last executing test programs: 18m39.425715618s ago: executing program 1 (id=242): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x6, &(0x7f0000000500)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r1}, @generic={0xb7, 0x3, 0x0, 0x0, 0xfffffffd}, @generic={0xb7, 0x4}, @call={0x85, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r1, r2, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) recvmsg(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000200)=""/168, 0xa8}], 0x1}, 0x20) write(r0, &(0x7f0000000700)='h', 0x1) 18m38.385149896s ago: executing program 1 (id=247): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x30, 0x0, 0x1, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x7}, {0x10}, {0x8, 0x7}, {0x0, 0x2}], "3829b70b8285e8c2"}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) 18m38.290173736s ago: executing program 1 (id=249): mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000100)="5bc6ce4288d22f41bb42c995d25e71ca4da1932cc50a", 0x16}, {&(0x7f0000000140)="2f528b93244c81e9ac20bf01bd657349d8703164032fd0f1ff4fbf2b826be150dfb3b3446c91a9aabc172deb2144747ec4e86387fde83b3a38c83151a3ab83036db49409d956783130e980b50a956119e3c273face7ad048c89a23a10ecd9dd0110918d2b4a6061369106ae740e3d5ae0ba32717a5376f97854e43ef4da68656e592f212c8d243f77483b0f00703113a24988f57fe491f9fa4b1afc977a5", 0x9e}], 0x2) 18m38.155306952s ago: executing program 1 (id=251): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./trace\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) inotify_init() 18m38.009036697s ago: executing program 1 (id=253): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x0) capset(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000380)={0x7, 0x7, 0x4, 0x1ff, 0x101, 0x1}) ioctl$KVM_GET_STATS_FD_cpu(r2, 0xaece) 18m37.670887817s ago: executing program 1 (id=256): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)={0x44, r4, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x7ff, 0x74}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r7 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r9, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r11, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r13, @ANYBLOB="08002600ad1600004000330010000000080211000000080211000000080211000001000000000000010001002d1a40000b0000000000000000040003000b0000000600500000000304006c"], 0x68}}, 0x0) write$rfkill(r7, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) 18m22.613925398s ago: executing program 32 (id=256): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)={0x44, r4, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x7ff, 0x74}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r7 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r9, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r11, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r13, @ANYBLOB="08002600ad1600004000330010000000080211000000080211000000080211000001000000000000010001002d1a40000b0000000000000000040003000b0000000600500000000304006c"], 0x68}}, 0x0) write$rfkill(r7, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) 18m11.792070416s ago: executing program 2 (id=323): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x30, r1, 0x1, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x7}, {0x10}, {0x8, 0x7}, {0x0, 0x2}], "3829b70b8285e8c2"}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) 18m11.476272095s ago: executing program 2 (id=325): sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000500000018"], 0x44}}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180100002000"], 0x118}], 0x1, 0x0, 0x0, 0x20008001}, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) 18m11.085003471s ago: executing program 2 (id=328): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000800)={0x48, 0x14, 0x0, 0x0, 0x1004000, 0x0, 0x0}) 18m10.940566621s ago: executing program 2 (id=330): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_mute_present\x00', 0x1, 0x0) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g_uac2/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000001600)='usbip-vudc.0', 0xc) 18m10.285864988s ago: executing program 2 (id=332): openat$nullb(0xffffffffffffff9c, 0x0, 0x400000000ec82, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) 18m9.598434936s ago: executing program 2 (id=336): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x8000003, 0x1, 0x1, 0x8, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbf9, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x7, 0x7, 0x5, 0x1, 0xfffffffd, 0x6}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xffffff80, 0x8001}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x240040e0}, 0x10) r6 = socket$kcm(0x11, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x9, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xfffa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x8000003, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 17m54.57293054s ago: executing program 33 (id=336): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x8000003, 0x1, 0x1, 0x8, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbf9, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x7, 0x7, 0x5, 0x1, 0xfffffffd, 0x6}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xffffff80, 0x8001}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x240040e0}, 0x10) r6 = socket$kcm(0x11, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x9, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xfffa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x8000003, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 9m51.720789472s ago: executing program 4 (id=3399): r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfff7ffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xffffffff, 0x0, 0x0, 0x1}, {0xd00, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r0, 0xc0884113, &(0x7f0000000000)={0x1000000, 0x4, 0x3, 0x6, 0x2, 0x87a9, 0x1, 0x5, 0xfffffffffffffffb, 0x7fff, 0x684d275, 0x1000000}) 9m51.303432764s ago: executing program 4 (id=3400): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='tc', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x2, 0x0) write(r1, &(0x7f0000000300)='127.0.0.1', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x2, 0x0) write(r2, &(0x7f0000000380)='8', 0x1) 9m48.533240392s ago: executing program 4 (id=3404): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0}, 0x4) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xb, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="18080000d0ffffff00000000000000171811", @ANYRES32=r1, @ANYBLOB="0000000000000000b706000014000000b7030000000d00008500000005000000bca900000000000035090100000000009500000000000000b7020000000000007b6af8ff00000000b50902000f0000007baaf0ff00000000bf8700000000000007080000fffdffffbf2400000000000007060000f0ffffff740200000800000018200000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7010000080000004608f0ff76000000bf9800000000000079080000000000008500000005000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 9m48.04068578s ago: executing program 4 (id=3405): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000a800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r0}, 0x21) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e00000000eb15000018010000", @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000024"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020692500000000002060207b1a"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc) 9m46.697107028s ago: executing program 4 (id=3408): sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x24040805) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040), 0x204800, 0x0) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c085}, 0x20008090) r5 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, 0x0, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000008000000000000000000910095"], &(0x7f0000000100)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r6, r6, 0x2f, 0x0, @void}, 0x10) 9m44.680023874s ago: executing program 4 (id=3409): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) truncate(&(0x7f0000000300)='./file0\x00', 0x100000005) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) 9m28.976614397s ago: executing program 34 (id=3409): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) truncate(&(0x7f0000000300)='./file0\x00', 0x100000005) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) 5m36.507838605s ago: executing program 3 (id=3813): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001140)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', 0x0, &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') pread64(r0, &(0x7f0000002240)=""/237, 0xed, 0x4eb) 5m35.437381955s ago: executing program 3 (id=3815): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x0) ioperm(0x3, 0x5, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mmap(&(0x7f0000126000/0x3000)=nil, 0x3000, 0x0, 0x204031, 0xffffffffffffffff, 0xffffffffffff1000) mknod(&(0x7f0000000000)='./file0\x00', 0x800, 0x77b) mount(&(0x7f0000000100)=@filename='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='zonefs\x00', 0x0, 0x0) 5m34.851645004s ago: executing program 3 (id=3817): prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) msgctl$IPC_STAT(0x0, 0x2, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00') ptrace$peeksig(0x4209, r0, &(0x7f00000000c0)={0x0, 0x1}, 0x0) preadv(r2, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0xc002a0, 0x0) 5m32.823343305s ago: executing program 3 (id=3818): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r2, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_NOACK_MAP(r4, 0x0, 0x48c0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r6, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x7}]}]}, 0x30}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r8, @ANYBLOB="01000000000000000000010000001c000180060001000200000008000300ac1414aa0800060003000000bcd1c988066245fb4a8c3b20a6b4fcfac51792a87e2a01803825026c0c19ad439635eae4ab4acbddf70741d510c3ad4908e14729a6af9af18f4093d0d482839d25e49f754ff1dbd078"], 0x30}}, 0x0) connect$inet(r3, 0x0, 0x0) 5m27.741177019s ago: executing program 3 (id=3826): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffdfe) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)={0x1, 0x0, [{0x0, 0x4b, &(0x7f00000000c0)=""/75}]}) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000980)={0x84, 0x0, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5m25.793269862s ago: executing program 3 (id=3830): r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160a62) openat$sysfs(0xffffffffffffff9c, 0x0, 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x9f05) write$sndseq(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000340)='htcp', 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r1, &(0x7f0000000240)="c927", 0x2, 0x4044880, 0x0, 0x0) 5m10.418855691s ago: executing program 35 (id=3830): r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160a62) openat$sysfs(0xffffffffffffff9c, 0x0, 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x9f05) write$sndseq(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000340)='htcp', 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r1, &(0x7f0000000240)="c927", 0x2, 0x4044880, 0x0, 0x0) 16.288372834s ago: executing program 6 (id=4294): mkdirat(0xffffffffffffffff, &(0x7f0000000180)='./trace/set_event\x00', 0x41) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='non_', 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioperm(0x0, 0x9, 0x20) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000500)=@generic={0x0, 0xffffffffffffffff, 0x0, 0x300}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$inet(r2, 0x0, 0x20003) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) read$msr(0xffffffffffffffff, &(0x7f0000032680)=""/102400, 0x19000) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r3, 0x7003) ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f0000000100)={0x28, 0x22, 0x0, 0x2, 0x8, 0x63, 0x5, 0x2, 0x1}) 11.346506962s ago: executing program 0 (id=4298): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000017c0)=@raw={'raw\x00', 0x4001, 0x3, 0x1240, 0x10f0, 0x700001b, 0x148, 0x0, 0x148, 0x11d0, 0x206, 0x240, 0x11d0, 0x240, 0x7fffffe, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xffffffff, 'veth0_to_hsr\x00', 'sit0\x00', {0xff}, {0xff}, 0x2f, 0x1, 0x46}, 0x1ea, 0x10d0, 0x10f0, 0x0, {0x390, 0x8f00}, [@common=@addrtype={{0x30}, {0x158, 0x202}}, @common=@unspec=@cgroup1={{0x1030}, {0x1, 0x0, 0x1, 0x0, './cgroup.net/syz1\x00', 0x5, {0xffffffffffffff03}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0xd4, 'syz1\x00', {0x9e2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x12a0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) socket(0x10, 0x80003, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) mlockall(0x2) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1a3042, 0x20) shmctl$SHM_LOCK(0x0, 0xb) shmctl$SHM_UNLOCK(0x0, 0xc) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) mount(0x0, 0x0, &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/share,user=root,pass=root,port=445,vers=3.0\x00') r2 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi1\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000000)={'comedi_bond\x00', [0x2, 0x4, 0x2, 0x8, 0x90000, 0x9, 0xed, 0x890, 0x280ffa, 0xfffffffc, 0x4, 0x1, 0x1030, 0x1000008, 0x4c, 0x40000009, 0xfff7ffa6, 0x3ff, 0x912, 0x9ea, 0x3, 0x9, 0xc, 0x101, 0x1, 0x990e, 0x5, 0x18, 0x2, 0x2000006, 0x5]}) 10.616896039s ago: executing program 6 (id=4299): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000012c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000ffffffff7a0af0fff8ffff5979a4f0ff00000000b7060000ffffffff2d6405000000000065040400014741001404000001007d60b7030000000000006a0a00fe40000900850000001f000000b70000000004000095000000000000006623848adf1dc9a764ab51a064e0ff0c9b27a26293fddf0180000071ff31f1622271d5518193e09483c5a020c334f8c76334d8ce8303b01ddaa52e8756ad60a07d6f27c125e16d02409819180179714ed0a6e1f0f755d8583da60f27c162dbba0706002ac9170f50f2568836077b7f711a18ebf608d87b885297b6a79819782748b376358c33c9f53bfd989b1ca58949a54d5827df14feecea46408a05d572077f1252fbb72c3d099c501bc4ded6fca17a3447222c95edb47b77aafa63b9dd5fa5c53e9c37251709f1ff7f0000f07bf7f53ce129a9ecd3b4dd15100f2b450f98526a0d8cac7c97fc2f64015306a1bd7e43fe1ca8345710fb6379b4c53cf55eefb4c0974486a8d25a363adbd83b49e13fbd1777b27020bd9b8cff3f48c9411670c34f23ab8caf7851b290feb3045a1b622f20c4383a0280f040de7667f8b1d08428353b1c358ebe73af41e5b5b924275cb1749289b44e9728e7a73f148ac8206afe120c1437490d99000000110000fdffffffffffffffaf580278e1342aabd1b623f6c4f128858e4eb6b42f2173184c2b99b645f6ec0e14e5d7c95a0008000000f30f6c0000000000ff0000b8f5001a1d2a34dc0973ec302bc23211d3e3b6e6dad65a51e5497a3419cece48c38126247b27113ad4c7915c8f82c333a7b350802f0311807010d1ed50c18411aa6900daccc02f4ba4b078f07e41f781eee222c7d071d5a94d82ca9a0846c1af59cee16639b4970f8f0a82c6a712fd5722d637d406160ffaffffffb4e0bde6749aa52c408b74251914c5ff01000000000000b69ebcd8eee623e51dbb1f1b548c91a6825c0686fdc16be1cbb72c217fda18bd746253ca66093daf35923300b600000013887ad6d2d440fedce51a3aa57b00ac376e0a4649a8a84e1d293a6b109c5e59b366bca5cc3d936c53d4a48c05099e6fc36d5aa23bff8cce0600fcff00000300a568a8532623d12b40b50ac26f2e8255470a04bfbe7acb581b90991d965a01d1f84cb6b973558e1e3f8118c77ccf0b3c6eb6443870004da10c75723b65f83769ad1f0e4ef6b9ef1cec23264fd8fdac6264af1cb467020bdc12b797b6c156c439105829d2ae1c45f7cfa40df68fd36a03353a55e68ec7c01bd5a2028a8fc107007f3deb1f200abe1f753754678dae8b4e3ba3d086d4b95dfc5817e3dafae2d38b522f942cc750399d90296171fdb1e05882f8a4b8fbd219ccac3a895828b4f22b6527ce31ceb02b7b2b44925129677b7b3d2f8e7792c7827862eae80134552f0b076b168394f8417f25cc82ae04007193cbe69de8bf35e4bebd15412426b2e20ab1f05fc44ae9ae094c1b81d3ef947692b44d2afb09c7498d357836f03e8a7c392e535694a3ead2de11e6b1781e2a018c0ada7bc7f0eb2d678f23c07ac341fda2e563ee95085742f5fee9f95f4741b226e428d20b00bc140000e4b2f5efd0a0b1ceba000830ba8634b5aa26bdbe91614e92fae3c7349531df9bf4c01ebf5d8eb7d53e5f30647661623fbdb3f60033fc32f68ea86a2df1e76fe27dfdff1cf9194849c4cc0da9533e5983693e526a7dc0d8728f3b573ca4427bdb44df9341e9b8050e896598a156c935c800436a312e7ae3c011e46851ac599f0427729ab9c55ae0ab4c0000000000000000000000000000c87bcc2ac5aed9247b51d92e0993af4beaf1f3f47dcdfab9165f98155d93e383d6b85158b54675c1585037508c1e9461a1c3d1a6e2402045cae150a7016f1a90716eebbdf6afc4414d900be0bdf19f4a273f44f4357380b4387f1c8b104f0e406b2f04e5ed88631be6411f9927fe9f83412b7c5a676ceec8b454ebf6481c98e86b6933a02daea0b4ec0be5b3d916bd70208b4588626c277648475002e2c62681bd07331422a6e47bbd40857d52c4894944fae5c500000000000000ff00000000de784314b8fd419216b48d0f353c11ae185749fa9ac7dfa16bc5c23a23f74b17a7f1b2d799480f33faa3537a910d6ca02f48b0e69beb1119f106ea59195dbc72e17a5dc8c3d131d82f067e29dc39665dff39fb6347b374aaaf6e65efde3fc6202bf29ccfcb08caf18d668a462493aa82e76affba9c9af31d1c23237aa6eccfadfaf794bb1004c07b21ac6ed77718098b2f722bd05fea3561b86b2838a8de5b4f91d6aba95dc9f4464a024be4d0d8d04f5023e7e19e503624d39a43c7b310de519b4073f300022fee47803989b7e916254e0fb9e1c8b07d8a4b8b692a75a32e6ed2caeaa7c258c47fe6143cd9e90b801eff78cd4e402374e0e4ca07b7f17254e3d2f0a2a1bac6fde8a15e3ef3588065524d41966fb3915e804c53201efee751ec294584d23d9008bdf046f55c030ab941a0b87234a30900000000000068133c76770d5e7dabcc48d47685404cc540535ed70df75c24660d85f9c9a245185c7da217d1c3743db85db67b9b8a8f00af02367429f6f0b53c169c4356751bf68745dbde055e1722ae256ae53ae637a1431855d16dfa91d82a021a4b2dbb50bf6d59fdd0c9bc84cd7d544de2523b6ce8aaeb94bfba75079f7455204ccca02bd389d8409b2effe9b88e301ac4fe28752386a0678a3f54b2bdf56f927ddd6b0ac98b2b505f668597455ada51ba95ab852b49373a11ff31dcd82474b51498f65e0601bcdd23acb4c01bcd2f3e1ad378d14c07d923087d3518369710b70ffb0b523dc4f00f275c381fe1c091e478b04d5e4a9f75b4072acb005a83c25625ab7a351a68977177e27a1bf11211"], 0x0}, 0x94) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x5}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="2703022b590200330000002f1eafbcf706e105000000894f000f1102ee1680ca82973d2bd4b8bf4a8291a14b8a34f90186cee844000000080000000019b0fb", 0x3f}, {&(0x7f0000000440)="63f805d7649496db72959832930469edc7b7d050139bf7ada32bc9e37eed1153ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d3333ce2ef36205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb0000000000000000", 0x87}, {&(0x7f0000000280)="fe112162c63e6da8bc8432294ef18af53cc330a62a2c7035246635093ba4d30fcf19a90804f04a10939db8f4e13069cda6d167bf1b68c94d8d694d6ad1a4d51a715975560ad48770706eb1b88d021e1119f2eb75275cfe77f862368649be0f7aff5e7826729816e3d3e7986d9434f891c71ca6e4210c6757083cfd8e732048c504f28b6d309fc129ed8eb5a82e224eb648f90134d1d315977c6ea360a7fece4baa3dd7dcc970759f29df0e86469e954e2b050e87b203ca27a2a519b7555c3b73f2681d49442d9647ff5ea64110cc5020fdeafe53a7d8be70f3260816bc376bcdc5352771fa55d9733e27730ec7103520e8359c78edd21ee6c68feb3685a55722f5da09ffe8ba9f05081a8d214156376f99906245f2f390ad717979d98f0574f8c5b52dcc2fa494f461be6c2560ddbaafb80c5b4583cbe56d24f14ab78fd718947077ea736251c7b8eee267267534c84daa6f095e94bfb85986a03ddea362cc7e6682884e710727c1163cd4f336c13b844605b7a815fe39e43bd0d2e414410a82958455b8a6bd9194c631d66295675fed64c04107a595c421111a3af6e9fadab5c9", 