last executing test programs: 5.819703168s ago: executing program 4 (id=671): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000005c0)={0x14, 0xa, 0xa, 0x101, 0x0, 0x0, {0x1}}, 0x14}, 0x1, 0x0, 0xfff0}, 0x0) 5.782401044s ago: executing program 3 (id=672): syz_open_dev$dri(0x0, 0x1ff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$l2tp6(0xa, 0x2, 0x73) socket$kcm(0x11, 0xa, 0x300) socket$can_j1939(0x1d, 0x2, 0x7) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_usbip_server_init(0x1) syz_usbip_server_init(0x1) syz_usbip_server_init(0x2) syz_usbip_server_init(0x0) syz_usbip_server_init(0x3) syz_usbip_server_init(0x5) syz_usbip_server_init(0x1) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_io_uring_setup(0x12c2, &(0x7f0000000140)={0x0, 0x5eda, 0x10100, 0x1, 0x12a, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpu.stat\x00', 0x275a, 0x0) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r0, 0x0, &(0x7f00000002c0)="73c3e1a51b7d1a4bacc16a7e389f9206d0929f7ac894874eb046348d1bd15a6836c83c25d36fafb54aecb6153883d5f92948fee01439edcc7a0f4f46deb3abfcbb8e0965f2ed81de2a32f05a7e0ccc06c58c46c8498bfba677540b95388480f1b35171b4f98d3beeb79822d66b070f81ff43905438f371759839861e73", 0x7d, 0x8000, 0x0, {0x0, r5}}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r4, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x43, 0x4004, @fd_index=0x2, 0x2a523746, &(0x7f0000001480)="2912adb90e7bc2ec04f00597eaf977b1030e21cff178fba12fcb5784b97e6d0a34aa04732e34450a181be315097b69208cca28a3da7acd8c636629ebc005e63c2df0563c94d180a0d4d14c36a616b218c839519a9b84da80a5c188cd9dd498e949afe8bc83ce0b212aadce926742acd815d52f8fa3d601ef33386af74d3358fc3fc50078e254251340d8acd65ed67db78c8af1b6821d076c4719ce9deb4c7790c063083b3084a3ad996240110d1cfd1b53ef8c37cb76108c0307e9a69e71ef8c1d847956035cbaba0223ab770474c3e548356386fb227acdd023a281737bc9131e19c8d2ff22f0b699795d2dabc3ff1c44016ea7be14009d0748415ba26c6ec1e43e65a2198de43ae237140b5a2fa5e9d12895d8ad13d404cfd76882b20e1b7a993b446ac24f15f5e2b1e7c407b92f722b2444931b9aaa45960ffa37fe389a4f6060949d090278e986224dd9c47780348616f4ffc3e2d494371ec2e474d64941ae62420e7646aa396cea83cc2b84246fa045f67d7796669efdff22f7394e0370f7c4b29aa6828c1732e1ab22abb1a9ad94e1f2e9865f20d2877c2e8f218101bf3449c2e54dbd00108e8b7d0b7b894590ac7814a893c7a0fbd255007fb5810995ac2aaa924d1226ad9295a6b8f6a0f94100b57f78b96d67897a3c981c5c0c83904e041008994250df6d61b232d15cca868e170b49797ad5f61b36564e3d0ee7728732e96bb52a691f39d1a80dacd67011868399220d4bf5267b46c5187c9e5086f7f522be7af723c380372ad2b31da2f2770fad696b4ccf885b29438432cd4a34b03f8554bafc8c3eb85c0c6c69ed6b00d6c279aa9a7f8ceeffe6c4a266e9b0a94634cf037a85ced8853db5adddeb874d4fd032338771e8da04c36e3d4a988f5919a5b924b2bda17ebae0152c73a36e8f3b1f678d14740ef07d5ccd6b2892edd79dea1e86ba0600f4a4d4b2d4a5d499caf986e45d69273ea6d217581bdf13728f3f943497779fe8caa8a0e867c1625a1f6bdbba4d684e015ae5fc8df4ec4e9d38f9002d62cddf81a8612712f6f3d9c4101b3fba9325a0af97f93cff9e7f48ec8aea97533ccd1c276f585b47636a3b293a611369b5e1c6b76d272277477f9c628e95ffd99c7ec706f74a27beca8d408499bb5b7b1ee1f4c4f4e622b89d4d7c30c10c40e1ad8c5b036802b857ef4731ea8f351fe64368ba9a9487fab8aed9d7af4f3f3b6592377eba6f2613f11fd10cd281d2db0d7d164f8a9eafedbf67bbf9662188943bf4829c66ca8cec8875f7790bba7d5e38d4be5c02378eb41814640df2cef0cfbd708f8d5d9412cb3592e3a9c674ed92e9e1698f9b381266b927abef16482d3b945aa31460aa9056e3849f048313d43612ac2edd3ee6cacb9822b5c4d351e31d7661cff565343c911f38a595fc311aebe9b4c2edb2082590b63477f598f959dd24085126b13d2277477b27c4d89802fe40e6036d17f9c558dbfde574d1d5650ba5b6c808734a02ceda6de778d062431578920ae6508034e2441ad710d0d29dcc63146131d4325699558af91703bfd918895a2761511e9f580695fd2ea471c11f8a9c6ed1dad4652f07658449e935d2d95e72de2ca535b5ec2c6ebe2292c976f49a877439120ad5dac073855eecde3035fea6415125c2f4d070ba4341aebcf903b2f3d14b9bba949a218101d00ec891697957f01c7b5c7bd76e9c7b94530ca9bc95646738672075c8139612323d66185f6f1ccc8bee656eff932e1c2f5d9db88d5bc569cf5cf8c6dff70bc523540e704aaa8ad5dde5e39109fd48ca936d991c3972a4bbc2e156dcd8655c0911bf927f3d3a8e308fcc83547b92278f9a53182d3796b786ec38c099adc09c603f933cb120590e04c96259468fc2c7bc85b1c962717745728b8fb2a847d937f39b20ec11585f89b410c9cd6e5537d4d3e6a2ed572c5456774ed1aa7ae7bc71d0276905842ad46c62253f01f6dc768701e7d87e34ab75dd3ae424ef5d74b6b9ae42bb4d25f2137b7c382df92d8e770defb61ff91e11e38a0244ba277a4bbfb7ec2dd0e3dbe0461bad6cdf23b54d49fb59b0204e04f6fcb0d6aa8ba2706cf63fa84e1625e8b639acb3f1d6170e352fce907953c5fb5354f1b833567b51f7748aa728e9dbfbf1621a226b07ebaddff35c19b7f245dd2ebb3a183372f8afc79be1f191085a2c061adc3357fbf3bc95ff104c205aeccd1498dea2913a5dd938ff322c12ae284f40e3c595c4d3028b32cf756134907659278128036afe9eea66c8685db8b6ccb54c2539322494b4425f7c502c8c9479c93660b0af654dec45b6d05f99ac7fa4ec971358c48e47960255e5a1e5a1fdce112ae09c74d56f41d0d14a5effd14a1b93ac3e80c38b6558d2a28e8dc97f14591a880674ad506b849282187125f276f911a76c0aec53635a8081e1bde6909e9103667cb5ed88404453bdb2ce4442e6f2276269dadc7ce0418e9cdab4623b188d1a823eade6c5fcacf1cea8b52c7c5783fbf9fa9543ddf54a4bc2b1b7cb55e4e3deaee43465be269b85cf60f52d287f84af5686ab569490edd01d641775459eb117c26a81149b7770bbcf2c12428987724c3c30646991f7a85c6c661c618aaf66b5aa054c95f1bd99e1833d9499b64201c104b25705e94d90a8e8ae92fcca52d30528f1e1fc137a718ca8bb8662ec1e13b703c591407be9a268d7de5ffaecc5addb834e9a45fd4fe144c2f246e078deaeee6a39e466d72fb6d1929907e3b09bad8d0bf2b10b523e0da0abd98229ea6b26b17911bb84761ed9d9ca57eb57c7e0cd2566fee359bdfdde423cf3b2e44f9623bbd7d2dfdb2c893721ca44b3b51dc01b9e9d3fa4be006b3eb6455589f71e893d7f2dfebbe614be2a3a69dc976b4c767595de83fcdafe0570960b7a9ee49c39c0c325c992a044e1dce8cecab9a64d77847aab065d56e236005ac75d0c658b6a8668516e1e73ebb386a5eb9ebd8b964e82c5a02ee897bf0d499fd0f60d444b65ab5818c427b89cdc6a79d5df574b8cfb202f7c3eca8a78e2fd5843c9a02404257fd91f042538f70737068cb808a6bcd9ec2850e168227ad9c2da670a0a72a81414edbf48e35e18ffda131338537a71ef37d670933d4e6575191d99fbf6c09a7d51f9b34424d69f06816c1cfc050ebd64345d122ac021d2636390aa29f097d66ccc6539bfc372a054003427ddd954e11ea74d9c7447b54b6e59096c284385ff3854c7dd1e032f23593ee044d31f080b77a3c585a2ab0b519851ad53da028ae245871c01e9704f3d5885f277c8602e832e3c2640dab71be18934999b9d0ffb8c409fe7e486e3d93724c59c357bbf487d188409a7ff55e37097a5554ea1ca3ae31a4a7bbf3571c68c0a580b5188c263282e43593d4c2ae5de38623ad9ca0c7fcb10aa77b628955e1a65b21abc5b3ee5c2b63c4143a118c0b068c306339efb912d2f252858b44bfa1923352f40846b94210fcabef30bddd51cb2e15d51a8d20abd72b03c88c798269cf61e01cb2cf7c0126d8279eb9441375010932928a25ff22cd11b3823a36b3c0a75cb3b6e0a23dc5c83484fb3d304c0c18298c3266dbe5232900c128681db1fe4013feca2730cf421acc65fba8f29566e31f9e9b9c7fc097332281dd64127222a2b711b043f32c96baf6bee1be4422d4d1c9ac2e52aacb0c4a6ea14f91fb5e3a518abfedd4e522cbca7df3c278845e34475da0bf1be73ddd1ba98b20762e569a29ad20e31e50d17b058af29ffbb0f70ccfda06385ef6d5f9de9f26822d0ed6ec7ba213105937059f7508b567e137f77951abf7978c9c0ca50491f8db061150474360eafa5f02a91e0aff5c657414c0b0762c205264ec8b7facc68e2831bc37ab2862bb73da8f45e05dda22c7a535110089a4e62cb6c50fbe59146a27e10cc393f87171fe130491ccb18f96c198bc5e515cd4f3345797cccf17171079897321dc09b95acfb7ae82f416a667da5c3cf4195fe1ed8e89833a67272a679a4de65c95cef9d16e6bfd5ba6da7903b479762fa858dbb1b44f5d609363714a4adde56e3824e50c2a0bf7e8ece6cf4868941d40051ff21172721d45265116fbc5a2ab8683d83551fde11c67f5574801e54b36e3701f44725e93370ef5c3775b0126f0b4dc852ef182ce61ef08dda0f3243daebcef8fb54bcce148ffd9a96376fdd61ecb69b5ab7f4f538113ee3d452c68c0545859c198b5c50702a0dac2b2bb4fcc807d915606d148ee8b2f1e63e26a52fad01a2b314c105814a28c06eb054585510b26c76bbb40bbd095213b222d38a4396d17da2028e4bbeddc2774bf14151206585de084afd90b7b00d9edbbb306513756d4ecfa2f9e754cd84a5a2f2a6ee443eea6c37b300ea04df584614f4ec910ee516b5daf019c5b945b2028c89dfb3deb3d46d6f51c8292568d1338d7e87c878b29f17661a1177305e11b11edb7e7b076560b90290ecc38b3315f6ff2b70294b8480279a366c0fe6da1a39b17e91575f7bd59862730f4c641bfddb9ec7269095559d59696314d542d896e29777ee0952f8bd91e6a3fa310b21414ca479d35ef82245312b7665a9b36816e3f87b875a29726ee8206e28bd425d87da665b542a700c38d4d6b5c4f304fb474fdad8a648761c1cc85dd446c698f2a31f10fa07d26cd487478736342dd57dd3a25cd1af83eb589b45b3b0b1333ce96fa22740b798936c708d41cb5023de7f68086a439eb380d7f01fd5fb59378f492b8a82451f2142954ff3068615cb5754db3ed85a976aa1db1f553df210faf502617d1b85f5f93ea498e93bbe840da2a235c3a5fe861f60aacf5fb3fbc70cf1188d531b8458243ed7a6f5b72168d45bbfda8868a5a51508b04edd16374d53cfbb9588e141b9d9eec2765b261d8e54413b243413b36cd36fec391fa7ba25b494c167644f8bfd784a27f80f9008bb2252e073a75d14352e88b18b82b4819544ba79e76b577899dc0d97a96fdc689411f1b34ce412db0c669a7c590126c5cef0d922ecd52aea0bea2262eb14c4b19114db28ef3db6486ae434588a23a23e2b2965e7bbb677af983c8831de375f3f0d02a467f61bce52f5b3619a4686eeafdfdf0c91704e4690e9ce618179a3349600db81b8099a3bd79e7431f402c6aebb92d2d4a9678d60abe5da017358c158cc3eced8b77aad6e5dd7165fc483a134384e3bbeb040117fd5639995cdf99f02ade21cda76bd3046c2739c632944dea8b70b6db3b406ef7c5537b3fa1e6629cd2ffc069881be2111c1f5978cc22fe5acee47b4bd136fb1b39a7ce4860f039f3ab8315613a6728540cd0605ddabe0fb9f7ccb475568d672d2cd3e81b209d825b921917b1ed5b399e9e9d0f858e3300be3ebb4f92def8eebac396ca1bc37d6c3653a9b10c97005844c18f35de2e0f3d1b8bfe39c351c7494b689a662067989b69a08e7de927bcab432fe09c2aef719fea588fd4f5f2b425c77227d66bf9a6f1c3cb3a2e4da54e14b26edd960eb7d4ad7787a5d99cd25d81a9542aa0a48b93c89fce3e86850a84bc45f102ed0339cb90b710a007ab8475aa1ed26f56a83d052c46c845b2dbb26b8aa541e89e47085edce9b5be472650601407565e3b632b31d4a65bd8363c18ff3de4a13bfd98e1a74a41cde2af209faffdaa607ba343b25ac6aa331fce957f2d614b039badd8f556fb79b01c5236ea1fa8d0a98f245dc84a0981c0850270730f03f1878e3463201dddec8e6ef5c06746137b45d94dba2c2bebace3e56297240f6345223a29f180cdc8df5577e7d8bef30d131d5540f4a91", 0x1003, 0x13, 0x1, {0x0, r5}}) io_uring_enter(r1, 0x7330, 0x0, 0x0, 0x0, 0x0) 5.712892072s ago: executing program 4 (id=673): r0 = eventfd2(0x1, 0x80801) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000040)="eebd73c460f8a4a8", 0x8}, {&(0x7f0000000100)="dda136dfb2938c66", 0x8}], 0x2) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x3, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000180)='GPL\x00', 0x1, 0x99, &(0x7f0000000240)=""/153, 0x0, 0x42, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x4) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0x8, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x8, 0x10}, {0x7, 0x3}, {0x6, 0x2}}, [@TCA_CHAIN={0x8, 0xb, 0x3}, @TCA_RATE={0x6, 0x5, {0xff, 0xfa}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4005}, 0x4000) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') pwritev(r3, &(0x7f0000000500)=[{&(0x7f00000002c0)='2', 0x1}], 0x1, 0x0, 0x0) 5.691505942s ago: executing program 4 (id=674): r0 = fsopen(&(0x7f0000000180)='ocfs2\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04) syz_open_dev$dri(&(0x7f00000000c0), 0x9, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, r5, 0x300000b, 0x11, r3, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000000)=@x86={0x9, 0x7, 0x8c, 0x0, 0x7, 0x8, 0xff, 0xb, 0xc, 0xf9, 0x2, 0xfb, 0x0, 0x8, 0x5, 0xb, 0x3, 0x7, 0x9, '\x00', 0x1c, 0x6}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r6, 0x25, &(0x7f0000000000)={0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x8001}}, './file0\x00'}) ioctl$TIOCGISO7816(r7, 0x80285442, &(0x7f0000000040)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000045f35b5a000100000001000010d5d52ce736e44d0474ad3c09b4ec354fa882d130d2da6e88bfd6c2da19b2467812f904c2a13b6c934f6b8dc2ed41a2dd4fde71ca0a712592fe0d5b226c2363fca2875424c5dbf5d31dfdd9e2a11e47", @ANYRES32=r8, @ANYRES32=r8, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x20}}], 0x2, 0x0) ioctl$AUTOFS_IOC_FAIL(r7, 0x9361, 0x9) 5.228289074s ago: executing program 2 (id=677): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000100000000000000000a5c000000060a0b04000000000000000002000000300004802c0001800b0001006e756d67656e00001c000280080002400000066c080001400000000308000340000000000900010073797a30000000000900020073797a32"], 0x84}}, 0x0) 4.70078707s ago: executing program 2 (id=679): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ipvlan1\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000000)={@private2, 0x0, r3}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c0000001000390400000000000a000000000000", @ANYRES32=r3, @ANYBLOB="19e8b61c3f"], 0x6c}}, 0x0) 4.535702254s ago: executing program 3 (id=680): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r1 = socket$inet(0x2, 0x6, 0x8) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r3, 0x6, 0x1d, &(0x7f00000001c0)=0x3, 0x4) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, 0x0, 0x0, 0x20008000) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6a0a00a2db3997cb6751d7d7fcb997460000000000000000"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) mount(0x0, &(0x7f0000019080)='./file0\x00', 0x0, 0x23010, 0x0) r4 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$read(0xb, r4, &(0x7f0000001300)=""/4096, 0xffffffffffffffd2) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280), 0x0) socket$kcm(0x10, 0x2, 0x0) r5 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) io_uring_setup(0x5c79, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x48100) read$FUSE(r5, &(0x7f0000000940)={0x2020}, 0x2020) creat(&(0x7f00000001c0)='./file0\x00', 0x8) syz_open_dev$sndmidi(&(0x7f0000000080), 0x115, 0x440200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) 4.068701261s ago: executing program 2 (id=683): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001c00)=@base={0xb, 0x5, 0x7, 0x9, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4) shutdown(r3, 0x0) recvmmsg(r3, &(0x7f0000001980)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/26, 0x11}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/47}, {&(0x7f0000000100)=""/224}, {&(0x7f0000000200)=""/4096}, {&(0x7f0000001200)=""/124}, {&(0x7f0000001280)=""/60}]}}, {{&(0x7f0000001380)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x0, &(0x7f0000001840)=[{&(0x7f0000001400)=""/149}, {&(0x7f0000001b00)=""/118}, {&(0x7f0000001540)=""/188}, {&(0x7f0000001600)=""/57}, {&(0x7f0000001640)=""/135}, {&(0x7f00000014c0)=""/101}, {&(0x7f0000001780)=""/171}], 0x0, &(0x7f00000018c0)=""/176}}], 0x15cbc1ab4c0933f, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) eventfd(0x10001) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={0x0, 0x0, 0x27, 0x0, 0x1, 0x80000001}, 0x28) r4 = socket$alg(0x26, 0x5, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/mdstat\x00', 0x0, 0x0) r6 = epoll_create1(0x0) epoll_wait(r6, &(0x7f0000000300), 0x0, 0x7ffe) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000040)={0x20000007}) bind$alg(r4, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cast5)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000001280)="b7f2288a91", 0x5) r7 = accept$alg(r4, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f0000001040)=[{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000080)="c16a22213bc73b5c37696b90ad5bca70304193fc04574d3ca94f8bd1cfecb4c0bbc0c62d3e3b7d4578bd360ea718afac", 0x30}, {&(0x7f0000000100)="9f1ac09f155c1291fc8baa01adb9b575263c1a877ef8644bccc1143c6da61222f05eacf50665f3905cc2fd3e4e81e2a13e7fcca4b10085ea82589f9511a2f87ee914c9e0894139310b5457cfe7ca3ae3da", 0x51}], 0x2, 0x0, 0x0, 0x80}], 0x1, 0x50) recvmmsg(r7, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0xffffff0b}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x2, 0x2101, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xe}, 0x18) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x101201, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r9, 0x4020aeb2, &(0x7f0000000080)={0x0, 0x0, @ioapic={0xeeef0000, 0x1, 0x8000, 0x0, 0x0, [{0x6, 0x87, 0xa, '\x00', 0xab}, {0x2, 0x0, 0x2, '\x00', 0x5b}, {0x60, 0x4, 0x8, '\x00', 0x3}, {0x5, 0xe, 0x7, '\x00', 0xf1}, {0xc, 0xc, 0x9, '\x00', 0x43}, {0x4, 0x78, 0xc5, '\x00', 0x9}, {0x94, 0x5, 0x9, '\x00', 0xfe}, {0xf, 0x0, 0x6, '\x00', 0xfc}, {0x1, 0x4, 0x8, '\x00', 0x33}, {0x81, 0xf, 0x57, '\x00', 0x9}, {0x5, 0x4, 0x1, '\x00', 0x6}, {0x81, 0x6, 0x6, '\x00', 0x48}, {0x3, 0x1, 0x8, '\x00', 0xff}, {0x6, 0x3, 0x2, '\x00', 0x2}, {0x6, 0x5, 0x3, '\x00', 0x50}, {0xd, 0x2, 0xd}, {0x8, 0x81, 0x81, '\x00', 0xb}, {0x3, 0x89, 0x1, '\x00', 0xf}, {0x78, 0x7, 0x2, '\x00', 0x5}, {0x3, 0x7, 0xc1, '\x00', 0x7}, {0x5, 0x26, 0x5, '\x00', 0x9}, {0x7, 0x9, 0xe4, '\x00', 0x6}, {0xc1, 0xd, 0x3, '\x00', 0x10}, {0xfd, 0x3, 0x80, '\x00', 0x6}]}}) 4.048209956s ago: executing program 4 (id=684): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="4c000000030601040000fcffffff0000070000080900020073797a3200000000050001"], 0x4c}}, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000200)={'syz_tun\x00', &(0x7f0000000280)=@ethtool_coalesce={0xe, 0x8, 0xbaf, 0x70a2b7c, 0x1d6, 0x2, 0x1, 0x81, 0x8000, 0xdfe, 0x6, 0xfffff1ac, 0xe, 0x1000, 0x3, 0x3, 0xecb, 0x9, 0x5, 0x9, 0x0, 0x92ae, 0x3}}) r4 = syz_open_procfs(0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000100)=0x10) setsockopt$sock_int(r5, 0x1, 0x35, &(0x7f0000000040)=0x1, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) socket$inet6(0xa, 0x2, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) creat(&(0x7f00000001c0)='./file0/../file0\x00', 0x32) open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(&(0x7f00000000c0)='.\x00', &(0x7f0000000080)='./file0/file0/file0\x00', 0x0, 0x80700e, 0x0) fchdir(r4) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r2, 0x4068aea3, &(0x7f0000000380)={0xbc, 0x0, 0x3}) ioctl$KVM_SET_GUEST_DEBUG(r6, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d4d549b, 0x0, [0xffffffffffffffff, 0x7, 0x1000000, 0x0, 0x5, 0x3, 0xfffffffffffffffc, 0x800000]}) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f00000ab000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000040)="36d0e866b9b000004066b80000008066ba000000000f300f23c8640f00dc66350c00a0000f23f89d0f326635000400000f302e8dcc0f23742e3b5753baf804f3e00066efbafc0c66b83ac80000666fda6509", 0x52}], 0x1, 0x1a, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 3.672890219s ago: executing program 0 (id=686): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fallocate(0xffffffffffffffff, 0x0, 0x404, 0x1000003) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/tcp\x00') r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$cgroup_type(r0, 0x0, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e22, @private=0xa010102}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe2$9p(&(0x7f0000000080), 0x4000) creat(&(0x7f00000000c0)='./file0\x00', 0xce) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x2004000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[], [], 0x6b}}) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x5e22, 0x0, @empty}, 0x1c) listen(r2, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000440)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-generic\x00'}, 0x58) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$unix(r6, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f00000001c0), 0x1}], 0x4e}, 0x400c000) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x81}, 0x4000001) lseek(r0, 0x1000000, 0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x3, 0x2}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) writev(r7, &(0x7f0000000100)=[{&(0x7f0000000200)="53f09efe211e7f81", 0xfffffe0f}], 0x1) write$binfmt_misc(r7, &(0x7f0000000000), 0xd) 3.571341591s ago: executing program 4 (id=687): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'geneve1\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="14419e5465f0006fc8afa8e40800", 0xe, 0x0, &(0x7f00000005c0)={0x11, 0x0, r1, 0x1, 0x40}, 0x14) 3.409540787s ago: executing program 0 (id=688): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0xfffe, 0x6}, 0x4) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x23, 0x0, &(0x7f0000000080)) 3.056671384s ago: executing program 0 (id=689): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000140)=[@in={0x2, 0x0, @private=0xa018101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000380)={r2, 0x1c, "1b992a38fd78954a4bb5486429589825a8f805f7675ef1cef950d963"}, &(0x7f0000000340)=0x24) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = userfaultfd(0x80001) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000412000/0x4000)=nil, &(0x7f0000481000/0x3000)=nil, 0x4000, 0x3}) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) r5 = syz_open_dev$ndb(&(0x7f00000003c0), 0x0, 0x1b18c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r5, 0xab00, r6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd}) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r9, 0x29, 0x4b, &(0x7f0000000000)=0x5, 0x4) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000003c0), 0x0, 0x2, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000180), 0x404400) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800000030000000000000f8ffffff851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) socket$pppoe(0x18, 0x1, 0x0) 3.056365977s ago: executing program 4 (id=690): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x2, "fa02c80a3a1e9d4b9aaf000000008d674fe69b5b7638dd031dd7504fe5809639", 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r1, 0xc0383e04, &(0x7f00000000c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getpid() r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) fcntl$lock(r3, 0x7, &(0x7f00000000c0)={0x0, 0x0, 0x40}) fcntl$lock(r3, 0x7, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x2}) fcntl$lock(r3, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x7}) sched_setscheduler(r2, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$bt_l2cap(r3, 0x0, 0x0) syz_open_procfs(0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b000000080000000200"/20, @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000001007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000000300000095000000000000006d5bc6410da0bcaec3e51708e29644e5545483d0fa380db226c2aa4853f98532e5cd6871faf27ceced1b092b9438e5edbb22c0ff2663899a8b2f4167eab80c85828400871bedf12232d160d2f53a406f28e7e2cc3dfc029c9569b5b354d729f403f758a3e1cee99bab4c26bf0e73fa3f44802e0c4fb6ce6aaa0a543c42cda47616ec9b850ede47760fc61b85b99f6f2b84cd39230555facc9d1de4880182edfcb927c7f981dc87167a79b5d19f9cd4ad4215ca746824680ab081"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='page_pool_state_release\x00', r7}, 