last executing test programs: 4m42.537563108s ago: executing program 3 (id=909): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracefs_dir\x00', 0xbf) mount(0x0, &(0x7f0000000100)='./tracefs_dir\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) ioctl$KVM_GET_DIRTY_LOG(0xffffffffffffffff, 0x4010ae42, &(0x7f0000001a00)={0x5, 0x0, &(0x7f0000ff7000/0x7000)=nil}) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./tracefs_dir/buffer_size_kb\x00', 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x280040c0}, 0x200000d5) mkdir(&(0x7f0000000300)='./bus\x00', 0x2c) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000340)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000440)={'pcl812\x00', [0x140, 0x2, 0x3, 0x2, 0x2, 0x1, 0x8002, 0x1000, 0x1007, 0xc72d, 0x8, 0xffffffff, 0x2009, 0x8, 0x4ce, 0xfffffffe, 0xfc, 0xed, 0x6, 0x8, 0x4, 0x0, 0x36, 0x4000b, 0xffe, 0x20002f, 0xaf, 0x0, 0x9, 0x1, 0x4]}) ppoll(&(0x7f0000000500)=[{r5, 0x80}], 0x1, &(0x7f0000000540), 0x0, 0x0) listen(0xffffffffffffffff, 0x5) socket$vsock_stream(0x28, 0x1, 0x0) syz_emit_ethernet(0x42, &(0x7f00000003c0)=ANY=[@ANYBLOB], 0x0) 4m41.20632179s ago: executing program 3 (id=911): openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x2, &(0x7f0000000140)={0x4, &(0x7f0000000180)=[{0x0, 0x7, 0x7d, 0x7f}, {0x4, 0x8, 0x45, 0x4}, {0x1, 0x2, 0x7f, 0xc}, {0x4, 0x14, 0x2, 0xffff0000}]}) read$msr(r3, &(0x7f00000003c0)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f00000193c0)=0x7) clock_gettime(0x8, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000019ac0)={0x0, 0x0, &(0x7f0000019b00)={&(0x7f0000019b40)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc0200000000000000000000000000000000000000000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000000000000000000084010500ac14143b000000000000000000000000000000002b00000000000000ac141408000000000000000000000000000000000000ff00000000000000000000000000ffffffff000000000000000000000000000000003200000000"], 0x23c}}, 0x0) 4m30.735016876s ago: executing program 3 (id=930): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000100)=0x59) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) 4m28.931277529s ago: executing program 3 (id=934): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r2, &(0x7f0000005580)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x47, &(0x7f000001e580)=0x7) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00') getdents64(r3, &(0x7f00000001c0)=""/4110, 0x100e) 4m19.672732186s ago: executing program 3 (id=951): r0 = syz_io_uring_setup(0xf00, &(0x7f00000003c0)={0x0, 0x5078, 0xc00, 0x2, 0x0, 0x0, 0x0}, &(0x7f0000000440)=0x0, &(0x7f0000000500)=0x0, &(0x7f0000000540)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000580)={&(0x7f0000002000)={[{0x0, 0x0, 0x1}]}, 0x1}, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000a80)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x38, 0x0, r4, 0x0, 0x0, 0x0, 0x10040, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xeaa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r7 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r8, &(0x7f0000003000)=""/102392, 0x18ff8) sched_setaffinity(r7, 0x8, &(0x7f000001c000)=0x80000000000003) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f000001c040)={0x0, 0x0, &(0x7f000001c080)={&(0x7f000001c0c0)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x0, {{@in=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}, {@in6=@mcast2, 0x0, 0x32}, @in=@dev, {0x0, 0x0, 0xfffffffffffffffd}, {}, {0x0, 0x5}, 0x0, 0x0, 0xa}, [@algo_auth_trunc={0x4c, 0x14, {{'digest_null\x00'}}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x1}, 0x0) openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r10, 0x0, 0x482, &(0x7f000001c200)={0x11, @private=0xa010101, 0x803, 0x3, 'lc\x00', 0x2, 0x7ff, 0x3e}, 0x2c) r11 = openat$sequencer(0xffffffffffffff9c, &(0x7f000001c240), 0x88b02, 0x0) write$P9_RSTATu(r11, &(0x7f000001c280)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0], 0x230) sendmsg$nl_route(0xffffffffffffffff, &(0x7f000001c2c0)={0x0, 0x0, &(0x7f000001c300)={0x0}}, 0x0) mq_open(0x0, 0x8c2, 0x30, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x5453, 0x0) 4m18.232579151s ago: executing program 3 (id=954): socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340), 0x80, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000440)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) r2 = getpid() lremovexattr(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)=@known='system.posix_acl_access\x00') r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) close_range(r1, 0xffffffffffffffff, 0x200000000000000) 4m2.965204644s ago: executing program 32 (id=954): socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340), 0x80, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000440)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) r2 = getpid() lremovexattr(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)=@known='system.posix_acl_access\x00') r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) close_range(r1, 0xffffffffffffffff, 0x200000000000000) 17.084350543s ago: executing program 1 (id=1448): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) rseq(&(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x6, 0x4, 0xffffffff, 0x7}, 0x2}, 0x20, 0x0, 0x0) sched_setaffinity(0x0, 0x47, &(0x7f0000000200)=0x7) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffd0, 0x0, 0x1, 0x0, 0x0, 0x44820}, 0x8000) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26f8ffa5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b2506f3bb506f1d7fbde8010000000000a073d0de5538ab42e170b3baae34c35987b0dda497ac3f5e97e6e6aeea15c6d5ed24310100000003bb6030f84b63aaf8690db0221b1705c501f802ff59b4e683efa4b6e77e042072bd2ac37d413008ec9eb8166f6e28b49a77ed91befc65315896f88a8fb1dd679fb4c515f8b7a5b7aca6a251a89d47b728502f7e621cc0e3ba04000000c149ee6601728c750d304197c22da8650579475afd96187d881e93b42a5fdfd686d8900c44c67133dad58037fda65885a15a429edfe3027a5ebf95254744f10fd607bc3300b94932b8d944e0b083bbd86b19cb074577a25ff581d92af08a06f857310a2f14326b0b290205e91a682e00c8762cbc6b904c980eef6e6a1def886c95676dce6a8194479700a02b92bdc8d05eae1f24fdd7b80d1bb404c22f681594de2ebb9687219de8d73ac83823feb402a2415a9850d5f0183ec67be96dc0e4c2d7acf1dfe79d6771903b76e21190c22d641030e1ddacf006c3116e1803af20a5f2b5f7ba58aca5bcabbbab24414a3810788e5503e4be66d683daac5f0001000077339b4200000000108a3c87b19d5b9a00c75d84a92d6dcf00ba96edf35ede0e2b57c26e94801b498924166bde57d5f24258d9fd028096cc15a8b912b494d4bbe609031ea1ca65a548971d5d16296dd08e020000007a27310d5d01f8a8a0f5212d7f628f554afea715ccbc66cbb1016490f5d579308cb3188cf2fcaf67e0c16443d526ba4b968f07ae362c2133c168313e"], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0xfeffff, 0xc0, 0x3f000002, &(0x7f0000000700)="c45c57ce395de5b289f07d637a223920f181c2e57d71483cfb2d075a3ff07258e080a194805cdb0c26d3f7ffb1e0d9cf4fa36dcb2168b72de48ac8f93e6804f1c4d70898d0810e044d7e1778eaac5dfdcc9f1208905522025bcfdf1b6f969b094d5c022c2b7ffefde71e0627b9a2069cc1e0175c4b8860aad4b0a103c589f676b6c4e85eb3950c533b6e62c39ccf9ae9bfe54ee5887358d44f46337fbe090d7c7e55847edee8130ffd3d1e719e01a68b0e691c0d35b0b56e0b514036342fd56f08ac0083f3c2fe41a1295a3d23cf3d160d4fd90f66beba68860456ed41272e1e68d16c2564c85f5556e18784113c493d13253e14d6eb891707fba3c30d07d5ee8619e4426cafec4cf6a3723c455d09b586b248", 0x0, 0xf0, 0x0, 0xf0, 0xffffff0c}, 0x40) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x207, 0x5, 0x4}, 0x3f, [0x9, 0x3, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0xfffffc01, 0x0, 0x6, 0x1, 0xfffffffd, 0x39, 0x747d5e13, 0x7ff, 0xfffffb9a, 0xfffffffe, 0x1, 0xfffffffb, 0x2004, 0x3, 0x0, 0x1, 0x482, 0x4800, 0x300000, 0x3, 0xe, 0x400, 0x1, 0x10002, 0x1ff, 0x8000, 0x0, 0x3, 0x4, 0x3, 0xa, 0x8da7, 0x2, 0x200, 0xffffffff, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x240, 0x9, 0x1, 0x4199d, 0x6, 0x2, 0xfffffff6, 0xffffffff, 0x4, 0x40000006, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x2, 0xf, 0x8000, 0xfffffffd, 0x3, 0x3, 0x25, 0x6, 0xff7ffffc, 0x8, 0x7fff, 0x72c, 0xfffffff3, 0x3, 0x8, 0x10000, 0x400, 0x8001, 0x3, 0x3, 0xf, 0x5, 0x0, 0xa, 0x4, 0x1, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000003, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffff7fff, 0x6, 0x2000008, 0x7fd, 0xfdff, 0x2, 0x96, 0xfffffff9, 0x2, 0xffffffff, 0x5, 0x401, 0xe, 0x3, 0x5, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7ff, 0x1, 0x3], [0x401, 0x8000e584, 0x9806, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0x8, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0x2dc000, 0x8, 0x1000, 0x63dd7e7f, 0xc70, 0x4, 0xffff, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x7, 0x200003, 0x100, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x3, 0x3, 0x400004, 0x3, 0x4d7e, 0x3, 0x1000000b, 0x3, 0xbf23, 0x6, 0x9, 0x7, 0x0, 0x5, 0xe, 0x20000006, 0x100fdfd, 0x93, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x9, 0x0, 0x7d, 0x3fd, 0x5], [0x108f, 0xffff, 0x3, 0x0, 0x88, 0x2, 0x4000000, 0x4, 0x5, 0x2, 0x763, 0xb, 0x406, 0x1, 0x5, 0x1000, 0x7f, 0x31d2, 0x3fa6, 0x5, 0x0, 0x5, 0x8000, 0x4, 0x9ac, 0x4, 0x3, 0x2, 0x0, 0x284c, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x8, 0x20008, 0x8a5, 0x8a, 0x46, 0x409, 0x5, 0x4, 0xc, 0xe, 0x4, 0xffffffff, 0x7, 0xffff8a33, 0xfffffff8, 0xf, 0x3, 0x200, 0x4007, 0xd4, 0xfffbfffd, 0x80a, 0xe, 0x101, 0x4, 0xc47a, 0x136, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x2) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) 15.848942093s ago: executing program 0 (id=1454): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x40004}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xdbcd78cf0f854f85}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0xfffe}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_QUOTA_FLAGS={0x8}, @NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x100000001}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xb8}}, 0x804) r3 = syz_open_dev$admmidi(&(0x7f0000000200), 0x2, 0x101842) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x80000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c000000170a01080000000000000000020000010900010073797a3000000000090002"], 0x2c}, 0x1, 0x0, 0x0, 0x8115}, 0x200000c0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r4, 0xc0bc5351, &(0x7f00000004c0)={0x7fffffff, 0x0, 'client1\x00', 0x80000002, "7fafdc4fbe3bc961", "1220965092974ad46350ac471f54ea9eb859c3ea4cc764751ff27d2ff9a6188b", 0x800000, 0x7}) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r3, 0x40045730, &(0x7f0000000240)) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x20040051}, 0x2400c851) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='clear_refs\x00') socket(0x15, 0x6, 0x8) writev(r6, &(0x7f0000000080)=[{&(0x7f00000000c0)='4', 0x1}], 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x301, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}]}], {0x14}}, 0x5c}}, 0x0) syz_usb_connect$midi(0x0, 0x3a, &(0x7f0000000100)=ANY=[@ANYBLOB="1201500200000040e5130100400001020301090228000101183804090400000101032006072401"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) 11.924171219s ago: executing program 0 (id=1462): r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000140)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r4, &(0x7f0000002a00)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x0, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f000001ba40)='./file0\x00', 0x1c0, 0x110) mknodat$null(r5, &(0x7f000001ba80)='./file0\x00', 0x1d4e, 0x103) ptrace$peek(0x4, r1, &(0x7f000001bac0)) bpf$MAP_CREATE(0x0, &(0x7f000001bb00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000054000000060a010400000000000000000100000008000b40000000000900010073797a30000000002c0004802800018008000100666962001c00028008000240000000030800034000000001080001"], 0xdc}}, 0x4040010) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100fcfffffffcdbdf250700000008000300", @ANYRES32=r9, @ANYBLOB="140004006e69637666300000000000000000000008000500060000001400178004"], 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x0) listen(r6, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f000001bb40)={0x10, 0x4, &(0x7f000001bc00)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000000f00000095"], &(0x7f000001bc40)='GPL\x00', 0x1}, 0x94) r11 = bpf$MAP_CREATE(0x0, &(0x7f000001bc80)=@base={0x12, 0x1, 0x8, 0xb}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f000001bd00)=ANY=[@ANYRES32=r11, @ANYRES32=r10, @ANYBLOB='\a'], 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x20, 0x10, 0x701, 0x70bd2a, 0x0, {0xa}, [@typed={0xc, 0x2, 0x0, 0x0, @str='nl80211\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 11.90067227s ago: executing program 1 (id=1463): bpf$PROG_LOAD(0x5, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000680)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000006c0)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000002f80)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000002fc0)='./proc\x00', &(0x7f0000003000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000003040)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000003080), 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, 0x0, 0x0) setgroups(0x0, 0x0) 10.611574651s ago: executing program 0 (id=1465): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000180)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) socket(0x10, 0x3, 0x0) getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000006800)=""/102392, 0x18ff8) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/icmp6\x00') ioctl(r3, 0x3, &(0x7f0000000280)) preadv(r3, &(0x7f00000002c0)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1, 0xa3, 0x0) io_uring_setup(0x6f0e, &(0x7f0000001300)={0x0, 0x2895, 0x100, 0x2, 0x1c3, 0x0, r3}) r4 = getpgrp(0x0) r5 = syz_pidfd_open(r4, 0x0) ioctl$FS_IOC_GETVERSION(r5, 0xff02, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r7, 0x4068aea3, &(0x7f00000000c0)={0xa8, 0x300}) r8 = openat$nsim_port_pp_hold(0xffffffffffffff9c, 0x0, 0x123842, 0x0) write$nsim_bool(r8, &(0x7f0000000080)='1', 0x1) write(r8, &(0x7f00000067c0)='F', 0x1) 10.330841658s ago: executing program 1 (id=1469): socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000380)={0xfdfdffff, 0xfffffff7, 0x1, 0x4, 0x15, "518aba4d000000000000000000000000002000"}) r0 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000001400)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001440)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000001480)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001500)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000001540)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000015c0), 0x651, 0x0) recvmmsg(r2, &(0x7f0000001600), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001640)=0x6) unshare(0x8000000) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000001680)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x7, 0x1, &(0x7f0000001b00)=ANY=[@ANYBLOB], 0x0, 0x5, 0xff7, &(0x7f0000001b80)=""/4087, 0x40f00, 0xc, '\x00', 0x0, @fallback=0x1f, r0, 0x8, &(0x7f0000002b80)={0x8, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, r0, 0x7, &(0x7f0000002bc0), &(0x7f0000002c00)=[{0x5, 0x3, 0xe, 0xa}, {0x1, 0x2, 0x3, 0x1}, {0x3, 0x23, 0xd, 0x6}, {0x1, 0x3, 0x400000b, 0x2}, {0x5, 0x4, 0x6, 0xc}, {0x3, 0x3, 0x4, 0x3}, {0x3, 0x3, 0x10, 0x6}], 0x10, 0x5}, 0x94) ptrace$getregs(0xb, r1, 0x0, &(0x7f0000002d40)=""/4096) socket$nl_route(0x10, 0x3, 0x0) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) 10.196489191s ago: executing program 4 (id=1470): openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x2, &(0x7f0000000140)={0x4, &(0x7f0000000180)=[{0x0, 0x7, 0x7d, 0x7f}, {0x4, 0x8, 0x45, 0x4}, {0x1, 0x2, 0x7f, 0xc}, {0x4, 0x14, 0x2, 0xffff0000}]}) read$msr(r3, &(0x7f00000003c0)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f00000193c0)=0x7) clock_gettime(0x8, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000019400)) mkdirat(0xffffffffffffff9c, &(0x7f0000019500)='./trace\x00', 0x1ff) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000019ac0)={0x0, 0x0, &(0x7f0000019b00)={&(0x7f0000019b40)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc0200000000000000000000000000000000000000000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000000000000000000084010500ac14143b000000000000000000000000000000002b00000000000000ac141408000000000000000000000000000000000000ff00000000000000000000000000ffffffff000000000000000000000000000000003200000000"], 0x23c}}, 0x0) 9.300873213s ago: executing program 1 (id=1471): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sync_file_range(r5, 0x6, 0x9fd, 0x3) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40c4) r6 = syz_open_dev$usbfs(&(0x7f0000000240), 0xf, 0x101301) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r6, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_SETCONFIGURATION(r6, 0x80045505, &(0x7f0000000000)=0x1) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f0000000100)=0x4) add_key$user(&(0x7f00000001c0), &(0x7f0000000280), &(0x7f0000000340)="96acb89a61204124ec7ba1198dfad06ee6ef37cbba50738e27eeb623a3c79dad9204c53ba08c23fba021a424e606537cc9fd9b63f3", 0x35, 0xfffffffffffffffd) mount(&(0x7f00000003c0), &(0x7f0000000400)='./mnt\x00', &(0x7f0000000440)='ecryptfs\x00', 0x0, &(0x7f0000000480)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') statfs(&(0x7f0000000500)='./mnt\x00', &(0x7f0000000540)=""/58) getsockopt$sock_timeval(r2, 0x1, 0x42, &(0x7f0000000180), &(0x7f0000000300)=0x10) 9.281863853s ago: executing program 5 (id=1473): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) rseq(&(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x6, 0x4, 0xffffffff, 0x7}, 0x2}, 0x20, 0x0, 0x0) sched_setaffinity(0x0, 0x47, &(0x7f0000000200)=0x7) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffd0, 0x0, 0x1, 0x0, 0x0, 0x44820}, 0x8000) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26f8ffa5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b2506f3bb506f1d7fbde8010000000000a073d0de5538ab42e170b3baae34c35987b0dda497ac3f5e97e6e6aeea15c6d5ed24310100000003bb6030f84b63aaf8690db0221b1705c501f802ff59b4e683efa4b6e77e042072bd2ac37d413008ec9eb8166f6e28b49a77ed91befc65315896f88a8fb1dd679fb4c515f8b7a5b7aca6a251a89d47b728502f7e621cc0e3ba04000000c149ee6601728c750d304197c22da8650579475afd96187d881e93b42a5fdfd686d8900c44c67133dad58037fda65885a15a429edfe3027a5ebf95254744f10fd607bc3300b94932b8d944e0b083bbd86b19cb074577a25ff581d92af08a06f857310a2f14326b0b290205e91a682e00c8762cbc6b904c980eef6e6a1def886c95676dce6a8194479700a02b92bdc8d05eae1f24fdd7b80d1bb404c22f681594de2ebb9687219de8d73ac83823feb402a2415a9850d5f0183ec67be96dc0e4c2d7acf1dfe79d6771903b76e21190c22d641030e1ddacf006c3116e1803af20a5f2b5f7ba58aca5bcabbbab24414a3810788e5503e4be66d683daac5f0001000077339b4200000000108a3c87b19d5b9a00c75d84a92d6dcf00ba96edf35ede0e2b57c26e94801b498924166bde57d5f24258d9fd028096cc15a8b912b494d4bbe609031ea1ca65a548971d5d16296dd08e020000007a27310d5d01f8a8a0f5212d7f628f554afea715ccbc66cbb1016490f5d579308cb3188cf2fcaf67e0c16443d526ba4b968f07ae362c2133c168313e84beb871203880dd453c45d0a137d7f5a8b039dbfa62fb2b4214f8e69f967bf1fbd89e77fcca110000000800000000000000f8877994ebdc35f7efd41e3babd9b3782edd6776d5b6cb4ecd72c9de9b5503747d71440378cf2c2c7ea2dc5febb654a867f853713cf4c0bb322fbbe446d18dee4c821275ef18259cafc346c8b3b9fb0f3adcf6ea310a6b9a3f59e29a5909ea047fb61affb4bc8bbea1fb761b8933795b1a91358a7791aa843d07020e8bb6fc18458c49ac6313e7165b7d9f65e94a62b69f1011b94340cdb7"], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0xfeffff, 0xc0, 0x3f000002, &(0x7f0000000700)="c45c57ce395de5b289f07d637a223920f181c2e57d71483cfb2d075a3ff07258e080a194805cdb0c26d3f7ffb1e0d9cf4fa36dcb2168b72de48ac8f93e6804f1c4d70898d0810e044d7e1778eaac5dfdcc9f1208905522025bcfdf1b6f969b094d5c022c2b7ffefde71e0627b9a2069cc1e0175c4b8860aad4b0a103c589f676b6c4e85eb3950c533b6e62c39ccf9ae9bfe54ee5887358d44f46337fbe090d7c7e55847edee8130ffd3d1e719e01a68b0e691c0d35b0b56e0b514036342fd56f08ac0083f3c2fe41a1295a3d23cf3d160d4fd90f66beba68860456ed41272e1e68d16c2564c85f5556e18784113c493d13253e14d6eb891707fba3c30d07d5ee8619e4426cafec4cf6a3723c455d09b586b248", 