0x1a1}, {&(0x7f0000000180)="6fe4dd9eeba3271dc700b581440284", 0xf}], 0x4}, 0x0) 9.394404175s ago: executing program 0 (id=4300): mount(0x0, &(0x7f0000000500)='dev\x00', 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88c01, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000680)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000400)={0x28, 0x2, r1, 0x0, &(0x7f0000000000/0x400000)=nil, 0x400000, 0x7ffffffe}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f0000000080)={0x28, 0x0, r2, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000040)}) 9.177079061s ago: executing program 6 (id=4301): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = gettid() tkill(r3, 0x2a) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x42, 0x0) fanotify_mark(0xffffffffffffffff, 0x105, 0x40009965, r4, 0x0) ioctl$NBD_CLEAR_SOCK(r4, 0xab04) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r5, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac1.usb0/p_chmask\x00', 0x141842, 0x10) 8.821028166s ago: executing program 0 (id=4303): socket$nl_route(0x10, 0x3, 0x0) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) listen(0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000500)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB], 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000cf000000000000000000000001000000000000000000040000"], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) 7.587970328s ago: executing program 0 (id=4304): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f00000000c0)=0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) 7.587306797s ago: executing program 6 (id=4305): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0xa) shutdown(r0, 0x1) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0, 0x0}) r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r3 = request_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x2}, 0x0, r2) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000280)=@chain={'key_or_keyring:', r3}) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000780)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r2) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x41000, 0x8, 0x9, 0x3, 0xe4, 0x40, 0x2d, 0xff, 0x2c, 0x1a}, {0x41000, 0x2, 0xe, 0x0, 0x40, 0x5, 0x7d, 0x8, 0x58, 0x3, 0x3}, {0xdddd1000, 0xe000, 0x9, 0x5, 0x3, 0x7, 0xfa, 0x89, 0x1, 0xab, 0x5, 0x81}, {0xdddd0000, 0xffff1000, 0x3, 0x5d, 0x2, 0x43, 0x0, 0xfa, 0x80, 0x4, 0x12, 0x4}, {0xdddd0000, 0x26000, 0x8, 0x1, 0x3, 0x7, 0xab, 0x7f, 0x47, 0x83, 0xf7, 0x82}, {0xc000, 0x8000000, 0x8, 0xa0, 0xb5, 0x8, 0x1, 0xd, 0x88, 0xf, 0x1}, {0x54000, 0x2, 0x4, 0x5, 0x7, 0x2, 0x7, 0x0, 0x6, 0x7e, 0xff, 0x70}, {0xeeee8000, 0xfec00000, 0xe, 0x5, 0xf, 0x7, 0x3, 0x16, 0x2, 0x3, 0x7, 0x9}, {0xb000, 0x2e}, {0x10000, 0x3ff}, 0x80000031, 0x0, 0x6000, 0x42124, 0x6, 0x9501, 0x3000, [0x6840000000000002, 0x3, 0x91, 0xff]}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0xc, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006b000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000c400000095"], &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x102}, 0x94) prlimit64(r1, 0x1, 0x0, &(0x7f0000000140)) mount(&(0x7f00000002c0)=@nullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='ext4\x00', 0x10, &(0x7f0000000100)='barrier') r7 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r7, 0x107, 0xc, 0x0, &(0x7f0000002000)) r8 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000180), 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r8, 0x0, 0x4a, 0x12, &(0x7f00000001c0)="72bd324769ed36ca10593bbff6bb84a3850c7f814a022fca9178f58ad83ed05d7b3ab43d44876141ee1757589bcdf4ced491ef34fbfa2c256ffa259da47a1f23ae361bdd41b84a807094", &(0x7f0000000240)=""/18, 0x4, 0x0, 0xd0, 0x20, &(0x7f0000000300)="af21cb0035fd7a8614cce874a73a27ccad32f5796f7467514b797872136a6614c11b39593da51fba5267b20f9e5f063a0ec1f4e99c1337050fb86b291395d2dcb02728032e85e53a3d4277ea53cb1f8217e1fcef3a8692e8e3a042914a3de5bb498f43e665dc2df2f71a2aa2f004dbbb93a044eeb103631ab0513729e06bf2e1930b2e5d06a3e39f607d1741c32022b11903d440bdeb07c44178a19679053e8af3bce03c477e04328eb71ce2d2b0bf94e583b05d5f0f211f60d5512a0edc60858f5defb410ddfa625005b65a237f5090", &(0x7f0000000400)="4f3f70b78fa7ad37a284972a41dfd986a6d2bb25471701b325fff270d98855f2", 0x7, 0x0, 0x4}, 0x50) openat$kvm(0xffffffffffffff9c, 0x0, 0x20940, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r9 = gettid() sched_setscheduler(r9, 0x1, &(0x7f00000004c0)=0x7) ppoll(&(0x7f0000000180)=[{r0, 0x4000}], 0x1, 0x0, 0x0, 0x0) 6.773336953s ago: executing program 5 (id=4307): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x76798000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getpid() setsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f0000000280)=0x392, 0x2) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000000)={'geneve1\x00', 0xe32e}) syz_emit_vhci(&(0x7f0000000200)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_ecred_conn_req={{0x17, 0x42, 0x8}, {0x80, 0x200, 0x200, 0xa}}}}, 0x15) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88c01, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000680)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000400)={0x28, 0x2, r4, 0x0, &(0x7f0000000000/0x400000)=nil, 0x400000, 0x7ffffffe}) ioctl$IOMMU_HWPT_ALLOC$TEST(r3, 0x3b89, &(0x7f0000000080)={0x28, 0x0, r5, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000040)}) 6.072136587s ago: executing program 5 (id=4308): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0xc, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}]}], {0x14}}, 0xb4}}, 0x0) 5.616942345s ago: executing program 6 (id=4309): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) nanosleep(0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r2, 0x1, 0xf, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}, @in={0x2, 0x4e21, @local}], 0x20) listen(r2, 0x7) 5.598519021s ago: executing program 5 (id=4310): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x8, &(0x7f0000000200)=0x40003) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xd, &(0x7f0000000380)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffc}, [@call={0x85, 0x0, 0x0, 0x17}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x3}}]}, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5.104883924s ago: executing program 6 (id=4311): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a03000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000180003801400020000007468305f746f5f68737200000000080002"], 0xe8}}, 0x0) 3.374546273s ago: executing program 0 (id=4312): socket$nl_route(0x10, 0x3, 0x0) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) listen(0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000500)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB], 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000cf000000000000000000000001000000000000000000040000"], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) 2.626029461s ago: executing program 0 (id=4313): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00'], 0x5c}}, 0x40400c4) openat$ppp(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040ac054f02000000000001090224000100000001090400000103000000092100000001221800090581030020"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x18, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x1, 0x1, 0x2, "ff"}, @local=@item_012={0x1, 0x2, 0x0, "04"}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @local=@item_012={0x1, 0x2, 0x0, "01"}, @main=@item_012={0x1, 0x0, 0xa, '\x00'}, @global=@item_012={0x1, 0x1, 0x0, '\b'}, @global=@item_012={0x1, 0x1, 0x9, "01"}, @local=@item_012={0x1, 0x2, 0x0, '0'}, @main=@item_012={0x1, 0x0, 0x9, "02"}, @main=@item_012={0x0, 0x0, 0xc}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, 0x0) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, 0x0, 0xb, 0x5, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4800) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000040)={0x201, 0xa, 0x4}) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_PREPARE_BUF(r3, 0xc058565d, &(0x7f0000000500)=@userptr={0x6, 0xa, 0x4, 0x1, 0x2, {}, {0x1, 0xc, 0xd2, 0x6, 0x77, 0x6, "0080ca6f"}, 0xff, 0x2, {&(0x7f00000002c0)}, 0x6}) 2.401270196s ago: executing program 5 (id=4314): syz_open_dev$cec(0x0, 0x0, 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[]) connect$inet6(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(r1, 0x3b83, &(0x7f0000000100)={0x28, 0x10004, r2, r2, 0x127577, 0x7, 0x2, 0x25820c}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r3 = getpid() inotify_add_watch(0xffffffffffffffff, 0x0, 0xe1000d00) r4 = syz_pidfd_open(r3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setns(r4, 0x24020000) 1.563231279s ago: executing program 5 (id=4315): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61105c00000000006113380000000000bfa00000000000000700000008ffffffd50301001874004095000600000000006916360000000000bf67000000000000360607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c747664e9f7478f8200000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) 0s ago: executing program 5 (id=4316): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x76798000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) getsockopt$inet6_mptcp_buf(0xffffffffffffffff, 0x11c, 0x4, 0x0, 0x0) getpid() setsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f0000000280)=0x392, 0x2) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000000)={'geneve1\x00', 0xe32e}) syz_emit_vhci(&(0x7f0000000200)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_ecred_conn_req={{0x17, 0x42, 0x8}, {0x80, 0x200, 0x200, 0xa}}}}, 0x15) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88c01, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000680)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000400)={0x28, 0x2, r4, 0x0, &(0x7f0000000000/0x400000)=nil, 0x400000, 0x7ffffffe}) ioctl$IOMMU_HWPT_ALLOC$TEST(r3, 0x3b89, &(0x7f0000000080)={0x28, 0x0, r5, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000040)}) kernel console output (not intermixed with test programs): nterface deactivated: batadv_slave_0 [ 895.418282][T14490] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 895.489375][T14490] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 895.548539][T14490] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 896.633843][T14490] veth1_macvtap: left promiscuous mode [ 896.634042][T14490] veth0_macvtap: left promiscuous mode [ 896.801697][T14490] veth1_vlan: left promiscuous mode [ 896.864092][T14490] veth0_vlan: left promiscuous mode [ 899.753065][T15941] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input26 [ 901.002471][T14490] team0 (unregistering): Port device team_slave_1 removed [ 901.042221][T14490] team0 (unregistering): Port device team_slave_0 removed [ 901.442414][T15927] tipc: Enabling of bearer rejected, failed to enable media [ 901.485420][ T5249] 8021q: adding VLAN 0 to HW filter on device eth10 [ 901.493740][T15947] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3676'. [ 905.157419][T15986] tipc: Enabling of bearer rejected, failed to enable media [ 905.416730][T15838] bridge0: port 1(bridge_slave_0) entered blocking state [ 905.416940][T15838] bridge0: port 1(bridge_slave_0) entered disabled state [ 905.417210][T15838] bridge_slave_0: entered allmulticast mode [ 905.442865][T15838] bridge_slave_0: entered promiscuous mode [ 905.466965][T15838] bridge0: port 2(bridge_slave_1) entered blocking state [ 905.474586][T15838] bridge0: port 2(bridge_slave_1) entered disabled state [ 905.474924][T15838] bridge_slave_1: entered allmulticast mode [ 905.478990][T15838] bridge_slave_1: entered promiscuous mode [ 905.634031][T15993] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3689'. [ 905.684293][T15838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 905.715691][T15838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 906.326365][T15838] team0: Port device team_slave_0 added [ 906.350820][T15838] team0: Port device team_slave_1 added [ 906.631748][T14490] bridge_slave_1: left allmulticast mode [ 906.631824][T14490] bridge_slave_1: left promiscuous mode [ 906.632062][T14490] bridge0: port 2(bridge_slave_1) entered disabled state [ 908.142584][T14490] bridge_slave_0: left allmulticast mode [ 908.142759][T14490] bridge_slave_0: left promiscuous mode [ 908.174000][T14490] bridge0: port 1(bridge_slave_0) entered disabled state [ 912.040566][T14490] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 912.200575][T14490] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 912.272820][T14490] bond0 (unregistering): Released all slaves [ 912.494622][ T5249] 8021q: adding VLAN 0 to HW filter on device eth11 [ 912.514219][T16027] tipc: Enabling of bearer rejected, failed to enable media [ 912.657973][T15838] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 912.673237][T15838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 912.673258][T15838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 912.701822][T15838] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 912.701840][T15838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 912.701866][T15838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 912.848585][T16047] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 913.134496][T15838] hsr_slave_0: entered promiscuous mode [ 913.137228][T15838] hsr_slave_1: entered promiscuous mode [ 913.292448][T15838] debugfs: 'hsr0' already exists in 'hsr' [ 913.294036][T15838] Cannot create hsr debugfs directory [ 915.550809][T14490] hsr_slave_0: left promiscuous mode [ 915.594099][T14490] hsr_slave_1: left promiscuous mode [ 915.596839][T14490] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 915.829471][T16071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 915.830100][T16071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 915.890729][T14490] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 916.310475][T14490] team0 (unregistering): Port device team_slave_1 removed [ 916.508078][T14490] team0 (unregistering): Port device team_slave_0 removed [ 916.830085][ T5249] 8021q: adding VLAN 0 to HW filter on device eth12 [ 917.099011][T16084] genirq: Flags mismatch irq 4. 00202000 (pcl818) vs. 00202080 (ttyS0) [ 917.389371][T16093] tipc: Enabling of bearer rejected, failed to enable media [ 922.774655][T16121] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.3722'. [ 927.283769][T16145] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 927.292203][ T5610] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 927.585716][ T5610] usb 7-1: device descriptor read/all, error -71 [ 930.812451][T16178] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 931.489358][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.489495][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.815721][T16186] ./file0: Can't lookup blockdev [ 932.079661][T16189] FAULT_INJECTION: forcing a failure. [ 932.079661][T16189] name failslab, interval 1, probability 0, space 0, times 0 [ 932.080858][T16189] CPU: 1 UID: 0 PID: 16189 Comm: syz.5.3738 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 932.080893][T16189] Tainted: [L]=SOFTLOCKUP [ 932.080901][T16189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 932.080914][T16189] Call Trace: [ 932.080922][T16189] [ 932.080932][T16189] dump_stack_lvl+0xe8/0x150 [ 932.080974][T16189] should_fail_ex+0x46b/0x600 [ 932.081003][T16189] should_failslab+0xa8/0x100 [ 932.081037][T16189] __kmalloc_noprof+0xfb/0x790 [ 932.081072][T16189] ? prepare_creds+0x30/0x820 [ 932.081124][T16189] ? security_prepare_creds+0x52/0x360 [ 932.081148][T16189] ? security_prepare_creds+0x52/0x360 [ 932.081178][T16189] security_prepare_creds+0x52/0x360 [ 932.081205][T16189] prepare_creds+0x57d/0x820 [ 932.081232][T16189] __se_sys_capset+0x2c6/0x440 [ 932.081263][T16189] ? __pfx___se_sys_capset+0x10/0x10 [ 932.081315][T16189] do_syscall_64+0x166/0x520 [ 932.081340][T16189] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 932.081361][T16189] ? clear_bhb_loop+0x70/0xc0 [ 932.081387][T16189] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 932.081408][T16189] RIP: 0033:0x7f60fa6ae159 [ 932.081428][T16189] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 932.081445][T16189] RSP: 002b:00007f60f88c4028 EFLAGS: 00000246 ORIG_RAX: 000000000000007e [ 932.081468][T16189] RAX: ffffffffffffffda RBX: 00007f60fa936180 RCX: 00007f60fa6ae159 [ 932.081483][T16189] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000a31000 [ 932.081497][T16189] RBP: 00007f60fa745024 R08: 0000000000000000 R09: 0000000000000000 [ 932.081509][T16189] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 932.081522][T16189] R13: 00007f60fa936218 R14: 00007f60fa936180 R15: 00007fffcc15d118 [ 932.081555][T16189] [ 932.999964][T16192] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 940.291823][ T5625] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 940.549297][ T5625] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 940.561498][ T5625] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 940.630566][ T5625] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 940.648642][ T5625] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 944.070555][T13197] Bluetooth: hci4: command tx timeout [ 946.280536][T13197] Bluetooth: hci4: command tx timeout [ 947.163065][T16285] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 948.384292][T13197] Bluetooth: hci4: command tx timeout [ 951.297830][T13197] Bluetooth: hci4: command tx timeout [ 952.437160][T16320] FAULT_INJECTION: forcing a failure. [ 952.437160][T16320] name failslab, interval 1, probability 0, space 0, times 0 [ 952.467619][T16320] CPU: 1 UID: 0 PID: 16320 Comm: syz.6.3765 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 952.467645][T16320] Tainted: [L]=SOFTLOCKUP [ 952.467649][T16320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 952.467657][T16320] Call Trace: [ 952.467663][T16320] [ 952.467669][T16320] dump_stack_lvl+0xe8/0x150 [ 952.467692][T16320] should_fail_ex+0x46b/0x600 [ 952.467711][T16320] should_failslab+0xa8/0x100 [ 952.467730][T16320] __kvmalloc_node_noprof+0x176/0x890 [ 952.467747][T16320] ? __kmalloc_cache_noprof+0x3d5/0x680 [ 952.467761][T16320] ? alloc_netdev_mqs+0xd59/0x12c0 [ 952.467856][T16320] ? alloc_netdev_mqs+0xd59/0x12c0 [ 952.467875][T16320] alloc_netdev_mqs+0xd59/0x12c0 [ 952.467896][T16320] rtnl_create_link+0x321/0xd70 [ 952.467958][T16320] rtnl_newlink_create+0x258/0x7b0 [ 952.467997][T16320] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 952.468017][T16320] ? rtnl_newlink+0xc10/0x1c30 [ 952.468032][T16320] ? rtnl_newlink+0xc10/0x1c30 [ 952.468053][T16320] rtnl_newlink+0x166d/0x1c30 [ 952.468085][T16320] ? __pfx_rtnl_newlink+0x10/0x10 [ 