last executing test programs: 2.809823068s ago: executing program 2 (id=3): pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, 0x0, 0x15) dup(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/config\x00', 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)="02", 0x1, 0x4) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r2, 0x0, 0x0) 2.768525409s ago: executing program 0 (id=1): mkdir(&(0x7f0000000100)='./sys_mount\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./sys_mount\x00', &(0x7f00000003c0)='sysfs\x00', 0x10000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys_mount/block/loop0/queue/scheduler\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='bfq', 0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x7, &(0x7f0000000040)=0x10, 0x4) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) fstat(r3, &(0x7f0000000100)) sendfile(r0, r0, &(0x7f0000000080), 0x8) 2.755780509s ago: executing program 2 (id=5): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_io_uring_setup(0x66e, &(0x7f0000000300)={0x0, 0xcd1d, 0x10100, 0x1000000, 0x20000}, 0x0, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, 0x0, 0x6, &(0x7f0000004040)={0x13, 0x6, 0x7fffffff}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) 2.744295049s ago: executing program 1 (id=2): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x124) mknodat$null(r0, &(0x7f0000000000)='./file1\x00', 0x1000, 0x103) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f0000000040)='./file1\x00', 0x20000ba) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x836d9fb164f927b3) vmsplice(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)="ce", 0x1}], 0x1, 0x8) 2.70833288s ago: executing program 1 (id=6): r0 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x2) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000340)='ro\x00H\x96\xf7\v\xcd \xd5\x19\x8ct\x14|\xa9\xd4\xc2\xf0\xf0\xab\xdf\x8f \x00\xc5\xb3\x99\xbf\xed\xa0\xe0\xa9\xc6\xab\xab\x95\xa8\x04O\b\xcc\x9b\x11\xa2`\xce\xffM]\xa1iB,\xae\x16\xf6|\xf5\'W\xd8~\xb7\xf80w+\xb7=f\xb7\xf2+\xe9zG\x9b\xadL\xfa\xbeb\xb1\xe6m\xab$\xd3\x97\xd6~ \xb8y\x13\xaf{\xc9\xa0\x941>\xa4Fgh\xb9r\x9b\xa4\xc1\x90\xf2\x85/A\xb3\x8e\x04~E\x7f\x14W\xcb?k\xa7ZB1\xe0n\x17\xc7U\xf6f\xd5\xdd\'\x05\x90\x10\xa2~\xf3\xe07`\x96\x85r', &(0x7f0000000180)='./file1\x00', 0xffffffffffffff9c) getrlimit(0xb, &(0x7f0000000000)) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) 2.627582902s ago: executing program 1 (id=8): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000180)=@file={0x1}, 0x6e) listen(r0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) connect$unix(r1, &(0x7f0000000000)=@file={0x1}, 0x6e) clock_gettime(0x2, &(0x7f0000000200)={0x0, 0x0}) setsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000100)={r2, r3/1000+10000}, 0x10) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) io_submit(0x0, 0xfffffffffffffd52, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r8 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r7, &(0x7f0000001040)={@void, @val={0x1, 0x5, 0x1c, 0x10, 0x14, 0x6}, @ipv4=@tipc={{0x5, 0x4, 0x3, 0x1f, 0x3c, 0x64, 0x0, 0x8, 0x6, 0x0, @dev={0xac, 0x14, 0x14, 0x17}, @dev={0xac, 0x14, 0x14, 0x13}}, @name_distributor={{0x28, 0x0, 0x0, 0x0, 0x0, 0xa, 0xb, 0x2, 0x101, 0x0, 0x1, 0x8, 0xfa, 0x50000000, 0x4e22, 0x4e24, 0x2, 0x3}}}}, 0x46) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_clone3(&(0x7f0000000080)={0xa690b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) setpgid(r4, r4) setpgid(0x0, r4) write(r0, &(0x7f0000000140)="75cd6e7cc2a550c6db6175c41ebb40bbd4b8660cc91b593283e545dd74c31e4642d0c6cbf03aad91", 0x28) tkill(r4, 0x7) wait4(r4, 0x0, 0x0, 0x0) ptrace$ARCH_SHSTK_DISABLE(0x1e, r4, 0x3, 0x5002) connect$unix(r1, &(0x7f0000000080)=@file={0x1}, 0x6e) 2.614109153s ago: executing program 0 (id=9): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f00000e4000/0x18000)=nil, &(0x7f0000019180)=[@text32={0x20, 0x0}], 0x1, 0x12, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x700}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000400000/0xc00000)=nil, &(0x7f0000199000/0x800000)=nil, 0xc00000}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r5, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a000002005000500000000e000000f25f1003e800000056", 0x2a}], 0x1, 0x0, 0xfffffffd) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) pwritev(r5, &(0x7f0000000080)=[{0x0}], 0x1, 0x0, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) 2.503567016s ago: executing program 2 (id=10): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f00000e4000/0x18000)=nil, &(0x7f0000019180)=[@text32={0x20, 0x0}], 0x1, 0x12, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x700}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000400000/0xc00000)=nil, &(0x7f0000199000/0x800000)=nil, 