0x0, 0xf0, 0x0, 0xf0, 0xffffff0c}, 0x40) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x207, 0x5, 0x4}, 0x3f, [0x9, 0x3, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0xfffffc01, 0x0, 0x6, 0x1, 0xfffffffd, 0x39, 0x747d5e13, 0x7ff, 0xfffffb9a, 0xfffffffe, 0x1, 0xfffffffb, 0x2004, 0x3, 0x0, 0x1, 0x482, 0x4800, 0x300000, 0x3, 0xe, 0x400, 0x1, 0x10002, 0x1ff, 0x8000, 0x0, 0x3, 0x4, 0x3, 0xa, 0x8da7, 0x2, 0x200, 0xffffffff, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x240, 0x9, 0x1, 0x4199d, 0x6, 0x2, 0xfffffff6, 0xffffffff, 0x4, 0x40000006, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x2, 0xf, 0x8000, 0xfffffffd, 0x3, 0x3, 0x25, 0x6, 0xff7ffffc, 0x8, 0x7fff, 0x72c, 0xfffffff3, 0x3, 0x8, 0x10000, 0x400, 0x8001, 0x3, 0x3, 0xf, 0x5, 0x0, 0xa, 0x4, 0x1, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000003, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffff7fff, 0x6, 0x2000008, 0x7fd, 0xfdff, 0x2, 0x96, 0xfffffff9, 0x2, 0xffffffff, 0x5, 0x401, 0xe, 0x3, 0x5, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7ff, 0x1, 0x3], [0x401, 0x8000e584, 0x9806, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0x8, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0x2dc000, 0x8, 0x1000, 0x63dd7e7f, 0xc70, 0x4, 0xffff, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x7, 0x200003, 0x100, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x3, 0x3, 0x400004, 0x3, 0x4d7e, 0x3, 0x1000000b, 0x3, 0xbf23, 0x6, 0x9, 0x7, 0x0, 0x5, 0xe, 0x20000006, 0x100fdfd, 0x93, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x9, 0x0, 0x7d, 0x3fd, 0x5], [0x108f, 0xffff, 0x3, 0x0, 0x88, 0x2, 0x4000000, 0x4, 0x5, 0x2, 0x763, 0xb, 0x406, 0x1, 0x5, 0x1000, 0x7f, 0x31d2, 0x3fa6, 0x5, 0x0, 0x5, 0x8000, 0x4, 0x9ac, 0x4, 0x3, 0x2, 0x0, 0x284c, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x8, 0x20008, 0x8a5, 0x8a, 0x46, 0x409, 0x5, 0x4, 0xc, 0xe, 0x4, 0xffffffff, 0x7, 0xffff8a33, 0xfffffff8, 0xf, 0x3, 0x200, 0x4007, 0xd4, 0xfffbfffd, 0x80a, 0xe, 0x101, 0x4, 0xc47a, 0x136, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x2) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) 7.39096808s ago: executing program 1 (id=1475): r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000140)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r4, &(0x7f0000002a00)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x0, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f000001ba40)='./file0\x00', 0x1c0, 0x110) mknodat$null(r5, &(0x7f000001ba80)='./file0\x00', 0x1d4e, 0x103) ptrace$peek(0x4, r1, &(0x7f000001bac0)) bpf$MAP_CREATE(0x0, &(0x7f000001bb00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000054000000060a010400000000000000000100000008000b40000000000900010073797a30000000002c0004802800018008000100666962001c00028008000240000000030800034000000001080001"], 0xdc}}, 0x4040010) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100fcfffffffcdbdf250700000008000300", @ANYRES32=r9, @ANYBLOB="140004006e69637666300000000000000000000008000500060000001400178004"], 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x0) listen(r6, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f000001bb40)={0x10, 0x4, &(0x7f000001bc00)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000000f00000095"], &(0x7f000001bc40)='GPL\x00', 0x1}, 0x94) r11 = bpf$MAP_CREATE(0x0, &(0x7f000001bc80)=@base={0x12, 0x1, 0x8, 0xb}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f000001bd00)=ANY=[@ANYRES32=r11, @ANYRES32=r10, @ANYBLOB='\a'], 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x20, 0x10, 0x701, 0x70bd2a, 0x0, {0xa}, [@typed={0xc, 0x2, 0x0, 0x0, @str='nl80211\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 6.080919322s ago: executing program 1 (id=1477): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8}}}}}}]}}, 0x0) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000040)=0x1, &(0x7f0000000080)=0x2) r1 = syz_open_dev$admmidi(&(0x7f0000000000), 0x8e53, 0x2000) lseek(r1, 0x45, 0x4) r2 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7ffc, 0x2) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) write$P9_RRENAME(r3, &(0x7f0000000140)={0x7, 0x15, 0x1}, 0x7) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000200)={0x0, 0x1, 0x2, 0x0, 0x7}) 5.764470159s ago: executing program 2 (id=1478): sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) acct(&(0x7f0000000100)='./file0\x00') openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x719ac1) 5.76428833s ago: executing program 4 (id=1479): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000)={'/dev/syzrnull', 0x0}, 0x43, 0x0) vmsplice(r0, 0x0, 0x0, 0xc) 4.93415906s ago: executing program 4 (id=1480): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f00000001c0)=[@increfs]}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f00000002c0)=[@acquire]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000003c0)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000440)={0x0, 0x18, 0x30}}}]}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f00000004c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000005c0)={0x44, 0x0, &(0x7f0000000600)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}]}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000007c0)={0x4c, 0x0, &(0x7f0000000800)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}]}) 4.827305282s ago: executing program 2 (id=1481): socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000380)={0xfdfdffff, 0xfffffff7, 0x1, 0x4, 0x15, "518aba4d000000000000000000000000002000"}) r0 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000001400)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001440)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000001480)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001500)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000001540)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000015c0), 0x651, 0x0) recvmmsg(r2, &(0x7f0000001600), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001640)=0x6) unshare(0x8000000) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000001680)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x7, 0x1, &(0x7f0000001b00)=ANY=[@ANYBLOB], 0x0, 0x5, 0xff7, &(0x7f0000001b80)=""/4087, 0x40f00, 0xc, '\x00', 0x0, @fallback=0x1f, r0, 0x8, &(0x7f0000002b80)={0x8, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, r0, 0x7, &(0x7f0000002bc0), &(0x7f0000002c00)=[{0x5, 0x3, 0xe, 0xa}, {0x1, 0x2, 0x3, 0x1}, {0x3, 0x23, 0xd, 0x6}, {0x1, 0x3, 0x400000b, 0x2}, {0x5, 0x4, 0x6, 0xc}, {0x3, 0x3, 0x4, 0x3}, {0x3, 0x3, 0x10, 0x6}], 0x10, 0x5}, 0x94) ptrace$getregs(0xb, r1, 0x0, &(0x7f0000002d40)=""/4096) socket$nl_route(0x10, 0x3, 0x0) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) 4.742040935s ago: executing program 5 (id=1482): syz_emit_ethernet(0x6a, &(0x7f00000002c0)={@broadcast, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x3, 0x0, 0x5c, 0x65, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x88a8, 0x0, 0x0, [0xff, 0x3]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0x8}}}, {}, {0x8, 0x6558, 0x1}}}}}}, 0x0) set_mempolicy(0x5, &(0x7f0000000040)=0x3, 0x9) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x4001, 0x3, 0x278, 0x110, 0x700001b, 0x148, 0x0, 0x148, 0x1e0, 0x206, 0x240, 0x1e0, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x1ea, 0xc8, 0x110, 0x0, {0x390, 0x8f00}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@unspec=@cluster={{0x30}, {0x9, 0xa, 0x7, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'nicvf0\x00', {0x1}}}}, {{@ip={@broadcast, @rand_addr=0x64010101, 0xffffffff, 0xffffff00, 'veth0\x00', 'syzkaller1\x00', {0xff}, {}, 0xff, 0x2, 0x18}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x2, [0x3, 0x0, 0x3, 0x0, 0x1, 0x1], 0x3, 0x7}, {0xffffffffffffffff, [0x1, 0x6, 0x1, 0x0, 0x2, 0x1], 0x5, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d8) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps_rollup\x00') setsockopt$packet_int(r1, 0x107, 0x12, &(0x7f0000000340)=0x88600000, 0x4) syz_clone(0x84008200, 0x0, 0x0, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000d40), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_HEADER(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000dc0)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000e00)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f0000000e40), 0x2, 0x143102) writev(r3, &(0x7f0000000e80)=[{&(0x7f0000000ec0)="94", 0xf000}, {0x0}], 0x2) listen(0xffffffffffffffff, 0x5) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000f00)={'ip_vti0\x00', &(0x7f0000000f40)={'syztnl0\x00', 0x0, 0x8080, 0x7, 0xbb, 0xffffd45d, {{0x5, 0x4, 0x3, 0x0, 0x14, 0x65, 0x0, 0x0, 0x2f, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x25}}}}}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=ANY=[@ANYBLOB="230000000800000002000000ffff0000"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, r5, 0xffff, '\x00', r4, r2}, 0x50) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001040)={&(0x7f0000001080)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000010c0)={0x11, 0x3, &(0x7f0000001180)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f00000011c0)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r7, 0x8, &(0x7f0000001200)={0x0, 0x1}, 0x1}, 0x94) connect$netlink(0xffffffffffffffff, &(0x7f0000001280)=@unspec={0x2d}, 0xc) write$6lowpan_control(0xffffffffffffffff, &(0x7f00000012c0)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000001300), 0x0) close(r9) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001340)=@bpf_ext={0x1a, 0xf, &(0x7f0000001400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001480)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r7, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r8, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) 3.952414794s ago: executing program 4 (id=1483): openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) syz_open_dev$dvb_frontend(0x0, 0x0, 0x882) bpf$MAP_CREATE(0x0, 0x0, 0x48) fsopen(&(0x7f0000000440)='overlay\x00', 0x1) ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0285628, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000480)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x34) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x161200, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f00000006c0)='./sys_sec\x00', &(0x7f0000000700)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r0, &(0x7f0000000c40)='select \n', 0x10) write(r0, &(0x7f0000000c80)='file read \\-\\}/passwd task.uid=0-0xec.argv[0]=\"sh\" exec.envp[\"PATH\"!=\"/bin\"\n', 0x4c) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000d40)=[@text16={0x10, &(0x7f0000000d80)="64670feea1096f00003e660f38054c880f323e26640fb9a9c94f660fc7b27f1a360f09366764f4660fdd40e69a3a00e300baa000b0e5ee", 0x37}], 0x1, 0x6, 0x0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000dc0), 0x1, 0x0) unlink(&(0x7f0000000e00)='./file0\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 3.895207955s ago: executing program 2 (id=1484): r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r0, 0x28, 0x8, 0x0, &(0x7f0000000300)) 3.71285504s ago: executing program 2 (id=1485): mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000580)='./debug\x00', &(0x7f00000005c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./debug/bluetooth/hci0/msft_opcode\x00', 0x2, 0x0) write(r0, &(0x7f0000000640)='64542', 0x5) 3.078538115s ago: executing program 0 (id=1486): openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) syz_open_dev$dvb_frontend(0x0, 0x0, 0x882) bpf$MAP_CREATE(0x0, 0x0, 0x48) fsopen(&(0x7f0000000440)='overlay\x00', 0x1) ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0285628, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000480)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x34) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys_sec\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000c80)='file read \\-\\}/passwd task.uid=0-0xec.argv[0]=\"sh\" exec.envp[\"PATH\"!=\"/bin\"\n', 0x4c) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000d40)=[@text16={0x10, &(0x7f0000000d80)="64670feea1096f00003e660f38054c880f323e26640fb9a9c94f660fc7b27f1a360f09366764f4660fdd40e69a3a00e300baa000b0e5ee", 0x37}], 0x1, 0x6, 0x0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) unlink(&(0x7f0000000e00)='./file0\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 2.932585009s ago: executing program 2 (id=1487): r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000140)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r4, &(0x7f0000002a00)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x0, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f000001ba40)='./file0\x00', 0x1c0, 0x110) mknodat$null(r5, &(0x7f000001ba80)='./file0\x00', 0x1d4e, 0x103) ptrace$peek(0x4, r1, &(0x7f000001bac0)) bpf$MAP_CREATE(0x0, &(0x7f000001bb00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000054000000060a010400000000000000000100000008000b40000000000900010073797a30000000002c0004802800018008000100666962001c00028008000240000000030800034000000001080001"], 0xdc}}, 0x4040010) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100fcfffffffcdbdf250700000008000300", @ANYRES32=r9, @ANYBLOB="140004006e69637666300000000000000000000008000500060000001400178004"], 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x0) listen(r6, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f000001bb40)={0x10, 0x4, &(0x7f000001bc00)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000000f00000095"], &(0x7f000001bc40)='GPL\x00', 0x1}, 0x94) r11 = bpf$MAP_CREATE(0x0, &(0x7f000001bc80)=@base={0x12, 0x1, 0x8, 0xb}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f000001bd00)=ANY=[@ANYRES32=r11, @ANYRES32=r10, @ANYBLOB='\a'], 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x20, 0x10, 0x701, 0x70bd2a, 0x0, {0xa}, [@typed={0xc, 0x2, 0x0, 0x0, @str='nl80211\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 2.860405011s ago: executing program 5 (id=1488): r0 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="0200000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r2}, &(0x7f0000000500), &(0x7f0000000540)}, 0x20) fsmount(r0, 0x1, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={&(0x7f0000000000)='./file0\x00', r2}, 0x18) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) pread64(r3, &(0x7f0000000240)=""/133, 0x85, 0x5b) 2.838591622s ago: executing program 4 (id=1489): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x284131, 0xffffffffffffffff, 0x42795000) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000002c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000300)=""/102392, 0x18ff8) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r4, &(0x7f0000019300)={0xa, 0x0, 0xfffffffd, @empty}, 0x1c) r5 = dup(r4) r6 = open(&(0x7f0000019340)='./file0\x00', 0x181c42, 0x81) ftruncate(r6, 0x200004) sendfile(r5, r6, 0x0, 0x80001d00c0d1) 2.0604269s ago: executing program 2 (id=1490): mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='1', 0x1) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) syz_ublk_setup_io_uring(0x20, 0x0, 0x0, &(0x7f0000000800), 0x0) 1.976655192s ago: executing program 5 (id=1491): sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) acct(&(0x7f0000000100)='./file0\x00') openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x719ac1) 1.198758651s ago: executing program 4 (id=1492): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) rseq(&(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x6, 0x4, 0xffffffff, 0x7}, 0x2}, 0x20, 0x0, 0x0) sched_setaffinity(0x0, 0x47, &(0x7f0000000200)=0x7) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffffd0, 0x0, 0x1, 0x0, 0x0, 0x44820}, 0x8000) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26f8ffa5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b2506f3bb506f1d7fbde8010000000000a073d0de5538ab42e170b3baae34c35987b0dda497ac3f5e97e6e6aeea15c6d5ed24310100000003bb6030f84b63aaf8690db0221b1705c501f802ff59b4e683efa4b6e77e042072bd2ac37d413008ec9eb8166f6e28b49a77ed91befc65315896f88a8fb1dd679fb4c515f8b7a5b7aca6a251a89d47b728502f7e621cc0e3ba04000000c149ee6601728c750d304197c22da8650579475afd96187d881e93b42a5fdfd686d8900c44c67133dad58037fda65885a15a429edfe3027a5ebf95254744f10fd607bc3300b94932b8d944e0b083bbd86b19cb074577a25ff581d92af08a06f857310a2f14326b0b290205e91a682e00c8762cbc6b904c980eef6e6a1def886c95676dce6a8194479700a02b92bdc8d05eae1f24fdd7b80d1bb404c22f681594de2ebb9687219de8d73ac83823feb402a2415a9850d5f0183ec67be96dc0e4c2d7acf1dfe79d6771903b76e21190c22d641030e1ddacf006c3116e1803af20a5f2b5f7ba58aca5bcabbbab24414a3810788e5503e4be66d683daac5f0001000077339b4200000000108a3c87b19d5b9a00c75d84a92d6dcf00ba96edf35ede0e2b57c26e94801b498924166bde57d5f24258d9fd028096cc15a8b912b494d4bbe609031ea1ca65a548971d5d16296dd08e020000007a27310d5d01f8a8a0f5212d7f628f554afea715ccbc66cbb1016490f5d579308cb3188cf2fcaf67e0c16443d526ba4b968f07ae362c2133c168313e84beb871203880dd453c45d0a137d7f5a8b039dbfa62fb2b4214f8e69f967bf1fbd89e77fcca110000000800000000000000f8877994ebdc35f7efd41e3babd9b3782edd6776d5b6cb4ecd72c9de9b5503747d71440378cf2c2c7ea2dc5febb654a867f853713cf4c0bb322fbbe446d18dee4c821275ef18259cafc346c8b3b9fb0f3adcf6ea310a6b9a3f59e29a5909ea047fb61affb4bc8bbea1fb761b8933795b1a91358a7791aa843d07020e8bb6fc18458c49ac6313e7165b7d9f65e94a62b69f1011b94340cdb7"], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0xfeffff, 0xc0, 0x3f000002, &(0x7f0000000700)="c45c57ce395de5b289f07d637a223920f181c2e57d71483cfb2d075a3ff07258e080a194805cdb0c26d3f7ffb1e0d9cf4fa36dcb2168b72de48ac8f93e6804f1c4d70898d0810e044d7e1778eaac5dfdcc9f1208905522025bcfdf1b6f969b094d5c022c2b7ffefde71e0627b9a2069cc1e0175c4b8860aad4b0a103c589f676b6c4e85eb3950c533b6e62c39ccf9ae9bfe54ee5887358d44f46337fbe090d7c7e55847edee8130ffd3d1e719e01a68b0e691c0d35b0b56e0b514036342fd56f08ac0083f3c2fe41a1295a3d23cf3d160d4fd90f66beba68860456ed41272e1e68d16c2564c85f5556e18784113c493d13253e14d6eb891707fba3c30d07d5ee8619e4426cafec4cf6a3723c455d09b586b248", 0x0, 0xf0, 0x0, 0xf0, 0xffffff0c}, 0x40) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x207, 0x5, 0x4}, 0x3f, [0x9, 0x3, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0xfffffc01, 0x0, 0x6, 0x1, 0xfffffffd, 0x39, 0x747d5e13, 0x7ff, 0xfffffb9a, 0xfffffffe, 0x1, 0xfffffffb, 0x2004, 0x3, 0x0, 0x1, 0x482, 0x4800, 0x300000, 0x3, 0xe, 0x400, 0x1, 0x10002, 0x1ff, 0x8000, 0x0, 0x3, 0x4, 0x3, 0xa, 0x8da7, 0x2, 0x200, 0xffffffff, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x240, 0x9, 0x1, 0x4199d, 0x6, 0x2, 0xfffffff6, 0xffffffff, 0x4, 0x40000006, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x2, 0xf, 0x8000, 0xfffffffd, 0x3, 0x3, 0x25, 0x6, 0xff7ffffc, 0x8, 0x7fff, 0x72c, 0xfffffff3, 0x3, 0x8, 0x10000, 0x400, 0x8001, 0x3, 0x3, 0xf, 0x5, 0x0, 0xa, 0x4, 0x1, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000003, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffff7fff, 0x6, 0x2000008, 0x7fd, 0xfdff, 0x2, 0x96, 0xfffffff9, 0x2, 0xffffffff, 0x5, 0x401, 0xe, 0x3, 0x5, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7ff, 0x1, 0x3], [0x401, 0x8000e584, 0x9806, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0x8, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0x2dc000, 0x8, 0x1000, 0x63dd7e7f, 0xc70, 0x4, 0xffff, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x7, 0x200003, 0x100, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x3, 0x3, 0x400004, 0x3, 0x4d7e, 0x3, 0x1000000b, 0x3, 0xbf23, 0x6, 0x9, 0x7, 0x0, 0x5, 0xe, 0x20000006, 0x100fdfd, 0x93, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x9, 0x0, 0x7d, 0x3fd, 0x5], [0x108f, 0xffff, 0x3, 0x0, 0x88, 0x2, 0x4000000, 0x4, 0x5, 0x2, 0x763, 0xb, 0x406, 0x1, 0x5, 0x1000, 0x7f, 0x31d2, 0x3fa6, 0x5, 0x0, 0x5, 0x8000, 0x4, 0x9ac, 0x4, 0x3, 0x2, 0x0, 0x284c, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x8, 0x20008, 0x8a5, 0x8a, 0x46, 0x409, 0x5, 0x4, 0xc, 0xe, 0x4, 0xffffffff, 0x7, 0xffff8a33, 0xfffffff8, 0xf, 0x3, 0x200, 0x4007, 0xd4, 0xfffbfffd, 0x80a, 0xe, 0x101, 0x4, 0xc47a, 0x136, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x2) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) 1.082098604s ago: executing program 5 (id=1493): fsopen(&(0x7f0000000f80)='zonefs\x00', 0x1) 1.016520026s ago: executing program 0 (id=1494): socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000380)={0xfdfdffff, 0xfffffff7, 0x1, 0x4, 0x15, "518aba4d000000000000000000000000002000"}) r0 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000001400)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001440)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000001480)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001500)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000001540)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000015c0), 0x651, 0x0) recvmmsg(r2, &(0x7f0000001600), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001640)=0x6) unshare(0x8000000) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000001680)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x7, 0x1, &(0x7f0000001b00)=ANY=[@ANYBLOB], 0x0, 0x5, 0xff7, &(0x7f0000001b80)=""/4087, 0x40f00, 0xc, '\x00', 0x0, @fallback=0x1f, r0, 0x8, &(0x7f0000002b80)={0x8, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, r0, 0x7, &(0x7f0000002bc0), &(0x7f0000002c00)=[{0x5, 0x3, 0xe, 0xa}, {0x1, 0x2, 0x3, 0x1}, {0x3, 0x23, 0xd, 0x6}, {0x1, 0x3, 0x400000b, 0x2}, {0x5, 0x4, 0x6, 0xc}, {0x3, 0x3, 0x4, 0x3}, {0x3, 0x3, 0x10, 0x6}], 0x10, 0x5}, 0x94) ptrace$getregs(0xb, r1, 0x0, &(0x7f0000002d40)=""/4096) socket$nl_route(0x10, 0x3, 0x0) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) 827.34831ms ago: executing program 5 (id=1495): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) setrlimit(0xa, &(0x7f0000000800)={0x2, 0x1}) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000bc0)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc9}}}, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./tracing\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000c40)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x401, 0x0) write(r1, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) fsopen(0x0, 0x1) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000c80)='.