last executing test programs: 17.194007805s ago: executing program 2 (id=7525): epoll_create1(0x80000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x8040480) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, 0x0) socket(0x2b, 0x800, 0x7) gettid() socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205649, &(0x7f0000000100)={0x98f90a, 0x300, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f90a, 0x8000, '\x00', @ptr=0x20002000}}) socket$inet6_udp(0xa, 0x2, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000180)='FREEZING\x00', 0x9) r5 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r5, &(0x7f0000000400)={&(0x7f0000000000)=@in={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000280)='+', 0xff82}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000840000000000000007000300060000042000000000000000840000000200000003000b00fe7fffffff000000", @ANYRES32=0x0, @ANYBLOB="1800000000000000840000000500140030000000090a0000"], 0x50, 0x4014}, 0x2c0408d0) syz_80211_inject_frame(&(0x7f0000000040)=@broadcast, &(0x7f00000004c0)=ANY=[@ANYBLOB="30340800080211000001ffffffffffff505050"], 0x3a) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000140)) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/timer_list\x00', 0x0, 0x0) lseek(r6, 0x4000000007, 0x1) rmdir(0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)) 13.815382358s ago: executing program 0 (id=7537): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, r0) waitid(0x2, r0, 0x0, 0x8, 0x0) r1 = syz_open_procfs(r0, &(0x7f0000000080)='net/udp\x00') unlinkat(r1, &(0x7f0000000040)='./file0\x00', 0x0) 13.639370919s ago: executing program 2 (id=7539): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000e8840000007a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 13.431267361s ago: executing program 2 (id=7540): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000005f40)={0x0, 0x0, &(0x7f0000005f00)={&(0x7f0000000000)=@delchain={0x24, 0x65, 0x20, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x3, 0x1}, {0x0, 0xc}, {0x8, 0xfff9}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="a443fcd7770245fc989b50ea09817223dd9fac342f8f7c3d2cdcae3b14f82c974dc1", 0x22}], 0x1}, 0x6) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xa002, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) unshare(0x22020400) pselect6(0x40, &(0x7f0000000100)={0x0, 0x2000000000000, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0xfffffffffffffffe, 0x400000000000}, &(0x7f0000000180)={0x1f, 0x4, 0xffffffff, 0x7, 0x10000, 0x7, 0xfffffffffffffffe, 0x4}, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x400000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_SET_MSCBIT(r3, 0x40045568, 0x8) 13.339625987s ago: executing program 0 (id=7541): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) recvmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000004c0)=""/217, 0xd9}], 0x1, &(0x7f0000000600)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb0}, 0x40000000) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="ec0000001000fffc2abd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7d15040000000000b800128009000100766c616e00000000a800028006000500810000000c0002001b000000000000000c0002001200000011000000060001000200000006000100020000000c0002000200000012000000400003800c00010009000000040000000c00010001010000020000000c000100030000001b0300000c00010001000100080000000c00010000000100030000001c0004800c000100ef0c0000030000000c00010000000000040000000c000200030000000200000008000500", @ANYRES32], 0xec}, 0x1, 0x0, 0x0, 0x40}, 0x8000002) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x106f) socket$igmp6(0xa, 0x3, 0x2) 11.98121885s ago: executing program 0 (id=7546): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000000, 0x100010, r1, 0xa94000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x6, 0x0, 0x9, 0x401, 0x20000000000000aa, 0xfa11, 0x9}, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0xa00, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000001d00010000000000000000000a0010070000000000000000c59886589a705decad93c7b22e489614d5048b2cd317b846f849a94e5102efc7f6de1d6081bb0639c40b1a4731beaa99e2e590a5e71bf911f5f20a8d790a923fa7dc0191abc2635fd7939b1f03cab81f73c0c7c5903d63483ad7174155ddafee17"], 0x1c}}, 0x0) fsopen(&(0x7f0000000000)='autofs\x00', 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, &(0x7f0000000400)) socket$nl_netfilter(0x10, 0x3, 0xc) faccessat2(0xffffffffffffff9c, 0x0, 0x5, 0x300) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$mixer_OSS_GETVERSION(r4, 0x80086303, &(0x7f0000000000)) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="48000000100001042abd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7b01000001c80400280012800b00010062726964676500001800028005002a0000000002000023000800000000000000"], 0x48}, 0x1, 0x0, 0x0, 0x10000000}, 0x20040844) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$IOMMU_HWPT_INVALIDATE$TEST(0xffffffffffffffff, 0x3b8d, &(0x7f0000000040)={0x20, 0x0, 0x0, 0xdeadbeef, 0x8, 0xffffffc1}) ioctl$SNDRV_PCM_IOCTL_DRAIN(r3, 0x4144, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, './file0\x00'}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x2}) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, 0x0) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mknodat$null(r6, &(0x7f0000000200)='./file0/file0\x00', 0x100, 0x103) close_range(r8, r7, 0x0) 11.658846513s ago: executing program 2 (id=7549): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e1f, 0x2000003, @dev={0xfe, 0x80, '\x00', 0x23}}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='wg0\x00', 0xffffffffffffff61) r1 = socket$nl_route(0x10, 0x3, 0x0) io_setup(0x1, &(0x7f00000001c0)=0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/disk', 0x1, 0x40) io_submit(r2, 0x0, 0x0) r4 = syz_usb_connect$uac1(0x6, 0x0, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x4000000000000, 0x40, &(0x7f0000001540)=@raw={'raw\x00', 0x4001, 0x3, 0x1268, 0x0, 0x700001b, 0x148, 0x1100, 0x148, 0x11e0, 0x206, 0x240, 0x11e0, 0x240, 0x7fffffe, 0x0, {[{{@ip={@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xffffff00, 0xffffffff, 'ip6gretap0\x00', 'sit0\x00', {0xff}, {0xff}, 0x2f, 0x2, 0x46}, 0x1ea, 0x10d0, 0x10f0, 0x0, {0x390, 0x8f00}, [@common=@set={{}, {{0x4, [0x6, 0x7, 0x4, 0x4, 0x4, 0x1], 0x43, 0x4}}}, @common=@unspec=@cgroup1={{0x1030}, {0x1, 0x0, 0x1, 0x8, './cgroup.net/syz1\x00', 0x8, {0xffffffffffffff03}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x400, 0x0, 0xd4, 'pptp\x00', {0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x12f7) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYRESOCT=r4, @ANYRES16=r0, @ANYBLOB='.\x00'/16], 0x28}, 0x1, 0x0, 0x0, 0x20048050}, 0x40014) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRESOCT=r2, @ANYRESDEC=r3], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) syz_emit_ethernet(0x78, &(0x7f00000005c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000030800450c006a0069000002069078640100feac14467c78f04e22", @ANYRESHEX=r6, @ANYRES32=r5, @ANYBLOB="5cc2000090780000d588a19555f09e785b6df94cbad25fffceb7cf260926944d1c05dd05a9e7945b863795f8d9a28537790f754899dd004e4da2e55bb9d964e0427db6bcf6555929d25e"], 0x0) syz_emit_vhci(&(0x7f0000000140)=ANY=[], 0x7) syz_emit_ethernet(0x76, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000020800408c00000065000002a090780a0101016401010286000000000302004ae75eb7cffa8d623c710600cada1112c44b837c7b2cd0c22e3fb0740700f6e0000001e0000002ac1e0101ac14140dac1414aa0a010101e000000100fd61f5ab410a010100000007e0ac1e010100000008ffffffff000001ffac1e01010000000207007ee0000002640101008300e17f000001e0000002e0000002e000000164010101e00000024400a911ac1414bb7fffffff0007002eac14140dac1414aa7f000001ac1e0001ac1414bbe0000002ac14142ce00000020a01010100ac9496e0840ffdd55ff4f68b659857f340659965f13f739ba23ba20a7ffa7901e22903d5c8f8faf742d43b447c33c2b11a7a7fd5835e67a8341916e6c417033531b35297f0b8e0f08b51d443f5bcd5e26572148f81b36ead47bc6ec2e30799478c5ba25acbdc87f92ddb671bfd8348b965e596c46d3358963640d37e4367add47c7b3a344cd737911f02d103f0cd4842ae571d1f9c8667f79ad13c221f41a07939d2be8fa718ea5e65118f7c4dca8f23bbd39377b4ec76932f1e9a72d545dee1f9b3c9a4b2"], 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000100), 0x28041, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x4000000000) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r10, 0x401054d6, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f00000000c0)="0f781866b94d0b00000f320f01b1f07fdfdc0f01cb66b9600a00000f32b818000f00d82ef20f38f0303ead0f01c2", 0x2e}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f00000002c0)={0x4, 0x0, [{0x488, 0x0, 0x100000000004}, {0xb88, 0x0, 0x7f}, {0x842, 0x0, 0x3}, {0xa63, 0x0, 0x3}]}) r12 = syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_QUERYCTRL(r12, 0xc0445624, &(0x7f0000000040)={0x8098fd08, 0x274, "60055808b4000000000000000080009ab67e1db9c8a431078d40f722e600", 0xb5ce}) 7.383064422s ago: executing program 4 (id=7556): r0 = syz_open_dev$dri(&(0x7f0000000000), 0xabd7, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f00000021c0)={0x1, 0x0, &(0x7f0000002180)=[0x0]}) ioctl$DRM_IOCTL_MODE_GETPROPBLOB(r0, 0xc01064ac, &(0x7f0000002300)={r1, 0x0, 0x0}) 7.346299753s ago: executing program 4 (id=7557): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="60000a0002060108000000000000000005000003050005000a000000050001000700000005000400000000000900020073797a310000000014000300686173683a69702c706f72742c697000140007800800064000000200080008"], 0x60}, 0x1, 0x0, 0x0, 0x90}, 0x40c0) 7.168804295s ago: executing program 4 (id=7558): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x41555856, 0x0, 0x0, 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, 0x0) r2 = openat$udambuf(0xffffff9c, &(0x7f0000000200), 0x2) ioctl$UDMABUF_CREATE_LIST(r2, 0x40087543, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32]) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00009ab000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) bind$alg(0xffffffffffffffff, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'rfc3686(ctr(camellia))\x00'}, 0x58) setsockopt$inet_sctp6_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30bc, 0x0, 0x2, 0x15d}, &(0x7f00000002c0)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000003e040000000000003f040100000000005504000001ed0aff9404010017ffffffbf040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9e104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f1300010000949b3aab06b1e042ff2164d80c8ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1e0600bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee6330000000000000000000000000000000000004000000000000000038600008fb854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8265e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb66701f4578ba4cb9b706e605a88c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f6a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cf026657a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2cccb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400090300000021911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a8f01bc4b73cc31df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21c24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a3c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d68000000000099347593f67da85d1c962bfb320d1553a74ec3bf003ba62b1784dbf0168a7e85f28b77bdebce96bf386a6dd5df162a16f2b7e8a4de0ffc464a87f91f81866d2ef0af71ebb07a739c3cb1b7000000000000"], &(0x7f00000001c0)='GPL\x00'}, 0x48) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x2a, &(0x7f00000004c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r12, 0x4800, 0x55007}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r12, 0x1bf5b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5}]}}}]}, 0x3c}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100000000000300000003000000580001800d00010075a6063a7379"], 0x6c}}, 0x0) r14 = socket$inet6_tcp(0xa, 0x1, 0x0) r15 = dup(r14) syz_ublk_setup_queues(r15, r7, &(0x7f0000000180)={0x0, 0x1, 0x1, 0x1, 0x257}, &(0x7f0000000680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x1, 0x2000, 0x10000004, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe0a4, 0x80000, 0x6, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x8000, 0x0, 0x8080362, 0x0, r15}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x7b, 0x0, 0x0}}, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r15, 0x0, 0x81, &(0x7f0000000400)={'nat\x00', 0x0, 0x4, 0xf, [0x6, 0x6, 0x58b, 0x0, 0x2, 0xfffffffffffffff8], 0x2, &(0x7f0000000000)=[{}, {}], &(0x7f00000000c0)=""/15}, &(0x7f0000000500)=0x78) 3.375841232s ago: executing program 3 (id=7560): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001800)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000140)="2f045ee5fe9249ed05b0ec37a721ec81ab367c04eced1ffc7fbe3af84e19dbc6046b923619a06e0b6ae2ebf0ab657d32cff916f0e3da24e4f26306f1c4527a44d729802f3e43485391176c630b0880ed637f5d351048b4203d62b3d96114252d70b4dd8bad5a321aa399", 0x6a}, {&(0x7f00000001c0)="2cf70e049d7ca10c2baa62463c54f8109cb8795a3d7b326bb81c6bc290875437b4a5a3bcbd199c2cbdd4a149005a94946713c9081c76822a626d60fcfac2830c3f1d48ca7bdc14c329b2602e5bb1e920ceeb1a30", 0x54}, {&(0x7f0000000380)}], 0x3}}, {{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000500)="391adf0e4ffc9d2b4e6681c97cb814e1d683fd7065b082e42549b6aac265d8f06fc74d6d2b95f827098a17bbab52d616469f034f5d955822d906343ab344782016e80fd7adb151", 0x47}, {&(0x7f00000005c0)="eb8a7649f11eee0c8a704e458b76ad37e1361c43b4078ae926cbf9f823f27bdb489f6255019cad0e6f95137d3fcf", 0x2e}, {&(0x7f0000000780)="2fd4cf47433cc832f7b9287f69f290312b728f0301db30fe42e0111c154e4f1cc54bdb7ebc984a090c727b33abe6f725c536d2399324bd7638461683b158b64c52908231fcb154449b4b006264288e06b92515a685f214020f7500bc89ee18805e22a030c25f1a2a9c3705eef0ca40beb97c799a4002269020c7c12e4f93d7dd822eb42ca542bf7cffc36de4e561fb13629158facaf1ede872cb5d242592b763a06cda9da620892350c59b3580054f2cef3416e47adfd7347bbe95903fa873fd7fee7e7e8c22d8b2ff575a", 0xcb}, {&(0x7f0000000880)="fa8f73530bdc6839cbd7de2c3cfdf1eda862656f65d5d0c4c2844e668b2a9c3003a5b2dc3dd324d843512a5791747534054eb682e05b38c2d19db77d13ec6bbee3da919aa8147271b5612c545cf95483beb486531e1289271e9570708af6a5f7263238f654704ccd4235ee47f8511e5e3fe7c89d3bf43af863590301f1ef78", 0x7f}, {&(0x7f0000000a40)="8a0e0f88ac", 0x5}, {&(0x7f0000000a80)="0e5f5a2ebf89", 0x6}], 0x6}}, {{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000b80)="5f13081d2750e4f83f8aaab231f88648f9c9e87e18e46ab9208a4d73c12e76e97444d96d1ebcc0b0aa6b49eb770956bde3127e54e348b02f", 0x38}], 0x1}}, {{&(0x7f0000000cc0)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000000dc0)=[{&(0x7f0000000d00)="736ecdd03b3937767fb82186dbda22c1200098cb486edd05ac88cf8c55717a30a2aa0dab40047756fbceec218470121af7f9934da3905f7fc4caad11bbf2db81c6462513a516da69f191e95538089f0d7717c9c1820c346dc35dacbeb6702094dadf302e9187e767f69c671c1b2f517308f512744852fd75edff69df", 0x7c}, {&(0x7f0000000d80)="ec008fdc8d2e6f8167e70b7173e464c9f5d825e803f7ff71", 0x18}], 0x2, &(0x7f0000000ec0)}}, {{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000001000)="a3e52c39765c8c792d36b1ac778d0c400244d38bd28936afd3dec9954548e60db10ba3bad3eb30dfa68747b776550895f5aff818eb4b6f74182be274e6cb67184e321d6f7e59b2cc3ace646baf9b6cd5c9cedf032a09f7ca1029b7fd0fd92332290a385a8c84f2f438d1c5ca31a21d086dce6913142053acfbdacf70c28d2c44e5d81d92f5e5c9fa53b531ffb1284da81d074eadb09b76a7fff33f9b34cfaffff031d2d75a163f69b708d627e08ff5570e943304faa60966bc9d9b70f5c8138d0d2aa04d47f9f49741bf6bcdd4c68eebf6b5d62dc43b74cf", 0xd8}, {&(0x7f0000001100)="75619ba9b63af95745741a7167ca1c6679d83b202eefa6dc7a5eec0dfe04ea78263ad3d4272a1d707f17976212eb03d419e2adc073b16437f374d3cd3b6f7718fcf2aeed196dde83e668def7840db0d319c7ccf58bde50fe137d1de465875c8bd2aa2cd9c100dfe6c353b02ff314dbed4b08fd40d65c1364a08ed9ca28ce3bdaa88c77945aec718de9e6f793256366da40bd3949ed0a162c747f979f5ad6bdaf8d9230a6a294dbf3330b81f715b1ef502a434a85", 0xb4}, {&(0x7f00000011c0)="da02d6f5505c2587ed4cb3656c40aefe7037a4e2e157ef1ffd6c36986d63c6cf8db41f42a2d02b09e37c75fbdb3f50108e5d5d135440a4cde064d28c9c30b8c59ebfcf1b3804b16606a289938e5d310359fb8ca279e501d6edc0c7b4cc2419f0bf92a5aea2e8b60b95ffd2c82d9932a22d7a8eb2346247776a523a5d0066bd5f7869e4d24bf30e366fb39c5c3091e615339a415b3efcf073205576f86fdc7e98a12fff979ba11c76a43e889e9bd44ae74e058b5e8e2d8028521a084e135600b4c3e6770b8ff8e26dbd3a010ed5e3bb894cdbfd1b53f85f80", 0xd8}, {&(0x7f00000012c0)="99b8979ec0fd5f721da667032cfc1f89a347faf9add0ff5faf7646e11e7526e29ac69c528df4de7e7bf50f40936336f6ab62d3b3e3", 0x35}, {&(0x7f0000001300)="88c28a2a8af39ce81f3b350e8d029b409bacf181a71c0d4559cb976dff2a1a381136daa1f0d4151e9203490eb924a37eb0c0501b733da3f2fed08209d65894a599168cb9e265b8cad73cac6480b00997024978d84171219077b3bd", 0x5b}, {&(0x7f0000001380)="19a8e41759f18c32758fc71f3c2d66a728219818f0ffe3e8601b4deb0e905eacc062d86a8cb2790444792b482646bd43f7d5b62bad22a5e981f01fafa9d5d5dd164970fe66bd83ef7c79a8cc8a7a2761acf1985d9318f84e8deddc763e737033da7dd91e7afbb686a0e8c2828747f37cc0aeca57c26f787cdb0023b2267521a6663e6aa1b317d646c4eb7e2f254bf8c04e1d4314fda26cf01f52bc5cc77b3850478fae6e0aea2ede6b343681bfe61884d63326b190c6043280147c7928a79c77e892d4c110585b", 0xc7}, {&(0x7f0000001480)="8e47d5ad9a73a9b1d76b0d98507e6646c535982501ec2f2475c6723f6c9d81ed7780965ae4d82e89f5f53b13a72f181d3617eaaad5b755ec785a39", 0x3b}], 0x7}}, {{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f00000016c0)="7e8e8941827e99d258271d4d2b0e7660010d61882519e06baa1a850606a2a3942c504b347aa23e34b74b8020c507441738596c2678ad71f8f1996adbe1b3e3f20085944878b7fed8f89226553337ea273b74b41528705e42b6fcc6f430fc833ababd39877a2bc2c315f22796ff5871e6", 0x70}], 0x1}}], 0x6, 0x4000000) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 3.318919146s ago: executing program 0 (id=7561): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x85, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x833, 0x0, 0x4, 0xfc}, &(0x7f00000001c0)=0x9c) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x21, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_flash={0x33, 0xea5, '.