0xc00000}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r5, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a000002005000500000000e000000f25f1003e800000056", 0x2a}], 0x1, 0x0, 0xfffffffd) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) pwritev(r5, &(0x7f0000000080)=[{0x0}], 0x1, 0x0, 0x0) syz_usb_control_io$uac1(r4, 0x0, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) 2.121401315s ago: executing program 3 (id=11): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) r2 = openat$kvm(0xffffff9c, &(0x7f0000000180), 0x129102, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x71, 0x2, 0x2, 0x2d7, 0x8000000000000000, 0x8000000000000000, 0x5, 0x0, 0x4, 0x401, 0x2, 0x5, 0x8d], 0xeeee8000, 0x284e97}) ptrace$setsig(0x4203, 0x0, 0xf4, &(0x7f00000000c0)={0x11, 0xf0f, 0x5}) ioctl$KVM_RUN(r4, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x4a282, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000e80)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010800040000000000000b01000008000300", @ANYRES32=r6, @ANYBLOB="28005080140001004abee33957edf8aaae14574df40000000500020007000000080003000bac0f"], 0x44}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000100)={0x208, r1, 0x400, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_SCHED_SCAN_MATCH={0x1e8, 0x84, 0x0, 0x1, [{0x9c, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x24, 0x6, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x8}, @NL80211_BAND_60GHZ={0x8, 0x2, 0xc}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x7}, @NL80211_BAND_60GHZ={0x8, 0x2, 0xf5c9}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0x6, 0x1, @random="b382"}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x3c, 0x6, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x8, 0x3, 0x3}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x6}, @NL80211_BAND_2GHZ={0x8, 0x0, 0xe}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x40}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x6cbc}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x8}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x2}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x1c, 0x6, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x8, 0x2, 0xfffff040}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x8}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x4}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x81}]}, {0x74, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ap_ssid}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ibss_ssid}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x8}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x24, 0x6, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x8, 0x2, 0x80000000}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x80}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x6}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x7}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0xa}]}, {0x9c, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x3c, 0x6, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x8, 0x0, 0x5}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x4}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x6000000}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x82}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x1ff}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x8}, @NL80211_BAND_LC={0x8, 0x5, 0x92a}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ibss_ssid}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x1}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x7fffffff}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0x7, 0x1, @random='\nAo'}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x80}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x24, 0x6, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x8}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x1}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x1433}, @NL80211_BAND_60GHZ={0x8}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @random="14b3b45d1936"}]}, {0x38, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x34, 0x6, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x8, 0x0, 0x9}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x10}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x148b}, @NL80211_BAND_60GHZ={0x8, 0x2, 0xffffff3e}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x800}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x78aeb52a}]}]}]}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x208}, 0x1, 0x0, 0x0, 0x1}, 0x40000) socket$inet_tcp(0x2, 0x1, 0x0) 1.93942638s ago: executing program 