\x00', 0x8880, 0x4) lseek(r2, 0x103, 0x0) getdents(r2, 0x0, 0x18) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000cc0), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000d80)={0x30, r3, 0xb97534d5fe9704cf, 0x70bd2b, 0x25dfdbfc, {{0x12}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x6, 0x13, [{0x59}, {0x1, 0x1}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xc841}, 0x44) openat(0xffffffffffffff9c, 0x0, 0x2002, 0x0) write(0xffffffffffffffff, &(0x7f0000000dc0), 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000e40), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc4c85513, &(0x7f0000000e80)={{0x2, 0x2}, 0x0, [0x1, 0x2, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x244, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffd]}) accept$inet6(0xffffffffffffffff, &(0x7f0000001380)={0xa, 0x0, 0x0, @empty}, &(0x7f00000013c0)=0x1c) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000a00)='./debug\x00', &(0x7f0000000a40)='debugfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./debug/netdevsim/netdevsim0/ports/0/queue_reset\x00', 0x1, 0x0) write(r5, &(0x7f0000000ac0)='0 9', 0x1d) 0s ago: executing program 0 (id=1496): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./gadget\x00', &(0x7f00000001c0)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f00000002c0), 0x100) kernel console output (not intermixed with test programs): T7251] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 527.723806][ T7251] device bridge_slave_0 left promiscuous mode [ 527.731641][ T7251] bridge0: port 1(bridge_slave_0) entered disabled state [ 527.759474][ T7251] device bridge_slave_1 left promiscuous mode [ 527.781576][ T7251] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.821223][ T7251] bond0: (slave bond_slave_0): Releasing backup interface [ 527.880705][ T7251] bond0: (slave bond_slave_1): Releasing backup interface [ 527.888098][ T4383] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 528.047062][ T7251] team0: Port device team_slave_0 removed [ 528.085365][ T4383] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 528.108001][ T4383] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 528.121085][ T7251] team0: Port device team_slave_1 removed [ 528.146385][ T4383] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 528.162305][ T7255] team0: Mode changed to "loadbalance" [ 528.181820][ T4383] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.204878][ T4383] usb 5-1: Product: syz [ 528.222294][ T4383] usb 5-1: Manufacturer: syz [ 528.244847][ T4383] usb 5-1: SerialNumber: syz [ 528.586100][ T7254] netlink: 16 bytes leftover after parsing attributes in process `syz.4.689'. [ 529.349397][ T4383] usb 5-1: USB disconnect, device number 16 [ 531.954927][ T7296] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 531.966869][ T7296] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 531.974959][ T7296] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 531.983096][ T7296] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 531.991315][ T7296] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 531.999705][ T7296] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 532.035353][ T7296] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 532.690180][ T7262] Process accounting resumed [ 540.857559][ T7361] bridge0: port 1(dummy0) entered blocking state [ 540.865702][ T7361] bridge0: port 1(dummy0) entered disabled state [ 540.875472][ T7361] device dummy0 entered promiscuous mode [ 540.883121][ T7361] bridge0: port 1(dummy0) entered blocking state [ 540.889616][ T7361] bridge0: port 1(dummy0) entered forwarding state [ 542.162419][ T7371] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 542.178906][ T7371] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 542.195989][ T7371] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 542.218229][ T7371] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 542.231333][ T7371] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 542.243506][ T7371] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 542.258825][ T7371] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 542.985775][ T7377] binder: 7376:7377 unknown command 1074553619 [ 542.991996][ T7377] binder: 7376:7377 ioctl c0306201 200000000240 returned -22 [ 549.082813][ T4828] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 550.122796][ T4828] usb 3-1: Using ep0 maxpacket: 16 [ 550.133563][ T4828] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 550.152588][ T4828] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 550.182636][ T4828] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 550.191733][ T4828] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 550.223107][ T4828] usb 3-1: SerialNumber: syz [ 550.274172][ T4828] usb 3-1: 0:2 : does not exist [ 550.280015][ T4828] usb 3-1: unit 5 not found! [ 550.385749][ T4828] usb 3-1: USB disconnect, device number 20 [ 550.512927][ T7] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 550.712681][ T7] usb 4-1: Using ep0 maxpacket: 16 [ 550.720101][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 550.750811][ T7] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 550.796990][ T7] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 550.830262][ T7] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 551.872830][ T7] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 551.890755][ T7430] comedi comedi2: Buffer allocation failed [ 551.953704][ T7] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 551.965157][ T7] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 551.973888][ T7] usb 4-1: Manufacturer: syz [ 552.024183][ T7] usb 4-1: config 0 descriptor?? [ 552.171211][ T7436] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 552.179833][ T7436] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 552.187328][ T7436] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 552.195287][ T7436] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 552.202801][ T7436] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 552.210251][ T7436] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 552.217774][ T7436] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 552.226280][ T7436] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 552.234880][ T7436] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 552.242355][ T7436] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 553.219449][ T7435] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 553.262354][ T7435] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 553.315011][ T7435] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 553.378534][ T7435] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 553.645015][ T7] rc_core: IR keymap rc-hauppauge not found [ 553.656083][ T7] Registered IR keymap rc-empty [ 553.666281][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.712640][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.735694][ T7435] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 553.744738][ T7] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 553.770665][ T7435] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 553.803085][ T7] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input23 [ 553.820328][ T7435] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 553.890432][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.938076][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 553.992884][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 554.054410][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 554.098501][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 554.132949][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 554.162658][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 554.202834][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 554.867401][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 555.982740][ T7] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 556.023831][ T7] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 556.084467][ T7] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 556.105095][ T7] usb 4-1: USB disconnect, device number 13 [ 561.015592][ T7506] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 561.029069][ T7506] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 561.037784][ T7506] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 561.045878][ T7506] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 561.054078][ T7506] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 561.062204][ T7506] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 561.082616][ T7] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 561.191430][ T7506] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 561.248949][ T7506] sctp_transport_update_pmtu: 48 callbacks suppressed [ 561.248997][ T7506] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 561.267520][ T7506] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 561.279016][ T7506] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 561.290333][ T7506] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 561.302696][ T7] usb 4-1: Using ep0 maxpacket: 16 [ 561.313835][ T7] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 561.326093][ T7506] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 561.341822][ T7506] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 561.354607][ T7506] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 561.366396][ T7506] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 561.378395][ T7506] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 561.390123][ T7506] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 561.453770][ T4338] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 561.528820][ T7] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 561.646799][ T7] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 561.692924][ T4338] usb 1-1: Using ep0 maxpacket: 16 [ 561.713604][ T4338] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 561.762692][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 561.786531][ T4338] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 561.806965][ T7] usb 4-1: SerialNumber: syz [ 561.850618][ T7] usb 4-1: 0:2 : does not exist [ 561.862793][ T4338] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 561.897388][ T7] usb 4-1: unit 5 not found! [ 561.910766][ T4338] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 561.962075][ T4338] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 562.006536][ T4338] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 562.030308][ T4338] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 562.050705][ T4338] usb 1-1: Manufacturer: syz [ 562.073269][ T4338] usb 1-1: config 0 descriptor?? [ 563.387058][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.393942][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.475926][ T7521] Process accounting paused [ 563.762767][ T4338] rc_core: IR keymap rc-hauppauge not found [ 563.768742][ T4338] Registered IR keymap rc-empty [ 564.151333][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.188364][ T7] usb 4-1: USB disconnect, device number 14 [ 564.203277][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.258855][ T4338] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 564.287182][ T4338] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input24 [ 564.328005][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.490873][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.557865][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.602789][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.647013][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.684102][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.732650][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.766879][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.828374][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.872721][ T4338] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 564.915260][ T4338] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 564.953661][ T4338] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 566.059377][ T4338] usb 1-1: USB disconnect, device number 20 [ 566.878173][ T7550] syz.2.756 (7550) used greatest stack depth: 19856 bytes left [ 566.955369][ T7551] netlink: 12 bytes leftover after parsing attributes in process `syz.2.756'. [ 568.402073][ T7558] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 568.410562][ T7558] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 568.418096][ T7558] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 568.425507][ T7558] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 568.433045][ T7558] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 568.440515][ T7558] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 568.448139][ T7558] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 568.531931][ T7561] sctp_transport_update_pmtu: 48 callbacks suppressed [ 568.531944][ T7561] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 568.627463][ T7561] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 568.657607][ T7561] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 568.722586][ T7561] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 568.990053][ T7561] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 569.029634][ T7561] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 569.088217][ T7561] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 569.108567][ T7561] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 569.120831][ T7561] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 569.247160][ T7561] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 571.407467][ T7586] device syzkaller1 entered promiscuous mode [ 571.542661][ T4401] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 571.742691][ T4401] usb 1-1: Using ep0 maxpacket: 16 [ 571.763846][ T4401] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 571.862931][ T4401] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 571.873949][ T4401] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 571.965332][ T4401] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 572.031332][ T4401] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 572.074615][ T4401] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 572.094154][ T4401] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 572.140841][ T4401] usb 1-1: Manufacturer: syz [ 572.158918][ T4401] usb 1-1: config 0 descriptor?? [ 572.662829][ T4401] rc_core: IR keymap rc-hauppauge not found [ 572.678999][ T4401] Registered IR keymap rc-empty [ 572.739591][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 572.762652][ T4338] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 572.772646][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 572.803240][ T4401] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 572.832236][ T4401] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input25 [ 572.905924][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 572.942803][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 572.962758][ T4338] usb 2-1: Using ep0 maxpacket: 8 [ 572.992750][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 573.027898][ T4338] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 573.042701][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 573.086615][ T4338] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 573.093135][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 573.142627][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 573.165025][ T4338] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 573.183203][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 573.222692][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 573.257534][ T4338] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 573.272711][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 573.310431][ T4338] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.322634][ T4401] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 573.353772][ T4401] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 573.382693][ T4401] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 573.391240][ T4338] hub 2-1:1.0: bad descriptor, ignoring hub [ 573.420526][ T4401] usb 1-1: USB disconnect, device number 21 [ 573.442671][ T4338] hub: probe of 2-1:1.0 failed with error -5 [ 573.493228][ T4338] cdc_wdm 2-1:1.0: skipping garbage [ 573.498498][ T4338] cdc_wdm 2-1:1.0: skipping garbage [ 573.527627][ T4338] cdc_wdm: probe of 2-1:1.0 failed with error -22 [ 573.613416][ T4338] usb 2-1: USB disconnect, device number 19 [ 573.872470][ T7617] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 573.884526][ T7617] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 573.892889][ T7617] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 573.900787][ T7617] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 573.908870][ T7617] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 573.917151][ T7617] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 574.302422][ T7623] sctp_transport_update_pmtu: 48 callbacks suppressed [ 574.302448][ T7623] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 574.321541][ T7623] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 574.335409][ T7623] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 574.377729][ T7623] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 574.394050][ T7623] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 574.406097][ T7623] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 574.417529][ T7623] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 574.429067][ T7623] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 574.440481][ T7623] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 574.453033][ T7623] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 574.548348][ T7617] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 576.639967][ T7639] FAULT_INJECTION: forcing a failure. [ 576.639967][ T7639] name failslab, interval 1, probability 0, space 0, times 0 [ 576.704032][ T7639] CPU: 1 PID: 7639 Comm: syz.1.778 Not tainted syzkaller #0 [ 576.711378][ T7639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 576.721456][ T7639] Call Trace: [ 576.724753][ T7639] [ 576.727728][ T7639] dump_stack_lvl+0x188/0x24e [ 576.732435][ T7639] ? show_regs_print_info+0x12/0x12 [ 576.737690][ T7639] ? load_image+0x410/0x410 [ 576.742217][ T7639] ? __lock_acquire+0x7ea0/0x7ea0 [ 576.747272][ T7639] should_fail_ex+0x390/0x4c0 [ 576.751979][ T7639] should_failslab+0x5/0x20 [ 576.756500][ T7639] slab_pre_alloc_hook+0x59/0x300 [ 576.761547][ T7639] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 576.767652][ T7639] kmem_cache_alloc_node+0x5a/0x310 [ 576.772879][ T7639] ? alloc_vmap_area+0x18e/0x18d0 [ 576.777943][ T7639] alloc_vmap_area+0x18e/0x18d0 [ 576.782836][ T7639] ? vm_map_ram+0xab0/0xab0 [ 576.787364][ T7639] ? rcu_is_watching+0x11/0xa0 [ 576.792269][ T7639] __get_vm_area_node+0x158/0x330 [ 576.797332][ T7639] __vmalloc_node_range+0x357/0x1380 [ 576.802648][ T7639] ? bpf_check+0x227/0x11060 [ 576.807315][ T7639] ? free_vm_area+0x50/0x50 [ 576.811842][ T7639] ? kvmalloc_node+0x6c/0x180 [ 576.816532][ T7639] ? kvmalloc_node+0x6c/0x180 [ 576.821220][ T7639] ? __kmalloc_node+0xe3/0x240 [ 576.826015][ T7639] ? bpf_check+0x227/0x11060 [ 576.830623][ T7639] vzalloc+0x75/0x80 [ 576.834541][ T7639] ? bpf_check+0x227/0x11060 [ 576.839149][ T7639] bpf_check+0x227/0x11060 [ 576.843593][ T7639] ? verify_lock_unused+0x140/0x140 [ 576.848834][ T7639] ? mark_lock+0x94/0x320 [ 576.853191][ T7639] ? mark_lock+0x94/0x320 [ 576.857563][ T7639] ? bpf_get_btf_vmlinux+0x60/0x60 [ 576.862691][ T7639] ? __lock_acquire+0x142d/0x7ea0 [ 576.867742][ T7639] ? mark_lock+0x94/0x320 [ 576.872190][ T7639] ? __lock_acquire+0x1359/0x7ea0 [ 576.877257][ T7639] ? mark_lock+0x94/0x320 [ 576.881607][ T7639] ? __lock_acquire+0x142d/0x7ea0 [ 576.886675][ T7639] ? verify_lock_unused+0x140/0x140 [ 576.891900][ T7639] ? verify_lock_unused+0x140/0x140 [ 576.897132][ T7639] ? verify_lock_unused+0x140/0x140 [ 576.902375][ T7639] ? pcpu_memcg_post_alloc_hook+0xe6/0x490 [ 576.908235][ T7639] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 576.914249][ T7639] ? __lock_acquire+0x7ea0/0x7ea0 [ 576.919302][ T7639] ? lock_chain_count+0x20/0x20 [ 576.924181][ T7639] ? seqcount_lockdep_reader_access+0x127/0x1d0 [ 576.930529][ T7639] ? lockdep_hardirqs_on+0x94/0x140 [ 576.935821][ T7639] ? ktime_get_with_offset+0xff/0x320 [ 576.941217][ T7639] ? seqcount_lockdep_reader_access+0x18d/0x1d0 [ 576.947488][ T7639] ? ktime_get_real_ts64+0x440/0x440 [ 576.952803][ T7639] ? do_raw_spin_unlock+0x11d/0x230 [ 576.958024][ T7639] ? __might_fault+0xc2/0x120 [ 576.962730][ T7639] ? memset+0x1e/0x40 [ 576.966741][ T7639] ? bpf_obj_name_cpy+0x190/0x1d0 [ 576.971865][ T7639] bpf_prog_load+0x100e/0x1530 [ 576.976671][ T7639] ? map_freeze+0x390/0x390 [ 576.981208][ T7639] ? __might_fault+0xa6/0x120 [ 576.985917][ T7639] ? __might_fault+0xa6/0x120 [ 576.990612][ T7639] ? __might_fault+0xc2/0x120 [ 576.995305][ T7639] ? __might_fault+0xa6/0x120 [ 577.000005][ T7639] ? bpf_lsm_bpf+0x5/0x10 [ 577.004440][ T7639] ? security_bpf+0x7a/0xa0 [ 577.009026][ T7639] __sys_bpf+0x5b8/0x780 [ 577.013300][ T7639] ? bpf_link_show_fdinfo+0x380/0x380 [ 577.018714][ T7639] ? lock_chain_count+0x20/0x20 [ 577.023607][ T7639] __x64_sys_bpf+0x78/0x90 [ 577.028043][ T7639] do_syscall_64+0x4c/0xa0 [ 577.032479][ T7639] ? clear_bhb_loop+0x60/0xb0 [ 577.037176][ T7639] ? clear_bhb_loop+0x60/0xb0 [ 577.041876][ T7639] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 577.047793][ T7639] RIP: 0033:0x7f37c179f559 [ 577.052225][ T7639] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 577.071858][ T7639] RSP: 002b:00007f37c2726028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 577.080302][ T7639] RAX: ffffffffffffffda RBX: 00007f37c1a25fa0 RCX: 00007f37c179f559 [ 577.088296][ T7639] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 577.096289][ T7639] RBP: 00007f37c1836b20 R08: 0000000000000000 R09: 0000000000000000 [ 577.104284][ T7639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 577.112278][ T7639] R13: 00007f37c1a26038 R14: 00007f37c1a25fa0 R15: 00007ffdc99119a8 [ 577.120292][ T7639] [ 577.232447][ T7639] syz.1.778: vmalloc error: size 896, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 577.436439][ T7639] CPU: 0 PID: 7639 Comm: syz.1.778 Not tainted syzkaller #0 [ 577.443788][ T7639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 577.453877][ T7639] Call Trace: [ 577.457175][ T7639] [ 577.460119][ T7639] dump_stack_lvl+0x188/0x24e [ 577.464822][ T7639] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 577.471270][ T7639] ? show_regs_print_info+0x12/0x12 [ 577.476499][ T7639] ? load_image+0x410/0x410 [ 577.481042][ T7639] ? __rcu_read_unlock+0x78/0xd0 [ 577.486011][ T7639] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 577.492460][ T7639] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 577.498997][ T7639] warn_alloc+0x242/0x330 [ 577.503365][ T7639] ? slab_free_freelist_hook+0x133/0x1b0 [ 577.509025][ T7639] ? zone_watermark_ok_safe+0x270/0x270 [ 577.514607][ T7639] ? __get_vm_area_node+0x16d/0x330 [ 577.519833][ T7639] ? __get_vm_area_node+0x16d/0x330 [ 577.525096][ T7639] __vmalloc_node_range+0x37c/0x1380 [ 577.530424][ T7639] ? free_vm_area+0x50/0x50 [ 577.534951][ T7639] ? kvmalloc_node+0x6c/0x180 [ 577.539659][ T7639] ? kvmalloc_node+0x6c/0x180 [ 577.544343][ T7639] ? __kmalloc_node+0xe3/0x240 [ 577.549138][ T7639] ? bpf_check+0x227/0x11060 [ 577.553724][ T7639] vzalloc+0x75/0x80 [ 577.557638][ T7639] ? bpf_check+0x227/0x11060 [ 577.562246][ T7639] bpf_check+0x227/0x11060 [ 577.566661][ T7639] ? verify_lock_unused+0x140/0x140 [ 577.571871][ T7639] ? mark_lock+0x94/0x320 [ 577.576199][ T7639] ? mark_lock+0x94/0x320 [ 577.580539][ T7639] ? bpf_get_btf_vmlinux+0x60/0x60 [ 577.585642][ T7639] ? __lock_acquire+0x142d/0x7ea0 [ 577.590673][ T7639] ? mark_lock+0x94/0x320 [ 577.595007][ T7639] ? __lock_acquire+0x1359/0x7ea0 [ 577.600036][ T7639] ? mark_lock+0x94/0x320 [ 577.604367][ T7639] ? __lock_acquire+0x142d/0x7ea0 [ 577.609406][ T7639] ? verify_lock_unused+0x140/0x140 [ 577.614629][ T7639] ? verify_lock_unused+0x140/0x140 [ 577.619824][ T7639] ? verify_lock_unused+0x140/0x140 [ 577.625026][ T7639] ? pcpu_memcg_post_alloc_hook+0xe6/0x490 [ 577.630842][ T7639] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 577.636820][ T7639] ? __lock_acquire+0x7ea0/0x7ea0 [ 577.641874][ T7639] ? lock_chain_count+0x20/0x20 [ 577.646728][ T7639] ? seqcount_lockdep_reader_access+0x127/0x1d0 [ 577.652968][ T7639] ? lockdep_hardirqs_on+0x94/0x140 [ 577.658163][ T7639] ? ktime_get_with_offset+0xff/0x320 [ 577.663531][ T7639] ? seqcount_lockdep_reader_access+0x18d/0x1d0 [ 577.669821][ T7639] ? ktime_get_real_ts64+0x440/0x440 [ 577.675118][ T7639] ? do_raw_spin_unlock+0x11d/0x230 [ 577.680318][ T7639] ? __might_fault+0xc2/0x120 [ 577.684999][ T7639] ? memset+0x1e/0x40 [ 577.688977][ T7639] ? bpf_obj_name_cpy+0x190/0x1d0 [ 577.694000][ T7639] bpf_prog_load+0x100e/0x1530 [ 577.698771][ T7639] ? map_freeze+0x390/0x390 [ 577.703271][ T7639] ? __might_fault+0xa6/0x120 [ 577.707954][ T7639] ? __might_fault+0xa6/0x120 [ 577.712624][ T7639] ? __might_fault+0xc2/0x120 [ 577.717298][ T7639] ? __might_fault+0xa6/0x120 [ 577.721971][ T7639] ? bpf_lsm_bpf+0x5/0x10 [ 577.726297][ T7639] ? security_bpf+0x7a/0xa0 [ 577.730821][ T7639] __sys_bpf+0x5b8/0x780 [ 577.735064][ T7639] ? bpf_link_show_fdinfo+0x380/0x380 [ 577.740446][ T7639] ? lock_chain_count+0x20/0x20 [ 577.745299][ T7639] __x64_sys_bpf+0x78/0x90 [ 577.749758][ T7639] do_syscall_64+0x4c/0xa0 [ 577.754171][ T7639] ? clear_bhb_loop+0x60/0xb0 [ 577.758849][ T7639] ? clear_bhb_loop+0x60/0xb0 [ 577.763523][ T7639] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 577.769413][ T7639] RIP: 0033:0x7f37c179f559 [ 577.773844][ T7639] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 577.793463][ T7639] RSP: 002b:00007f37c2726028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 577.801870][ T7639] RAX: ffffffffffffffda RBX: 00007f37c1a25fa0 RCX: 00007f37c179f559 [ 577.809862][ T7639] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 577.817829][ T7639] RBP: 00007f37c1836b20 R08: 0000000000000000 R09: 0000000000000000 [ 577.825795][ T7639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 577.833758][ T7639] R13: 00007f37c1a26038 R14: 00007f37c1a25fa0 R15: 00007ffdc99119a8 [ 577.841737][ T7639] [ 578.141852][ T7639] Mem-Info: [ 578.149836][ T7639] active_anon:41360 inactive_anon:22224 isolated_anon:0 [ 578.149836][ T7639] active_file:22987 inactive_file:40177 isolated_file:0 [ 578.149836][ T7639] unevictable:768 dirty:99 writeback:0 [ 578.149836][ T7639] slab_reclaimable:22274 slab_unreclaimable:95566 [ 578.149836][ T7639] mapped:47644 shmem:58975 pagetables:708 [ 578.149836][ T7639] sec_pagetables:0 bounce:0 [ 578.149836][ T7639] kernel_misc_reclaimable:0 [ 578.149836][ T7639] free:1249943 free_pcp:8422 free_cma:0 [ 578.219905][ T7639] Node 0 active_anon:165440kB inactive_anon:87796kB active_file:91892kB inactive_file:160508kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:190520kB dirty:396kB writeback:0kB shmem:233264kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:10592kB pagetables:2832kB sec_pagetables:0kB all_unreclaimable? no [ 578.381571][ T7639] Node 1 active_anon:0kB inactive_anon:0kB active_file:56kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 579.735763][ T7639] Node 0 DMA free:15232kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:112kB local_pcp:96kB free_cma:0kB [ 579.852626][ T7639] lowmem_reserve[]: 0 2511 2513 2513 2513 [ 579.858455][ T7639] Node 0 DMA32 free:1043420kB boost:0kB min:34556kB low:43192kB high:51828kB reserved_highatomic:0KB active_anon:205540kB inactive_anon:65776kB active_file:91892kB inactive_file:160508kB unevictable:1536kB writepending:416kB present:3129332kB managed:2576776kB mlocked:0kB bounce:0kB free_pcp:42296kB local_pcp:21032kB free_cma:0kB [ 579.993973][ T7639] lowmem_reserve[]: 0 0 1 1 1 [ 580.021573][ T7639] Node 0 Normal free:24kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:1680kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 580.222728][ T7] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 580.455171][ T7] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 580.526481][ T7639] lowmem_reserve[]: 0 0 0 0 0 [ 580.576074][ T7] usb 3-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 580.681641][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.725769][ T7639] Node 1 Normal free:3893252kB boost:0kB min:55324kB low:69152kB high:82980kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:56kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:24064kB local_pcp:14752kB free_cma:0kB [ 580.817142][ T7] usb 3-1: Product: syz [ 580.863903][ T7] usb 3-1: Manufacturer: syz [ 580.915058][ T7] usb 3-1: SerialNumber: syz [ 581.038258][ T7] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 581.588462][ T7639] lowmem_reserve[]: 0 0 0 0 0 [ 581.633032][ T7] gspca_mr97310a: reg write [21] error -110 [ 581.640922][ T7] mr97310a: probe of 3-1:1.0 failed with error -110 [ 581.738869][ T7639] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15232kB [ 582.137816][ T7639] Node 0 DMA32: 11941*4kB (UME) 831*8kB (UME) 586*16kB (UME) 1228*32kB (UME) 483*64kB (UME) 101*128kB (UM) 67*256kB (UM) 15*512kB (UME) 16*1024kB (UM) 4*2048kB (ME) 223*4096kB (UM) = 1109740kB [ 582.584767][ T7639] Node 0 Normal: 2*4kB (U) 2*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 24kB [ 583.778363][ T7639] Node 1 Normal: 243*4kB (UME) 49*8kB (UME) 31*16kB (UME) 70*32kB (UME) 28*64kB (UE) 14*128kB (UM) 2*256kB (UM) 2*512kB (UM) 1*1024kB (E) 2*2048kB (UE) 947*4096kB (M) = 3893252kB [ 583.802941][ T7639] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 583.928969][ T7639] Node 0 hugepages_total=4 hugepages_free=0 hugepages_surp=4 hugepages_size=2048kB [ 583.993666][ T7639] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 584.125256][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 584.136926][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 584.145013][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 584.153805][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 584.162041][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 584.170143][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 584.206270][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 585.254498][ T7639] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 585.300060][ T7639] 101212 total pagecache pages [ 585.386789][ T7639] 0 pages in swap cache [ 585.391857][ T7639] Free swap = 124448kB [ 585.526225][ T7639] Total swap = 124996kB [ 585.530508][ T7639] 2097051 pages RAM [ 585.534937][ T7639] 0 pages HighMem/MovableOnly [ 585.539809][ T7639] 419192 pages reserved [ 585.544152][ T7639] 0 pages cma reserved [ 586.795761][ T7223] syz.2.685 (7223) used greatest stack depth: 18544 bytes left [ 586.927406][ T4338] usb 3-1: USB disconnect, device number 21 [ 591.835032][ T7732] syz.2.796 (7732) used greatest stack depth: 17776 bytes left [ 592.959990][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 592.971742][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 592.979948][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 592.988562][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 592.996958][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 593.005192][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 593.048660][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 593.117810][ T7750] sctp_transport_update_pmtu: 49 callbacks suppressed [ 593.117862][ T7750] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 593.139437][ T7750] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 593.153845][ T7750] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 593.198516][ T7750] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 593.214851][ T7750] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 593.226446][ T7750] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 593.237970][ T7750] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 593.253128][ T7750] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 593.264855][ T7750] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 593.280300][ T7750] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 593.438474][ T7753] comedi comedi3: bad chanlist[0]=0x00000002 chan=2 range length=1 [ 596.086610][ T7716] Process accounting resumed [ 597.062663][ T6691] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 597.260186][ T6691] usb 4-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 597.279611][ T6691] usb 4-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 597.299703][ T6691] usb 4-1: Product: syz [ 597.330017][ T6691] usb 4-1: Manufacturer: syz [ 597.338469][ T6691] usb 4-1: SerialNumber: syz [ 597.380473][ T6691] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 597.782890][ T6691] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 597.802670][ T6691] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 600.864859][ T7814] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 600.879284][ T7814] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 600.887432][ T7814] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 600.895449][ T7814] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 600.903606][ T7814] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 600.911571][ T7814] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 600.949516][ T7814] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 602.205364][ T126] usb 4-1: USB disconnect, device number 15 [ 603.902718][ T6691] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 604.102656][ T6691] usb 4-1: Using ep0 maxpacket: 32 [ 604.109626][ T6691] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 604.230854][ T6691] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 604.324105][ T6691] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 604.372047][ T6691] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.406748][ T6691] usb 4-1: Product: syz [ 604.424823][ T6691] usb 4-1: Manufacturer: syz [ 604.434946][ T6691] usb 4-1: SerialNumber: syz [ 604.465566][ T6691] usb 4-1: config 0 descriptor?? [ 605.984056][ T6691] usb 4-1: USB disconnect, device number 16 [ 608.697188][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 608.708108][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 608.716129][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 608.724108][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 608.732144][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 608.740193][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 608.775039][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 617.486789][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 617.498103][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 617.506179][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 617.514105][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 617.522179][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 617.530339][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 617.570811][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 624.871478][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.877890][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 626.185997][ T8004] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 626.194455][ T8004] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 626.201789][ T8004] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 626.209106][ T8004] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 626.216620][ T8004] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 626.224119][ T8004] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 626.231588][ T8004] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 626.314076][ T8004] sctp_transport_update_pmtu: 48 callbacks suppressed [ 626.314087][ T8004] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 626.331286][ T8004] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 626.341666][ T8004] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 626.352166][ T8004] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 626.377301][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 626.387461][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 626.397591][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 626.407701][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 626.417812][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 626.427922][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 628.577609][ T8016] Process accounting paused [ 632.813826][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 632.826382][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 632.834458][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 632.843277][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 632.851607][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 632.860435][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 632.874417][ T8049] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 632.940785][ T8049] sctp_transport_update_pmtu: 55 callbacks suppressed [ 632.940840][ T8049] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 632.959269][ T8049] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 632.972408][ T8049] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 632.988550][ T8049] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 633.107072][ T8049] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 