\x00'}}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=@newlink={0x48, 0x10, 0x439, 0x0, 0x5fffd, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x8, 0x6, @dev={0xac, 0x14, 0x14, 0x30}}, @IFLA_GRE_REMOTE={0x8, 0x7, @multicast1}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x1fe}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20044080}, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x3}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r8 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x350}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, &(0x7f0000000680)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r8, 0x2219, 0x7721, 0x16, 0x0, 0x0) 3.18928774s ago: executing program 3 (id=7562): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@local, 0x4e23, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x9, 0xa00, 0x40800000000000, 0x800000000000000}, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) (fail_nth: 9) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000a40)=@migrate={0xa0, 0x21, 0x1, 0x3a, 0xfffffffc, {{@in6=@private2, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0xfffc, 0x0, 0x2, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x50, 0x11, [{@in6=@mcast2, @in6=@private0, @in6=@remote, @in=@broadcast, 0x6c, 0x1, 0x0, 0x0, 0xa, 0x2}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x0) 3.182433931s ago: executing program 2 (id=7563): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r1 = socket$can_bcm(0x1d, 0x2, 0x2) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000380)={0x1d, r3, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, r4, 0x0) preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r5 = io_uring_setup(0x521, &(0x7f0000000100)={0x0, 0x7fc1, 0x4000, 0xfffffffd, 0x20002f7, 0x0, r4}) r6 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) syz_usb_control_io$printer(r6, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r7, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) sendmsg(r1, &(0x7f0000000500)={&(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e21, @multicast1}, 0x75c, 0x1, 0x3, 0x3}}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000280)="b778adb75cf9f8f576dac2541c7dc63ee47690d2a0b6970d4d2107bac6b0ad134bef404e715ef89fb01e57", 0x2b}], 0x1, &(0x7f00000003c0)=[{0x48, 0x110, 0x7, "8b0ba5546e9034ac7f21c66234b9a457bc2c48094061553063ad6c66471d113e334d4cec430146b949dee87e156e24e63646237241e2c090"}, {0x60, 0x114, 0x800, "ac03b4e9997b723110ad6c58f54960812c14969dd6282465cfa7e77d377e10ee05d6ef2562beb244f9c2e49c8a87699296b8c22c2ceb487e33dc0e0d4de147a8a259c2eaef6fb7fda77be81fbf68dc"}, {0x98, 0x116, 0x9, "d5b1feb3f7c575eafdfa86869f0d2386f7e4819dd159bdd6e5bad004ab85d1369f78f76f1f7cf6cef7b5bdd4841dcf6c29443347b34d6c650e1f447162825ef2423fc43f14f509164db86246235907d59ae6c0afcdcec2926e549c1f595651238c75c09d406f6478e369dcc8b38d4e86bd4de92ad345d2d2293a35ab62e926a755eeb1e3d58941df"}], 0x140}, 0x40000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) io_uring_enter(r5, 0x2219, 0x4be2, 0x16, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='vegas', 0x5) r8 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r8, &(0x7f0000000080)={0x0, 0xfffffeaf, &(0x7f0000000040)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="4c00000012000103000000000b0000000000ffff4e230000000000000000000081000000000000f701000000fdffffff0000010000000000", @ANYRES32=0x0, @ANYBLOB="0000a37bc4d24bfede"], 0x4c}, 0x1, 0x0, 0x0, 0x20044190}, 0x40000) 2.402912521s ago: executing program 3 (id=7564): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000100)=ANY=[], 0xfdef) 2.384983394s ago: executing program 4 (id=7565): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001800)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000500)="391adf0e4ffc9d2b4e6681c97cb814e1d683fd7065b082e42549b6aac265d8f06fc74d6d2b95f827098a17bbab52d616469f034f5d955822d906343ab344782016e80fd7adb151", 0x47}, {&(0x7f00000005c0)="eb8a7649f11eee0c8a704e458b76ad37e1361c43b4078ae926cbf9f823f27bdb489f6255019cad0e6f95137d3fcf", 0x2e}, {&(0x7f0000000780)="2fd4cf47433cc832f7b9287f69f290312b728f0301db30fe42e0111c154e4f1cc54bdb7ebc984a090c727b33abe6f725c536d2399324bd7638461683b158b64c52908231fcb154449b4b006264288e06b92515a685f214020f7500bc89ee18805e22a030c25f1a2a9c3705eef0ca40beb97c799a4002269020c7c12e4f93d7dd822eb42ca542bf7cffc36de4e561fb13629158facaf1ede872cb5d242592b763a06cda9da620892350c59b3580054f2cef3416e47adfd7347bbe95903fa873fd7fee7e7e8c22d8b2ff575a", 0xcb}, {&(0x7f0000000880)="fa8f73530bdc6839cbd7de2c3cfdf1eda862656f65d5d0c4c2844e668b2a9c3003a5b2dc3dd324d843512a5791747534054eb682e05b38c2d19db77d13ec6bbee3da919aa8147271b5612c545cf95483beb486531e1289271e9570708af6a5f7263238f654704ccd4235ee47f8511e5e3fe7c89d3bf43af863590301f1ef78", 0x7f}, {&(0x7f0000000a40)="8a0e0f88ac", 0x5}, {&(0x7f0000000a80)="0e5f5a2ebf89", 0x6}], 0x6}}, {{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000b80)="5f13081d2750e4f83f8aaab231f88648f9c9e87e18e46ab9208a4d73c12e76e97444d96d1ebcc0b0aa6b49eb770956bde3127e54e348b02f", 0x38}], 0x1}}, {{&(0x7f0000000cc0)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000000dc0)=[{&(0x7f0000000d00)="736ecdd03b3937767fb82186dbda22c1200098cb486edd05ac88cf8c55717a30a2aa0dab40047756fbceec218470121af7f9934da3905f7fc4caad11bbf2db81c6462513a516da69f191e95538089f0d7717c9c1820c346dc35dacbeb6702094dadf302e9187e767f69c671c1b2f517308f512744852fd75edff69df", 0x7c}, {&(0x7f0000000d80)="ec008fdc8d2e6f8167e70b7173e464c9f5d825e803f7ff71", 0x18}], 0x2, &(0x7f0000000ec0)}}, {{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000001000)="a3e52c39765c8c792d36b1ac778d0c400244d38bd28936afd3dec9954548e60db10ba3bad3eb30dfa68747b776550895f5aff818eb4b6f74182be274e6cb67184e321d6f7e59b2cc3ace646baf9b6cd5c9cedf032a09f7ca1029b7fd0fd92332290a385a8c84f2f438d1c5ca31a21d086dce6913142053acfbdacf70c28d2c44e5d81d92f5e5c9fa53b531ffb1284da81d074eadb09b76a7fff33f9b34cfaffff031d2d75a163f69b708d627e08ff5570e943304faa60966bc9d9b70f5c8138d0d2aa04d47f9f49741bf6bcdd4c68eebf6b5d62dc43b74cf", 0xd8}, {&(0x7f0000001100)="75619ba9b63af95745741a7167ca1c6679d83b202eefa6dc7a5eec0dfe04ea78263ad3d4272a1d707f17976212eb03d419e2adc073b16437f374d3cd3b6f7718fcf2aeed196dde83e668def7840db0d319c7ccf58bde50fe137d1de465875c8bd2aa2cd9c100dfe6c353b02ff314dbed4b08fd40d65c1364a08ed9ca28ce3bdaa88c77945aec718de9e6f793256366da40bd3949ed0a162c747f979f5ad6bdaf8d9230a6a294dbf3330b81f715b1ef502a434a85", 0xb4}, {&(0x7f00000011c0)="da02d6f5505c2587ed4cb3656c40aefe7037a4e2e157ef1ffd6c36986d63c6cf8db41f42a2d02b09e37c75fbdb3f50108e5d5d135440a4cde064d28c9c30b8c59ebfcf1b3804b16606a289938e5d310359fb8ca279e501d6edc0c7b4cc2419f0bf92a5aea2e8b60b95ffd2c82d9932a22d7a8eb2346247776a523a5d0066bd5f7869e4d24bf30e366fb39c5c3091e615339a415b3efcf073205576f86fdc7e98a12fff979ba11c76a43e889e9bd44ae74e058b5e8e2d8028521a084e135600b4c3e6770b8ff8e26dbd3a010ed5e3bb894cdbfd1b53f85f80", 0xd8}, {&(0x7f00000012c0)="99b8979ec0fd5f721da667032cfc1f89a347faf9add0ff5faf7646e11e7526e29ac69c528df4de7e7bf50f40936336f6ab62d3b3e3", 0x35}, {&(0x7f0000001300)="88c28a2a8af39ce81f3b350e8d029b409bacf181a71c0d4559cb976dff2a1a381136daa1f0d4151e9203490eb924a37eb0c0501b733da3f2fed08209d65894a599168cb9e265b8cad73cac6480b00997024978d84171219077b3bd", 0x5b}, {&(0x7f0000001380)="19a8e41759f18c32758fc71f3c2d66a728219818f0ffe3e8601b4deb0e905eacc062d86a8cb2790444792b482646bd43f7d5b62bad22a5e981f01fafa9d5d5dd164970fe66bd83ef7c79a8cc8a7a2761acf1985d9318f84e8deddc763e737033da7dd91e7afbb686a0e8c2828747f37cc0aeca57c26f787cdb0023b2267521a6663e6aa1b317d646c4eb7e2f254bf8c04e1d4314fda26cf01f52bc5cc77b3850478fae6e0aea2ede6b343681bfe61884d63326b190c6043280147c7928a79c77e892d4c110585b", 0xc7}, {&(0x7f0000001480)="8e47d5ad9a73a9b1d76b0d98507e6646c535982501ec2f2475c6723f6c9d81ed7780965ae4d82e89f5f53b13a72f181d3617eaaad5b755ec785a39", 0x3b}], 0x7}}, {{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f00000016c0)="7e8e8941827e99d258271d4d2b0e7660010d61882519e06baa1a850606a2a3942c504b347aa23e34b74b8020c507441738596c2678ad71f8f1996adbe1b3e3f20085944878b7fed8f89226553337ea273b74b41528705e42b6fcc6f430fc833ababd39877a2bc2c315f22796ff5871e6", 0x70}], 0x1}}], 0x5, 0x4000000) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 2.268394691s ago: executing program 0 (id=7566): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x28, r1, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="34e14593325e"}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4004000) (fail_nth: 9) 2.180004883s ago: executing program 3 (id=7567): syz_usb_connect(0x0, 0x36, &(0x7f0000000e80)=ANY=[@ANYBLOB="1201000068e04d206f0e2c586831010203010902240001000000000904000002ff47d000090509e7020080000409059b1746", @ANYBLOB], 0x0) socket$inet(0x2, 0x2, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) 1.798879864s ago: executing program 0 (id=7569): openat$apparmor_thread_exec(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) io_setup(0x9, &(0x7f0000000740)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ustat(0x7f, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e5876e4040200516940a0000000109022400010000000009040000025883b2000905850140000000000905"], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000100), 0x383201, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r3, 0x4018aee1, &(0x7f0000000180)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000140)=0x7fff}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r6 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r6, 0x6000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r4, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) pipe(&(0x7f00000000c0)) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) 1.798691442s ago: executing program 1 (id=7570): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = landlock_create_ruleset(&(0x7f0000000080)={0x1100}, 0x30, 0x0) landlock_restrict_self(r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) r2 = getpid() capset(&(0x7f0000000000)={0x20071026, r2}, 0x0) fcntl$getflags(r0, 0x40a) syz_open_procfs$userns(r2, &(0x7f0000000100)) renameat2(r1, &(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000200)='.\x02\x00', 0x4) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f00000000c0), 0x4) renameat2(r1, &(0x7f0000000000)='.\x02\x00', r1, &(0x7f0000000140)='./file0\x00', 0x2) 1.720778427s ago: executing program 1 (id=7571): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42, 0x0) close(r1) ioctl$TUNSETLINK(r0, 0x400454cd, 0x118) socket$kcm(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) write$cgroup_devices(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1b2386dd"], 0xffdd) 1.517367044s ago: executing program 1 (id=7572): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001800)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000140)="2f045ee5fe9249ed05b0ec37a721ec81ab367c04eced1ffc7fbe3af84e19dbc6046b923619a06e0b6ae2ebf0ab657d32cff916f0e3da24e4f26306f1c4527a44d729802f3e43485391176c630b0880ed637f5d351048b4203d62b3d96114252d70b4dd8bad5a321aa399", 0x6a}, {&(0x7f00000001c0)="2cf70e049d7ca10c2baa62463c54f8109cb8795a3d7b326bb81c6bc290875437b4a5a3bcbd199c2cbdd4a149005a94946713c9081c76822a626d60fcfac2830c3f1d48ca7bdc14c329b2602e5bb1e920ceeb1a30", 0x54}, {&(0x7f0000000380)}], 0x3}}, {{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000500)="391adf0e4ffc9d2b4e6681c97cb814e1d683fd7065b082e42549b6aac265d8f06fc74d6d2b95f827098a17bbab52d616469f034f5d955822d906343ab344782016e80fd7adb151", 0x47}, {&(0x7f00000005c0)="eb8a7649f11eee0c8a704e458b76ad37e1361c43b4078ae926cbf9f823f27bdb489f6255019cad0e6f95137d3fcf", 0x2e}, {&(0x7f0000000780)="2fd4cf47433cc832f7b9287f69f290312b728f0301db30fe42e0111c154e4f1cc54bdb7ebc984a090c727b33abe6f725c536d2399324bd7638461683b158b64c52908231fcb154449b4b006264288e06b92515a685f214020f7500bc89ee18805e22a030c25f1a2a9c3705eef0ca40beb97c799a4002269020c7c12e4f93d7dd822eb42ca542bf7cffc36de4e561fb13629158facaf1ede872cb5d242592b763a06cda9da620892350c59b3580054f2cef3416e47adfd7347bbe95903fa873fd7fee7e7e8c22d8b2ff575a", 0xcb}, {&(0x7f0000000880)="fa8f73530bdc6839cbd7de2c3cfdf1eda862656f65d5d0c4c2844e668b2a9c3003a5b2dc3dd324d843512a5791747534054eb682e05b38c2d19db77d13ec6bbee3da919aa8147271b5612c545cf95483beb486531e1289271e9570708af6a5f7263238f654704ccd4235ee47f8511e5e3fe7c89d3bf43af863590301f1ef78", 0x7f}, {&(0x7f0000000a40)="8a0e0f88ac", 0x5}, {&(0x7f0000000a80)="0e5f5a2ebf89", 0x6}], 0x6}}, {{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000b80)="5f13081d2750e4f83f8aaab231f88648f9c9e87e18e46ab9208a4d73c12e76e97444d96d1ebcc0b0aa6b49eb770956bde3127e54e348b02f", 0x38}], 0x1}}, {{&(0x7f0000000cc0)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000000dc0)=[{&(0x7f0000000d00)="736ecdd03b3937767fb82186dbda22c1200098cb486edd05ac88cf8c55717a30a2aa0dab40047756fbceec218470121af7f9934da3905f7fc4caad11bbf2db81c6462513a516da69f191e95538089f0d7717c9c1820c346dc35dacbeb6702094dadf302e9187e767f69c671c1b2f517308f512744852fd75edff69df", 0x7c}, {&(0x7f0000000d80)="ec008fdc8d2e6f8167e70b7173e464c9f5d825e803f7ff71", 0x18}], 0x2, &(0x7f0000000ec0)}}, {{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000001000)="a3e52c39765c8c792d36b1ac778d0c400244d38bd28936afd3dec9954548e60db10ba3bad3eb30dfa68747b776550895f5aff818eb4b6f74182be274e6cb67184e321d6f7e59b2cc3ace646baf9b6cd5c9cedf032a09f7ca1029b7fd0fd92332290a385a8c84f2f438d1c5ca31a21d086dce6913142053acfbdacf70c28d2c44e5d81d92f5e5c9fa53b531ffb1284da81d074eadb09b76a7fff33f9b34cfaffff031d2d75a163f69b708d627e08ff5570e943304faa60966bc9d9b70f5c8138d0d2aa04d47f9f49741bf6bcdd4c68eebf6b5d62dc43b74cf", 0xd8}, {&(0x7f0000001100)="75619ba9b63af95745741a7167ca1c6679d83b202eefa6dc7a5eec0dfe04ea78263ad3d4272a1d707f17976212eb03d419e2adc073b16437f374d3cd3b6f7718fcf2aeed196dde83e668def7840db0d319c7ccf58bde50fe137d1de465875c8bd2aa2cd9c100dfe6c353b02ff314dbed4b08fd40d65c1364a08ed9ca28ce3bdaa88c77945aec718de9e6f793256366da40bd3949ed0a162c747f979f5ad6bdaf8d9230a6a294dbf3330b81f715b1ef502a434a85", 0xb4}, {&(0x7f00000011c0)="da02d6f5505c2587ed4cb3656c40aefe7037a4e2e157ef1ffd6c36986d63c6cf8db41f42a2d02b09e37c75fbdb3f50108e5d5d135440a4cde064d28c9c30b8c59ebfcf1b3804b16606a289938e5d310359fb8ca279e501d6edc0c7b4cc2419f0bf92a5aea2e8b60b95ffd2c82d9932a22d7a8eb2346247776a523a5d0066bd5f7869e4d24bf30e366fb39c5c3091e615339a415b3efcf073205576f86fdc7e98a12fff979ba11c76a43e889e9bd44ae74e058b5e8e2d8028521a084e135600b4c3e6770b8ff8e26dbd3a010ed5e3bb894cdbfd1b53f85f80", 0xd8}, {&(0x7f00000012c0)="99b8979ec0fd5f721da667032cfc1f89a347faf9add0ff5faf7646e11e7526e29ac69c528df4de7e7bf50f40936336f6ab62d3b3e3", 0x35}, {&(0x7f0000001300)="88c28a2a8af39ce81f3b350e8d029b409bacf181a71c0d4559cb976dff2a1a381136daa1f0d4151e9203490eb924a37eb0c0501b733da3f2fed08209d65894a599168cb9e265b8cad73cac6480b00997024978d84171219077b3bd", 0x5b}, {&(0x7f0000001380)="19a8e41759f18c32758fc71f3c2d66a728219818f0ffe3e8601b4deb0e905eacc062d86a8cb2790444792b482646bd43f7d5b62bad22a5e981f01fafa9d5d5dd164970fe66bd83ef7c79a8cc8a7a2761acf1985d9318f84e8deddc763e737033da7dd91e7afbb686a0e8c2828747f37cc0aeca57c26f787cdb0023b2267521a6663e6aa1b317d646c4eb7e2f254bf8c04e1d4314fda26cf01f52bc5cc77b3850478fae6e0aea2ede6b343681bfe61884d63326b190c6043280147c7928a79c77e892d4c110585b", 0xc7}, {&(0x7f0000001480)="8e47d5ad9a73a9b1d76b0d98507e6646c535982501ec2f2475c6723f6c9d81ed7780965ae4d82e89f5f53b13a72f181d3617eaaad5b755ec785a39", 0x3b}], 0x7}}, {{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f00000016c0)="7e8e8941827e99d258271d4d2b0e7660010d61882519e06baa1a850606a2a3942c504b347aa23e34b74b8020c507441738596c2678ad71f8f1996adbe1b3e3f20085944878b7fed8f89226553337ea273b74b41528705e42b6fcc6f430fc833ababd39877a2bc2c315f22796ff5871e6", 0x70}], 0x1}}], 0x6, 0x4000000) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 1.415416243s ago: executing program 4 (id=7573): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000fee000)=0x3f9, 0x4) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e23, 0x8, @loopback}, 0x1c) listen(r1, 0x7) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e20, 0x5, @mcast1, 0x4}, 0x1c) r2 = socket$inet6(0xa, 0x5, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x4e23, 0x8000000, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, 0x0, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x6, @ipv4={'\x00', '\xff\xff', @loopback}, 0x100000b}, 0x1c) listen(r2, 0xb) socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x2, 0xa, 0x2) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r5 = socket(0x10, 0x803, 0x0) bind$netlink(r5, 0x0, 0x0) getsockname$packet(r5, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newlink={0x44, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r6, 0x69b, 0x4}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_ALL_SLAVES_ACTIVE={0x5, 0x11, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) r7 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x44}}, 0x0) r11 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) 681.878776ms ago: executing program 4 (id=7574): mmap(&(0x7f00000fc000/0x1000)=nil, 0x1000, 0x2000002, 0x4000932, 0xffffffffffffffff, 0x8000) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000340)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x40400, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xfffffffd}) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, 0x0) pwritev2(r0, &(0x7f00000001c0)=[{0x0}], 0x1, 0x0, 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/timer_list\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x100000500) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) openat$sw_sync(0xffffffffffffff9c, &(0x7f00000001c0), 0x141400, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x6b7, 0x80, 0x800, 0xffffffff, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x800) sendto$inet(r4, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) openat$vimc0(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) 554.953836ms ago: executing program 1 (id=7575): capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x10, 0x4002, @remote, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, 0x0, 0x0) 439.435173ms ago: executing program 1 (id=7576): lsm_get_self_attr(0x64, &(0x7f0000000040), &(0x7f0000000000)=0x101, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}]}]}, @NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}], {0x14, 0x10}}, 0xc0}}, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x15) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001700)=[{{&(0x7f0000000100)={0xa, 0x4e21, 0x466e8c6b, @mcast2, 0x1}, 0x1c, 0x0, 0x0, 0x0, 0x50, 0x7ffffff7}}], 0x1, 0xc050) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000001100)=""/4099, &(0x7f00000010c0)=0x1003) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000005c0)={[0x5836, 0x1000000000000008, 0x2, 0x4000000000000e52, 0x1, 0x5479, 0x1043, 0x200000000006, 0x4, 0x1, 0xfffffffffffffffe, 0x100000000, 0x9ca6, 0x200001, 0x8000000000005, 0x5c], 0x8080000, 0x42590}) ioctl$KVM_RUN(r6, 0xae80, 0x0) io_setup(0xffb, &(0x7f0000000040)=0x0) io_pgetevents(r7, 0x414, 0x5, &(0x7f0000000080)=[{}, {}, {}, {}, {}], &(0x7f0000000140), &(0x7f00000001c0)={&(0x7f0000000180)={[0x7]}, 0x8}) 275.889289ms ago: executing program 3 (id=7577): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000100)=ANY=[], 0xfdef) 259.540612ms ago: executing program 1 (id=7578): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000005f40)={0x0, 0x0, &(0x7f0000005f00)={&(0x7f0000000000)=@delchain={0x24, 0x65, 0x20, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x3, 0x1}, {0x0, 0xc}, {0x8, 0xfff9}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="a443fcd7770245fc989b50ea09817223dd9fac342f8f7c3d2cdcae3b14f82c974dc1", 0x22}], 0x1}, 0x6) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xa002, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) unshare(0x22020400) pselect6(0x40, &(0x7f0000000100)={0x0, 0x2000000000000, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0xfffffffffffffffe, 0x400000000000}, &(0x7f0000000180)={0x1f, 0x4, 0xffffffff, 0x7, 0x10000, 0x7, 0xfffffffffffffffe, 0x4}, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x400000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x17) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_SET_MSCBIT(r3, 0x40045568, 0x8) 198.493009ms ago: executing program 2 (id=7579): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e20, 0x3, @local, 0x10}}, 0x0, 0xf, 0x101, 0x10, 0x83, 0xd6, 0x6}, &(0x7f0000000100)=0x9c) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000180)={r2}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00'}) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r4, 0x5761, &(0x7f00000001c0)=ANY=[@ANYBLOB="01"]) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r4, 0x0) ioctl$VIDIOC_G_JPEGCOMP(r4, 0x808c563d, &(0x7f00000004c0)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) sendmsg$netlink(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{0x0}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) 0s ago: executing program 3 (id=7580): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000c00000/0x400000)=nil) r2 = syz_kvm_add_vcpu$x86(r1, &(0x7f00000000c0)={0x0, &(0x7f0000000380)=[@nested_amd_vmsave={0x183, 0x18, 0x1000000001}, @nested_amd_vmload={0x182, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @guest64=0x280a, 0x5, 0x7, 0x7}}, @nested_amd_stgi={0x17e, 0x10}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest_nat=0x6808, 0x43, 0x1, 0x6}}, @nested_amd_inject_event={0x180, 0x38, {0x1, 0x2a, 0x2, 0x2, 0x1}}, @in_dx={0x69, 0x0, {0xde4d, 0x6}}, @rdmsr={0x66, 0x18, {0xc0000104}}, @cpuid={0x64, 0x68, {0x6, 0x4}}, @nested_amd_stgi={0x17e, 0x10}, @cpuid={0x64, 0x18, {0x9, 