1 (id=12): r0 = syz_usb_connect$cdc_ecm(0x0, 0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a4400001020301090248000101570040090400000002060000052406000005240000000d240f0100080000000000000004240200090581031000000000090582"], 0x0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e"], 0x0) syz_usb_disconnect(r0) r2 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$uac1(r1, &(0x7f0000000000)={0x14, &(0x7f0000000140)={0x40, 0x31, 0xb, {0xb, 0xd, "5d768d97c37e80aa81"}}, 0x0}, 0x0) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) syz_usb_connect$hid(0x2, 0x4a, 0x0, 0x0) syz_open_dev$evdev(0x0, 0x1, 0xc0841) syz_usb_connect(0x5, 0x4a, 0x0, 0x0) 1.866535162s ago: executing program 3 (id=13): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000a00)='rd', 0x2) 1.808186284s ago: executing program 3 (id=14): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff0001}]}) close_range(r1, 0xffffffffffffffff, 0x0) 1.807933304s ago: executing program 3 (id=15): r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder-control\x00', 0x2, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000002200)={'custom0\x00'}) 1.807513634s ago: executing program 3 (id=22): inotify_init() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8e}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2f, 0x0, 0x0) pipe2$watch_queue(0x0, 0x80) r4 = add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x3d) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x0) r5 = socket(0x2, 0x3, 0x6) bind$inet(r5, &(0x7f0000000080)={0x2, 0xfffa, @local}, 0x10) 97.581718ms ago: executing program 0 (id=16): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) socket$inet6(0xa, 0x80003, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) getegid() r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000400)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) pread64(r2, &(0x7f0000000340)=""/69, 0x45, 0x3) 97.436598ms ago: executing program 3 (id=17): r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000000)) r1 = syz_open_dev$usbmon(&(0x7f0000000300), 0x7, 0x10b080) read$usbmon(r1, 0x0, 0x0) ioctl$MON_IOCH_MFLUSH(r1, 0x9208, 0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 0s ago: executing program 2 (id=18): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x24, r1, 0x1, 0x70bd06, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_SEC_OUT_LEVEL={0x8, 0x2a, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x8811}, 0x80) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.67' (ED25519) to the list of known hosts. [ 30.054545][ T36] audit: type=1400 audit(1787775848.170:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 30.058356][ T287] cgroup: Unknown subsys name 'net' [ 30.077246][ T36] audit: type=1400 audit(1787775848.180:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.104647][ T36] audit: type=1400 audit(1787775848.200:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.105147][ T287] cgroup: Unknown subsys name 'devices' [ 30.227146][ T287] cgroup: Unknown subsys name 'hugetlb' [ 30.232800][ T287] cgroup: Unknown subsys name 'rlimit' [ 30.348842][ T36] audit: type=1400 audit(1787775848.470:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.372064][ T36] audit: type=1400 audit(1787775848.470:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.396849][ T36] audit: type=1400 audit(1787775848.470:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.427831][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 30.436758][ T36] audit: type=1400 audit(1787775848.560:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.462333][ T36] audit: type=1400 audit(1787775848.560:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.496309][ T36] audit: type=1400 audit(1787775848.620:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.521946][ T36] audit: type=1400 audit(1787775848.620:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.522576][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.990371][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.997520][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.005300][ T296] bridge_slave_0: entered allmulticast mode [ 32.011732][ T296] bridge_slave_0: entered promiscuous mode [ 32.022146][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.029293][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.036447][ T296] bridge_slave_1: entered allmulticast mode [ 32.042714][ T296] bridge_slave_1: entered promiscuous mode [ 32.070672][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.078049][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.085197][ T295] bridge_slave_0: entered allmulticast mode [ 32.091517][ T295] bridge_slave_0: entered promiscuous mode [ 