633.156774][ T8049] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 633.176318][ T8049] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 633.196398][ T8049] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 633.228652][ T8049] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 633.243256][ T8049] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 637.752658][ T126] usb 1-1: new full-speed USB device number 22 using dummy_hcd [ 637.944888][ T126] usb 1-1: unable to get BOS descriptor or descriptor too short [ 637.961753][ T126] usb 1-1: not running at top speed; connect to a high speed hub [ 637.991477][ T126] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 638.052428][ T126] usb 1-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 638.072131][ T126] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.100242][ T126] usb 1-1: Product: syz [ 638.112602][ T126] usb 1-1: Manufacturer: syz [ 638.120517][ T126] usb 1-1: SerialNumber: syz [ 638.155949][ T126] usb 1-1: config 0 descriptor?? [ 638.171802][ T8081] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 638.181451][ T8081] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 638.193371][ C0] usb 1-1: NFC: Urb failure (status -71) [ 638.199312][ C0] usb 1-1: NFC: Urb failure (status -71) [ 638.207604][ T126] usb 1-1: NFC: Unable to get FW version [ 638.213587][ T126] pn533_usb: probe of 1-1:0.0 failed with error -71 [ 638.450638][ T8081] FAULT_INJECTION: forcing a failure. [ 638.450638][ T8081] name failslab, interval 1, probability 0, space 0, times 0 [ 638.463362][ T8081] CPU: 0 PID: 8081 Comm: syz.0.885 Not tainted syzkaller #0 [ 638.471073][ T8081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 638.481147][ T8081] Call Trace: [ 638.484420][ T8081] [ 638.487450][ T8081] dump_stack_lvl+0x188/0x24e [ 638.492123][ T8081] ? show_regs_print_info+0x12/0x12 [ 638.497312][ T8081] ? load_image+0x410/0x410 [ 638.501803][ T8081] ? __might_sleep+0xd0/0xd0 [ 638.506392][ T8081] ? __lock_acquire+0x7ea0/0x7ea0 [ 638.511411][ T8081] should_fail_ex+0x390/0x4c0 [ 638.516172][ T8081] should_failslab+0x5/0x20 [ 638.520685][ T8081] slab_pre_alloc_hook+0x59/0x300 [ 638.525878][ T8081] ? security_prepare_creds+0x47/0x130 [ 638.532414][ T8081] __kmem_cache_alloc_node+0x4f/0x270 [ 638.537790][ T8081] ? security_prepare_creds+0x47/0x130 [ 638.543264][ T8081] __kmalloc+0xa3/0x240 [ 638.547421][ T8081] security_prepare_creds+0x47/0x130 [ 638.552802][ T8081] prepare_creds+0x450/0x610 [ 638.557490][ T8081] set_current_groups+0x18/0x160 [ 638.562611][ T8081] __se_sys_setgroups+0x34b/0x410 [ 638.567635][ T8081] do_syscall_64+0x4c/0xa0 [ 638.572043][ T8081] ? clear_bhb_loop+0x60/0xb0 [ 638.576832][ T8081] ? clear_bhb_loop+0x60/0xb0 [ 638.581499][ T8081] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 638.587388][ T8081] RIP: 0033:0x7f8c7dd9f559 [ 638.591789][ T8081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 638.611406][ T8081] RSP: 002b:00007f8c7ec01028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 638.619853][ T8081] RAX: ffffffffffffffda RBX: 00007f8c7e025fa0 RCX: 00007f8c7dd9f559 [ 638.627820][ T8081] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 638.635779][ T8081] RBP: 00007f8c7de36b20 R08: 0000000000000000 R09: 0000000000000000 [ 638.643764][ T8081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 638.651733][ T8081] R13: 00007f8c7e026038 R14: 00007f8c7e025fa0 R15: 00007ffceae5c948 [ 638.659716][ T8081] [ 638.675434][ T126] usb 1-1: USB disconnect, device number 22 [ 639.212565][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 639.240098][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 639.283112][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 639.303524][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 639.336876][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 639.647063][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 640.282925][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 640.845798][ T7] libceph: connect (1)[c::]:6789 error -101 [ 640.895178][ T7] libceph: mon0 (1)[c::]:6789 connect error [ 641.405355][ T7] libceph: connect (1)[c::]:6789 error -101 [ 641.820929][ T7] libceph: mon0 (1)[c::]:6789 connect error [ 642.964400][ T4338] libceph: connect (1)[c::]:6789 error -101 [ 642.970409][ T4338] libceph: mon0 (1)[c::]:6789 connect error [ 642.982700][ T8125] ceph: No mds server is up or the cluster is laggy [ 644.805117][ T4338] libceph: connect (1)[c::]:6789 error -101 [ 644.836519][ T4338] libceph: mon0 (1)[c::]:6789 connect error [ 644.896234][ T4338] libceph: connect (1)[c::]:6789 error -101 [ 644.932719][ T4338] libceph: mon0 (1)[c::]:6789 connect error [ 645.262696][ T4338] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 645.422745][ T126] usb 2-1: new full-speed USB device number 20 using dummy_hcd [ 645.534151][ T4338] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 645.595119][ T4338] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 646.328076][ T4338] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 646.390109][ T126] usb 2-1: unable to get BOS descriptor or descriptor too short [ 646.461744][ T126] usb 2-1: not running at top speed; connect to a high speed hub [ 646.523459][ T8151] netlink: 12 bytes leftover after parsing attributes in process `syz.3.904'. [ 646.635239][ T4338] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 646.799343][ T126] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 646.919222][ T4338] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 646.951551][ T4338] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 646.965984][ T126] usb 2-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 646.976103][ T4338] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 646.988862][ T126] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.997772][ T4338] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 647.009525][ T126] usb 2-1: Product: syz [ 647.015028][ T126] usb 2-1: Manufacturer: syz [ 647.019741][ T4338] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 647.033879][ T126] usb 2-1: SerialNumber: syz [ 647.044362][ T4338] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 647.054880][ T126] usb 2-1: config 0 descriptor?? [ 647.064392][ T8148] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 647.071625][ T4338] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 647.089191][ T8148] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 647.098295][ T4338] usb 1-1: config 1 interface 0 altsetting 0 has 9 endpoint descriptors, different from the interface descriptor's value: 14 [ 647.140170][ C0] usb 2-1: NFC: Urb failure (status -71) [ 647.146183][ C0] usb 2-1: NFC: Urb failure (status -71) [ 647.153374][ T126] usb 2-1: NFC: Unable to get FW version [ 647.164225][ T4338] usb 1-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 647.181905][ T126] pn533_usb: probe of 2-1:0.0 failed with error -71 [ 647.201178][ T4338] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 647.220464][ T4338] usb 1-1: Product: syz [ 647.224958][ T4338] usb 1-1: Manufacturer: syz [ 647.229733][ T4338] usb 1-1: SerialNumber: syz [ 647.249357][ T8146] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 647.278913][ T8146] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 647.303701][ T8146] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 647.311108][ T8146] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 647.324999][ T8146] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 647.332296][ T8146] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 647.344609][ T8146] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 647.352946][ T8160] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 647.364656][ T8146] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 647.382325][ T8160] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 647.393713][ T4338] keyspan 1-1:1.0: Keyspan 2 port adapter converter detected [ 647.401450][ T8160] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 647.417936][ T4338] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 7 [ 647.420249][ T8148] FAULT_INJECTION: forcing a failure. [ 647.420249][ T8148] name failslab, interval 1, probability 0, space 0, times 0 [ 647.438415][ T8148] CPU: 1 PID: 8148 Comm: syz.1.903 Not tainted syzkaller #0 [ 647.445700][ T8148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 647.455755][ T8148] Call Trace: [ 647.459030][ T8148] [ 647.461955][ T8148] dump_stack_lvl+0x188/0x24e [ 647.466644][ T8148] ? show_regs_print_info+0x12/0x12 [ 647.471851][ T8148] ? load_image+0x410/0x410 [ 647.476350][ T8148] ? __might_sleep+0xd0/0xd0 [ 647.481023][ T8148] ? __lock_acquire+0x7ea0/0x7ea0 [ 647.486058][ T8148] should_fail_ex+0x390/0x4c0 [ 647.490745][ T8148] should_failslab+0x5/0x20 [ 647.495256][ T8148] slab_pre_alloc_hook+0x59/0x300 [ 647.500280][ T8148] ? security_prepare_creds+0x47/0x130 [ 647.505739][ T8148] __kmem_cache_alloc_node+0x4f/0x270 [ 647.511119][ T8148] ? security_prepare_creds+0x47/0x130 [ 647.516573][ T8148] __kmalloc+0xa3/0x240 [ 647.520730][ T8148] security_prepare_creds+0x47/0x130 [ 647.526016][ T8148] prepare_creds+0x450/0x610 [ 647.530608][ T8148] set_current_groups+0x18/0x160 [ 647.535553][ T8148] __se_sys_setgroups+0x34b/0x410 [ 647.540583][ T8148] do_syscall_64+0x4c/0xa0 [ 647.544997][ T8148] ? clear_bhb_loop+0x60/0xb0 [ 647.549667][ T8148] ? clear_bhb_loop+0x60/0xb0 [ 647.554345][ T8148] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 647.560232][ T8148] RIP: 0033:0x7f37c179f559 [ 647.564644][ T8148] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 647.584251][ T8148] RSP: 002b:00007f37c2726028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 647.592678][ T8148] RAX: ffffffffffffffda RBX: 00007f37c1a25fa0 RCX: 00007f37c179f559 [ 647.600642][ T8148] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 647.608693][ T8148] RBP: 00007f37c1836b20 R08: 0000000000000000 R09: 0000000000000000 [ 647.616659][ T8148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 647.624990][ T8148] R13: 00007f37c1a26038 R14: 00007f37c1a25fa0 R15: 00007ffdc99119a8 [ 647.632983][ T8148] [ 647.636856][ T8160] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 647.669888][ T8160] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 647.686320][ T8160] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 647.707174][ T4338] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 5 [ 647.732473][ T6691] usb 2-1: USB disconnect, device number 20 [ 647.768934][ T8160] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 647.805219][ T4338] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 647.846461][ T4338] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 3 [ 647.882967][ T4338] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 4 [ 647.926396][ T4338] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 6 [ 647.975381][ T4338] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 648.060281][ T4338] usb 1-1: USB disconnect, device number 23 [ 648.117295][ T4338] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 648.185324][ T4338] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 649.351996][ T4338] keyspan 1-1:1.0: device disconnected [ 654.127592][ T8197] sctp_transport_update_pmtu: 48 callbacks suppressed [ 654.127622][ T8197] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 654.145667][ T8197] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 654.156632][ T8197] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 654.167570][ T8197] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 654.210413][ T8197] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 654.222039][ T8197] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 654.233574][ T8197] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 654.244885][ T8197] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 654.256069][ T8197] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 654.267276][ T8197] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 656.234014][ T8211] netlink: 12 bytes leftover after parsing attributes in process `syz.0.919'. [ 660.365919][ T8234] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input28 [ 661.822761][ T6691] usb 2-1: new full-speed USB device number 21 using dummy_hcd [ 662.725288][ T6691] usb 2-1: unable to get BOS descriptor or descriptor too short [ 662.783619][ T6691] usb 2-1: not running at top speed; connect to a high speed hub [ 662.802737][ T6691] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 662.845664][ T6691] usb 2-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 662.875576][ T6691] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.897622][ T6691] usb 2-1: Product: syz [ 662.901836][ T6691] usb 2-1: Manufacturer: syz [ 662.916939][ T6691] usb 2-1: SerialNumber: syz [ 662.963264][ T6691] usb 2-1: config 0 descriptor?? [ 662.983329][ T8258] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 662.990783][ T8258] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 663.046130][ C1] usb 2-1: NFC: Urb failure (status -71) [ 663.052138][ C1] usb 2-1: NFC: Urb failure (status -71) [ 663.060665][ T6691] usb 2-1: NFC: Unable to get FW version [ 663.069029][ T6691] pn533_usb: probe of 2-1:0.0 failed with error -71 [ 663.306443][ T8258] FAULT_INJECTION: forcing a failure. [ 663.306443][ T8258] name failslab, interval 1, probability 0, space 0, times 0 [ 663.319361][ T8258] CPU: 1 PID: 8258 Comm: syz.1.924 Not tainted syzkaller #0 [ 663.326669][ T8258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 663.336752][ T8258] Call Trace: [ 663.340054][ T8258] [ 663.343030][ T8258] dump_stack_lvl+0x188/0x24e [ 663.347732][ T8258] ? show_regs_print_info+0x12/0x12 [ 663.352956][ T8258] ? load_image+0x410/0x410 [ 663.357488][ T8258] ? __might_sleep+0xd0/0xd0 [ 663.362097][ T8258] ? __lock_acquire+0x7ea0/0x7ea0 [ 663.367153][ T8258] should_fail_ex+0x390/0x4c0 [ 663.371868][ T8258] should_failslab+0x5/0x20 [ 663.376384][ T8258] slab_pre_alloc_hook+0x59/0x300 [ 663.381429][ T8258] ? security_prepare_creds+0x47/0x130 [ 663.386927][ T8258] __kmem_cache_alloc_node+0x4f/0x270 [ 663.392318][ T8258] ? security_prepare_creds+0x47/0x130 [ 663.397792][ T8258] __kmalloc+0xa3/0x240 [ 663.401960][ T8258] security_prepare_creds+0x47/0x130 [ 663.407280][ T8258] prepare_creds+0x450/0x610 [ 663.411888][ T8258] set_current_groups+0x18/0x160 [ 663.416852][ T8258] __se_sys_setgroups+0x34b/0x410 [ 663.421906][ T8258] do_syscall_64+0x4c/0xa0 [ 663.426344][ T8258] ? clear_bhb_loop+0x60/0xb0 [ 663.431037][ T8258] ? clear_bhb_loop+0x60/0xb0 [ 663.435734][ T8258] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 663.441645][ T8258] RIP: 0033:0x7f37c179f559 [ 663.446076][ T8258] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 663.465703][ T8258] RSP: 002b:00007f37c2726028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 663.474147][ T8258] RAX: ffffffffffffffda RBX: 00007f37c1a25fa0 RCX: 00007f37c179f559 [ 663.482136][ T8258] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 663.490155][ T8258] RBP: 00007f37c1836b20 R08: 0000000000000000 R09: 0000000000000000 [ 663.498185][ T8258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 663.506177][ T8258] R13: 00007f37c1a26038 R14: 00007f37c1a25fa0 R15: 00007ffdc99119a8 [ 663.514183][ T8258] [ 663.534022][ T4338] usb 2-1: USB disconnect, device number 21 [ 664.047771][ T8258] Process accounting resumed [ 665.078242][ T8277] netlink: 12 bytes leftover after parsing attributes in process `syz.2.937'. [ 674.290935][ T8359] sctp_transport_update_pmtu: 48 callbacks suppressed [ 674.290963][ T8359] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 674.309005][ T8359] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 674.320026][ T8359] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 674.331125][ T8359] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 674.371826][ T8359] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 674.383071][ T8359] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 674.394635][ T8359] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 674.405750][ T8359] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 674.416948][ T8359] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 674.428154][ T8359] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 676.442024][ T8374] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 676.486071][ T8374] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 676.500473][ T8374] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 676.515456][ T8374] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 676.529433][ T8374] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 676.545694][ T8374] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 676.559314][ T8374] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 676.620949][ T8374] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 676.680796][ T8374] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 676.695245][ T8374] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 683.212693][ T4828] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 683.415954][ T4828] usb 2-1: unable to get BOS descriptor or descriptor too short [ 683.448255][ T4828] usb 2-1: not running at top speed; connect to a high speed hub [ 683.488275][ T4828] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 683.546045][ T4828] usb 2-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 683.589533][ T4828] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 683.649835][ T4828] usb 2-1: Product: syz [ 683.680201][ T4828] usb 2-1: Manufacturer: syz [ 684.665934][ T8416] sctp_transport_update_pmtu: 48 callbacks suppressed [ 684.666005][ T8416] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 684.685527][ T8416] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 684.701046][ T8416] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 684.713013][ T8416] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 684.786600][ T8416] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 684.797016][ T8416] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 684.840569][ T8416] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 684.851275][ T8416] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 684.861812][ T8416] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 684.872152][ T8416] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 685.018939][ T4828] usb 2-1: SerialNumber: syz [ 685.046720][ T4828] usb 2-1: config 0 descriptor?? [ 685.052716][ T8402] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 685.060109][ T8402] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 685.069390][ C0] usb 2-1: NFC: Urb failure (status -71) [ 685.075486][ C0] usb 2-1: NFC: Urb failure (status -71) [ 685.132421][ T4828] usb 2-1: NFC: Unable to get FW version [ 685.164172][ T4828] pn533_usb: probe of 2-1:0.0 failed with error -71 [ 685.332335][ T8402] FAULT_INJECTION: forcing a failure. [ 685.332335][ T8402] name failslab, interval 1, probability 0, space 0, times 0 [ 685.345091][ T8402] CPU: 0 PID: 8402 Comm: syz.1.966 Not tainted syzkaller #0 [ 685.352567][ T8402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 685.362638][ T8402] Call Trace: [ 685.365939][ T8402] [ 685.368876][ T8402] dump_stack_lvl+0x188/0x24e [ 685.373559][ T8402] ? show_regs_print_info+0x12/0x12 [ 685.378758][ T8402] ? load_image+0x410/0x410 [ 685.383249][ T8402] ? __might_sleep+0xd0/0xd0 [ 685.387838][ T8402] ? __lock_acquire+0x7ea0/0x7ea0 [ 685.392869][ T8402] should_fail_ex+0x390/0x4c0 [ 685.397558][ T8402] should_failslab+0x5/0x20 [ 685.402043][ T8402] slab_pre_alloc_hook+0x59/0x300 [ 685.407059][ T8402] ? security_prepare_creds+0x47/0x130 [ 685.412516][ T8402] __kmem_cache_alloc_node+0x4f/0x270 [ 685.417914][ T8402] ? security_prepare_creds+0x47/0x130 [ 685.423396][ T8402] __kmalloc+0xa3/0x240 [ 685.427555][ T8402] security_prepare_creds+0x47/0x130 [ 685.432838][ T8402] prepare_creds+0x450/0x610 [ 685.437453][ T8402] set_current_groups+0x18/0x160 [ 685.442397][ T8402] __se_sys_setgroups+0x34b/0x410 [ 685.447436][ T8402] do_syscall_64+0x4c/0xa0 [ 685.451863][ T8402] ? clear_bhb_loop+0x60/0xb0 [ 685.456552][ T8402] ? clear_bhb_loop+0x60/0xb0 [ 685.461247][ T8402] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 685.467135][ T8402] RIP: 0033:0x7f37c179f559 [ 685.471544][ T8402] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 685.491150][ T8402] RSP: 002b:00007f37c2726028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 685.499582][ T8402] RAX: ffffffffffffffda RBX: 00007f37c1a25fa0 RCX: 00007f37c179f559 [ 685.507552][ T8402] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 685.515517][ T8402] RBP: 00007f37c1836b20 R08: 0000000000000000 R09: 0000000000000000 [ 685.523494][ T8402] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 685.531456][ T8402] R13: 00007f37c1a26038 R14: 00007f37c1a25fa0 R15: 00007ffdc99119a8 [ 685.539459][ T8402] [ 685.542476][ C0] vkms_vblank_simulate: vblank timer overrun [ 685.578891][ T4401] usb 2-1: USB disconnect, device number 22 [ 685.658940][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.380554][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 689.928313][ T8456] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 689.938655][ T8456] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 689.951465][ T8456] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 689.969095][ T8456] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 689.982178][ T8456] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 689.990838][ T8456] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 690.202220][ T8454] rxe_eth0 speed is unknown, defaulting to 1000 [ 691.311935][ T4354] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.594157][ T4354] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.722544][ C0] sched: RT throttling activated [ 692.742580][ T8456] Bluetooth: hci5: command 0x0409 tx timeout [ 693.407078][ T4354] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 694.195131][ T8483] Process accounting paused [ 694.260366][ T4354] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 694.403078][ T8493] sctp_transport_update_pmtu: 48 callbacks suppressed [ 694.403091][ T8493] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 694.456955][ T8493] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 695.562911][ T8456] Bluetooth: hci5: command 0x041b tx timeout [ 695.586277][ T8493] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 695.762126][ T8493] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 695.823629][ T8493] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 695.893403][ T8493] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 695.917571][ T8493] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 695.966653][ T8493] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 696.010564][ T8493] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 696.076276][ T8454] chnl_net:caif_netlink_parms(): no params data found [ 696.114832][ T8493] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 697.573117][ T8456] Bluetooth: hci5: command 0x040f tx timeout [ 698.887088][ T8454] bridge0: port 1(bridge_slave_0) entered blocking state [ 698.919610][ T8454] bridge0: port 1(bridge_slave_0) entered disabled state [ 699.234333][ T8535] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input30 [ 699.673504][ T8456] Bluetooth: hci5: command 0x0419 tx timeout [ 699.695583][ T8454] device bridge_slave_0 entered promiscuous mode [ 699.891565][ T8454] bridge0: port 2(bridge_slave_1) entered blocking state [ 699.902769][ T8454] bridge0: port 2(bridge_slave_1) entered disabled state [ 699.911686][ T8454] device bridge_slave_1 entered promiscuous mode [ 700.053467][ T8454] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 700.120371][ T8454] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 700.270394][ T8454] team0: Port device team_slave_0 added [ 700.301607][ T8454] team0: Port device team_slave_1 added [ 700.477404][ T8454] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 700.493715][ T8454] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 700.559330][ T8454] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 700.757986][ T8454] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 700.768241][ T8454] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 701.877327][ T8454] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 702.103599][ T8454] device hsr_slave_0 entered promiscuous mode [ 702.123933][ T8454] device hsr_slave_1 entered promiscuous mode [ 702.167198][ T8454] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 702.199006][ T8454] Cannot create hsr debugfs directory [ 703.952825][ T126] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 704.142715][ T126] usb 2-1: Using ep0 maxpacket: 16 [ 704.153955][ T126] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 704.197004][ T126] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 704.251323][ T126] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 704.285569][ T126] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 704.306797][ T126] usb 2-1: SerialNumber: syz [ 704.345541][ T4354] device hsr_slave_0 left promiscuous mode [ 704.360028][ T126] usb 2-1: 0:2 : does not exist [ 704.385986][ T4354] device hsr_slave_1 left promiscuous mode [ 704.447620][ T4354] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 704.467723][ T4354] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 704.490754][ T4354] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 704.528780][ T4354] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 704.573503][ T4354] device bridge_slave_1 left promiscuous mode [ 704.581690][ T4354] bridge0: port 2(bridge_slave_1) entered disabled state [ 704.624578][ T4354] device bridge_slave_0 left promiscuous mode [ 704.630911][ T4354] bridge0: port 1(bridge_slave_0) entered disabled state [ 704.835252][ T4354] device veth1_macvtap left promiscuous mode [ 704.913970][ T4354] device veth0_macvtap left promiscuous mode [ 704.978003][ T4354] device veth1_vlan left promiscuous mode [ 705.005989][ T4354] device veth0_vlan left promiscuous mode [ 705.175046][ T8608] sctp_transport_update_pmtu: 48 callbacks suppressed [ 705.175101][ T8608] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 705.193271][ T8608] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 705.204519][ T8608] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 705.218506][ T8608] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 705.232467][ T8608] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 705.243797][ T8608] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 705.255228][ T8608] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 705.267716][ T8608] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 705.278851][ T8608] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 705.289983][ T8608] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 705.578423][ T126] usb 2-1: USB disconnect, device number 23 [ 710.262035][ T4354] team0 (unregistering): Port device team_slave_1 removed [ 710.338289][ T4354] team0 (unregistering): Port device team_slave_0 removed [ 710.405898][ T4354] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 710.482140][ T4354] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 710.844581][ T4354] bond0 (unregistering): Released all slaves [ 710.902151][ T8605] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 710.911643][ T8605] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 710.923837][ T8605] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 710.931227][ T8605] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 710.948709][ T8605] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 710.956946][ T8605] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 710.967528][ T8605] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 710.982705][ T8620] smc: net device team0 applied user defined pnetid SYZ2 [ 712.926072][ T8508] udevd[8508]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 712.933333][ T8454] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 712.998921][ T8454] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 713.031244][ T8454] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 713.070899][ T8454] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 713.077891][ T7] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 713.242112][ T8454] 8021q: adding VLAN 0 to HW filter on device bond0 [ 713.276266][ T7] usb 2-1: Using ep0 maxpacket: 16 [ 713.284852][ T7] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 713.311917][ T8454] 8021q: adding VLAN 0 to HW filter on device team0 [ 713.329925][ T7] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 713.340089][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 713.349412][ T7] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 713.359065][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 713.361676][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 713.367737][ T7] usb 2-1: SerialNumber: syz [ 713.397668][ T7] usb 2-1: 0:2 : does not exist [ 714.044127][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 714.055475][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 714.065491][ T4368] bridge0: port 1(bridge_slave_0) entered blocking state [ 714.072655][ T4368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 714.080705][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 714.093248][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 714.132479][ T4368] bridge0: port 2(bridge_slave_1) entered blocking state [ 714.139690][ T4368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 714.167088][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 714.198463][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 714.232344][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 714.410613][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 714.550122][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 714.562031][ T8675] sctp_transport_update_pmtu: 48 callbacks suppressed [ 714.562131][ T8675] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 714.580668][ T8675] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 714.592248][ T8675] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 714.604049][ T8675] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 714.621424][ T8675] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 714.633030][ T8675] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 714.646048][ T8675] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 714.657240][ T8675] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 714.669179][ T8675] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 714.680515][ T8675] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 714.964667][ T8674] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 714.977120][ T8674] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 714.985308][ T8674] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 714.993486][ T8674] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 715.001709][ T8674] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 715.010557][ T8674] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 715.018966][ T8674] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 715.051185][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 715.123530][ T7] usb 2-1: USB disconnect, device number 24 [ 715.145997][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 715.175278][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 715.190268][ T8454] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 715.282663][ T8454] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 715.343842][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 715.463171][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 715.501486][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 715.532014][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 715.570815][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 717.183285][ T8706] hub 5-0:1.0: USB hub found [ 717.192704][ T8706] hub 5-0:1.0: 1 port detected [ 719.313916][ T4338] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 719.504649][ T4338] usb 2-1: unable to get BOS descriptor or descriptor too short [ 719.523194][ T4338] usb 2-1: not running at top speed; connect to a high speed hub [ 719.543311][ T4338] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 719.568564][ T4338] usb 2-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 719.592817][ T4338] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 719.611115][ T4338] usb 2-1: Product: syz [ 719.621222][ T4338] usb 2-1: Manufacturer: syz [ 719.631358][ T4338] usb 2-1: SerialNumber: syz [ 719.652309][ T4338] usb 2-1: config 0 descriptor?? [ 719.732724][ T8712] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 719.739994][ T8712] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 719.791076][ C0] usb 2-1: NFC: Urb failure (status -71) [ 719.797804][ C0] usb 2-1: NFC: Urb failure (status -71) [ 719.806390][ T4338] usb 2-1: NFC: Unable to get FW version [ 719.812284][ T4338] pn533_usb: probe of 2-1:0.0 failed with error -71 [ 719.888258][ T4580] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 719.903951][ T4580] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 719.947641][ T8454] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 719.994750][ T8712] FAULT_INJECTION: forcing a failure. [ 719.994750][ T8712] name failslab, interval 1, probability 0, space 0, times 0 [ 720.008183][ T8712] CPU: 1 PID: 8712 Comm: syz.1.1033 Not tainted syzkaller #0 [ 720.015589][ T8712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 720.025758][ T8712] Call Trace: [ 720.029052][ T8712] [ 720.031994][ T8712] dump_stack_lvl+0x188/0x24e [ 720.036710][ T8712] ? show_regs_print_info+0x12/0x12 [ 720.041937][ T8712] ? load_image+0x410/0x410 [ 720.046468][ T8712] ? __might_sleep+0xd0/0xd0 [ 720.051086][ T8712] ? __lock_acquire+0x7ea0/0x7ea0 [ 720.056161][ T8712] should_fail_ex+0x390/0x4c0 [ 720.060873][ T8712] should_failslab+0x5/0x20 [ 720.065402][ T8712] slab_pre_alloc_hook+0x59/0x300 [ 720.070460][ T8712] ? security_prepare_creds+0x47/0x130 [ 720.076041][ T8712] __kmem_cache_alloc_node+0x4f/0x270 [ 720.081455][ T8712] ? security_prepare_creds+0x47/0x130 [ 720.086976][ T8712] __kmalloc+0xa3/0x240 [ 720.091163][ T8712] security_prepare_creds+0x47/0x130 [ 720.096491][ T8712] prepare_creds+0x450/0x610 [ 720.101116][ T8712] set_current_groups+0x18/0x160 [ 720.106097][ T8712] __se_sys_setgroups+0x34b/0x410 [ 720.111167][ T8712] do_syscall_64+0x4c/0xa0 [ 720.115618][ T8712] ? clear_bhb_loop+0x60/0xb0 [ 720.120320][ T8712] ? clear_bhb_loop+0x60/0xb0 [ 720.125030][ T8712] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 720.130952][ T8712] RIP: 0033:0x7f37c179f559 [ 720.135390][ T8712] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 720.155023][ T8712] RSP: 002b:00007f37c2726028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 720.163483][ T8712] RAX: ffffffffffffffda RBX: 00007f37c1a25fa0 RCX: 00007f37c179f559 [ 720.171487][ T8712] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 720.179479][ T8712] RBP: 00007f37c1836b20 R08: 0000000000000000 R09: 0000000000000000 [ 720.187473][ T8712] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 720.195437][ T8712] R13: 00007f37c1a26038 R14: 00007f37c1a25fa0 R15: 00007ffdc99119a8 [ 720.203420][ T8712] [ 720.219708][ T4338] usb 2-1: USB disconnect, device number 25 [ 723.762821][ T7] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 723.872237][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 723.893438][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 723.954317][ T7] usb 2-1: not running at top speed; connect to a high speed hub [ 723.962401][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 723.977117][ T7] usb 2-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 723.987585][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 724.029795][ T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.042691][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 724.063511][ T7] usb 2-1: Product: syz [ 724.067696][ T7] usb 2-1: Manufacturer: syz [ 724.072269][ T7] usb 2-1: SerialNumber: syz [ 724.085248][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 724.121357][ T8454] device veth0_vlan entered promiscuous mode [ 724.133609][ T8765] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 724.141796][ T8765] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 724.149582][ T8765] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 724.156892][ T8765] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 724.164644][ T8765] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 724.172101][ T8765] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 724.179671][ T8765] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 724.215348][ T8454] device veth1_vlan entered promiscuous mode [ 724.239928][ T7] keyspan 2-1:1.0: Keyspan 4 port adapter converter detected [ 724.251440][ T8768] sctp_transport_update_pmtu: 48 callbacks suppressed [ 724.251452][ T8768] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 724.266907][ T8454] device veth0_macvtap entered promiscuous mode [ 724.393303][ T8768] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 724.406860][ T7] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 724.434735][ T8454] device veth1_macvtap entered promiscuous mode [ 724.443342][ T7] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 724.452132][ T8768] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 724.510206][ T7885] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 724.516694][ T7] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 724.526139][ T8768] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 724.538565][ T7885] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 724.539540][ T7] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 724.633384][ T7885] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 724.682013][ T7885] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 724.705008][ T7885] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 724.729332][ T8768] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 724.748685][ T7885] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 724.761548][ T8454] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 724.779853][ T8454] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 724.807919][ T8768] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 724.818239][ T8454] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 724.844080][ T8454] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 724.854817][ T8768] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 724.874916][ T8768] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 724.892247][ T8454] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 724.915011][ T8768] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 724.931658][ T8454] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 724.956007][ T8768] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 724.981227][ T8454] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 725.010659][ T4580] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 725.136246][ T4580] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 725.912174][ T8752] Process accounting resumed [ 725.934664][ T4338] usb 2-1: USB disconnect, device number 26 [ 725.950135][ T8454] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 725.994262][ T8454] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 726.025842][ T4338] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 726.043686][ T8454] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 726.066562][ T4338] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 727.187376][ T4338] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 727.211505][ T4338] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 