0x7ff}}, @uexit={0x0, 0x18, 0x8}, @rdmsr={0x66, 0x18, {0x8bc}}], 0x1a8}) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000140)={0x10001}) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r3, 0x3, 0x12, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) socket$inet(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000000)={@local}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0xc00000000000, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xfffdffffffffffff, 0x9, 0x3, 0xf, 0x80000006}, 0x0, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r6, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e, 0x8}) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r6, 0x7af, &(0x7f0000000080)={@hyper, 0x2}) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r7, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r7, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) close_range(r5, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$tun(r8, &(0x7f0000000340)=ANY=[], 0x141) kernel console output (not intermixed with test programs): 329.158287][T27024] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1329.158328][T27024] __shmem_file_setup+0x2e9/0x370 [ 1329.158355][T27024] ? __pfx___shmem_file_setup+0x10/0x10 [ 1329.158379][T27024] ? big_key_preparse+0x200/0x500 [ 1329.158407][T27024] ? big_key_preparse+0x200/0x500 [ 1329.158441][T27024] big_key_preparse+0x28b/0x500 [ 1329.158476][T27024] ? __pfx_big_key_preparse+0x10/0x10 [ 1329.158515][T27024] key_update+0x227/0x560 [ 1329.158539][T27024] ? irqentry_exit+0x218/0x8f0 [ 1329.158570][T27024] ? __pfx_key_update+0x10/0x10 [ 1329.158612][T27024] ? rep_movs_alternative+0x4a/0xa0 [ 1329.158649][T27024] keyctl_update_key+0xf6/0x140 [ 1329.158683][T27024] __se_sys_keyctl+0x617/0x9d0 [ 1329.158720][T27024] ? __pfx___se_sys_keyctl+0x10/0x10 [ 1329.158761][T27024] ? __mutex_unlock_slowpath+0x731/0x900 [ 1329.158790][T27024] ? __fget_files+0x2a/0x420 [ 1329.158822][T27024] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1329.158849][T27024] ? __fget_files+0x3a2/0x420 [ 1329.158890][T27024] ? fput+0xa0/0xd0 [ 1329.158918][T27024] ? ksys_write+0x242/0x270 [ 1329.158944][T27024] ? __pfx_ksys_write+0x10/0x10 [ 1329.158972][T27024] ? __x64_sys_keyctl+0x20/0xc0 [ 1329.159005][T27024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1329.159029][T27024] do_syscall_64+0x174/0x580 [ 1329.159060][T27024] ? trace_irq_disable+0x3b/0x140 [ 1329.159089][T27024] ? clear_bhb_loop+0x40/0x90 [ 1329.159117][T27024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1329.159140][T27024] RIP: 0033:0x7f7c52d9de99 [ 1329.159162][T27024] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1329.159183][T27024] RSP: 002b:00007f7c53c99028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1329.159207][T27024] RAX: ffffffffffffffda RBX: 00007f7c53025fa0 RCX: 00007f7c52d9de99 [ 1329.159224][T27024] RDX: 00002000000000c0 RSI: 000000000b36994c RDI: 0000000000000002 [ 1329.159240][T27024] RBP: 00007f7c53c99090 R08: 0000000000000000 R09: 0000000000000000 [ 1329.159254][T27024] R10: 0000000000001000 R11: 0000000000000246 R12: 0000000000000001 [ 1329.159268][T27024] R13: 00007f7c53026038 R14: 00007f7c53025fa0 R15: 00007f7c5314fa48 [ 1329.159303][T27024] [ 1329.455958][T20218] net_ratelimit: 23 callbacks suppressed [ 1329.455980][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1329.476126][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1329.491363][T25296] Bluetooth: hci4: command 0x0406 tx timeout [ 1329.497484][T25296] Bluetooth: hci5: command 0x0406 tx timeout [ 1329.504734][T25296] Bluetooth: hci1: command 0x0406 tx timeout [ 1329.510814][T25296] Bluetooth: hci2: command 0x0406 tx timeout [ 1329.637183][ T5695] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1329.874506][T20505] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 1329.891871][T27035] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1329.900408][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1329.953235][T27029] netlink: 'syz.2.7295': attribute type 12 has an invalid length. [ 1329.961317][T27029] netlink: 'syz.2.7295': attribute type 29 has an invalid length. [ 1329.979683][T27029] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7295'. [ 1329.998144][T21386] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1330.012856][T27029] netlink: 59 bytes leftover after parsing attributes in process `syz.2.7295'. [ 1330.025378][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1330.039775][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1330.045369][T20505] usb 2-1: Using ep0 maxpacket: 32 [ 1330.067488][T20505] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1330.077727][T20505] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1330.086250][T20505] usb 2-1: Product: syz [ 1330.090689][T20505] usb 2-1: Manufacturer: syz [ 1330.097003][T20505] usb 2-1: SerialNumber: syz [ 1330.119168][T20505] usb 2-1: config 0 descriptor?? [ 1330.178883][T27040] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1330.210575][T27040] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1330.230537][T27041] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7300'. [ 1330.256317][T27041] vlan0: entered promiscuous mode [ 1330.262788][T27041] bond0: entered promiscuous mode [ 1330.267984][T27041] bond_slave_0: entered promiscuous mode [ 1330.275339][T27041] bond_slave_1: entered promiscuous mode [ 1330.293045][T27044] FAULT_INJECTION: forcing a failure. [ 1330.293045][T27044] name failslab, interval 1, probability 0, space 0, times 0 [ 1330.331742][T27044] CPU: 0 UID: 0 PID: 27044 Comm: syz.3.7301 Tainted: G L syzkaller #0 PREEMPT(full) [ 1330.331780][T27044] Tainted: [L]=SOFTLOCKUP [ 1330.331789][T27044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1330.331802][T27044] Call Trace: [ 1330.331812][T27044] [ 1330.331822][T27044] dump_stack_lvl+0xe8/0x150 [ 1330.331861][T27044] should_fail_ex+0x40c/0x560 [ 1330.331896][T27044] should_failslab+0xa8/0x100 [ 1330.331933][T27044] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1330.331963][T27044] ? fib_trie_unmerge+0x270/0xce0 [ 1330.331992][T27044] ? fib_trie_unmerge+0x270/0xce0 [ 1330.332030][T27044] fib_trie_unmerge+0x270/0xce0 [ 1330.332073][T27044] fib_unmerge+0xc5/0x350 [ 1330.332113][T27044] fib4_rule_configure+0x2e0/0xa40 [ 1330.332258][T27044] fib_newrule+0x5a1/0xf10 [ 1330.332316][T27044] ? __lock_acquire+0x683/0x2cf0 [ 1330.332352][T27044] ? __pfx_fib_newrule+0x10/0x10 [ 1330.332419][T27044] ? __pfx_fib_nl_newrule+0x10/0x10 [ 1330.332446][T27044] rtnetlink_rcv_msg+0x802/0xc00 [ 1330.332469][T27044] ? netlink_sendmsg+0x5d4/0xb40 [ 1330.332501][T27044] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1330.332523][T27044] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1330.332548][T27044] ? __lock_acquire+0x683/0x2cf0 [ 1330.332594][T27044] netlink_rcv_skb+0x226/0x4a0 [ 1330.332622][T27044] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1330.332647][T27044] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1330.332694][T27044] ? netlink_deliver_tap+0x2e/0x1b0 [ 1330.332721][T27044] ? netlink_deliver_tap+0x2e/0x1b0 [ 1330.332754][T27044] netlink_unicast+0x7bb/0x940 [ 1330.332790][T27044] netlink_sendmsg+0x813/0xb40 [ 1330.332829][T27044] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1330.332862][T27044] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1330.332897][T27044] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1330.332924][T27044] sock_sendmsg_nosec+0x13a/0x180 [ 1330.332960][T27044] ____sys_sendmsg+0x54e/0x850 [ 1330.332993][T27044] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1330.333030][T27044] ? import_iovec+0x73/0xa0 [ 1330.333056][T27044] ___sys_sendmsg+0x2a5/0x360 [ 1330.333081][T27044] ? __lock_acquire+0x683/0x2cf0 [ 1330.333117][T27044] ? __pfx____sys_sendmsg+0x10/0x10 [ 1330.333181][T27044] ? __fget_files+0x2a/0x420 [ 1330.333212][T27044] ? __fget_files+0x3a2/0x420 [ 1330.333254][T27044] __x64_sys_sendmsg+0x1b1/0x290 [ 1330.333284][T27044] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1330.333330][T27044] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1330.333356][T27044] do_syscall_64+0x174/0x580 [ 1330.333384][T27044] ? clear_bhb_loop+0x40/0x90 [ 1330.333412][T27044] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1330.333435][T27044] RIP: 0033:0x7f68ff39de99 [ 1330.333456][T27044] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1330.333475][T27044] RSP: 002b:00007f6900346028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1330.333500][T27044] RAX: ffffffffffffffda RBX: 00007f68ff625fa0 RCX: 00007f68ff39de99 [ 1330.333517][T27044] RDX: 0000000000044004 RSI: 0000200000000400 RDI: 0000000000000003 [ 1330.333532][T27044] RBP: 00007f6900346090 R08: 0000000000000000 R09: 0000000000000000 [ 1330.333547][T27044] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1330.333560][T27044] R13: 00007f68ff626038 R14: 00007f68ff625fa0 R15: 00007f68ff74fa48 [ 1330.333596][T27044] [ 1330.393972][T20505] usb 2-1: USB disconnect, device number 54 [ 1331.153657][T27050] syz.2.7303 (27050) used greatest stack depth: 19200 bytes left [ 1331.461405][T21401] usb 5-1: USB disconnect, device number 10 [ 1331.911111][T21401] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 1332.073315][T21401] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1332.136351][T21401] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1332.168486][T21401] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 64 [ 1332.219110][T21401] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1332.291307][T21401] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1332.356341][T21401] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1332.386898][T21401] usb 5-1: Manufacturer: syz [ 1332.416012][T21401] usb 5-1: config 0 descriptor?? [ 1332.846135][T27077] netlink: 'syz.2.7312': attribute type 1 has an invalid length. [ 1332.889403][T27077] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7312'. [ 1333.197569][T27088] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7315'. [ 1333.272995][T27088] vlan2: entered promiscuous mode [ 1333.291823][T27088] bond0: entered promiscuous mode [ 1333.311238][T27088] bond_slave_0: entered promiscuous mode [ 1333.336374][T27088] bond_slave_1: entered promiscuous mode [ 1333.909519][T27082] netlink: 'syz.3.7313': attribute type 12 has an invalid length. [ 1333.967124][T27082] netlink: 'syz.3.7313': attribute type 29 has an invalid length. [ 1334.019087][T27082] netlink: 148 bytes leftover after parsing attributes in process `syz.3.7313'. [ 1334.056809][T27082] netlink: 59 bytes leftover after parsing attributes in process `syz.3.7313'. [ 1334.177304][T27092] netlink: 144 bytes leftover after parsing attributes in process `syz.1.7316'. [ 1334.721621][T20214] net_ratelimit: 1048 callbacks suppressed [ 1334.721645][T20214] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1334.742349][T20214] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1334.891687][T21401] rc_core: IR keymap rc-hauppauge not found [ 1334.902832][T21401] Registered IR keymap rc-empty [ 1334.913537][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1334.941503][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1334.973064][T21401] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 1335.019476][T21401] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input82 [ 1335.065410][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1335.093808][T21612] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1335.106381][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1335.153635][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1335.171574][T21385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1335.215093][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1335.246881][T27115] netlink: 124 bytes leftover after parsing attributes in process `syz.3.7322'. [ 1335.267355][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1335.281565][T20217] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1335.296126][T20217] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1335.332881][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1335.375844][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1335.411982][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1335.451383][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1335.491899][T21401] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 1335.538112][T21401] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 1335.583362][T21401] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1335.666509][T21401] usb 5-1: USB disconnect, device number 11 [ 1335.884217][T27120] program syz.1.7324 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1335.911841][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1335.926386][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1336.213765][T21385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1336.259252][T27130] netlink: 124 bytes leftover after parsing attributes in process `syz.4.7325'. [ 1336.614476][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1336.830610][T27139] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7328'. [ 1337.061257][T27142] C: renamed from veth1_to_team (while UP) [ 1337.107843][T27142] netlink: 164 bytes leftover after parsing attributes in process `syz.1.7329'. [ 1337.609126][T27135] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7326'. [ 1337.643748][T27135] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7326'. [ 1337.881216][T21386] usb 2-1: new full-speed USB device number 55 using dummy_hcd [ 1337.911432][T27152] bridge0: left promiscuous mode [ 1337.931014][T27152] bridge0: left allmulticast mode [ 1337.966290][T27154] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7333'. [ 1338.038842][T18511] Bluetooth: hci3: Ignoring connect complete event for invalid link type [ 1338.048614][T27152] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7333'. [ 1338.093248][T21386] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1338.149019][T21386] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1338.193074][T27154] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1338.207747][T21386] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 64 [ 1338.240134][T27154] 8021q: adding VLAN 0 to HW filter on device team0 [ 1338.261613][T21386] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1338.293246][T27154] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1338.328730][T21386] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1338.386096][T21386] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1338.428218][T21386] usb 2-1: Manufacturer: syz [ 1338.470540][T21386] usb 2-1: config 0 descriptor?? [ 1338.485855][T27154] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1338.503700][T27154] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1338.584659][T27154] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1338.596341][T27154] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1338.616310][T27154] veth1_vlan: left promiscuous mode [ 1338.627182][T27154] veth0_vlan: left promiscuous mode [ 1338.638030][T27154] veth0_vlan: entered promiscuous mode [ 1338.655821][T27154] veth1_vlan: entered promiscuous mode [ 1338.680768][T27154] veth1_macvtap: left promiscuous mode [ 1338.702794][T27154] veth0_macvtap: left promiscuous mode [ 1338.710812][T27154] veth0_macvtap: entered promiscuous mode [ 1338.722365][T27154] veth1_macvtap: entered promiscuous mode [ 1338.745480][T27154] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1338.764457][T27154] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1338.774273][T27154] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1338.785740][T27154] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1338.804630][T27154] veth0: entered promiscuous mode [ 1338.811131][ T5723] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 1338.845583][T11628] bridge0: port 1(bridge_slave_0) entered blocking state [ 1338.852861][T11628] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1338.865941][T11628] bridge0: port 2(bridge_slave_1) entered blocking state [ 1338.873160][T11628] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1338.940186][T20217] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1338.956405][T11628] bridge0: port 3(team0) entered blocking state [ 1338.962833][T11628] bridge0: port 3(team0) entered forwarding state [ 1338.986235][T20217] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1339.000452][ T5723] usb 5-1: config 0 has an invalid descriptor of length 91, skipping remainder of the config [ 1339.016430][T20217] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1339.040234][ T5723] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1339.074296][ T5723] usb 5-1: New USB device found, idVendor=05ac, idProduct=0267, bcdDevice= 0.00 [ 1339.087416][ T5723] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1339.110484][ T5723] usb 5-1: config 0 descriptor?? [ 1339.407536][T27168] binder: 27167:27168 ioctl c0306201 0 returned -14 [ 1339.439444][T27168] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 1339.466767][T27168] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 1339.480364][T27168] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 1339.710375][ T5723] usb 5-1: string descriptor 0 read error: -71 [ 1339.753879][ T5723] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 1339.767691][T20218] net_ratelimit: 1047 callbacks suppressed [ 1339.767707][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1339.788200][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1339.816162][ T5723] usb 5-1: USB disconnect, device number 12 [ 1340.331229][T21385] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 1340.345083][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1340.359630][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1340.385743][T20505] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1340.561699][T21385] usb 4-1: Using ep0 maxpacket: 16 [ 1340.570138][T21385] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1340.571615][T21401] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 1340.585574][T21385] usb 4-1: config 5 has an invalid interface number: 21 but max is 0 [ 1340.596730][T27189] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7343'. [ 1340.606945][T21385] usb 4-1: config 5 has no interface number 0 [ 1340.624683][T21385] usb 4-1: config 5 interface 21 has no altsetting 0 [ 1340.649371][T21385] usb 4-1: New USB device found, idVendor=0cf3, idProduct=b003, bcdDevice=93.d3 [ 1340.662561][T21385] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1340.675454][T21385] usb 4-1: Product: syz [ 1340.679827][T21385] usb 4-1: Manufacturer: syz [ 1340.684968][T21385] usb 4-1: SerialNumber: syz [ 1340.776923][T21401] usb 1-1: device descriptor read/64, error -71 [ 1340.891448][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1340.906000][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1340.970262][T21385] usb 4-1: ath9k_htc: Device endpoint numbers are not the expected ones [ 1340.979423][T21386] rc_core: IR keymap rc-hauppauge not found [ 1340.986650][T21386] Registered IR keymap rc-empty [ 1340.998811][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1341.038771][T21385] usb 4-1: USB disconnect, device number 113 [ 1341.041919][T21401] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 1341.050112][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1341.122345][T21386] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 1341.171587][ T5695] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1341.184160][T21386] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input83 [ 1341.221175][T21401] usb 1-1: device descriptor read/64, error -71 [ 