952.468097][T16320] ? do_syscall_64+0x166/0x520 [ 952.468110][T16320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.468137][T16320] ? __lock_acquire+0x6df/0x2e40 [ 952.468161][T16320] ? kasan_quarantine_put+0xbb/0x1f0 [ 952.468176][T16320] ? lockdep_hardirqs_on+0x7b/0x110 [ 952.468223][T16320] ? nlmon_xmit+0xb0/0x100 [ 952.468274][T16320] ? kmem_cache_free+0x187/0x6d0 [ 952.468289][T16320] ? nlmon_xmit+0xb0/0x100 [ 952.468306][T16320] ? __lock_acquire+0x6df/0x2e40 [ 952.468323][T16320] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 952.468339][T16320] ? lockdep_hardirqs_on+0x7b/0x110 [ 952.468351][T16320] ? __dev_queue_xmit+0x294/0x3880 [ 952.468390][T16320] ? __dev_queue_xmit+0x1ee9/0x3880 [ 952.468417][T16320] ? lock_acquire+0x115/0x350 [ 952.468439][T16320] ? __pfx_rtnl_newlink+0x10/0x10 [ 952.468452][T16320] rtnetlink_rcv_msg+0x802/0xc00 [ 952.468467][T16320] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 952.468479][T16320] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 952.468491][T16320] ? ref_tracker_free+0x668/0x820 [ 952.468506][T16320] ? __pfx_ref_tracker_free+0x10/0x10 [ 952.468525][T16320] netlink_rcv_skb+0x226/0x4a0 [ 952.468569][T16320] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 952.468583][T16320] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 952.468609][T16320] ? netlink_deliver_tap+0x2e/0x1b0 [ 952.468634][T16320] ? netlink_deliver_tap+0x2e/0x1b0 [ 952.468666][T16320] netlink_unicast+0x7f5/0x990 [ 952.468700][T16320] netlink_sendmsg+0x813/0xb40 [ 952.468736][T16320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 952.468754][T16320] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 952.468773][T16320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 952.468788][T16320] sock_sendmsg_nosec+0x13a/0x180 [ 952.468845][T16320] ____sys_sendmsg+0x565/0x870 [ 952.468864][T16320] ? __pfx_____sys_sendmsg+0x10/0x10 [ 952.468884][T16320] ? import_iovec+0x73/0xa0 [ 952.468910][T16320] ___sys_sendmsg+0x2a5/0x360 [ 952.468925][T16320] ? __lock_acquire+0x6df/0x2e40 [ 952.468941][T16320] ? __pfx____sys_sendmsg+0x10/0x10 [ 952.468957][T16320] ? futex_wait+0x2a2/0x390 [ 952.468985][T16320] ? __fget_files+0x2a/0x420 [ 952.469001][T16320] ? __fget_files+0x3a8/0x420 [ 952.469018][T16320] __x64_sys_sendmsg+0x1b7/0x290 [ 952.469034][T16320] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 952.469061][T16320] do_syscall_64+0x166/0x520 [ 952.469072][T16320] ? trace_irq_disable+0x3b/0x140 [ 952.469086][T16320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.469097][T16320] ? clear_bhb_loop+0x70/0xc0 [ 952.469110][T16320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.469121][T16320] RIP: 0033:0x7f077d0de159 [ 952.469133][T16320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 952.469143][T16320] RSP: 002b:00007f077b336028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 952.469156][T16320] RAX: ffffffffffffffda RBX: 00007f077d365fa0 RCX: 00007f077d0de159 [ 952.469164][T16320] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 952.469171][T16320] RBP: 00007f077d175024 R08: 0000000000000000 R09: 0000000000000000 [ 952.469181][T16320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 952.469192][T16320] R13: 00007f077d366038 R14: 00007f077d365fa0 R15: 00007fff39e7fb88 [ 952.469219][T16320] [ 954.621513][T14096] bridge_slave_1: left allmulticast mode [ 954.621597][T14096] bridge_slave_1: left promiscuous mode [ 954.621846][T14096] bridge0: port 2(bridge_slave_1) entered disabled state [ 954.802396][T14096] bridge_slave_0: left allmulticast mode [ 954.809086][T14096] bridge_slave_0: left promiscuous mode [ 954.815743][T14096] bridge0: port 1(bridge_slave_0) entered disabled state [ 955.032971][T16336] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 958.222314][T14096] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 958.446024][T14096] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 958.511992][T14096] bond0 (unregistering): Released all slaves [ 958.719798][ T5743] usb 4-1: new full-speed USB device number 29 using dummy_hcd [ 959.018835][ T5743] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 959.020542][ T5743] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 959.020575][ T5743] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 959.020624][ T5743] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 959.038134][ T5743] usb 4-1: config 0 descriptor?? [ 959.047108][ T5743] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 959.047165][ T5743] dvb-usb: bulk message failed: -22 (3/0) [ 960.759856][ T5743] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 962.071967][ T5743] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 962.072100][ T5743] usb 4-1: media controller created [ 962.099292][ T5743] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 962.434871][ T5743] dvb-usb: bulk message failed: -22 (6/0) [ 962.435013][ T5743] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 962.477942][ T5743] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input38 [ 962.524809][ T5743] dvb-usb: schedule remote query interval to 150 msecs. [ 962.524902][ T5743] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 962.620522][ T5743] usb 4-1: USB disconnect, device number 29 [ 963.495215][ T5743] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 963.895500][T14096] hsr_slave_0: left promiscuous mode [ 963.990001][T16388] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 964.082386][T14096] hsr_slave_1: left promiscuous mode [ 964.089347][T14096] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 964.127304][T14096] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 966.951278][T14096] team0 (unregistering): Port device team_slave_1 removed [ 967.003255][T14096] team0 (unregistering): Port device team_slave_0 removed [ 967.321656][T16241] bridge0: port 1(bridge_slave_0) entered blocking state [ 967.329003][T16241] bridge0: port 1(bridge_slave_0) entered disabled state [ 967.329224][T16241] bridge_slave_0: entered allmulticast mode [ 967.346224][T16241] bridge_slave_0: entered promiscuous mode [ 967.410017][T16241] bridge0: port 2(bridge_slave_1) entered blocking state [ 967.410477][T16241] bridge0: port 2(bridge_slave_1) entered disabled state [ 967.410943][T16241] bridge_slave_1: entered allmulticast mode [ 967.431260][T16241] bridge_slave_1: entered promiscuous mode [ 967.966625][T16241] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 967.993498][T16241] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 968.192911][T16241] team0: Port device team_slave_0 added [ 968.320758][T16241] team0: Port device team_slave_1 added [ 972.378424][T16241] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 972.378539][T16241] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 972.378564][T16241] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 972.394507][T16241] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 972.394524][T16241] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 972.394551][T16241] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 975.283184][T16241] hsr_slave_0: entered promiscuous mode [ 975.291805][T16241] hsr_slave_1: entered promiscuous mode [ 975.294809][T16241] debugfs: 'hsr0' already exists in 'hsr' [ 975.294837][T16241] Cannot create hsr debugfs directory [ 977.270368][T16442] netlink: 'syz.5.3792': attribute type 1 has an invalid length. [ 977.455401][T16442] 8021q: adding VLAN 0 to HW filter on device bond1 [ 977.767031][T16445] gretap1: entered promiscuous mode [ 978.029663][ T5727] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 978.181422][ T5727] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 978.191711][ T5727] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 978.191729][ T5727] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 978.191759][ T5727] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 978.253898][ T5727] usb 4-1: config 0 descriptor?? [ 978.308586][ T5727] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 978.316580][ T5727] dvb-usb: bulk message failed: -22 (3/0) [ 978.493069][T16448] dvb-usb: bulk message failed: -22 (2/0) [ 978.537175][ T5727] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 978.549295][ T5727] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 978.549346][ T5727] usb 4-1: media controller created [ 978.608562][ T5727] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 978.677015][ T5727] dvb-usb: bulk message failed: -22 (6/0) [ 978.683115][ T5727] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 978.708253][ T5727] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input39 [ 978.753165][ T5727] dvb-usb: schedule remote query interval to 150 msecs. [ 978.762394][ T5727] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 978.795478][ T5727] usb 4-1: USB disconnect, device number 30 [ 979.281345][T16467] netlink: 61687 bytes leftover after parsing attributes in process `syz.3.3794'. [ 979.613311][ T5727] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 981.092286][T16477] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input40 [ 981.445790][ T146] IPVS: starting estimator thread 0... [ 981.579821][T16484] IPVS: using max 8 ests per chain, 19200 per kthread [ 985.930452][T16511] ./file0: Can't lookup blockdev [ 987.412082][ T998] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 987.815188][ T998] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 987.816187][ T998] usb 6-1: config 0 has no interfaces? [ 988.021219][ T998] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 988.021245][ T998] usb 6-1: Manufacturer: syz [ 988.100101][ T998] usb 6-1: config 0 descriptor?? [ 988.330246][ T5727] usb 6-1: USB disconnect, device number 33 [ 989.337423][T16241] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 989.568588][T16241] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 989.610277][T16241] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 989.818935][T16546] ./file0: Can't lookup blockdev [ 989.855399][T16241] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 989.865050][T16241] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 991.904399][T16241] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 991.923300][T16241] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 992.102739][T16241] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 992.666736][T16565] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input41 [ 992.960961][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.961135][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 997.011722][T16582] overlayfs: overlapping lowerdir path [ 997.072268][T16585] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 998.038803][T16241] 8021q: adding VLAN 0 to HW filter on device bond0 [ 998.708768][T16599] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3828'. [ 998.755117][T16600] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3828'. [ 1001.704502][ T5625] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1001.761676][ T5625] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1001.785023][ T5625] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1001.792134][T16607] bridge0: port 2(bridge_slave_1) entered disabled state [ 1001.792408][T16607] bridge0: port 1(bridge_slave_0) entered disabled state [ 1001.801662][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1001.806533][ T5625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1002.871022][T16626] futex_wake_op: syz.5.3833 tries to shift op by 144; fix this program [ 1004.604609][T13197] Bluetooth: hci1: command tx timeout [ 1005.275036][T16636] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input42 [ 1006.690669][T13197] Bluetooth: hci1: command tx timeout [ 1008.760081][T13197] Bluetooth: hci1: command tx timeout [ 1008.785025][T16607] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1009.207666][T16607] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1010.850658][T13197] Bluetooth: hci1: command tx timeout [ 1017.037735][ T5625] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1017.149103][ T5625] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1017.176661][ T5625] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1017.186475][ T5625] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1017.187161][ T5625] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1018.120825][ T57] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1018.132704][ T57] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1018.132749][ T57] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1018.132785][ T57] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1020.298412][ T5625] Bluetooth: hci4: command tx timeout [ 1022.363537][ T5625] Bluetooth: hci4: command tx timeout [ 1024.442661][ T5625] Bluetooth: hci4: command tx timeout [ 1026.520484][ T5625] Bluetooth: hci4: command tx timeout [ 1041.014072][T16645] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 1041.170627][T16645] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1041.184511][T16645] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1041.184551][T16645] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1041.222331][T16645] usb 6-1: config 0 descriptor?? [ 1041.332679][T16645] pwc: Askey VC010 type 2 USB webcam detected. [ 1041.723288][T16645] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1041.778647][T16645] pwc: recv_control_msg error -32 req 02 val 2700 [ 1041.786476][T16645] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1041.791578][T16645] pwc: recv_control_msg error -32 req 04 val 1000 [ 1041.805343][T16645] pwc: recv_control_msg error -32 req 04 val 1300 [ 1041.818673][T16645] pwc: recv_control_msg error -32 req 04 val 1400 [ 1042.023554][T16645] pwc: recv_control_msg error -32 req 02 val 2100 [ 1042.040043][T16645] pwc: recv_control_msg error -32 req 04 val 1500 [ 1042.049022][T16645] pwc: recv_control_msg error -32 req 02 val 2500 [ 1042.408060][T16645] pwc: recv_control_msg error -71 req 02 val 2600 [ 1042.415334][T16645] pwc: recv_control_msg error -71 req 02 val 2900 [ 1042.417418][T16645] pwc: recv_control_msg error -71 req 02 val 2800 [ 1042.418072][T16645] pwc: recv_control_msg error -71 req 04 val 1100 [ 1042.418539][T16645] pwc: recv_control_msg error -71 req 04 val 1200 [ 1042.491012][T16645] pwc: Registered as video103. [ 1042.507353][T16645] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input43 [ 1042.548646][T16645] usb 6-1: USB disconnect, device number 34 [ 1051.532450][T16672] bridge0: port 1(bridge_slave_0) entered blocking state [ 1051.532756][T16672] bridge0: port 1(bridge_slave_0) entered disabled state [ 1051.533081][T16672] bridge_slave_0: entered allmulticast mode [ 1051.543669][T16672] bridge_slave_0: entered promiscuous mode [ 1051.773264][T16672] bridge0: port 2(bridge_slave_1) entered blocking state [ 1051.773468][T16672] bridge0: port 2(bridge_slave_1) entered disabled state [ 1051.773765][T16672] bridge_slave_1: entered allmulticast mode [ 1051.797644][T16672] bridge_slave_1: entered promiscuous mode [ 1052.544673][T15635] bridge_slave_1: left allmulticast mode [ 1052.549661][T15635] bridge_slave_1: left promiscuous mode [ 1052.550047][T15635] bridge0: port 2(bridge_slave_1) entered disabled state [ 1052.701179][T15635] bridge_slave_0: left allmulticast mode [ 1052.702714][T15635] bridge_slave_0: left promiscuous mode [ 1052.709643][T15635] bridge0: port 1(bridge_slave_0) entered disabled state [ 1054.381947][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.383691][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 1057.668867][T14364] usb 1-1: USB disconnect, device number 30 [ 1058.750413][T15635] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1058.933605][T15635] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1059.036728][T15635] bond0 (unregistering): Released all slaves [ 1059.498342][T16672] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1059.516741][ T5249] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1059.903209][T16613] bridge0: port 1(bridge_slave_0) entered blocking state [ 1059.903339][T16613] bridge0: port 1(bridge_slave_0) entered disabled state [ 1059.903481][T16613] bridge_slave_0: entered allmulticast mode [ 1059.995625][T16613] bridge_slave_0: entered promiscuous mode [ 1060.073357][T16875] serio: Serial port ttyS3 [ 1060.218251][T16672] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1060.604846][T14364] cdc_ncm 1-1:1.2 usb1: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM (NO ZLP) [ 1060.702086][T15635] hsr_slave_0: left promiscuous mode [ 1060.765337][T15635] hsr_slave_1: left promiscuous mode [ 1060.766846][T15635] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1060.826725][T15635] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1061.191511][T13197] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1061.260055][T13197] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1061.261757][T13197] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1061.264659][T13197] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1061.265374][T13197] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1062.240414][ T5727] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 1062.392636][ T5727] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1062.393944][ T5727] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1062.394001][ T5727] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1062.399848][ T5727] usb 7-1: config 0 descriptor?? [ 1062.410234][ T5727] pwc: Askey VC010 type 2 USB webcam detected. [ 1062.638266][T16897] binder: BINDER_SET_CONTEXT_MGR already set [ 1062.638358][T16897] binder: 16896:16897 ioctl 4018620d 200000004a80 returned -16 [ 1062.836817][ T5727] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1062.894147][ T5727] pwc: recv_control_msg error -71 req 02 val 2700 [ 1062.894684][ T5727] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1062.895125][ T5727] pwc: recv_control_msg error -71 req 04 val 1000 [ 1062.895563][ T5727] pwc: recv_control_msg error -71 req 04 val 1300 [ 1062.897142][ T5727] pwc: recv_control_msg error -71 req 04 val 1400 [ 1062.897985][ T5727] pwc: recv_control_msg error -71 req 02 val 2000 [ 1062.902879][ T5727] pwc: recv_control_msg error -71 req 02 val 2100 [ 1062.903360][ T5727] pwc: recv_control_msg error -71 req 04 val 1500 [ 1062.903796][ T5727] pwc: recv_control_msg error -71 req 02 val 2500 [ 1062.904232][ T5727] pwc: recv_control_msg error -71 req 02 val 2400 [ 1062.905757][ T5727] pwc: recv_control_msg error -71 req 02 val 2600 [ 1062.906580][ T5727] pwc: recv_control_msg error -71 req 02 val 2900 [ 1062.908531][ T5727] pwc: recv_control_msg error -71 req 02 val 2800 [ 1062.909148][ T5727] pwc: recv_control_msg error -71 req 04 val 1100 [ 1062.913838][ T5727] pwc: recv_control_msg error -71 req 04 val 1200 [ 1063.069653][ T5610] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1063.207108][T15635] team0 (unregistering): Port device team_slave_1 removed [ 1063.253439][ T5610] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1063.257734][ T5610] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1063.257806][ T5610] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1063.279078][ T5727] pwc: Registered as video103. [ 1063.314165][ T5727] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input44 [ 1063.328395][ T5610] usb 6-1: config 0 descriptor?? [ 1063.416658][ T5610] pwc: Askey VC010 type 2 USB webcam detected. [ 1063.435187][ T5727] usb 7-1: USB disconnect, device number 25 [ 1063.670717][T15635] team0 (unregistering): Port device team_slave_0 removed [ 1063.788812][ T5610] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1063.800016][T13197] Bluetooth: hci3: command tx timeout [ 1064.080205][ T5610] pwc: recv_control_msg error -32 req 02 val 2700 [ 1064.088675][ T5610] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1064.101396][ T5610] pwc: recv_control_msg error -32 req 04 val 1000 [ 1064.112051][ T5610] pwc: recv_control_msg error -32 req 04 val 1300 [ 1064.120621][ T5610] pwc: recv_control_msg error -32 req 04 val 1400 [ 1064.338397][ T5610] pwc: recv_control_msg error -32 req 02 val 2100 [ 1064.348572][ T5610] pwc: recv_control_msg error -32 req 04 val 1500 [ 1064.356530][ T5610] pwc: recv_control_msg error -32 req 02 val 2500 [ 1064.575894][ T5610] pwc: recv_control_msg error -71 req 02 val 2600 [ 1064.586276][ T5610] pwc: recv_control_msg error -71 req 02 val 2900 [ 1064.586791][ T5610] pwc: recv_control_msg error -71 req 02 val 2800 [ 1064.587520][ T5610] pwc: recv_control_msg error -71 req 04 val 1100 [ 1064.588300][ T5610] pwc: recv_control_msg error -71 req 04 val 1200 [ 1064.735056][ T5610] pwc: Registered as video103. [ 1064.842595][ T5610] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input45 [ 1065.438203][ T5610] usb 6-1: USB disconnect, device number 35 [ 1065.978162][T13197] Bluetooth: hci3: command tx timeout [ 1066.469748][ T5610] usb 6-1: new full-speed USB device number 36 using dummy_hcd [ 1066.650353][ T5610] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1066.662587][ T5610] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1066.662615][ T5610] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1066.662664][ T5610] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1066.672498][T16672] team0: Port device team_slave_0 added [ 1066.716616][T16672] team0: Port device team_slave_1 added [ 1066.738700][ T5610] usb 6-1: config 0 descriptor?? [ 1066.767761][ T5610] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1066.774945][ T5610] dvb-usb: bulk message failed: -22 (3/0) [ 1066.823550][ T5610] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1066.834118][ T5610] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1066.834174][ T5610] usb 6-1: media controller created [ 1066.835814][ T5610] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1066.924636][ T5610] dvb-usb: bulk message failed: -22 (6/0) [ 1066.930722][ T5610] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1066.952689][T16911] dvb-usb: bulk message failed: -22 (2/0) [ 1066.971536][ T5610] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input46 [ 1067.347696][T16672] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1067.347761][T16672] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1067.347785][T16672] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1067.403262][T16672] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1067.409596][T16672] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1067.409629][T16672] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1067.450263][ T5610] dvb-usb: schedule remote query interval to 150 msecs. [ 1067.459226][ T5610] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1067.479922][ T5610] usb 6-1: USB disconnect, device number 36 [ 1068.060657][T13197] Bluetooth: hci3: command tx timeout [ 1068.139355][T16672] hsr_slave_0: entered promiscuous mode [ 1068.147032][T16672] hsr_slave_1: entered promiscuous mode [ 1068.153536][T16672] debugfs: 'hsr0' already exists in 'hsr' [ 1068.153645][T16672] Cannot create hsr debugfs directory [ 1068.545529][ T5610] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1068.808371][T16937] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1069.211800][T16947] tipc: Enabling of bearer rejected, failed to enable media [ 1069.219657][T14364] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 1069.385660][T14364] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1069.387131][T14364] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1069.387178][T14364] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1069.412818][T14364] usb 1-1: config 0 descriptor?? [ 1069.420351][T14364] pwc: Askey VC010 type 2 USB webcam detected. [ 1069.877833][T14364] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1070.119765][T13197] Bluetooth: hci3: command tx timeout [ 1070.166602][T14364] pwc: recv_control_msg error -32 req 02 val 2700 [ 1070.174676][T14364] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1070.176823][T14364] pwc: recv_control_msg error -32 req 04 val 1000 [ 1070.183888][T14364] pwc: recv_control_msg error -32 req 04 val 1300 [ 1070.189690][T14364] pwc: recv_control_msg error -32 req 04 val 1400 [ 1070.510236][T14364] pwc: recv_control_msg error -32 req 02 val 2100 [ 1070.512449][T14364] pwc: recv_control_msg error -32 req 04 val 1500 [ 1070.518542][T14364] pwc: recv_control_msg error -32 req 02 val 2500 [ 1070.730837][T14364] pwc: recv_control_msg error -71 req 02 val 2600 [ 1070.731379][T14364] pwc: recv_control_msg error -71 req 02 val 2900 [ 1070.732476][T14364] pwc: recv_control_msg error -71 req 02 val 2800 [ 1070.736029][T14364] pwc: recv_control_msg error -71 req 04 val 1100 [ 1070.736555][T14364] pwc: recv_control_msg error -71 req 04 val 1200 [ 1071.017313][T14364] pwc: Registered as video103. [ 1071.031773][T14364] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input47 [ 1071.250608][ T36] usb 6-1: new full-speed USB device number 37 using dummy_hcd [ 1071.250851][T14364] usb 1-1: USB disconnect, device number 31 [ 1071.416932][ T36] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1071.418332][ T36] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1071.418355][ T36] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1071.418404][ T36] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1071.622223][ T36] usb 6-1: config 0 descriptor?? [ 1071.656470][ T5249] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1071.660896][ T36] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1071.660957][ T36] dvb-usb: bulk message failed: -22 (3/0) [ 1071.681575][ T36] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1071.706167][ T36] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1071.706273][ T36] usb 6-1: media controller created [ 1071.708093][ T36] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1071.782155][ T36] dvb-usb: bulk message failed: -22 (6/0) [ 1071.785429][ T36] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1071.826915][T16963] dvb-usb: bulk message failed: -22 (2/0) [ 1071.892436][ T36] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input48 [ 1071.983829][ T36] dvb-usb: schedule remote query interval to 150 msecs. [ 1071.983901][ T36] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1072.082527][ T36] usb 6-1: USB disconnect, device number 37 [ 1072.202952][T15635] bridge_slave_0: left allmulticast mode [ 1072.203024][T15635] bridge_slave_0: left promiscuous mode [ 1072.203255][T15635] bridge0: port 1(bridge_slave_0) entered disabled state [ 1072.656399][T16980] overlayfs: overlapping lowerdir path [ 1072.673003][ T36] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1072.713788][T16983] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1074.290158][T16645] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 1074.481768][T16645] usb 7-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 1074.492320][T16645] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1074.492350][T16645] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1074.501881][T16645] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1074.501909][T16645] usb 7-1: Product: syz [ 1074.501923][T16645] usb 7-1: Manufacturer: syz [ 1074.501935][T16645] usb 7-1: SerialNumber: syz [ 1074.571429][T16645] ums-sddr09 7-1:1.0: USB Mass Storage device detected [ 1074.786933][T16645] ums-sddr09 7-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 1074.786933][T16645] Please send a copy of this message to and [ 1074.850106][T15635] bond0 (unregistering): Released all slaves [ 1075.083842][T16992] tipc: Enabling of bearer rejected, failed to enable media [ 1075.248274][ T5625] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1075.324690][ T5625] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1075.339317][ T5625] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1075.349578][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1075.359417][ T5625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1075.806898][T16645] ums-sddr09 7-1:1.0: probe with driver ums-sddr09 failed with error -5 [ 1075.853927][T16645] usb 7-1: USB disconnect, device number 26 [ 1076.316176][T17007] netlink: 'syz.6.3917': attribute type 1 has an invalid length. [ 1076.324981][T17007] netlink: 84 bytes leftover after parsing attributes in process `syz.6.3917'. [ 1076.325006][T17007] netlink: 'syz.6.3917': attribute type 2 has an invalid length. [ 1076.325019][T17007] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3917'. [ 1077.249733][T14364] usb 7-1: new full-speed USB device number 27 using dummy_hcd [ 1077.418335][T14364] usb 7-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1077.420452][T14364] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1077.420477][T14364] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1077.420527][T14364] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1077.475828][T14364] usb 7-1: config 0 descriptor?? [ 1077.504179][T14364] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1077.508648][T14364] dvb-usb: bulk message failed: -22 (3/0) [ 1077.544016][T14364] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1077.544896][T14364] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1077.544948][T14364] usb 7-1: media controller created [ 1077.556006][T14364] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1077.560111][T13197] Bluetooth: hci1: command tx timeout [ 1077.691669][T17013] dvb-usb: bulk message failed: -22 (2/0) [ 1077.778165][T14364] dvb-usb: bulk message failed: -22 (6/0) [ 1077.778287][T14364] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1077.798728][T14364] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input49 [ 1077.807554][T14364] dvb-usb: schedule remote query interval to 150 msecs. [ 1077.807579][T14364] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1077.935106][T14364] usb 7-1: USB disconnect, device number 27 [ 1078.489278][T14364] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1079.646488][T13197] Bluetooth: hci1: command tx timeout [ 1081.521927][T16883] bridge0: port 1(bridge_slave_0) entered blocking state [ 1081.522054][T16883] bridge0: port 1(bridge_slave_0) entered disabled state [ 1081.522186][T16883] bridge_slave_0: entered allmulticast mode [ 1081.523631][T16883] bridge_slave_0: entered promiscuous mode [ 1081.525984][T17055] tipc: Enabling of bearer rejected, already enabled [ 1081.641754][T16883] bridge0: port 2(bridge_slave_1) entered blocking state [ 1081.652900][T16883] bridge0: port 2(bridge_slave_1) entered disabled state [ 1081.653110][T16883] bridge_slave_1: entered allmulticast mode [ 1081.683465][T16883] bridge_slave_1: entered promiscuous mode [ 1081.796911][T13197] Bluetooth: hci1: command tx timeout [ 1082.107160][T16883] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1082.289249][T16883] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1082.635463][T17069] ./file0: Can't lookup blockdev [ 1082.851219][T17072] FAULT_INJECTION: forcing a failure. [ 1082.851219][T17072] name failslab, interval 1, probability 0, space 0, times 0 [ 1082.851279][T17072] CPU: 1 UID: 0 PID: 17072 Comm: syz.5.3929 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1082.851309][T17072] Tainted: [L]=SOFTLOCKUP [ 1082.851317][T17072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1082.851330][T17072] Call Trace: [ 1082.851339][T17072] [ 1082.851355][T17072] dump_stack_lvl+0xe8/0x150 [ 1082.851395][T17072] should_fail_ex+0x46b/0x600 [ 1082.851424][T17072] should_failslab+0xa8/0x100 [ 1082.851458][T17072] __kmalloc_noprof+0xfb/0x790 [ 1082.851485][T17072] ? udp_init_sock+0x1a9/0x3c0 [ 1082.851602][T17072] ? udp_init_sock+0x1a9/0x3c0 [ 1082.851629][T17072] udp_init_sock+0x1a9/0x3c0 [ 1082.851657][T17072] inet_create+0xd2c/0x1000 [ 1082.851740][T17072] ? inet_create+0x9d/0x1000 [ 1082.851774][T17072] __sock_create+0x4b3/0x9d0 [ 1082.851807][T17072] __sys_socket+0xd6/0x1b0 [ 1082.851833][T17072] __x64_sys_socket+0x7a/0x90 [ 1082.851855][T17072] do_syscall_64+0x166/0x520 [ 1082.851879][T17072] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1082.851901][T17072] ? clear_bhb_loop+0x70/0xc0 [ 1082.851927][T17072] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1082.851948][T17072] RIP: 0033:0x7f60fa6ae159 [ 1082.851969][T17072] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1082.851988][T17072] RSP: 002b:00007f60f88c4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 1082.852011][T17072] RAX: ffffffffffffffda RBX: 00007f60fa936180 RCX: 00007f60fa6ae159 [ 1082.852027][T17072] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 1082.852041][T17072] RBP: 00007f60fa745024 R08: 0000000000000000 R09: 0000000000000000 [ 1082.852054][T17072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1082.852067][T17072] R13: 00007f60fa936218 R14: 00007f60fa936180 R15: 00007fffcc15d118 [ 1082.852099][T17072] [ 1083.573406][T16883] team0: Port device team_slave_0 added [ 1083.576043][ T5249] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1083.597082][T16883] team0: Port device team_slave_1 added [ 1083.800645][T13197] Bluetooth: hci1: command tx timeout [ 1084.016829][T16883] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1084.016896][T16883] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1084.016923][T16883] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1084.297738][ T36] usb 6-1: new full-speed USB device number 38 using dummy_hcd [ 1084.483748][ T36] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1084.495175][ T36] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1084.495201][ T36] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1084.495250][ T36] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1084.536918][ T36] usb 6-1: config 0 descriptor?? [ 1084.562854][ T36] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1084.571245][ T36] dvb-usb: bulk message failed: -22 (3/0) [ 1084.595905][ T36] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1084.613056][ T36] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1084.620910][ T36] usb 6-1: media controller created [ 1084.626208][ T36] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1084.718024][ T36] dvb-usb: bulk message failed: -22 (6/0) [ 1084.724000][ T36] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1084.738336][ T36] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input50 [ 1084.744513][T17076] dvb-usb: bulk message failed: -22 (2/0) [ 1084.807811][ T36] dvb-usb: schedule remote query interval to 150 msecs. [ 1084.814899][ T36] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1084.838488][ T36] usb 6-1: USB disconnect, device number 38 [ 1085.331196][T16883] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1085.338314][T16883] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1085.338343][T16883] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1085.432163][ T36] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1088.978870][T16883] hsr_slave_0: entered promiscuous mode [ 1088.987391][T16883] hsr_slave_1: entered promiscuous mode [ 1088.993393][T16883] debugfs: 'hsr0' already exists in 'hsr' [ 1088.993420][T16883] Cannot create hsr debugfs directory [ 1093.630235][T17122] tipc: Enabling of bearer rejected, failed to enable media [ 1094.066389][T17137] overlayfs: conflicting lowerdir path [ 1094.903560][T16997] bridge0: port 1(bridge_slave_0) entered blocking state [ 1094.909693][T16997] bridge0: port 1(bridge_slave_0) entered disabled state [ 1094.909939][T16997] bridge_slave_0: entered allmulticast mode [ 1094.923920][T16997] bridge_slave_0: entered promiscuous mode [ 1095.058648][T16997] bridge0: port 2(bridge_slave_1) entered blocking state [ 1095.058812][T16997] bridge0: port 2(bridge_slave_1) entered disabled state [ 1095.059043][T16997] bridge_slave_1: entered allmulticast mode [ 1095.073430][T16997] bridge_slave_1: entered promiscuous mode [ 1095.944288][T17154] jffs2: notice: (17154) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1096.103503][T17159] ./file0: Can't lookup blockdev [ 1096.303023][T17162] FAULT_INJECTION: forcing a failure. [ 1096.303023][T17162] name failslab, interval 1, probability 0, space 0, times 0 [ 1096.303190][T17162] CPU: 1 UID: 0 PID: 17162 Comm: syz.0.3938 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1096.303221][T17162] Tainted: [L]=SOFTLOCKUP [ 1096.303228][T17162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1096.303242][T17162] Call Trace: [ 1096.303249][T17162] [ 1096.303258][T17162] dump_stack_lvl+0xe8/0x150 [ 1096.303313][T17162] should_fail_ex+0x46b/0x600 [ 1096.303344][T17162] should_failslab+0xa8/0x100 [ 1096.303377][T17162] __kmalloc_noprof+0xfb/0x790 [ 1096.303429][T17162] ? sk_prot_alloc+0x57/0x210 [ 1096.303534][T17162] ? security_sk_alloc+0x52/0x360 [ 1096.303563][T17162] ? security_sk_alloc+0x52/0x360 [ 1096.303600][T17162] security_sk_alloc+0x52/0x360 [ 1096.303634][T17162] sk_prot_alloc+0x101/0x210 [ 1096.303663][T17162] sk_alloc+0x3a/0x390 [ 1096.303691][T17162] inet_create+0x7a9/0x1000 [ 1096.303723][T17162] ? inet_create+0x9d/0x1000 [ 1096.303756][T17162] __sock_create+0x4b3/0x9d0 [ 1096.303789][T17162] __sys_socket+0xd6/0x1b0 [ 1096.303824][T17162] __x64_sys_socket+0x7a/0x90 [ 1096.303848][T17162] do_syscall_64+0x166/0x520 [ 1096.303871][T17162] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1096.303893][T17162] ? clear_bhb_loop+0x70/0xc0 [ 1096.303918][T17162] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1096.303940][T17162] RIP: 0033:0x7f0ff928e159 [ 1096.303960][T17162] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1096.303978][T17162] RSP: 002b:00007f0ff74a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 1096.304001][T17162] RAX: ffffffffffffffda RBX: 00007f0ff9516180 RCX: 00007f0ff928e159 [ 