locks held by syz-executor/13690: [ 783.691822][ T37] #0: ffff888037880480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 [ 783.691871][ T37] #1: ffff88805cf9b078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 783.691915][ T37] #2: ffff888027a27a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 783.691959][ T37] #3: ffffffff8e9c8258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 783.692006][ T37] 4 locks held by syz-executor/13693: [ 783.692018][ T37] #0: ffff888037880480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 [ 783.692067][ T37] #1: ffff88805da9a078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 783.692114][ T37] #2: ffff888027a27a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 783.692171][ T37] #3: ffffffff8e9c8258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 783.692219][ T37] 4 locks held by syz-executor/13704: [ 783.692230][ T37] #0: ffff888037880480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 [ 783.692279][ T37] #1: ffff88804b83e878 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 783.692331][ T37] #2: ffff888027a27a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 783.692382][ T37] #3: ffffffff8e9c8258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 783.692431][ T37] 2 locks held by syz.3.2866/13731: [ 783.692441][ T37] #0: ffffffff8f6a53d8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 783.692539][ T37] #1: ffffffff8ddd1b30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 783.692586][ T37] 4 locks held by syz-executor/13757: [ 783.692597][ T37] #0: ffff888037880480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 [ 783.692646][ T37] #1: ffff888036321878 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 783.692692][ T37] #2: ffff888027a27a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 783.692743][ T37] #3: ffffffff8e9c8258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 783.692790][ T37] 4 locks held by syz-executor/13766: [ 783.692802][ T37] #0: ffff888037880480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 [ 783.692852][ T37] #1: ffff8880436a0078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 783.692897][ T37] #2: ffff888027a27a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 783.692948][ T37] #3: ffffffff8e9c8258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 783.692996][ T37] 4 locks held by syz-executor/13768: [ 783.693007][ T37] #0: ffff888037880480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 [ 783.693057][ T37] #1: ffff88807a041c78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 783.693103][ T37] #2: ffff888027a27a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 783.693161][ T37] #3: ffffffff8e9c8258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 783.693214][ T37] 4 locks held by syz-executor/13778: [ 783.693225][ T37] #0: ffff888037880480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 [ 783.693274][ T37] #1: ffff88808609a878 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 783.693326][ T37] #2: ffff888027a27a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 783.693376][ T37] #3: ffffffff8e9c8258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 783.693424][ T37] 4 locks held by syz-executor/13781: [ 783.693434][ T37] #0: ffff888037880480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 [ 783.693483][ T37] #1: ffff888084a9f478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 783.693530][ T37] #2: ffff888027a27a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 783.693580][ T37] #3: ffffffff8e9c8258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 783.693630][ T37] 4 locks held by syz-executor/13815: [ 783.693641][ T37] #0: ffff888037880480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 [ 783.693690][ T37] #1: ffff888075ac6078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 783.693736][ T37] #2: ffff888027a27a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 783.693787][ T37] #3: ffffffff8e9c8258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 [ 783.693835][ T37] 2 locks held by syz-executor/13827: [ 783.693845][ T37] #0: ffffffff8e8b6648 