1341.243147][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1341.312528][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1341.331810][T21401] usb usb1-port1: attempt power cycle [ 1341.365816][T27202] netlink: 124 bytes leftover after parsing attributes in process `syz.1.7345'. [ 1341.412531][T21385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1341.421757][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1341.511511][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1341.519034][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1341.592809][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1341.691736][T21401] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 1341.713987][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1341.733821][T21401] usb 1-1: device descriptor read/8, error -71 [ 1341.816752][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1341.934418][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1341.991553][T21401] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 1342.016140][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1342.072678][T21401] usb 1-1: device descriptor read/8, error -71 [ 1342.084462][T21386] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1342.149763][T21386] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 1342.181136][T21386] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1342.199116][T27214] netlink: 830 bytes leftover after parsing attributes in process `syz.2.7350'. [ 1342.211772][T21401] usb usb1-port1: unable to enumerate USB device [ 1342.250654][T21386] usb 2-1: USB disconnect, device number 55 [ 1342.551050][T21385] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 1342.625865][T27218] binder: 27217:27218 ioctl c0306201 0 returned -14 [ 1342.636038][T27218] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 1342.645882][T27218] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 1342.654698][T27218] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 1342.712999][T21385] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1342.724387][T21385] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1342.735625][T21385] usb 4-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 1342.745047][T21385] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1342.756049][T21385] usb 4-1: config 0 descriptor?? [ 1343.271102][T21401] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 1343.434713][T21401] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1343.458897][T21401] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1343.475631][T27230] syzkaller0: entered promiscuous mode [ 1343.487236][T27230] syzkaller0: entered allmulticast mode [ 1343.497426][T21401] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 64 [ 1343.557970][T21401] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1343.601240][T21401] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1343.615592][T21401] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1343.624228][T21401] usb 3-1: Manufacturer: syz [ 1343.699146][T21401] usb 3-1: config 0 descriptor?? [ 1344.084910][T27240] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7358'. [ 1345.181242][T11628] net_ratelimit: 18 callbacks suppressed [ 1345.181265][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1345.201546][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1345.573013][T21385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1345.825588][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1345.840024][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1345.946943][T27254] netlink: 124 bytes leftover after parsing attributes in process `syz.0.7362'. [ 1346.017249][ T5629] usb 4-1: USB disconnect, device number 114 [ 1346.471046][T21401] rc_core: IR keymap rc-hauppauge not found [ 1346.477073][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1346.491708][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1346.510425][T21401] Registered IR keymap rc-empty [ 1346.548079][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1346.601544][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1346.612749][T21385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1346.636556][T27264] binder: 27263:27264 ioctl c0306201 0 returned -14 [ 1346.646032][T21401] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1346.707544][T21401] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input84 [ 1346.721264][T27264] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 1346.770789][T27264] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 1346.827617][T27264] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 1346.859212][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1346.926095][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1347.002709][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1347.045241][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1347.104852][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1347.140128][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1347.154791][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1347.218792][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1347.276935][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1347.387016][T27275] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7368'. [ 1347.402326][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1347.452634][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1347.490335][T27275] FAULT_INJECTION: forcing a failure. [ 1347.490335][T27275] name failslab, interval 1, probability 0, space 0, times 0 [ 1347.507777][T21401] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 1347.507782][T27275] CPU: 1 UID: 0 PID: 27275 Comm: syz.3.7368 Tainted: G L syzkaller #0 PREEMPT(full) [ 1347.507815][T27275] Tainted: [L]=SOFTLOCKUP [ 1347.507823][T27275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1347.507876][T27275] Call Trace: [ 1347.507908][T27275] [ 1347.507945][T27275] dump_stack_lvl+0xe8/0x150 [ 1347.508057][T27275] should_fail_ex+0x40c/0x560 [ 1347.508142][T27275] should_failslab+0xa8/0x100 [ 1347.508230][T27275] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1347.508320][T27275] ? skb_clone+0x212/0x3a0 [ 1347.508385][T27275] ? skb_clone+0x212/0x3a0 [ 1347.508476][T27275] skb_clone+0x212/0x3a0 [ 1347.508552][T27275] __netlink_deliver_tap+0x413/0x860 [ 1347.508659][T27275] ? netlink_deliver_tap+0x2e/0x1b0 [ 1347.508740][T27275] netlink_deliver_tap+0x19c/0x1b0 [ 1347.508814][T27275] netlink_sendskb+0x68/0x140 [ 1347.508879][T27275] netlink_rcv_skb+0x2a4/0x4a0 [ 1347.508950][T27275] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1347.509043][T27275] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1347.509142][T27275] ? down_read+0x2be/0x330 [ 1347.509213][T27275] genl_rcv+0x28/0x40 [ 1347.509269][T27275] netlink_unicast+0x7bb/0x940 [ 1347.509383][T27275] netlink_sendmsg+0x813/0xb40 [ 1347.509490][T27275] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1347.509583][T27275] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1347.509665][T27275] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1347.509744][T27275] sock_sendmsg_nosec+0x13a/0x180 [ 1347.509838][T27275] ____sys_sendmsg+0x54e/0x850 [ 1347.509921][T27275] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1347.510014][T27275] ? import_iovec+0x73/0xa0 [ 1347.510079][T27275] ___sys_sendmsg+0x2a5/0x360 [ 1347.510141][T27275] ? __lock_acquire+0x683/0x2cf0 [ 1347.510234][T27275] ? __pfx____sys_sendmsg+0x10/0x10 [ 1347.510402][T27275] ? __fget_files+0x2a/0x420 [ 1347.510477][T27275] ? __fget_files+0x3a2/0x420 [ 1347.510593][T27275] __x64_sys_sendmsg+0x1b1/0x290 [ 1347.510666][T27275] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1347.510821][T27275] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.510892][T27275] do_syscall_64+0x174/0x580 [ 1347.510956][T27275] ? trace_irq_disable+0x3b/0x140 [ 1347.511031][T27275] ? clear_bhb_loop+0x40/0x90 [ 1347.511103][T27275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.511165][T27275] RIP: 0033:0x7f68ff39de99 [ 1347.511228][T27275] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1347.511282][T27275] RSP: 002b:00007f6900346028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1347.511345][T27275] RAX: ffffffffffffffda RBX: 00007f68ff625fa0 RCX: 00007f68ff39de99 [ 1347.511386][T27275] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 1347.511427][T27275] RBP: 00007f6900346090 R08: 0000000000000000 R09: 0000000000000000 [ 1347.511467][T27275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1347.511500][T27275] R13: 00007f68ff626038 R14: 00007f68ff625fa0 R15: 00007f68ff74fa48 [ 1347.511595][T27275] [ 1348.119969][T21401] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 1348.144100][T21401] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1348.160240][T27281] binder: 27280:27281 ioctl 4018620d 0 returned -22 [ 1348.176893][T21401] usb 3-1: USB disconnect, device number 32 [ 1348.183838][T27281] binder: 27280:27281 ioctl c0306201 2000000003c0 returned -14 [ 1348.359317][T27284] FAULT_INJECTION: forcing a failure. [ 1348.359317][T27284] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1348.423412][T27284] CPU: 1 UID: 0 PID: 27284 Comm: syz.3.7372 Tainted: G L syzkaller #0 PREEMPT(full) [ 1348.423447][T27284] Tainted: [L]=SOFTLOCKUP [ 1348.423456][T27284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1348.423470][T27284] Call Trace: [ 1348.423479][T27284] [ 1348.423488][T27284] dump_stack_lvl+0xe8/0x150 [ 1348.423525][T27284] should_fail_ex+0x40c/0x560 [ 1348.423559][T27284] _copy_from_user+0x2d/0xb0 [ 1348.423581][T27284] snd_seq_write+0x309/0x820 [ 1348.423625][T27284] ? __pfx_snd_seq_write+0x10/0x10 [ 1348.423657][T27284] ? bpf_lsm_file_permission+0x9/0x20 [ 1348.423683][T27284] ? security_file_permission+0x75/0x260 [ 1348.423718][T27284] ? rw_verify_area+0x203/0x4c0 [ 1348.423744][T27284] vfs_writev+0x4bb/0x990 [ 1348.423775][T27284] ? __pfx_snd_seq_write+0x10/0x10 [ 1348.423809][T27284] ? __pfx_vfs_writev+0x10/0x10 [ 1348.423851][T27284] ? __fget_files+0x2a/0x420 [ 1348.423886][T27284] ? __fget_files+0x3a2/0x420 [ 1348.423914][T27284] ? __fget_files+0x2a/0x420 [ 1348.423954][T27284] do_writev+0x154/0x2e0 [ 1348.423985][T27284] ? __pfx_do_writev+0x10/0x10 [ 1348.424025][T27284] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1348.424049][T27284] do_syscall_64+0x174/0x580 [ 1348.424075][T27284] ? trace_irq_disable+0x3b/0x140 [ 1348.424103][T27284] ? clear_bhb_loop+0x40/0x90 [ 1348.424140][T27284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1348.424161][T27284] RIP: 0033:0x7f68ff39de99 [ 1348.424181][T27284] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1348.424199][T27284] RSP: 002b:00007f6900346028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1348.424223][T27284] RAX: ffffffffffffffda RBX: 00007f68ff625fa0 RCX: 00007f68ff39de99 [ 1348.424239][T27284] RDX: 0000000000000001 RSI: 0000200000000580 RDI: 0000000000000003 [ 1348.424254][T27284] RBP: 00007f6900346090 R08: 0000000000000000 R09: 0000000000000000 [ 1348.424268][T27284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1348.424282][T27284] R13: 00007f68ff626038 R14: 00007f68ff625fa0 R15: 00007f68ff74fa48 [ 1348.424317][T27284] [ 1348.531616][ T5695] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 1348.801041][ T5629] usb 2-1: new full-speed USB device number 56 using dummy_hcd [ 1348.861591][ T5695] usb 5-1: Using ep0 maxpacket: 32 [ 1348.870718][ T5695] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1348.906954][ T5695] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1348.920123][ T5695] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1348.963249][ T5629] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1348.976784][ T5629] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1348.990762][ T5695] usb 5-1: Product: syz [ 1349.006743][ T5695] usb 5-1: Manufacturer: syz [ 1349.016595][ T5629] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 64 [ 1349.042014][ T5695] usb 5-1: SerialNumber: syz [ 1349.066598][ T5695] usb 5-1: config 0 descriptor?? [ 1349.073002][ T5629] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1349.107057][T27282] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1349.139129][ T5629] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1349.163965][ T5629] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1349.175864][T27291] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7375'. [ 1349.188013][ T5629] usb 2-1: Manufacturer: syz [ 1349.227366][ T5629] usb 2-1: config 0 descriptor?? [ 1349.438015][T27306] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7381'. [ 1349.449651][T27306] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7381'. [ 1349.469063][T27307] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 1349.581054][T21385] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 1349.591156][T27306] netlink: 72 bytes leftover after parsing attributes in process `syz.3.7381'. [ 1349.741746][T21385] usb 1-1: Using ep0 maxpacket: 8 [ 1349.754464][T21385] usb 1-1: config 1 interface 0 has no altsetting 0 [ 1349.778666][T21385] usb 1-1: New USB device found, idVendor=056a, idProduct=0017, bcdDevice= 0.40 [ 1349.815279][T21385] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1349.844731][T21385] usb 1-1: Product: syz [ 1349.863500][T21385] usb 1-1: Manufacturer: ဉ [ 1349.893703][T21385] usb 1-1: SerialNumber: syz [ 1350.212962][T20215] net_ratelimit: 13 callbacks suppressed [ 1350.213012][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1350.235508][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1350.291793][T21612] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1350.386604][T21385] usbhid 1-1:1.0: can't add hid device: -71 [ 1350.398521][T21385] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 1350.432932][T21385] usb 1-1: USB disconnect, device number 27 [ 1350.791625][T21612] usb 4-1: new low-speed USB device number 115 using dummy_hcd [ 1350.842993][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1350.857974][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1350.949812][T21612] usb 4-1: device descriptor read/64, error -71 [ 1351.014909][T21385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1351.184906][T21401] usb 5-1: USB disconnect, device number 13 [ 1351.191345][T21612] usb 4-1: new low-speed USB device number 116 using dummy_hcd [ 1351.341189][T21612] usb 4-1: device descriptor read/64, error -71 [ 1351.412885][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1351.427524][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1351.453721][T21612] usb usb4-port1: attempt power cycle [ 1351.465011][T27335] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1351.473757][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1351.561345][ T5629] rc_core: IR keymap rc-hauppauge not found [ 1351.567948][ T5629] Registered IR keymap rc-empty [ 1351.581767][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1351.612011][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1351.642226][ T5629] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 1351.676757][ T5629] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input86 [ 1351.708554][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1351.752548][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1351.782874][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1351.811182][T21612] usb 4-1: new low-speed USB device number 117 using dummy_hcd [ 1351.819408][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1351.842336][T21612] usb 4-1: device descriptor read/8, error -71 [ 1351.851474][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1351.881303][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1351.902861][T21385] usb 1-1: new full-speed USB device number 28 using dummy_hcd [ 1351.911801][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1351.940681][ T30] audit: type=1326 audit(1785109327.637:1616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27350 comm="syz.1.7395" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc122b9de99 code=0x7ffc0000 [ 1351.954854][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1351.968928][ T30] audit: type=1326 audit(1785109327.637:1617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27350 comm="syz.1.7395" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc122b9de99 code=0x7ffc0000 [ 1352.031369][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1352.059091][ T30] audit: type=1326 audit(1785109327.667:1618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27350 comm="syz.1.7395" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc122b9de99 code=0x7ffc0000 [ 1352.062183][ T5629] mceusb 2-1:0.0: Error: mce write urb status = -71 [ 1352.091930][T21612] usb 4-1: new low-speed USB device number 118 using dummy_hcd [ 1352.103918][T21385] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 23444, setting to 64 [ 1352.120447][ T30] audit: type=1326 audit(1785109327.667:1619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27350 comm="syz.1.7395" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc122b9de99 code=0x7ffc0000 [ 1352.134003][T21612] usb 4-1: device descriptor read/8, error -71 [ 1352.152976][T21385] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1352.174395][ T5629] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 1352.175819][T21385] usb 1-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 1352.192774][T27354] FAULT_INJECTION: forcing a failure. [ 1352.192774][T27354] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1352.192809][ T5629] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1352.206325][ T30] audit: type=1326 audit(1785109327.687:1620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27350 comm="syz.1.7395" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fc122b9de99 code=0x7ffc0000 [ 1352.206382][ T30] audit: type=1326 audit(1785109327.687:1621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27350 comm="syz.1.7395" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc122b9de99 code=0x7ffc0000 [ 1352.206428][ T30] audit: type=1326 audit(1785109327.687:1622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27350 comm="syz.1.7395" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc122b9de99 code=0x7ffc0000 [ 1352.287193][T21612] usb usb4-port1: unable to enumerate USB device [ 1352.296348][T27354] CPU: 1 UID: 0 PID: 27354 Comm: syz.1.7396 Tainted: G L syzkaller #0 PREEMPT(full) [ 1352.296383][T27354] Tainted: [L]=SOFTLOCKUP [ 1352.296392][T27354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1352.296405][T27354] Call Trace: [ 1352.296414][T27354] [ 1352.296424][T27354] dump_stack_lvl+0xe8/0x150 [ 1352.296462][T27354] should_fail_ex+0x40c/0x560 [ 1352.296494][T27354] prepare_alloc_pages+0x230/0x650 [ 1352.296533][T27354] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1352.296572][T27354] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1352.296627][T27354] __alloc_pages_noprof+0x10/0x100 [ 1352.296661][T27354] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 1352.296697][T27354] ? __kmalloc_noprof+0x1ad/0x720 [ 1352.296724][T27354] ? copy_splice_read+0x16f/0xaa0 [ 1352.296756][T27354] ? copy_splice_read+0x16f/0xaa0 [ 1352.296794][T27354] copy_splice_read+0x19f/0xaa0 [ 1352.296839][T27354] ? __pfx_copy_splice_read+0x10/0x10 [ 1352.296878][T27354] ? register_lock_class+0x31/0x2e0 [ 1352.296914][T27354] ? file_end_write+0xd8/0x220 [ 1352.296949][T27354] ? direct_splice_actor+0x10c/0x160 [ 1352.296984][T27354] ? __pfx_copy_splice_read+0x10/0x10 [ 1352.297015][T27354] splice_direct_to_actor+0x48b/0xcb0 [ 1352.297068][T27354] ? __pfx_direct_splice_actor+0x10/0x10 [ 1352.297102][T27354] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1352.297147][T27354] do_splice_direct+0x195/0x290 [ 1352.297184][T27354] ? __pfx_do_splice_direct+0x10/0x10 [ 1352.297228][T27354] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1352.297253][T27354] ? bpf_lsm_file_permission+0x9/0x20 [ 1352.297279][T27354] ? security_file_permission+0x75/0x260 [ 1352.297314][T27354] ? rw_verify_area+0x203/0x4c0 [ 1352.297340][T27354] do_sendfile+0x52e/0x7c0 [ 1352.297377][T27354] ? __pfx_do_sendfile+0x10/0x10 [ 1352.297405][T27354] ? __fget_files+0x3a2/0x420 [ 1352.297446][T27354] __se_sys_sendfile64+0x144/0x1a0 [ 1352.297477][T27354] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 1352.297513][T27354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.297539][T27354] do_syscall_64+0x174/0x580 [ 1352.297565][T27354] ? trace_irq_disable+0x3b/0x140 [ 1352.297595][T27354] ? clear_bhb_loop+0x40/0x90 [ 1352.297623][T27354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.297646][T27354] RIP: 0033:0x7fc122b9de99 [ 1352.297668][T27354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1352.297688][T27354] RSP: 002b:00007fc123a89028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1352.297712][T27354] RAX: ffffffffffffffda RBX: 00007fc122e25fa0 RCX: 00007fc122b9de99 [ 1352.297728][T27354] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 1352.297741][T27354] RBP: 00007fc123a89090 R08: 0000000000000000 R09: 0000000000000000 [ 1352.297755][T27354] R10: 0000020000023896 R11: 0000000000000246 R12: 0000000000000001 [ 1352.297769][T27354] R13: 00007fc122e26038 R14: 00007fc122e25fa0 R15: 00007fc122f4fa48 [ 1352.297804][T27354] [ 1352.298037][T21385] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1352.434490][ T5629] usb 2-1: USB disconnect, device number 56 [ 1352.439720][ T30] audit: type=1326 audit(1785109327.697:1623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27350 comm="syz.1.7395" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fc122b9de99 code=0x7ffc0000 [ 1352.642375][ T30] audit: type=1326 audit(1785109327.697:1624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27350 comm="syz.1.7395" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fc122b9de99 code=0x7ffc0000 [ 1352.691737][T21385] usb 1-1: config 0 descriptor?? [ 1352.699244][T27341] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1352.858994][T27358] netlink: 88 bytes leftover after parsing attributes in process `syz.2.7398'. [ 1353.141051][ T5629] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 1353.152945][T21385] hid-multitouch 0003:0457:07DA.0028: unknown main item tag 0x6 [ 1353.173603][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 1353.182763][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 1353.192212][T21385] hid-multitouch 0003:0457:07DA.0028: unknown main item tag 0x2 [ 1353.200266][T21385] hid-multitouch 0003:0457:07DA.0028: unknown main item tag 0x0 [ 1353.215762][T21385] hid-multitouch 0003:0457:07DA.0028: unknown main item tag 0x0 [ 1353.261046][T21385] hid-multitouch 0003:0457:07DA.0028: unknown main item tag 0x0 [ 1353.279970][T21385] hid-multitouch 0003:0457:07DA.0028: unknown main item tag 0x0 [ 1353.305933][T27364] bridge0: port 2(bridge_slave_1) entered disabled state [ 1353.313341][T27364] bridge0: port 1(bridge_slave_0) entered disabled state [ 1353.321819][ T5629] usb 2-1: Using ep0 maxpacket: 32 [ 1353.336309][ T5629] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1353.359988][ T5629] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1353.382306][T21385] hid-multitouch 0003:0457:07DA.0028: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.0-1/input0 [ 1353.432289][ T5629] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1353.474430][T27368] bridge0: port 2(bridge_slave_1) entered blocking state [ 1353.481742][T27368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1353.490812][T27368] bridge0: port 1(bridge_slave_0) entered blocking state [ 1353.498092][T27368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1353.515394][ T5629] usb 2-1: Product: syz [ 1353.527927][T27366] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1353.570699][T27368] bridge0: entered promiscuous mode [ 1353.577784][ T5629] usb 2-1: Manufacturer: syz [ 1353.586080][T27364] netlink: 68 bytes leftover after parsing attributes in process `syz.2.7400'. [ 1353.597093][ T5629] usb 2-1: SerialNumber: syz [ 1353.603969][T27366] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1353.631961][T27364] tipc: Enabling of bearer rejected, media not registered [ 1353.649026][ T5629] usb 2-1: config 0 descriptor?? [ 1353.687365][T27356] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1353.939843][T21612] usb 2-1: USB disconnect, device number 57 [ 1354.843552][T21612] usb 1-1: USB disconnect, device number 28 [ 1354.959825][T27376] tipc: Started in network mode [ 1354.987923][T27376] tipc: Node identity 2e000000000000000000000000000001, cluster identity 4711 [ 1355.020070][T27376] tipc: Enabling of bearer rejected, failed to enable media [ 1355.396551][T27385] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7407'. [ 1355.450209][T27385] tipc: Enabling of bearer rejected, failed to enable media [ 1355.582557][T20215] net_ratelimit: 19 callbacks suppressed [ 1355.582572][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1355.603275][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1355.751093][T20505] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 1355.913143][T20505] usb 1-1: config 7 descriptor has 1 excess byte, ignoring [ 1355.928896][T20505] usb 1-1: config 7 has 1 interface, different from the descriptor's value: 2 [ 1355.950741][T20505] usb 1-1: New USB device found, idVendor=19d2, idProduct=1275, bcdDevice= 7.84 [ 1355.967057][T20505] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1355.987918][T20505] usb 1-1: Product: syz [ 1355.998057][T20505] usb 1-1: Manufacturer: syz [ 1356.008167][T20505] usb 1-1: SerialNumber: syz [ 1356.040615][T20505] rndis_host 1-1:7.0: skipping garbage [ 1356.062003][T20505] rndis_host 1-1:7.0: rndis: master #0/ffff88805ebdf000 slave #1/0000000000000000 [ 1356.073017][T27384] netlink: 'syz.1.7406': attribute type 12 has an invalid length. [ 1356.084100][T27384] netlink: 'syz.1.7406': attribute type 29 has an invalid length. [ 1356.093480][T20505] option 1-1:7.0: GSM modem (1-port) converter detected [ 1356.107151][T27384] netlink: 148 bytes leftover after parsing attributes in process `syz.1.7406'. [ 1356.122004][T27384] netlink: 59 bytes leftover after parsing attributes in process `syz.1.7406'. [ 1356.193040][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1356.207487][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1356.224515][T20505] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1356.226400][T27401] netlink: 'syz.2.7411': attribute type 153 has an invalid length. [ 1356.371736][T21611] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1356.429605][T27406] FAULT_INJECTION: forcing a failure. [ 1356.429605][T27406] name failslab, interval 1, probability 0, space 0, times 0 [ 1356.461387][T27406] CPU: 0 UID: 0 PID: 27406 Comm: syz.2.7413 Tainted: G L syzkaller #0 PREEMPT(full) [ 1356.461431][T27406] Tainted: [L]=SOFTLOCKUP [ 1356.461440][T27406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1356.461453][T27406] Call Trace: [ 1356.461463][T27406] [ 1356.461473][T27406] dump_stack_lvl+0xe8/0x150 [ 1356.461512][T27406] should_fail_ex+0x40c/0x560 [ 1356.461546][T27406] should_failslab+0xa8/0x100 [ 1356.461583][T27406] __kmalloc_cache_noprof+0xa8/0x660 [ 1356.461616][T27406] ? nfnetlink_rcv+0x1021/0x28c0 [ 1356.461640][T27406] ? nfnetlink_rcv+0x1021/0x28c0 [ 1356.461670][T27406] nfnetlink_rcv+0x1021/0x28c0 [ 1356.461732][T27406] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1356.461773][T27406] ? ref_tracker_free+0x689/0x830 [ 1356.461830][T27406] ? skb_clone+0x246/0x3a0 [ 1356.461862][T27406] ? __netlink_deliver_tap+0x811/0x860 [ 1356.461899][T27406] ? netlink_deliver_tap+0x2e/0x1b0 [ 1356.461922][T27406] ? netlink_deliver_tap+0x2e/0x1b0 [ 1356.461954][T27406] netlink_unicast+0x7bb/0x940 [ 1356.461991][T27406] netlink_sendmsg+0x813/0xb40 [ 1356.462055][T27406] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1356.462088][T27406] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1356.462120][T27406] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1356.462147][T27406] sock_sendmsg_nosec+0x13a/0x180 [ 1356.462182][T27406] ____sys_sendmsg+0x54e/0x850 [ 1356.462215][T27406] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1356.462251][T27406] ? import_iovec+0x73/0xa0 [ 1356.462277][T27406] ___sys_sendmsg+0x2a5/0x360 [ 1356.462302][T27406] ? __lock_acquire+0x683/0x2cf0 [ 1356.462339][T27406] ? __pfx____sys_sendmsg+0x10/0x10 [ 1356.462410][T27406] ? __fget_files+0x2a/0x420 [ 1356.462442][T27406] ? __fget_files+0x3a2/0x420 [ 1356.462484][T27406] __x64_sys_sendmsg+0x1b1/0x290 [ 1356.462514][T27406] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1356.462560][T27406] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1356.462586][T27406] do_syscall_64+0x174/0x580 [ 1356.462610][T27406] ? trace_irq_disable+0x3b/0x140 [ 1356.462640][T27406] ? clear_bhb_loop+0x40/0x90 [ 1356.462667][T27406] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1356.462690][T27406] RIP: 0033:0x7f7c52d9de99 [ 1356.462713][T27406] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1356.462732][T27406] RSP: 002b:00007f7c53c99028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1356.462756][T27406] RAX: ffffffffffffffda RBX: 00007f7c53025fa0 RCX: 00007f7c52d9de99 [ 1356.462773][T27406] RDX: 0000000024000840 RSI: 0000200000000000 RDI: 0000000000000003 [ 1356.462788][T27406] RBP: 00007f7c53c99090 R08: 0000000000000000 R09: 0000000000000000 [ 1356.462803][T27406] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1356.462816][T27406] R13: 00007f7c53026038 R14: 00007f7c53025fa0 R15: 00007f7c5314fa48 [ 1356.462852][T27406] [ 1356.782136][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1356.796588][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1357.131053][T21611] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1357.251581][T21386] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1357.303359][T21611] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1357.326028][T21611] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 1357.356475][T21611] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1357.381982][T20217] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1357.416300][T21611] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 1357.420568][T27430] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7419'. [ 1357.457198][T21611] usb 3-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 1357.473226][T21611] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1357.488009][T21611] usb 3-1: config 0 descriptor?? [ 1357.513020][T27432] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7419'. [ 1357.558912][T27434] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7420'. [ 1357.599698][T27430] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1357.690327][T27434] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1357.886968][T21611] hdpvr 3-1:0.0: unexpected answer of status request, len -32 [ 1357.910412][T21611] hdpvr 3-1:0.0: device init failed [ 1357.929578][T21611] hdpvr 3-1:0.0: probe with driver hdpvr failed with error -12 [ 1358.045047][T27447] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1358.078297][T27447] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1358.324334][T21611] usb 1-1: USB disconnect, device number 29 [ 1358.362980][T21611] option 1-1:7.0: device disconnected [ 1358.841172][T27459] netlink: 'syz.1.7424': attribute type 153 has an invalid length. [ 1360.929373][T27493] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7433'. [ 1360.938150][T27491] bridge0: port 2(bridge_slave_1) entered disabled state [ 1360.946083][T27491] bridge0: port 1(bridge_slave_0) entered disabled state [ 1361.017177][T27498] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7434'. [ 1361.031215][T20219] net_ratelimit: 18 callbacks suppressed [ 1361.031237][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1361.051908][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1361.097039][T18511] Bluetooth: hci1: Ignoring connect complete event for invalid link type [ 1361.210806][T21386] usb 3-1: USB disconnect, device number 33 [ 1361.391346][T21385] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 1361.432096][T21386] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1361.577939][T21385] usb 4-1: config 7 descriptor has 1 excess byte, ignoring [ 1361.606276][T21385] usb 4-1: config 7 has 1 interface, different from the descriptor's value: 2 [ 1361.640369][T21385] usb 4-1: New USB device found, idVendor=19d2, idProduct=1275, bcdDevice= 7.84 [ 1361.650226][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1361.664725][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1361.684989][T21385] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1361.694590][T21385] usb 4-1: Product: syz [ 1361.704327][T21385] usb 4-1: Manufacturer: syz [ 1361.717122][T21385] usb 4-1: SerialNumber: syz [ 1361.748741][T21385] rndis_host 4-1:7.0: skipping garbage [ 1361.761780][T21385] rndis_host 4-1:7.0: rndis: master #0/ffff88802a081000 slave #1/0000000000000000 [ 1361.800148][T21385] option 4-1:7.0: GSM modem (1-port) converter detected [ 1362.094476][T27496] bridge0: port 2(bridge_slave_1) entered disabled state [ 1362.102060][T27496] bridge0: port 1(bridge_slave_0) entered disabled state [ 1362.126076][T27496] bridge0: left promiscuous mode [ 1362.133928][T27496] bridge0: left allmulticast mode [ 1362.150808][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 1362.157908][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 1362.241094][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1362.256013][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1362.451410][T21385] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1362.467789][T21401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1362.807440][T27496] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1362.821688][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1362.878373][T27496] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1363.310822][T27496] ip6gre1: left allmulticast mode [ 1363.345250][T27496] vlan2: left promiscuous mode [ 1363.361519][T27496] bond0: left promiscuous mode [ 1363.366365][T27496] bond_slave_0: left promiscuous mode [ 1363.374883][T27496] bond_slave_1: left promiscuous mode [ 1363.401285][T27491] bridge0: port 2(bridge_slave_1) entered blocking state [ 1363.408518][T27491] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1363.416170][T27491] bridge0: port 1(bridge_slave_0) entered blocking state [ 1363.423909][T27491] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1363.447165][T27491] bridge0: entered promiscuous mode [ 1363.464706][T27491] bridge0: entered allmulticast mode [ 1363.474376][T27497] tipc: Enabling of bearer rejected, failed to enable media [ 1363.510153][T27498] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1363.518687][T27498] 8021q: adding VLAN 0 to HW filter on device team0 [ 1363.530029][T27498] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1363.555464][T27498] bridge0: port 1(bridge_slave_0) entered blocking state [ 1363.562838][T27498] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1363.573760][T27498] bridge0: port 2(bridge_slave_1) entered blocking state [ 1363.581113][T27498] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1363.602703][T27498] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1363.613137][T27498] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1363.656946][T20215] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1363.666402][T20215] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1363.676605][T27500] netlink: 68 bytes leftover after parsing attributes in process `syz.0.7432'. [ 1363.686706][T27500] tipc: Enabling of bearer rejected, media not registered [ 1363.697605][T20215] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1364.674401][T21386] usb 4-1: USB disconnect, device number 119 [ 1364.699170][T21386] option 4-1:7.0: device disconnected [ 1364.881355][T21385] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 1365.061495][T21385] usb 5-1: Using ep0 maxpacket: 16 [ 1365.089740][T21385] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1365.122669][T21385] usb 5-1: config 5 has an invalid interface number: 21 but max is 0 [ 1365.145910][T21385] usb 5-1: config 5 has no interface number 0 [ 1365.164622][T21385] usb 5-1: config 5 interface 21 has no altsetting 0 [ 1365.187586][T21385] usb 5-1: New USB device found, idVendor=0cf3, idProduct=b003, bcdDevice=93.d3 [ 1365.209319][T21385] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1365.230884][T21385] usb 5-1: Product: syz [ 1365.247115][T21385] usb 5-1: Manufacturer: syz [ 1365.271027][T21385] usb 5-1: SerialNumber: syz [ 1365.540406][T21385] usb 5-1: ath9k_htc: Device endpoint numbers are not the expected ones [ 1365.600360][T21385] usb 5-1: USB disconnect, device number 14 [ 1366.257239][T27553] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7450'. [ 1366.316560][T18511] Bluetooth: hci2: Ignoring connect complete event for invalid link type [ 1366.410716][T27560] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7452'. [ 1366.457382][T27560] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7452'. [ 1366.469221][T20216] net_ratelimit: 19 callbacks suppressed [ 1366.469240][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1366.489522][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1366.587865][T27552] bridge0: port 2(bridge_slave_1) entered disabled state [ 1366.595246][T27552] bridge0: port 1(bridge_slave_0) entered disabled state [ 1366.849657][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1366.993475][T21379] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 1367.032240][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1367.046687][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1367.180732][T21379] usb 5-1: config 7 descriptor has 1 excess byte, ignoring [ 1367.193633][T27552] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1367.207638][T21379] usb 5-1: config 7 has 1 interface, different from the descriptor's value: 2 [ 1367.218255][T27552] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1367.258648][T21379] usb 5-1: New USB device found, idVendor=19d2, idProduct=1275, bcdDevice= 7.84 [ 1367.303826][T21401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1367.330776][T21379] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1367.363892][T21379] usb 5-1: Product: syz [ 1367.378448][T21379] usb 5-1: Manufacturer: syz [ 1367.393648][T21379] usb 5-1: SerialNumber: syz [ 1367.425575][T21379] rndis_host 5-1:7.0: skipping garbage [ 1367.463221][T21379] rndis_host 5-1:7.0: rndis: master #0/ffff88807ad20000 slave #1/0000000000000000 [ 1367.491181][T21379] option 5-1:7.0: GSM modem (1-port) converter detected [ 1367.581984][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1367.596795][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1368.068311][T21380] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1368.174173][T27553] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1368.188396][T27553] 8021q: adding VLAN 0 to HW filter on device team0 [ 1368.195586][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1368.221327][T27553] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1368.279974][T27553] bridge0: port 1(bridge_slave_0) entered blocking state [ 1368.287233][T27553] bridge0: port 1(bridge_slave_0) entered listening state [ 1368.325271][T27553] bridge0: port 2(bridge_slave_1) entered