1096.304016][T17162] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 1096.304029][T17162] RBP: 00007f0ff9325024 R08: 0000000000000000 R09: 0000000000000000 [ 1096.304042][T17162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1096.304055][T17162] R13: 00007f0ff9516218 R14: 00007f0ff9516180 R15: 00007ffd886f7368 [ 1096.304094][T17162] [ 1097.152786][ T5249] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1097.234642][T16997] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1097.343512][T16997] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1097.646981][T16997] team0: Port device team_slave_0 added [ 1097.870977][T16997] team0: Port device team_slave_1 added [ 1098.027255][T16997] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1098.027331][T16997] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1098.027355][T16997] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1098.042353][T16997] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1098.042370][T16997] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1098.042397][T16997] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1098.151559][T17172] tipc: Enabling of bearer rejected, failed to enable media [ 1098.427637][T17175] FAULT_INJECTION: forcing a failure. [ 1098.427637][T17175] name failslab, interval 1, probability 0, space 0, times 0 [ 1098.437897][T17175] CPU: 0 UID: 0 PID: 17175 Comm: syz.5.3953 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1098.437937][T17175] Tainted: [L]=SOFTLOCKUP [ 1098.437945][T17175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1098.437957][T17175] Call Trace: [ 1098.437967][T17175] [ 1098.437977][T17175] dump_stack_lvl+0xe8/0x150 [ 1098.438015][T17175] should_fail_ex+0x46b/0x600 [ 1098.438043][T17175] should_failslab+0xa8/0x100 [ 1098.438075][T17175] kmem_cache_alloc_node_noprof+0xac/0x660 [ 1098.438102][T17175] ? zswap_store+0xc25/0x2050 [ 1098.438148][T17175] ? zswap_store+0xc25/0x2050 [ 1098.438174][T17175] zswap_store+0xc25/0x2050 [ 1098.438201][T17175] ? zswap_store+0x76b/0x2050 [ 1098.438235][T17175] ? __pfx_zswap_store+0x10/0x10 [ 1098.438261][T17175] ? rt_spin_unlock+0x159/0x200 [ 1098.438296][T17175] ? rt_spin_unlock+0x165/0x200 [ 1098.438326][T17175] swap_writeout+0x9d8/0x15b0 [ 1098.438364][T17175] ? try_to_unmap_flush_dirty+0x96/0x100 [ 1098.438393][T17175] shrink_folio_list+0x32d6/0x5100 [ 1098.438454][T17175] ? __pfx_shrink_folio_list+0x10/0x10 [ 1098.438520][T17175] ? __lock_acquire+0x6df/0x2e40 [ 1098.438572][T17175] reclaim_folio_list+0x100/0x430 [ 1098.438612][T17175] ? __pfx_reclaim_folio_list+0x10/0x10 [ 1098.438641][T17175] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1098.438665][T17175] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1098.438705][T17175] reclaim_pages+0x452/0x530 [ 1098.438729][T17175] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1098.438763][T17175] ? __pfx_reclaim_pages+0x10/0x10 [ 1098.438792][T17175] ? madvise_cold_or_pageout_pte_range+0x1715/0x1980 [ 1098.438829][T17175] madvise_cold_or_pageout_pte_range+0x173a/0x1980 [ 1098.438880][T17175] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 1098.438909][T17175] ? do_raw_spin_lock+0x12b/0x2f0 [ 1098.438946][T17175] walk_pgd_range+0xf90/0x1c30 [ 1098.439003][T17175] ? __pfx_walk_pgd_range+0x10/0x10 [ 1098.439024][T17175] ? do_raw_spin_lock+0x12b/0x2f0 [ 1098.439051][T17175] __walk_page_range+0x16d/0x730 [ 1098.439074][T17175] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1098.439098][T17175] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1098.439129][T17175] walk_page_range_vma_unsafe+0x309/0x410 [ 1098.439156][T17175] ? __pfx_walk_page_range_vma_unsafe+0x10/0x10 [ 1098.439176][T17175] ? rt_spin_unlock+0x159/0x200 [ 1098.439207][T17175] ? rt_spin_unlock+0x165/0x200 [ 1098.439237][T17175] ? walk_page_range_vma+0x6b/0x90 [ 1098.439261][T17175] madvise_vma_behavior+0x27b9/0x4140 [ 1098.439299][T17175] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 1098.439342][T17175] ? do_raw_spin_lock+0x12b/0x2f0 [ 1098.439370][T17175] ? rcu_is_watching+0x16/0xb0 [ 1098.439399][T17175] ? trace_hrtimer_start+0x82/0x200 [ 1098.439425][T17175] ? hrtimer_start_range_ns_common+0x841/0xb90 [ 1098.439461][T17175] ? __lock_acquire+0x6df/0x2e40 [ 1098.439486][T17175] ? finish_task_switch+0x40e/0xc60 [ 1098.439505][T17175] ? lockdep_hardirqs_on+0x7b/0x110 [ 1098.439525][T17175] ? rcu_is_watching+0x16/0xb0 [ 1098.439556][T17175] ? mas_next_slot+0xc94/0xd70 [ 1098.439656][T17175] ? mt_find+0x186/0x630 [ 1098.439692][T17175] ? mt_find+0x481/0x630 [ 1098.439719][T17175] ? mt_find+0x186/0x630 [ 1098.439741][T17175] ? __pfx_mt_find+0x10/0x10 [ 1098.439772][T17175] ? find_vma_prev+0x123/0x1b0 [ 1098.439795][T17175] ? futex_unqueue+0x22/0x240 [ 1098.439832][T17175] ? find_vma+0xed/0x160 [ 1098.439856][T17175] ? __lock_acquire+0x6df/0x2e40 [ 1098.439888][T17175] madvise_walk_vmas+0x576/0xb00 [ 1098.439929][T17175] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 1098.439967][T17175] ? blk_start_plug+0x6e/0x1b0 [ 1098.440012][T17175] madvise_do_behavior+0x385/0x540 [ 1098.440047][T17175] ? __pfx_madvise_do_behavior+0x10/0x10 [ 1098.440073][T17175] ? down_read+0x156/0x200 [ 1098.440116][T17175] do_madvise+0x26f/0x330 [ 1098.440153][T17175] ? __pfx_do_madvise+0x10/0x10 [ 1098.440191][T17175] ? rcu_is_watching+0x16/0xb0 [ 1098.440227][T17175] __x64_sys_madvise+0xa6/0xc0 [ 1098.440258][T17175] do_syscall_64+0x166/0x520 [ 1098.440279][T17175] ? trace_irq_disable+0x3b/0x140 [ 1098.440303][T17175] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1098.440323][T17175] ? clear_bhb_loop+0x70/0xc0 [ 1098.440347][T17175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1098.440367][T17175] RIP: 0033:0x7f60fa6ae159 [ 1098.440388][T17175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1098.440405][T17175] RSP: 002b:00007f60f8906028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 1098.440427][T17175] RAX: ffffffffffffffda RBX: 00007f60fa935fa0 RCX: 00007f60fa6ae159 [ 1098.440447][T17175] RDX: 0000000000000015 RSI: 7fffffffffffffff RDI: 0000200000000000 [ 1098.440461][T17175] RBP: 00007f60fa745024 R08: 0000000000000000 R09: 0000000000000000 [ 1098.440474][T17175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1098.440487][T17175] R13: 00007f60fa936038 R14: 00007f60fa935fa0 R15: 00007fffcc15d118 [ 1098.440519][T17175] [ 1098.530892][T17177] overlayfs: missing 'lowerdir' [ 1098.584116][T17178] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1099.589225][T17185] overlayfs: overlapping lowerdir path [ 1099.624208][T17185] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1101.927745][T16997] hsr_slave_0: entered promiscuous mode [ 1101.929982][T16997] hsr_slave_1: entered promiscuous mode [ 1101.931114][T16997] debugfs: 'hsr0' already exists in 'hsr' [ 1101.931138][T16997] Cannot create hsr debugfs directory [ 1102.049226][T17198] tipc: Enabling of bearer rejected, already enabled [ 1105.994894][T17231] overlayfs: conflicting lowerdir path [ 1106.475411][T17236] overlayfs: missing 'lowerdir' [ 1106.527864][T17239] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1109.773358][T17278] ./file0: Can't lookup blockdev [ 1110.036832][T17283] FAULT_INJECTION: forcing a failure. [ 1110.036832][T17283] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1110.061738][T17283] CPU: 0 UID: 0 PID: 17283 Comm: syz.5.3976 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1110.061775][T17283] Tainted: [L]=SOFTLOCKUP [ 1110.061784][T17283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1110.061796][T17283] Call Trace: [ 1110.061805][T17283] [ 1110.061814][T17283] dump_stack_lvl+0xe8/0x150 [ 1110.061851][T17283] should_fail_ex+0x46b/0x600 [ 1110.061881][T17283] get_futex_key+0x1b4/0x1580 [ 1110.061913][T17283] ? __lock_acquire+0x6df/0x2e40 [ 1110.061946][T17283] ? __pfx_get_futex_key+0x10/0x10 [ 1110.061974][T17283] ? __cgroup_account_cputime+0xe8/0x120 [ 1110.062014][T17283] futex_wait_setup+0x4a/0x590 [ 1110.062044][T17283] ? __futex_wait+0xe1/0x410 [ 1110.062072][T17283] __futex_wait+0x161/0x410 [ 1110.062101][T17283] ? __pfx___futex_wait+0x10/0x10 [ 1110.062129][T17283] ? __pfx_futex_wake_mark+0x10/0x10 [ 1110.062158][T17283] ? try_to_wake_up+0x84b/0x1430 [ 1110.062193][T17283] futex_wait+0x121/0x390 [ 1110.062218][T17283] ? __pfx_futex_wait+0x10/0x10 [ 1110.062283][T17283] do_futex+0x3e7/0x4e0 [ 1110.062320][T17283] ? __pfx_do_futex+0x10/0x10 [ 1110.062359][T17283] __se_sys_futex+0x3a8/0x450 [ 1110.062396][T17283] ? __pfx___se_sys_futex+0x10/0x10 [ 1110.062427][T17283] ? rcu_is_watching+0x16/0xb0 [ 1110.062464][T17283] ? __x64_sys_futex+0x21/0xf0 [ 1110.062498][T17283] do_syscall_64+0x166/0x520 [ 1110.062521][T17283] ? trace_irq_disable+0x3b/0x140 [ 1110.062545][T17283] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1110.062567][T17283] ? clear_bhb_loop+0x70/0xc0 [ 1110.062592][T17283] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1110.062613][T17283] RIP: 0033:0x7f60fa6ae159 [ 1110.062634][T17283] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1110.062652][T17283] RSP: 002b:00007f60f88c40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1110.062676][T17283] RAX: ffffffffffffffda RBX: 00007f60fa936188 RCX: 00007f60fa6ae159 [ 1110.062692][T17283] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f60fa936188 [ 1110.062706][T17283] RBP: 00007f60fa936180 R08: 0000000000000000 R09: 0000000000000000 [ 1110.062718][T17283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1110.062731][T17283] R13: 00007f60fa936218 R14: 00007fffcc15d030 R15: 00007fffcc15d118 [ 1110.062763][T17283] [ 1110.722640][T15632] bridge_slave_1: left allmulticast mode [ 1110.722690][T15632] bridge_slave_1: left promiscuous mode [ 1110.722980][T15632] bridge0: port 2(bridge_slave_1) entered disabled state [ 1110.882118][T15632] bridge_slave_0: left allmulticast mode [ 1110.882183][T15632] bridge_slave_0: left promiscuous mode [ 1110.882436][T15632] bridge0: port 1(bridge_slave_0) entered disabled state [ 1111.154292][T17290] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input51 [ 1111.487492][ T57] IPVS: starting estimator thread 0... [ 1111.710077][T17294] IPVS: using max 8 ests per chain, 19200 per kthread [ 1112.291087][T15632] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1112.502337][T15632] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1112.602522][T17303] overlayfs: missing 'lowerdir' [ 1112.633430][T15632] bond0 (unregistering): Released all slaves [ 1112.643178][T17303] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1114.084871][T15632] hsr_slave_0: left promiscuous mode [ 1114.127552][T17320] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input52 [ 1114.632982][T11041] IPVS: starting estimator thread 0... [ 1114.862516][T15632] hsr_slave_1: left promiscuous mode [ 1114.890842][T17325] IPVS: using max 8 ests per chain, 19200 per kthread [ 1115.034781][T15632] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1115.176735][T15632] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1115.368476][T17335] overlay: Unknown parameter '/' [ 1115.398791][T17335] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1115.842442][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.848906][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.171050][T15632] team0 (unregistering): Port device team_slave_1 removed [ 1116.258732][T15632] team0 (unregistering): Port device team_slave_0 removed [ 1116.370751][ T36] usb 6-1: new full-speed USB device number 39 using dummy_hcd [ 1116.540484][ T36] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1116.554712][ T36] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1116.554738][ T36] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1116.554791][ T36] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1116.751664][T17353] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1116.817043][ T36] usb 6-1: config 0 descriptor?? [ 1116.833350][ T36] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1116.833399][ T36] dvb-usb: bulk message failed: -22 (3/0) [ 1116.912628][ T36] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1116.923379][ T36] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1116.923435][ T36] usb 6-1: media controller created [ 1116.927851][ T36] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1117.022616][ T36] dvb-usb: bulk message failed: -22 (6/0) [ 1117.042183][T17340] dvb-usb: bulk message failed: -22 (2/0) [ 1117.060980][ T36] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1117.127713][ T36] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input53 [ 1117.151591][ T36] dvb-usb: schedule remote query interval to 150 msecs. [ 1117.158729][ T36] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1117.191356][ T36] usb 6-1: USB disconnect, device number 39 [ 1117.547318][ T36] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1117.652293][T17368] overlay: Unknown parameter '/' [ 1117.703192][T17368] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1120.019416][T17422] overlay: Unknown parameter '/' [ 1120.042883][T17422] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1120.759945][ T36] usb 7-1: new full-speed USB device number 28 using dummy_hcd [ 1120.910397][ T36] usb 7-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1120.930280][ T36] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1120.940476][ T36] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1120.950141][ T36] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1120.998636][ T36] usb 7-1: config 0 descriptor?? [ 1121.031145][ T36] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1121.037931][ T36] dvb-usb: bulk message failed: -22 (3/0) [ 1121.091496][ T36] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1121.100841][ T36] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1121.100901][ T36] usb 7-1: media controller created [ 1121.102710][ T36] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1121.139050][ T36] dvb-usb: bulk message failed: -22 (6/0) [ 1121.150009][ T36] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1121.187723][ T36] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input54 [ 1121.212963][T17426] dvb-usb: bulk message failed: -22 (2/0) [ 1121.465710][ T36] dvb-usb: schedule remote query interval to 150 msecs. [ 1121.476959][ T36] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1121.503219][ T36] usb 7-1: USB disconnect, device number 28 [ 1122.633970][ T5625] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1122.786795][ T5625] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1122.799169][ T36] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1122.826844][ T5625] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1122.834135][ T5625] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1122.871818][ T5625] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1123.260250][ T36] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 1123.411114][ T36] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1123.412487][ T36] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1123.412535][ T36] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1123.423587][ T36] usb 7-1: config 0 descriptor?? [ 1123.666940][ T36] usbhid 7-1:0.0: can't add hid device: -71 [ 1123.672293][ T36] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1123.721050][ T36] usb 7-1: USB disconnect, device number 29 [ 1124.383172][T17485] overlayfs: overlapping lowerdir path [ 1124.441103][T17487] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1124.460580][ T36] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 1124.639920][T17490] coredump: 791(syz.0.4016): Core dump to core aborted: cannot preserve file permissions [ 1124.649732][ T36] usb 7-1: Using ep0 maxpacket: 32 [ 1124.650549][ T36] usb 7-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1124.651831][ T36] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1124.651873][ T36] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1124.668657][ T36] usb 7-1: config 0 descriptor?? [ 1124.705510][ T36] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1125.034849][ T36] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1125.083961][T13197] Bluetooth: hci4: command tx timeout [ 1125.331522][ T36] usb 7-1: USB disconnect, device number 30 [ 1125.362167][ T36] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 1126.431250][T16645] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 1126.590592][T16645] usb 7-1: Using ep0 maxpacket: 32 [ 1126.596634][T16645] usb 7-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1126.597890][T16645] usb 7-1: config index 0 descriptor too short (expected 156, got 27) [ 1126.597931][T16645] usb 7-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1126.597983][T16645] usb 7-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1126.598010][T16645] usb 7-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1126.598037][T16645] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1126.611327][T16645] usb 7-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1126.611357][T16645] usb 7-1: Product: syz [ 1126.611372][T16645] usb 7-1: Manufacturer: syz [ 1126.611387][T16645] usb 7-1: SerialNumber: syz [ 1126.721002][T16645] usb 7-1: config 0 descriptor?? [ 1126.731142][T16645] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1126.797918][T16645] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1126.820234][T14364] usb 6-1: new full-speed USB device number 40 using dummy_hcd [ 1127.160773][T13197] Bluetooth: hci4: command tx timeout [ 1127.182311][T14364] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1127.210806][T14364] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1127.210909][T14364] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1127.210970][T14364] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1127.268374][T14364] usb 6-1: config 0 descriptor?? [ 1127.376130][ T5727] usb 7-1: USB disconnect, device number 31 [ 1127.376211][ C1] ldusb 7-1:0.0: usb_submit_urb failed (-19) [ 1127.397571][ T5727] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 1127.477958][T14364] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1127.486003][T14364] dvb-usb: bulk message failed: -22 (3/0) [ 1127.523371][T14364] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1127.532813][T14364] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1127.532864][T14364] usb 6-1: media controller created [ 1127.535611][T14364] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1127.625965][T14364] dvb-usb: bulk message failed: -22 (6/0) [ 1127.632415][T14364] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1127.645829][T17526] dvb-usb: bulk message failed: -22 (2/0) [ 1127.836266][T14364] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input55 [ 1127.873057][T14364] dvb-usb: schedule remote query interval to 150 msecs. [ 1127.881453][T14364] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1127.941964][T14364] usb 