727.223857][ T4338] keyspan 2-1:1.0: device disconnected [ 727.729924][ T8456] Bluetooth: hci0: command 0x0409 tx timeout [ 727.878689][ T8454] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 728.081939][ T8454] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 728.203916][ T8454] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 728.305196][ T8454] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 728.333376][ T4580] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 728.377506][ T4580] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 729.120342][ T8454] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.180086][ T8454] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.220644][ T8454] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.242590][ T8454] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.378791][ T4704] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 729.424034][ T4704] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 729.438397][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 729.527479][ T4704] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 729.551985][ T4704] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 729.587084][ T4368] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 730.861745][ T8814] FAULT_INJECTION: forcing a failure. [ 730.861745][ T8814] name failslab, interval 1, probability 0, space 0, times 0 [ 730.874608][ T8814] CPU: 1 PID: 8814 Comm: syz.1.1049 Not tainted syzkaller #0 [ 730.881999][ T8814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 730.892084][ T8814] Call Trace: [ 730.895375][ T8814] [ 730.898331][ T8814] dump_stack_lvl+0x188/0x24e [ 730.903036][ T8814] ? show_regs_print_info+0x12/0x12 [ 730.908263][ T8814] ? load_image+0x410/0x410 [ 730.912789][ T8814] ? __might_sleep+0xd0/0xd0 [ 730.917395][ T8814] ? __lock_acquire+0x7ea0/0x7ea0 [ 730.922449][ T8814] should_fail_ex+0x390/0x4c0 [ 730.927166][ T8814] should_failslab+0x5/0x20 [ 730.931699][ T8814] slab_pre_alloc_hook+0x59/0x300 [ 730.936742][ T8814] ? security_prepare_creds+0x47/0x130 [ 730.942204][ T8814] __kmem_cache_alloc_node+0x4f/0x270 [ 730.947582][ T8814] ? security_prepare_creds+0x47/0x130 [ 730.953040][ T8814] __kmalloc+0xa3/0x240 [ 730.957190][ T8814] security_prepare_creds+0x47/0x130 [ 730.962476][ T8814] prepare_creds+0x450/0x610 [ 730.967075][ T8814] set_current_groups+0x18/0x160 [ 730.972014][ T8814] __se_sys_setgroups+0x34b/0x410 [ 730.977065][ T8814] do_syscall_64+0x4c/0xa0 [ 730.981481][ T8814] ? clear_bhb_loop+0x60/0xb0 [ 730.986157][ T8814] ? clear_bhb_loop+0x60/0xb0 [ 730.990835][ T8814] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 730.996722][ T8814] RIP: 0033:0x7f37c179f559 [ 731.001136][ T8814] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 731.020745][ T8814] RSP: 002b:00007f37c2726028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 731.029160][ T8814] RAX: ffffffffffffffda RBX: 00007f37c1a25fa0 RCX: 00007f37c179f559 [ 731.037136][ T8814] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 731.045104][ T8814] RBP: 00007f37c1836b20 R08: 0000000000000000 R09: 0000000000000000 [ 731.053078][ T8814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 731.061043][ T8814] R13: 00007f37c1a26038 R14: 00007f37c1a25fa0 R15: 00007ffdc99119a8 [ 731.069021][ T8814] [ 731.598195][ T7] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 731.982630][ T7] usb 2-1: Using ep0 maxpacket: 8 [ 731.989939][ T7] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 732.029176][ T7] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 732.075424][ T7] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 732.123518][ T7] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 732.168050][ T7] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 732.222744][ T7] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 732.267487][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.518058][ T7] usb 2-1: usb_control_msg returned -32 [ 732.524102][ T7] usbtmc 2-1:16.0: can't read capabilities [ 733.095346][ T8842] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 733.103892][ T8842] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 733.111217][ T8842] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 733.118584][ T8842] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 733.126124][ T8842] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 733.133710][ T8842] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 733.141313][ T8842] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 733.212486][ T8842] sctp_transport_update_pmtu: 48 callbacks suppressed [ 733.212498][ T8842] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 733.229828][ T8842] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 733.240132][ T8842] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 733.250546][ T8842] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 733.261892][ T8842] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 733.272349][ T8842] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 733.294433][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 733.304637][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 733.314800][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 733.316674][ T8849] usbtmc 2-1:16.0: INITIATE_CLEAR returned 0 [ 733.324939][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 734.473419][ T6691] usb 2-1: USB disconnect, device number 27 [ 736.130027][ T8875] FAULT_INJECTION: forcing a failure. [ 736.130027][ T8875] name failslab, interval 1, probability 0, space 0, times 0 [ 736.143178][ T8875] CPU: 1 PID: 8875 Comm: syz.5.1065 Not tainted syzkaller #0 [ 736.150551][ T8875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 736.160599][ T8875] Call Trace: [ 736.163868][ T8875] [ 736.166787][ T8875] dump_stack_lvl+0x188/0x24e [ 736.171470][ T8875] ? show_regs_print_info+0x12/0x12 [ 736.176682][ T8875] ? load_image+0x410/0x410 [ 736.181174][ T8875] ? __might_sleep+0xd0/0xd0 [ 736.185750][ T8875] ? __lock_acquire+0x7ea0/0x7ea0 [ 736.190787][ T8875] should_fail_ex+0x390/0x4c0 [ 736.195461][ T8875] should_failslab+0x5/0x20 [ 736.199955][ T8875] slab_pre_alloc_hook+0x59/0x300 [ 736.204968][ T8875] ? security_prepare_creds+0x47/0x130 [ 736.210420][ T8875] __kmem_cache_alloc_node+0x4f/0x270 [ 736.215786][ T8875] ? security_prepare_creds+0x47/0x130 [ 736.221237][ T8875] __kmalloc+0xa3/0x240 [ 736.225395][ T8875] security_prepare_creds+0x47/0x130 [ 736.230689][ T8875] prepare_creds+0x450/0x610 [ 736.235272][ T8875] set_current_groups+0x18/0x160 [ 736.240203][ T8875] __se_sys_setgroups+0x34b/0x410 [ 736.245232][ T8875] do_syscall_64+0x4c/0xa0 [ 736.249655][ T8875] ? clear_bhb_loop+0x60/0xb0 [ 736.254325][ T8875] ? clear_bhb_loop+0x60/0xb0 [ 736.258988][ T8875] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 736.264873][ T8875] RIP: 0033:0x7fab75b9f559 [ 736.269281][ T8875] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 736.288883][ T8875] RSP: 002b:00007fab76a75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 736.297326][ T8875] RAX: ffffffffffffffda RBX: 00007fab75e25fa0 RCX: 00007fab75b9f559 [ 736.305384][ T8875] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 736.313351][ T8875] RBP: 00007fab75c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 736.321316][ T8875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 736.329283][ T8875] R13: 00007fab75e26038 R14: 00007fab75e25fa0 R15: 00007fffbb5f3788 [ 736.337255][ T8875] [ 739.603456][ T8901] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 739.622091][ T8901] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 739.625464][ T8893] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input32 [ 739.641937][ T8901] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 740.232231][ T8901] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 740.300078][ T8901] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 740.352124][ T8901] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 740.422834][ T8901] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 740.517401][ T8915] sctp_transport_update_pmtu: 48 callbacks suppressed [ 740.517418][ T8915] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 740.537663][ T8915] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 740.650582][ T8915] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 740.795655][ T8915] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 740.829253][ T8915] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 740.870493][ T8915] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 740.921812][ T8915] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 740.963606][ T8915] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 741.033294][ T8915] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 741.086504][ T8915] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 743.001684][ T8931] FAULT_INJECTION: forcing a failure. [ 743.001684][ T8931] name failslab, interval 1, probability 0, space 0, times 0 [ 743.014476][ T8931] CPU: 0 PID: 8931 Comm: syz.1.1077 Not tainted syzkaller #0 [ 743.021861][ T8931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 743.031929][ T8931] Call Trace: [ 743.035216][ T8931] [ 743.038165][ T8931] dump_stack_lvl+0x188/0x24e [ 743.042864][ T8931] ? show_regs_print_info+0x12/0x12 [ 743.048078][ T8931] ? load_image+0x410/0x410 [ 743.052589][ T8931] ? __might_sleep+0xd0/0xd0 [ 743.057193][ T8931] ? __lock_acquire+0x7ea0/0x7ea0 [ 743.062234][ T8931] should_fail_ex+0x390/0x4c0 [ 743.066937][ T8931] should_failslab+0x5/0x20 [ 743.071427][ T8931] slab_pre_alloc_hook+0x59/0x300 [ 743.076442][ T8931] ? security_prepare_creds+0x47/0x130 [ 743.081889][ T8931] __kmem_cache_alloc_node+0x4f/0x270 [ 743.087255][ T8931] ? security_prepare_creds+0x47/0x130 [ 743.092712][ T8931] __kmalloc+0xa3/0x240 [ 743.096867][ T8931] security_prepare_creds+0x47/0x130 [ 743.102141][ T8931] prepare_creds+0x450/0x610 [ 743.106726][ T8931] set_current_groups+0x18/0x160 [ 743.111656][ T8931] __se_sys_setgroups+0x34b/0x410 [ 743.116674][ T8931] do_syscall_64+0x4c/0xa0 [ 743.121073][ T8931] ? clear_bhb_loop+0x60/0xb0 [ 743.125735][ T8931] ? clear_bhb_loop+0x60/0xb0 [ 743.130396][ T8931] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 743.136277][ T8931] RIP: 0033:0x7f37c179f559 [ 743.140684][ T8931] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 743.160279][ T8931] RSP: 002b:00007f37c2726028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 743.168676][ T8931] RAX: ffffffffffffffda RBX: 00007f37c1a25fa0 RCX: 00007f37c179f559 [ 743.176635][ T8931] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 743.184615][ T8931] RBP: 00007f37c1836b20 R08: 0000000000000000 R09: 0000000000000000 [ 743.192578][ T8931] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 743.200563][ T8931] R13: 00007f37c1a26038 R14: 00007f37c1a25fa0 R15: 00007ffdc99119a8 [ 743.208530][ T8931] [ 743.491136][ T8939] smc: net device team0 applied user defined pnetid SYZ2 [ 745.431373][ T8947] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 745.448540][ T8947] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 745.510776][ T8947] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 745.550034][ T8947] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 745.560910][ T8947] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 745.828749][ T8947] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 746.790477][ T8947] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 746.891041][ T8947] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 746.954004][ T8947] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 747.006781][ T8947] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 747.094921][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.101774][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.603915][ T8973] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 747.659998][ T8973] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 747.698942][ T8973] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 747.772963][ T8973] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 747.790877][ T8973] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 747.808518][ T8973] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 747.864840][ T8973] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 750.213371][ T8996] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input34 [ 751.789952][ T9021] hub 5-0:1.0: USB hub found [ 751.795504][ T9021] hub 5-0:1.0: 1 port detected [ 752.417771][ T9029] Cannot find add_set index 2 as target [ 752.628183][ T6691] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 753.023549][ T6691] usb 1-1: Using ep0 maxpacket: 8 [ 753.042320][ T6691] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 753.107909][ T6691] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 753.208737][ T6691] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 753.328725][ T6691] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 753.405730][ T6691] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 754.007994][ T6691] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 754.018488][ T6691] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 754.245705][ T6691] usb 1-1: usb_control_msg returned -32 [ 754.251572][ T6691] usbtmc 1-1:16.0: can't read capabilities [ 754.302724][ T4401] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 754.633878][ T4401] usb 6-1: Using ep0 maxpacket: 16 [ 754.641192][ T4401] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 754.666725][ T4401] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 754.687950][ T4401] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 754.704295][ T4401] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 754.719153][ T4401] usb 6-1: SerialNumber: syz [ 754.745804][ T4401] usb 6-1: 0:2 : does not exist [ 754.967665][ T9067] usbtmc 1-1:16.0: INITIATE_CLEAR returned 0 [ 755.939710][ T9075] Process accounting paused [ 755.992069][ T4401] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 756.132750][ T4401] usb 6-1: USB disconnect, device number 2 [ 756.644004][ T8981] udevd[8981]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 758.034650][ T4338] usb 1-1: USB disconnect, device number 24 [ 758.701774][ T9106] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 758.748548][ T9106] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 758.823257][ T9106] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 758.836569][ T9106] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 758.850155][ T9106] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 758.863918][ T9106] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 758.878699][ T9106] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 758.939157][ T9106] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 759.192726][ T9106] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 759.200222][ T9106] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 770.506689][ T9218] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1138'. [ 771.277491][ T9218] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1138'. [ 771.355265][ T9216] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1138'. [ 771.732722][ T4401] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 771.936820][ T4401] usb 6-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice= 0.40 [ 771.966400][ T4401] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.986623][ T4401] usb 6-1: Product: syz [ 771.996062][ T4401] usb 6-1: Manufacturer: syz [ 772.005847][ T4401] usb 6-1: SerialNumber: syz [ 772.245702][ T4401] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 772.295921][ T4401] usb 6-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 772.497743][ T4401] usb 6-1: USB disconnect, device number 3 [ 772.650648][ T9253] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 772.658925][ T9253] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 772.666415][ T9253] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 772.673703][ T9253] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 772.681158][ T9253] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 772.688674][ T9253] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 772.696300][ T9253] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 772.712073][ T9217] udevd[9217]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 777.138959][ T5192] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 778.005439][ T5192] usb 6-1: Using ep0 maxpacket: 16 [ 778.024071][ T5192] usb 6-1: unable to get BOS descriptor or descriptor too short [ 778.043422][ T5192] usb 6-1: config 252 has an invalid interface number: 6 but max is 0 [ 778.051647][ T5192] usb 6-1: config 252 has no interface number 0 [ 778.245954][ T5192] usb 6-1: config 252 interface 6 has no altsetting 0 [ 778.730643][ T5192] usb 6-1: New USB device found, idVendor=0499, idProduct=1007, bcdDevice=59.92 [ 778.939493][ T5192] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 778.962594][ T5192] usb 6-1: Product: syz [ 778.966810][ T5192] usb 6-1: Manufacturer: syz [ 778.991783][ T5192] usb 6-1: SerialNumber: syz [ 779.298763][ T5192] snd-usb-audio: probe of 6-1:252.6 failed with error -2 [ 779.371654][ T9341] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 779.383279][ T9341] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 779.391327][ T9341] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 779.399263][ T9341] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 779.407364][ T9341] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 779.415508][ T9341] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 779.430234][ T9341] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 780.112364][ T5192] usb 6-1: USB disconnect, device number 4 [ 780.130041][ T9264] udevd[9264]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:252.6/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 786.078933][ T9390] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 786.090705][ T9390] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 786.098970][ T9390] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 786.106977][ T9390] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 786.115453][ T9390] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 786.123773][ T9390] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 786.132055][ T9390] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 787.591326][ T9391] Process accounting resumed [ 800.004047][ T9497] UBIFS error (pid: 9497): cannot open "ubi0:testvol", error -19 [ 801.154798][ T9507] hub 5-0:1.0: USB hub found [ 801.168749][ T9507] hub 5-0:1.0: 1 port detected [ 801.758000][ T4401] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 801.952710][ T4401] usb 1-1: Using ep0 maxpacket: 32 [ 802.368748][ T4401] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 802.403376][ T4401] usb 1-1: config 0 has no interface number 0 [ 802.442752][ T4401] usb 1-1: config 0 interface 12 has no altsetting 0 [ 802.515152][ T4401] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 802.536145][ T4401] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 802.544581][ T4401] usb 1-1: Product: syz [ 802.548876][ T4401] usb 1-1: Manufacturer: syz [ 802.553571][ T4401] usb 1-1: SerialNumber: syz [ 802.560439][ T4401] usb 1-1: config 0 descriptor?? [ 805.063597][ T4401] f81534 1-1:0.12: f81534_set_register: reg: 1002 data: 3 failed: -32 [ 805.113428][ T4401] f81534 1-1:0.12: f81534_find_config_idx: read failed: -32 [ 805.127638][ T4401] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -32 [ 805.152047][ T4401] f81534: probe of 1-1:0.12 failed with error -32 [ 805.229386][ T4401] usb 1-1: USB disconnect, device number 25 [ 806.613232][ T9568] Cannot find add_set index 2 as target [ 808.535371][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.542232][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 812.441900][ T9612] FAULT_INJECTION: forcing a failure. [ 812.441900][ T9612] name failslab, interval 1, probability 0, space 0, times 0 [ 812.473428][ T9612] CPU: 0 PID: 9612 Comm: syz.0.1216 Not tainted syzkaller #0 [ 812.480859][ T9612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 812.490933][ T9612] Call Trace: [ 812.494241][ T9612] [ 812.497184][ T9612] dump_stack_lvl+0x188/0x24e [ 812.501897][ T9612] ? show_regs_print_info+0x12/0x12 [ 812.507112][ T9612] ? load_image+0x410/0x410 [ 812.511617][ T9612] ? __might_sleep+0xd0/0xd0 [ 812.516206][ T9612] ? __lock_acquire+0x7ea0/0x7ea0 [ 812.521239][ T9612] should_fail_ex+0x390/0x4c0 [ 812.525925][ T9612] should_failslab+0x5/0x20 [ 812.530429][ T9612] slab_pre_alloc_hook+0x59/0x300 [ 812.535468][ T9612] kmem_cache_alloc+0x56/0x2f0 [ 812.540226][ T9612] ? __kernfs_new_node+0xe1/0x7f0 [ 812.545421][ T9612] __kernfs_new_node+0xe1/0x7f0 [ 812.550272][ T9612] ? __lock_acquire+0x7ea0/0x7ea0 [ 812.555297][ T9612] ? kernfs_new_node+0x250/0x250 [ 812.560244][ T9612] kernfs_new_node+0x148/0x250 [ 812.565015][ T9612] __kernfs_create_file+0x47/0x2e0 [ 812.570124][ T9612] sysfs_add_file_mode_ns+0x233/0x2f0 [ 812.575527][ T9612] internal_create_group+0x490/0xce0 [ 812.580811][ T9612] ? kernfs_add_one+0x14e/0x8f0 [ 812.585659][ T9612] ? __lock_acquire+0x7ea0/0x7ea0 [ 812.590682][ T9612] ? sysfs_create_group+0x20/0x20 [ 812.595709][ T9612] sysfs_create_groups+0x55/0x120 [ 812.600743][ T9612] device_add_attrs+0x1ae/0x830 [ 812.605695][ T9612] ? get_device_parent+0x3e0/0x3e0 [ 812.610832][ T9612] ? kernfs_create_link+0x186/0x200 [ 812.616039][ T9612] device_add+0x677/0x1050 [ 812.620459][ T9612] netdev_register_kobject+0x184/0x320 [ 812.625981][ T9612] register_netdevice+0x133a/0x1b80 [ 812.631236][ T9612] ? netif_stacked_transfer_operstate+0x200/0x200 [ 812.637667][ T9612] ? __local_bh_enable_ip+0x136/0x1c0 [ 812.643124][ T9612] ? _local_bh_enable+0xa0/0xa0 [ 812.647968][ T9612] ? slip_open+0xb4c/0xe40 [ 812.652453][ T9612] ? rcu_is_watching+0x11/0xa0 [ 812.657241][ T9612] slip_open+0xbae/0xe40 [ 812.661505][ T9612] ? pptp_ppp_ioctl+0x170/0x170 [ 812.666364][ T9612] ? up_write+0x1b6/0x410 [ 812.670706][ T9612] tty_ldisc_open+0x9d/0x100 [ 812.675403][ T9612] tty_set_ldisc+0x361/0x540 [ 812.680000][ T9612] tty_ioctl+0xa20/0xba0 [ 812.684240][ T9612] ? tty_get_icount+0xa0/0xa0 [ 812.688910][ T9612] __se_sys_ioctl+0xfa/0x170 [ 812.693499][ T9612] do_syscall_64+0x4c/0xa0 [ 812.697913][ T9612] ? clear_bhb_loop+0x60/0xb0 [ 812.702583][ T9612] ? clear_bhb_loop+0x60/0xb0 [ 812.707255][ T9612] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 812.713589][ T9612] RIP: 0033:0x7f8c7dd9f559 [ 812.718094][ T9612] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 812.737725][ T9612] RSP: 002b:00007f8c7ec01028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 812.746156][ T9612] RAX: ffffffffffffffda RBX: 00007f8c7e025fa0 RCX: 00007f8c7dd9f559 [ 812.754124][ T9612] RDX: 0000200000000600 RSI: 0000000000005423 RDI: 0000000000000004 [ 812.762089][ T9612] RBP: 00007f8c7de36b20 R08: 0000000000000000 R09: 0000000000000000 [ 812.770055][ T9612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 812.778022][ T9612] R13: 00007f8c7e026038 R14: 00007f8c7e025fa0 R15: 00007ffceae5c948 [ 812.786012][ T9612] [ 816.295271][ T4274] Bluetooth: hci5: command 0x0406 tx timeout [ 817.642702][ T6691] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 817.762819][ T4383] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 817.836197][ T6691] usb 2-1: config 0 has an invalid descriptor of length 177, skipping remainder of the config [ 817.851760][ T6691] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 817.917640][ T6691] usb 2-1: New USB device found, idVendor=0b05, idProduct=19b6, bcdDevice= 0.00 [ 817.962785][ T4383] usb 6-1: Using ep0 maxpacket: 32 [ 817.969530][ T4383] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 817.988076][ T6691] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 817.997045][ T4383] usb 6-1: config 0 has no interface number 0 [ 818.022380][ T6691] usb 2-1: config 0 descriptor?? [ 818.027709][ T4383] usb 6-1: config 0 interface 12 has no altsetting 0 [ 818.049070][ T4383] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 818.078036][ T4383] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 818.108124][ T4383] usb 6-1: Product: syz [ 818.126972][ T4383] usb 6-1: Manufacturer: syz [ 818.136957][ T4383] usb 6-1: SerialNumber: syz [ 818.157341][ T4383] usb 6-1: config 0 descriptor?? [ 820.222523][ T4383] f81534 6-1:0.12: f81534_set_register: reg: 1002 data: 3 failed: -32 [ 820.287872][ T4383] f81534 6-1:0.12: f81534_find_config_idx: read failed: -32 [ 820.390255][ T4383] f81534 6-1:0.12: f81534_calc_num_ports: find idx failed: -32 [ 820.450865][ T4383] f81534: probe of 6-1:0.12 failed with error -32 [ 820.536159][ T4383] usb 6-1: USB disconnect, device number 5 [ 821.693063][ T9679] Process accounting paused [ 821.789402][ T6691] usb 2-1: USB disconnect, device number 28 [ 826.793031][ T9741] ptrace attach of "ci2-linux-6-1-kasan/syz-executor exec"[4272] was attempted by "ci2-linux-6-1-kasan/syz-executor exec"[9741] [ 828.282980][ T9747] Cannot find add_set index 2 as target [ 834.612847][ T4274] Bluetooth: hci5: command 0x0405 tx timeout [ 842.692833][ T5192] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 842.891667][ T9855] fuse: Bad value for 'fd' [ 842.902620][ T5192] usb 1-1: Using ep0 maxpacket: 16 [ 842.909980][ T5192] usb 1-1: unable to get BOS descriptor or descriptor too short [ 843.077059][ T5192] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 843.091334][ T5192] usb 1-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 843.100610][ T5192] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 843.109006][ T5192] usb 1-1: Product: syz [ 843.113377][ T5192] usb 1-1: Manufacturer: syz [ 843.117987][ T5192] usb 1-1: SerialNumber: syz [ 844.035498][ T5192] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 844.055080][ T5192] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 845.322657][ T5192] usb 1-1: 2:1 : invalid Cluster Descriptor size [ 845.597973][ T5192] usb 1-1: USB disconnect, device number 26 [ 852.329986][ T9928] Process accounting resumed [ 853.364579][ T4401] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 856.448746][ T4401] usb 1-1: unable to get BOS descriptor or descriptor too short [ 856.483047][ T4401] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 856.502839][ T4401] usb 1-1: can't read configurations, error -71 [ 869.976318][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.982717][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.062658][ T4383] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 871.572706][ T4383] usb 6-1: Using ep0 maxpacket: 16 [ 871.579631][ T4383] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 871.600214][ T4383] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 871.621673][ T4383] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 871.686012][ T4383] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 871.712614][ T4383] usb 6-1: SerialNumber: syz [ 872.483612][ T4383] usb 6-1: 0:2 : does not exist [ 872.906262][ T4383] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 872.948481][ T4383] usb 6-1: USB disconnect, device number 6 [ 873.714995][ T4401] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 873.886376][T10039] udevd[10039]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 873.932761][ T4401] usb 2-1: Using ep0 maxpacket: 32 [ 873.940500][ T4401] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 873.965729][ T4401] usb 2-1: config 0 has no interface number 0 [ 873.984759][ T4401] usb 2-1: config 0 interface 12 has no altsetting 0 [ 874.719800][ T4401] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 874.749450][ T4401] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.782668][ T4401] usb 2-1: Product: syz [ 874.786960][ T4401] usb 2-1: Manufacturer: syz [ 874.805208][ T4401] usb 2-1: SerialNumber: syz [ 874.824889][ T4401] usb 2-1: config 0 descriptor?? [ 875.709622][ T4401] f81534 2-1:0.12: f81534_set_register: reg: 1002 data: 3 failed: -71 [ 875.844903][ T4401] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 875.948689][ T4401] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 875.972751][ T4401] f81534: probe of 2-1:0.12 failed with error -71 [ 876.032852][ T4401] usb 2-1: USB disconnect, device number 29 [ 877.529139][T10091] usb usb5: usbfs: interface 0 claimed by hub while 'syz.1.1349' sets config #0 [ 877.538835][T10091] usb usb5: usbfs: interface 0 claimed by hub while 'syz.1.1349' sets config #1 [ 881.682303][T10126] ip_tables: iptables: counters copy to user failed while replacing table [ 882.479528][T10115] Process accounting paused [ 892.960593][T10204] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1381'. [ 896.667659][T10242] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1394'. [ 903.275404][T10319] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1406'. [ 906.774802][T10354] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1429'. [ 909.119934][T10379] netlink: 532 bytes leftover after parsing attributes in process `syz.5.1435'. [ 910.136052][T10400] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1440'. [ 910.308477][T10401] Cannot find add_set index 2 as target [ 912.162677][ T4383] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 912.422892][ T4383] usb 1-1: Using ep0 maxpacket: 16 [ 912.436246][ T4383] usb 1-1: unable to get BOS descriptor or descriptor too short [ 912.457638][ T4383] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 912.499209][ T4383] usb 1-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 912.532500][ T4383] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.574700][ T4383] usb 1-1: Product: syz [ 912.580296][T10399] Process accounting resumed [ 912.585308][ T4383] usb 1-1: Manufacturer: syz [ 912.589925][ T4383] usb 1-1: SerialNumber: syz [ 912.829345][ T4383] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 912.843254][ T4383] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 913.760017][ T4383] usb 1-1: USB disconnect, device number 29 [ 914.636341][T10435] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1451'. [ 914.753488][T10430] udevd[10430]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 915.562671][ T4383] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 916.274673][ T4383] usb 1-1: unable to get BOS descriptor or descriptor too short [ 916.303623][ T4383] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 916.472837][ T4383] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 916.556869][ T4383] usb 1-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 916.566365][ T4383] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.575757][ T4383] usb 1-1: Product: syz [ 916.579918][ T4383] usb 1-1: Manufacturer: syz [ 916.584828][ T4383] usb 1-1: SerialNumber: syz [ 916.855518][ T4383] usb 1-1: USB disconnect, device number 30 [ 919.391182][T10491] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1462'. [ 920.064521][T10483] udevd[10483]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 922.582202][T10521] hub 5-0:1.0: USB hub found [ 922.587140][T10521] hub 5-0:1.0: 1 port detected [ 923.928351][T10526] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1475'. [ 926.690128][T10549] Cannot find add_set index 2 as target [ 928.477154][T10567] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1487'. [ 928.712719][ T8679] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 929.604762][ T8679] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 929.621330][ T8679] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 929.676561][ T8679] usb 2-1: config 1 interface 0 has no altsetting 0 [ 929.694853][ T8679] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 929.726909][ T8679] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.742607][ T8679] usb 2-1: Product: syz [ 929.746818][ T8679] usb 2-1: Manufacturer: syz [ 929.778447][ T8679] usb 2-1: SerialNumber: syz [ 929.807258][T10561] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 929.822829][T10561] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 930.665736][ T8679] rtl8150 2-1:1.0: couldn't reset the device [ 930.666653][ T4274] [ 930.671871][ T8679] rtl8150: probe of 2-1:1.0 failed with error -5 [ 930.674072][ T4274] ====================================================== [ 930.674079][ T4274] WARNING: possible circular locking dependency detected [ 930.674096][ T4274] syzkaller #0 Not tainted [ 930.674104][ T4274] ------------------------------------------------------ [ 930.674109][ T4274] kworker/u5:1/4274 is trying to acquire lock: [ 930.674117][ T4274] ffffffff8ecd7e28 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_security_cfm+0x95/0x780 [ 930.721189][ T4274] [ 930.721189][ T4274] but task is already holding lock: [ 930.728549][ T4274] ffffffff8ecb5728 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_auth_complete_evt+0x2e0/0xba0 [ 930.738478][ T4274] [ 930.738478][ T4274] which lock already depends on the new lock. [ 930.738478][ T4274] [ 930.748861][ T4274] [ 930.748861][ T4274] the existing dependency chain (in reverse order) is: [ 930.757872][ T4274] [ 930.757872][ T4274] -> #2 (hci_cb_list_lock){+.+.}-{3:3}: [ 930.765581][ T4274] __mutex_lock+0x12d/0xae0 [ 930.770595][ T4274] hci_remote_features_evt+0x464/0xa10 [ 930.776563][ T4274] hci_event_packet+0x806/0x1290 [ 930.782025][ T4274] hci_rx_work+0x3eb/0xd40 [ 930.786942][ T4274] process_one_work+0x8ab/0x1160 [ 930.792472][ T4274] worker_thread+0xaf5/0x12a0 [ 930.797653][ T4274] kthread+0x29d/0x330 [ 930.802257][ T4274] ret_from_fork+0x1f/0x30 [ 930.807235][ T4274] [ 930.807235][ T4274] -> #1 (&hdev->lock){+.+.}-{3:3}: [ 930.814508][ T4274] __mutex_lock+0x12d/0xae0 [ 930.819515][ T4274] l2cap_chan_connect+0xfb/0xe20 [ 930.825012][ T4274] l2cap_sock_connect+0x576/0x750 [ 930.830538][ T4274] kernel_connect+0x13e/0x1c0 [ 930.835763][ T4274] rfcomm_dlc_open+0x600/0x10c0 [ 930.841116][ T4274] rfcomm_sock_connect+0x2e9/0x600 [ 930.846744][ T4274] __sys_connect+0x3cb/0x450 [ 930.851834][ T4274] __x64_sys_connect+0x76/0x80 [ 930.857098][ T4274] do_syscall_64+0x4c/0xa0 [ 930.862016][ T4274] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 930.868410][ T4274] [ 930.868410][ T4274] -> #0 (rfcomm_mutex){+.+.}-{3:3}: [ 930.875771][ T4274] __lock_acquire+0x3a03/0x7ea0 [ 930.881131][ T4274] lock_acquire+0x1bc/0x4a0 [ 930.886140][ T4274] __mutex_lock+0x12d/0xae0 [ 930.891147][ T4274] rfcomm_security_cfm+0x95/0x780 [ 930.896673][ T4274] hci_auth_complete_evt+0x365/0xba0 [ 930.902458][ T4274] hci_event_packet+0x806/0x1290 [ 930.907901][ T4274] hci_rx_work+0x3eb/0xd40 [ 930.912819][ T4274] process_one_work+0x8ab/0x1160 [ 930.918257][ T4274] worker_thread+0xaf5/0x12a0 [ 930.923460][ T4274] kthread+0x29d/0x330 [ 930.928030][ T4274] ret_from_fork+0x1f/0x30 [ 930.932951][ T4274] [ 930.932951][ T4274] other info that might help us debug this: [ 930.932951][ T4274] [ 930.943159][ T4274] Chain exists of: [ 930.943159][ T4274] rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock [ 930.943159][ T4274] [ 930.955670][ T4274] Possible unsafe locking scenario: [ 930.955670][ T4274] [ 930.963098][ T4274] CPU0 CPU1 [ 930.968444][ T4274] ---- ---- [ 930.973791][ T4274] lock(hci_cb_list_lock); [ 930.978279][ T4274] lock(&hdev->lock); [ 930.984847][ T4274] lock(hci_cb_list_lock); [ 930.991848][ T4274] lock(rfcomm_mutex); [ 930.995982][ T4274] [ 930.995982][ T4274] *** DEADLOCK *** [ 930.995982][ T4274] [ 931.004108][ T4274] 4 locks held by kworker/u5:1/4274: [ 931.009393][ T4274] #0: ffff8880644aa138 ((wq_completion)hci5#2){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 [ 931.019747][ T4274] #1: ffffc900040d7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 [ 931.031126][ T4274] #2: ffff8880281a8428 (&hdev->lock){+.+.}-{3:3}, at: hci_auth_complete_evt+0x97/0xba0 [ 931.040854][ T4274] #3: ffffffff8ecb5728 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_auth_complete_evt+0x2e0/0xba0 [ 931.051184][ T4274] [ 931.051184][ T4274] stack backtrace: [ 931.057053][ T4274] CPU: 1 PID: 4274 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 931.064575][ T4274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 931.074632][ T4274] Workqueue: hci5 hci_rx_work [ 931.079296][ T4274] Call Trace: [ 931.082565][ T4274] [ 931.085487][ T4274] dump_stack_lvl+0x188/0x24e [ 931.090149][ T4274] ? load_image+0x410/0x410 [ 931.094650][ T4274] ? show_regs_print_info+0x12/0x12 [ 931.099846][ T4274] ? print_circular_bug+0x12b/0x1a0 [ 931.105051][ T4274] check_noncircular+0x2f8/0x400 [ 931.109976][ T4274] ? print_deadlock_bug+0x5d0/0x5d0 [ 931.115164][ T4274] ? lockdep_lock+0xf1/0x1f0 [ 931.119739][ T4274] ? _find_first_zero_bit+0xd2/0x100 [ 931.125056][ T4274] __lock_acquire+0x3a03/0x7ea0 [ 931.129895][ T4274] ? verify_lock_unused+0x140/0x140 [ 931.135080][ T4274] ? verify_lock_unused+0x140/0x140 [ 931.140270][ T4274] lock_acquire+0x1bc/0x4a0 [ 931.144756][ T4274] ? rfcomm_security_cfm+0x95/0x780 [ 931.149935][ T4274] ? trace_contention_end+0x5f/0x170 [ 931.155220][ T4274] ? __mutex_lock+0x1ab/0xae0 [ 931.159880][ T4274] ? __might_sleep+0xd0/0xd0 [ 931.164464][ T4274] ? read_lock_is_recursive+0x10/0x10 [ 931.169835][ T4274] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 931.175458][ T4274] ? mutex_unlock+0x10/0x10 [ 931.179947][ T4274] __mutex_lock+0x12d/0xae0 [ 931.184437][ T4274] ? rfcomm_security_cfm+0x95/0x780 [ 931.189619][ T4274] ? rfcomm_security_cfm+0x95/0x780 [ 931.194798][ T4274] ? mutex_lock_nested+0x10/0x10 [ 931.199733][ T4274] ? trace_contention_end+0x5f/0x170 [ 931.205001][ T4274] ? __mutex_lock+0x1ab/0xae0 [ 931.209662][ T4274] ? l2cap_disconn_cfm+0xc0/0xc0 [ 931.214598][ T4274] rfcomm_security_cfm+0x95/0x780 [ 931.219640][ T4274] ? mutex_lock_nested+0x10/0x10 [ 931.224593][ T4274] ? trace_contention_end+0x5f/0x170 [ 931.229890][ T4274] ? rfcomm_send_msc+0x350/0x350 [ 931.234835][ T4274] ? hci_conn_hash_lookup_handle+0x20/0x240 [ 931.240739][ T4274] ? hci_conn_hash_lookup_handle+0x20/0x240 [ 931.246648][ T4274] ? hci_conn_hash_lookup_handle+0x22e/0x240 [ 931.252649][ T4274] ? rfcomm_send_msc+0x350/0x350 [ 931.257597][ T4274] hci_auth_complete_evt+0x365/0xba0 [ 931.262895][ T4274] ? hci_disconn_complete_evt+0x8f0/0x8f0 [ 931.268442][ T8679] usb 2-1: USB disconnect, device number 30 [ 931.268612][ T4274] ? skb_pull_data+0xec/0x1f0 [ 931.279179][ T4274] ? hci_disconn_complete_evt+0x8f0/0x8f0 [ 931.284924][ T4274] hci_event_packet+0x806/0x1290 [ 931.289879][ T4274] ? lock_chain_count+0x20/0x20 [ 931.294747][ T4274] ? bis_list+0x280/0x280 [ 931.299085][ T4274] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 931.304970][ T4274] ? kcov_remote_start+0x50f/0x810 [ 931.310089][ T4274] ? lockdep_hardirqs_on+0x94/0x140 [ 931.315278][ T4274] ? hci_send_to_monitor+0x9c/0x4a0 [ 931.320481][ T4274] hci_rx_work+0x3eb/0xd40 [ 931.324886][ T4274] ? _raw_spin_unlock+0x40/0x40 [ 931.329748][ T4274] ? process_one_work+0x7b4/0x1160 [ 931.334873][ T4274] process_one_work+0x8ab/0x1160 [ 931.339832][ T4274] ? worker_detach_from_pool+0x240/0x240 [ 931.345485][ T4274] ? _raw_spin_lock_irq+0xb7/0xf0 [ 931.350516][ T4274] ? _raw_spin_lock_irqsave+0x100/0x100 [ 931.356069][ T4274] ? wq_worker_running+0x97/0x190 [ 931.361102][ T4274] worker_thread+0xaf5/0x12a0 [ 931.365804][ T4274] kthread+0x29d/0x330 [ 931.369914][ T4274] ? worker_clr_flags+0x1a0/0x1a0 [ 931.374953][ T4274] ? kthread_blkcg+0xd0/0xd0 [ 931.379555][ T4274] ret_from_fork+0x1f/0x30 [ 931.383985][ T4274] [ 931.414805][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.421290][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.436652][T10589] gadgetfs: bound to dummy_udc driver [ 931.712983][ T7] usb 1-1: new full-speed USB device number 31 using dummy_hcd [ 931.725632][ C0] gadgetfs: connected [ 931.729854][ T7] gadgetfs: disconnected [ 937.492677][ T4274] Bluetooth: hci5: command 0x0406 tx timeout