blocking state [ 1368.332554][T27553] bridge0: port 2(bridge_slave_1) entered listening state [ 1368.377604][T27553] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1368.403462][T27553] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1368.456883][T27560] tipc: Enabling of bearer rejected, failed to enable media [ 1368.526812][T20217] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1368.542715][T20217] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1368.569964][T20217] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1368.602018][T27582] syzkaller0: entered promiscuous mode [ 1368.607937][T27582] syzkaller0: entered allmulticast mode [ 1368.645322][T27586] netlink: 'syz.0.7457': attribute type 7 has an invalid length. [ 1368.811473][T27589] loop4: detected capacity change from 0 to 7 [ 1368.822716][T27589] loop4: [ 1368.827524][T27589] loop4: partition table partially beyond EOD, truncated [ 1368.941413][T27579] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 1369.101498][T27579] usb 1-1: Using ep0 maxpacket: 8 [ 1369.114986][T27579] usb 1-1: config 1 has an invalid descriptor of length 173, skipping remainder of the config [ 1369.130100][T27579] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1369.140452][T27579] usb 1-1: config 1 has no interface number 0 [ 1369.147651][T27579] usb 1-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xBC, changing to 0x8C [ 1369.159954][T27579] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x8C has an invalid bInterval 93, changing to 7 [ 1369.179245][T27579] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x8C has invalid maxpacket 9440, setting to 1024 [ 1369.195957][T27579] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 1369.206073][T27579] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1369.214457][T27579] usb 1-1: Product: syz [ 1369.218846][T27579] usb 1-1: Manufacturer: syz [ 1369.224064][T27579] usb 1-1: SerialNumber: syz [ 1369.517748][T20505] usb 5-1: USB disconnect, device number 15 [ 1369.535911][T20505] option 5-1:7.0: device disconnected [ 1369.599969][T27604] binder: 27603:27604 ioctl c0306201 0 returned -14 [ 1369.610543][T27604] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 1369.620072][T27604] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 1369.630666][T27604] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 1369.813226][T27607] binder: 27606:27607 ioctl c0306201 0 returned -14 [ 1369.851799][T27586] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1369.862004][T27586] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1369.886686][T20505] usb 1-1: USB disconnect, device number 30 [ 1370.039335][T27610] FAULT_INJECTION: forcing a failure. [ 1370.039335][T27610] name failslab, interval 1, probability 0, space 0, times 0 [ 1370.063700][T27610] CPU: 1 UID: 0 PID: 27610 Comm: syz.2.7465 Tainted: G L syzkaller #0 PREEMPT(full) [ 1370.063737][T27610] Tainted: [L]=SOFTLOCKUP [ 1370.063746][T27610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1370.063761][T27610] Call Trace: [ 1370.063771][T27610] [ 1370.063781][T27610] dump_stack_lvl+0xe8/0x150 [ 1370.063821][T27610] should_fail_ex+0x40c/0x560 [ 1370.063856][T27610] should_failslab+0xa8/0x100 [ 1370.063894][T27610] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1370.063924][T27610] ? security_inode_alloc+0x39/0x310 [ 1370.063950][T27610] ? security_inode_alloc+0x39/0x310 [ 1370.063985][T27610] security_inode_alloc+0x39/0x310 [ 1370.064015][T27610] inode_init_always_gfp+0x97e/0xd30 [ 1370.064051][T27610] ? __pfx_shmem_alloc_inode+0x10/0x10 [ 1370.064081][T27610] alloc_inode+0x82/0x1b0 [ 1370.064112][T27610] new_inode+0x1f/0x170 [ 1370.064141][T27610] ? shmem_get_inode+0x29a/0xfe0 [ 1370.064172][T27610] shmem_get_inode+0x3a4/0xfe0 [ 1370.064198][T27610] ? kmem_cache_alloc_noprof+0x150/0x5f0 [ 1370.064225][T27610] ? mas_alloc_nodes+0x291/0x350 [ 1370.064259][T27610] ? __pfx_shmem_get_inode+0x10/0x10 [ 1370.064293][T27610] ? __vm_enough_memory+0x11a/0x380 [ 1370.064319][T27610] __shmem_file_setup+0x20b/0x370 [ 1370.064346][T27610] ? __pfx___shmem_file_setup+0x10/0x10 [ 1370.064380][T27610] shmem_zero_setup+0x90/0x130 [ 1370.064406][T27610] mmap_region+0x1974/0x2310 [ 1370.064439][T27610] ? __lock_acquire+0x683/0x2cf0 [ 1370.064477][T27610] ? __pfx_mmap_region+0x10/0x10 [ 1370.064498][T27610] ? __lock_acquire+0x683/0x2cf0 [ 1370.064617][T27610] ? arch_get_unmapped_area_topdown+0x269/0xb50 [ 1370.064680][T27610] ? cap_mmap_addr+0xaf/0x100 [ 1370.064713][T27610] ? bpf_lsm_mmap_addr+0x9/0x50 [ 1370.064738][T27610] ? security_mmap_addr+0x71/0x240 [ 1370.064779][T27610] do_mmap+0xc3b/0x10c0 [ 1370.064817][T27610] ? __pfx_do_mmap+0x10/0x10 [ 1370.064837][T27610] ? down_write_killable+0x180/0x240 [ 1370.064870][T27610] ? __pfx_down_write_killable+0x10/0x10 [ 1370.064899][T27610] ? apparmor_mmap_file+0x197/0x3e0 [ 1370.064929][T27610] ? security_mmap_file+0x4df/0xa20 [ 1370.064967][T27610] vm_mmap_pgoff+0x272/0x4e0 [ 1370.065009][T27610] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1370.065041][T27610] ? ksys_write+0x242/0x270 [ 1370.065066][T27610] ? __pfx_ksys_write+0x10/0x10 [ 1370.065091][T27610] ? ksys_mmap_pgoff+0xf3/0x760 [ 1370.065116][T27610] ? __x64_sys_mmap+0x7f/0x140 [ 1370.065150][T27610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1370.065175][T27610] do_syscall_64+0x174/0x580 [ 1370.065200][T27610] ? trace_irq_disable+0x3b/0x140 [ 1370.065230][T27610] ? clear_bhb_loop+0x40/0x90 [ 1370.065258][T27610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1370.065282][T27610] RIP: 0033:0x7f7c52d9de99 [ 1370.065303][T27610] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1370.065324][T27610] RSP: 002b:00007f7c53c99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1370.065348][T27610] RAX: ffffffffffffffda RBX: 00007f7c53025fa0 RCX: 00007f7c52d9de99 [ 1370.065365][T27610] RDX: b635773f06ebbeef RSI: 0000000000b36000 RDI: 0000200000000000 [ 1370.065381][T27610] RBP: 00007f7c53c99090 R08: ffffffffffffffff R09: 0000000000000000 [ 1370.065397][T27610] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000001 [ 1370.065412][T27610] R13: 00007f7c53026038 R14: 00007f7c53025fa0 R15: 00007f7c5314fa48 [ 1370.065447][T27610] [ 1370.748945][T27627] FAULT_INJECTION: forcing a failure. [ 1370.748945][T27627] name failslab, interval 1, probability 0, space 0, times 0 [ 1370.793483][T27627] CPU: 0 UID: 0 PID: 27627 Comm: syz.2.7470 Tainted: G L syzkaller #0 PREEMPT(full) [ 1370.793525][T27627] Tainted: [L]=SOFTLOCKUP [ 1370.793532][T27627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1370.793542][T27627] Call Trace: [ 1370.793549][T27627] [ 1370.793556][T27627] dump_stack_lvl+0xe8/0x150 [ 1370.793584][T27627] should_fail_ex+0x40c/0x560 [ 1370.793609][T27627] should_failslab+0xa8/0x100 [ 1370.793636][T27627] __kmalloc_noprof+0xfe/0x720 [ 1370.793659][T27627] ? key_put+0xb7/0x270 [ 1370.793676][T27627] ? __keyctl_dh_compute+0x3df/0xd10 [ 1370.793695][T27627] ? __keyctl_dh_compute+0x3df/0xd10 [ 1370.793719][T27627] __keyctl_dh_compute+0x3df/0xd10 [ 1370.793743][T27627] ? __lock_acquire+0x683/0x2cf0 [ 1370.793769][T27627] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 1370.793798][T27627] ? __might_fault+0xaf/0x130 [ 1370.793833][T27627] keyctl_dh_compute+0x124/0x180 [ 1370.793855][T27627] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 1370.793887][T27627] __se_sys_keyctl+0x44c/0x9d0 [ 1370.793914][T27627] ? __pfx___se_sys_keyctl+0x10/0x10 [ 1370.793937][T27627] ? __mutex_unlock_slowpath+0x731/0x900 [ 1370.793959][T27627] ? __fget_files+0x2a/0x420 [ 1370.793982][T27627] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1370.794002][T27627] ? __fget_files+0x3a2/0x420 [ 1370.794028][T27627] ? fput+0xa0/0xd0 [ 1370.794049][T27627] ? ksys_write+0x242/0x270 [ 1370.794066][T27627] ? __pfx_ksys_write+0x10/0x10 [ 1370.794085][T27627] ? __x64_sys_keyctl+0x20/0xc0 [ 1370.794109][T27627] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1370.794126][T27627] do_syscall_64+0x174/0x580 [ 1370.794149][T27627] ? trace_irq_disable+0x3b/0x140 [ 1370.794171][T27627] ? clear_bhb_loop+0x40/0x90 [ 1370.794190][T27627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1370.794205][T27627] RIP: 0033:0x7f7c52d9de99 [ 1370.794221][T27627] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1370.794234][T27627] RSP: 002b:00007f7c53c99028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1370.794251][T27627] RAX: ffffffffffffffda RBX: 00007f7c53025fa0 RCX: 00007f7c52d9de99 [ 1370.794263][T27627] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000017 [ 1370.794273][T27627] RBP: 00007f7c53c99090 R08: 0000200000000180 R09: 0000000000000000 [ 1370.794284][T27627] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1370.794293][T27627] R13: 00007f7c53026038 R14: 00007f7c53025fa0 R15: 00007f7c5314fa48 [ 1370.794316][T27627] [ 1371.059183][T27623] tipc: Enabled bearer , priority 10 [ 1371.075378][T27630] bridge0: left promiscuous mode [ 1371.287963][T27637] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1371.339072][T27637] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7474'. [ 1371.503356][T20505] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 1371.571511][T20219] net_ratelimit: 19 callbacks suppressed [ 1371.571531][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1371.592302][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1371.607155][T21612] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1371.649225][T27644] bridge0: port 2(bridge_slave_1) entered disabled state [ 1371.656655][T27644] bridge0: port 1(bridge_slave_0) entered disabled state [ 1371.668436][T27650] binder: 27647:27650 ioctl c0306201 0 returned -14 [ 1371.677732][T27650] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 1371.713089][T20505] usb 1-1: Using ep0 maxpacket: 16 [ 1371.723801][T27650] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 1371.744270][T20505] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1371.759012][T27648] bridge0: port 2(bridge_slave_1) entered blocking state [ 1371.766328][T27648] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1371.773934][T27648] bridge0: port 1(bridge_slave_0) entered blocking state [ 1371.781184][T27648] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1371.868492][T20505] usb 1-1: config 5 has an invalid interface number: 21 but max is 0 [ 1371.877604][T27650] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 1371.888131][T27656] netlink: 68 bytes leftover after parsing attributes in process `syz.2.7473'. [ 1371.899056][T27656] tipc: Enabling of bearer rejected, media not registered [ 1371.912103][T20505] usb 1-1: config 5 has no interface number 0 [ 1371.943588][T20505] usb 1-1: config 5 interface 21 has no altsetting 0 [ 1371.968171][T20505] usb 1-1: New USB device found, idVendor=0cf3, idProduct=b003, bcdDevice=93.d3 [ 1371.981733][T20505] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1371.990681][T20505] usb 1-1: Product: syz [ 1372.003608][T20505] usb 1-1: Manufacturer: syz [ 1372.023013][T20505] usb 1-1: SerialNumber: syz [ 1372.241626][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1372.256136][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1372.339083][T20505] usb 1-1: ath9k_htc: Device endpoint numbers are not the expected ones [ 1372.371706][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1372.387769][T20505] usb 1-1: USB disconnect, device number 31 [ 1372.461622][T21386] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1372.931908][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1372.946331][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1373.491567][T20505] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1373.748743][T27679] FAULT_INJECTION: forcing a failure. [ 1373.748743][T27679] name failslab, interval 1, probability 0, space 0, times 0 [ 1373.796612][T27679] CPU: 0 UID: 0 PID: 27679 Comm: syz.4.7483 Tainted: G L syzkaller #0 PREEMPT(full) [ 1373.796648][T27679] Tainted: [L]=SOFTLOCKUP [ 1373.796657][T27679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1373.796671][T27679] Call Trace: [ 1373.796681][T27679] [ 1373.796690][T27679] dump_stack_lvl+0xe8/0x150 [ 1373.796730][T27679] should_fail_ex+0x40c/0x560 [ 1373.796765][T27679] should_failslab+0xa8/0x100 [ 1373.796802][T27679] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1373.796832][T27679] ? security_inode_alloc+0x39/0x310 [ 1373.796860][T27679] ? security_inode_alloc+0x39/0x310 [ 1373.796894][T27679] security_inode_alloc+0x39/0x310 [ 1373.796923][T27679] inode_init_always_gfp+0x97e/0xd30 [ 1373.796960][T27679] ? __pfx_sock_alloc_inode+0x10/0x10 [ 1373.796992][T27679] alloc_inode+0x82/0x1b0 [ 1373.797022][T27679] do_accept+0x13e/0x750 [ 1373.797050][T27679] ? __pfx_do_accept+0x10/0x10 [ 1373.797108][T27679] io_accept+0x310/0x7a0 [ 1373.797156][T27679] ? __pfx_io_accept+0x10/0x10 [ 1373.797186][T27679] ? __lock_acquire+0x683/0x2cf0 [ 1373.797225][T27679] __io_issue_sqe+0x188/0x4d0 [ 1373.797267][T27679] io_poll_issue+0x125/0x1d0 [ 1373.797299][T27679] io_poll_task_func+0x342/0xc40 [ 1373.797333][T27679] ? __pfx_io_poll_task_func+0x10/0x10 [ 1373.797360][T27679] ? tctx_task_work_run+0x2df/0xa80 [ 1373.797385][T27679] ? __pfx_io_poll_task_func+0x10/0x10 [ 1373.797410][T27679] tctx_task_work_run+0x5ac/0xa80 [ 1373.797454][T27679] ? __pfx_tctx_task_work_run+0x10/0x10 [ 1373.797490][T27679] tctx_task_work+0x3f/0x60 [ 1373.797513][T27679] task_work_run+0x1d9/0x270 [ 1373.797538][T27679] ? __pfx_task_work_run+0x10/0x10 [ 1373.797573][T27679] get_signal+0x1181/0x12c0 [ 1373.797605][T27679] ? refcount_dec_and_test+0x4f/0x80 [ 1373.797633][T27679] ? unix_stream_connect+0xd82/0x1000 [ 1373.797671][T27679] arch_do_signal_or_restart+0xbb/0x860 [ 1373.797706][T27679] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1373.797759][T27679] exit_to_user_mode_loop+0x104/0x730 [ 1373.797790][T27679] ? rcu_is_watching+0x15/0xb0 [ 1373.797814][T27679] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1373.797839][T27679] do_syscall_64+0x353/0x580 [ 1373.797865][T27679] ? trace_irq_disable+0x3b/0x140 [ 1373.797894][T27679] ? clear_bhb_loop+0x40/0x90 [ 1373.797923][T27679] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1373.797946][T27679] RIP: 0033:0x7f3cdcd9de99 [ 1373.797968][T27679] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1373.797989][T27679] RSP: 002b:00007f3cdaff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1373.798014][T27679] RAX: 0000000000000000 RBX: 00007f3cdd025fa0 RCX: 00007f3cdcd9de99 [ 1373.798030][T27679] RDX: 000000000000006e RSI: 0000200000000100 RDI: 0000000000000005 [ 1373.798045][T27679] RBP: 00007f3cdaff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1373.798059][T27679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1373.798073][T27679] R13: 00007f3cdd026038 R14: 00007f3cdd025fa0 R15: 00007f3cdd14fa48 [ 1373.798109][T27679] [ 1375.681887][T27698] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 1375.706283][T27698] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 1375.737700][T27698] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 1375.761839][T20218] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1376.074873][T27709] netlink: 124 bytes leftover after parsing attributes in process `syz.4.7490'. [ 1376.351234][T27579] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 1376.371626][T21612] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 1376.513362][T27579] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1376.551326][T21612] usb 2-1: Using ep0 maxpacket: 32 [ 1376.560631][T27579] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1376.596681][T21612] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1376.613181][T27579] usb 1-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 1376.618646][T21386] net_ratelimit: 15 callbacks suppressed [ 1376.618704][T21386] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1376.626511][T21612] usb 2-1: config 0 has no interface number 0 [ 1376.667111][T27579] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1376.695704][T21612] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1376.717532][T27579] usb 1-1: config 0 descriptor?? [ 1376.728730][T21612] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1376.746313][T27713] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 1376.778993][T21612] usb 2-1: Product: syz [ 1376.787163][T27713] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 1376.791462][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1376.810146][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1376.815626][T21612] usb 2-1: Manufacturer: syz [ 1376.840090][T27713] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 1376.853369][T27579] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1376.866174][T21612] usb 2-1: SerialNumber: syz [ 1376.907228][T21612] usb 2-1: config 0 descriptor?? [ 1376.929610][T21612] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1376.951059][T21612] usb 2-1: selecting invalid altsetting 1 [ 1376.976458][T21612] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1377.022186][T21612] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1377.060653][T21612] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1377.095592][T21612] usb 2-1: media controller created [ 1377.192694][T21612] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1377.290668][T27719] loop7: detected capacity change from 0 to 16384 [ 1377.330299][T21612] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 1377.387357][T21612] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1377.404692][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1377.419384][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1377.442538][T21612] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1377.492653][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1377.651698][T27579] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1377.663257][T21380] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1377.957908][T21612] usb 2-1: USB disconnect, device number 58 [ 1378.131488][T20214] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1378.178364][T27724] FAULT_INJECTION: forcing a failure. [ 1378.178364][T27724] name failslab, interval 1, probability 0, space 0, times 0 [ 1378.229269][T27724] CPU: 0 UID: 0 PID: 27724 Comm: syz.2.7498 Tainted: G L syzkaller #0 PREEMPT(full) [ 1378.229304][T27724] Tainted: [L]=SOFTLOCKUP [ 1378.229313][T27724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1378.229327][T27724] Call Trace: [ 1378.229336][T27724] [ 1378.229347][T27724] dump_stack_lvl+0xe8/0x150 [ 1378.229387][T27724] should_fail_ex+0x40c/0x560 [ 1378.229422][T27724] should_failslab+0xa8/0x100 [ 1378.229459][T27724] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 1378.229488][T27724] ? local_lock_release+0x9c/0x160 [ 1378.229522][T27724] ? __alloc_skb+0x1d7/0x7a0 [ 1378.229543][T27724] ? __alloc_skb+0x1d7/0x7a0 [ 1378.229571][T27724] __alloc_skb+0x1d7/0x7a0 [ 1378.229598][T27724] netlink_ack+0x136/0xb30 [ 1378.229623][T27724] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1378.229645][T27724] ? ref_tracker_free+0x689/0x830 [ 1378.229681][T27724] ? __pfx_ref_tracker_free+0x10/0x10 [ 1378.229721][T27724] netlink_rcv_skb+0x2a4/0x4a0 [ 1378.229749][T27724] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1378.229773][T27724] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1378.229813][T27724] ? netlink_deliver_tap+0x2e/0x1b0 [ 1378.229839][T27724] ? netlink_deliver_tap+0x2e/0x1b0 [ 1378.229886][T27724] netlink_unicast+0x7bb/0x940 [ 1378.229922][T27724] netlink_sendmsg+0x813/0xb40 [ 1378.229959][T27724] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1378.229990][T27724] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1378.230021][T27724] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1378.230048][T27724] sock_sendmsg_nosec+0x13a/0x180 [ 1378.230081][T27724] ____sys_sendmsg+0x54e/0x850 [ 1378.230114][T27724] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1378.230149][T27724] ? import_iovec+0x73/0xa0 [ 1378.230175][T27724] ___sys_sendmsg+0x2a5/0x360 [ 1378.230201][T27724] ? __lock_acquire+0x683/0x2cf0 [ 1378.230237][T27724] ? __pfx____sys_sendmsg+0x10/0x10 [ 1378.230267][T27724] ? kstrtouint+0x6e/0xe0 [ 1378.230321][T27724] ? __fget_files+0x2a/0x420 [ 1378.230352][T27724] ? __fget_files+0x3a2/0x420 [ 1378.230393][T27724] __sys_sendmmsg+0x273/0x4d0 [ 1378.230426][T27724] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1378.230463][T27724] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1378.230512][T27724] ? ksys_write+0x242/0x270 [ 1378.230539][T27724] ? __pfx_ksys_write+0x10/0x10 [ 1378.230569][T27724] __x64_sys_sendmmsg+0xa0/0xc0 [ 1378.230596][T27724] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1378.230621][T27724] do_syscall_64+0x174/0x580 [ 1378.230645][T27724] ? trace_irq_disable+0x3b/0x140 [ 1378.230676][T27724] ? clear_bhb_loop+0x40/0x90 [ 1378.230704][T27724] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1378.230727][T27724] RIP: 0033:0x7f7c52d9de99 [ 1378.230750][T27724] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1378.230769][T27724] RSP: 002b:00007f7c53c99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1378.230794][T27724] RAX: ffffffffffffffda RBX: 00007f7c53025fa0 RCX: 00007f7c52d9de99 [ 1378.230811][T27724] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 1378.230827][T27724] RBP: 00007f7c53c99090 R08: 0000000000000000 R09: 0000000000000000 [ 1378.230842][T27724] R10: 00000000000000fc R11: 0000000000000246 R12: 0000000000000001 [ 1378.230856][T27724] R13: 00007f7c53026038 R14: 00007f7c53025fa0 R15: 00007f7c5314fa48 [ 1378.230890][T27724] [ 1378.691142][T21612] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 1378.891531][T21612] usb 2-1: Using ep0 maxpacket: 16 [ 1378.898487][T21612] usb 2-1: config index 0 descriptor too short (expected 16456, got 72) [ 1378.967338][T21612] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 1379.005184][T21612] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 1379.027601][T21612] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 1379.036853][T21612] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1379.045882][T21612] usb 2-1: config 0 has no interface number 0 [ 1379.052947][T21612] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 1379.064471][T21612] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 1379.130002][T21612] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1379.176228][T27730] bridge0: port 2(bridge_slave_1) entered disabled state [ 1379.183545][T27730] bridge0: port 1(bridge_slave_0) entered disabled state [ 1379.191592][T21612] usb 2-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1379.296678][T21612] usb 2-1: config 0 interface 125 has no altsetting 0 [ 1379.318990][T27734] bridge0: port 2(bridge_slave_1) entered blocking state [ 1379.326828][T27734] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1379.334504][T27734] bridge0: port 1(bridge_slave_0) entered blocking state [ 1379.341741][T27734] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1379.363096][T21612] usb 2-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 1379.372548][T21612] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1379.422205][T21612] usb 2-1: Product: syz [ 1379.477203][T21612] usb 2-1: Manufacturer: syz [ 1379.499391][T27734] bridge0: entered promiscuous mode [ 1379.509889][T21612] usb 2-1: SerialNumber: syz [ 1379.537737][T27734] bridge0: entered allmulticast mode [ 1379.609975][T21612] usb 2-1: config 0 descriptor?? [ 1379.639178][T21386] usb 1-1: USB disconnect, device number 32 [ 1379.714290][T27733] bridge0: port 2(bridge_slave_1) entered disabled state [ 1379.721721][T27733] bridge0: port 1(bridge_slave_0) entered disabled state [ 1379.798753][T27737] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7499'. [ 1379.861427][T27737] tipc: Enabling of bearer rejected, media not registered [ 1379.954912][T27738] bridge0: port 2(bridge_slave_1) entered blocking state [ 1379.962157][T27738] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1379.969706][T27738] bridge0: port 1(bridge_slave_0) entered blocking state [ 1379.977019][T27738] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1380.009089][T27741] netlink: 68 bytes leftover after parsing attributes in process `syz.2.7500'. [ 1380.084309][T27741] tipc: Enabling of bearer rejected, media not registered [ 1380.227161][T27722] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1380.240556][T27722] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1380.315470][T20505] usb 2-1: USB disconnect, device number 59 [ 1380.417976][T27759] binder: 27757:27759 ioctl c0306201 0 returned -14 [ 1380.447993][T27759] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 1380.473234][T27759] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 1380.508238][T27759] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 1381.471176][T21612] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1381.522924][T27781] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 1381.544964][T27782] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1381.575195][T27783] netlink: 124 bytes leftover after parsing attributes in process `syz.3.7509'. [ 1381.604181][T27782] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7510'. [ 1381.624731][T27781] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1381.641578][T21612] usb 3-1: Using ep0 maxpacket: 32 [ 1381.686130][T21612] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1381.727627][T21612] usb 3-1: config 0 has no interface number 0 [ 1381.776317][T21612] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1381.793986][T20218] net_ratelimit: 20 callbacks suppressed [ 1381.794008][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1381.814796][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1381.835901][T27784] netlink: 52 bytes leftover after parsing attributes in process `syz.0.7511'. [ 1381.843435][T21386] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1381.853814][T21612] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1381.903696][T21612] usb 3-1: Product: syz [ 1381.932818][T21612] usb 3-1: Manufacturer: syz [ 1382.002936][T21612] usb 3-1: SerialNumber: syz [ 1382.063482][T21612] usb 3-1: config 0 descriptor?? [ 1382.159531][T21612] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1382.266347][T21612] usb 3-1: selecting invalid altsetting 1 [ 1382.383605][T21612] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1382.445449][T21612] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1382.452133][T20505] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 1382.490174][T27791] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7513'. [ 1382.531628][T21612] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1382.560416][T21612] usb 3-1: media controller created [ 1382.622478][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1382.631621][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1382.646607][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1382.676257][T20505] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1382.704902][T20505] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1382.735955][T20505] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1382.764539][T20505] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1382.818160][T27788] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1382.848197][T20505] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1382.850292][T21612] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1382.882024][T21380] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1383.102882][T21612] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 1383.147994][T21612] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1383.199932][T21612] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1383.241495][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1383.256498][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1383.278914][T20505] usb 5-1: USB disconnect, device number 16 [ 1383.427884][T21612] usb 3-1: USB disconnect, device number 34 [ 1383.440452][T27788] binder: 27787:27788 ioctl 84009422 200000000180 returned -22 [ 1383.731194][T23869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1383.855492][T20218] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1383.995028][T27805] bridge0: port 2(bridge_slave_1) entered disabled state [ 1384.002404][T27805] bridge0: port 1(bridge_slave_0) entered disabled state [ 1384.180443][T27808] bridge0: port 2(bridge_slave_1) entered blocking state [ 1384.187761][T27808] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1384.195488][T27808] bridge0: port 1(bridge_slave_0) entered blocking state [ 1384.202768][T27808] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1384.261064][T27812] binder: 27810:27812 ioctl c0306201 0 returned -14 [ 1384.323754][T27805] netlink: 68 bytes leftover after parsing attributes in process `syz.2.7518'. [ 1384.335492][T27812] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 1384.362013][T27805] tipc: Enabling of bearer rejected, media not registered [ 1384.372608][T27812] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 1384.394558][T27812] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 1384.521045][T20505] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 1384.691072][T20505] usb 1-1: Using ep0 maxpacket: 8 [ 1384.705076][T20505] usb 1-1: config 0 has no interfaces? [ 1384.721737][T20505] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1384.750695][T20505] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1384.785305][T20505] usb 1-1: config 0 descriptor?? [ 1385.093648][T27814] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7519'. [ 1385.490569][T27829] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7523'. [ 1385.525165][T27829] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7523'. [ 1385.593953][T20505] usb 1-1: USB disconnect, device number 33 [ 1386.175112][T27840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1386.482373][T27847] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7527'. [ 1386.651093][T21612] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 1386.822947][T21612] usb 1-1: Using ep0 maxpacket: 32 [ 1386.857170][T21612] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1386.883210][T21612] usb 1-1: config 0 has no interface number 0 [ 1386.896810][T21612] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1386.906715][T27851] ªªªªªª: renamed from vlan0 [ 1386.923909][T21612] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1386.959476][T21612] usb 1-1: Product: syz [ 1386.979636][T21612] usb 1-1: Manufacturer: syz [ 1387.010369][T21612] usb 1-1: SerialNumber: syz [ 1387.042986][T20216] net_ratelimit: 16 callbacks suppressed [ 1387.043008][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1387.063386][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1387.086251][T21612] usb 1-1: config 0 descriptor?? [ 1387.093336][T20505] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1387.119170][T21612] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1387.158745][T21612] usb 1-1: selecting invalid altsetting 1 [ 1387.198459][T21612] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1387.246251][T21612] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1387.285536][T27858] netlink: 124 bytes leftover after parsing attributes in process `syz.3.7530'. [ 1387.302517][T21612] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1387.345633][T21612] usb 1-1: media controller created [ 1387.484483][T21612] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1387.552039][T27862] FAULT_INJECTION: forcing a failure. [ 1387.552039][T27862] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1387.619094][T27862] CPU: 0 UID: 0 PID: 27862 Comm: syz.4.7532 Tainted: G L syzkaller #0 PREEMPT(full) [ 1387.619133][T27862] Tainted: [L]=SOFTLOCKUP [ 1387.619142][T27862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1387.619156][T27862] Call Trace: [ 1387.619165][T27862] [ 1387.619176][T27862] dump_stack_lvl+0xe8/0x150 [ 1387.619216][T27862] should_fail_ex+0x40c/0x560 [ 1387.619251][T27862] _copy_to_user+0x31/0xb0 [ 1387.619284][T27862] simple_read_from_buffer+0xe1/0x170 [ 1387.619322][T27862] proc_fail_nth_read+0x1bb/0x230 [ 1387.619357][T27862] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1387.619394][T27862] ? rw_verify_area+0x24a/0x4c0 [ 1387.619418][T27862] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1387.619449][T27862] vfs_read+0x213/0xa80 [ 1387.619477][T27862] ? __pfx___mutex_lock+0x10/0x10 [ 1387.619505][T27862] ? __pfx_vfs_read+0x10/0x10 [ 1387.619529][T27862] ? __fget_files+0x2a/0x420 [ 1387.619566][T27862] ? __fget_files+0x3a2/0x420 [ 1387.619596][T27862] ? __fget_files+0x2a/0x420 [ 1387.619637][T27862] ksys_read+0x150/0x270 [ 1387.619662][T27862] ? __pfx_ksys_read+0x10/0x10 [ 1387.619688][T27862] ? __secure_computing+0xe7/0x2b0 [ 1387.619723][T27862] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1387.619748][T27862] do_syscall_64+0x174/0x580 [ 1387.619774][T27862] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1387.619798][T27862] ? clear_bhb_loop+0x40/0x90 [ 1387.619825][T27862] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1387.619849][T27862] RIP: 0033:0x7f3cdcd5e6ce [ 1387.619869][T27862] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1387.619889][T27862] RSP: 002b:00007f3cdaff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1387.619913][T27862] RAX: ffffffffffffffda RBX: 00007f3cdaff66c0 RCX: 00007f3cdcd5e6ce [ 1387.619930][T27862] RDX: 000000000000000f RSI: 00007f3cdaff60a0 RDI: 0000000000000003 [ 1387.619945][T27862] RBP: 00007f3cdaff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1387.619960][T27862] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1387.619973][T27862] R13: 00007f3cdd026038 R14: 00007f3cdd025fa0 R15: 00007f3cdd14fa48 [ 1387.620006][T27862] [ 1387.889121][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1387.903600][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1388.141614][T21380] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1388.291095][T20505] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 1388.423674][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1388.438106][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1388.452908][T27845] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1388.471316][T20505] usb 2-1: Using ep0 maxpacket: 8 [ 1388.493266][T21612] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 1388.512169][T21612] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1388.524277][T27869] netlink: 'syz.4.7535': attribute type 153 has an invalid length. [ 1388.538507][T20505] usb 2-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1388.577353][T20505] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1388.599136][T21612] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1388.621113][T20505] usb 2-1: Product: syz [ 1388.633472][T20505] usb 2-1: Manufacturer: syz [ 1388.654927][T20505] usb 2-1: SerialNumber: syz [ 1388.670466][T20505] usb 2-1: config 0 descriptor?? [ 1388.696513][T20505] gspca_main: se401-2.14.0 probing 047d:5003 [ 1388.824560][T21612] usb 1-1: USB disconnect, device number 34 [ 1388.896493][T27864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1388.921899][T27871] gre2: entered promiscuous mode [ 1388.940354][T27864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1389.064248][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1389.078764][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1389.196446][T20505] gspca_se401: ExtraFeatures: 4 [ 1389.398514][T27864] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7533'. [ 1389.436425][T27864] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1389.476369][T27864] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7533'. [ 1389.692887][T27888] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7541'. [ 1389.915900][T27891] fuse: Unknown parameter '00000001000000000002300000000351843720900480x000020000000058000000000000000000006' [ 1390.214756][T20505] input: se401 as /devices/platform/dummy_hcd.1/usb2/2-1/input/input90 [ 1390.381457][T27886] block device autoloading is deprecated and will be removed. [ 1390.464705][T20505] usb 2-1: USB disconnect, device number 60 [ 1391.205872][T27906] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7546'. [ 1391.277748][T27910] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7549'. [ 1391.311053][T21380] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 1391.501335][T21380] usb 4-1: Using ep0 maxpacket: 8 [ 1391.510530][T21380] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 1391.519106][T21380] usb 4-1: config 179 has no interface number 0 [ 1391.525598][T21380] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 1391.537176][T21380] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 1391.548842][T21380] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 1391.566361][T21380] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 1391.579968][T21380] usb 4-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1391.593916][T21380] usb 4-1: config 179 interface 65 has no altsetting 0 [ 1391.601253][T21380] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 1391.610627][T21380] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1391.709835][T21380] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input92 [ 1391.781366][ T4978] input input92: unable to receive magic message: -110 [ 1391.861385][ T4978] input input92: unable to receive magic message: -32 [ 1391.935545][ T4978] input input92: unable to receive magic message: -32 [ 1391.948614][ T4978] input input92: unable to receive magic message: -32 [ 1391.994583][ T4978] input input92: unable to receive magic message: -32 [ 1392.025112][ T4978] input input92: unable to receive magic message: -32 [ 1392.098240][T27905] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3659427032 (29275416256 ns) > initial count (200000 ns). Using initial count to start timer. [ 1392.207977][T20217] net_ratelimit: 1039 callbacks suppressed [ 1392.208019][T20217] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1392.228696][T20217] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1392.303842][T21380] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1392.674136][T21380] usb 4-1: USB disconnect, device number 120 [ 1392.680282][ C1] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1392.771118][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1392.785665][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1392.853945][T21612] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1393.354848][T21380] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1393.355995][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1393.377729][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1393.905347][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1394.261592][T21380] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 1394.421153][T21380] usb 4-1: Using ep0 maxpacket: 16 [ 1394.430205][T21380] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1394.439845][T21380] usb 4-1: config 5 has an invalid interface number: 21 but max is 0 [ 1394.448457][T21380] usb 4-1: config 5 has no interface number 0 [ 1394.455140][T21380] usb 4-1: config 5 interface 21 has no altsetting 0 [ 1394.466253][T21380] usb 4-1: New USB device found, idVendor=0cf3, idProduct=b003, bcdDevice=93.d3 [ 1394.494914][T21380] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.526090][T21380] usb 