6-1: USB disconnect, device number 40 [ 1128.837296][T14364] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1129.239744][T13197] Bluetooth: hci4: command tx timeout [ 1129.632687][T17556] overlayfs: overlapping lowerdir path [ 1129.686794][T17557] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1130.187430][T17457] bridge0: port 1(bridge_slave_0) entered blocking state [ 1130.195004][T17457] bridge0: port 1(bridge_slave_0) entered disabled state [ 1130.195203][T17457] bridge_slave_0: entered allmulticast mode [ 1130.197439][T17457] bridge_slave_0: entered promiscuous mode [ 1131.629084][T13197] Bluetooth: hci4: command tx timeout [ 1132.342660][ T5706] usb 6-1: new full-speed USB device number 41 using dummy_hcd [ 1132.502102][ T5706] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1132.503767][ T5706] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1132.503792][ T5706] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1132.503841][ T5706] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1132.515704][ T5706] usb 6-1: config 0 descriptor?? [ 1132.527538][ T5706] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1132.527586][ T5706] dvb-usb: bulk message failed: -22 (3/0) [ 1132.565528][ T5706] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1132.566468][ T5706] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1132.566519][ T5706] usb 6-1: media controller created [ 1132.576674][ T5706] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1132.644715][T17457] bridge0: port 2(bridge_slave_1) entered blocking state [ 1132.652100][T17457] bridge0: port 2(bridge_slave_1) entered disabled state [ 1132.652298][T17457] bridge_slave_1: entered allmulticast mode [ 1132.656370][T17457] bridge_slave_1: entered promiscuous mode [ 1132.708823][ T5706] dvb-usb: bulk message failed: -22 (6/0) [ 1132.714467][ T5706] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1132.718015][T17575] dvb-usb: bulk message failed: -22 (2/0) [ 1132.813098][ T5706] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input56 [ 1132.881242][ T5706] dvb-usb: schedule remote query interval to 150 msecs. [ 1132.881318][ T5706] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1132.883194][T16997] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1132.893882][ T5706] usb 6-1: USB disconnect, device number 41 [ 1133.096693][T16997] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1133.259102][ T5706] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1133.338855][T16997] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1133.622508][T16997] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1133.645096][T17457] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1133.655512][T16997] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1133.711920][T16997] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1133.723263][T17457] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1134.005603][T17599] overlayfs: overlapping lowerdir path [ 1134.062310][T17599] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1134.204040][T16997] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1135.744400][T16997] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1136.616460][T16997] kthread_run failed with err -4 [ 1136.782582][T17457] team0: Port device team_slave_0 added [ 1136.847465][T17457] team0: Port device team_slave_1 added [ 1137.658046][T13197] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1137.712924][T13197] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1137.716071][T13197] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1137.735760][T17457] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1137.735777][T17457] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1137.735803][T17457] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1137.740365][T17457] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1137.740400][T17457] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1137.740426][T17457] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1137.756272][T13197] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1137.879640][T13197] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1139.057888][T17457] hsr_slave_0: entered promiscuous mode [ 1139.061953][T17457] hsr_slave_1: entered promiscuous mode [ 1139.062540][T17457] debugfs: 'hsr0' already exists in 'hsr' [ 1139.062563][T17457] Cannot create hsr debugfs directory [ 1139.579690][T16645] usb 7-1: new full-speed USB device number 32 using dummy_hcd [ 1139.732915][T16645] usb 7-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1139.734413][T16645] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1139.734436][T16645] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1139.734483][T16645] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1139.760433][T16645] usb 7-1: config 0 descriptor?? [ 1139.797344][T16645] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1139.802957][T16645] dvb-usb: bulk message failed: -22 (3/0) [ 1139.824012][T16645] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1139.834947][T16645] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1139.835060][T16645] usb 7-1: media controller created [ 1139.851250][T16645] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1139.963010][T17629] dvb-usb: bulk message failed: -22 (2/0) [ 1140.040346][T13197] Bluetooth: hci3: command tx timeout [ 1140.150044][T16645] dvb-usb: bulk message failed: -22 (6/0) [ 1140.154218][T16645] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1140.400025][T16645] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input57 [ 1140.445366][T16645] dvb-usb: schedule remote query interval to 150 msecs. [ 1140.445453][T16645] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1140.456187][T16645] usb 7-1: USB disconnect, device number 32 [ 1140.838845][T17651] overlayfs: overlapping lowerdir path [ 1140.896291][T17652] overlayfs: conflicting lowerdir path [ 1142.122459][T13197] Bluetooth: hci3: command tx timeout [ 1142.240998][T16645] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1143.899767][ T5610] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 1144.052275][ T5610] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1144.062739][ T5610] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1144.073740][ T5610] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1144.202125][T17677] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1144.208949][T13197] Bluetooth: hci3: command tx timeout [ 1144.374837][ T5610] usb 1-1: config 0 descriptor?? [ 1144.464282][T14577] bridge_slave_1: left allmulticast mode [ 1144.464375][T14577] bridge_slave_1: left promiscuous mode [ 1144.464622][T14577] bridge0: port 2(bridge_slave_1) entered disabled state [ 1145.930313][ T5610] usbhid 1-1:0.0: can't add hid device: -71 [ 1145.930471][ T5610] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1146.001341][ T5610] usb 1-1: USB disconnect, device number 32 [ 1146.280004][T13197] Bluetooth: hci3: command tx timeout [ 1146.292653][T14577] bridge_slave_0: left allmulticast mode [ 1146.292741][T14577] bridge_slave_0: left promiscuous mode [ 1146.292991][T14577] bridge0: port 1(bridge_slave_0) entered disabled state [ 1146.506055][ T5610] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 1146.659570][ T5610] usb 1-1: Using ep0 maxpacket: 32 [ 1146.665764][ T5610] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 1146.667280][ T5610] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1146.667326][ T5610] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1146.726129][ T5610] usb 1-1: config 0 descriptor?? [ 1146.748112][ T5610] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1146.918213][ T5610] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1147.016689][T17688] overlayfs: overlapping lowerdir path [ 1147.060506][T17688] overlayfs: conflicting lowerdir path [ 1147.184107][ T5610] usb 1-1: USB disconnect, device number 33 [ 1147.218551][ T5610] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 1148.802987][T14577] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1149.609387][T14577] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1149.683647][T14577] bond0 (unregistering): Released all slaves [ 1149.862606][T17706] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1150.149620][T17704] rdma_op ffff888058ad8ab8 conn xmit_rdma 0000000000000000 [ 1150.708320][T17715] overlayfs: overlapping lowerdir path [ 1150.733886][T17715] overlayfs: conflicting lowerdir path [ 1153.090335][T14577] hsr_slave_0: left promiscuous mode [ 1153.129677][T16645] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 1153.135572][T14577] hsr_slave_1: left promiscuous mode [ 1153.148927][T14577] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1153.191864][T14577] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1153.293862][T16645] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1153.307186][T16645] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1153.307280][T16645] usb 6-1: Product: syz [ 1153.307293][T16645] usb 6-1: Manufacturer: syz [ 1153.307307][T16645] usb 6-1: SerialNumber: syz [ 1153.690016][T16645] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1153.690115][T16645] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 1153.690147][T16645] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1153.745991][T16645] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -32 [ 1154.030539][T17729] rnbd_client L610: Mapping device /dev/ram0 on session s1, (access_mode: rw, nr_poll_queues: 0) [ 1154.204983][T17729] rtrs_client L2095: : Failed to resolve address, err: -ENODEV [ 1154.215022][T17729] rtrs_client L2638: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1155.218406][ T5706] usb 6-1: USB disconnect, device number 42 [ 1155.604541][T17734] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1156.078192][T14577] team0 (unregistering): Port device team_slave_1 removed [ 1156.666850][T14577] team0 (unregistering): Port device team_slave_0 removed [ 1157.751834][T17746] overlayfs: overlapping lowerdir path [ 1157.866122][T17749] overlayfs: conflicting lowerdir path [ 1161.880471][T17772] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1162.552978][T17780] comedi comedi1: Minor 4 could not be opened [ 1162.854712][T17618] bridge0: port 1(bridge_slave_0) entered blocking state [ 1162.854929][T17618] bridge0: port 1(bridge_slave_0) entered disabled state [ 1162.855112][T17618] bridge_slave_0: entered allmulticast mode [ 1162.860149][T17618] bridge_slave_0: entered promiscuous mode [ 1162.927757][T17618] bridge0: port 2(bridge_slave_1) entered blocking state [ 1162.927991][T17618] bridge0: port 2(bridge_slave_1) entered disabled state [ 1162.928231][T17618] bridge_slave_1: entered allmulticast mode [ 1162.939284][T17618] bridge_slave_1: entered promiscuous mode [ 1165.365637][T17618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1165.739250][T17618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1166.204646][T17618] team0: Port device team_slave_0 added [ 1166.365766][T17618] team0: Port device team_slave_1 added [ 1168.544923][T17828] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1168.590498][ T5706] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 1168.824174][ T5706] usb 1-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.10 [ 1168.839105][ T5706] usb 1-1: config 6 has an invalid interface number: 198 but max is 0 [ 1168.839133][ T5706] usb 1-1: config 6 has no interface number 0 [ 1168.839164][ T5706] usb 1-1: config 6 interface 198 has no altsetting 0 [ 1168.854417][ T5706] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1168.854442][ T5706] usb 1-1: Product: syz [ 1168.854459][ T5706] usb 1-1: Manufacturer: syz [ 1168.854474][ T5706] usb 1-1: SerialNumber: syz [ 1169.151984][ T5706] go7007 1-1:6.198: probe with driver go7007 failed with error -12 [ 1169.155867][ T5706] usb 1-1: USB disconnect, device number 34 [ 1169.512467][T17618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1169.519695][T17618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1169.519716][T17618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1169.599998][T17618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1169.667982][T17618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1169.668017][T17618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1171.299900][T17853] comedi comedi1: Minor 4 could not be opened [ 1173.471551][T17618] hsr_slave_0: entered promiscuous mode [ 1173.484728][T17618] hsr_slave_1: entered promiscuous mode [ 1173.496071][T17618] debugfs: 'hsr0' already exists in 'hsr' [ 1173.512504][T17618] Cannot create hsr debugfs directory [ 1174.142401][T17882] FAULT_INJECTION: forcing a failure. [ 1174.142401][T17882] name failslab, interval 1, probability 0, space 0, times 0 [ 1174.171277][T17882] CPU: 1 UID: 0 PID: 17882 Comm: syz.5.4099 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1174.171320][T17882] Tainted: [L]=SOFTLOCKUP [ 1174.171327][T17882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1174.171340][T17882] Call Trace: [ 1174.171348][T17882] [ 1174.171358][T17882] dump_stack_lvl+0xe8/0x150 [ 1174.171395][T17882] should_fail_ex+0x46b/0x600 [ 1174.171424][T17882] should_failslab+0xa8/0x100 [ 1174.171454][T17882] ? vm_area_dup+0x28/0x750 [ 1174.171482][T17882] kmem_cache_alloc_noprof+0x9e/0x690 [ 1174.171513][T17882] ? vm_area_dup+0x28/0x750 [ 1174.171547][T17882] vm_area_dup+0x28/0x750 [ 1174.171572][T17882] ? dup_mmap+0x8ce/0x1d80 [ 1174.171600][T17882] dup_mmap+0x8d6/0x1d80 [ 1174.171642][T17882] ? __pfx_dup_mmap+0x10/0x10 [ 1174.171667][T17882] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1174.171712][T17882] ? lock_acquire+0x115/0x350 [ 1174.171757][T17882] copy_mm+0x11a/0x480 [ 1174.171788][T17882] ? copy_process+0xd3c/0x43f0 [ 1174.171812][T17882] copy_process+0x1e7d/0x43f0 [ 1174.171849][T17882] ? copy_process+0xd3c/0x43f0 [ 1174.171895][T17882] ? __pfx_copy_process+0x10/0x10 [ 1174.171929][T17882] ? futex_wait+0x2a2/0x390 [ 1174.171961][T17882] kernel_clone+0x2d2/0x8d0 [ 1174.171990][T17882] ? __pfx_kernel_clone+0x10/0x10 [ 1174.172025][T17882] ? do_futex+0x3e7/0x4e0 [ 1174.172059][T17882] __x64_sys_clone+0x1b6/0x230 [ 1174.172092][T17882] ? __pfx___x64_sys_clone+0x10/0x10 [ 1174.172135][T17882] ? rcu_is_watching+0x16/0xb0 [ 1174.172176][T17882] do_syscall_64+0x166/0x520 [ 1174.172197][T17882] ? trace_irq_disable+0x3b/0x140 [ 1174.172222][T17882] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1174.172244][T17882] ? clear_bhb_loop+0x70/0xc0 [ 1174.172270][T17882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1174.172290][T17882] RIP: 0033:0x7f60fa6ae159 [ 1174.172320][T17882] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1174.172339][T17882] RSP: 002b:00007f60f8905fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1174.172364][T17882] RAX: ffffffffffffffda RBX: 00007f60fa935fa0 RCX: 00007f60fa6ae159 [ 1174.172380][T17882] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1174.172392][T17882] RBP: 00007f60fa745024 R08: 0000000000000000 R09: 0000000000000000 [ 1174.172405][T17882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1174.172417][T17882] R13: 00007f60fa936038 R14: 00007f60fa935fa0 R15: 00007fffcc15d118 [ 1174.172449][T17882] [ 1174.410460][ T998] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 1174.535354][T17882] futex_wake_op: syz.5.4099 tries to shift op by 144; fix this program [ 1174.567278][ T998] usb 1-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 1174.568083][ T998] usb 1-1: config 0 has no interfaces? [ 1174.574009][ T998] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1174.574033][ T998] usb 1-1: Product: syz [ 1174.574047][ T998] usb 1-1: Manufacturer: syz [ 1174.574062][ T998] usb 1-1: SerialNumber: syz [ 1174.643748][ T998] usb 1-1: config 0 descriptor?? [ 1176.501421][T17899] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1177.142651][ T5706] usb 1-1: USB disconnect, device number 35 [ 1178.721344][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 1178.721483][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.807804][T17457] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1178.835129][T17457] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1178.874099][T17457] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1178.948866][T17457] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1179.035676][T17457] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1179.069877][T17457] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1181.228335][T17457] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1181.278064][T17457] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1181.500351][T17926] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1182.544271][T17936] syz_tun: entered allmulticast mode [ 1185.237449][ T5625] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1185.309271][ T5625] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1185.318348][ T5625] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1185.324040][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1185.324721][ T5625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1186.626220][T14577] bridge_slave_1: left allmulticast mode [ 1186.626305][T14577] bridge_slave_1: left promiscuous mode [ 1186.626560][T14577] bridge0: port 2(bridge_slave_1) entered disabled state [ 1186.832445][T14577] bridge_slave_0: left allmulticast mode [ 1186.838961][T14577] bridge_slave_0: left promiscuous mode [ 1186.839230][T14577] bridge0: port 1(bridge_slave_0) entered disabled state [ 1187.541496][T17981] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1187.659808][ T5625] Bluetooth: hci1: command tx timeout [ 1188.178347][T17996] serio: Serial port ttyS3 [ 1189.900048][ T5625] Bluetooth: hci1: command tx timeout [ 1190.972752][T14577] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1192.505588][ T5625] Bluetooth: hci1: command tx timeout [ 1192.537163][T14577] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1192.636646][T14577] bond0 (unregistering): Released all slaves [ 1192.734214][ T5249] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1193.425324][T18013] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1194.333623][T14577] hsr_slave_0: left promiscuous mode [ 1194.360154][T14577] hsr_slave_1: left promiscuous mode [ 1194.366952][T14577] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1194.400551][T14577] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1194.520558][ T5625] Bluetooth: hci1: command tx timeout [ 1194.562482][T18035] serio: Serial port ttyS3 [ 1197.741660][T18050] netlink: 'syz.0.4141': attribute type 1 has an invalid length. [ 