last executing test programs: 5.259009739s ago: executing program 1 (id=35): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) (fail_nth: 2) 5.206031417s ago: executing program 1 (id=36): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x40e02, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448ca, 0x0) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0x0, 0x1}, 0x6) write$rfkill(r0, &(0x7f0000000300)={0x0, 0x2, 0x3, 0x1, 0x1}, 0x8) 4.657813454s ago: executing program 3 (id=38): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/kernel/mm/ksm/sleep_millisecs\x00', 0x1, 0x0) write(r0, &(0x7f0000000080)='\f', 0x1) 4.563646116s ago: executing program 3 (id=39): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000300)='cifs\x00', 0x0, &(0x7f0000000400)='vers=3.0,username=guest,password=,port=20000,hard\x00') (async) r1 = accept(r0, 0x0, 0x0) write(r1, &(0x7f0000000500)="00000010", 0x4) close(r1) accept(r0, 0x0, 0x0) nanosleep(&(0x7f0000000600)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/kernel/mm/ksm/sleep_millisecs\x00', 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) write(r2, &(0x7f0000000080)='\f', 0x1) 4.120637303s ago: executing program 0 (id=42): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) eventfd2(0x9, 0x800) socket$inet_sctp(0x2, 0x1, 0x84) syz_io_uring_setup(0x3b83, &(0x7f0000000240)={0x0, 0x59db, 0x800, 0x6, 0x2be}, 0x0, 0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001200), 0x2, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r1, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000020c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000011c0)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4ea5, 0x9, @mcast1, 0x8}, r2, 0x8001}}, 0x48) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) (fail_nth: 2) 4.068631163s ago: executing program 1 (id=43): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0x0, 0x2) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a70020000090a010400000000000000000a0000050900010073797a310000000008000540000000020900020073797a310000000034020980300102802c0001800800014000000001080001400000000208000140000000020800014080000000080bec4f56000140000001ff14000180080001400000004008000140000000003400018008000140000000050800014000000004080001400000000308000140000000000800014000000003080001400000000514000180080001400000000008000140000000034400a9367ca23d018008000140000000a108000140000000020800014000000000080001400000059b080001400000060a080001400000000d080001400000000708000140000000033400018008000140fffffff10800014000000040080001400000004008000140fffffff70800014000000007080001400000d6c32c00018008000140000000010800014000000038080001400007007f08000140000000000800014000000006f0000280240001800800014000000001080001400000000208000140fffffffa080001400000007f0c000180080001400000000234000180080001400000000e080001400000001008000140000000040800014000000008080001400000546e08000140000000003c0001800800014000000bc20800014000000008080001400000000b0800014000000008080001407fffffff080001400000079508000140ffffffa614000180080001400000000708000140000000061400018008000140000000ff0800014000000009240001800800014000000007080001400000000508000140000000080800014000000002080001400000000508000140ffffffff0800084000000001140000001100010000000000000000"], 0x298}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 3.737637137s ago: executing program 0 (id=45): r0 = syz_open_dev$I2C(&(0x7f0000000480), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0xa0900, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r3, r3, &(0x7f0000162000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000040)="2e0f785c7f06660fc7b503000000b9ec0200000f320f300f784e0026660fc7b69edf0000b8010000000f01c1ea53000000be000f20c035000004000f22c03e0fc75fab", 0x43}], 0x1, 0x5a, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x26000, 0xdddd1000, {}, 0x0, 0x5}, {"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008bc584c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f6f3874000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ecff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000001a49000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b6e6f1b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000"}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = fanotify_init(0x4, 0x400) readv(r4, &(0x7f0000002ec0)=[{&(0x7f0000000a40)=""/220, 0xdc}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./proc/net/rpc/auth.unix.ip/content\x00', 0x0, 0x0) read(r5, &(0x7f0000000c00)=""/4096, 0x1000) read$qrtrtun(r5, &(0x7f0000000000)=""/28, 0x1c) read$FUSE(r5, &(0x7f0000001c00)={0x2020}, 0x2020) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) prlimit64(0x0, 0x7, &(0x7f0000000200), 0x0) fanotify_mark(r4, 0x1, 0x40001019, r6, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000180)={&(0x7f0000000400)=[{0x0, 0x0, 0x20, 0x0}, {0x0, 0x0, 0x2, &(0x7f0000000880)="d40b"}], 0x2a}) 3.295671925s ago: executing program 3 (id=47): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}, 0x2, 0xfffffffd, 0x1}}, 0x2e) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0xdcc, 0x4) 3.208447144s ago: executing program 1 (id=48): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000040)={[0x8633, 0x9, 0x1, 0xc0, 0x405, 0x4, 0x32, 0x89, 0x71f6139e, 0x7, 0x100000002, 0x6, 0x8, 0x7, 0xff, 0x20000000400eee0], 0xffe}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x6, 0xfffffffffffffffe}) write(r0, &(0x7f0000001640)="8b", 0x1) 3.150707546s ago: executing program 0 (id=49): r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r1 = syz_create_resource$binfmt(&(0x7f0000000140)='./file1\x00') execveat$binfmt(0xffffffffffffff9c, r1, 0x0, 0x0, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, 0x0, 0x2000c800) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x91bc, 0x2) syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000540)={0x2, @win={{0x6, 0x1, 0x1ff, 0x70}, 0x5, 0x4, 0x0, 0x2, 0x0, 0x1}}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r3, &(0x7f0000000100)={0x1f, 0x0, @any, 0x40}, 0xe) connect$bt_l2cap(r3, &(0x7f0000000200)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x40}, 