32.108134][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.115234][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.122323][ T295] bridge_slave_1: entered allmulticast mode [ 32.128721][ T295] bridge_slave_1: entered promiscuous mode [ 32.157923][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.165109][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.172232][ T294] bridge_slave_0: entered allmulticast mode [ 32.178670][ T294] bridge_slave_0: entered promiscuous mode [ 32.194038][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.201169][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.208335][ T297] bridge_slave_0: entered allmulticast mode [ 32.215180][ T297] bridge_slave_0: entered promiscuous mode [ 32.221746][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.228878][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.236033][ T297] bridge_slave_1: entered allmulticast mode [ 32.242308][ T297] bridge_slave_1: entered promiscuous mode [ 32.248581][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.255711][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.262792][ T294] bridge_slave_1: entered allmulticast mode [ 32.269209][ T294] bridge_slave_1: entered promiscuous mode [ 32.409683][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.416822][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.424129][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.431217][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.454197][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.461336][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.468672][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.475754][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.496268][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.503373][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.510722][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.517818][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.546237][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.553347][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.560690][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.567764][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.592982][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.600415][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.607970][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.615771][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.623025][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.630593][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.637934][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.645415][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.661279][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.668393][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.676168][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.683236][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.696298][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.703411][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.711169][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.718275][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.759735][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.766906][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.779650][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.786788][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.799692][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.806811][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.814688][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.821803][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.847731][ T295] veth0_vlan: entered promiscuous mode [ 32.881008][ T296] veth0_vlan: entered promiscuous mode [ 32.888369][ T294] veth0_vlan: entered promiscuous mode [ 32.907260][ T295] veth1_macvtap: entered promiscuous mode [ 32.914161][ T297] veth0_vlan: entered promiscuous mode [ 32.932149][ T294] veth1_macvtap: entered promiscuous mode [ 32.939829][ T296] veth1_macvtap: entered promiscuous mode [ 32.976456][ T297] veth1_macvtap: entered promiscuous mode [ 32.988512][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 33.230017][ T333] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 34.015068][ T46] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 34.022749][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 34.135170][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 34.175272][ T31] usb 1-1: Using ep0 maxpacket: 16 [ 34.180504][ T46] usb 3-1: Using ep0 maxpacket: 16 [ 34.192507][ T31] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 34.201395][ T46] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 