1199.238304][T13197] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1199.290836][T13197] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1199.302612][T13197] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1199.305081][T13197] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1199.314348][T13197] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1199.831815][T14577] team0 (unregistering): Port device team_slave_1 removed [ 1199.890169][T14577] team0 (unregistering): Port device team_slave_0 removed [ 1200.223341][T18060] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1200.284382][T18050] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1202.012305][ T5625] Bluetooth: hci4: command tx timeout [ 1204.050536][ T5625] Bluetooth: hci4: command tx timeout [ 1206.120393][ T5625] Bluetooth: hci4: command tx timeout [ 1206.867691][ T37] audit: type=1800 audit(2000000789.200:992): pid=18109 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.6.4149" name="p_chmask" dev="configfs" ino=69640 res=0 errno=0 [ 1207.343531][T18117] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1207.870290][T18135] comedi comedi1: Minor 4 could not be opened [ 1208.200371][ T5625] Bluetooth: hci4: command tx timeout [ 1211.816350][ T37] audit: type=1800 audit(2000000794.150:993): pid=18157 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.6.4162" name="p_chmask" dev="configfs" ino=69686 res=0 errno=0 [ 1213.369350][T18176] input: syz1 as /devices/virtual/input/input58 [ 1216.544127][T17949] bridge0: port 1(bridge_slave_0) entered blocking state [ 1216.551729][T17949] bridge0: port 1(bridge_slave_0) entered disabled state [ 1216.551934][T17949] bridge_slave_0: entered allmulticast mode [ 1216.588344][T17949] bridge_slave_0: entered promiscuous mode [ 1216.737674][T17949] bridge0: port 2(bridge_slave_1) entered blocking state [ 1216.737854][T17949] bridge0: port 2(bridge_slave_1) entered disabled state [ 1216.738066][T17949] bridge_slave_1: entered allmulticast mode [ 1216.768970][T17949] bridge_slave_1: entered promiscuous mode [ 1217.529928][T17949] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1217.786332][ T37] audit: type=1800 audit(2000000800.120:994): pid=18220 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.4172" name="p_chmask" dev="configfs" ino=69866 res=0 errno=0 [ 1218.743728][T17949] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1220.282010][T18046] bridge0: port 1(bridge_slave_0) entered blocking state [ 1220.289654][T18046] bridge0: port 1(bridge_slave_0) entered disabled state [ 1220.289879][T18046] bridge_slave_0: entered allmulticast mode [ 1220.314172][T18046] bridge_slave_0: entered promiscuous mode [ 1220.350231][T18046] bridge0: port 2(bridge_slave_1) entered blocking state [ 1220.350390][T18046] bridge0: port 2(bridge_slave_1) entered disabled state [ 1220.350568][T18046] bridge_slave_1: entered allmulticast mode [ 1220.361602][T18046] bridge_slave_1: entered promiscuous mode [ 1220.448832][T17949] team0: Port device team_slave_0 added [ 1221.538528][T18238] ./file0: Can't lookup blockdev [ 1221.699877][T18242] FAULT_INJECTION: forcing a failure. [ 1221.699877][T18242] name failslab, interval 1, probability 0, space 0, times 0 [ 1221.700041][T18242] CPU: 0 UID: 0 PID: 18242 Comm: syz.0.4179 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1221.700073][T18242] Tainted: [L]=SOFTLOCKUP [ 1221.700081][T18242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1221.700094][T18242] Call Trace: [ 1221.700103][T18242] [ 1221.700112][T18242] dump_stack_lvl+0xe8/0x150 [ 1221.700153][T18242] should_fail_ex+0x46b/0x600 [ 1221.700180][T18242] ? sock_alloc_inode+0x2c/0x1a0 [ 1221.700214][T18242] should_failslab+0xa8/0x100 [ 1221.700247][T18242] kmem_cache_alloc_lru_noprof+0xa2/0x680 [ 1221.700276][T18242] ? sock_alloc_inode+0x2c/0x1a0 [ 1221.700300][T18242] ? __pfx_sock_alloc_inode+0x10/0x10 [ 1221.700319][T18242] sock_alloc_inode+0x2c/0x1a0 [ 1221.700340][T18242] ? __pfx_sock_alloc_inode+0x10/0x10 [ 1221.700359][T18242] alloc_inode+0x6a/0x1b0 [ 1221.700393][T18242] __sock_create+0x12d/0x9d0 [ 1221.700425][T18242] __sys_socket+0xd6/0x1b0 [ 1221.700451][T18242] __x64_sys_socket+0x7a/0x90 [ 1221.700474][T18242] do_syscall_64+0x166/0x520 [ 1221.700498][T18242] ? trace_irq_disable+0x3b/0x140 [ 1221.700525][T18242] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1221.700547][T18242] ? clear_bhb_loop+0x70/0xc0 [ 1221.700573][T18242] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1221.700593][T18242] RIP: 0033:0x7f0ff928e159 [ 1221.700613][T18242] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1221.700631][T18242] RSP: 002b:00007f0ff74a4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 1221.700654][T18242] RAX: ffffffffffffffda RBX: 00007f0ff9516180 RCX: 00007f0ff928e159 [ 1221.700670][T18242] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 1221.700682][T18242] RBP: 00007f0ff9325024 R08: 0000000000000000 R09: 0000000000000000 [ 1221.700695][T18242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1221.700707][T18242] R13: 00007f0ff9516218 R14: 00007f0ff9516180 R15: 00007ffd886f7368 [ 1221.700740][T18242] [ 1221.700786][T18242] socket: no more sockets [ 1222.464281][T17949] team0: Port device team_slave_1 added [ 1223.092639][ T998] usb 1-1: new full-speed USB device number 36 using dummy_hcd [ 1223.241402][ T998] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1223.253777][ T998] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1223.253811][ T998] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1223.253851][ T998] usb 1-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1223.253891][ T998] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1223.253918][ T998] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1223.369893][T18252] comedi comedi1: Minor 4 could not be opened [ 1223.381370][ T998] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1223.389531][ T998] usb 1-1: Product: syz [ 1223.389550][ T998] usb 1-1: Manufacturer: syz [ 1223.389563][ T998] usb 1-1: SerialNumber: syz [ 1223.432249][T18248] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1223.556313][T18046] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1223.752256][T18248] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1223.761669][T18046] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1223.939123][T17949] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1223.946761][T17949] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1223.946793][T17949] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1224.081031][T17949] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1224.088711][T17949] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1224.088741][T17949] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1224.222181][T18046] team0: Port device team_slave_0 added [ 1224.254942][T18046] team0: Port device team_slave_1 added [ 1224.476569][T18248] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1224.481326][ T37] audit: type=1800 audit(2000000806.820:995): pid=18255 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.5.4182" name="p_chmask" dev="configfs" ino=70014 res=0 errno=0 [ 1224.711756][ T998] cdc_ncm 1-1:1.0: bind() failure [ 1224.736215][ T998] cdc_ncm 1-1:1.1: probe with driver cdc_ncm failed with error -71 [ 1224.749022][ T998] cdc_mbim 1-1:1.1: probe with driver cdc_mbim failed with error -71 [ 1224.762953][ T998] usbtest 1-1:1.1: probe with driver usbtest failed with error -71 [ 1224.812482][ T998] usb 1-1: USB disconnect, device number 36 [ 1225.475328][T17949] hsr_slave_0: entered promiscuous mode [ 1225.486130][T17949] hsr_slave_1: entered promiscuous mode [ 1225.502584][T17949] debugfs: 'hsr0' already exists in 'hsr' [ 1225.510573][T17949] Cannot create hsr debugfs directory [ 1225.515204][T18046] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1225.515218][T18046] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1225.515244][T18046] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1225.538778][T18046] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1225.538795][T18046] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1225.538821][T18046] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1227.740112][ T37] audit: type=1800 audit(2000000810.080:996): pid=18276 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.4191" name="p_chmask" dev="configfs" ino=70143 res=0 errno=0 [ 1228.333932][T18282] comedi comedi1: Minor 4 could not be opened [ 1228.407956][T18046] hsr_slave_0: entered promiscuous mode [ 1228.418524][T18046] hsr_slave_1: entered promiscuous mode [ 1228.434218][T18046] debugfs: 'hsr0' already exists in 'hsr' [ 1228.443746][T18046] Cannot create hsr debugfs directory [ 1230.821381][T14577] bridge_slave_1: left allmulticast mode [ 1230.828444][T14577] bridge_slave_1: left promiscuous mode [ 1230.828727][T14577] bridge0: port 2(bridge_slave_1) entered disabled state [ 1231.005403][T14577] bridge_slave_0: left allmulticast mode [ 1231.012488][T14577] bridge_slave_0: left promiscuous mode [ 1231.012754][T14577] bridge0: port 1(bridge_slave_0) entered disabled state [ 1231.170177][T14364] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 1231.330496][T14364] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1231.344803][T14364] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1231.344830][T14364] usb 1-1: Product: syz [ 1231.344844][T14364] usb 1-1: Manufacturer: syz [ 1231.344859][T14364] usb 1-1: SerialNumber: syz [ 1232.693508][T14577] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1232.936037][T14577] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1233.034225][T14577] bond0 (unregistering): Released all slaves [ 1233.765804][T18301] bridge0: port 2(bridge_slave_1) entered blocking state [ 1233.765954][T18301] bridge0: port 2(bridge_slave_1) entered listening state [ 1233.766140][T18301] bridge0: port 1(bridge_slave_0) entered blocking state [ 1233.766219][T18301] bridge0: port 1(bridge_slave_0) entered listening state [ 1233.808451][T18301] erspan1: left allmulticast mode [ 1234.482353][ T998] usb 1-1: ath9k_htc: Firmware - ath9k_htc/htc_9271-1.4.0.fw download failed [ 1234.550884][ T36] usb 1-1: USB disconnect, device number 37 [ 1234.566512][ T36] usb 1-1: ath9k_htc: USB layer deinitialized [ 1235.889950][ T37] audit: type=1800 audit(2000000818.230:997): pid=18313 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.4200" name="p_chmask" dev="configfs" ino=70431 res=0 errno=0 [ 1236.405986][T14577] hsr_slave_0: left promiscuous mode [ 1236.419231][T18307] comedi comedi1: Minor 4 could not be opened [ 1236.445094][T14577] hsr_slave_1: left promiscuous mode [ 1236.446338][T14577] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1236.500356][T14577] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1237.484613][T18332] rdma_op ffff888060cf4ab8 conn xmit_rdma 0000000000000000 [ 1238.832360][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.832828][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 1240.031753][T14577] team0 (unregistering): Port device team_slave_1 removed [ 1240.110857][T14577] team0 (unregistering): Port device team_slave_0 removed [ 1240.650815][T18344] syz_tun: entered allmulticast mode [ 1240.658299][ T5249] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1241.415095][ T5610] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 1241.575800][ T5610] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1241.582536][ T5610] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1241.582563][ T5610] usb 7-1: Product: syz [ 1241.582578][ T5610] usb 7-1: Manufacturer: syz [ 1241.582593][ T5610] usb 7-1: SerialNumber: syz [ 1241.778843][ T5706] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1241.986519][ T36] usb 7-1: USB disconnect, device number 33 [ 1242.097878][ T5706] usb 7-1: ath9k_htc: Unable to allocate URBs [ 1242.107989][ T36] usb 7-1: ath9k_htc: USB layer deinitialized [ 1243.489536][ T37] audit: type=1800 audit(2000000825.820:998): pid=18374 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.6.4212" name="p_chmask" dev="configfs" ino=70623 res=0 errno=0 [ 1243.943317][T13197] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1244.030134][T13197] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1244.032623][T13197] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1244.068428][T13197] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1244.071653][T13197] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1244.821172][T18393] comedi comedi1: Minor 4 could not be opened [ 1246.368418][T13197] Bluetooth: hci3: command tx timeout [ 1248.440197][T13197] Bluetooth: hci3: command tx timeout [ 1248.670213][T18407] netlink: 61967 bytes leftover after parsing attributes in process `syz.5.4219'. [ 1248.919643][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 1248.919843][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 1250.519542][T13197] Bluetooth: hci3: command tx timeout [ 1250.910040][ T5727] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 1252.301051][ T5727] usb 1-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 1252.302416][ T5727] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1252.302445][ T5727] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 1024 [ 1252.302472][ T5727] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 1252.305641][ T5727] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1252.305664][ T5727] usb 1-1: Product: syz [ 1252.305677][ T5727] usb 1-1: Manufacturer: syz [ 1252.305691][ T5727] usb 1-1: SerialNumber: syz [ 1252.347141][T18420] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1252.384897][ T5727] usbserial_generic 1-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 1252.384972][ T5727] usbserial_generic 1-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 1252.385015][ T5727] usbserial_generic 1-1:1.0: generic converter detected [ 1252.417965][ T5727] usb 1-1: generic converter now attached to ttyUSB0 [ 1252.599570][T13197] Bluetooth: hci3: command tx timeout [ 1252.995377][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 1252.995533][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 1252.995785][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 1252.995880][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 1252.996064][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 1253.877923][ T5610] usb 1-1: USB disconnect, device number 38 [ 1253.908146][ T5610] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 1253.909126][ T5610] usbserial_generic 1-1:1.0: device disconnected [ 1254.137069][T14577] bridge_slave_1: left allmulticast mode [ 1254.137120][T14577] bridge_slave_1: left promiscuous mode [ 1254.137412][T14577] bridge0: port 2(bridge_slave_1) entered disabled state [ 1254.450100][T14577] bridge_slave_0: left allmulticast mode [ 1254.450149][T14577] bridge_slave_0: left promiscuous mode [ 1254.450422][T14577] bridge0: port 1(bridge_slave_0) entered disabled state [ 1255.097986][T14577] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1255.714951][T14577] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1255.918482][T14577] bond0 (unregistering): Released all slaves [ 1257.508618][ T5625] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1258.458734][ T5625] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1258.496254][ T5625] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1258.497377][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1258.501336][ T5625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1259.039111][T14577] hsr_slave_0: left promiscuous mode [ 1259.104254][T14577] hsr_slave_1: left promiscuous mode [ 1259.106632][T14577] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1259.142045][T14577] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1260.610732][ T5625] Bluetooth: hci1: command tx timeout [ 1262.680233][ T5625] Bluetooth: hci1: command tx timeout [ 1263.032420][T14577] team0 (unregistering): Port device team_slave_1 removed [ 1263.140325][T14577] team0 (unregistering): Port device team_slave_0 removed [ 1263.344659][ T37] audit: type=1800 audit(2000000845.680:999): pid=18509 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.6.4233" name="p_chmask" dev="configfs" ino=70870 res=0 errno=0 [ 1264.233672][T18518] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input59 [ 1264.289659][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1264.289693][ C1] bridge0: topology change detected, propagating [ 1264.292572][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1264.292592][ C1] bridge0: topology change detected, propagating [ 1264.760739][ T5625] Bluetooth: hci1: command tx timeout [ 1267.166060][ T5625] Bluetooth: hci1: command tx timeout [ 1278.956785][ T37] audit: type=1800 audit(2000000861.290:1000): pid=18577 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.6.4244" name="p_chmask" dev="configfs" ino=71057 res=0 errno=0 [ 1282.988248][T14577] bridge_slave_1: left allmulticast mode [ 1282.994779][T14577] bridge_slave_1: left promiscuous mode [ 1282.995070][T14577] bridge0: port 2(bridge_slave_1) entered disabled state [ 1283.164423][T14577] bridge_slave_0: left allmulticast mode [ 1283.170490][T14577] bridge_slave_0: left promiscuous mode [ 1283.170738][T14577] bridge0: port 1(bridge_slave_0) entered disabled state [ 1284.614510][T14577] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1284.853068][ T37] audit: type=1800 audit(2000000867.190:1001): pid=18614 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.6.4261" name="p_chmask" dev="configfs" ino=71127 res=0 errno=0 [ 1284.920245][ T5727] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 1285.032699][T14577] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1286.060175][ T5727] usb 1-1: Using ep0 maxpacket: 16 [ 1286.074344][ T5727] usb 1-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 1286.091251][ T5727] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 1286.104681][ T5727] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1286.104708][ T5727] usb 1-1: Product: syz [ 1286.104724][ T5727] usb 1-1: Manufacturer: syz [ 1286.104739][ T5727] usb 1-1: SerialNumber: syz [ 1286.134419][T14577] bond0 (unregistering): Released all slaves [ 1286.147900][ T5727] usb 1-1: config 0 descriptor?? [ 1286.213929][ T5727] hub 1-1:0.0: bad descriptor, ignoring hub [ 1286.222356][ T5727] hub 1-1:0.0: probe with driver hub failed with error -5 [ 1286.239048][ T5727] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1288.322865][T18629] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1288.738723][ T5610] usb 1-1: USB disconnect, device number 39 [ 1288.831973][T18379] bridge0: port 1(bridge_slave_0) entered blocking state [ 1288.832149][T18379] bridge0: port 1(bridge_slave_0) entered disabled state [ 1288.832366][T18379] bridge_slave_0: entered allmulticast mode [ 1289.055079][T18379] bridge_slave_0: entered promiscuous mode [ 1289.439293][T14577] hsr_slave_0: left promiscuous mode [ 1290.495282][T14577] hsr_slave_1: left promiscuous mode [ 