0xe) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000300)={r3}) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) getsockopt$SO_COOKIE(r4, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000080)={r3, 0x1, 0x7}) (fail_nth: 2) 3.083753663s ago: executing program 3 (id=50): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mounts\x00') (async) r1 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) (async) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000020c0), 0x2000413, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00d?', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',max_read=0x0000000000000000,\x00']) read$FUSE(r0, &(0x7f0000002340)={0x2020}, 0x2020) 2.753933326s ago: executing program 1 (id=51): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000040)={[0x8633, 0x9, 0x1, 0xc0, 0x405, 0x4, 0x32, 0x89, 0x71f6139e, 0x7, 0x100000002, 0x6, 0x8, 0x7, 0xff, 0x20000000400eee0], 0xffe}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x6, 0xfffffffffffffffe}) write(r0, &(0x7f0000001640)="8b", 0x1) (fail_nth: 2) 2.722685411s ago: executing program 0 (id=52): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000000)="ebe301e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e005", 0x26}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48", 0xbd}, {&(0x7f0000000600)="e7c4a6e597cc7e8b95de55bc84f821a2a9844814391e7c66b854f436d622ee02daae0c61de8735b7c5bd9540c552524539dec5081252c56f1009992539ecabe72653027c6c1493e7bff0df50a27985df8294e6c71b2b733666dd4cad621da1c7cb496e6ee040430551b9b8265c12cfe9b90b77c0dee89b97b8630eff0eb9265b5cc4243048cccbaa", 0x88}], 0x4, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x1}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 2.647536378s ago: executing program 3 (id=53): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000d00), r0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x808000, 0x4, 0x20300, 0xfc, 0x2000000}, 0x1c) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000340)={0x1, 0xb}, 0x8) (async) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000340)={0x1, 0xb}, 0x8) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x8, 0x20132, 0xffffffffffffffff, 0xb2993000) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x8, 0x20132, 0xffffffffffffffff, 0xb2993000) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="290e29bd7000fbdbdf052700000005003100030000000a0001007770616e310000002463157cc4c006f684ba05b2327ffae713cf3aec7f0062b6fab2057133e9145b6e9906f2680994d22b7ab43996496e91871a69b287"], 0x28}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) (async) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="290e29bd7000fbdbdf052700000005003100030000000a0001007770616e310000002463157cc4c006f684ba05b2327ffae713cf3aec7f0062b6fab2057133e9145b6e9906f2680994d22b7ab43996496e91871a69b287"], 0x28}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r0) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000000)="b9800000c00f3235004000000f30b9fa000000130f01d9300d76c4020a1bf7b805000000b90000c0fe0f3cae0a41d941d900b80c0000000f23c00f21f83501000f000f23f8ba00e500000f30660fc775022e0fba600c9864660ffc76002f3166b85766baa00066ed00d0", 0x6a}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_NMI(r8, 0xae9a) (async) ioctl$KVM_NMI(r8, 0xae9a) ioctl$KVM_SET_CPUID2(r8, 0x4008ae90, &(0x7f00000005c0)={0x1, 0x0, [{0x80000008, 0x2, 0xa, 0x1, 0xfffffff9, 0x6, 0x6b89}]}) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r9, 0x8933, &(0x7f0000000ec0)={'wpan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r9, 0x8933, &(0x7f0000000ec0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x40, r5, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_SEC_KEY={0x24, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x20, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x300}]}]}]}]}, 0x40}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan3\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan3\x00', 0x0}) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r12, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) r14 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r12) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r12, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002880)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="01002abd7000ffdbdf251e00000008000300", @ANYRES32=r13, @ANYBLOB="30002f802000038014008f210800020003000000060001000200000008000100030000000c0002"], 0x4c}, 0x1, 0x0, 0x0, 0x4883}, 0x4894) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x44, r4, 0x100, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r13}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x8050) (async) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x44, r4, 0x100, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r13}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x8050) writev(r3, &(0x7f000000cac0)=[{&(0x7f0000000000)="c7c6079c0213a13dce386a64f869aaa51e9b3b39347200"/33, 0x21}], 0x1) 2.218431514s ago: executing program 1 (id=54): ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000040)={0xffffff2a, 0x9, 0x4, 0x0, 0x6, "012f2e20e1430ecd7d6435b5aa19489de4cc57", 0x1, 0x8}) r0 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000004180)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x400}, 0x0, 0x0, 0x2, 0x6, 0x4, 0x8, 0x8, 0xf, 0x6, 0x8}) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffffb]}, 0x8, 0x0) readv(r1, &(0x7f0000000340)=[{&(0x7f0000000100)=""/158, 0x9e}], 0x1) landlock_restrict_self(0xffffffffffffffff, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0xb}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0xfffffff8}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_NG_TYPE={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 2.207589764s ago: executing program 0 (id=55): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096231306e53f070f0000002a940183"], 0x0}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r1, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) setns(0xc9, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/llc/socket\x00') sendfile(r1, r2, &(0x7f0000000100)=0xa5, 