34.209615][ T31] usb 1-1: config 0 has no interface number 0 [ 34.216335][ T46] usb 3-1: config 0 has no interface number 0 [ 34.222573][ T31] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 34.232782][ T46] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 34.243227][ T31] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 34.253465][ T46] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 34.265888][ T46] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 34.275183][ T31] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 34.284408][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.292805][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.301170][ T46] usb 3-1: Product: syz [ 34.305612][ T31] usb 1-1: Product: syz [ 34.309849][ T46] usb 3-1: Manufacturer: syz [ 34.314555][ T31] usb 1-1: Manufacturer: syz [ 34.319513][ T46] usb 3-1: SerialNumber: syz [ 34.324201][ T31] usb 1-1: SerialNumber: syz [ 34.330643][ T46] usb 3-1: config 0 descriptor?? [ 34.341379][ T31] usb 1-1: config 0 descriptor?? [ 34.346964][ T333] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 34.354372][ T342] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 34.361765][ T333] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 34.369519][ T342] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 34.526237][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 34.536870][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 34.551545][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 34.560719][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.568841][ T9] usb 2-1: Product: syz [ 34.573101][ T9] usb 2-1: Manufacturer: syz [ 34.577876][ T9] usb 2-1: SerialNumber: syz [ 34.586604][ T333] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 34.595289][ T333] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 34.595325][ T337] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 34.609887][ T337] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 34.806661][ T356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.816477][ T356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.824557][ T31] asix 1-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 34.835220][ T9] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 34.836294][ T46] asix 3-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 34.853050][ T9] usb 2-1: USB disconnect, device number 2 [ 35.044301][ T46] asix 3-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 35.074879][ T46] asix 3-1:0.34 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffe0 [ 35.091913][ T46] asix 3-1:0.34: probe with driver asix failed with error -32 [ 35.145695][ T31] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 35.164118][ T31] asix 1-1:0.34 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 35.184724][ T31] asix 1-1:0.34: probe with driver asix failed with error -71 [ 35.194033][ T31] usb 1-1: USB disconnect, device number 2 [ 35.275343][ T10] usb 3-1: USB disconnect, device number 2 [ 35.354936][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 35.504894][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 35.511058][ T9] usb 2-1: config index 0 descriptor too short (expected 301, got 72) [ 35.519336][ T9] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 35.529550][ T9] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 35.539558][ T9] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 35.549386][ T9] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 35.559590][ T9] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.570646][ T9] usb 2-1: config 16 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 35.583724][ T9] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 35.593045][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.513902][ T9] usb 2-1: USB disconnect, device number 3 [ 95.899642][ T111] udevd[111]: worker [340] /devices/platform/dummy_hcd.2/usb3/3-1 is taking a long time [ 95.909673][ T111] udevd[111]: worker [341] /devices/platform/dummy_hcd.0/usb1/1-1 is taking a long time [ 95.919504][ T111] udevd[111]: worker [313] /devices/platform/dummy_hcd.1/usb2/2-1 is taking a long time [ 173.056102][ T37] INFO: task kworker/u8:0:12 blocked for more than 122 seconds. [ 173.063930][ T37] Not tainted syzkaller #0 [ 173.069177][ T37] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 173.078235][ T37] task:kworker/u8:0 state:D stack:0 pid:12 tgid:12 ppid:2 flags:0x00004000 [ 173.088674][ T37] Workqueue: writeback wb_workfn (flush-8:0) [ 173.094873][ T37] Call Trace: [ 173.098176][ T37] [ 173.101113][ T37] __schedule+0x1496/0x20b0 [ 173.105840][ T37] ? __sched_text_start+0x10/0x10 [ 173.110991][ T37] ? __blk_flush_plug+0x425/0x4e0 [ 173.116092][ T37] ? __blk_flush_plug+0x425/0x4e0 [ 173.121153][ T37] ? __cfi___blk_flush_plug+0x10/0x10 [ 173.126654][ T37] ? xas_load+0x3a6/0x3d0 [ 173.131024][ T37] ? wq_worker_sleeping+0x68/0x260 [ 173.136262][ T37] schedule+0xc5/0x240 [ 173.140401][ T37] io_schedule+0x88/0xe0 [ 173.144662][ T37] bit_wait_io+0x17/0xd0 [ 173.148986][ T37] __wait_on_bit_lock+0x241/0x5e0 [ 173.154041][ T37] ? __cfi_bit_wait_io+0x10/0x10 [ 173.159132][ T37] ? __kasan_check_read+0x15/0x20 [ 173.164230][ T37] out_of_line_wait_on_bit_lock+0x139/0x190 [ 173.170263][ T37] ? __cfi_bit_wait_io+0x10/0x10 [ 173.175262][ T37] ? __cfi_out_of_line_wait_on_bit_lock+0x10/0x10 [ 173.181695][ T37] ? __cfi_wake_bit_function+0x10/0x10 [ 173.187250][ T37] ? __kasan_check_write+0x18/0x20 [ 173.192395][ T37] __lock_buffer+0x5d/0x70 [ 173.196904][ T37] do_get_write_access+0x196/0xd70 [ 173.202328][ T37] jbd2_journal_get_write_access+0x268/0x3d0 [ 173.208402][ T37] __ext4_journal_get_write_access+0x1b6/0x6a0 [ 173.214639][ T37] ? __cfi___ext4_journal_get_write_access+0x10/0x10 [ 173.221430][ T37] ? __kasan_check_read+0x15/0x20 [ 173.226513][ T37] ? ext4_wait_block_bitmap+0x7c/0x2a0 [ 173.232101][ T37] ext4_mb_mark_context+0x1f3/0xee0 [ 173.237367][ T37] ? __cfi_ext4_mb_mark_context+0x10/0x10 [ 173.243140][ T37] ext4_mb_mark_diskspace_used+0x3aa/0x830 [ 173.249030][ T37] ? ext4_discard_allocated_blocks+0x690/0x690 [ 173.255266][ T37] ? ext4_mb_pa_put_free+0x124/0x1c0 [ 173.260564][ T37] ext4_mb_new_blocks+0x840/0x36c0 [ 173.265846][ T37] ? __kmalloc_noprof+0x261/0x510 [ 173.270903][ T37] ? ext4_find_extent+0x1f5/0xd80 [ 173.276009][ T37] ? ext4_ext_search_right+0x49e/0x880 [ 173.281684][ T37] ? ext4_inode_to_goal_block+0x34f/0x4c0 [ 173.287491][ T37] ext4_ext_map_blocks+0x14d9/0x6080 [ 173.292901][ T37] ? stack_depot_save_flags+0x399/0x800 [ 173.298545][ T37] ? kasan_save_track+0x4f/0x80 [ 173.303442][ T37] ? kasan_save_track+0x3e/0x80 [ 173.308453][ T37] ? kmem_cache_alloc_noprof+0x1bf/0x410 [ 173.314118][ T37] ? ext4_alloc_io_end_vec+0x42/0x1e0 [ 173.319585][ T37] ? ext4_do_writepages+0x106f/0x39f0 [ 173.325015][ T37] ? __cfi_ext4_ext_map_blocks+0x10/0x10 [ 173.330661][ T37] ? writeback_sb_inodes+0x6a5/0xfb0 [ 173.336014][ T37] ? __writeback_inodes_wb+0x129/0x280 [ 173.341516][ T37] ? wb_writeback+0x3bb/0x850 [ 173.346289][ T37] ? wb_workfn+0x812/0xef0 [ 173.350753][ T37] ? process_scheduled_works+0x7f7/0x1060 [ 173.356588][ T37] ? worker_thread+0xc99/0x13f0 [ 173.361527][ T37] ? kthread+0x2c7/0x360 [ 173.365922][ T37] ? ret_from_fork+0x67/0xa0 [ 173.370580][ T37] ? ret_from_fork_asm+0x1a/0x30 [ 173.375748][ T37] ? ext4_es_lookup_extent+0x567/0x900 [ 173.381342][ T37] ext4_map_blocks+0x873/0x17f0 [ 173.386343][ T37] ? __cfi_ext4_map_blocks+0x10/0x10 [ 173.391706][ T37] ? kmem_cache_alloc_noprof+0x1e2/0x410 [ 173.397505][ T37] ? jbd2__journal_start+0x3c9/0x860 [ 173.402831][ T37] ? ext4_inode_journal_mode+0x392/0x480 [ 173.408553][ T37] ext4_do_writepages+0x1c4a/0x39f0 [ 173.413799][ T37] ? ext4_normal_submit_inode_data_buffers+0x270/0x270 [ 173.420773][ T37] ? filemap_get_folios_tag+0x61c/0x760 [ 173.426423][ T37] ? __cfi_filemap_get_folios_tag+0x10/0x10 [ 173.432345][ T37] ? __folio_batch_release+0xac/0x100 [ 173.437870][ T37] ? writeback_iter+0xccb/0x1070 [ 173.442852][ T37] ext4_writepages+0x28c/0x550 [ 173.447714][ T37] ? __cfi_ext4_writepages+0x10/0x10 [ 173.453066][ T37] ? blkdev_writepages+0xd2/0x130 [ 173.458412][ T37] ? __cfi_ext4_writepages+0x10/0x10 [ 173.463844][ T37] do_writepages+0x3d7/0x7f0 [ 173.468537][ T37] ? rtnl_notify+0x9e/0xd0 [ 173.473022][ T37] ? __cfi_do_writepages+0x10/0x10 [ 173.478234][ T37] ? __kasan_check_write+0x18/0x20 [ 173.483390][ T37] ? _raw_spin_lock+0x92/0x120 [ 173.488266][ T37] __writeback_single_inode+0xc8/0xba0 [ 173.493768][ T37] writeback_sb_inodes+0x6a5/0xfb0 [ 173.498966][ T37] ? queue_io+0x690/0x690 [ 173.503356][ T37] ? __kasan_check_read+0x15/0x20 [ 173.508444][ T37] ? queue_io+0x3d9/0x690 [ 173.512844][ T37] __writeback_inodes_wb+0x129/0x280 [ 173.518310][ T37] wb_writeback+0x3bb/0x850 [ 173.522857][ T37] ? inode_cgwb_move_to_attached+0x470/0x470 [ 173.528907][ T37] ? kvm_sched_clock_read+0x15/0x30 [ 173.534144][ T37] wb_workfn+0x812/0xef0 [ 173.538476][ T37] ? __cfi_wb_workfn+0x10/0x10 [ 173.543273][ T37] ? _raw_spin_unlock+0x45/0x60 [ 173.548209][ T37] ? finish_task_switch+0x139/0x770 [ 173.553447][ T37] ? __schedule+0x149e/0x20b0 [ 173.558295][ T37] ? kick_pool+0xb9/0x540 [ 173.562668][ T37] process_scheduled_works+0x7f7/0x1060 [ 173.568293][ T37] worker_thread+0xc99/0x13f0 [ 173.573065][ T37] kthread+0x2c7/0x360 [ 173.577216][ T37] ? __cfi_worker_thread+0x10/0x10 [ 173.582375][ T37] ? __cfi_kthread+0x10/0x10 [ 173.587039][ T37] ret_from_fork+0x67/0xa0 [ 173.591501][ T37] ? __cfi_kthread+0x10/0x10 [ 173.596666][ T37] ret_from_fork_asm+0x1a/0x30 [ 173.601498][ T37] [ 173.604705][ T37] INFO: task jbd2/sda1-8:74 blocked for more than 123 seconds. [ 173.612331][ T37] Not tainted syzkaller #0 [ 173.617325][ T37] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 173.626069][ T37] task:jbd2/sda1-8 state:D stack:0 pid:74 tgid:74 ppid:2 flags:0x00004000 [ 173.636418][ T37] Call Trace: [ 173.639727][ T37] [ 173.642672][ T37] __schedule+0x1496/0x20b0 [ 173.647256][ T37] ? update_load_avg+0x4f3/0x1980 [ 173.652327][ T37] ? __sched_text_start+0x10/0x10 [ 173.657441][ T37] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 173.662942][ T37] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 173.668915][ T37] ? dequeue_entity+0x88a/0x13b0 [ 173.673891][ T37] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 173.679801][ T37] schedule+0xc5/0x240 [ 173.683918][ T37] jbd2_journal_wait_updates+0x198/0x280 [ 173.689633][ T37] ? __cfi_jbd2_journal_wait_updates+0x10/0x10 [ 173.695845][ T37] ? __cfi_autoremove_wake_function+0x10/0x10 [ 173.701941][ T37] ? __cfi__raw_write_lock+0x10/0x10 [ 173.707331][ T37] jbd2_journal_commit_transaction+0x813/0x5510 [ 173.713639][ T37] ? sched_clock_noinstr+0xd/0x30 [ 173.718773][ T37] ? __cfi___switch_to+0x10/0x10 [ 173.723874][ T37] ? _raw_spin_unlock+0x45/0x60 [ 173.728866][ T37] ? __cfi_jbd2_journal_commit_transaction+0x10/0x10 [ 173.735726][ T37] ? __schedule+0x149e/0x20b0 [ 173.740430][ T37] ? __kasan_check_write+0x18/0x20 [ 173.745620][ T37] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 173.751131][ T37] ? __kasan_check_write+0x18/0x20 [ 173.756772][ T37] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 173.762371][ T37] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 173.768265][ T37] ? __try_to_del_timer_sync+0x2e8/0x440 [ 173.774012][ T37] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 173.779917][ T37] kjournald2+0x386/0x6a0 [ 173.784290][ T37] ? __cfi_kjournald2+0x10/0x10 [ 173.789225][ T37] ? set_cpus_allowed_ptr+0xa1/0xf0 [ 173.794463][ T37] ? __cfi_autoremove_wake_function+0x10/0x10 [ 173.800617][ T37] ? __kasan_check_read+0x15/0x20 [ 173.805718][ T37] ? __kthread_parkme+0x12f/0x180 [ 173.810755][ T37] ? schedule+0xc5/0x240 [ 173.815085][ T37] kthread+0x2c7/0x360 [ 173.819191][ T37] ? __cfi_kjournald2+0x10/0x10 [ 173.824057][ T37] ? __cfi_kthread+0x10/0x10 [ 173.828747][ T37] ret_from_fork+0x67/0xa0 [ 173.833221][ T37] ? __cfi_kthread+0x10/0x10 [ 173.837907][ T37] ret_from_fork_asm+0x1a/0x30 [ 173.842713][ T37] [ 173.845829][ T37] INFO: task syz-executor:287 blocked for more than 123 seconds. [ 173.853565][ T37] Not tainted syzkaller #0 [ 173.858584][ T37] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 173.867292][ T37] task:syz-executor state:D stack:0 pid:287 tgid:287 ppid:286 flags:0x00000000 [ 173.877518][ T37] Call Trace: [ 173.880824][ T37] [ 173.883769][ T37] __schedule+0x1496/0x20b0 [ 173.888355][ T37] ? __sched_text_start+0x10/0x10 [ 173.893419][ T37] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 173.898955][ T37] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 173.904942][ T37] ? kernel_text_address+0xa9/0xe0 [ 173.910083][ T37] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 173.916075][ T37] schedule+0xc5/0x240 [ 173.920198][ T37] wait_transaction_locked+0x19e/0x240 [ 173.925753][ T37] ? jbd2_journal_begin_ordered_truncate+0x180/0x180 [ 173.932505][ T37] ? __cfi_autoremove_wake_function+0x10/0x10 [ 173.938694][ T37] ? __cfi___set_page_owner+0x10/0x10 [ 173.944192][ T37] start_this_handle+0x7de/0x2050 [ 173.949303][ T37] ? ext4_dirty_inode+0x97/0x110 [ 173.954277][ T37] ? __mark_inode_dirty+0x24e/0xc50 [ 173.959580][ T37] ? jbd2__journal_start+0x860/0x860 [ 173.964941][ T37] ? kasan_save_alloc_info+0x3a/0x50 [ 173.970253][ T37] ? __kasan_slab_alloc+0x73/0x90 [ 173.975366][ T37] ? kmem_cache_alloc_noprof+0x1e2/0x410 [ 173.981039][ T37] ? jbd2__journal_start+0x16d/0x860 [ 173.986399][ T37] jbd2__journal_start+0x300/0x860 [ 173.991631][ T37] __ext4_journal_start_sb+0x111/0x3f0 [ 173.997175][ T37] ext4_dirty_inode+0x97/0x110 [ 174.001983][ T37] ? __cfi_ext4_dirty_inode+0x10/0x10 [ 174.007462][ T37] __mark_inode_dirty+0x24e/0xc50 [ 174.012523][ T37] ? __cfi___mark_inode_dirty+0x10/0x10 [ 174.018231][ T37] ? tcp_release_cb+0x14d/0x4c0 [ 174.023387][ T37] ? mnt_get_write_access_file+0x1af/0x3b0 [ 174.029436][ T37] ? __kasan_check_read+0x15/0x20 [ 174.034584][ T37] file_update_time+0x1d3/0x210 [ 174.039528][ T37] ext4_page_mkwrite+0x2bf/0x1120 [ 174.044599][ T37] ? __kasan_check_write+0x18/0x20 [ 174.049793][ T37] ? folio_unlock+0x137/0x1b0 [ 174.054503][ T37] ? __cfi_ext4_page_mkwrite+0x10/0x10 [ 174.060045][ T37] ? inode_update_timestamps+0x574/0x6e0 [ 174.065740][ T37] ? __mark_inode_dirty+0x2ab/0xc50 [ 174.070953][ T37] do_pte_missing+0x12c4/0x4440 [ 174.075986][ T37] ? touch_atime+0x395/0x470 [ 174.080618][ T37] ? pte_marker_clear+0x1b0/0x1b0 [ 174.085742][ T37] ? __thp_vma_allowable_orders+0x820/0x9a0 [ 174.091692][ T37] ? __cfi___thp_vma_allowable_orders+0x10/0x10 [ 174.098023][ T37] handle_mm_fault+0x1189/0x1ba0 [ 174.103016][ T37] ? __cfi_handle_mm_fault+0x10/0x10 [ 174.108389][ T37] ? lock_vma_under_rcu+0x4cf/0x590 [ 174.113631][ T37] ? __kasan_check_read+0x15/0x20 [ 174.118742][ T37] do_user_addr_fault+0x951/0x1230 [ 174.123894][ T37] ? __cfi_ksys_read+0x10/0x10 [ 174.128764][ T37] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 174.134905][ T37] exc_page_fault+0x58/0xc0 [ 174.139429][ T37] asm_exc_page_fault+0x2b/0x30 [ 174.144285][ T37] RIP: 0033:0x7fa408670163 [ 174.148804][ T37] RSP: 002b:00007fffd703bcb0 EFLAGS: 00010202 [ 174.154955][ T37] RAX: 00007fa4043fff18 RBX: 00007fffd703bde0 RCX: 0000000000000000 [ 174.162941][ T37] RDX: 00007fa4043fff14 RSI: 0000000000000008 RDI: 00007fffd703bde0 [ 174.170995][ T37] RBP: 00000000000003e6 R08: 0000000000000000 R09: 0000000000000000 [ 174.179063][ T37] R10: 00007fffd703bdc0 R11: 0000000000000000 R12: 0000000000000000 [ 174.187123][ T37] R13: 00000000000000e8 R14: ffffffffffffff18 R15: 0000000000000000 [ 174.195147][ T37] [ 174.198245][ T37] NMI backtrace for cpu 0 [ 174.198258][ T37] CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 b8659436e0263bf3bdd99d8db567fd2a3f6145e5 [ 174.198278][ T37] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 174.198287][ T37] Call Trace: [ 174.198292][ T37] [ 174.198299][ T37] __dump_stack+0x21/0x30 [ 174.198325][ T37] dump_stack_lvl+0x140/0x1c0 [ 174.198347][ T37] ? __cfi_dump_stack_lvl+0x10/0x10 [ 174.198370][ T37] ? rcu_preempt_deferred_qs_irqrestore+0x6d6/0xa50 [ 174.198396][ T37] dump_stack+0x19/0x20 [ 174.198417][ T37] nmi_cpu_backtrace+0x2ba/0x2d0 [ 174.198439][ T37] ? rcu_read_unlock_special+0x150/0x420 [ 174.198462][ T37] ? __cfi_nmi_cpu_backtrace+0x10/0x10 [ 174.198483][ T37] ? sched_show_task+0x371/0x530 [ 174.198505][ T37] ? __rcu_read_unlock+0xc0/0xc0 [ 174.198527][ T37] ? __cfi_nmi_raise_cpu_backtrace+0x10/0x10 [ 174.198549][ T37] ? __cfi_nmi_raise_cpu_backtrace+0x10/0x10 [ 174.198571][ T37] nmi_trigger_cpumask_backtrace+0x142/0x2c0 [ 174.198594][ T37] arch_trigger_cpumask_backtrace+0x14/0x20 [ 174.198616][ T37] watchdog+0xe45/0xf90 [ 174.198632][ T37] ? __kasan_check_write+0x18/0x20 [ 174.198667][ T37] ? __cfi_watchdog+0x10/0x10 [ 174.198684][ T37] ? __kasan_check_read+0x15/0x20 [ 174.198698][ T37] ? __kthread_parkme+0x12f/0x180 [ 174.198714][ T37] ? schedule+0xc5/0x240 [ 174.198737][ T37] kthread+0x2c7/0x360 [ 174.198754][ T37] ? __cfi_watchdog+0x10/0x10 [ 174.198770][ T37] ? __cfi_kthread+0x10/0x10 [ 174.198787][ T37] ret_from_fork+0x67/0xa0 [ 174.198810][ T37] ? __cfi_kthread+0x10/0x10 [ 174.198827][ T37] ret_from_fork_asm+0x1a/0x30 [ 174.198843][ T37] [ 174.198848][ T37] Sending NMI from CPU 0 to CPUs 1: [ 174.369981][ C1] NMI backtrace for cpu 1 [ 174.369996][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 b8659436e0263bf3bdd99d8db567fd2a3f6145e5 [ 174.370017][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 174.370027][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 174.370054][ C1] Code: cc cc cc cc cc cc cc b8 52 6f 1f 0f 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 b9 42 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 174.370068][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 174.370083][ C1] RAX: ffff8881f6f00000 RBX: ffff888103668000 RCX: ffffffff85a4a4fd [ 174.370096][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000000314dc [ 174.370106][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd [ 174.370119][ C1] R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000 [ 174.370130][ C1] R13: 1ffff110206cd000 R14: dffffc0000000000 R15: ffffffff87ecc9a8 [ 174.370142][ C1] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 174.370156][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 174.370167][ C1] CR2: 000055670a843c88 CR3: 000000010c71a000 CR4: 00000000003526b0 [ 174.370183][ C1] Call Trace: [ 174.370189][ C1] [ 174.370197][ C1] default_idle+0x17/0x30 [ 174.370219][ C1] arch_cpu_idle+0xd/0x20 [ 174.370238][ C1] default_idle_call+0x3e/0x80 [ 174.370258][ C1] do_idle+0x1df/0x570 [ 174.370276][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 174.370296][ C1] ? do_idle+0xa/0x570 [ 174.370313][ C1] cpu_startup_entry+0x47/0x60 [ 174.370343][ C1] start_secondary+0x12e/0x140 [ 174.370366][ C1] common_startup_64+0x13b/0x157 [ 174.370392][ C1]