1291.114796][T14577] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1291.764637][T14577] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1293.046076][ T37] audit: type=1800 audit(2000000875.380:1002): pid=18657 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.6.4270" name="p_chmask" dev="configfs" ino=71215 res=0 errno=0 [ 1294.712186][T14577] team0 (unregistering): Port device team_slave_1 removed [ 1294.772452][T14577] team0 (unregistering): Port device team_slave_0 removed [ 1295.190491][ T998] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 1295.200046][T18379] bridge0: port 2(bridge_slave_1) entered blocking state [ 1295.200235][T18379] bridge0: port 2(bridge_slave_1) entered disabled state [ 1295.200459][T18379] bridge_slave_1: entered allmulticast mode [ 1295.202926][T18379] bridge_slave_1: entered promiscuous mode [ 1295.257590][T18667] syzkaller0: entered promiscuous mode [ 1295.257614][T18667] syzkaller0: entered allmulticast mode [ 1295.350374][ T998] usb 6-1: Using ep0 maxpacket: 16 [ 1295.357980][ T998] usb 6-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 1295.359045][ T998] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 1295.381372][ T998] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1295.381442][ T998] usb 6-1: Product: syz [ 1295.381457][ T998] usb 6-1: Manufacturer: syz [ 1295.381471][ T998] usb 6-1: SerialNumber: syz [ 1295.393756][ T998] usb 6-1: config 0 descriptor?? [ 1295.399043][ T998] hub 6-1:0.0: bad descriptor, ignoring hub [ 1295.399078][ T998] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1295.406790][ T998] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1295.927438][T18379] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1295.952256][T18686] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1296.080432][T18379] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1298.723524][ T5610] usb 6-1: USB disconnect, device number 43 [ 1298.986315][T18379] team0: Port device team_slave_0 added [ 1299.041251][T18379] team0: Port device team_slave_1 added [ 1299.752726][T18379] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1299.761477][T18379] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1299.761511][T18379] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1299.764079][T18476] bridge0: port 1(bridge_slave_0) entered blocking state [ 1299.764274][T18476] bridge0: port 1(bridge_slave_0) entered disabled state [ 1299.764525][T18476] bridge_slave_0: entered allmulticast mode [ 1299.767349][T18476] bridge_slave_0: entered promiscuous mode [ 1299.853377][T18379] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1299.862653][T18379] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1299.862687][T18379] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1299.863941][T18476] bridge0: port 2(bridge_slave_1) entered blocking state [ 1299.864057][T18476] bridge0: port 2(bridge_slave_1) entered disabled state [ 1299.864269][T18476] bridge_slave_1: entered allmulticast mode [ 1299.866945][T18476] bridge_slave_1: entered promiscuous mode [ 1300.010953][ T37] audit: type=1800 audit(2000000882.260:1003): pid=18707 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.4281" name="p_chmask" dev="configfs" ino=71327 res=0 errno=0 [ 1300.126122][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.126260][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.218749][T18476] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1301.283757][T18476] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1302.449813][T18722] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input60 [ 1305.146581][T18476] team0: Port device team_slave_0 added [ 1305.184195][T18476] team0: Port device team_slave_1 added [ 1305.803586][T13197] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1305.914428][T13197] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1305.965961][T13197] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1305.976295][ T5610] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 1306.041938][T13197] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1306.046781][T13197] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1306.150727][ T5610] usb 7-1: Using ep0 maxpacket: 16 [ 1306.157701][ T5610] usb 7-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 1306.158851][ T5610] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 1306.161570][ T5610] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1306.161594][ T5610] usb 7-1: Product: syz [ 1306.161609][ T5610] usb 7-1: Manufacturer: syz [ 1306.161624][ T5610] usb 7-1: SerialNumber: syz [ 1306.576042][ T5610] usb 7-1: config 0 descriptor?? [ 1306.594976][ T5610] hub 7-1:0.0: bad descriptor, ignoring hub [ 1306.595010][ T5610] hub 7-1:0.0: probe with driver hub failed with error -5 [ 1306.624499][ T5610] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1306.641699][T18476] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1306.649020][T18476] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1306.649051][T18476] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1306.763207][T18476] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1306.763283][T18476] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1306.763307][T18476] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1307.963485][ T5610] usb 7-1: USB disconnect, device number 34 [ 1307.974844][T18745] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1308.171813][ T37] audit: type=1800 audit(2000000890.510:1004): pid=18748 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.4291" name="p_chmask" dev="configfs" ino=71428 res=0 errno=0 [ 1308.606057][T18754] rdma_op ffff88803b2bcab8 conn xmit_rdma 0000000000000000 [ 1308.701063][ T5625] Bluetooth: hci4: command tx timeout [ 1309.093725][T18636] udevd[18636]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1309.410614][T18758] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input61 [ 1310.760304][ T5625] Bluetooth: hci4: command tx timeout [ 1312.208613][T18476] hsr_slave_0: entered promiscuous mode [ 1312.223466][T18476] hsr_slave_1: entered promiscuous mode [ 1312.238088][T18476] debugfs: 'hsr0' already exists in 'hsr' [ 1312.238113][T18476] Cannot create hsr debugfs directory [ 1313.246902][ T5625] Bluetooth: hci4: command tx timeout [ 1315.071212][T18775] comedi comedi1: Minor 4 could not be opened [ 1315.321470][ T5625] Bluetooth: hci4: command tx timeout [ 1315.467560][T18781] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1315.955755][ T37] audit: type=1800 audit(2000000898.290:1005): pid=18784 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.6.4301" name="p_chmask" dev="configfs" ino=71571 res=0 errno=0 [ 1317.788390][T18731] bridge0: port 1(bridge_slave_0) entered blocking state [ 1317.788574][T18731] bridge0: port 1(bridge_slave_0) entered disabled state [ 1317.788796][T18731] bridge_slave_0: entered allmulticast mode [ 1317.811360][T18731] bridge_slave_0: entered promiscuous mode [ 1317.822206][T18731] bridge0: port 2(bridge_slave_1) entered blocking state [ 1317.822424][T18731] bridge0: port 2(bridge_slave_1) entered disabled state [ 1317.822627][T18731] bridge_slave_1: entered allmulticast mode [ 1317.838438][T18731] bridge_slave_1: entered promiscuous mode [ 1317.840892][T18797] EXT4-fs (nullb0): VFS: Can't find ext4 filesystem [ 1318.286170][T18808] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1318.364431][T13197] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1318.453218][T13197] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1318.473263][T13197] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1318.487558][T13197] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1318.496552][T13197] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1318.830564][T18731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1318.904351][T18731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1319.769974][T18731] team0: Port device team_slave_0 added [ 1319.777637][T18731] team0: Port device team_slave_1 added [ 1320.615815][T18731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1320.625334][T18731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1320.625368][T18731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1320.715120][T18731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1320.715175][T18731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1320.715191][T18731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1320.759650][ T5625] Bluetooth: hci3: command tx timeout [ 1320.870515][T14577] bridge_slave_1: left allmulticast mode [ 1320.870603][T14577] bridge_slave_1: left promiscuous mode [ 1320.870836][T14577] bridge0: port 2(bridge_slave_1) entered disabled state [ 1321.212365][T14577] bridge_slave_0: left allmulticast mode [ 1321.212442][T14577] bridge_slave_0: left promiscuous mode [ 1321.218233][T14577] bridge0: port 1(bridge_slave_0) entered disabled state [ 1322.421072][ T5727] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 1322.873964][ T5625] Bluetooth: hci3: command tx timeout [ 1323.050211][ T5727] usb 1-1: New USB device found, idVendor=05ac, idProduct=024f, bcdDevice= 0.00 [ 1323.051535][ T5727] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1323.051563][ T5727] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8192, setting to 1024 [ 1323.051603][ T5727] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1323.062134][T14577] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1323.077699][ T5727] usb 1-1: config 0 descriptor?? [ 1324.761417][T14577] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1324.859630][T14577] bond0 (unregistering): Released all slaves [ 1324.911181][ C1] ================================================================== [ 1324.911202][ C1] BUG: KASAN: slab-use-after-free in dummy_timer+0xd1f/0x4d50 [ 1324.911235][ C1] Read of size 1 at addr ffff88803c5bad12 by task ktimers/1/29 [ 1324.911245][ C1] [ 1324.911255][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1324.911271][ C1] Tainted: [L]=SOFTLOCKUP [ 1324.911275][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1324.911283][ C1] Call Trace: [ 1324.911288][ C1] [ 1324.911295][ C1] dump_stack_lvl+0xe8/0x150 [ 1324.911315][ C1] print_address_description+0x55/0x1e0 [ 1324.911351][ C1] ? dummy_timer+0xd1f/0x4d50 [ 1324.911368][ C1] print_report+0x58/0x70 [ 1324.911383][ C1] kasan_report+0x117/0x150 [ 1324.911401][ C1] ? dummy_timer+0xd1f/0x4d50 [ 1324.911420][ C1] dummy_timer+0xd1f/0x4d50 [ 1324.911439][ C1] ? __lock_acquire+0x6df/0x2e40 [ 1324.911457][ C1] ? __lock_acquire+0x6df/0x2e40 [ 1324.911475][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1324.911490][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 1324.911507][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1324.911524][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 1324.911541][ C1] __hrtimer_run_queues+0x3eb/0xaf0 [ 1324.911559][ C1] hrtimer_run_softirq+0x1e1/0x2e0 [ 1324.911573][ C1] handle_softirqs+0x1da/0x6d0 [ 1324.911592][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 1324.911609][ C1] run_ktimerd+0x6a/0x100 [ 1324.911625][ C1] smpboot_thread_fn+0x565/0xa70 [ 1324.911642][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 1324.911660][ C1] kthread+0x38b/0x470 [ 1324.911671][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 1324.911688][ C1] ? __pfx_kthread+0x10/0x10 [ 1324.911705][ C1] ret_from_fork+0x514/0xb70 [ 1324.911718][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1324.911729][ C1] ? __switch_to+0xc89/0x1420 [ 1324.911746][ C1] ? __pfx_kthread+0x10/0x10 [ 1324.911757][ C1] ret_from_fork_asm+0x1a/0x30 [ 1324.911772][ C1] [ 1324.911776][ C1] [ 1324.911781][ C1] Allocated by task 17949: [ 1324.911842][ C1] kasan_save_track+0x3e/0x80 [ 1324.911856][ C1] __kasan_kmalloc+0x93/0xb0 [ 1324.911870][ C1] __kmalloc_cache_noprof+0x3d5/0x680 [ 1324.911884][ C1] __ipv6_dev_mc_inc+0x447/0xa40 [ 1324.911933][ C1] ipv6_add_dev+0xe83/0x1400 [ 1324.911990][ C1] addrconf_notify+0x771/0x1050 [ 1324.912004][ C1] notifier_call_chain+0x1a5/0x3d0 [ 1324.912020][ C1] register_netdevice+0x18c0/0x1ed0 [ 1324.912040][ C1] veth_newlink+0x6a2/0xdd0 [ 1324.912084][ C1] rtnl_newlink_create+0x305/0x7b0 [ 1324.912102][ C1] rtnl_newlink+0x166d/0x1c30 [ 1324.912113][ C1] rtnetlink_rcv_msg+0x802/0xc00 [ 1324.912124][ C1] netlink_rcv_skb+0x226/0x4a0 [ 1324.912140][ C1] netlink_unicast+0x7f5/0x990 [ 1324.912152][ C1] netlink_sendmsg+0x813/0xb40 [ 1324.912166][ C1] sock_sendmsg_nosec+0x13a/0x180 [ 1324.912176][ C1] __sys_sendto+0x41e/0x5d0 [ 1324.912188][ C1] __x64_sys_sendto+0xde/0x100 [ 1324.912199][ C1] do_syscall_64+0x166/0x520 [ 1324.912211][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1324.912221][ C1] [ 1324.912224][ C1] Freed by task 20: [ 1324.912229][ C1] kasan_save_track+0x3e/0x80 [ 1324.912242][ C1] kasan_save_free_info+0x40/0x50 [ 1324.912252][ C1] __kasan_slab_free+0x5c/0x80 [ 1324.912265][ C1] __rcu_free_sheaf_prepare+0x12d/0x2a0 [ 1324.912281][ C1] rcu_free_sheaf+0x31/0x210 [ 1324.912294][ C1] rcu_cpu_kthread+0xb2c/0x1740 [ 1324.912307][ C1] smpboot_thread_fn+0x565/0xa70 [ 1324.912322][ C1] kthread+0x38b/0x470 [ 1324.912331][ C1] ret_from_fork+0x514/0xb70 [ 1324.912340][ C1] ret_from_fork_asm+0x1a/0x30 [ 1324.912349][ C1] [ 1324.912351][ C1] The buggy address belongs to the object at ffff88803c5bac00 [ 1324.912351][ C1] which belongs to the cache kmalloc-512 of size 512 [ 1324.912361][ C1] The buggy address is located 274 bytes inside of [ 1324.912361][ C1] freed 512-byte region [ffff88803c5bac00, ffff88803c5bae00) [ 1324.912374][ C1] [ 1324.912377][ C1] The buggy address belongs to the physical page: [ 1324.912387][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c5b8 [ 1324.912398][ C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1324.912407][ C1] flags: 0x80000000000040(head|node=0|zone=1) [ 1324.912417][ C1] page_type: f5(slab) [ 1324.912428][ C1] raw: 0080000000000040 ffff88813ffbbc80 dead000000000100 dead000000000122 [ 1324.912438][ C1] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1324.912449][ C1] head: 0080000000000040 ffff88813ffbbc80 dead000000000100 dead000000000122 [ 1324.912458][ C1] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1324.912468][ C1] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 1324.912477][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 1324.912483][ C1] page dumped because: kasan: bad access detected [ 1324.912493][ C1] page_owner tracks the page as allocated [ 1324.912497][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 14307, tgid 14303 (syz.0.3214), ts 652805469827 [ 1324.912516][ C1] post_alloc_hook+0x1f9/0x250 [ 1324.912528][ C1] get_page_from_freelist+0x2591/0x2600 [ 1324.912543][ C1] __alloc_frozen_pages_noprof+0x230/0x5c0 [ 1324.912557][ C1] allocate_slab+0x7d/0x620 [ 1324.912566][ C1] refill_objects+0x2d8/0x350 [ 1324.912576][ C1] __pcs_replace_empty_main+0x339/0x690 [ 1324.912592][ C1] __kmalloc_cache_noprof+0x46f/0x680 [ 1324.912605][ C1] snd_mixer_oss_build_test+0x7a/0x380 [ 1324.912657][ C1] snd_mixer_oss_build_input+0x626/0x1370 [ 1324.912671][ C1] snd_mixer_oss_notify_handler+0x93f/0x1050 [ 1324.912686][ C1] snd_card_register+0x589/0x720 [ 1324.912730][ C1] f_midi2_bind+0x1562/0x2c40 [ 1324.912779][ C1] usb_add_function+0x290/0x930 [ 1324.912843][ C1] configfs_composite_bind+0xde0/0x1410 [ 1324.912857][ C1] gadget_bind_driver+0x2ca/0x9e0 [ 1324.912867][ C1] really_probe+0x254/0xae0 [ 1324.912929][ C1] page last free pid 4954 tgid 4954 ts 649020708120 stack trace: [ 1324.912938][ C1] __free_frozen_pages+0xf8e/0x1070 [ 1324.912950][ C1] __slab_free+0x250/0x2a0 [ 1324.912963][ C1] qlist_free_all+0x99/0x100 [ 1324.912975][ C1] kasan_quarantine_reduce+0x148/0x160 [ 1324.912987][ C1] __kasan_slab_alloc+0x22/0x80 [ 1324.913000][ C1] __kmalloc_noprof+0x3b9/0x790 [ 1324.913013][ C1] tomoyo_realpath_from_path+0xef/0x640 [ 1324.913027][ C1] tomoyo_path_perm+0x283/0x560 [ 1324.913036][ C1] security_inode_getattr+0x12b/0x310 [ 1324.913052][ C1] __x64_sys_newfstat+0x133/0x270 [ 1324.913072][ C1] do_syscall_64+0x166/0x520 [ 1324.913083][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1324.913095][ C1] [ 1324.913098][ C1] Memory state around the buggy address: [ 1324.913104][ C1] ffff88803c5bac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1324.913112][ C1] ffff88803c5bac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1324.913122][ C1] >ffff88803c5bad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1324.913128][ C1] ^ [ 1324.913134][ C1] ffff88803c5bad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1324.913141][ C1] ffff88803c5bae00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1324.913147][ C1] ================================================================== [ 1324.913169][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1325.633174][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1325.644298][ C1] Tainted: [L]=SOFTLOCKUP [ 1325.648610][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1325.658649][ C1] Call Trace: [ 1325.661928][ C1] [ 1325.664846][ C1] vpanic+0x56d/0xa60 [ 1325.668822][ C1] ? __pfx_vpanic+0x10/0x10 [ 1325.673316][ C1] panic+0xc5/0xd0 [ 1325.677033][ C1] ? __pfx_panic+0x10/0x10 [ 1325.681444][ C1] ? dummy_timer+0xd1f/0x4d50 [ 1325.686132][ C1] ? dummy_timer+0xd1f/0x4d50 [ 1325.690805][ C1] check_panic_on_warn+0x89/0xb0 [ 1325.695738][ C1] ? dummy_timer+0xd1f/0x4d50 [ 1325.700416][ C1] end_report+0x73/0x170 [ 1325.704657][ C1] ? dummy_timer+0xd1f/0x4d50 [ 1325.709330][ C1] kasan_report+0x128/0x150 [ 1325.713832][ C1] ? dummy_timer+0xd1f/0x4d50 [ 1325.718506][ C1] dummy_timer+0xd1f/0x4d50 [ 1325.723011][ C1] ? __lock_acquire+0x6df/0x2e40 [ 1325.727945][ C1] ? __lock_acquire+0x6df/0x2e40 [ 1325.732881][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1325.738245][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 1325.743181][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1325.748977][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 1325.753912][ C1] __hrtimer_run_queues+0x3eb/0xaf0 [ 1325.759109][ C1] hrtimer_run_softirq+0x1e1/0x2e0 [ 1325.764213][ C1] handle_softirqs+0x1da/0x6d0 [ 1325.768973][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 1325.773995][ C1] run_ktimerd+0x6a/0x100 [ 1325.778320][ C1] smpboot_thread_fn+0x565/0xa70 [ 1325.783257][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 1325.788281][ C1] kthread+0x38b/0x470 [ 1325.792340][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 1325.797792][ C1] ? __pfx_kthread+0x10/0x10 [ 1325.802368][ C1] ret_from_fork+0x514/0xb70 [ 1325.806947][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1325.812044][ C1] ? __switch_to+0xc89/0x1420 [ 1325.816720][ C1] ? __pfx_kthread+0x10/0x10 [ 1325.821300][ C1] ret_from_fork_asm+0x1a/0x30 [ 1325.826059][ C1] [ 1325.829313][ C1] Kernel Offset: disabled [ 1325.833625][ C1] Rebooting in 86400 seconds..