0xff) syz_usb_connect$hid(0x5d5da1a1b8faf21f, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x4d9, 0xa072, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x3, 0x20, 0x6, "", [{{0x9, 0x4, 0x0, 0xd6, 0x1, 0x3, 0x1, 0x6, 0xff, {0x9, 0x21, 0x800, 0xfa, 0x1, {0x22, 0xcc3}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0xe4, 0x8}}}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x200, 0xa, 0xe, 0x3, 0x40, 0x7}, 0x19, &(0x7f0000000100)={0x5, 0xf, 0x19, 0x4, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x4, 0x0, 0x9e, 0x0, 0x1, 0x2}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x7, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x446}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x843}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x80a}}, {0x29, &(0x7f0000000240)=@string={0x29, 0x3, "6058827e4ed4d78b11d636fb96dfed0194a7371b4d52eb63f10fb3304da2564d96dff4722701cd"}}, {0x9b, &(0x7f0000000280)=@string={0x9b, 0x3, "25a502afa9bb3967375231a4c70c46277fc014a53fedddc80b1a6f1c150af3d721f7c5d615a69bf47e85bec2d2824ca921cb522eade6f492b6d2bbdc4a2d734502f96108b3d29cfbf24276064049cf0d53b91a29f527cab085a0f2ea778977cd49ed8b762e81b0fcf3b8da90add1a8d8b88520397b2d58c4cdf9870a022a6f16c23c150051a59bb623b41cdc9c0b1254a34e3aff53de7b41bb"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x843}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x424}}]}) 1.220999385s ago: executing program 2 (id=58): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)={0x28, r1, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x85}, 0x4c040) 1.122001428s ago: executing program 2 (id=59): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x48094}, 0x20001040) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) eventfd(0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r1, 0x3ba0, &(0x7f0000000d40)={0x4c, 0x16, 0x0, 0x0, 0x1000, &(0x7f0000ffc000)}) 1.062824086s ago: executing program 3 (id=60): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x48094}, 0x20001040) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000d40)='rpc_pipefs\x00', 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x20100) r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) write$char_usb(r1, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r2 = dup(0xffffffffffffffff) write$UHID_INPUT(r2, &(0x7f0000001040)={0xe, {"a2e3ad21ed0d52f90b9b39094bf70e06d038e7ff7fc6e5539b324b298b089b3208376d090890e0878f0e1ac6e7049b334a959bfc9a240d2567f3988f7ef319520100ffe8d1780700523c921b1b9b31310d075d0936cd3b78130daa61f94b61404d64aec1b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c088215ec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6f44ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d208001349b41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2a15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee53259289d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c1980778efa5ea567b7b7430acc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a0700d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8440daaa69bf5c8f4350aeae9ca1207e76061b28f27da19acc7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211c7847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7beddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e781171e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b906ce2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf3f2aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7ae288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289d8523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c78e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e7c7b2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df06720ba2b26bbfcc807c8aabb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db38b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1040}}, 0x1006) syz_open_dev$char_usb(0xc, 0xb4, 0x1c0000000000) mremap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffc000/0x3000)=nil) timer_create(0x5, &(0x7f0000000300)={0x0, 0x2, 0x0, @thr={&(0x7f0000000180)="2365d38c908c9810bb46a8121053a5e3d2ade9be9733cc50dcc26ebeb73e0c5944ef1a749c7324df9a225b29b92cf3d6501c3a59ac", &(0x7f00000001c0)="f2868312780e2579873d31853686832f71da85a50d2c3950d878fc2e0dfdd6a609c15f6384e5fb769e4d30c74472208dfae518bf43e89eaff59b826c4e944cdf11ffc3fd7f39c029e827fc792e80e872cfc41865924189ec7783ef5c8815d6c26514ca"}}, &(0x7f0000000340)=0x0) socket$can_j1939(0x1d, 0x2, 0x7) timer_settime(r3, 0x1, &(0x7f0000000380), &(0x7f00000003c0)={{0x0}, {0x0}}) syz_usb_disconnect(r0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r6, &(0x7f0000000000)='3', 0x4e) eventfd(0x0) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="240000001e", 0x5) r8 = syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r8, 0xc0105500, &(0x7f0000000800)=ANY=[@ANYRES32=r5, @ANYRES64]) r9 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TRIM(r9, &(0x7f0000000e40)={&(0x7f00000000c0), 0xc, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x3f6, 0x800, 0x70bd28, 0x25dfdbfd, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000851}, 0x800) write$P9_RSTATu(r7, &(0x7f0000000900)=ANY=[@ANYBLOB="9d0200000200000005d700000004000000040000000007000000000000000000810300000000070003e800000000000000001b00046e"], 0x29d) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r10 = syz_usb_connect$uac2(0x6, 0x136, &(0x7f0000000440)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x124, 0x3, 0x1, 0x7, 0x0, 0x8, {0x8, 0xb, 0x0, 0x0, 0x1, 0x9, 0x20, 0x3}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xb4, 0x8, 0x51, 0x6}, [@output_terminal={0xc, 0x24, 0x3, 0x6, 0x100, 0x9, 0x4, 0x7, 0x401, 0x2}, @input_terminal={0x10, 0x24, 0x2, 0x2, 0x202, 0x4, 0x0, 0x18, 0x1, 0xfb, 0xc, 0x79}, @processing_unit={0xd, 0x24, 0x8, 0x3, 0x4, [0x2, 0x2, 0x1, 0x1]}, @sample_rate={0x13, 0x24, 0xd, 0x2, 0x1, 0x6, [0x1, 0x3, 0x2, 0x2, 0x1, 0x3]}, @extension_unit={0xc, 0x24, 0x9, 0x4, 0x5, 0x9, "dfcfd48932"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x7, 0x7, 0x1, "1e62d7baf1"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x2}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x9, 0x0, 0x5d, 0x2, 0x1}, @as_header={0x10, 0x24, 0x1, 0x0, 0x9, 0x1, 0x4, 0x2, 