4-1: Product: syz [ 1394.530345][T21380] usb 4-1: Manufacturer: syz [ 1394.535598][T21380] usb 4-1: SerialNumber: syz [ 1397.517558][T20505] net_ratelimit: 18 callbacks suppressed [ 1397.517574][T20505] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1397.598420][T20217] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1397.613022][T20217] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1398.202673][T20217] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1398.217626][T20217] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1398.537585][T20505] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1398.613086][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 1398.621218][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 1398.752256][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1398.766758][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1398.931462][T27579] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1399.311592][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1399.340646][T27943] bridge0: port 2(bridge_slave_1) entered disabled state [ 1399.348032][T27943] bridge0: port 1(bridge_slave_0) entered disabled state [ 1399.427814][T27945] bridge0: port 2(bridge_slave_1) entered blocking state [ 1399.435112][T27945] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1399.442743][T27945] bridge0: port 1(bridge_slave_0) entered blocking state [ 1399.449983][T27945] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1399.464058][T21380] usb 4-1: ath9k_htc: Device endpoint numbers are not the expected ones [ 1399.530271][T27946] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7558'. [ 1399.541658][T21380] usb 4-1: USB disconnect, device number 121 [ 1399.560440][T27946] tipc: Enabling of bearer rejected, media not registered [ 1399.638177][T27955] binder: 27953:27955 ioctl c0306201 0 returned -14 [ 1399.677327][T27955] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 1399.716204][T27955] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 1399.745496][T27955] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 1399.840065][T27959] FAULT_INJECTION: forcing a failure. [ 1399.840065][T27959] name failslab, interval 1, probability 0, space 0, times 0 [ 1399.866438][T27959] CPU: 1 UID: 0 PID: 27959 Comm: syz.3.7562 Tainted: G L syzkaller #0 PREEMPT(full) [ 1399.866473][T27959] Tainted: [L]=SOFTLOCKUP [ 1399.866482][T27959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1399.866496][T27959] Call Trace: [ 1399.866505][T27959] [ 1399.866516][T27959] dump_stack_lvl+0xe8/0x150 [ 1399.866568][T27959] should_fail_ex+0x40c/0x560 [ 1399.866603][T27959] should_failslab+0xa8/0x100 [ 1399.866640][T27959] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 1399.866669][T27959] ? local_lock_release+0x9c/0x160 [ 1399.866694][T27959] ? __alloc_skb+0x1d7/0x7a0 [ 1399.866714][T27959] ? __alloc_skb+0x1d7/0x7a0 [ 1399.866744][T27959] __alloc_skb+0x1d7/0x7a0 [ 1399.866772][T27959] xfrm_alloc_compat+0x1a6/0x1740 [ 1399.866887][T27959] ? __pfx_xfrm_alloc_compat+0x10/0x10 [ 1399.866917][T27959] xfrm_nlmsg_multicast+0xda/0x1f0 [ 1399.866944][T27959] xfrm_send_policy_notify+0xed2/0x1c00 [ 1399.866978][T27959] ? __pfx_xfrm_send_policy_notify+0x10/0x10 [ 1399.867002][T27959] ? km_policy_notify+0x28/0x200 [ 1399.867027][T27959] ? km_policy_notify+0x28/0x200 [ 1399.867057][T27959] ? __local_bh_enable_ip+0xe1/0x130 [ 1399.867085][T27959] ? km_policy_notify+0x28/0x200 [ 1399.867109][T27959] ? __pfx_xfrm_send_policy_notify+0x10/0x10 [ 1399.867133][T27959] km_policy_notify+0x121/0x200 [ 1399.867161][T27959] ? km_policy_notify+0x28/0x200 [ 1399.867187][T27959] xfrm_add_policy+0x4a1/0x690 [ 1399.867217][T27959] ? __pfx_xfrm_add_policy+0x10/0x10 [ 1399.867238][T27959] ? apparmor_capable+0x126/0x170 [ 1399.867273][T27959] ? __nla_parse+0x40/0x60 [ 1399.867308][T27959] xfrm_user_rcv_msg+0x7a8/0xf30 [ 1399.867341][T27959] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 1399.867401][T27959] ? __mutex_trylock_common+0x15f/0x270 [ 1399.867430][T27959] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1399.867458][T27959] ? rcu_is_watching+0x15/0xb0 [ 1399.867481][T27959] ? trace_contention_end+0x3d/0x140 [ 1399.867514][T27959] netlink_rcv_skb+0x226/0x4a0 [ 1399.867551][T27959] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 1399.867578][T27959] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1399.867623][T27959] ? netlink_deliver_tap+0x2e/0x1b0 [ 1399.867649][T27959] ? netlink_deliver_tap+0x2e/0x1b0 [ 1399.867679][T27959] xfrm_netlink_rcv+0x79/0x90 [ 1399.867704][T27959] netlink_unicast+0x7bb/0x940 [ 1399.867739][T27959] netlink_sendmsg+0x813/0xb40 [ 1399.867774][T27959] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1399.867807][T27959] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1399.867838][T27959] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1399.867865][T27959] sock_sendmsg_nosec+0x13a/0x180 [ 1399.867900][T27959] ____sys_sendmsg+0x54e/0x850 [ 1399.867931][T27959] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1399.867966][T27959] ? import_iovec+0x73/0xa0 [ 1399.868011][T27959] ___sys_sendmsg+0x2a5/0x360 [ 1399.868036][T27959] ? __lock_acquire+0x683/0x2cf0 [ 1399.868072][T27959] ? __pfx____sys_sendmsg+0x10/0x10 [ 1399.868134][T27959] ? __fget_files+0x2a/0x420 [ 1399.868163][T27959] ? __fget_files+0x3a2/0x420 [ 1399.868204][T27959] __x64_sys_sendmsg+0x1b1/0x290 [ 1399.868233][T27959] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1399.868279][T27959] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1399.868304][T27959] do_syscall_64+0x174/0x580 [ 1399.868329][T27959] ? trace_irq_disable+0x3b/0x140 [ 1399.868360][T27959] ? clear_bhb_loop+0x40/0x90 [ 1399.868396][T27959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1399.868419][T27959] RIP: 0033:0x7f68ff39de99 [ 1399.868442][T27959] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1399.868461][T27959] RSP: 002b:00007f6900346028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1399.868485][T27959] RAX: ffffffffffffffda RBX: 00007f68ff625fa0 RCX: 00007f68ff39de99 [ 1399.868502][T27959] RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000003 [ 1399.868516][T27959] RBP: 00007f6900346090 R08: 0000000000000000 R09: 0000000000000000 [ 1399.868530][T27959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1399.868551][T27959] R13: 00007f68ff626038 R14: 00007f68ff625fa0 R15: 00007f68ff74fa48 [ 1399.868587][T27959] [ 1400.654172][T27970] FAULT_INJECTION: forcing a failure. [ 1400.654172][T27970] name failslab, interval 1, probability 0, space 0, times 0 [ 1400.684336][T27970] CPU: 0 UID: 0 PID: 27970 Comm: syz.0.7566 Tainted: G L syzkaller #0 PREEMPT(full) [ 1400.684373][T27970] Tainted: [L]=SOFTLOCKUP [ 1400.684381][T27970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1400.684394][T27970] Call Trace: [ 1400.684403][T27970] [ 1400.684414][T27970] dump_stack_lvl+0xe8/0x150 [ 1400.684453][T27970] should_fail_ex+0x40c/0x560 [ 1400.684489][T27970] should_failslab+0xa8/0x100 [ 1400.684526][T27970] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1400.684556][T27970] ? skb_clone+0x212/0x3a0 [ 1400.684590][T27970] ? skb_clone+0x212/0x3a0 [ 1400.684622][T27970] skb_clone+0x212/0x3a0 [ 1400.684654][T27970] __netlink_deliver_tap+0x413/0x860 [ 1400.684695][T27970] ? netlink_deliver_tap+0x2e/0x1b0 [ 1400.684724][T27970] netlink_deliver_tap+0x19c/0x1b0 [ 1400.684753][T27970] netlink_sendskb+0x68/0x140 [ 1400.684781][T27970] netlink_rcv_skb+0x2a4/0x4a0 [ 1400.684809][T27970] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1400.684843][T27970] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1400.684888][T27970] ? down_read+0x2be/0x330 [ 1400.684921][T27970] genl_rcv+0x28/0x40 [ 1400.684951][T27970] netlink_unicast+0x7bb/0x940 [ 1400.684986][T27970] netlink_sendmsg+0x813/0xb40 [ 1400.685024][T27970] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1400.685057][T27970] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1400.685090][T27970] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1400.685117][T27970] sock_sendmsg_nosec+0x13a/0x180 [ 1400.685152][T27970] ____sys_sendmsg+0x54e/0x850 [ 1400.685189][T27970] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1400.685227][T27970] ? import_iovec+0x73/0xa0 [ 1400.685253][T27970] ___sys_sendmsg+0x2a5/0x360 [ 1400.685279][T27970] ? __lock_acquire+0x683/0x2cf0 [ 1400.685316][T27970] ? __pfx____sys_sendmsg+0x10/0x10 [ 1400.685382][T27970] ? __fget_files+0x2a/0x420 [ 1400.685412][T27970] ? __fget_files+0x3a2/0x420 [ 1400.685455][T27970] __x64_sys_sendmsg+0x1b1/0x290 [ 1400.685484][T27970] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1400.685531][T27970] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1400.685557][T27970] do_syscall_64+0x174/0x580 [ 1400.685589][T27970] ? trace_irq_disable+0x3b/0x140 [ 1400.685619][T27970] ? clear_bhb_loop+0x40/0x90 [ 1400.685647][T27970] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1400.685670][T27970] RIP: 0033:0x7f653559de99 [ 1400.685693][T27970] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1400.685713][T27970] RSP: 002b:00007f6536546028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1400.685737][T27970] RAX: ffffffffffffffda RBX: 00007f6535825fa0 RCX: 00007f653559de99 [ 1400.685754][T27970] RDX: 0000000004004000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1400.685770][T27970] RBP: 00007f6536546090 R08: 0000000000000000 R09: 0000000000000000 [ 1400.685784][T27970] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1400.685797][T27970] R13: 00007f6535826038 R14: 00007f6535825fa0 R15: 00007f653594fa48 [ 1400.685832][T27970] [ 1400.993666][T27972] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7568'. [ 1401.002939][T27972] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7568'. [ 1401.091591][T27579] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1401.170789][T27981] syzkaller0: entered promiscuous mode [ 1401.179392][T27981] syzkaller0: entered allmulticast mode [ 1401.243243][T27579] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1401.258196][T27579] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 1401.267662][T27579] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 1401.275887][T27579] usb 3-1: Product: syz [ 1401.280079][T27579] usb 3-1: Manufacturer: syz [ 1401.284790][T27579] usb 3-1: SerialNumber: syz [ 1401.301537][T23869] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 1401.363121][T21380] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 1401.461320][T23869] usb 4-1: Using ep0 maxpacket: 32 [ 1401.469781][T23869] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 1401.481776][T23869] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x9B, changing to 0x8B [ 1401.494243][T23869] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1401.513821][T23869] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 1401.536540][T27988] netlink: 14 bytes leftover after parsing attributes in process `syz.4.7573'. [ 1401.537320][T21380] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1401.548391][T23869] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1401.557669][T21380] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1401.576670][T21380] usb 1-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 1401.586045][T27579] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 35 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1401.586458][T21380] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1401.612944][T21380] usb 1-1: config 0 descriptor?? [ 1401.670476][T23869] usb 4-1: Product: syz [ 1401.687802][T23869] usb 4-1: Manufacturer: syz [ 1401.693332][T23869] usb 4-1: SerialNumber: syz [ 1401.714490][T23869] usb 4-1: config 0 descriptor?? [ 1401.736955][T23869] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input94 [ 1401.791598][T27988] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1401.836335][T27988] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1401.860185][T27988] bond0 (unregistering): Released all slaves [ 1402.011317][T26895] usb 4-1: USB disconnect, device number 122 [ 1402.012763][ C1] xpad 4-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 1402.052904][T21380] usb 3-1: USB disconnect, device number 35 [ 1402.125376][T21380] usblp0: removed [ 1402.691577][T21380] net_ratelimit: 16 callbacks suppressed [ 1402.691597][T21380] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1402.891155][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1402.905951][T20219] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1403.120394][T28011] [ 1403.122838][T28011] ============================================ [ 1403.129018][T28011] WARNING: possible recursive locking detected [ 1403.135191][T28011] syzkaller #0 Tainted: G L [ 1403.141179][T28011] -------------------------------------------- [ 1403.147359][T28011] syz.3.7580/28011 is trying to acquire lock: [ 1403.153432][T28011] ffffffff8f62aa90 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0xe9/0xec0 [ 1403.163661][T28011] [ 1403.163661][T28011] but task is already holding lock: [ 1403.171062][T28011] ffffffff8f62aa90 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0xe9/0xec0 [ 1403.181213][T28011] [ 1403.181213][T28011] other info that might help us debug this: [ 1403.189303][T28011] Possible unsafe locking scenario: [ 1403.189303][T28011] [ 1403.196778][T28011] CPU0 [ 1403.200065][T28011] ---- [ 1403.203358][T28011] lock(qp_broker_list.mutex); [ 1403.208220][T28011] lock(qp_broker_list.mutex); [ 1403.213081][T28011] [ 1403.213081][T28011] *** DEADLOCK *** [ 1403.213081][T28011] [ 1403.221250][T28011] May be due to missing lock nesting notation [ 1403.221250][T28011] [ 1403.229610][T28011] 1 lock held by syz.3.7580/28011: [ 1403.234752][T28011] #0: ffffffff8f62aa90 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0xe9/0xec0 [ 1403.245307][T28011] [ 1403.245307][T28011] stack backtrace: [ 1403.251223][T28011] CPU: 1 UID: 0 PID: 28011 Comm: syz.3.7580 Tainted: G L syzkaller #0 PREEMPT(full) [ 1403.251258][T28011] Tainted: [L]=SOFTLOCKUP [ 1403.251267][T28011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1403.251280][T28011] Call Trace: [ 1403.251289][T28011] [ 1403.251298][T28011] dump_stack_lvl+0xe8/0x150 [ 1403.251335][T28011] print_deadlock_bug+0x279/0x290 [ 1403.251360][T28011] __lock_acquire+0x24df/0x2cf0 [ 1403.251394][T28011] ? kernel_text_address+0xa5/0xe0 [ 1403.251416][T28011] ? __kernel_text_address+0xd/0x30 [ 1403.251437][T28011] ? stack_depot_save_flags+0x28b/0x800 [ 1403.251466][T28011] ? lock_acquire+0x106/0x350 [ 1403.251500][T28011] ? vmci_qp_broker_detach+0xe9/0xec0 [ 1403.251528][T28011] lock_acquire+0x106/0x350 [ 1403.251550][T28011] ? vmci_qp_broker_detach+0xe9/0xec0 [ 1403.251570][T28011] __mutex_lock+0x19d/0x1550 [ 1403.251589][T28011] ? vmci_qp_broker_detach+0xe9/0xec0 [ 1403.251603][T28011] ? kasan_save_track+0x3e/0x80 [ 1403.251625][T28011] ? kasan_save_free_info+0x40/0x50 [ 1403.251642][T28011] ? __kasan_slab_free+0x5c/0x80 [ 1403.251663][T28011] ? kfree+0x1c5/0x640 [ 1403.251680][T28011] ? vmci_ctx_put+0x5ba/0xc00 [ 1403.251771][T28011] ? vmci_ctx_enqueue_datagram+0x3c3/0x440 [ 1403.251790][T28011] ? vmci_datagram_dispatch+0x450/0xc80 [ 1403.251810][T28011] ? vmci_qp_broker_detach+0x887/0xec0 [ 1403.251824][T28011] ? vmci_ctx_put+0x619/0xc00 [ 1403.251841][T28011] ? vmci_host_close+0x8e/0x140 [ 1403.251865][T28011] ? __fput+0x418/0xa50 [ 1403.251885][T28011] ? exit_to_user_mode_loop+0x1fa/0x730 [ 1403.251906][T28011] ? do_syscall_64+0x353/0x580 [ 1403.251923][T28011] ? vmci_qp_broker_detach+0xe9/0xec0 [ 1403.251939][T28011] ? __pfx___mutex_lock+0x10/0x10 [ 1403.251963][T28011] vmci_qp_broker_detach+0xe9/0xec0 [ 1403.251981][T28011] ? __pfx_vmci_qp_broker_detach+0x10/0x10 [ 1403.251995][T28011] ? kasan_quarantine_put+0xbb/0x1f0 [ 1403.252015][T28011] ? lockdep_hardirqs_on+0x7a/0x110 [ 1403.252033][T28011] ? kfree+0x1c5/0x640 [ 1403.252050][T28011] ? vmci_ctx_put+0x5ba/0xc00 [ 1403.252066][T28011] ? vmci_ctx_put+0x13e/0xc00 [ 1403.252085][T28011] vmci_ctx_put+0x619/0xc00 [ 1403.252103][T28011] ? vmci_ctx_put+0x13e/0xc00 [ 1403.252122][T28011] ? __pfx_vmci_ctx_put+0x10/0x10 [ 1403.252140][T28011] ? preempt_schedule_thunk+0x16/0x40 [ 1403.252158][T28011] ? preempt_schedule_common+0x82/0xd0 [ 1403.252175][T28011] ? preempt_schedule_thunk+0x16/0x40 [ 1403.252194][T28011] vmci_ctx_enqueue_datagram+0x3c3/0x440 [ 1403.252219][T28011] vmci_datagram_dispatch+0x450/0xc80 [ 1403.252254][T28011] ? __pfx_vmci_datagram_dispatch+0x10/0x10 [ 1403.252284][T28011] vmci_qp_broker_detach+0x887/0xec0 [ 1403.252302][T28011] ? __pfx_vmci_qp_broker_detach+0x10/0x10 [ 1403.252315][T28011] ? kasan_quarantine_put+0xbb/0x1f0 [ 1403.252338][T28011] ? kfree+0x1c5/0x640 [ 1403.252354][T28011] ? vmci_ctx_put+0x5ba/0xc00 [ 1403.252373][T28011] vmci_ctx_put+0x619/0xc00 [ 1403.252390][T28011] ? vmci_ctx_put+0x13e/0xc00 [ 1403.252409][T28011] ? __pfx_vmci_ctx_put+0x10/0x10 [ 1403.252433][T28011] vmci_host_close+0x8e/0x140 [ 1403.252457][T28011] ? __pfx_vmci_host_close+0x10/0x10 [ 1403.252480][T28011] __fput+0x418/0xa50 [ 1403.252504][T28011] task_work_run+0x1d9/0x270 [ 1403.252520][T28011] ? __pfx_task_work_run+0x10/0x10 [ 1403.252537][T28011] exit_to_user_mode_loop+0x1fa/0x730 [ 1403.252558][T28011] ? rcu_is_watching+0x15/0xb0 [ 1403.252573][T28011] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.252589][T28011] do_syscall_64+0x353/0x580 [ 1403.252607][T28011] ? trace_irq_disable+0x3b/0x140 [ 1403.252627][T28011] ? clear_bhb_loop+0x40/0x90 [ 1403.252645][T28011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.252661][T28011] RIP: 0033:0x7f68ff39de99 [ 1403.252677][T28011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1403.252691][T28011] RSP: 002b:00007f6900325028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 1403.252716][T28011] RAX: 0000000000000000 RBX: 00007f68ff626090 RCX: 00007f68ff39de99 [ 1403.252727][T28011] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000008 [ 1403.252738][T28011] RBP: 00007f68ff433eaf R08: 0000000000000000 R09: 0000000000000000 [ 1403.252748][T28011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1403.252758][T28011] R13: 00007f68ff626128 R14: 00007f68ff626090 R15: 00007f68ff74fa48 [ 1403.252776][T28011] [ 1403.734161][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1403.748539][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1403.776601][T21380] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1404.243358][T21380] usb 1-1: USB disconnect, device number 35 [ 1404.301129][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1404.315547][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1404.831218][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1404.845613][T11628] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1407.911670][T20215] net_ratelimit: 15 callbacks suppressed [ 1407.911693][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1407.931886][T20215] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1407.973056][T20505] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1408.051199][T23869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1408.451098][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1408.465492][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1408.981330][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1408.995869][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1409.011651][T21386] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1409.511075][T20220] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1413.092016][T20216] net_ratelimit: 17 callbacks suppressed [ 1413.092040][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1413.112269][T20216] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01