0xa) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r8 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@mcast1, @in6=@dev={0xfe, 0x80, '\x00', 0x1d}, 0x4e22, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x4}, 0x0, 0x1, 0x1}, {{@in6=@local, 0x0, 0x6c}, 0x2, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3504, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}}, 0xe8) r9 = socket$key(0xf, 0x3, 0x2) recvmmsg(r9, &(0x7f0000006200)=[{{0x0, 0x0, 0x0}, 0x72d}], 0x1, 0x2000000022, 0x0) sendmsg$key(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000006, 0x40032, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') 2.585127633s ago: executing program 32 (id=690): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x2, "fa02c80a3a1e9d4b9aaf000000008d674fe69b5b7638dd031dd7504fe5809639", 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r1, 0xc0383e04, &(0x7f00000000c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getpid() r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) fcntl$lock(r3, 0x7, &(0x7f00000000c0)={0x0, 0x0, 0x40}) fcntl$lock(r3, 0x7, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x2}) fcntl$lock(r3, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x7}) sched_setscheduler(r2, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$bt_l2cap(r3, 0x0, 0x0) syz_open_procfs(0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b000000080000000200"/20, @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000001007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000000300000095000000000000006d5bc6410da0bcaec3e51708e29644e5545483d0fa380db226c2aa4853f98532e5cd6871faf27ceced1b092b9438e5edbb22c0ff2663899a8b2f4167eab80c85828400871bedf12232d160d2f53a406f28e7e2cc3dfc029c9569b5b354d729f403f758a3e1cee99bab4c26bf0e73fa3f44802e0c4fb6ce6aaa0a543c42cda47616ec9b850ede47760fc61b85b99f6f2b84cd39230555facc9d1de4880182edfcb927c7f981dc87167a79b5d19f9cd4ad4215ca746824680ab081"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='page_pool_state_release\x00', r7}, 0xa) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r8 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@mcast1, @in6=@dev={0xfe, 0x80, '\x00', 0x1d}, 0x4e22, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x4}, 0x0, 0x1, 0x1}, {{@in6=@local, 0x0, 0x6c}, 0x2, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3504, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}}, 0xe8) r9 = socket$key(0xf, 0x3, 0x2) recvmmsg(r9, &(0x7f0000006200)=[{{0x0, 0x0, 0x0}, 0x72d}], 0x1, 0x2000000022, 0x0) sendmsg$key(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000006, 0x40032, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') 2.570857672s ago: executing program 1 (id=692): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x6, 0xb, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007000000e8e09e9ab702000008000000b70300000000000085000000c800000095"], &(0x7f00000005c0)='syzkaller\x00', 0x8, 0x79, &(0x7f0000000140)=""/121}, 0x94) ioctl$F2FS_IOC_COMPRESS_FILE(r0, 0xf518, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) fcntl$setown(r0, 0x8, r1) 2.564505742s ago: executing program 2 (id=693): syz_open_dev$video4linux(&(0x7f0000000040), 0x20002000404, 0x1aa543) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffd6c, &(0x7f0000000040)=0x202) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001f40)=""/102392, 0x18ff8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$cec(0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_MSG_GETRULE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000007c0)={0xa8, 0x19, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_RULE_USERDATA={0x93, 0x7, 0x1, 0x0, "0390b224b91887791f1681853e8ad4d6b7367349554510955b8f3ff281df33ae12f4a96d5b96c54a89c071e73b33c5e20728dd07c77d01be1d9c5ba77e19622e196c58c1a9f9e82beaafb7066ef1020988f3028adfb9b34c049e55f553595917bf42942d6f8bd9fc79f8a012282375585aa903836aad441c2e69d11df481184c612fe83d78f7e91f5a490e46f76450"}]}, 0xa8}, 0x1, 0x0, 0x0, 0x40000}, 0x0) epoll_create1(0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) dup3(r3, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000380)='mm_page_alloc\x00', r4}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r0}, &(0x7f0000000180), &(0x7f0000000400)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x7, 0x3, &(0x7f0000000000)=@framed={{0x62, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0xb3}}, &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4}, 0x80) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000001020102000000000000000002000004a40001800600033700040000060003400001000006000340000100002c0001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000}, 0x40) 2.44670124s ago: executing program 3 (id=694): r0 = socket$inet6(0xa, 0x2, 0x3a) sendmmsg$inet6(r0, &(0x7f0000000800)=[{{&(0x7f0000000080)={0xa, 0x0, 0x66f, @local, 0x4}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000780)="8000102e7577d401", 0x8}], 0x1, &(0x7f00000000c0)=[@hopopts_2292={{0x18, 0x29, 0x32, {0x21}}}], 0x18}}], 0x1, 0x4000010) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000012c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x2, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xb000000}, {{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1c}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x4}, {0x3, 0x0, 0x3, 0xa, 0x2}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x0, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x4, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) 2.130644191s ago: executing program 1 (id=695): mq_open(&(0x7f0000000040)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!T\xeeux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0x4, 0x2000400, 0x3f00}) 1.49635419s ago: executing program 0 (id=696): syz_open_dev$video4linux(&(0x7f0000000080), 0x1, 0x1a8543) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000001020102000000000000000002000004a40001800600033700040000060003400001000006000340000100002c0001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000}, 0x40) 1.454391089s ago: executing program 2 (id=697): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYRES8=r0, @ANYBLOB="739078d7e8e0e098e152ef8334560d198ed65b1c4e7cb59571491ffae8f79a83d718b0eb322ec286391d42ff5f17b8ed849eafb5e74d0b6d329e62e88b071ebdf6ec18985dfe22ef0cefd4675d0a55d3121d9ff610d6d7aceaabd744c6e6f8aa70c50e04ced7f9e3e2a0535fd3da2f6869d1f07386cf45e6be2a6a00ef3dd0abb6"], 0x7c}}, 0x85) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)={{0x14}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_RULE_EXPRESSIONS={0x4c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x30, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0xf}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xa0}, 0x1, 0x0, 0x0, 0x850}, 0x0) r1 = syz_usb_connect(0x0, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) (async) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r2, 0x707, &(0x7f00000001c0)={&(0x7f0000000180)=[{0xb4b1, 0x4200, 0x0, 0x0}, {0x9, 0x221, 0x0, 0x0}], 0x2}) (async) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000d00)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r4 = io_uring_setup(0x1cdd, &(0x7f0000000200)={0x0, 0xcda1, 0x40}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f0000001b00)={0x0, 0x0, &(0x7f0000001a80)=[{0x0}], 0x0, 0x1, 0x700}, 0x20) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000004c0)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000002000018200000", @ANYRES32=r3, @ANYBLOB="00000000000000006200f8ff0000000095"], &(0x7f0000000180)='syzkaller\x00', 0x2, 0xdd, &(0x7f00000001c0)=""/221, 0x0, 0x20}, 0x94) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0), 0x80, 0x0) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$RTC_SET_TIME(r7, 0x40247007, 0x0) (async) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r6, 0x800442d2, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x0, 0x0, 0x0, @link_local}]}) getpid() (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x4c, 0x10, 0x401, 0x2000000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2809}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0xb}, @IFLA_GRE_IFLAGS={0x6, 0x2, 0x5}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x3}]}, 0x4c}}, 0x0) 1.449770355s ago: executing program 3 (id=698): bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) fstatfs(0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r2, @ANYBLOB="01000000000000007fff010000000c0005006c000000000000000c0002000000000000000000040007"], 0x90}}, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) move_pages(0x0, 0x1, &(0x7f0000000140)=[&(0x7f0000000000/0x1000)=nil], &(0x7f0000000180)=[0x59], 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000d9a37b4db5afc344883cd1699426ec1b58f7de441a741d6f3254f1f65877ed", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x1f, 0x14, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000020000000000000080000000180100002020690000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000f8ffffff850000000600000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000018000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x40, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0xb, 0x2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x6, 0x1, 0x0, 0x2, 0xffffffff}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffffffd}}, @TCA_NETEM_RATE={0x14, 0x6, {0x1, 0x80, 0x7, 0x7a7}}]}}}]}, 0x6c}}, 0x20000000) 1.425736362s ago: executing program 1 (id=699): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0xb97979010a91f913, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}, 0x1, 0x0, 0x4000000}, 0x0) 1.376072426s ago: executing program 0 (id=700): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f00000000c0)={0x2000000, 0xc, 0xfeff, 0xffffffffffffffff, 0x200000001, 0x0, 0xfffffffffffffffe, 0xce, 0xf}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9365e000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000001c0)={0xe886c5ffc5249171, 0x0, 0xeeee0000, 0x1000, &(0x7f0000001000/0x1000)=nil}) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000400)={[&(0x7f0000000140)='\'\\\x00', &(0x7f0000000200)='-!\\\xf2/^\x00', &(0x7f0000000280)='/,]\x00', &(0x7f0000000380)='hugetlb.2MB.usage_in_bytes\x00', &(0x7f00000003c0)='-+\x00']}, &(0x7f0000000500)={[&(0x7f0000000440)='$[\x00', &(0x7f0000000480)='usrquota', &(0x7f00000004c0)='\x00']}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) 1.176651462s ago: executing program 1 (id=701): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x3, 0xc, &(0x7f0000001240)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020"], &(0x7f0000000200)='GPL\x00', 0x1}, 0x94) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000001440), 0x6, 0x840) ioctl$VIDIOC_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f0000003500)={0x0, 0x0, '\x00', @raw_data=[0x3, 0x5, 0x7bff, 0xbcb, 0x957, 0x1, 0xfffffffb, 0x6, 0x7ff, 0xe8, 0xbd, 0x0, 0x7, 0x68e24ef5, 0x9, 0x3ff, 0x7, 0x3, 0x1, 0x7ff3, 0x0, 0x6, 0xc0, 0xffffffff, 0x7, 0x5, 0x3, 0xe, 0x40006, 0xfb, 0x5, 0xfff]}) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x200000006c832, 0xffffffffffffffff, 0x2000) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x2, 0x0) utimensat(0xffffffffffffffff, 0x0, 0x0, 0x100) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x10, 0xffffffffffffffff, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f0000000180)=0x1, 0x86, 0x2, 0x0, 0x0, 0x1) poll(0x0, 0x0, 0x10000) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{0x0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ptrace$peekuser(0x3, r2, 0x3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) inotify_init1(0x800) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x27, 0xe80, 0x0, &(0x7f00000002c0)="f8ad48cc02cb29dcc8007f5b88a8", 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.070691711s ago: executing program 3 (id=702): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, 0x0) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000002d80)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x100000000004, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x2, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r1, 0x7, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, &(0x7f0000000240), 0x0, 0xffffffffffffffff) fcntl$setlease(r1, 0x400, 0x2) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/tcp\x00') r3 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_int(r3, 0x6, 0x7, 0x0, &(0x7f0000000040)=0x15) lseek(r2, 0x1000000, 0x0) 266.306773ms ago: executing program 1 (id=703): syz_emit_ethernet(0x100e, &(0x7f0000000700)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}, @void, {@generic={0x8884, "d302ea111e49170f601c78d01a83f80801b41169c4638139b3a59aa2cbbe4f7e77998c0030fba8f9ac16182754157bcc7b6a997ab97f4078460ed8ecbf6b07583e1fdf9d1c6ab7cee31e5f1cfea6c8718da9a5ae797dc816c2e0fbd63c998e39ce1b3db07b6741efb7a9cf480486e374510bc2c4d366d7774ab69237f6aa1dc608a66f1b8939d887bbf23218464c4fb8ca1a36e168d6c931df9335d42d89cf233a104a8b109b934d0d0f3370311dbc6552c69c9b28e026545892c89057cc46ae914f8a0f731b2a97f80aeed361bf83d69e5bcd8115ddd08d85c9ff46d264b087c15d834381fd2d088d3469383fe9ef9845541576cb9c99baae3d8cb2134f30b95cbdfce676ef7fe6dad1a613828cbf8b1cb7c3a086754dfec8dc0877aab4d6105e40dc30ce3519c8b61aa73128de896ddf46b09d58c5af85260840b5246b9e71230d0a6643823c5dc2535b1f40d80bc8787bbfc6150fcea8fe34d72826c07cc1244b72c31238df0534b31f2d0ecd662b152e3c5daba184c69389bd023d1e32b43dc7186e11fd7130ae8d9c5d5fe60efa6c25496777b1d432581268800cfa9294b54c02b9c948b71d0f31055f917aa3fb5ca825fa1e5bb36b137eaecc5d3ecd42f1f2b2abee383417c4dbc758eb41cdeab617fc2a95b8d887eef2bafc157e949bb5c008d9b7e8822de101be32f31bae24a348b63a65483b96c19b39b960e9fcdc871a50ec79ae95e0f05b4d5bf0745ef4e09ad054e613cbead755d5bc57f626909a5f70b46cf30b7c2b142ff87f60d05a56cc993ade41091a09eae0e50d8963441a0a91524ea9875ac692446e1aed12a242a711847efd6e68742c9f222fe606deca628cde102c1e2ec47705f1ac1ec97d7535b53626947193aace56ebeb5e4cddc4a12e6d58549a30dcacb11117b8eaad1fd642d1ed5175b73e867a5cc8663e4c1a4bc366d22f7fb750b72f6726d46c203d5bfa7b37925e79fe0b0842f91fb372169a58a0625f4b6a15e3c6b35341b31e4eb3b68611c5af7ecd5613be020908d591263286636e3f937a200a004864365eb5eba271b0801a62c116d6ecbcc33fe935eed4c7d5f99548a6f40b6ad71d4f4ea324b579cc9f02ed72b8eba4273723f0436ba9437010aac3f5c528367bdacdc4ec68e086913c8190452b5a025d2fe891b7da0f1b370b4a974f73231fcefd21a9992f815ceee8633697524557bd4aa76f603f8e8874fee4493a1a4021afef7123968d0313535d2be70bcdefafa6822f28be5266836c405c28ae51ff7ec975cb2c24743f873207d9c0381d62d67db62a0ebb293d86542aaf370b9aa6ba35d32eb6c7da12d975a0d77eec28e05528a295916bb01e0cb31797932c1e3816105f4ac8a053f70342e626dff4d2e503d185f6f0e66622c88383f65d0c6ab372a4110474fbdb8eaa3838a097a6e3a016fbdbf8ecaab8a56bb9679e2a94c67667665fbf9c915ae8f2228965a8c654c169a9a45f414156cfa4b101b7c6c93a11d6e5f522d90840953ffc489898b5afc13db40f758385f441986f146a6292045d4e1e0b548bda6e14756372a10c33892d8309cadaa9c4ea1cfa0a83c85391e4ae36cc1c3f87093094749b3fe8bb9e0fd69718d57f0c8306426f075fda57fb3bc56e1076dc85f4578c44c5765a66128e360d082dbae537b5c68d30ba619f537d8b7cc390586cb5cdaebb83c3932364abbdd5a13bb1f81954b8220694cf9cf6f1198c74f2200bc720e644a125ab4262830924755c3d0e6acfc05058dd17038ba5e4fcbcbb3316c72838101af83a35e487c77bd8e25e1ebfbf4160d9b7f0f14fd54bc7eb67fb3647a533ddfe18e19c369c0870871ad1d636e9fb4b526df37a8b8d0714aa5cc3aef5f8dce1696080841ddcf913e0eecab4ff3bc7f8ad3bdc12b9c0af0aa2eb6e2b6e2765f21889772c7969f019115df48979ae35ea6ef9bb48013ef305a059197dcd7a63e89a0d713b0c7c88d56df00c83f2b37404844503dd81c7465272e69a6b74648cd3ac88f02082553d239df808945f0472c44f100daada36ad040a2ad65315b811b57593f0f9f298d549c66affb8ac435522ba670ccd3ea5cc6dc4125f48861c670c80317cda69e5a1c00ea31ade5d2da45285fd4e59946202d39a40896283a956f358319d4f20ed7b61b2e6c9ef4004ae8c3aca3046d08a42fc4f079926f8d199b601b136dc19302b736981f966e666b2e7f595ab0ebb6eb318d0d1e372292eed3e32784de84d7191d89aa14da91417c15f6460bd8cefd04e9d25e462c68f8ee5ff314ed383f65ad7abe69bd719e314931f59b7b40bf2f0d15779d1f986e462a15873d4a1819cc2a89da9009a5bd39d1e14e951d43a751d536ecb90ca14c487f2704d1cdeb98d4305fa62e7692060b5fcfbe816ea8224dfa35c2ff184e2037479d637f11c413307b9b7cfe4d39b3d31b31c393de781dda0cea16506f108e940b8f062a223abdc153de543441ee24ec88c6f6b5a8977162f54b137eb290f36ea7269c8df6361e7ca6f0a005426c1174a3787adbad1f1cdab6a3ef10b537fbceec0324fcdee95f18e60e33801ffb27ab1f39f4bd04d2dcd33bc9f658a8dc087cdab530da0d80d91c49328750ee04d41ea7f451b497bd88d326d4d94cdb714d24d28db589f96a114b64c268083032286d0eebeb7214022584121c212e1d11fbe17f292373b53eaa7fb6058714aa72f6fe0aef4c6674f2d0ea4d752f96caf8f53af7e887469d6f1176f31335d9644ca508b80a0ac292f97793c4ea7e6d113d848c6a814855f4263ec15f9b5b9247bfe91385ee8cff2391d7f270c5a10e962a115a11a4d29ab78f4fe66763c927189e3bc5e453c366580a5722268afccdeb09246db9c38f75b7a0bcd5452f2aa3f808813a8afc279d68a3d9795cf7a34d7a73c7a2900ac1b9db3c48aa2f430a9f1c300c312117a9a5c9b2c3abefc24f6974986cfe2bd73d1c7abb6126ff4cb438068ebee2c2030505cfa6c6f93972d69ff7063f798ddd776b9999bc6099420345ebcf71880d962a588e5662b56b39b2d1aa9fbf31f87ef6fedfd5a5284b58b440c48b88570ffe727e2490e595b14302a54bdd15e5c1ee06c134f9d9fa07d71f34716c4a7140fe2e832f6c6c2650c5618bf5cd458358bb1ef7fac25f151e73442beeaf7eddbe502cc3a6a3553bd6c7287b2aa5f613391d2bc7174d6e027c4b65bab45353f33b6039ffde6ee1252d542cc5c864e6bafce9259141f0de8771dca9735fe104843d7844fe2de9feb71b081e32f2283fd8c7fe6b39617bd45514d9f5f0873e56d2d4539ea031f9165584359379afaac407b03731dbe07784177a33f69147a984e5b5128ce5a3fc1e667212bb66c8f9ed56096e810b4bde137df9e988290c087ae2e1f8a9248aa66473048862b87de79e6d9b32930941ed7f58b3aeb9c2dcc23ace7bfd3c0bd1acb8d0f231b15d1cccf8531c30d8700f0dad3ed848a3f0ba2febcdda2392ae8ecddcf0ded113fab5be811cff067817ed30b7d0e8c8dda1be1e3a546f342d22fa205671314fa1514dda90edf6d1c3d20251231b416debd2fe2193f102757390c9f837ab77abe230a3b98e5bdbb2a6d76effd5d438632d81126d6d9eb4f7abc88ac994a371f049caa0e46d7f0585de39246cab4e42769a55f2eb4bc5b744ed9edb497e452ab5d89c1aa8887877b6fe563f71ef7db95d6cbc07eb60a86b839d99d637a9ba927701d19a7c174eb93498449660d153859cb6a37f5a247852210bf9af254770759d37029cc3ab0aedb3b28460c34083c61f177ef87a18bf7534e86ccc05895f1b03083e5b49c066a5b909b6c742d3a82da679b7dbdbafca5611469816c606e6b1bee89af6f999799b419f2c384b2e6632d2270fca27369eb3296f067e5ff6130aabaa88317d5022d366330d089f4891c9e58065dcd631a0ec695ff862f7e6d45e541327a0040765df1946a89a93e23f7296e0539cee2adf4a0a45d643cb1626a9a9ef235e67f0c649d3ffa69ae9eea326b62c287a1fc22bdf224984ec79a882157ae1b4fbe8fe74d2e31c04ec494bfa9080709cef7e9bb3d8b1b6dcb520970cd1e6232520fe965d919114ef9aa4cf2b874bea61c2af0044b6fe32b62e8527ec5b93dfb8dbaf22ec66bd6a6d75837a5c4a6b8dbe30f3a68f6e8c53e48d7718d4c96988c719cc81d8e6b700c8e4401d039311a45fe7e03f758932aebda2d5a955bad91d32a1c931a928e72c82663a43f0d049d7e4a361dc8b62446619c2acce32fe959a94e75884c1c14632a0e3edb8b9c1c46e875a7c4bdc100f7204b9b1704ad37b32ad32d5294de1c4e96f061026cf1d0244cd578bd1d18971b7d5766784b110968196021e0b29d5b2123316fb9bfeff874b9d3188bc5ffa7706e9c6e15b1fe2c81769f30b0db90d93044bd60f94e9fff14ddfd68fe9f0ea5673d5fd13e4b3a672c124467dca67768f9915cc8af4df7fff6735929e8d5b454d59afa92f48412bd1068b46201e15ca95375712d9d37a52f5f9c2941774ea31545c35a6f3d8a51223079856c96c2e365cd283566cf4d222262590a27a74fd5c8440e7008dfabf8a94e33edbff2ee8ba1177351e74392ee2718c8c8cd64183da24e0cbb7bdbab98e075c74b85e7cba3f24d8c6dd132084521604931f0017fa06b9a2fea66d4cc3ccca02c9c11ad2e19529c639579d599de14d331e78e29f8f6f285d00251cf6e87df59d3bb6f0f56d13189df010a4ddc79337a65bcd48acbe4334c890931d1ea69a9a0f8d0a91ab9fc63d840f890f8314f5733df44034bbea225d9b6733ccd3f33e0328ede3edf5c91a310f0e69ef53674a86d65e12714d1471bc55dcd0d2b1ae896f12b59d8354d73f44e3e48987c27f0747f980ab084bed48141a13d0bb5be8e544aae5bb928c57cd5d59387ee2ee693592bff706f27d34effd2997a3fd79c6b8455b468f48c8068e7163db9bcfb9820b6506a5eddc43e5d6ecc795ca366084c2b22a583bbfc2a8313492565f3219f5251bb59d686eddeb469309564df5f7e9fddadd2e5fa0d90ea11772873ec370dfe56129eaa9f0805c1443d7691ef0e314670e8fe4d7aa8bc8768bbac34a690dc72245ea40ad937c67b18922609ceed7cc5d3ddc8da4421a7df475e5ac8e4bc6d06b092159f9467dcbaf48423dc0f95a6690281070c969729dbf1bcca1776a8bf0f582d07079b5bf7f3ac2067575fea0640ddc2cd87c1d9b22d683ef6cc87cc1b135d4fc543e59e35f5e362eaad5d497b5471eb1ec9ba8c149804c5fe01365955bea23148175a59376ae3123564c63a684ebf6b70664d169e3c47902e612a8cce9c61f8aede51ca41d53e8210d0ae400d55301f05cd60be21e7b1e33da6f9da0b38acc84ce6fb09a040c8d6a395a27d72c182ca41c56d49d143819266fc332d81a10137b8fa8d49e3582f20e73152982fb74d8aff5e9d8d94a6d8b78e5ed482fd585f38b1cbb192e55ed57576280f5229bde7eba92af2a4dbb9c8a500f83cd7329d261d0eb9dcc4c1137a7748c09cb1f93aa7dd2e274dc3812e5657199cb1a973ba3d336995368f8e1c60c1be1be7e42f9f692ce97617f22d287d8c2271a43b643abb427ea1128cbde579f247279d7136c4b355206f5e9e9b98cd245a7ba68f98d288512f2214792f3a72ba393acf758d36f0310f87f6b6eada7ad4f9d45afdaf11bb244d977b1e5dba01a55e3b8d4574648d8d5287139f3d35247ccaa94cd53082d4c829b5511e93a2295220485cb76860825a23050fc08575155b5e92c38910cced823bb0ec41"}}}, &(0x7f0000000000)={0x1, 0x3, [0xba8, 0x5db, 0xc4f, 0x690]}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000040)=@newlink={0xa0, 0x10, 0x401, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCB={0x5, 0xb, 0xfb}]}}}, @IFLA_PORT_SELF={0x64, 0x19, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "5d56faaf0d411cd418de22ac0c35d3a5"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0xd2}, @IFLA_PORT_VF={0x8, 0x1, 0x400}, @IFLA_PORT_VF={0x8}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "610fc4263e1257ff9cdb6af17a031543"}, @IFLA_PORT_PROFILE={0xb, 0x2, 'macsec\x00'}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "53f007b61b84456d585dad73d4004134"}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 157.237923ms ago: executing program 3 (id=704): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x14, r1, 0x5, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000000000000000000018500000017000000850000000700000095"], &(0x7f0000000040)='syzkaller\x00', 