0x8, 0x6}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x9, 0x6, 0xf7, {0x8, 0x25, 0x1, 0xc1, 0xf, 0x1, 0xc}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@as_header={0x10, 0x24, 0x1, 0x0, 0x4, 0x3, 0x0, 0x4, 0xffff, 0xf}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x7}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0xdc}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x7, 0x1, 0x4, 0x6b, "cfe5aa3a1520bdbc99"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x3, 0x0, 0x7, 0xfd}, @as_header={0x10, 0x24, 0x1, 0x7, 0x7f, 0x2, 0x4, 0xe0, 0x1ff}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x7, 0xf2, 0x2, {0x8, 0x25, 0x1, 0x81, 0xc, 0xc, 0x1}}}}}}}}]}}, &(0x7f0000000980)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x310, 0x8, 0x6, 0x8, 0xff}, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="20058a"], 0x6, [{0x4, &(0x7f0000000640)=ANY=[@ANYRESDEC=r4]}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x1c0a}}, {0xbd, &(0x7f0000000740)=@string={0xbd, 0x3, "08d476b31b2ccabf467fd8cefae786959bb67e0a1391c3d24490f54230876ba5160f0692b00a2d05900343fb0f4fd5144c1cd7b8023ee764327545d6aebe923257ed4254c1ae95d4767e77f8e400f1443033a24059a1c584664480a8d96da6efb31a0ebdcf4006a1727f37087a26cf1dad0aaa2a58644312711a793f36fba190cbefc0f933519e921a1351519a01c079561b66def66b321ab5a275e96d4d1bfa353f8767fcad37d6f13652754e5c191cbe08c2d7c3c5d7b81ff0ef"}}, {0x1e, &(0x7f0000000d80)=ANY=[@ANYBLOB="1e03867d255b9c77427f00007955ef77ce53c7a53ad4d6b1657fcbb20cc4dcf73c3395"]}, {0xc4, &(0x7f0000000840)=@string={0xc4, 0x3, "1f52806599926493abe9b60cfe74e1cb67e345128eee639bc194f246c49ab58268640afc0d9dedf453aaf40b747fe8ad010afd6b8a6f87d6a366d65e988f75cbc543c43444d6c4ce7d0788172aa88e6d76659381220f67dae342231670de7feecf7911eff72dd0cfb660d1f27d8063777cb61d88e3c8863aeeb0ffb77b9c7a5be7b9225ad155def5c7db30ff1870f123da3eae317cc1c77e8708f7ef18783c6184dde8b32ade1bc9b9fc0e5b5f6b09c75215c8bfdc6feea917e868a641a0bf602a08"}}, {0xbd, &(0x7f0000000240)=@string={0xbd, 0x3, "16f5e025de75f86239f54f61a00d475e02b6d26d8af60dc36655eb0b6bf440692a61d941b2092fa110813a7637bed1e7d2715f90b127a59763b35a1466b35dd3dd76ae9c7d7a3cce47aee617f781e545a4da81f2bc0fdfd5e1311c86c35b59ec84144c456dbe786a778ee11d8dd9143595f2c503205d4e6390cc3f31142113bce427c9e81b38b850617c220ba431b84ff2ef943771196817b96f7b878f56e39df99dc57e5c930bfd77b87fd294694fca2b5d32188717a868104f66"}}]}) syz_usb_control_io$uac2(r10, &(0x7f0000000b00)={0x14, &(0x7f0000000a00)={0x20, 0x2a, 0x2e, {0x2e, 0x23, "76ce912fffe094498906522b3a72f94456cfecc402e4f1dd80900b048196edbcd466e2ac8c9cc463ec6a58dc"}}, &(0x7f0000000a40)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x423}}}, &(0x7f0000000dc0)={0x44, &(0x7f0000000b40)={0x40, 0xa, 0x1d, "b568c57ffb2f42e4091dfe3b1e3f581d808b05c31f9560608a42920490"}, &(0x7f0000000b80)={0x0, 0xa, 0x1, 0xfe}, &(0x7f0000000bc0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000c00)={0x20, 0x81, 0x1, '2'}, &(0x7f0000000c40)={0x20, 0x82, 0x2, 'y5'}, &(0x7f0000000c80)={0x20, 0x83, 0x1, "eb"}, &(0x7f0000000cc0)={0x20, 0x84, 0x1, "ce"}, &(0x7f0000000d00)={0x20, 0x85, 0x3, "95db27"}}) 713.757719ms ago: executing program 2 (id=61): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="340000002000010025bd7000000000000a00000008001600", @ANYRES32=0x0, @ANYBLOB="1800178014", @ANYBLOB="74d68b"], 0x34}, 0x1, 0x0, 0x0, 0x40940}, 0x0) 527.043206ms ago: executing program 2 (id=62): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x400000000000027c, &(0x7f0000000080)}) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000004a40)={0x10, 0x0, &(0x7f00000001c0)=[@increfs={0x40046304, 0x3}, @release], 0x0, 0x0, 0x0}) (async) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3801000010000100feffffbf000100000000000000000000000000000000000000000000000000000000ffffac1414bb000103944e230005000000003b000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c0000000a010101000000000000000000000000000000000000000009000000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff000000000000000000000000001f00000000000000ff0100000000000002000000fcffffff000000002abd7000043500000a0001fd61746500"/224], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) (async) readv(r4, &(0x7f0000000600)=[{&(0x7f0000000540)=""/165, 0xa5}], 0x1) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="210f00000000000000002000000008000300", @ANYRES32=r6], 0x1c}, 0x1, 0x0, 0x0, 0x20000015}, 0x44090) sendmsg$NL80211_CMD_SET_KEY(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000380)={0x34, r5, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_SEQ={0x10, 0xa, "5bb3b05f22bbd02803251e43"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "2800fef000"}]}, 0x34}, 0x1, 0x0, 0x0, 0x9}, 0x800) (async) r7 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r7, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x61, &(0x7f00000004c0)={0x0, 0x3, 0x14, 0x3}, 0x8, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}) (async) mmap(&(0x7f000014e000/0x4000)=nil, 0x4000, 0xb635773f06ebbee5, 0x110, 0xffffffffffffffff, 0x629e4000) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x552100, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="9c010000100001002cbc701000000000ff0200000000000000000000000000017f0000010000000400000000000000000000ecdf0000001e0a000020000087a10e38944b8ef8e63096780979a6572e9635cd8012cd97c45b6a5febd829e468380f01178f97fc5e722b3606ebdac79fd79acaa70a325b9e4ce94b5239b2c3e6819a4eebef02776b342b564fe6ea98fc", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe00000010000000032000000e0000002000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000400000000000000fcffffffffffffff0000000000010000090000000000000003000000000000000408400000000000090000000000000092020000000000000000b01c000000000000000000000000000000000a0004002c00000000000000600002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00000001a000b000000366a6a849a73904500241a000000e81400d54c001400686d61632873686132353629000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000"], 0x19c}}, 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) (async) write$tun(r8, &(0x7f0000000200)=ANY=[@ANYBLOB="0a000010ffffffffffffffffffffffff86dd690000000028290000000000000000000000ffffe0000001ff020000000000000000000000000001"], 