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 783.693895][ T37] #1: ffffffff8f15a878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 783.693940][ T37] 2 locks held by syz-executor/13828: [ 783.693952][ T37] 1 lock held by syz-executor/13836: [ 783.693963][ T37] #0: ffffffff8f15a878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 783.694008][ T37] 2 locks held by syz-executor/13841: [ 783.694019][ T37] #0: ffffffff8e8b6648 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 783.694069][ T37] #1: ffffffff8f15a878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 783.694116][ T37] [ 783.694121][ T37] ============================================= [ 783.694121][ T37] [ 783.694137][ T37] NMI backtrace for cpu 0 [ 783.694161][ T37] CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 783.694186][ T37] Tainted: [L]=SOFTLOCKUP [ 783.694192][ T37] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 783.694204][ T37] Call Trace: [ 783.694212][ T37] [ 783.694221][ T37] dump_stack_lvl+0xe8/0x150 [ 783.694248][ T37] nmi_cpu_backtrace+0x274/0x2d0 [ 783.694270][ T37] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 783.694296][ T37] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 783.694320][ T37] sys_info+0x135/0x170 [ 783.694338][ T37] watchdog+0xfd9/0x1030 [ 783.694365][ T37] ? watchdog+0x21a/0x1030 [ 783.694392][ T37] kthread+0x388/0x470 [ 783.694410][ T37] ? __pfx_watchdog+0x10/0x10 [ 783.694429][ T37] ? __pfx_kthread+0x10/0x10 [ 783.694449][ T37] ret_from_fork+0x51e/0xb90 [ 783.694474][ T37] ? __pfx_ret_from_fork+0x10/0x10 [ 783.694496][ T37] ? __switch_to+0xc7d/0x1450 [ 783.694521][ T37] ? __pfx_kthread+0x10/0x10 [ 783.694541][ T37] ret_from_fork_asm+0x1a/0x30 [ 783.694573][ T37] [ 783.694580][ T37] Sending NMI from CPU 0 to CPUs 1: [ 783.694610][ C1] NMI backtrace for cpu 1 [ 783.694627][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 783.694654][ C1] Tainted: [L]=SOFTLOCKUP [ 783.694661][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 783.694670][ C1] RIP: 0010:__rcu_read_lock+0x31/0x60 [ 783.694693][ C1] Code: 8b 1d 0b 22 a4 10 48 81 c3 c4 04 00 00 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 18 ff 03 8b 03 <3d> 00 00 00 40 7d 07 5b c3 cc cc cc cc cc 90 0f 0b 90 eb f3 89 d9 [ 783.694706][ C1] RSP: 0018:ffffc90000a3ec68 EFLAGS: 00000202 [ 783.694720][ C1] RAX: 0000000000000004 RBX: ffff88801d2ac1c4 RCX: dffffc0000000000 [ 783.694732][ C1] RDX: dffffc0000000000 RSI: ffffffff895cace5 RDI: ffffc90000a3ed48 [ 783.694744][ C1] RBP: dffffc0000000000 R08: ffffc90000a3ee10 R09: 0000000000000006 [ 783.694755][ C1] R10: ffffc90000a3ed98 R11: ffffffff81af77a0 R12: 1ffff92000147da9 [ 783.694767][ C1] R13: ffffc90000a3ed80 R14: ffffc90000a3ed48 R15: ffffc90000a3f2a0 [ 783.694780][ C1] FS: 0000000000000000(0000) GS:ffff88812643c000(0000) knlGS:0000000000000000 [ 783.694793][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 783.694805][ C1] CR2: 00007f10ec39412a CR3: 00000000743fc000 CR4: 00000000003526f0 [ 783.694820][ C1] Call Trace: [ 783.694826][ C1] [ 783.694832][ C1] ? nft_synproxy_do_eval+0x305/0x580 [ 783.694904][ C1] unwind_next_frame+0x9e/0x23c0 [ 783.694922][ C1] ? unwind_next_frame+0xa5/0x23c0 [ 783.694937][ C1] ? nft_synproxy_eval_v4+0x352/0x4e0 [ 783.694952][ C1] ? nft_synproxy_do_eval+0x305/0x580 [ 783.694968][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 783.694988][ C1] arch_stack_walk+0x11b/0x150 [ 783.695006][ C1] ? nft_synproxy_do_eval+0x305/0x580 [ 783.695023][ C1] stack_trace_save+0xa9/0x100 [ 783.695041][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 783.695063][ C1] kasan_save_stack+0x3e/0x60 [ 783.695082][ C1] ? kasan_save_stack+0x3e/0x60 [ 783.695100][ C1] ? kasan_record_aux_stack+0xbd/0xd0 [ 783.695116][ C1] ? call_rcu+0xee/0x890 [ 783.695130][ C1] ? skb_release_head_state+0x71/0x360 [ 783.695151][ C1] ? __kfree_skb+0x24/0x210 [ 783.695170][ C1] ? nft_synproxy_eval_v4+0x352/0x4e0 [ 783.695184][ C1] ? nft_synproxy_do_eval+0x305/0x580 [ 783.695217][ C1] ? __phys_addr+0xd3/0x180 [ 783.695241][ C1] kasan_record_aux_stack+0xbd/0xd0 [ 783.695258][ C1] ? __pfx_dst_destroy_rcu+0x10/0x10 [ 783.695273][ C1] call_rcu+0xee/0x890 [ 783.695291][ C1] ? dst_release+0x126/0x1b0 [ 783.695307][ C1] skb_release_head_state+0x71/0x360 [ 783.695328][ C1] __kfree_skb+0x24/0x210 [ 783.695348][ C1] nft_synproxy_eval_v4+0x352/0x4e0 [ 783.695366][ C1] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 783.695382][ C1] ? nf_ip_checksum+0x13c/0x510 [ 783.695425][ C1] nft_synproxy_do_eval+0x305/0x580 [ 783.695442][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 783.695460][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 783.695478][ C1] nft_do_chain+0x45e/0x1990 [ 783.695522][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 783.695541][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 783.695559][ C1] ? kasan_save_track+0x4f/0x80 [ 783.695589][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 783.695607][ C1] nft_do_chain_inet+0x29d/0x380 [ 783.695660][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 783.695684][ C1] ? rtlock_slowlock_locked+0xfb/0x3c80 [ 783.695706][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 783.695727][ C1] nf_hook_slow+0xc5/0x220 [ 783.695774][ C1] NF_HOOK+0x21f/0x3c0 [ 783.695791][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 783.695806][ C1] ? NF_HOOK+0x9e/0x3c0 [ 783.695820][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 783.695833][ C1] ? ip_rcv_finish_core+0xda3/0x1c00 [ 783.695850][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 783.695868][ C1] ? ip_local_deliver+0x12a/0x1b0 [ 783.695884][ C1] NF_HOOK+0x336/0x3c0 [ 783.695898][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 783.695919][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 783.695933][ C1] ? NF_HOOK+0x9e/0x3c0 [ 783.695947][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 783.695962][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 783.695978][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 783.695992][ C1] ? process_backlog+0x271/0xc60 [ 783.696010][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 783.696024][ C1] process_backlog+0x569/0xc60 [ 783.696050][ C1] __napi_poll+0xaf/0x580 [ 783.696066][ C1] ? skb_defer_free_flush+0x233/0x260 [ 783.696085][ C1] net_rx_action+0x696/0xe00 [ 783.696103][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 783.696128][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 783.696163][ C1] handle_softirqs+0x1de/0x6f0 [ 783.696187][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 783.696207][ C1] run_ktimerd+0x69/0x100 [ 783.696221][ C1] smpboot_thread_fn+0x541/0xa50 [ 783.696242][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 783.696265][ C1] kthread+0x388/0x470 [ 783.696281][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 783.696300][ C1] ? __pfx_kthread+0x10/0x10 [ 783.696321][ C1] ret_from_fork+0x51e/0xb90 [ 783.696341][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 783.696359][ C1] ? __switch_to+0xc7d/0x1450 [ 783.696382][ C1] ? __pfx_kthread+0x10/0x10 [ 783.696397][ C1] ret_from_fork_asm+0x1a/0x30 [ 783.696418][ C1] [ 783.696618][ T37] Kernel panic - not syncing: hung_task: blocked tasks [ 783.696635][ T37] CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 783.696658][ T37] Tainted: [L]=SOFTLOCKUP [ 783.696665][ T37] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 783.696676][ T37] Call Trace: [ 783.696684][ T37] [ 783.696692][ T37] vpanic+0x56c/0xa60 [ 783.696721][ T37] ? __pfx_vpanic+0x10/0x10 [ 783.696753][ T37] panic+0xc5/0xd0 [ 783.696776][ T37] ? __pfx_panic+0x10/0x10 [ 783.696797][ T37] ? printk_trigger_flush+0x117/0x180 [ 783.696822][ T37] ? lockdep_hardirqs_on+0x7a/0x110 [ 783.696853][ T37] ? nmi_trigger_cpumask_backtrace+0x234/0x300 [ 783.696878][ T37] watchdog+0x1023/0x1030 [ 783.696904][ T37] ? watchdog+0x21a/0x1030 [ 783.696931][ T37] kthread+0x388/0x470 [ 783.696950][ T37] ? __pfx_watchdog+0x10/0x10 [ 783.696969][ T37] ? __pfx_kthread+0x10/0x10 [ 783.696989][ T37] ret_from_fork+0x51e/0xb90 [ 783.697015][ T37] ? __pfx_ret_from_fork+0x10/0x10 [ 783.697037][ T37] ? __switch_to+0xc7d/0x1450 [ 783.697066][ T37] ? __pfx_kthread+0x10/0x10 [ 783.697086][ T37] ret_from_fork_asm+0x1a/0x30 [ 783.697119][ T37] [ 783.697405][ T37] Kernel Offset: disabled