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, r1, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x7fa0, 0x1f}}}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x2}, @NL80211_ATTR_STA_WME={0x1c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x7f}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x5}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x6}]}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x7ff}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4814}, 0x20000000) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa1c86dd6003000000040000fe8000000000000500000000000000aa00004e2200"/56, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5002000090780000"], 0x0) syz_usb_connect(0x0, 0x5d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a0000052413"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x14, r1, 0x5, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000000000000000000018500000017000000850000000700000095"], &(0x7f0000000040)='syzkaller\x00', 0x4}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, r1, 0x0, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x7fa0, 0x1f}}}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x2}, @NL80211_ATTR_STA_WME={0x1c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x7f}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x5}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x6}]}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x7ff}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4814}, 0x20000000) (async) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa1c86dd6003000000040000fe8000000000000500000000000000aa00004e2200"/56, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5002000090780000"], 0x0) (async) syz_usb_connect(0x0, 0x5d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a0000052413"], 0x0) (async) 577.097µs ago: executing program 1 (id=705): socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f00000004c0)={{0x80}, 'port0\x00', 0x8, 0x100075, 0xffefffff, 0x4, 0x1ff, 0x0, 0x0, 0x0, 0x6}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r3}, 0x10) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000280)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local, {[@rr={0x7, 0x3, 0x7a}]}}, {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x800}}}}}}, 0x0) r5 = fanotify_init(0x8, 0x80000) fanotify_mark(r5, 0x105, 0x4800003a, r4, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) fcntl$setown(r1, 0x8, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40000, 0x100) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x8, 0x3, 0x5, 0x8, 0x3, 0x1, {0x1, 0x17f, 0x20ff, 0x5, 0x89, 0xd615, 0xb, 0x7fffffff, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x13}}}, 0xa0) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) connect$can_bcm(r6, &(0x7f00000000c0)={0x1d, r7}, 0x10) sendmsg$can_bcm(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x1, 0x840, 0x0, {}, {0x77359400}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "ef1d62ee7e923b0ad9cda5b28dd4753620a2f0271768a8284c18a4e2b5e44dc77098b18fd964df81213608ec503db52d42f1a78c97322f4ae4c8dc89cf2b1440"}}, 0x80}}, 0x0) sendmsg$can_bcm(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x1, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "ce2a4fa77baa108b"}}, 0x48}}, 0x0) sendmsg$can_bcm(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000000180)={0x1, 0x808, 0x0, {0x77359400}, {0x0, 0xea60}, {}, 0x1, @canfd={{}, 0x0, 0x1, 0x0, 0x0, "a9d350ea09a558bbc069972fd6135503414190c502f593570fa6bb0fa85d9b3128353dcadf8bb71c06e619b08986d626a032ff1c224c9e1aa390b57d5bcf9ff7"}}, 0x80}}, 0x0) 214.363µs ago: executing program 0 (id=706): r0 = signalfd(0xffffffffffffffff, &(0x7f0000000140)={[0x157]}, 0x8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) ftruncate(r1, 0xc17a) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x6f, &(0x7f0000000980)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x61, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, {0x0, 0x4e20, 0x4d, 0x0, @opaque="49061741a8a88a9c64c5207e6c0af06215b7fb1a74c61d607d43211301300d7c274f461e9993b48c91bcdf1aecc1f39ebad04a191154d2a893447067ee92e2c86ecfd35472"}}}}}, 0x0) recvmmsg(r2, &(0x7f00000039c0)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001940)=""/4096, 0x1000}, {0x0}], 0x2}, 0x7061ab3a}], 0x1, 0x120, 0x0) r3 = syz_io_uring_setup(0x6937, &(0x7f0000000300)={0x0, 0x125a, 0x10100, 0xfffffffe, 0x100000, 0x0, r0}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x3, 0x0, @fd=r3, 0x0, 0x0, 0x3, 0xa, 0x0, {0x0, r6, r3}}) io_uring_enter(r3, 0x44fd, 0x3, 0x1, 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) io_uring_register$IORING_REGISTER_NAPI(r3, 0x1b, &(0x7f0000000080)={0x1, 0x9}, 0x1) r8 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r8, 0x0) accept4(r8, 0x0, 0x0, 0x0) 0s ago: executing program 2 (id=707): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001380)={&(0x7f0000001440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x4c, 0x4c, 0x6, [@datasec={0x2, 0x2, 0x0, 0xf, 0x3, [{0x1000000, 0x1, 0x803}, {}], "44942d"}, @ptr, @datasec={0x0, 0x1, 0x0, 0xf, 0x1, [{}], "84"}]}, {0x0, [0x0, 0x2e, 0x5f, 0x2e]}}, 0x0, 0x6a, 0x0, 0x1}, 0x28) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='romfs\x00', 0x208402, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000200), 0x100) r2 = timerfd_create(0x0, 0x800) r3 = syz_io_uring_setup(0xd3, &(0x7f0000000480)={0x0, 0x6776, 0x8, 0x22, 0x335}, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0x103, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000240)=[{0x0}], 0x1}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffff}, 0x94) io_uring_enter(r3, 0x47ba, 0x0, 0x0, 0x0, 0x0) timerfd_settime(r2, 0x3, &(0x7f000000b000)={{}, {0x0, 0x989680}}, 0x0) clock_settime(0x0, &(0x7f0000000040)={0x77359400}) sendmsg$netlink(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001880)={0x10, 0x2e, 0x1}, 0x10}], 0x1}, 0x0) quotactl$Q_SETINFO(0xffffffff80000600, &(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, r1, &(0x7f0000000100)={0x5, 0x7fff, 0x1, 0x1}) kernel console output (not intermixed with test programs): s, falling back to index=off,nfs_export=off. [ 122.230159][ T6418] 9pnet_fd: Insufficient options for proto=fd [ 122.843375][ T6412] netlink: 60 bytes leftover after parsing attributes in process `syz.2.123'. [ 122.885229][ T6412] netlink: 12 bytes leftover after parsing attributes in process `syz.2.123'. [ 123.190096][ T6422] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 123.201652][ T6422] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 124.482198][ T30] audit: type=1400 audit(1751135275.004:69): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=6439 comm="syz.1.133" daddr=fe80:: [ 124.537896][ T6445] loop2: detected capacity change from 0 to 7 [ 124.581196][ T6445] Dev loop2: unable to read RDB block 7 [ 124.984526][ T6445] loop2: unable to read partition table [ 125.011876][ T6445] loop2: partition table beyond EOD, truncated [ 125.034470][ T6445] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 125.459778][ T6461] netlink: 4 bytes leftover after parsing attributes in process `syz.1.139'. [ 125.469158][ T6461] netlink: 4 bytes leftover after parsing attributes in process `syz.1.139'. [ 125.572065][ T6462] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 125.659625][ T6462] overlayfs: failed to set xattr on upper [ 125.665636][ T6462] overlayfs: ...falling back to redirect_dir=nofollow. [ 125.672627][ T6462] overlayfs: ...falling back to index=off. [ 125.678921][ T6462] overlayfs: ...falling back to uuid=null. [ 126.478915][ T6459] netlink: 60 bytes leftover after parsing attributes in process `syz.3.137'. [ 126.507912][ T6469] (unnamed net_device) (uninitialized): option use_carrier: invalid value (13) [ 126.532241][ T6463] netlink: 20 bytes leftover after parsing attributes in process `syz.3.137'. [ 126.567300][ T6471] netlink: 'syz.4.142': attribute type 1 has an invalid length. [ 126.575596][ T6471] netlink: 228 bytes leftover after parsing attributes in process `syz.4.142'. [ 126.964584][ T24] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 127.894547][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 127.968272][ T24] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 127.977305][ T24] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 127.987620][ T24] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 127.997899][ T24] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 128.008387][ T24] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 128.021936][ T24] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 128.031453][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.894179][ T5889] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 131.099732][ T24] usb 3-1: can't set config #16, error -71 [ 131.120769][ T24] usb 3-1: USB disconnect, device number 2 [ 131.244503][ T5889] usb 2-1: Using ep0 maxpacket: 16 [ 131.252031][ T5889] usb 2-1: config 0 has no interfaces? [ 131.269809][ T5889] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 131.298008][ T5889] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 131.349745][ T5889] usb 2-1: SerialNumber: syz [ 131.370968][ T5889] usb 2-1: config 0 descriptor?? [ 131.690258][ T5889] usb 2-1: USB disconnect, device number 8 [ 132.888103][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.901100][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.909190][ T24] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 133.157063][ T24] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 133.169135][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.195470][ T24] usb 2-1: config 0 descriptor?? [ 133.204085][ T24] cp210x 2-1:0.0: cp210x converter detected [ 134.362212][ T24] usb 2-1: cp210x converter now attached to ttyUSB0 [ 134.508111][ T24] usb 2-1: USB disconnect, device number 9 [ 134.578903][ T24] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 134.829330][ T6534] netlink: 8 bytes leftover after parsing attributes in process `syz.3.160'. [ 134.899119][ T24] cp210x 2-1:0.0: device disconnected [ 136.388419][ T30] audit: type=1326 audit(1751135286.914:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6546 comm="syz.1.164" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7423b8e929 code=0x0 [ 136.439338][ T6555] dummy0 speed is unknown, defaulting to 1000 [ 136.446175][ T6555] dummy0 speed is unknown, defaulting to 1000 [ 136.453461][ T6555] dummy0 speed is unknown, defaulting to 1000 [ 136.482533][ T6555] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 136.545276][ T5875] usb 5-1: new low-speed USB device number 7 using dummy_hcd [ 136.584793][ T44] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 136.594748][ T6555] dummy0 speed is unknown, defaulting to 1000 [ 136.619877][ T6555] dummy0 speed is unknown, defaulting to 1000 [ 136.632112][ T5889] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 136.745596][ T6555] dummy0 speed is unknown, defaulting to 1000 [ 136.787030][ T44] usb 1-1: config 0 has no interfaces? [ 136.787838][ T6555] dummy0 speed is unknown, defaulting to 1000 [ 136.829763][ T6555] dummy0 speed is unknown, defaulting to 1000 [ 136.865656][ T44] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 136.971230][ T44] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 136.977551][ T5875] usb 5-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 137.066064][ T5875] usb 5-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 137.077292][ T44] usb 1-1: SerialNumber: syz [ 137.077660][ T5875] usb 5-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 16 [ 137.096972][ T5889] usb 4-1: unable to get BOS descriptor or descriptor too short [ 137.098458][ T44] usb 1-1: config 0 descriptor?? [ 137.111731][ T5889] usb 4-1: not running at top speed; connect to a high speed hub [ 137.124470][ T5875] usb 5-1: config 0 interface 0 has no altsetting 0 [ 137.135737][ T5875] usb 5-1: New USB device found, idVendor=28bd, idProduct=1903, bcdDevice= 0.00 [ 137.146013][ T5889] usb 4-1: config 1 interface 0 altsetting 249 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 137.160383][ T5889] usb 4-1: config 1 interface 0 has no altsetting 0 [ 137.167825][ T5875] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.178829][ T5889] usb 4-1: New USB device found, idVendor=05ac, idProduct=0236, bcdDevice= 0.40 [ 137.188214][ T5889] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.197529][ T5889] usb 4-1: Product: syz [ 137.202481][ T5889] usb 4-1: Manufacturer: syz [ 137.208452][ T5875] usb 5-1: config 0 descriptor?? [ 137.214542][ T5889] usb 4-1: SerialNumber: syz [ 137.219589][ T6551] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 137.333022][ T44] usb 1-1: USB disconnect, device number 8 [ 137.567396][ T6553] pim6reg0: tun_chr_ioctl cmd 1074025680 [ 137.574254][ T6553] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 137.657424][ T6553] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 137.666565][ T6553] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 137.842099][ T6551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 137.863677][ T6013] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 137.963848][ T6551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.117123][ T6013] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 138.152625][ T30] audit: type=1326 audit(1751135288.634:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6550 comm="syz.4.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 138.214591][ T6551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.252398][ T6013] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.303031][ T6551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.393710][ T6013] usb 2-1: config 0 descriptor?? [ 138.420436][ T30] audit: type=1326 audit(1751135288.654:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6550 comm="syz.4.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 138.477320][ T6551] ======================================================= [ 138.477320][ T6551] WARNING: The mand mount option has been deprecated and [ 138.477320][ T6551] and is ignored by this kernel. Remove the mand [ 138.477320][ T6551] option from the mount to silence this warning. [ 138.477320][ T6551] ======================================================= [ 138.785556][ T30] audit: type=1326 audit(1751135288.664:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6550 comm="syz.4.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f682ef8d3df code=0x7ffc0000 [ 139.079026][ T6551] MTD: Couldn't look up './file1': -15 [ 139.145957][ T30] audit: type=1326 audit(1751135288.664:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6550 comm="syz.4.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 139.377628][ T30] audit: type=1326 audit(1751135288.674:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6550 comm="syz.4.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 139.399259][ T30] audit: type=1326 audit(1751135288.674:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6550 comm="syz.4.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f682ef8d290 code=0x7ffc0000 [ 139.421469][ T30] audit: type=1326 audit(1751135288.714:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6550 comm="syz.4.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f682ef8e52b code=0x7ffc0000 [ 139.444644][ T30] audit: type=1326 audit(1751135288.714:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6550 comm="syz.4.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f682ef8e52b code=0x7ffc0000 [ 139.466383][ T30] audit: type=1326 audit(1751135288.914:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6550 comm="syz.4.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 139.543760][ T6551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.745338][ T6551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 140.487555][ T6584] netlink: 8 bytes leftover after parsing attributes in process `syz.1.169'. [ 141.021418][ T5889] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input7 [ 141.071917][ T6587] netlink: 8 bytes leftover after parsing attributes in process `syz.0.172'. [ 141.132650][ T5875] usbhid 5-1:0.0: can't add hid device: -71 [ 141.154521][ T5875] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 141.177049][ T5178] bcm5974 4-1:1.0: could not read from device [ 141.225777][ T5875] usb 5-1: USB disconnect, device number 7 [ 141.278081][ T5889] usb 4-1: USB disconnect, device number 4 [ 141.296076][ T5178] bcm5974 4-1:1.0: could not read from device [ 142.176836][ T6013] usb 2-1: Cannot set autoneg [ 142.181916][ T6013] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 142.196043][ T6013] usb 2-1: USB disconnect, device number 10 [ 142.421516][ T6602] process 'syz.3.177' launched './file0' with NULL argv: empty string added [ 143.546165][ T6623] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 144.009750][ T6629] netlink: 8 bytes leftover after parsing attributes in process `syz.4.186'. [ 145.342185][ T6649] ptrace attach of "./syz-executor exec"[5823] was attempted by "./syz-executor exec"[6649] [ 148.331401][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 148.331421][ T30] audit: type=1400 audit(1751135298.554:102): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=6670 comm="syz.4.197" daddr=fe80::aa dest=3 [ 148.746953][ T6675] sctp: failed to load transform for md5: -2 [ 148.787239][ T6683] sctp: failed to load transform for md5: -2 [ 151.024470][ T24] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 151.194468][ T24] usb 5-1: device descriptor read/64, error -71 [ 151.516758][ T24] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 151.927023][ T24] usb 5-1: device descriptor read/64, error -71 [ 152.330463][ T24] usb usb5-port1: attempt power cycle [ 152.364597][ T5875] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 152.437913][ T6725] input: syz0 as /devices/virtual/input/input8 [ 152.543506][ T5875] usb 3-1: config 0 has no interfaces? [ 152.550560][ T5875] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 152.590808][ T5875] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 152.621199][ T5875] usb 3-1: SerialNumber: syz [ 152.646779][ T5875] usb 3-1: config 0 descriptor?? [ 152.702680][ T24] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 153.111994][ T5875] usb 3-1: USB disconnect, device number 3 [ 153.145670][ T24] usb 5-1: device descriptor read/8, error -71 [ 153.840548][ T978] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 154.504471][ T978] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 154.521427][ T978] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.567157][ T978] usb 2-1: config 0 descriptor?? [ 154.713665][ T6752] netlink: 12 bytes leftover after parsing attributes in process `syz.3.221'. [ 154.844112][ T978] cp210x 2-1:0.0: cp210x converter detected [ 155.009818][ T6756] dummy0 speed is unknown, defaulting to 1000 [ 155.069538][ T978] cp210x 2-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 155.092658][ T978] cp210x 2-1:0.0: querying part number failed [ 155.819218][ T978] usb 2-1: cp210x converter now attached to ttyUSB0 [ 155.831223][ T978] usb 2-1: USB disconnect, device number 11 [ 155.855172][ T978] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 155.863591][ T978] cp210x 2-1:0.0: device disconnected [ 156.244568][ T6772] 9pnet_fd: Insufficient options for proto=fd [ 157.740973][ T6783] netlink: 4 bytes leftover after parsing attributes in process `syz.1.229'. [ 157.750357][ T6783] netlink: 4 bytes leftover after parsing attributes in process `syz.1.229'. [ 158.833611][ T6794] syz.3.231: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 158.849064][ T6794] CPU: 0 UID: 0 PID: 6794 Comm: syz.3.231 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 158.849091][ T6794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 158.849104][ T6794] Call Trace: [ 158.849113][ T6794] [ 158.849131][ T6794] dump_stack_lvl+0x189/0x250 [ 158.849173][ T6794] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 158.849203][ T6794] ? __pfx_dump_stack_lvl+0x10/0x10 [ 158.849229][ T6794] ? __pfx__printk+0x10/0x10 [ 158.849248][ T6794] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 158.849275][ T6794] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 158.849309][ T6794] warn_alloc+0x214/0x310 [ 158.849332][ T6794] ? stack_depot_save_flags+0x429/0x900 [ 158.849362][ T6794] ? __pfx_warn_alloc+0x10/0x10 [ 158.849387][ T6794] ? kasan_save_track+0x4f/0x80 [ 158.849408][ T6794] ? xskq_create+0x56/0x170 [ 158.849429][ T6794] ? xsk_init_queue+0xb0/0x110 [ 158.849448][ T6794] ? xsk_setsockopt+0x43f/0x710 [ 158.849468][ T6794] ? do_sock_setsockopt+0x257/0x3e0 [ 158.849486][ T6794] ? __x64_sys_setsockopt+0x18b/0x220 [ 158.849504][ T6794] ? do_syscall_64+0xfa/0x3b0 [ 158.849526][ T6794] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.849552][ T6794] __vmalloc_node_range_noprof+0x125/0x12f0 [ 158.849598][ T6794] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 158.849634][ T6794] ? __kasan_kmalloc+0x93/0xb0 [ 158.849665][ T6794] vmalloc_user_noprof+0xad/0xf0 [ 158.849688][ T6794] ? xskq_create+0xbf/0x170 [ 158.849712][ T6794] xskq_create+0xbf/0x170 [ 158.849738][ T6794] xsk_init_queue+0xb0/0x110 [ 158.849764][ T6794] xsk_setsockopt+0x43f/0x710 [ 158.849789][ T6794] ? __pfx_xsk_setsockopt+0x10/0x10 [ 158.849810][ T6794] ? __lock_acquire+0xab9/0xd20 [ 158.849843][ T6794] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 158.849882][ T6794] ? __pfx_xsk_setsockopt+0x10/0x10 [ 158.849905][ T6794] do_sock_setsockopt+0x257/0x3e0 [ 158.849928][ T6794] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 158.849954][ T6794] ? __fget_files+0x2a/0x420 [ 158.849985][ T6794] __x64_sys_setsockopt+0x18b/0x220 [ 158.850012][ T6794] do_syscall_64+0xfa/0x3b0 [ 158.850038][ T6794] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.850054][ T6794] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 158.850072][ T6794] ? clear_bhb_loop+0x60/0xb0 [ 158.850093][ T6794] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.850111][ T6794] RIP: 0033:0x7f807a78e929 [ 158.850129][ T6794] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 158.850143][ T6794] RSP: 002b:00007f807b530038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 158.850163][ T6794] RAX: ffffffffffffffda RBX: 00007f807a9b6240 RCX: 00007f807a78e929 [ 158.850176][ T6794] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000d [ 158.850187][ T6794] RBP: 00007f807a810b39 R08: 0000000000000052 R09: 0000000000000000 [ 158.850199][ T6794] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 158.850212][ T6794] R13: 0000000000000000 R14: 00007f807a9b6240 R15: 00007ffe75141c88 [ 158.850242][ T6794] [ 158.850305][ T6794] Mem-Info: [ 159.074509][ T24] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 159.081703][ T6794] active_anon:2094 inactive_anon:8469 isolated_anon:0 [ 159.081703][ T6794] active_file:5694 inactive_file:45327 isolated_file:0 [ 159.081703][ T6794] unevictable:768 dirty:199 writeback:0 [ 159.081703][ T6794] slab_reclaimable:10089 slab_unreclaimable:98244 [ 159.081703][ T6794] mapped:34253 shmem:6062 pagetables:1229 [ 159.081703][ T6794] sec_pagetables:0 bounce:0 [ 159.081703][ T6794] kernel_misc_reclaimable:0 [ 159.081703][ T6794] free:1318769 free_pcp:13286 free_cma:0 [ 159.114736][ T30] audit: type=1400 audit(1751135309.354:103): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=6785 comm="syz.3.231" daddr=::ffff:172.20.20.57 dest=20001 [ 159.119437][ T6794] Node 0 active_anon:8376kB inactive_anon:33876kB active_file:22576kB inactive_file:181308kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:137012kB dirty:792kB writeback:0kB shmem:22712kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12340kB pagetables:4772kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 159.241215][ T30] audit: type=1400 audit(1751135309.634:104): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=6785 comm="syz.3.231" daddr=3::1 dest=20128 [ 159.264467][ T6794] Node 1 active_anon:0kB inactive_anon:0kB active_file:200kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 159.264520][ T6794] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 159.264569][ T6794] lowmem_reserve[]: 0 2501 2503 2503 2503 [ 159.264611][ T6794] Node 0 DMA32 free:1361480kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:6372kB inactive_anon:33832kB active_file:20804kB inactive_file:181240kB unevictable:1536kB writepending:724kB present:3129332kB managed:2561448kB mlocked:0kB bounce:0kB free_pcp:34712kB local_pcp:12352kB free_cma:0kB [ 159.264671][ T6794] lowmem_reserve[]: 0 0 1 1 1 [ 159.387703][ T6794] Node 0 Normal free:8kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:44kB active_file:1772kB inactive_file:68kB unevictable:0kB writepending:0kB present:1048580kB managed:1904kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 159.417292][ T6794] lowmem_reserve[]: 0 0 0 0 0 [ 159.422051][ T6794] Node 1 Normal free:3898228kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:200kB inactive_file:0kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:20304kB local_pcp:11808kB free_cma:0kB [ 159.454933][ T6794] lowmem_reserve[]: 0 0 0 0 0 [ 159.459705][ T6794] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 159.473377][ T6794] Node 0 DMA32: 592*4kB (UM) 699*8kB (UME) 460*16kB (U) 5*32kB (UE) 252*64kB (UM) 31*128kB (ME) 17*256kB (ME) 17*512kB (UM) 8*1024kB (ME) 7*2048kB (UME) 315*4096kB (M) = 1361400kB [ 159.492049][ T6794] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 159.504146][ T6794] Node 1 Normal: 187*4kB (UME) 45*8kB (UME) 36*16kB (UE) 101*32kB (UE) 35*64kB (UME) 9*128kB (UE) 3*256kB (UM) 2*512kB (UM) 3*1024kB (UME) 1*2048kB (E) 948*4096kB (M) = 3898228kB [ 159.522167][ T6794] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 159.531827][ T6794] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 159.541184][ T6794] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 159.550879][ T6794] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 159.560279][ T6794] 56659 total pagecache pages [ 159.565011][ T6794] 0 pages in swap cache [ 159.569263][ T6794] Free swap = 124996kB [ 159.573437][ T6794] Total swap = 124996kB [ 159.577656][ T6794] 2097051 pages RAM [ 159.581478][ T6794] 0 pages HighMem/MovableOnly [ 159.586213][ T6794] 424582 pages reserved [ 159.590383][ T6794] 0 pages cma reserved [ 159.730469][ T24] usb 5-1: config 0 has no interfaces? [ 159.756627][ T24] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 159.767936][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 159.797170][ T24] usb 5-1: SerialNumber: syz [ 159.918408][ T6800] ip6erspan1: entered allmulticast mode [ 160.521880][ T24] usb 5-1: config 0 descriptor?? [ 160.543193][ T6801] capability: warning: `syz.1.233' uses deprecated v2 capabilities in a way that may be insecure [ 161.022152][ T978] usb 5-1: USB disconnect, device number 12 [ 161.394980][ T5889] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 161.719534][ T6821] FAULT_INJECTION: forcing a failure. [ 161.719534][ T6821] name failslab, interval 1, probability 0, space 0, times 0 [ 161.732327][ T6821] CPU: 1 UID: 0 PID: 6821 Comm: syz.1.241 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 161.732351][ T6821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 161.732362][ T6821] Call Trace: [ 161.732369][ T6821] [ 161.732377][ T6821] dump_stack_lvl+0x189/0x250 [ 161.732406][ T6821] ? __pfx____ratelimit+0x10/0x10 [ 161.732430][ T6821] ? __pfx_dump_stack_lvl+0x10/0x10 [ 161.732453][ T6821] ? __pfx__printk+0x10/0x10 [ 161.732476][ T6821] ? ref_tracker_alloc+0x318/0x460 [ 161.732500][ T6821] should_fail_ex+0x414/0x560 [ 161.732525][ T6821] should_failslab+0xa8/0x100 [ 161.732549][ T6821] kmem_cache_alloc_noprof+0x73/0x3c0 [ 161.732569][ T6821] ? skb_clone+0x212/0x3a0 [ 161.732594][ T6821] skb_clone+0x212/0x3a0 [ 161.732617][ T6821] __netlink_deliver_tap+0x404/0x850 [ 161.732649][ T6821] ? netlink_deliver_tap+0x2e/0x1b0 [ 161.732669][ T6821] netlink_deliver_tap+0x19c/0x1b0 [ 161.732688][ T6821] netlink_unicast+0x72f/0x8d0 [ 161.732725][ T6821] netlink_sendmsg+0x805/0xb30 [ 161.732752][ T6821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 161.732779][ T6821] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 161.732798][ T6821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 161.732818][ T6821] __sock_sendmsg+0x21c/0x270 [ 161.732844][ T6821] ____sys_sendmsg+0x52d/0x830 [ 161.732870][ T6821] ? __pfx_____sys_sendmsg+0x10/0x10 [ 161.732899][ T6821] ? import_iovec+0x74/0xa0 [ 161.732927][ T6821] ___sys_sendmsg+0x21f/0x2a0 [ 161.732949][ T6821] ? __pfx____sys_sendmsg+0x10/0x10 [ 161.732975][ T6821] ? rcu_read_unlock_special+0x3fe/0x4c0 [ 161.733023][ T6821] ? __fget_files+0x2a/0x420 [ 161.733043][ T6821] ? __fget_files+0x3a0/0x420 [ 161.733201][ T6821] __sys_sendmmsg+0x227/0x430 [ 161.733231][ T6821] ? __pfx___sys_sendmmsg+0x10/0x10 [ 161.733296][ T6821] __x64_sys_sendmmsg+0xa0/0xc0 [ 161.733318][ T6821] do_syscall_64+0xfa/0x3b0 [ 161.733341][ T6821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.733358][ T6821] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 161.733374][ T6821] ? clear_bhb_loop+0x60/0xb0 [ 161.733396][ T6821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.733413][ T6821] RIP: 0033:0x7f7423b8e929 [ 161.733431][ T6821] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 161.733445][ T6821] RSP: 002b:00007f74219f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 161.733464][ T6821] RAX: ffffffffffffffda RBX: 00007f7423db6160 RCX: 00007f7423b8e929 [ 161.733477][ T6821] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000007 [ 161.733488][ T6821] RBP: 00007f74219f6090 R08: 0000000000000000 R09: 0000000000000000 [ 161.733499][ T6821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 161.733509][ T6821] R13: 0000000000000000 R14: 00007f7423db6160 R15: 00007ffe35c66058 [ 161.733539][ T6821] [ 161.733749][ T6821] netlink: 4 bytes leftover after parsing attributes in process `syz.1.241'. [ 162.007438][ T5889] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 162.030130][ T6821] 8021q: adding VLAN 0 to HW filter on device team1 [ 162.230730][ T5889] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.395752][ T5889] usb 3-1: config 0 descriptor?? [ 162.416115][ T5889] cp210x 3-1:0.0: cp210x converter detected [ 162.622252][ T5889] cp210x 3-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 162.646895][ T5889] cp210x 3-1:0.0: querying part number failed [ 162.667259][ T5889] usb 3-1: cp210x converter now attached to ttyUSB0 [ 162.701661][ T5889] usb 3-1: USB disconnect, device number 4 [ 162.731364][ T5889] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 162.748330][ T5889] cp210x 3-1:0.0: device disconnected [ 163.398989][ T978] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 163.614509][ T978] usb 4-1: Using ep0 maxpacket: 8 [ 163.677763][ T978] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 163.847977][ T978] usb 4-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 163.957465][ T978] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.219079][ T978] usb 4-1: config 0 descriptor?? [ 164.498024][ T6837] binder_alloc: binder_alloc_mmap_handler: 6834 200000ffe000-200001000000 already mapped failed -16 [ 164.549796][ T6842] netlink: 16 bytes leftover after parsing attributes in process `syz.0.248'. [ 165.747173][ T6854] FAULT_INJECTION: forcing a failure. [ 165.747173][ T6854] name failslab, interval 1, probability 0, space 0, times 0 [ 165.764026][ T6854] CPU: 0 UID: 0 PID: 6854 Comm: syz.2.250 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 165.764063][ T6854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 165.764074][ T6854] Call Trace: [ 165.764082][ T6854] [ 165.764090][ T6854] dump_stack_lvl+0x189/0x250 [ 165.764119][ T6854] ? __pfx____ratelimit+0x10/0x10 [ 165.764145][ T6854] ? __pfx_dump_stack_lvl+0x10/0x10 [ 165.764168][ T6854] ? __pfx__printk+0x10/0x10 [ 165.764188][ T6854] ? __lock_acquire+0xab9/0xd20 [ 165.764218][ T6854] should_fail_ex+0x414/0x560 [ 165.764243][ T6854] should_failslab+0xa8/0x100 [ 165.764266][ T6854] kmem_cache_alloc_noprof+0x73/0x3c0 [ 165.764285][ T6854] ? dst_alloc+0x105/0x170 [ 165.764310][ T6854] dst_alloc+0x105/0x170 [ 165.764334][ T6854] ip_route_output_key_hash_rcu+0x1482/0x23a0 [ 165.764364][ T6854] ? ip_route_output_key_hash+0xde/0x2e0 [ 165.764386][ T6854] ip_route_output_key_hash+0x1b9/0x2e0 [ 165.764405][ T6854] ? __lock_acquire+0xab9/0xd20 [ 165.764424][ T6854] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 165.764461][ T6854] ip_route_output_flow+0x2a/0x150 [ 165.764479][ T6854] ? security_sk_classify_flow+0x70/0x180 [ 165.764501][ T6854] ping_v4_sendmsg+0xfd7/0x1740 [ 165.764524][ T6854] ? __lock_acquire+0xab9/0xd20 [ 165.764557][ T6854] ? __pfx_ping_v4_sendmsg+0x10/0x10 [ 165.764605][ T6854] ? __local_bh_enable_ip+0x12d/0x1c0 [ 165.764626][ T6854] ? lockdep_hardirqs_on+0x9c/0x150 [ 165.764648][ T6854] ? __local_bh_enable_ip+0x12d/0x1c0 [ 165.764678][ T6854] ? inet_sendmsg+0x14f/0x370 [ 165.764701][ T6854] ? inet_sendmsg+0x2f4/0x370 [ 165.764727][ T6854] __sock_sendmsg+0x19c/0x270 [ 165.764753][ T6854] ____sys_sendmsg+0x505/0x830 [ 165.764778][ T6854] ? __pfx_____sys_sendmsg+0x10/0x10 [ 165.764807][ T6854] ? import_iovec+0x74/0xa0 [ 165.764833][ T6854] ___sys_sendmsg+0x21f/0x2a0 [ 165.764855][ T6854] ? __pfx____sys_sendmsg+0x10/0x10 [ 165.764911][ T6854] ? __fget_files+0x2a/0x420 [ 165.764930][ T6854] ? __fget_files+0x3a0/0x420 [ 165.764981][ T6854] __x64_sys_sendmsg+0x19b/0x260 [ 165.765003][ T6854] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 165.765032][ T6854] ? __pfx_ksys_write+0x10/0x10 [ 165.765049][ T6854] ? rcu_is_watching+0x15/0xb0 [ 165.765077][ T6854] ? do_syscall_64+0xbe/0x3b0 [ 165.765103][ T6854] do_syscall_64+0xfa/0x3b0 [ 165.765124][ T6854] ? lockdep_hardirqs_on+0x9c/0x150 [ 165.765144][ T6854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.765160][ T6854] ? clear_bhb_loop+0x60/0xb0 [ 165.765179][ T6854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.765195][ T6854] RIP: 0033:0x7fb98898e929 [ 165.765211][ T6854] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 165.765224][ T6854] RSP: 002b:00007fb98981f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 165.765242][ T6854] RAX: ffffffffffffffda RBX: 00007fb988bb5fa0 RCX: 00007fb98898e929 [ 165.765254][ T6854] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 165.765263][ T6854] RBP: 00007fb98981f090 R08: 0000000000000000 R09: 0000000000000000 [ 165.765273][ T6854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 165.765283][ T6854] R13: 0000000000000000 R14: 00007fb988bb5fa0 R15: 00007fff39880028 [ 165.765311][ T6854] [ 166.084791][ C0] vkms_vblank_simulate: vblank timer overrun [ 166.559809][ T6863] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(10) [ 166.567722][ T6863] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 166.570011][ T6863] vhci_hcd vhci_hcd.0: Device attached [ 167.459563][ T978] usbhid 4-1:0.0: can't add hid device: -71 [ 167.466477][ T978] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 167.491468][ T978] usb 4-1: USB disconnect, device number 5 [ 167.500786][ T6862] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(12) [ 167.507440][ T6862] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 167.515402][ T6013] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 167.543347][ T6863] vhci_hcd vhci_hcd.0: pdev(0) rhport(2) sockfd(16) [ 167.550008][ T6863] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 167.570771][ T6875] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 167.592679][ T6863] vhci_hcd vhci_hcd.0: Device attached [ 167.600179][ T6878] netlink: 8 bytes leftover after parsing attributes in process `syz.2.257'. [ 167.612887][ T6862] vhci_hcd vhci_hcd.0: Device attached [ 167.620629][ T6878] netlink: 8 bytes leftover after parsing attributes in process `syz.2.257'. [ 167.624995][ T5889] usb 33-1: new low-speed USB device number 2 using vhci_hcd [ 167.658513][ T6863] vhci_hcd vhci_hcd.0: pdev(0) rhport(4) sockfd(15) [ 167.665171][ T6863] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 167.673467][ T6863] vhci_hcd vhci_hcd.0: Device attached [ 167.702869][ T6862] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(21) [ 167.709528][ T6862] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 167.732309][ T6013] usb 5-1: config 0 has no interfaces? [ 167.735723][ T6862] vhci_hcd vhci_hcd.0: Device attached [ 167.749756][ T6013] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 167.759872][ T6863] vhci_hcd vhci_hcd.0: pdev(0) rhport(5) sockfd(24) [ 167.759895][ T6863] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 167.759965][ T6863] vhci_hcd vhci_hcd.0: Device attached [ 167.763789][ T6013] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 167.763823][ T6013] usb 5-1: SerialNumber: syz [ 167.783302][ T6013] usb 5-1: config 0 descriptor?? [ 167.787986][ T6881] vhci_hcd: connection closed [ 167.789409][ T6865] vhci_hcd: connection reset by peer [ 167.789600][ T6872] vhci_hcd: connection closed [ 167.790896][ T6870] vhci_hcd: connection closed [ 167.803734][ T3514] vhci_hcd: stop threads [ 167.804687][ T3514] vhci_hcd: release socket [ 167.805565][ T3514] vhci_hcd: disconnect device [ 167.831965][ T3514] vhci_hcd: stop threads [ 167.831986][ T3514] vhci_hcd: release socket [ 167.832035][ T3514] vhci_hcd: disconnect device [ 167.832133][ T3514] vhci_hcd: stop threads [ 167.832141][ T3514] vhci_hcd: release socket [ 167.832173][ T3514] vhci_hcd: disconnect device [ 167.832776][ T3514] vhci_hcd: stop threads [ 167.832787][ T3514] vhci_hcd: release socket [ 167.833428][ T3514] vhci_hcd: disconnect device [ 167.877433][ T6886] vhci_hcd: connection closed [ 167.879412][ T3514] vhci_hcd: stop threads [ 167.879435][ T3514] vhci_hcd: release socket [ 167.879529][ T3514] vhci_hcd: disconnect device [ 167.887874][ T6883] vhci_hcd: connection closed [ 167.897572][ T120] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 167.902457][ T3514] vhci_hcd: stop threads [ 167.922969][ T6887] netlink: 92 bytes leftover after parsing attributes in process `syz.2.258'. [ 167.927353][ T3514] vhci_hcd: release socket [ 167.927498][ T3514] vhci_hcd: disconnect device [ 168.040302][ T6887] openvswitch: netlink: Flow key attr not present in new flow. [ 168.053547][ T10] usb 5-1: USB disconnect, device number 13 [ 168.131310][ T120] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 168.143276][ T6892] FAULT_INJECTION: forcing a failure. [ 168.143276][ T6892] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 168.156588][ T120] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.167517][ T120] usb 2-1: config 0 descriptor?? [ 168.173310][ T6892] CPU: 1 UID: 0 PID: 6892 Comm: syz.2.259 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 168.173335][ T6892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 168.173345][ T6892] Call Trace: [ 168.173353][ T6892] [ 168.173360][ T6892] dump_stack_lvl+0x189/0x250 [ 168.173389][ T6892] ? __pfx____ratelimit+0x10/0x10 [ 168.173412][ T6892] ? __pfx_dump_stack_lvl+0x10/0x10 [ 168.173438][ T6892] ? __pfx__printk+0x10/0x10 [ 168.173455][ T6892] ? __might_fault+0xb0/0x130 [ 168.173486][ T6892] should_fail_ex+0x414/0x560 [ 168.173510][ T6892] _copy_from_user+0x2d/0xb0 [ 168.173534][ T6892] ____sys_sendmsg+0x2fe/0x830 [ 168.173559][ T6892] ? __pfx_____sys_sendmsg+0x10/0x10 [ 168.173587][ T6892] ? import_iovec+0x74/0xa0 [ 168.173615][ T6892] ___sys_sendmsg+0x21f/0x2a0 [ 168.173635][ T6892] ? __pfx____sys_sendmsg+0x10/0x10 [ 168.173685][ T6892] ? __fget_files+0x2a/0x420 [ 168.173703][ T6892] ? __fget_files+0x3a0/0x420 [ 168.173730][ T6892] __x64_sys_sendmsg+0x19b/0x260 [ 168.173749][ T6892] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 168.173785][ T6892] ? __pfx_ksys_write+0x10/0x10 [ 168.173808][ T6892] ? do_syscall_64+0xbe/0x3b0 [ 168.173833][ T6892] do_syscall_64+0xfa/0x3b0 [ 168.173854][ T6892] ? lockdep_hardirqs_on+0x9c/0x150 [ 168.173876][ T6892] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.173892][ T6892] ? clear_bhb_loop+0x60/0xb0 [ 168.173911][ T6892] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.173926][ T6892] RIP: 0033:0x7fb98898e929 [ 168.173941][ T6892] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 168.173953][ T6892] RSP: 002b:00007fb98981f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 168.173971][ T6892] RAX: ffffffffffffffda RBX: 00007fb988bb5fa0 RCX: 00007fb98898e929 [ 168.173984][ T6892] RDX: 0000000000000041 RSI: 0000200000000600 RDI: 0000000000000003 [ 168.173994][ T6892] RBP: 00007fb98981f090 R08: 0000000000000000 R09: 0000000000000000 [ 168.174005][ T6892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 168.174015][ T6892] R13: 0000000000000000 R14: 00007fb988bb5fa0 R15: 00007fff39880028 [ 168.174042][ T6892] [ 168.440273][ T120] cp210x 2-1:0.0: cp210x converter detected [ 168.455606][ T120] cp210x 2-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 168.469102][ T120] cp210x 2-1:0.0: querying part number failed [ 168.478815][ T120] usb 2-1: cp210x converter now attached to ttyUSB0 [ 168.490436][ T120] usb 2-1: USB disconnect, device number 12 [ 168.519857][ T120] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 168.540593][ T120] cp210x 2-1:0.0: device disconnected [ 168.677944][ T6894] syzkaller0: entered allmulticast mode [ 169.235245][ T6922] trusted_key: encrypted_key: insufficient parameters specified [ 169.546465][ T5875] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 169.576281][ T6934] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(11) [ 169.582959][ T6934] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 169.608650][ T6934] vhci_hcd vhci_hcd.0: Device attached [ 169.625940][ T6939] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(14) [ 169.632602][ T6939] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 169.662954][ T6939] vhci_hcd vhci_hcd.0: Device attached [ 169.672329][ T6934] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(13) [ 169.678960][ T6934] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 169.721402][ T6939] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 169.744463][ T5875] usb 2-1: Using ep0 maxpacket: 32 [ 169.804340][ T5875] usb 2-1: too many configurations: 122, using maximum allowed: 8 [ 169.818415][ T6934] vhci_hcd vhci_hcd.0: Device attached [ 169.827907][ T5875] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 39 [ 169.849007][ T5875] usb 2-1: can't read configurations, error -22 [ 169.866936][ T6947] vhci_hcd vhci_hcd.0: pdev(2) rhport(4) sockfd(20) [ 169.873588][ T6947] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 169.899031][ T6947] vhci_hcd vhci_hcd.0: Device attached [ 169.911591][ T6934] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(17) [ 169.918239][ T6934] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 169.930576][ T6934] vhci_hcd vhci_hcd.0: Device attached [ 170.024915][ T5875] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 170.113498][ T6934] vhci_hcd vhci_hcd.0: pdev(2) rhport(5) sockfd(22) [ 170.120170][ T6934] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 170.224875][ T5875] usb 2-1: Using ep0 maxpacket: 32 [ 170.287285][ T5875] usb 2-1: too many configurations: 122, using maximum allowed: 8 [ 170.443821][ T5875] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 39 [ 170.452764][ T6934] vhci_hcd vhci_hcd.0: Device attached [ 170.473800][ T6954] vhci_hcd: connection closed [ 170.474067][ T2995] vhci_hcd: stop threads [ 170.474171][ T6948] vhci_hcd: connection closed [ 170.483334][ T6935] vhci_hcd: connection closed [ 170.487446][ T2995] vhci_hcd: release socket [ 170.489847][ T6944] vhci_hcd: connection closed [ 170.501254][ T2995] vhci_hcd: disconnect device [ 170.504587][ T6940] vhci_hcd: connection closed [ 170.506470][ T120] usb 37-1: new low-speed USB device number 2 using vhci_hcd [ 170.512216][ T6951] vhci_hcd: connection closed [ 170.518759][ T6937] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 170.535939][ T3484] vhci_hcd: stop threads [ 170.540243][ T3484] vhci_hcd: release socket [ 170.636750][ T5875] usb 2-1: can't read configurations, error -22 [ 170.637794][ T3484] vhci_hcd: disconnect device [ 170.655659][ T3484] vhci_hcd: stop threads [ 170.660796][ T3484] vhci_hcd: release socket [ 170.669350][ T3484] vhci_hcd: disconnect device [ 170.671478][ T5875] usb usb2-port1: attempt power cycle [ 170.694576][ T3484] vhci_hcd: stop threads [ 170.700000][ T3484] vhci_hcd: release socket [ 170.708651][ T3484] vhci_hcd: disconnect device [ 170.734338][ T3484] vhci_hcd: stop threads [ 170.739579][ T3484] vhci_hcd: release socket [ 170.746696][ T3484] vhci_hcd: disconnect device [ 170.784196][ T3484] vhci_hcd: stop threads [ 170.792951][ T3484] vhci_hcd: release socket [ 170.815790][ T3484] vhci_hcd: disconnect device [ 171.030519][ T30] audit: type=1326 audit(1751135321.464:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6956 comm="syz.3.275" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f807a78e929 code=0x0 [ 171.067301][ T5875] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 171.115445][ T5875] usb 2-1: Using ep0 maxpacket: 32 [ 171.178323][ T5875] usb 2-1: too many configurations: 122, using maximum allowed: 8 [ 171.198374][ T5875] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 39 [ 171.230688][ T5875] usb 2-1: can't read configurations, error -22 [ 171.374669][ T5875] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 171.435173][ T5875] usb 2-1: Using ep0 maxpacket: 32 [ 171.447944][ T5875] usb 2-1: too many configurations: 122, using maximum allowed: 8 [ 171.476415][ T5875] usb 2-1: invalid descriptor for config index 0: type = 0x2, length = 39 [ 171.504675][ T5875] usb 2-1: can't read configurations, error -22 [ 171.520753][ T5875] usb usb2-port1: unable to enumerate USB device [ 172.794518][ T5889] vhci_hcd: vhci_device speed not set [ 173.212643][ T6978] openvswitch: netlink: Message has 8 unknown bytes. [ 173.224043][ T6978] netlink: 172 bytes leftover after parsing attributes in process `syz.0.283'. [ 173.243219][ T6978] program syz.0.283 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 173.363413][ T10] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 173.575163][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 173.694082][ T10] usb 4-1: config 0 has no interfaces? [ 173.792649][ T10] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 173.844293][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.872986][ T10] usb 4-1: config 0 descriptor?? [ 174.080930][ T6988] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(11) [ 174.087594][ T6988] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 174.111843][ T6988] vhci_hcd vhci_hcd.0: Device attached [ 174.124082][ T6988] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(13) [ 174.130743][ T6988] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 174.142882][ T6988] vhci_hcd vhci_hcd.0: Device attached [ 174.158652][ T6988] vhci_hcd vhci_hcd.0: pdev(1) rhport(2) sockfd(15) [ 174.165301][ T6988] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 174.174185][ T6988] vhci_hcd vhci_hcd.0: Device attached [ 174.194444][ T6988] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 174.208864][ T6988] vhci_hcd vhci_hcd.0: pdev(1) rhport(4) sockfd(19) [ 174.215523][ T6988] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 174.215691][ T978] usb usb34-port1: attempt power cycle [ 174.225820][ T6988] vhci_hcd vhci_hcd.0: Device attached [ 174.237851][ T6988] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(21) [ 174.244484][ T6988] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 174.252738][ T6988] vhci_hcd vhci_hcd.0: Device attached [ 174.260847][ T6988] vhci_hcd vhci_hcd.0: pdev(1) rhport(5) sockfd(23) [ 174.267489][ T6988] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 174.277217][ T6988] vhci_hcd vhci_hcd.0: Device attached [ 174.291051][ T6997] vhci_hcd: connection closed [ 174.291110][ T6989] vhci_hcd: connection closed [ 174.296929][ T3484] vhci_hcd: stop threads [ 174.297243][ T7003] vhci_hcd: connection closed [ 174.301817][ T6995] vhci_hcd: connection closed [ 174.305962][ T6999] vhci_hcd: connection closed [ 174.306237][ T7001] vhci_hcd: connection closed [ 174.315214][ T3484] vhci_hcd: release socket [ 174.332097][ T3484] vhci_hcd: disconnect device [ 174.340895][ T3484] vhci_hcd: stop threads [ 174.347610][ T3484] vhci_hcd: release socket [ 174.352419][ T3484] vhci_hcd: disconnect device [ 174.357528][ T3484] vhci_hcd: stop threads [ 174.361787][ T3484] vhci_hcd: release socket [ 174.366375][ T5875] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 174.375560][ T3484] vhci_hcd: disconnect device [ 174.380497][ T3484] vhci_hcd: stop threads [ 174.385632][ T3484] vhci_hcd: release socket [ 174.390145][ T3484] vhci_hcd: disconnect device [ 174.396527][ T3484] vhci_hcd: stop threads [ 174.400799][ T3484] vhci_hcd: release socket [ 174.406153][ T3484] vhci_hcd: disconnect device [ 174.411691][ T3484] vhci_hcd: stop threads [ 174.416055][ T3484] vhci_hcd: release socket [ 174.420542][ T3484] vhci_hcd: disconnect device [ 174.465922][ T6013] usb 4-1: USB disconnect, device number 6 [ 174.519314][ T7008] netlink: 104 bytes leftover after parsing attributes in process `syz.3.288'. [ 174.795660][ T978] usb usb34-port1: unable to enumerate USB device [ 175.069719][ T7020] netlink: 28 bytes leftover after parsing attributes in process `syz.1.292'. [ 175.082285][ T7020] netlink: 28 bytes leftover after parsing attributes in process `syz.1.292'. [ 175.115498][ T7020] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 175.152565][ T7020] ip6gretap0: entered promiscuous mode [ 175.422751][ T7026] netlink: 8 bytes leftover after parsing attributes in process `syz.4.293'. [ 175.683996][ T120] vhci_hcd: vhci_device speed not set [ 175.900719][ T7033] can0: slcan on ttyS3. [ 176.308716][ T7035] xt_CT: You must specify a L4 protocol and not use inversions on it [ 176.609432][ T7033] can0 (unregistered): slcan off ttyS3. [ 176.965946][ T7043] FAULT_INJECTION: forcing a failure. [ 176.965946][ T7043] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 176.979671][ T7043] CPU: 0 UID: 0 PID: 7043 Comm: syz.0.295 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 176.979692][ T7043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 176.979701][ T7043] Call Trace: [ 176.979709][ T7043] [ 176.979717][ T7043] dump_stack_lvl+0x189/0x250 [ 176.979746][ T7043] ? __pfx____ratelimit+0x10/0x10 [ 176.979764][ T7043] ? __pfx_dump_stack_lvl+0x10/0x10 [ 176.979777][ T7043] ? __pfx__printk+0x10/0x10 [ 176.979787][ T7043] ? __might_fault+0xb0/0x130 [ 176.979807][ T7043] should_fail_ex+0x414/0x560 [ 176.979830][ T7043] _copy_from_user+0x2d/0xb0 [ 176.979854][ T7043] kstrtouint_from_user+0xc4/0x170 [ 176.979875][ T7043] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 176.979912][ T7043] proc_fail_nth_write+0x88/0x240 [ 176.979944][ T7043] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 176.979961][ T7043] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 176.979974][ T7043] vfs_write+0x27b/0xa90 [ 176.979991][ T7043] ? __pfx_vfs_write+0x10/0x10 [ 176.980000][ T7043] ? task_mm_cid_work+0x21f/0x760 [ 176.980009][ T7043] ? __pfx___might_resched+0x10/0x10 [ 176.980025][ T7043] ? __pfx_task_mm_cid_work+0x10/0x10 [ 176.980034][ T7043] ? blkcg_maybe_throttle_current+0x1ab/0xb40 [ 176.980047][ T7043] ? _raw_spin_unlock_irq+0x23/0x50 [ 176.980063][ T7043] ksys_write+0x145/0x250 [ 176.980075][ T7043] ? __pfx_ksys_write+0x10/0x10 [ 176.980084][ T7043] ? rcu_is_watching+0x15/0xb0 [ 176.980101][ T7043] ? do_syscall_64+0xbe/0x3b0 [ 176.980117][ T7043] do_syscall_64+0xfa/0x3b0 [ 176.980131][ T7043] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.980140][ T7043] ? asm_sysvec_call_function_single+0x1a/0x20 [ 176.980150][ T7043] ? clear_bhb_loop+0x60/0xb0 [ 176.980161][ T7043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.980171][ T7043] RIP: 0033:0x7f7aa238d3df [ 176.980182][ T7043] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 176.980190][ T7043] RSP: 002b:00007f7aa31cc030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 176.980201][ T7043] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7aa238d3df [ 176.980208][ T7043] RDX: 0000000000000001 RSI: 00007f7aa31cc0a0 RDI: 0000000000000005 [ 176.980214][ T7043] RBP: 00007f7aa31cc090 R08: 0000000000000000 R09: 0000000000000000 [ 176.980220][ T7043] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 176.980225][ T7043] R13: 0000000000000000 R14: 00007f7aa25b6080 R15: 00007fff4b6400e8 [ 176.980240][ T7043] [ 177.574469][ T10] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 179.146038][ T7051] netlink: 8 bytes leftover after parsing attributes in process `syz.4.300'. [ 179.160663][ T7051] bridge0: port 2(bridge_slave_1) entered disabled state [ 179.169335][ T7051] bridge0: port 1(bridge_slave_0) entered disabled state [ 179.258050][ T10] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 179.267271][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.295624][ T10] usb 2-1: config 0 descriptor?? [ 179.317103][ T10] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 179.356588][ T5860] usb usb38-port1: attempt power cycle [ 179.589138][ T7064] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(11) [ 179.589436][ T5875] vhci_hcd: vhci_device speed not set [ 179.595778][ T7064] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 179.756350][ T7064] vhci_hcd vhci_hcd.0: Device attached [ 179.867428][ T7073] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 179.878625][ T7068] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(14) [ 179.885281][ T7068] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 179.895791][ T7071] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(17) [ 179.902436][ T7071] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 179.913115][ T7068] vhci_hcd vhci_hcd.0: Device attached [ 179.943856][ T10] gp8psk: usb out operation failed. [ 179.953938][ T10] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 179.995980][ T7064] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(13) [ 180.002613][ T7064] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 180.028921][ T7071] vhci_hcd vhci_hcd.0: Device attached [ 180.054494][ T10] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 180.068482][ T7073] vhci_hcd vhci_hcd.0: pdev(2) rhport(4) sockfd(22) [ 180.075145][ T7073] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 180.095543][ T10] usb 2-1: USB disconnect, device number 17 [ 180.114129][ T7064] vhci_hcd vhci_hcd.0: Device attached [ 180.131919][ T7068] vhci_hcd vhci_hcd.0: pdev(2) rhport(5) sockfd(19) [ 180.138594][ T7068] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 180.164827][ T5860] usb 38-1: SetAddress Request (5) to port 0 [ 180.185543][ T5860] usb 38-1: new SuperSpeed USB device number 5 using vhci_hcd [ 180.199922][ T7073] vhci_hcd vhci_hcd.0: Device attached [ 180.259240][ T7068] vhci_hcd vhci_hcd.0: Device attached [ 180.287971][ T7078] vhci_hcd: connection closed [ 180.290104][ T7072] vhci_hcd: connection closed [ 180.295004][ T7079] vhci_hcd: connection reset by peer [ 180.305653][ T7066] vhci_hcd: connection closed [ 180.306016][ T7082] vhci_hcd: connection closed [ 180.310847][ T3463] vhci_hcd: stop threads [ 180.310931][ T7075] vhci_hcd: connection closed [ 180.333284][ T3463] vhci_hcd: release socket [ 180.357150][ T3463] vhci_hcd: disconnect device [ 180.379577][ T3463] vhci_hcd: stop threads [ 180.383887][ T3463] vhci_hcd: release socket [ 180.390818][ T3463] vhci_hcd: disconnect device [ 180.398765][ T3463] vhci_hcd: stop threads [ 180.403064][ T3463] vhci_hcd: release socket [ 180.410069][ T3463] vhci_hcd: disconnect device [ 180.416906][ T3463] vhci_hcd: stop threads [ 180.503315][ T3463] vhci_hcd: release socket [ 181.524702][ T3463] vhci_hcd: disconnect device [ 181.529813][ T3463] vhci_hcd: stop threads [ 181.534102][ T3463] vhci_hcd: release socket [ 181.543013][ T3463] vhci_hcd: disconnect device [ 181.572582][ T3463] vhci_hcd: stop threads [ 181.580956][ T3463] vhci_hcd: release socket [ 181.589036][ T3463] vhci_hcd: disconnect device [ 182.750446][ T44] usb usb36-port1: attempt power cycle [ 183.985334][ T30] audit: type=1400 audit(1751135334.504:106): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7107 comm="syz.2.312" daddr=fe80::aa dest=3 [ 184.072512][ T44] usb usb36-port1: unable to enumerate USB device [ 184.506531][ T7122] overlay: Unknown parameter 'obj_type' [ 184.703988][ T7124] netlink: 4 bytes leftover after parsing attributes in process `syz.4.314'. [ 185.467351][ T5860] usb 38-1: device descriptor read/8, error -110 [ 185.844990][ T5827] Bluetooth: hci4: command 0x0405 tx timeout [ 185.968060][ T5860] usb usb38-port1: unable to enumerate USB device [ 186.037503][ T120] vhci_hcd: vhci_device speed not set [ 187.121445][ T7144] netlink: 'syz.4.323': attribute type 11 has an invalid length. [ 187.155559][ T7148] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(11) [ 187.162229][ T7148] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 187.452663][ T7148] vhci_hcd vhci_hcd.0: Device attached [ 187.669094][ T7160] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 187.718411][ T7153] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(14) [ 187.725062][ T7153] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 187.879274][ T30] audit: type=1400 audit(1751135338.404:107): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7161 comm="syz.0.325" daddr=fe80::aa dest=3 [ 187.950014][ T7153] vhci_hcd vhci_hcd.0: Device attached [ 187.971427][ T7155] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(16) [ 187.978091][ T7155] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 188.200798][ T7148] vhci_hcd vhci_hcd.0: pdev(2) rhport(4) sockfd(21) [ 188.207430][ T7148] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 188.238803][ T7155] vhci_hcd vhci_hcd.0: Device attached [ 188.262698][ T7148] vhci_hcd vhci_hcd.0: Device attached [ 188.278900][ T7153] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(19) [ 188.285563][ T7153] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 188.404302][ T7153] vhci_hcd vhci_hcd.0: Device attached [ 188.420799][ T7148] vhci_hcd vhci_hcd.0: pdev(2) rhport(5) sockfd(18) [ 188.427436][ T7148] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 188.454506][ T120] usb 37-1: new low-speed USB device number 4 using vhci_hcd [ 189.064484][ T30] audit: type=1400 audit(1751135339.584:108): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7170 comm="syz.1.327" daddr=fe80::aa dest=3 [ 189.099459][ T7148] vhci_hcd vhci_hcd.0: Device attached [ 189.146074][ T7157] vhci_hcd: connection closed [ 189.147389][ T7165] vhci_hcd: connection closed [ 189.152340][ T7158] vhci_hcd: connection closed [ 189.160772][ T7149] vhci_hcd: connection reset by peer [ 189.171129][ T7172] vhci_hcd: connection closed [ 189.171346][ T7179] vhci_hcd: connection closed [ 189.177095][ T3463] vhci_hcd: stop threads [ 189.252838][ T3463] vhci_hcd: release socket [ 189.327044][ T3463] vhci_hcd: disconnect device [ 189.352700][ T7187] netlink: 4 bytes leftover after parsing attributes in process `syz.0.329'. [ 189.375221][ T3463] vhci_hcd: stop threads [ 189.456164][ T3463] vhci_hcd: release socket [ 189.655486][ T3463] vhci_hcd: disconnect device [ 189.887788][ T3463] vhci_hcd: stop threads [ 189.916805][ T3463] vhci_hcd: release socket [ 190.029756][ T3463] vhci_hcd: disconnect device [ 190.035522][ T3463] vhci_hcd: stop threads [ 190.039832][ T3463] vhci_hcd: release socket [ 190.052726][ T3463] vhci_hcd: disconnect device [ 190.070369][ T3463] vhci_hcd: stop threads [ 190.304500][ T3463] vhci_hcd: release socket [ 190.864539][ T3463] vhci_hcd: disconnect device [ 190.873629][ T3463] vhci_hcd: stop threads [ 190.879516][ T3463] vhci_hcd: release socket [ 190.889142][ T3463] vhci_hcd: disconnect device [ 190.980324][ T30] audit: type=1400 audit(1751135341.504:109): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7198 comm="syz.2.334" daddr=ff02::1 dest=20003 [ 191.760386][ T30] audit: type=1400 audit(1751135341.864:110): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7200 comm="syz.4.335" daddr=fe80::ff dest=65535 [ 191.814551][ T30] audit: type=1800 audit(1751135342.334:111): pid=7206 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.336" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 191.818359][ T7207] netlink: 8 bytes leftover after parsing attributes in process `syz.0.336'. [ 191.885516][ T7207] netlink: 4 bytes leftover after parsing attributes in process `syz.0.336'. [ 194.332473][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.344529][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.369741][ T120] vhci_hcd: vhci_device speed not set [ 194.378067][ T5939] usb 5-1: new low-speed USB device number 14 using dummy_hcd [ 194.379373][ T7232] netlink: 4 bytes leftover after parsing attributes in process `syz.0.342'. [ 194.918397][ T7233] netlink: 4 bytes leftover after parsing attributes in process `syz.2.344'. [ 194.933241][ T7233] netlink: 4 bytes leftover after parsing attributes in process `syz.2.344'. [ 195.031284][ T5939] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 195.044590][ T5939] usb 5-1: config 0 has no interface number 0 [ 195.050883][ T5939] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 195.065098][ T5939] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 195.079815][ T30] audit: type=1326 audit(1751135345.594:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7234 comm="syz.1.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7423b8e929 code=0x7ffc0000 [ 195.154864][ T5939] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 195.314646][ T5939] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.374575][ T30] audit: type=1326 audit(1751135345.594:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7234 comm="syz.1.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7423b8e929 code=0x7ffc0000 [ 195.397745][ T5939] usb 5-1: config 0 descriptor?? [ 195.411260][ T7227] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 195.451240][ T5939] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 195.492358][ T30] audit: type=1326 audit(1751135345.594:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7234 comm="syz.1.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f7423b8e929 code=0x7ffc0000 [ 195.640654][ T30] audit: type=1326 audit(1751135345.604:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7234 comm="syz.1.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7423b8e929 code=0x7ffc0000 [ 195.655879][ T7240] overlay: filesystem on ./bus not supported as upperdir [ 195.662519][ T30] audit: type=1326 audit(1751135345.934:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7234 comm="syz.1.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7423b8e929 code=0x7ffc0000 [ 195.691305][ T30] audit: type=1326 audit(1751135345.934:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7234 comm="syz.1.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7423b8e929 code=0x7ffc0000 [ 195.846856][ T30] audit: type=1326 audit(1751135345.934:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7234 comm="syz.1.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7423b8e929 code=0x7ffc0000 [ 195.870183][ T30] audit: type=1326 audit(1751135345.934:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7234 comm="syz.1.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f7423b8e929 code=0x7ffc0000 [ 195.901698][ T7227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 195.929022][ T7227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 195.956876][ T30] audit: type=1326 audit(1751135345.934:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7234 comm="syz.1.