0x62) (async) r12 = openat$snapshot(0xffffffffffffff9c, 0x0, 0x103000, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r12, 0x80083313, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) ioctl$USBDEVFS_REAPURB(r7, 0x4004550d, &(0x7f0000001080)) (async) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000080)=ANY=[], 0x138}, 0x1, 0x0, 0x0, 0x8840}, 0x0) 31.230428ms ago: executing program 2 (id=63): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000000)="ebe301e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e005", 0x26}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48", 0xbd}, {&(0x7f0000000600)="e7c4a6e597cc7e8b95de55bc84f821a2a9844814391e7c66b854f436d622ee02daae0c61de8735b7c5bd9540c552524539dec5081252c56f1009992539ecabe72653027c6c1493e7bff0df50a27985df8294e6c71b2b733666dd4cad621da1c7cb496e6ee040430551b9b8265c12cfe9b90b77c0dee89b97b8630eff0eb9265b5cc4243048cccbaa", 0x88}], 0x4, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x1}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 27.239565ms ago: executing program 0 (id=64): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r2 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r2, 0x0, 0x0, 0x1000f4) sendfile(r2, r2, 0x0, 0x400000008f1) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) 0s ago: executing program 2 (id=65): openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) (async) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000180)=0x200) (async) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000180)=0x200) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) write$dsp(r0, &(0x7f0000000200)="dce480febb0ccd0bcb66ade3495ec7b440e5afdc984cc06eb1c91c85a7fec04b2f82e267c1edd1543b79d80c0f949073bdbaa464c040e61ea6e658101100101097a5821b6c0c79d177b96995281707ce6d20a6db", 0x54) write$dsp(r0, &(0x7f0000000080)="cd", 0x1) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) symlinkat(&(0x7f00000000c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') (async) symlinkat(&(0x7f00000000c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') symlinkat(&(0x7f0000000040)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000500)='./file1\x00', &(0x7f0000000540), 0x0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r1, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.231' (ED25519) to the list of known hosts. [ 78.548358][ T5604] cgroup: Unknown subsys name 'net' [ 78.679629][ T5604] cgroup: Unknown subsys name 'cpuset' [ 78.682945][ T5604] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 80.311580][ T5604] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.701848][ T5614] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.703253][ T5614] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.703919][ T5614] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.705246][ T5614] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.734258][ T5614] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.765784][ T4933] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 82.766918][ T4933] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 82.767411][ T4933] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 82.768710][ T4933] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 82.769349][ T4933] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 82.808426][ T5624] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 82.820639][ T5624] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 82.824036][ T5624] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 82.837403][ T5624] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 82.839180][ T5624] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 82.844829][ T4933] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.857659][ T4933] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 82.865131][ T4933] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 82.878594][ T4933] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 82.880313][ T4933] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 84.453077][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.453244][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.453385][ T5617] bridge_slave_0: entered allmulticast mode [ 84.455235][ T5617] bridge_slave_0: entered promiscuous mode [ 84.467464][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.467886][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.468221][ T5613] bridge_slave_0: entered allmulticast mode [ 84.477751][ T5613] bridge_slave_0: entered promiscuous mode [ 84.523106][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.523201][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.523323][ T5617] bridge_slave_1: entered allmulticast mode [ 84.524876][ T5617] bridge_slave_1: entered promiscuous mode [ 84.529420][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.530160][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.531926][ T5613] bridge_slave_1: entered allmulticast mode [ 84.537286][ T5613] bridge_slave_1: entered promiscuous mode [ 84.635001][ T5618] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.635177][ T5618] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.635339][ T5618] bridge_slave_0: entered allmulticast mode [ 84.641817][ T5618] bridge_slave_0: entered promiscuous mode [ 84.681113][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.681271][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.681406][ T5619] bridge_slave_0: entered allmulticast mode [ 84.683124][ T5619] bridge_slave_0: entered promiscuous mode [ 84.688835][ T5618] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.689117][ T5618] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.689462][ T5618] bridge_slave_1: entered allmulticast mode [ 84.696580][ T5618] bridge_slave_1: entered promiscuous mode [ 84.741927][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.745022][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.745361][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.747942][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.748461][ T5619] bridge_slave_1: entered allmulticast mode [ 84.758594][ T5619] bridge_slave_1: entered promiscuous mode [ 84.780224][ T5614] Bluetooth: hci0: command tx timeout [ 84.818285][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.821089][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.845782][ T5614] Bluetooth: hci1: command tx timeout [ 84.848789][ T5618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.885000][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.893799][ T5618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.925759][ T5614] Bluetooth: hci3: command tx timeout [ 84.925978][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.935623][ T5614] Bluetooth: hci2: command tx timeout [ 84.952225][ T5617] team0: Port device team_slave_0 added [ 84.960784][ T5613] team0: Port device team_slave_0 added [ 84.990642][ T5617] team0: Port device team_slave_1 added [ 84.993082][ T5613] team0: Port device team_slave_1 added [ 85.015174][ T5618] team0: Port device team_slave_0 added [ 85.044092][ T5619] team0: Port device team_slave_0 added [ 85.059203][ T5618] team0: Port device team_slave_1 added [ 85.092011][ T5619] team0: Port device team_slave_1 added [ 85.108339][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.108358][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.108377][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.110634][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.110650][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.110678][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.111777][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.111790][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.111812][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.251441][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.251456][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.251475][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.288890][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.288908][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.288935][ T5618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.350301][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.350320][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.350347][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.353268][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.353283][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.353316][ T5618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.355054][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.355068][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.355091][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.514312][ T5613] hsr_slave_0: entered promiscuous mode [ 85.515127][ T5613] hsr_slave_1: entered promiscuous mode [ 85.564201][ T5617] hsr_slave_0: entered promiscuous mode [ 85.564970][ T5617] hsr_slave_1: entered promiscuous mode [ 85.566307][ T5617] debugfs: 'hsr0' already exists in 'hsr' [ 85.566562][ T5617] Cannot create hsr debugfs directory [ 85.611086][ T5619] hsr_slave_0: entered promiscuous mode [ 85.611882][ T5619] hsr_slave_1: entered promiscuous mode [ 85.612404][ T5619] debugfs: 'hsr0' already exists in 'hsr' [ 85.612426][ T5619] Cannot create hsr debugfs directory [ 85.648188][ T5618] hsr_slave_0: entered promiscuous mode [ 85.648990][ T5618] hsr_slave_1: entered promiscuous mode [ 85.649518][ T5618] debugfs: 'hsr0' already exists in 'hsr' [ 85.649544][ T5618] Cannot create hsr debugfs directory [ 86.133945][ T5613] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 86.152169][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.153324][ T5613] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 86.169343][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.174659][ T5613] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 86.188265][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.189887][ T5613] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 86.193805][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.277963][ T5617] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 86.282315][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.284240][ T5617] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 86.311105][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.311860][ T5617] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 86.314808][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.337634][ T5617] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 86.341371][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.439376][ T5619] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 86.443023][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.444243][ T5619] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 86.459140][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.484518][ T5619] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 86.495201][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.507472][ T5619] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 86.511750][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.622515][ T5618] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.632503][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.636619][ T5618] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.650943][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.652234][ T5618] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.655066][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.678710][ T5618] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.681951][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.724739][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.808188][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.840229][ T146] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.840362][ T146] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.846391][ T4933] Bluetooth: hci0: command tx timeout [ 86.871967][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.898978][ T146] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.899095][ T146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.927122][ T5614] Bluetooth: hci1: command tx timeout [ 86.964011][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.005786][ T5614] Bluetooth: hci2: command tx timeout [ 87.005797][ T4933] Bluetooth: hci3: command tx timeout [ 87.015865][ T146] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.015974][ T146] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.052235][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.095946][ T146] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.096068][ T146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.170474][ T5619] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.207652][ T5618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.230519][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.230625][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.321972][ T146] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.322082][ T146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.328549][ T5618] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.382976][ T139] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.383086][ T139] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.444753][ T139] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.444871][ T139] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.327903][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.532736][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.552070][ T5613] veth0_vlan: entered promiscuous mode [ 88.608616][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.609447][ T5613] veth1_vlan: entered promiscuous mode [ 88.642576][ T5618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.721044][ T5617] veth0_vlan: entered promiscuous mode [ 88.739954][ T5613] veth0_macvtap: entered promiscuous mode [ 88.742508][ T5617] veth1_vlan: entered promiscuous mode [ 88.772642][ T5613] veth1_macvtap: entered promiscuous mode [ 88.807454][ T5618] veth0_vlan: entered promiscuous mode [ 88.812552][ T5619] veth0_vlan: entered promiscuous mode [ 88.831071][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.853063][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.869669][ T5618] veth1_vlan: entered promiscuous mode [ 88.890148][ T5619] veth1_vlan: entered promiscuous mode [ 88.926277][ T4933] Bluetooth: hci0: command tx timeout [ 88.936797][ T5617] veth0_macvtap: entered promiscuous mode [ 88.966312][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.966516][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.966653][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.966823][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.012052][ T4933] Bluetooth: hci1: command tx timeout [ 89.030302][ T5617] veth1_macvtap: entered promiscuous mode [ 89.085718][ T4933] Bluetooth: hci3: command tx timeout [ 89.085752][ T4933] Bluetooth: hci2: command tx timeout [ 89.110850][ T157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.110872][ T157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.120761][ T5619] veth0_macvtap: entered promiscuous mode [ 89.139745][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.159163][ T5618] veth0_macvtap: entered promiscuous mode [ 89.172518][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.185149][ T5619] veth1_macvtap: entered promiscuous mode [ 89.214031][ T5618] veth1_macvtap: entered promiscuous mode [ 89.237221][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.237244][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.294572][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.305865][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.306003][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.306045][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.315414][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.375402][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.376589][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.450267][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.477817][ T5613] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 89.542030][ T1373] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.542054][ T1373] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.577382][ T146] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.578230][ T146] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.709644][ T146] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.709667][ T146] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.737483][ T146] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.737553][ T146] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.737594][ T146] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.737633][ T146] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.737671][ T146] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.780899][ T1373] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.824300][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.824322][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.888458][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.888481][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.945946][ T5690] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 89.979257][ T5770] kAFS: unable to lookup cell '.' [ 90.019977][ T139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.019999][ T139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.086678][ T5772] FAULT_INJECTION: forcing a failure. [ 90.086678][ T5772] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 90.086727][ T5772] CPU: 1 UID: 0 PID: 5772 Comm: syz.2.5 Not tainted syzkaller #0 PREEMPT(full) [ 90.086752][ T5772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.086773][ T5772] Call Trace: [ 90.086786][ T5772] [ 90.086795][ T5772] dump_stack_lvl+0xe8/0x150 [ 90.086838][ T5772] should_fail_ex+0x3eb/0x540 [ 90.086868][ T5772] _copy_from_user+0x2d/0xb0 [ 90.086899][ T5772] memdup_user+0x5e/0xd0 [ 90.086933][ T5772] strndup_user+0x68/0xd0 [ 90.086968][ T5772] __se_sys_fsconfig+0x4d0/0x810 [ 90.086998][ T5772] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 90.087018][ T5772] ? ksys_write+0x242/0x270 [ 90.087051][ T5772] ? __pfx_ksys_write+0x10/0x10 [ 