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7423b8e929 code=0x7ffc0000 [ 195.979239][ T7227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 196.001788][ T30] audit: type=1326 audit(1751135345.934:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7234 comm="syz.1.345" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7423b8e929 code=0x7ffc0000 [ 196.039525][ T7227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 196.056079][ T44] usb usb38-port1: attempt power cycle [ 196.099147][ T7247] fuse: Bad value for 'fd' [ 196.174060][ C1] iowarrior 5-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 196.336537][ T5860] usb 5-1: USB disconnect, device number 14 [ 196.404578][ T5829] Bluetooth: hci3: command 0x0406 tx timeout [ 196.418766][ T5829] Bluetooth: hci0: command 0x0406 tx timeout [ 196.424853][ T5833] Bluetooth: hci4: command 0x0405 tx timeout [ 196.424909][ T5833] Bluetooth: hci1: command 0x0406 tx timeout [ 196.424942][ T5833] Bluetooth: hci2: command 0x0406 tx timeout [ 196.688212][ T44] usb usb38-port1: unable to enumerate USB device [ 196.936888][ T7258] FAULT_INJECTION: forcing a failure. [ 196.936888][ T7258] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 196.972563][ T7258] CPU: 0 UID: 0 PID: 7258 Comm: syz.1.351 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 196.972587][ T7258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 196.972597][ T7258] Call Trace: [ 196.972604][ T7258] [ 196.972612][ T7258] dump_stack_lvl+0x189/0x250 [ 196.972651][ T7258] ? __pfx____ratelimit+0x10/0x10 [ 196.972673][ T7258] ? __pfx_dump_stack_lvl+0x10/0x10 [ 196.972696][ T7258] ? __pfx__printk+0x10/0x10 [ 196.972723][ T7258] should_fail_ex+0x414/0x560 [ 196.972747][ T7258] _copy_to_user+0x31/0xb0 [ 196.972772][ T7258] simple_read_from_buffer+0xe1/0x170 [ 196.972807][ T7258] proc_fail_nth_read+0x1df/0x250 [ 196.972830][ T7258] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 196.972851][ T7258] ? rw_verify_area+0x258/0x650 [ 196.972868][ T7258] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 196.972890][ T7258] vfs_read+0x1fd/0x980 [ 196.972914][ T7258] ? __pfx___mutex_lock+0x10/0x10 [ 196.972937][ T7258] ? __pfx_vfs_read+0x10/0x10 [ 196.972955][ T7258] ? __fget_files+0x2a/0x420 [ 196.972980][ T7258] ? __fget_files+0x3a0/0x420 [ 196.972998][ T7258] ? __fget_files+0x2a/0x420 [ 196.973027][ T7258] ksys_read+0x145/0x250 [ 196.973047][ T7258] ? __pfx_ksys_read+0x10/0x10 [ 196.973061][ T7258] ? rcu_is_watching+0x15/0xb0 [ 196.973089][ T7258] ? do_syscall_64+0xbe/0x3b0 [ 196.973115][ T7258] do_syscall_64+0xfa/0x3b0 [ 196.973136][ T7258] ? lockdep_hardirqs_on+0x9c/0x150 [ 196.973156][ T7258] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.973170][ T7258] ? clear_bhb_loop+0x60/0xb0 [ 196.973194][ T7258] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.973209][ T7258] RIP: 0033:0x7f7423b8d33c [ 196.973229][ T7258] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 196.973243][ T7258] RSP: 002b:00007f7424949030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 196.973265][ T7258] RAX: ffffffffffffffda RBX: 00007f7423db5fa0 RCX: 00007f7423b8d33c [ 196.973276][ T7258] RDX: 000000000000000f RSI: 00007f74249490a0 RDI: 0000000000000003 [ 196.973286][ T7258] RBP: 00007f7424949090 R08: 0000000000000000 R09: 0000000000000002 [ 196.973296][ T7258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.973306][ T7258] R13: 0000000000000000 R14: 00007f7423db5fa0 R15: 00007ffe35c66058 [ 196.973332][ T7258] [ 197.250084][ T7263] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 197.733640][ T7260] sctp: failed to load transform for md5: -2 [ 200.440368][ T7297] 9pnet_fd: Insufficient options for proto=fd [ 202.214594][ T10] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 202.246946][ T7319] netlink: 8 bytes leftover after parsing attributes in process `syz.3.365'. [ 202.344676][ T10] usb 5-1: device descriptor read/64, error -71 [ 202.654752][ T10] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 202.940084][ T10] usb 5-1: device descriptor read/64, error -71 [ 203.055686][ T10] usb usb5-port1: attempt power cycle [ 203.104767][ T7327] netlink: 36 bytes leftover after parsing attributes in process `syz.2.368'. [ 203.126088][ T7327] netlink: 452 bytes leftover after parsing attributes in process `syz.2.368'. [ 203.137277][ T7330] netlink: 40 bytes leftover after parsing attributes in process `syz.1.369'. [ 203.395501][ T5939] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 203.406866][ T10] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 203.448647][ T10] usb 5-1: device descriptor read/8, error -71 [ 203.564968][ T5939] usb 4-1: device descriptor read/64, error -71 [ 203.779726][ T10] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 203.805445][ T10] usb 5-1: device descriptor read/8, error -71 [ 203.918348][ T7346] 9pnet_fd: Insufficient options for proto=fd [ 204.418921][ T10] usb usb5-port1: unable to enumerate USB device [ 204.474690][ T5939] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 205.093023][ T5939] usb 4-1: device descriptor read/64, error -71 [ 205.220558][ T5939] usb usb4-port1: attempt power cycle [ 205.605080][ T5939] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 205.649389][ T7362] netlink: 32 bytes leftover after parsing attributes in process `syz.4.381'. [ 205.834509][ T5939] usb 4-1: device not accepting address 9, error -71 [ 208.971103][ T7390] 9pnet_fd: Insufficient options for proto=fd [ 209.949837][ C1] vcan0: j1939_tp_rxtimer: 0xffff888057990400: rx timeout, send abort [ 209.960467][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888057990400: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 211.032065][ T7412] netlink: 80 bytes leftover after parsing attributes in process `syz.3.394'. [ 211.154469][ T7412] netlink: 'syz.3.394': attribute type 1 has an invalid length. [ 211.163171][ T7412] netlink: 4 bytes leftover after parsing attributes in process `syz.3.394'. [ 211.184995][ T5860] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 211.387144][ T7416] netlink: 4 bytes leftover after parsing attributes in process `syz.0.395'. [ 211.454033][ T30] kauditd_printk_skb: 60 callbacks suppressed [ 211.454050][ T30] audit: type=1326 audit(1751135361.974:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7417 comm="syz.4.396" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 211.494448][ T5860] usb 2-1: Using ep0 maxpacket: 16 [ 211.501960][ T5860] usb 2-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 211.506855][ T30] audit: type=1326 audit(1751135361.984:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7417 comm="syz.4.396" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 211.515724][ T5860] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.533616][ T30] audit: type=1326 audit(1751135361.984:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7417 comm="syz.4.396" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 211.591235][ T30] audit: type=1326 audit(1751135361.994:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7417 comm="syz.4.396" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 211.620266][ T30] audit: type=1326 audit(1751135361.994:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7417 comm="syz.4.396" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 211.622097][ T5860] usb 2-1: config 0 descriptor?? [ 211.642344][ T30] audit: type=1326 audit(1751135361.994:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7417 comm="syz.4.396" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 211.670698][ T30] audit: type=1326 audit(1751135361.994:188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7417 comm="syz.4.396" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 211.693235][ T30] audit: type=1326 audit(1751135361.994:189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7417 comm="syz.4.396" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 211.754634][ T30] audit: type=1326 audit(1751135362.014:190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7417 comm="syz.4.396" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 211.797763][ T30] audit: type=1326 audit(1751135362.044:191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7417 comm="syz.4.396" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f682ef8e929 code=0x7ffc0000 [ 212.663880][ T7423] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 212.786865][ T5860] usbhid 2-1:0.0: can't add hid device: -32 [ 212.792932][ T5860] usbhid 2-1:0.0: probe with driver usbhid failed with error -32 [ 212.850760][ T7433] netlink: 'syz.2.401': attribute type 10 has an invalid length. [ 213.786778][ T7433] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 213.888880][ T5860] usb 2-1: USB disconnect, device number 18 [ 216.501796][ T7460] Invalid logical block size (21930) [ 216.589442][ T7461] block device autoloading is deprecated and will be removed. [ 216.630972][ T7469] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 216.712282][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 216.712301][ T30] audit: type=1400 audit(1751135367.234:198): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7468 comm="syz.2.414" daddr=fe80::1b dest=16385 [ 216.870658][ T7476] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 216.939331][ T7477] program syz.1.412 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 216.949160][ T7477] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 217.752493][ T30] audit: type=1400 audit(1751135368.274:199): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7472 comm="syz.3.415" daddr=fc01:: dest=20000 [ 219.961158][ T7505] FAULT_INJECTION: forcing a failure. [ 219.961158][ T7505] name failslab, interval 1, probability 0, space 0, times 0 [ 219.997297][ T7505] CPU: 0 UID: 0 PID: 7505 Comm: syz.0.423 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 219.997325][ T7505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 219.997335][ T7505] Call Trace: [ 219.997342][ T7505] [ 219.997350][ T7505] dump_stack_lvl+0x189/0x250 [ 219.997379][ T7505] ? __pfx____ratelimit+0x10/0x10 [ 219.997401][ T7505] ? __pfx_dump_stack_lvl+0x10/0x10 [ 219.997424][ T7505] ? __pfx__printk+0x10/0x10 [ 219.997447][ T7505] ? __pfx___might_resched+0x10/0x10 [ 219.997474][ T7505] should_fail_ex+0x414/0x560 [ 219.997500][ T7505] should_failslab+0xa8/0x100 [ 219.997523][ T7505] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 219.997544][ T7505] ? __alloc_skb+0x112/0x2d0 [ 219.997567][ T7505] __alloc_skb+0x112/0x2d0 [ 219.997588][ T7505] netlink_sendmsg+0x5c6/0xb30 [ 219.997616][ T7505] ? __pfx_netlink_sendmsg+0x10/0x10 [ 219.997642][ T7505] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 219.997662][ T7505] ? __pfx_netlink_sendmsg+0x10/0x10 [ 219.997681][ T7505] __sock_sendmsg+0x21c/0x270 [ 219.997707][ T7505] ____sys_sendmsg+0x505/0x830 [ 219.997733][ T7505] ? __pfx_____sys_sendmsg+0x10/0x10 [ 219.997760][ T7505] ? import_iovec+0x74/0xa0 [ 219.997788][ T7505] ___sys_sendmsg+0x21f/0x2a0 [ 219.997809][ T7505] ? __pfx____sys_sendmsg+0x10/0x10 [ 219.997865][ T7505] ? __fget_files+0x2a/0x420 [ 219.997886][ T7505] ? __fget_files+0x3a0/0x420 [ 219.997916][ T7505] __x64_sys_sendmsg+0x19b/0x260 [ 219.997938][ T7505] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 219.997967][ T7505] ? __pfx_ksys_write+0x10/0x10 [ 219.997984][ T7505] ? rcu_is_watching+0x15/0xb0 [ 219.998018][ T7505] ? do_syscall_64+0xbe/0x3b0 [ 219.998045][ T7505] do_syscall_64+0xfa/0x3b0 [ 219.998066][ T7505] ? lockdep_hardirqs_on+0x9c/0x150 [ 219.998088][ T7505] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.998106][ T7505] ? clear_bhb_loop+0x60/0xb0 [ 219.998126][ T7505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.998144][ T7505] RIP: 0033:0x7f7aa238e929 [ 219.998160][ T7505] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 219.998175][ T7505] RSP: 002b:00007f7aa31ed038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 219.998194][ T7505] RAX: ffffffffffffffda RBX: 00007f7aa25b5fa0 RCX: 00007f7aa238e929 [ 219.998207][ T7505] RDX: 0000000000000040 RSI: 0000200000000300 RDI: 0000000000000004 [ 219.998218][ T7505] RBP: 00007f7aa31ed090 R08: 0000000000000000 R09: 0000000000000000 [ 219.998229][ T7505] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 219.998239][ T7505] R13: 0000000000000000 R14: 00007f7aa25b5fa0 R15: 00007fff4b6400e8 [ 219.998267][ T7505] [ 221.176008][ T24] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 221.572470][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 221.685634][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 221.805005][ T24] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 22 [ 222.062336][ T24] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 222.062416][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 222.062465][ T24] usb 4-1: SerialNumber: syz [ 223.647999][ T7522] tty tty3: ldisc open failed (-12), clearing slot 2 [ 223.950066][ T120] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 223.987859][ T120] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz0] on syz0 [ 224.061687][ T5939] usb 4-1: USB disconnect, device number 11 [ 224.119748][ T7536] netlink: 8 bytes leftover after parsing attributes in process `syz.0.431'. [ 224.202637][ T7535] fido_id[7535]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 226.049208][ T7557] ptrace attach of "./syz-executor exec"[5820] was attempted by " eth0 #uu0*iƇ޿_k.\x22#p/yLa~+>3l{@!2!9k\x0b8I$Q=r\x09/vӧJ#KT_$A=z/XmOX)s޾_N)6m\x0a\x0b뻑z|d\x1byx\x1bLTrw|0\x09\x5c[ ]V:Þ\x07x.TTϿa%QCuTYZy!Ѧ7vs\x07j*I{]*5JtsĪ~0fۮG:Q\x1b㣤}`eL\x0dyg1\x09i/!,u~)\x1b2jNTh\x1bo:\x0bq7SHLBq([aF*q v ANTeL+u^\x07sha 넙LD7DQ2!8,%$֜yKƴ%:0dLWՐl\x1b\x0bh=m.\x0bhQ}8/P+:E\x5cԬטլCRr^gQ(>⺨=\x0c04*@vTځg:hzW6s)x\x [ 226.766941][ T30] audit: type=1400 audit(1751135377.284:200): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7548 comm="syz.1.435" daddr=fc01:: dest=20000 [ 227.355175][ T7577] netlink: 12 bytes leftover after parsing attributes in process `syz.1.443'. [ 227.364101][ T7577] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 229.203801][ T7591] netlink: 'syz.2.446': attribute type 10 has an invalid length. [ 230.140384][ T7601] syz_tun: entered allmulticast mode [ 230.281716][ T7599] syz_tun: left allmulticast mode [ 230.424498][ T5875] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 230.613441][ T5875] usb 1-1: Using ep0 maxpacket: 16 [ 230.626784][ T5875] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 230.662770][ T5875] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 230.717750][ T5875] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 230.869291][ T5875] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 231.194539][ T5875] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.202594][ T5875] usb 1-1: Product: 띢㉤꣩豴녕ꭼ컅꠹觩⺜锗꿟杰林㱥돤벷ㅀ胈촾㫛ဏ줭ꪭ뼘ŏ芽踉䄎뷐殉輻⬓ꔫΙᇯ䉰㳲滱᱅룼ᴼ룋簐鏺✉兘ꅱ턂ᚄ㰟ܕ耣ᜟᝰ툡ᬏ㚣䥌硂䊶枼໿ᶕ萨㎮⮥䬖ꏬ⽅疷둿嶒炁磊뿎ﴵꪗꋉ믹ᩜ᭥蛶얙ତ贱몵ዠꢌȎ흐萧夈븿㌡榧갇ᓊ훘멏勐䃎拓⫿ [ 231.638955][ T30] audit: type=1400 audit(1751135381.904:201): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7609 comm="syz.3.454" daddr=fc01:: dest=20000 [ 231.656508][ T5875] usb 1-1: Manufacturer: ࠉ [ 231.744788][ T5875] usb 1-1: SerialNumber: И [ 231.969762][ T5875] cdc_ncm 1-1:1.0: CDC Union missing and no IAD found [ 231.983602][ T5875] cdc_ncm 1-1:1.0: bind() failure [ 232.180265][ T978] usb 1-1: USB disconnect, device number 9 [ 232.394638][ T5875] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 232.554526][ T5875] usb 4-1: Using ep0 maxpacket: 32 [ 232.563649][ T5875] usb 4-1: unable to get BOS descriptor or descriptor too short [ 232.583195][ T5875] usb 4-1: config 56 has an invalid interface number: 216 but max is 0 [ 232.623999][ T5875] usb 4-1: config 56 has no interface number 0 [ 232.631226][ T5875] usb 4-1: config 56 interface 216 has no altsetting 0 [ 232.652201][ T5875] usb 4-1: New USB device found, idVendor=12d1, idProduct=554b, bcdDevice=5a.0b [ 232.803224][ T5875] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.853057][ T5875] usb 4-1: Product: syz [ 232.887937][ T5875] usb 4-1: Manufacturer: syz [ 232.892624][ T5875] usb 4-1: SerialNumber: syz [ 233.143084][ T5875] hub 4-1:56.216: bad descriptor, ignoring hub [ 233.149782][ T5875] hub 4-1:56.216: probe with driver hub failed with error -5 [ 233.167125][ T5875] option 4-1:56.216: GSM modem (1-port) converter detected [ 233.944419][ T5875] usb 4-1: USB disconnect, device number 12 [ 234.198368][ T5875] option 4-1:56.216: device disconnected [ 234.608951][ T7641] netlink: 4 bytes leftover after parsing attributes in process `syz.1.460'. [ 234.620061][ T7641] netlink: 4 bytes leftover after parsing attributes in process `syz.1.460'. [ 235.027063][ T7644] tipc: Can't bind to reserved service type 2 [ 235.309123][ T7632] could not allocate digest TFM handle digest_null-generic [ 235.319547][ T5860] libceph: connect (1)[c::]:6789 error -101 [ 235.327057][ T5860] libceph: mon0 (1)[c::]:6789 connect error [ 235.480583][ T7642] ceph: No mds server is up or the cluster is laggy [ 235.713210][ T5860] libceph: connect (1)[c::]:6789 error -101 [ 235.888321][ T5860] libceph: mon0 (1)[c::]:6789 connect error [ 236.144449][ T30] audit: type=1400 audit(1751135386.564:202): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7658 comm="syz.4.466" daddr=fc01:: dest=20000 [ 237.097645][ T7669] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 237.120580][ T7677] xt_recent: Unsupported userspace flags (000000de) [ 237.386339][ T7681] 9pnet_fd: Insufficient options for proto=fd [ 240.637430][ T7711] netlink: 4 bytes leftover after parsing attributes in process `syz.0.478'. [ 240.692244][ T7711] netlink: 4 bytes leftover after parsing attributes in process `syz.0.478'. [ 240.962884][ T7712] netlink: 80 bytes leftover after parsing attributes in process `syz.1.481'. [ 241.148199][ T7702] xt_TCPMSS: Only works on TCP SYN packets [ 241.494144][ T7704] netlink: 'syz.1.481': attribute type 1 has an invalid length. [ 241.501906][ T7704] netlink: 4 bytes leftover after parsing attributes in process `syz.1.481'. [ 241.640209][ T30] audit: type=1400 audit(1751135392.164:203): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7716 comm="syz.3.483" daddr=fc01:: dest=20000 [ 242.558542][ T7729] 9pnet_fd: Insufficient options for proto=fd [ 243.098071][ T7734] netlink: 28 bytes leftover after parsing attributes in process `syz.0.486'. [ 243.107146][ T7734] netlink: 'syz.0.486': attribute type 7 has an invalid length. [ 243.114949][ T7734] netlink: 'syz.0.486': attribute type 8 has an invalid length. [ 243.122600][ T7734] netlink: 4 bytes leftover after parsing attributes in process `syz.0.486'. [ 243.138407][ T7734] team0: entered promiscuous mode [ 243.143622][ T7734] team_slave_0: entered promiscuous mode [ 243.156391][ T7734] team_slave_1: entered promiscuous mode [ 243.165079][ T7734] bond0: entered promiscuous mode [ 243.170383][ T7734] bond_slave_0: entered promiscuous mode [ 243.176655][ T7734] bond_slave_1: entered promiscuous mode [ 243.184590][ T7734] gretap0: entered promiscuous mode [ 243.191905][ T7734] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 243.199767][ T7734] Cannot create hsr debugfs directory [ 243.206460][ T7734] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 243.560988][ T7736] xt_connbytes: Forcing CT accounting to be enabled [ 243.567882][ T7736] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 243.580363][ T7736] xt_bpf: check failed: parse error [ 244.937259][ T7757] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 245.190340][ T7759] netlink: 52 bytes leftover after parsing attributes in process `syz.1.494'. [ 245.200310][ T7759] bridge0: port 2(bridge_slave_1) entered disabled state [ 245.207902][ T7759] bridge0: port 1(bridge_slave_0) entered disabled state [ 246.499762][ T7771] 9pnet_fd: Insufficient options for proto=fd [ 247.544606][ T30] audit: type=1400 audit(1751135397.814:204): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7773 comm="syz.0.498" daddr=fc01:: dest=20000 [ 248.806267][ T7786] netlink: 8 bytes leftover after parsing attributes in process `syz.1.502'. [ 250.775064][ T7822] 9pnet_fd: Insufficient options for proto=fd [ 252.007825][ T30] audit: type=1400 audit(1751135402.534:205): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7829 comm="syz.4.514" daddr=fc01:: dest=20000 [ 252.383200][ T30] audit: type=1400 audit(1751135402.904:206): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7837 comm="syz.1.517" daddr=ff00::1 dest=49150 [ 252.438137][ T7839] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 255.242716][ T7872] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 255.251710][ T7872] overlayfs: missing 'lowerdir' [ 255.605730][ T7878] 9pnet_fd: Insufficient options for proto=fd [ 256.375059][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.381399][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.639146][ T30] audit: type=1400 audit(1751135408.164:207): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7886 comm="syz.3.529" daddr=4102::1 dest=3 [ 259.264881][ T30] audit: type=1400 audit(1751135409.734:208): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=7885 comm="syz.2.530" daddr=fc01:: dest=20000 [ 260.524329][ T7905] netlink: 4 bytes leftover after parsing attributes in process `syz.3.535'. [ 267.728410][ T7978] batadv0: entered promiscuous mode [ 267.752305][ T7978] vlan0: entered promiscuous mode [ 270.263584][ T978] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 271.394740][ T978] usb 5-1: Using ep0 maxpacket: 32 [ 271.406194][ T978] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 271.415975][ T978] usb 5-1: too many endpoints for config 0 interface 0 altsetting 5: 69, using maximum allowed: 30 [ 271.450358][ T978] usb 5-1: config 0 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 69 [ 271.473392][ T8021] netlink: 28 bytes leftover after parsing attributes in process `syz.1.567'. [ 271.494888][ T978] usb 5-1: config 0 interface 0 has no altsetting 1 [ 271.516926][ T8021] netlink: 28 bytes leftover after parsing attributes in process `syz.1.567'. [ 271.535600][ T978] usb 5-1: New USB device found, idVendor=152d, idProduct=0539, bcdDevice= 0.00 [ 271.538253][ T8023] netlink: 12 bytes leftover after parsing attributes in process `syz.2.568'. [ 271.553901][ T978] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 271.566991][ T978] usb 5-1: SerialNumber: syz [ 271.576365][ T978] usb 5-1: config 0 descriptor?? [ 271.593339][ T978] usb-storage 5-1:0.0: USB Mass Storage device detected [ 271.621590][ T8021] gretap0: entered promiscuous mode [ 271.637276][ T8021] gretap0: left promiscuous mode [ 271.681125][ T978] usb-storage 5-1:0.0: Quirks match for vid 152d pid 0539: 4000000 [ 271.751918][ T8024] netlink: 12 bytes leftover after parsing attributes in process `syz.2.568'. [ 273.381775][ T8046] dummy0 speed is unknown, defaulting to 1000 [ 274.477683][ T8060] netlink: 4 bytes leftover after parsing attributes in process `syz.3.576'. [ 274.488985][ T8060] netlink: 4 bytes leftover after parsing attributes in process `syz.3.576'. [ 274.717020][ T8061] netlink: 8 bytes leftover after parsing attributes in process `syz.2.577'. [ 274.884083][ T978] usb 5-1: USB disconnect, device number 19 [ 274.980104][ T8067] netlink: 8 bytes leftover after parsing attributes in process `syz.1.579'. [ 275.075458][ T8067] netlink: 8 bytes leftover after parsing attributes in process `syz.1.579'. [ 275.647044][ T8071] 9pnet_fd: Insufficient options for proto=fd [ 275.832523][ T5875] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 275.977227][ T8082] sp0: Synchronizing with TNC [ 276.009535][ T5875] usb 2-1: Using ep0 maxpacket: 32 [ 276.015385][ T8084] netlink: 8 bytes leftover after parsing attributes in process `syz.2.585'. [ 276.044130][ T5875] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 276.073536][ T5875] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 16 [ 276.090560][ T978] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 276.100393][ T8081] [U] [ 276.114308][ T5875] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 276.148566][ T5875] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 276.169534][ T5875] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.192531][ T5875] usb 2-1: Product: 䊂䷌ꢭ╽戬谏僁誀⬫䃙㘙嘍탆潴猱❘鸌谸쨊輅ꭆ벒评ẵꢓ먦춥쉥鐣≰鹅끐忒놱ꎉ뜞吙깾蹯褚胢牾콘㱊ﹽ㦒咮䘦嗊馼靿烓ᅲ䜯䁴癘綘瞣閺纻帜늹潆瀇띠格ꏭ븡ꜞ걵잺ࢀⰺ [ 276.266689][ T5875] usb 2-1: Manufacturer: ͪ惒ힺ消羕ꈞ [ 276.272563][ T5875] usb 2-1: SerialNumber: syz [ 276.277682][ T978] usb 5-1: device descriptor read/64, error -71 [ 276.324229][ T8092] openvswitch: netlink: Message has 8 unknown bytes. [ 276.530770][ T978] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 276.592011][ T8067] Invalid ELF header magic: != ELF [ 276.769561][ T8067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 276.802003][ T8067] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 276.858066][ T978] usb 5-1: device descriptor read/64, error -71 [ 276.906600][ T5875] cdc_ncm 2-1:1.0: bind() failure [ 276.929227][ T5875] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 276.936370][ T5875] cdc_ncm 2-1:1.1: bind() failure [ 276.985002][ T978] usb usb5-port1: attempt power cycle [ 276.998368][ T5875] usb 2-1: USB disconnect, device number 19 [ 277.049436][ T8100] netlink: 8 bytes leftover after parsing attributes in process `syz.0.591'. [ 277.344738][ T978] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 277.875712][ T978] usb 5-1: device descriptor read/8, error -71 [ 278.263710][ T30] audit: type=1326 audit(1751135428.784:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8112 comm="syz.2.596" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb98898e929 code=0x0 [ 278.316450][ T8117] netlink: 8 bytes leftover after parsing attributes in process `syz.2.596'. [ 278.367952][ T978] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 278.568662][ T978] usb 5-1: device descriptor read/8, error -71 [ 278.573515][ T8119] netlink: 1088 bytes leftover after parsing attributes in process `syz.1.597'. [ 278.589889][ T8119] FAULT_INJECTION: forcing a failure. [ 278.589889][ T8119] name failslab, interval 1, probability 0, space 0, times 0 [ 278.603681][ T8119] CPU: 1 UID: 0 PID: 8119 Comm: syz.1.597 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 278.603707][ T8119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 278.603718][ T8119] Call Trace: [ 278.603726][ T8119] [ 278.603733][ T8119] dump_stack_lvl+0x189/0x250 [ 278.603764][ T8119] ? __pfx____ratelimit+0x10/0x10 [ 278.603787][ T8119] ? __pfx_dump_stack_lvl+0x10/0x10 [ 278.603808][ T8119] ? __pfx__printk+0x10/0x10 [ 278.603837][ T8119] should_fail_ex+0x414/0x560 [ 278.603853][ T8119] should_failslab+0xa8/0x100 [ 278.603866][ T8119] kmem_cache_alloc_noprof+0x73/0x3c0 [ 278.603878][ T8119] ? skb_clone+0x212/0x3a0 [ 278.603893][ T8119] skb_clone+0x212/0x3a0 [ 278.603905][ T8119] __netlink_deliver_tap+0x404/0x850 [ 278.603923][ T8119] ? netlink_deliver_tap+0x2e/0x1b0 [ 278.603934][ T8119] netlink_deliver_tap+0x19c/0x1b0 [ 278.603945][ T8119] netlink_sendskb+0x68/0x140 [ 278.603960][ T8119] netlink_rcv_skb+0x28c/0x470 [ 278.603971][ T8119] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 278.603984][ T8119] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 278.604003][ T8119] ? netlink_deliver_tap+0x2e/0x1b0 [ 278.604012][ T8119] ? netlink_deliver_tap+0x2e/0x1b0 [ 278.604023][ T8119] xfrm_netlink_rcv+0x79/0x90 [ 278.604034][ T8119] netlink_unicast+0x75b/0x8d0 [ 278.604054][ T8119] netlink_sendmsg+0x805/0xb30 [ 278.604069][ T8119] ? __pfx_netlink_sendmsg+0x10/0x10 [ 278.604084][ T8119] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 278.604096][ T8119] ? __pfx_netlink_sendmsg+0x10/0x10 [ 278.604106][ T8119] __sock_sendmsg+0x21c/0x270 [ 278.604121][ T8119] ____sys_sendmsg+0x505/0x830 [ 278.604135][ T8119] ? __pfx_____sys_sendmsg+0x10/0x10 [ 278.604151][ T8119] ? import_iovec+0x74/0xa0 [ 278.604168][ T8119] ___sys_sendmsg+0x21f/0x2a0 [ 278.604180][ T8119] ? __pfx____sys_sendmsg+0x10/0x10 [ 278.604211][ T8119] ? __fget_files+0x2a/0x420 [ 278.604223][ T8119] ? __fget_files+0x3a0/0x420 [ 278.604241][ T8119] __x64_sys_sendmsg+0x19b/0x260 [ 278.604253][ T8119] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 278.604269][ T8119] ? __pfx_ksys_write+0x10/0x10 [ 278.604279][ T8119] ? rcu_is_watching+0x15/0xb0 [ 278.604296][ T8119] ? do_syscall_64+0xbe/0x3b0 [ 278.604312][ T8119] do_syscall_64+0xfa/0x3b0 [ 278.604324][ T8119] ? lockdep_hardirqs_on+0x9c/0x150 [ 278.604338][ T8119] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.604348][ T8119] ? clear_bhb_loop+0x60/0xb0 [ 278.604368][ T8119] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.604383][ T8119] RIP: 0033:0x7f7423b8e929 [ 278.604398][ T8119] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 278.604412][ T8119] RSP: 002b:00007f7424949038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 278.604430][ T8119] RAX: ffffffffffffffda RBX: 00007f7423db5fa0 RCX: 00007f7423b8e929 [ 278.604442][ T8119] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 278.604449][ T8119] RBP: 00007f7424949090 R08: 0000000000000000 R09: 0000000000000000 [ 278.604455][ T8119] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 278.604461][ T8119] R13: 0000000000000000 R14: 00007f7423db5fa0 R15: 00007ffe35c66058 [ 278.604477][ T8119] [ 278.715614][ T978] usb usb5-port1: unable to enumerate USB device [ 279.039699][ T8117] syz.2.596 (8117) used greatest stack depth: 17992 bytes left [ 279.124500][ T5860] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 279.203646][ T30] audit: type=1400 audit(1751135429.714:210): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=8122 comm="syz.1.599" daddr=fe80::d [ 279.320722][ T30] audit: type=1400 audit(1751135429.724:211): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="v." object="_" requested=w pid=8126 comm="syz.0.601" saddr=fe80::bb src=20003 daddr=fe80::aa dest=20002 netif=wpan0 [ 279.461341][ T5860] usb 4-1: Using ep0 maxpacket: 8 [ 279.525040][ T5860] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 279.525104][ T5860] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.631943][ T5860] usb 4-1: config 0 descriptor?? [ 279.885812][ T5860] asix 4-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 280.272558][ T30] audit: type=1400 audit(1751135430.794:212): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=8134 comm="syz.1.604" daddr=fc01::f dest=20003 [ 280.336468][ T8140] netlink: 8 bytes leftover after parsing attributes in process `syz.0.605'. [ 280.405523][ T5827] Bluetooth: hci4: command 0x0405 tx timeout [ 280.605212][ T8121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 280.615377][ T120] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 280.656999][ T8121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 280.760029][ T5860] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 280.770338][ T5860] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x00b0: ffffffb9 [ 280.795053][ T5860] asix 4-1:0.0: probe with driver asix failed with error -71 [ 281.005982][ T120] usb 5-1: Using ep0 maxpacket: 8 [ 281.124713][ T8157] FAULT_INJECTION: forcing a failure. [ 281.124713][ T8157] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 281.137965][ T8157] CPU: 0 UID: 0 PID: 8157 Comm: syz.2.610 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 281.137990][ T8157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 281.138001][ T8157] Call Trace: [ 281.138010][ T8157] [ 281.138019][ T8157] dump_stack_lvl+0x189/0x250 [ 281.138048][ T8157] ? __pfx____ratelimit+0x10/0x10 [ 281.138073][ T8157] ? __pfx_dump_stack_lvl+0x10/0x10 [ 281.138096][ T8157] ? __pfx__printk+0x10/0x10 [ 281.138128][ T8157] should_fail_ex+0x414/0x560 [ 281.138153][ T8157] strncpy_from_user+0x36/0x290 [ 281.138176][ T8157] getname_flags+0xf3/0x540 [ 281.138205][ T8157] __x64_sys_execve+0x7a/0xb0 [ 281.138225][ T8157] do_syscall_64+0xfa/0x3b0 [ 281.138247][ T8157] ? lockdep_hardirqs_on+0x9c/0x150 [ 281.138270][ T8157] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.138295][ T8157] ? clear_bhb_loop+0x60/0xb0 [ 281.138317][ T8157] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.138334][ T8157] RIP: 0033:0x7fb98898e929 [ 281.138350][ T8157] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 281.138365][ T8157] RSP: 002b:00007fb9897dd038 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 281.138384][ T8157] RAX: ffffffffffffffda RBX: 00007fb988bb6160 RCX: 00007fb98898e929 [ 281.138397][ T8157] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 281.138409][ T8157] RBP: 00007fb9897dd090 R08: 0000000000000000 R09: 0000000000000000 [ 281.138420][ T8157] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 281.138431][ T8157] R13: 0000000000000000 R14: 00007fb988bb6160 R15: 00007fff39880028 [ 281.138460][ T8157] [ 281.312217][ C0] vkms_vblank_simulate: vblank timer overrun [ 281.401681][ T5860] usb 4-1: USB disconnect, device number 13 [ 281.404920][ T120] usb 5-1: config 1 interface 0 altsetting 3 endpoint 0x82 has invalid maxpacket 24385, setting to 1024 [ 281.427942][ T120] usb 5-1: config 1 interface 0 altsetting 3 bulk endpoint 0x82 has invalid maxpacket 1024 [ 281.438215][ T120] usb 5-1: config 1 interface 0 has no altsetting 0 [ 281.450327][ T120] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 281.459584][ T120] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.477011][ T120] usb 5-1: Product: syz [ 281.481332][ T120] usb 5-1: Manufacturer: syz [ 281.488156][ T120] usb 5-1: SerialNumber: syz [ 281.497459][ T8143] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 281.734301][ T8143] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 281.774905][ T8143] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 281.937190][ T8166] tmpfs: Bad value for 'mpol' [ 281.953862][ T120] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -71 [ 281.982443][ T120] usb 5-1: USB disconnect, device number 24 [ 282.767956][ T8177] netlink: 8 bytes leftover after parsing attributes in process `syz.4.618'. [ 283.035219][ T120] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 283.234756][ T120] usb 1-1: Using ep0 maxpacket: 32 [ 283.276922][ T120] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 283.319196][ T8189] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(11) [ 283.325870][ T8189] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 283.336695][ T120] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 283.349983][ T120] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 283.366693][ T8189] vhci_hcd vhci_hcd.0: Device attached [ 283.467260][ T8192] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(14) [ 283.473919][ T8192] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 283.481907][ T120] usb 1-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 283.493463][ T8192] vhci_hcd vhci_hcd.0: Device attached [ 283.502455][ T120] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.502517][ T8189] vhci_hcd vhci_hcd.0: pdev(4) rhport(2) sockfd(13) [ 283.517086][ T8189] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 283.524663][ C0] vkms_vblank_simulate: vblank timer overrun [ 283.534937][ T8189] vhci_hcd vhci_hcd.0: Device attached [ 283.540735][ T120] usb 1-1: config 0 descriptor?? [ 283.553144][ T8189] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 283.574231][ T8189] vhci_hcd vhci_hcd.0: pdev(4) rhport(4) sockfd(19) [ 283.580883][ T8189] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 283.590719][ T8189] vhci_hcd vhci_hcd.0: Device attached [ 283.606047][ T8189] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(21) [ 283.612703][ T8189] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 283.622962][ T8189] vhci_hcd vhci_hcd.0: Device attached [ 283.631868][ T8189] vhci_hcd vhci_hcd.0: pdev(4) rhport(5) sockfd(23) [ 283.638516][ T8189] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 283.649070][ T8189] vhci_hcd vhci_hcd.0: Device attached [ 283.654826][ T24] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 283.673786][ T8203] vhci_hcd: connection closed [ 283.673977][ T8201] vhci_hcd: connection closed [ 283.674071][ T8199] vhci_hcd: connection closed [ 283.717241][ T37] vhci_hcd: stop threads [ 283.739230][ T8193] vhci_hcd: connection closed [ 283.739959][ T37] vhci_hcd: release socket [ 283.756972][ T37] vhci_hcd: disconnect device [ 283.766129][ T8195] vhci_hcd: connection closed [ 283.784954][ T37] vhci_hcd: stop threads [ 283.793966][ T37] vhci_hcd: release socket [ 283.798949][ T8190] vhci_hcd: connection reset by peer [ 283.842530][ T37] vhci_hcd: disconnect device [ 283.865923][ T37] vhci_hcd: stop threads [ 283.870267][ T37] vhci_hcd: release socket [ 283.880064][ T37] vhci_hcd: disconnect device [ 283.889183][ T37] vhci_hcd: stop threads [ 283.897456][ T37] vhci_hcd: release socket [ 283.904672][ T37] vhci_hcd: disconnect device [ 283.920417][ T37] vhci_hcd: stop threads [ 283.932745][ T37] vhci_hcd: release socket [ 283.956888][ T37] vhci_hcd: disconnect device [ 283.963400][ T37] vhci_hcd: stop threads [ 283.970151][ T37] vhci_hcd: release socket [ 283.976021][ T37] vhci_hcd: disconnect device [ 283.997317][ T8214] XFS (nullb0): Invalid superblock magic number [ 284.174484][ T5964] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 285.854479][ T5935] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 286.471239][ T120] usbhid 1-1:0.0: can't add hid device: -71 [ 286.477879][ T120] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 286.490214][ T120] usb 1-1: USB disconnect, device number 10 [ 286.584763][ T5935] usb 2-1: device descriptor read/64, error -71 [ 286.593334][ T5964] usb 4-1: config 0 has an invalid interface number: 200 but max is 0 [ 286.607821][ T5964] usb 4-1: config 0 has no interface number 0 [ 286.625512][ T5964] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=91.6f [ 286.651865][ T5964] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 286.683426][ T5964] usb 4-1: config 0 descriptor?? [ 286.729345][ T8238] netlink: 8 bytes leftover after parsing attributes in process `syz.2.631'. [ 286.845304][ T5935] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 286.885237][ T5964] RobotFuzz Open Source InterFace, OSIF 4-1:0.200: failure sending bit rate [ 286.896963][ T5964] RobotFuzz Open Source InterFace, OSIF 4-1:0.200: probe with driver RobotFuzz Open Source InterFace, OSIF failed with error -71 [ 286.913046][ T5964] usb 4-1: USB disconnect, device number 14 [ 286.996712][ T5935] usb 2-1: device descriptor read/64, error -71 [ 287.003589][ T8242] netlink: 'syz.2.633': attribute type 2 has an invalid length. [ 287.114818][ T5935] usb usb2-port1: attempt power cycle [ 287.773564][ T30] audit: type=1400 audit(1751135437.774:213): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=8240 comm="syz.3.634" daddr=fe80::1a [ 288.056374][ T8255] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(11) [ 288.063048][ T8255] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 288.084143][ T8261] FAULT_INJECTION: forcing a failure. [ 288.084143][ T8261] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 288.103216][ T8261] CPU: 1 UID: 0 PID: 8261 Comm: syz.0.640 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 288.103244][ T8261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 288.103255][ T8261] Call Trace: [ 288.103262][ T8261] [ 288.103271][ T8261] dump_stack_lvl+0x189/0x250 [ 288.103299][ T8261] ? __pfx____ratelimit+0x10/0x10 [ 288.103323][ T8261] ? __pfx_dump_stack_lvl+0x10/0x10 [ 288.103346][ T8261] ? __pfx__printk+0x10/0x10 [ 288.103364][ T8261] ? __might_fault+0xb0/0x130 [ 288.103396][ T8261] should_fail_ex+0x414/0x560 [ 288.103422][ T8261] _copy_from_user+0x2d/0xb0 [ 288.103447][ T8261] input_event_from_user+0xb2/0x280 [ 288.103466][ T8261] ? __pfx_input_event_from_user+0x10/0x10 [ 288.103499][ T8261] ? input_inject_event+0xbc/0x320 [ 288.103525][ T8261] evdev_write+0x2a6/0x480 [ 288.103548][ T8261] ? __pfx_evdev_write+0x10/0x10 [ 288.103566][ T8261] ? bpf_lsm_file_permission+0x9/0x20 [ 288.103587][ T8261] ? security_file_permission+0x75/0x290 [ 288.103608][ T8261] ? rw_verify_area+0x258/0x650 [ 288.103626][ T8261] ? __pfx_evdev_write+0x10/0x10 [ 288.103645][ T8261] vfs_write+0x27b/0xa90 [ 288.103674][ T8261] ? __pfx_vfs_write+0x10/0x10 [ 288.103695][ T8261] ? __fget_files+0x2a/0x420 [ 288.103719][ T8261] ? __fget_files+0x2a/0x420 [ 288.103738][ T8261] ? __fget_files+0x3a0/0x420 [ 288.103757][ T8261] ? __fget_files+0x2a/0x420 [ 288.103786][ T8261] ksys_write+0x145/0x250 [ 288.103808][ T8261] ? __pfx_ksys_write+0x10/0x10 [ 288.103824][ T8261] ? rcu_is_watching+0x15/0xb0 [ 288.103852][ T8261] ? do_syscall_64+0xbe/0x3b0 [ 288.103880][ T8261] do_syscall_64+0xfa/0x3b0 [ 288.103901][ T8261] ? lockdep_hardirqs_on+0x9c/0x150 [ 288.103922][ T8261] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.103939][ T8261] ? clear_bhb_loop+0x60/0xb0 [ 288.103960][ T8261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.103976][ T8261] RIP: 0033:0x7f7aa238e929 [ 288.103992][ T8261] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 288.104007][ T8261] RSP: 002b:00007f7aa31ed038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 288.104027][ T8261] RAX: ffffffffffffffda RBX: 00007f7aa25b5fa0 RCX: 00007f7aa238e929 [ 288.104040][ T8261] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000005 [ 288.104051][ T8261] RBP: 00007f7aa31ed090 R08: 0000000000000000 R09: 0000000000000000 [ 288.104063][ T8261] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 288.104073][ T8261] R13: 0000000000000000 R14: 00007f7aa25b5fa0 R15: 00007fff4b6400e8 [ 288.104103][ T8261] [ 288.110521][ T8255] vhci_hcd vhci_hcd.0: Device attached [ 288.243965][ T8271] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 288.316187][ T5892] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 288.334945][ T8263] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(14) [ 288.394763][ T8263] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 288.394826][ T8266] vhci_hcd vhci_hcd.0: pdev(4) rhport(2) sockfd(17) [ 288.394844][ T8266] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 288.395344][ T5935] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 288.405784][ T8264] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 288.410552][ T8263] vhci_hcd vhci_hcd.0: Device attached [ 288.412477][ T8266] vhci_hcd vhci_hcd.0: Device attached [ 288.430456][ T5935] usb 2-1: device descriptor read/8, error -71 [ 288.448873][ T8255] vhci_hcd vhci_hcd.0: pdev(4) rhport(4) sockfd(16) [ 288.448906][ T8255] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 288.448982][ T8255] vhci_hcd vhci_hcd.0: Device attached [ 288.453873][ T8271] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(13) [ 288.453900][ T8271] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 288.453968][ T8271] vhci_hcd vhci_hcd.0: Device attached [ 288.461399][ T8255] vhci_hcd vhci_hcd.0: pdev(4) rhport(5) sockfd(19) [ 288.528871][ T8255] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 288.562764][ T8255] vhci_hcd vhci_hcd.0: Device attached [ 288.592913][ T8277] vhci_hcd: connection closed [ 288.593217][ T2995] vhci_hcd: stop threads [ 288.595419][ T8270] vhci_hcd: connection closed [ 288.598179][ T8276] vhci_hcd: connection closed [ 288.603686][ T8269] vhci_hcd: connection closed [ 288.607209][ T2995] vhci_hcd: release socket [ 288.618785][ T8258] vhci_hcd: connection closed [ 288.624009][ T8280] vhci_hcd: connection closed [ 288.636275][ T5892] usb 3-1: Using ep0 maxpacket: 32 [ 288.642825][ T2995] vhci_hcd: disconnect device [ 288.653192][ T2995] vhci_hcd: stop threads [ 288.668146][ T2995] vhci_hcd: release socket [ 288.669081][ T5892] usb 3-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 288.674573][ T5935] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 288.696012][ T2995] vhci_hcd: disconnect device [ 288.706449][ T2995] vhci_hcd: stop threads [ 288.708827][ T5892] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.710735][ T2995] vhci_hcd: release socket [ 288.719785][ T5892] usb 3-1: Product: syz [ 288.728751][ T5892] usb 3-1: Manufacturer: syz [ 288.732438][ T8259] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 288.739708][ T5935] usb 2-1: device descriptor read/8, error -71 [ 288.746801][ T8285] netlink: 8 bytes leftover after parsing attributes in process `syz.3.643'. [ 288.756022][ T5892] usb 3-1: SerialNumber: syz [ 288.778169][ T2995] vhci_hcd: disconnect device [ 288.783163][ T2995] vhci_hcd: stop threads [ 288.794463][ T2995] vhci_hcd: release socket [ 288.801824][ T2995] vhci_hcd: disconnect device [ 288.802822][ T5892] usb 3-1: config 0 descriptor?? [ 288.808429][ T2995] vhci_hcd: stop threads [ 288.818345][ T2995] vhci_hcd: release socket [ 288.822919][ T2995] vhci_hcd: disconnect device [ 288.828607][ T2995] vhci_hcd: stop threads [ 288.842661][ T2995] vhci_hcd: release socket [ 288.848215][ T2995] vhci_hcd: disconnect device [ 288.851181][ T5892] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 288.865229][ T24] vhci_hcd: vhci_device speed not set [ 288.870733][ T5935] usb usb2-port1: unable to enumerate USB device [ 288.954504][ T5860] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 289.106386][ T5860] usb 1-1: Using ep0 maxpacket: 16 [ 289.114167][ T5860] usb 1-1: config 0 has no interfaces? [ 289.125914][ T5860] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 289.135805][ T5860] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.143830][ T5860] usb 1-1: Product: syz [ 289.148075][ T5860] usb 1-1: Manufacturer: syz [ 289.152705][ T5860] usb 1-1: SerialNumber: syz [ 289.159686][ T5860] usb 1-1: config 0 descriptor?? [ 289.187077][ T5935] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 289.406764][ T5860] usb 1-1: USB disconnect, device number 11 [ 289.486877][ T5935] usb 4-1: New USB device found, idVendor=08ca, idProduct=0010, bcdDevice=90.d6 [ 289.543748][ T5935] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.086022][ T5892] gspca_stk1135: reg_w 0x3 err -110 [ 290.101843][ T5892] gspca_stk1135: serial bus timeout: status=0x00 [ 290.109111][ T5892] gspca_stk1135: Sensor write failed [ 290.113918][ T5935] usb 4-1: Product: syz [ 290.114816][ T5892] gspca_stk1135: serial bus timeout: status=0x00 [ 290.120979][ T5935] usb 4-1: Manufacturer: syz [ 290.129908][ T5892] gspca_stk1135: Sensor write failed [ 290.130743][ T5935] usb 4-1: SerialNumber: syz [ 290.183990][ T5935] usb 4-1: config 0 descriptor?? [ 290.198531][ T5935] aiptek 4-1:0.0: interface has no int in endpoints, but must have minimum 1 [ 290.219235][ T5892] gspca_stk1135: serial bus timeout: status=0x00 [ 290.225759][ T5892] gspca_stk1135: Sensor read failed [ 290.230997][ T5892] gspca_stk1135: serial bus timeout: status=0x00 [ 290.241004][ T5892] gspca_stk1135: Sensor read failed [ 290.246452][ T5892] gspca_stk1135: Detected sensor type unknown (0x0) [ 290.253100][ T5892] gspca_stk1135: serial bus timeout: status=0x00 [ 290.267544][ T5892] gspca_stk1135: Sensor read failed [ 290.272810][ T5892] gspca_stk1135: serial bus timeout: status=0x00 [ 290.279366][ T5892] gspca_stk1135: Sensor read failed [ 290.288563][ T5892] gspca_stk1135: serial bus timeout: status=0x00 [ 290.295103][ T5892] gspca_stk1135: Sensor write failed [ 290.300429][ T5892] gspca_stk1135: serial bus timeout: status=0x00 [ 290.311489][ T5892] gspca_stk1135: Sensor write failed [ 290.317236][ T5892] stk1135 3-1:0.0: probe with driver stk1135 failed with error -110 [ 290.404103][ T5892] usb 4-1: USB disconnect, device number 15 [ 290.491190][ T5939] usb usb42-port1: attempt power cycle [ 291.156816][ T5860] usb 3-1: USB disconnect, device number 5 [ 291.616270][ T5939] usb usb42-port1: unable to enumerate USB device [ 291.937064][ T5964] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 292.432775][ T8325] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(14) [ 292.439438][ T8325] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 292.515492][ T8321] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(11) [ 292.522124][ T8321] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 292.537304][ T8325] vhci_hcd vhci_hcd.0: Device attached [ 292.544086][ T8319] netlink: 8 bytes leftover after parsing attributes in process `syz.2.654'. [ 292.554013][ T8321] vhci_hcd vhci_hcd.0: Device attached [ 293.218294][ T8325] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 293.289738][ T8330] vhci_hcd vhci_hcd.0: pdev(0) rhport(3) sockfd(19) [ 293.296394][ T8330] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 293.351538][ T5964] usb 5-1: not running at top speed; connect to a high speed hub [ 293.395889][ T5964] usb 5-1: config 1 interface 0 altsetting 3 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 293.401626][ T8337] netlink: 8 bytes leftover after parsing attributes in process `syz.1.657'. [ 293.414210][ T5964] usb 5-1: config 1 interface 0 has no altsetting 0 [ 293.421965][ T8337] bond0: entered promiscuous mode [ 293.427911][ T8337] bond_slave_0: entered promiscuous mode [ 293.429814][ T8330] vhci_hcd vhci_hcd.0: Device attached [ 293.441115][ T8337] bond_slave_1: entered promiscuous mode [ 293.488288][ T5964] usb 5-1: New USB device found, idVendor=05ac, idProduct=0221, bcdDevice= 0.40 [ 293.499189][ T5964] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.499742][ T8321] vhci_hcd vhci_hcd.0: pdev(0) rhport(4) sockfd(13) [ 293.513830][ T8321] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 293.524451][ T5964] usb 5-1: Product: 喙Ềꦀ狼䑱̤靈촹ᨐ瘴렽맻㽚⾯걡荱䂽㰆탌⸞洭荘箲⊫䅹᪊䂜삿亝넱娭섴 [ 293.561087][ T8325] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(23) [ 293.567755][ T8325] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 293.575593][ T8344] netlink: 36 bytes leftover after parsing attributes in process `syz.3.658'. [ 293.587629][ T5964] usb 5-1: Manufacturer: င [ 293.592359][ T5964] usb 5-1: SerialNumber: ࠧ [ 293.592611][ T8321] vhci_hcd vhci_hcd.0: Device attached [ 293.614627][ T5939] usb 33-1: new low-speed USB device number 3 using vhci_hcd [ 293.675221][ T8337] bond0: left promiscuous mode [ 293.680274][ T8337] bond_slave_0: left promiscuous mode [ 293.703805][ T8337] bond_slave_1: left promiscuous mode [ 293.943306][ T8346] netlink: 452 bytes leftover after parsing attributes in process `syz.3.658'. [ 293.964592][ T8325] vhci_hcd vhci_hcd.0: Device attached [ 293.970591][ T8309] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 293.998955][ T8321] vhci_hcd vhci_hcd.0: pdev(0) rhport(5) sockfd(22) [ 294.005582][ T8321] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 294.016116][ T8321] vhci_hcd vhci_hcd.0: Device attached [ 294.061998][ T8335] vhci_hcd: connection closed [ 294.062081][ T8339] vhci_hcd: connection closed [ 294.067204][ T8341] vhci_hcd: connection closed [ 294.076614][ T2995] vhci_hcd: stop threads [ 294.076739][ T8347] vhci_hcd: connection closed [ 294.081328][ T2995] vhci_hcd: release socket [ 294.081450][ T2995] vhci_hcd: disconnect device [ 294.104718][ T8324] vhci_hcd: connection reset by peer [ 294.110151][ T8326] vhci_hcd: connection closed [ 294.136026][ T2995] vhci_hcd: stop threads [ 294.198901][ T2995] vhci_hcd: release socket [ 294.205323][ T2995] vhci_hcd: disconnect device [ 294.210273][ T2995] vhci_hcd: stop threads [ 294.215002][ T2995] vhci_hcd: release socket [ 294.219548][ T2995] vhci_hcd: disconnect device [ 294.225061][ T2995] vhci_hcd: stop threads [ 294.229324][ T2995] vhci_hcd: release socket [ 294.240424][ T2995] vhci_hcd: disconnect device [ 294.248266][ T2995] vhci_hcd: stop threads [ 294.252556][ T2995] vhci_hcd: release socket [ 294.259835][ T2995] vhci_hcd: disconnect device [ 294.269616][ T2995] vhci_hcd: stop threads [ 294.278758][ T2995] vhci_hcd: release socket [ 294.290861][ T2995] vhci_hcd: disconnect device [ 294.455195][ T8355] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 294.509163][ T8355] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 295.116866][ T8361] netlink: 36 bytes leftover after parsing attributes in process `syz.3.661'. [ 295.239579][ T8361] netlink: 452 bytes leftover after parsing attributes in process `syz.3.661'. [ 295.303360][ T5964] usbhid 5-1:1.0: can't add hid device: -71 [ 295.333892][ T5964] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 295.364154][ T5964] usb 5-1: USB disconnect, device number 25 [ 295.680343][ T8367] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 295.691228][ T8367] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 295.971460][ T8367] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 295.978243][ T8367] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 296.009035][ T8367] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 296.059234][ T8367] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 296.224600][ T8367] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 296.311656][ T8367] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 296.373869][ T8378] fuseblk: Unknown parameter 'dont_measure' [ 296.388879][ T8380] fuseblk: Unknown parameter 'dont_measure' [ 296.844516][ T5827] Bluetooth: hci3: unexpected event for opcode 0x6572 [ 297.022281][ T8388] 9pnet_fd: Insufficient options for proto=fd [ 297.148153][ T8395] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(11) [ 297.154815][ T8395] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 297.164548][ T8395] vhci_hcd vhci_hcd.0: Device attached [ 297.179856][ T8395] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(13) [ 297.186551][ T8395] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 297.195187][ T8395] vhci_hcd vhci_hcd.0: Device attached [ 297.215150][ T8395] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(15) [ 297.221798][ T8395] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 297.230382][ T8395] vhci_hcd vhci_hcd.0: Device attached [ 297.237863][ T8395] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 297.250542][ T8395] vhci_hcd vhci_hcd.0: pdev(3) rhport(4) sockfd(19) [ 297.257190][ T8395] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 297.266280][ T8395] vhci_hcd vhci_hcd.0: Device attached [ 297.274308][ T8395] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(21) [ 297.280956][ T8395] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 297.293917][ T8395] vhci_hcd vhci_hcd.0: Device attached [ 297.307274][ T8395] vhci_hcd vhci_hcd.0: pdev(3) rhport(5) sockfd(23) [ 297.313921][ T8395] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 297.328157][ T8395] vhci_hcd vhci_hcd.0: Device attached [ 297.341405][ T8411] vhci_hcd: connection closed [ 297.341721][ T8407] vhci_hcd: connection closed [ 297.347435][ T8404] vhci_hcd: connection closed [ 297.352617][ T8409] vhci_hcd: connection closed [ 297.358176][ T3514] vhci_hcd: stop threads [ 297.369678][ T8401] vhci_hcd: connection closed [ 297.370255][ T8397] vhci_hcd: connection closed [ 297.375829][ T3514] vhci_hcd: release socket [ 297.386704][ T3514] vhci_hcd: disconnect device [ 297.391760][ T3514] vhci_hcd: stop threads [ 297.399221][ T3514] vhci_hcd: release socket [ 297.403827][ T3514] vhci_hcd: disconnect device [ 297.410355][ T3514] vhci_hcd: stop threads [ 297.414916][ T5875] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 297.427552][ T8399] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 297.433976][ T3514] vhci_hcd: release socket [ 297.442927][ T3514] vhci_hcd: disconnect device [ 297.452235][ T3514] vhci_hcd: stop threads [ 297.459839][ T3514] vhci_hcd: release socket [ 297.467797][ T3514] vhci_hcd: disconnect device [ 297.476275][ T3514] vhci_hcd: stop threads [ 297.483788][ T3514] vhci_hcd: release socket [ 297.493950][ T3514] vhci_hcd: disconnect device [ 297.502146][ T3514] vhci_hcd: stop threads [ 297.510940][ T3514] vhci_hcd: release socket [ 297.520626][ T3514] vhci_hcd: disconnect device [ 297.604481][ T5827] Bluetooth: hci1: command 0x0406 tx timeout [ 298.014567][ T5827] Bluetooth: hci2: command 0x0406 tx timeout [ 298.245437][ T5827] Bluetooth: hci4: command 0x0405 tx timeout [ 298.434865][ T8427] netlink: 76 bytes leftover after parsing attributes in process `syz.2.679'. [ 298.525756][ T8430] netlink: 48 bytes leftover after parsing attributes in process `syz.0.681'. [ 298.547414][ T8430] netlink: 44 bytes leftover after parsing attributes in process `syz.0.681'. [ 298.756153][ T30] audit: type=1400 audit(1751135449.284:214): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=8429 comm="syz.0.681" daddr=::ffff:172.20.20.20 dest=20001 [ 298.794559][ T5939] vhci_hcd: vhci_device speed not set [ 298.921499][ T8440] netlink: 36 bytes leftover after parsing attributes in process `syz.4.684'. [ 299.684654][ T5827] Bluetooth: hci1: command 0x0406 tx timeout [ 300.056718][ T24] usb usb34-port1: attempt power cycle [ 300.084591][ T5827] Bluetooth: hci2: command 0x0406 tx timeout [ 300.261377][ T995] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.324483][ T5827] Bluetooth: hci4: command 0x0405 tx timeout [ 300.579528][ T8464] binder: 8462:8464 ioctl c0306201 0 returned -14 [ 300.647444][ T24] usb usb34-port1: unable to enumerate USB device [ 300.714660][ T30] audit: type=1400 audit(1751135451.244:215): lsm=SMACK fn=smk_ipv6_check action=denied subject="_" object="v." requested=w pid=8465 comm="syz.3.694" daddr=fe80::aa [ 300.739546][ T995] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.884906][ T8464] netlink: 92 bytes leftover after parsing attributes in process `syz.2.693'. [ 300.897315][ T8464] netlink: 40 bytes leftover after parsing attributes in process `syz.2.693'. [ 301.367562][ T8472] netlink: 92 bytes leftover after parsing attributes in process `syz.0.696'. [ 301.398492][ T8472] netlink: 40 bytes leftover after parsing attributes in process `syz.0.696'. [ 301.529287][ T995] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.594659][ T8475] netlink: 96 bytes leftover after parsing attributes in process `syz.3.698'. [ 301.665382][ T995] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.825600][ T5939] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 301.882491][ T5839] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 301.901299][ T5839] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 301.916131][ T5839] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 301.941683][ T5839] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 301.951527][ T5839] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 301.962892][ T995] bridge_slave_1: left allmulticast mode [ 301.970538][ T995] bridge_slave_1: left promiscuous mode [ 301.979108][ T995] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.993153][ T995] bridge_slave_0: left allmulticast mode [ 302.002392][ T995] bridge_slave_0: left promiscuous mode [ 302.004611][ T5939] usb 3-1: Using ep0 maxpacket: 16 [ 302.012841][ T995] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.094197][ T5939] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 302.180418][ T5939] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 302.255576][ T5939] usb 3-1: Product: syz [ 302.288693][ T5939] usb 3-1: Manufacturer: syz [ 302.333312][ T5939] usb 3-1: SerialNumber: syz [ 302.493105][ T5939] usb 3-1: config 0 descriptor?? [ 302.597376][ T5875] vhci_hcd: vhci_device speed not set [ 302.843491][ T5939] dvb_usb_dtv5100 3-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 302.916415][ T5939] usb 3-1: USB disconnect, device number 6 [ 303.139258][ T8501] syz.2.707: attempt to access beyond end of device [ 303.139258][ T8501] nbd2: rw=0, sector=0, nr_sectors = 2 limit=0 [ 408.524399][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 408.531414][ C1] rcu: 0-...!: (0 ticks this GP) idle=98e4/1/0x4000000000000000 softirq=29836/29836 fqs=0 [ 408.542316][ C1] rcu: (detected by 1, t=10502 jiffies, g=23769, q=164 ncpus=2) [ 408.550066][ C1] Sending NMI from CPU 1 to CPUs 0: [ 408.550107][ C0] NMI backtrace for cpu 0 [ 408.550126][ C0] CPU: 0 UID: 0 PID: 8500 Comm: syz.1.705 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 408.550145][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 408.550155][ C0] RIP: 0010:debug_deactivate+0x66/0x200 [ 408.550185][ C0] Code: 07 77 6d e8 1c ba 11 00 41 89 de c1 eb 06 48 8d 3c dd f0 df 9f 8f be 08 00 00 00 e8 74 15 73 00 31 f6 4c 0f a3 35 7a 4c f1 0d <0f> 92 c3 40 0f 92 c6 bf 02 00 00 00 e8 e9 bc 11 00 84 db 74 10 e8 [ 408.550197][ C0] RSP: 0018:ffffc90000007d18 EFLAGS: 00000047 [ 408.550212][ C0] RAX: ffffffff81ae9301 RBX: 0000000000000000 RCX: ffffffff81ae936c [ 408.550223][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9fdff0 [ 408.550239][ C0] RBP: ffffc90000007e90 R08: ffffffff8f9fdff7 R09: 1ffffffff1f3fbfe [ 408.550251][ C0] R10: dffffc0000000000 R11: fffffbfff1f3fbff R12: ffff88807014b340 [ 408.550262][ C0] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880b8627bc0 [ 408.550273][ C0] FS: 00007f74249496c0(0000) GS:ffff888125c84000(0000) knlGS:0000000000000000 [ 408.550287][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.550297][ C0] CR2: 0000200000004000 CR3: 000000005634c000 CR4: 00000000003526f0 [ 408.550311][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 408.550320][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 408.550329][ C0] Call Trace: [ 408.550337][ C0] [ 408.550349][ C0] __hrtimer_run_queues+0x2b0/0xc60 [ 408.550378][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 408.550396][ C0] ? read_tsc+0x9/0x20 [ 408.550417][ C0] hrtimer_interrupt+0x45b/0xaa0 [ 408.550448][ C0] __sysvec_apic_timer_interrupt+0x10b/0x410 [ 408.550470][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 408.550490][ C0] [ 408.550495][ C0] [ 408.550502][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 408.550517][ C0] RIP: 0010:finish_task_switch+0x26b/0x950 [ 408.550534][ C0] Code: 0f 84 3c 01 00 00 48 85 db 0f 85 63 01 00 00 e9 27 05 00 00 4c 8b 75 d0 4c 89 e7 e8 ff 98 d0 09 e8 5a fe 35 00 fb 4c 8b 65 c0 <49> 8d bc 24 18 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0 [ 408.550546][ C0] RSP: 0018:ffffc9001b8df698 EFLAGS: 00000282 [ 408.550559][ C0] RAX: 1530f539626d1c00 RBX: 0000000000000000 RCX: 1530f539626d1c00 [ 408.550569][ C0] RDX: 0000000000000000 RSI: ffffffff8d96e8fe RDI: ffffffff8be1bb80 [ 408.550580][ C0] RBP: ffffc9001b8df6f0 R08: ffffffff8f9fdff7 R09: 1ffffffff1f3fbfe [ 408.550591][ C0] R10: dffffc0000000000 R11: fffffbfff1f3fbff R12: ffff88802f710000 [ 408.550602][ C0] R13: dffffc0000000000 R14: ffff88801ced3c00 R15: ffff8880b863a9d8 [ 408.550622][ C0] ? finish_task_switch+0x266/0x950 [ 408.550641][ C0] __schedule+0x16aa/0x4cb0 [ 408.550667][ C0] ? schedule+0x165/0x360 [ 408.550685][ C0] ? __pfx___schedule+0x10/0x10 [ 408.550709][ C0] ? schedule+0x91/0x360 [ 408.550727][ C0] schedule+0x165/0x360 [ 408.550745][ C0] schedule_timeout+0x12b/0x270 [ 408.550761][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 408.550777][ C0] ? __pfx_process_timeout+0x10/0x10 [ 408.550799][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 408.550816][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 408.550835][ C0] snd_rawmidi_write+0x3a8/0xbd0 [ 408.550857][ C0] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 408.550871][ C0] ? __pfx_default_wake_function+0x10/0x10 [ 408.550888][ C0] ? __import_iovec+0x40e/0x7f0 [ 408.550911][ C0] ? bpf_lsm_file_permission+0x9/0x20 [ 408.550928][ C0] ? security_file_permission+0x75/0x290 [ 408.550947][ C0] ? rw_verify_area+0x258/0x650 [ 408.550965][ C0] vfs_writev+0x4b6/0x960 [ 408.550984][ C0] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 408.550999][ C0] ? __pfx_vfs_writev+0x10/0x10 [ 408.551024][ C0] ? __fget_files+0x2a/0x420 [ 408.551043][ C0] ? __fget_files+0x3a0/0x420 [ 408.551060][ C0] ? __fget_files+0x2a/0x420 [ 408.551080][ C0] do_writev+0x14d/0x2d0 [ 408.551099][ C0] ? __pfx_do_writev+0x10/0x10 [ 408.551115][ C0] ? rcu_is_watching+0x15/0xb0 [ 408.551137][ C0] ? do_syscall_64+0xbe/0x3b0 [ 408.551158][ C0] do_syscall_64+0xfa/0x3b0 [ 408.551176][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 408.551193][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.551207][ C0] ? clear_bhb_loop+0x60/0xb0 [ 408.551223][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.551243][ C0] RIP: 0033:0x7f7423b8e929 [ 408.551257][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 408.551269][ C0] RSP: 002b:00007f7424949038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 408.551283][ C0] RAX: ffffffffffffffda RBX: 00007f7423db5fa0 RCX: 00007f7423b8e929 [ 408.551294][ C0] RDX: 0000000000000002 RSI: 0000200000000840 RDI: 0000000000000006 [ 408.551304][ C0] RBP: 00007f7423c10b39 R08: 0000000000000000 R09: 0000000000000000 [ 408.551313][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 408.551322][ C0] R13: 0000000000000000 R14: 00007f7423db5fa0 R15: 00007ffe35c66058 [ 408.551341][ C0] [ 408.552093][ C1] rcu: rcu_preempt kthread starved for 10502 jiffies! g23769 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 409.064123][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 409.074190][ C1] rcu: RCU grace-period kthread stack dump: [ 409.080160][ C1] task:rcu_preempt state:R running task stack:27320 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 [ 409.093676][ C1] Call Trace: [ 409.096958][ C1] [ 409.099900][ C1] __schedule+0x16a2/0x4cb0 [ 409.104439][ C1] ? schedule+0x165/0x360 [ 409.108779][ C1] ? __pfx___schedule+0x10/0x10 [ 409.113658][ C1] ? schedule+0x91/0x360 [ 409.117911][ C1] schedule+0x165/0x360 [ 409.122091][ C1] schedule_timeout+0x12b/0x270 [ 409.126949][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 409.132329][ C1] ? preempt_schedule+0xae/0xc0 [ 409.137197][ C1] ? __pfx_process_timeout+0x10/0x10 [ 409.142503][ C1] ? prepare_to_swait_event+0x341/0x380 [ 409.148151][ C1] rcu_gp_fqs_loop+0x301/0x1540 [ 409.153030][ C1] ? __pfx_rcu_gp_init+0x10/0x10 [ 409.157976][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 409.163191][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 409.168482][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 409.173696][ C1] ? finish_swait+0xcd/0x1f0 [ 409.178299][ C1] rcu_gp_kthread+0x99/0x390 [ 409.182904][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 409.188110][ C1] ? __kthread_parkme+0x7b/0x200 [ 409.193056][ C1] ? __kthread_parkme+0x1a1/0x200 [ 409.198108][ C1] kthread+0x70e/0x8a0 [ 409.202189][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 409.207397][ C1] ? __pfx_kthread+0x10/0x10 [ 409.211998][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 409.217207][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 409.222412][ C1] ? __pfx_kthread+0x10/0x10 [ 409.227012][ C1] ret_from_fork+0x3fc/0x770 [ 409.231615][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 409.236744][ C1] ? __switch_to_asm+0x39/0x70 [ 409.241522][ C1] ? __switch_to_asm+0x33/0x70 [ 409.246288][ C1] ? __pfx_kthread+0x10/0x10 [ 409.250888][ C1] ret_from_fork_asm+0x1a/0x30 [ 409.255671][ C1] [ 409.258693][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 409.265021][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 409.276650][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 409.286706][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 409.292437][ C1] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 45 28 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 409.312048][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c6 [ 409.318121][ C1] RAX: f5b4303e21349200 RBX: ffffffff81974c68 RCX: f5b4303e21349200 [ 409.326102][ C1] RDX: 0000000000000001 RSI: ffffffff8d96e8fe RDI: ffffffff8be1bb80 [ 409.334077][ C1] RBP: ffffc90000197f20 R08: ffff8880b8732f5b R09: 1ffff110170e65eb [ 409.342078][ C1] R10: dffffc0000000000 R11: ffffed10170e65ec R12: ffffffff8f9fdff0 [ 409.350057][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff11003a5db40 [ 409.358034][ C1] FS: 0000000000000000(0000) GS:ffff888125d84000(0000) knlGS:0000000000000000 [ 409.367403][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 409.373989][ C1] CR2: 0000001b2fa0fff8 CR3: 000000005634c000 CR4: 00000000003526f0 [ 409.381966][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 409.389939][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 409.397917][ C1] Call Trace: [ 409.401204][ C1] [ 409.404138][ C1] default_idle+0x13/0x20 [ 409.408481][ C1] default_idle_call+0x74/0xb0 [ 409.413249][ C1] do_idle+0x1e8/0x510 [ 409.417336][ C1] ? __pfx_do_idle+0x10/0x10 [ 409.421953][ C1] cpu_startup_entry+0x44/0x60 [ 409.426730][ C1] start_secondary+0x101/0x110 [ 409.431502][ C1] common_startup_64+0x13e/0x147 [ 409.436466][ C1]