90.087088][ T5772] ? __x64_sys_fsconfig+0x20/0xc0 [ 90.087114][ T5772] do_syscall_64+0x166/0x520 [ 90.087136][ T5772] ? trace_irq_disable+0x3b/0x140 [ 90.087165][ T5772] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.087186][ T5772] ? clear_bhb_loop+0x70/0xc0 [ 90.087210][ T5772] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.087229][ T5772] RIP: 0033:0x7fb57079e159 [ 90.087255][ T5772] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.087273][ T5772] RSP: 002b:00007fb56e9f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 90.087301][ T5772] RAX: ffffffffffffffda RBX: 00007fb570a25fa0 RCX: 00007fb57079e159 [ 90.087316][ T5772] RDX: 0000200000000000 RSI: 0000000000000001 RDI: 0000000000000003 [ 90.087329][ T5772] RBP: 00007fb56e9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 90.087342][ T5772] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 90.087355][ T5772] R13: 00007fb570a26038 R14: 00007fb570a25fa0 R15: 00007fff382675a8 [ 90.087388][ T5772] [ 90.126733][ T146] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.126794][ T146] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.168971][ T5690] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 90.328859][ T5690] usb 4-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 153, changing to 11 [ 90.328898][ T5690] usb 4-1: config 0 interface 0 altsetting 255 endpoint 0x4 has invalid maxpacket 33922, setting to 1024 [ 90.328928][ T5690] usb 4-1: config 0 interface 0 has no altsetting 0 [ 90.335089][ T5690] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 90.335119][ T5690] usb 4-1: Product: syz [ 90.335135][ T5690] usb 4-1: Manufacturer: syz [ 90.335160][ T5690] usb 4-1: SerialNumber: syz [ 90.383725][ T5690] usb 4-1: config 0 descriptor?? [ 90.395308][ T5766] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 90.484042][ T5690] usb 4-1: selecting invalid altsetting 0 [ 90.584591][ T5776] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7'. [ 90.652287][ T5766] usb 4-1: BOGUS urb xfer, pipe 0 != type 1 [ 90.867165][ T31] audit: type=1800 audit(1789936666.632:2): pid=5779 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2" name=08 dev="sda1" ino=2043 res=0 errno=0 [ 90.867219][ T31] audit: type=1800 audit(1789936666.652:3): pid=5784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1" name=08 dev="sda1" ino=2043 res=0 errno=0 [ 91.002231][ T5698] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 91.096813][ T5614] Bluetooth: hci0: command tx timeout [ 91.096852][ T5614] Bluetooth: hci1: command tx timeout [ 91.161351][ T5698] usb 3-1: unable to get BOS descriptor or descriptor too short [ 91.161407][ T5698] usb 3-1: New USB device found, idVendor=07ca, idProduct=a800, bcdDevice=d6.ae [ 91.164362][ T5698] usb 3-1: config 114 has an invalid interface number: 174 but max is 0 [ 91.164392][ T5698] usb 3-1: config 114 has no interface number 0 [ 91.164422][ T5698] usb 3-1: config 114 interface 174 has no altsetting 0 [ 91.166702][ T4933] Bluetooth: hci2: command tx timeout [ 91.166735][ T4933] Bluetooth: hci3: command tx timeout [ 91.254364][ T5698] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.254396][ T5698] usb 3-1: Product: syz [ 91.254413][ T5698] usb 3-1: Manufacturer: syz [ 91.254430][ T5698] usb 3-1: SerialNumber: syz [ 91.628568][ T5698] dvb-usb: found a 'AVerMedia AverTV DVB-T USB 2.0 (A800)' in warm state. [ 92.215076][ T5793] FAULT_INJECTION: forcing a failure. [ 92.215076][ T5793] name failslab, interval 1, probability 0, space 0, times 1 [ 92.215117][ T5793] CPU: 0 UID: 0 PID: 5793 Comm: syz.0.8 Not tainted syzkaller #0 PREEMPT(full) [ 92.215147][ T5793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.215166][ T5793] Call Trace: [ 92.215176][ T5793] [ 92.215187][ T5793] dump_stack_lvl+0xe8/0x150 [ 92.215226][ T5793] should_fail_ex+0x3eb/0x540 [ 92.215258][ T5793] ? __alloc_skb+0x1db/0x7a0 [ 92.215283][ T5793] should_failslab+0xa8/0x100 [ 92.215313][ T5793] ? __alloc_skb+0x1db/0x7a0 [ 92.215334][ T5793] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 92.215374][ T5793] ? __alloc_skb+0x1db/0x7a0 [ 92.215406][ T5793] __alloc_skb+0x1db/0x7a0 [ 92.215435][ T5793] tipc_msg_build+0x15f/0xf50 [ 92.215472][ T5793] ? tipc_node_find+0xb3/0x490 [ 92.215510][ T5793] ? tipc_node_find+0x3bd/0x490 [ 92.215540][ T5793] ? trace_irq_disable+0x3b/0x140 [ 92.215579][ T5793] ? __pfx_tipc_msg_build+0x10/0x10 [ 92.215635][ T5793] __tipc_sendmsg+0x1849/0x2b60 [ 92.215682][ T5793] ? arch_stack_walk+0xfb/0x150 [ 92.215712][ T5793] ? __pfx___tipc_sendmsg+0x10/0x10 [ 92.215750][ T5793] ? aa_label_sk_perm+0x532/0x6e0 [ 92.215777][ T5793] ? stack_trace_save+0xa9/0x100 [ 92.215819][ T5793] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 92.215859][ T5793] ? check_path+0x21/0x40 [ 92.215882][ T5793] ? check_noncircular+0xdb/0x150 [ 92.215910][ T5793] ? add_lock_to_list+0xc7/0x100 [ 92.215938][ T5793] ? __lock_acquire+0x747/0x2de0 [ 92.216005][ T5793] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 92.216035][ T5793] ? __pfx_woken_wake_function+0x10/0x10 [ 92.216068][ T5793] ? tipc_sendmsg+0x47/0x70 [ 92.216108][ T5793] ? __local_bh_enable_ip+0xd6/0x140 [ 92.216142][ T5793] tipc_sendmsg+0x55/0x70 [ 92.216180][ T5793] ? __pfx_tipc_sendmsg+0x10/0x10 [ 92.216216][ T5793] sock_sendmsg_nosec+0x13a/0x180 [ 92.216255][ T5793] ____sys_sendmsg+0x54e/0x850 [ 92.216298][ T5793] ? __pfx_____sys_sendmsg+0x10/0x10 [ 92.216337][ T5793] ? import_iovec+0x73/0xa0 [ 92.216374][ T5793] ___sys_sendmsg+0x2a5/0x360 [ 92.216401][ T5793] ? __lock_acquire+0x747/0x2de0 [ 92.216447][ T5793] ? __pfx____sys_sendmsg+0x10/0x10 [ 92.216473][ T5793] ? __lock_acquire+0x747/0x2de0 [ 92.216517][ T5793] ? __pfx_futex_wake_mark+0x10/0x10 [ 92.216595][ T5793] __sys_sendmmsg+0x273/0x4d0 [ 92.216630][ T5793] ? __pfx___sys_sendmmsg+0x10/0x10 [ 92.216656][ T5793] ? do_futex+0x3e7/0x4e0 [ 92.216715][ T5793] ? rcu_is_watching+0x16/0xb0 [ 92.216749][ T5793] __x64_sys_sendmmsg+0xa0/0xc0 [ 92.216781][ T5793] do_syscall_64+0x166/0x520 [ 92.216805][ T5793] ? trace_irq_disable+0x3b/0x140 [ 92.216850][ T5793] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.216877][ T5793] ? clear_bhb_loop+0x70/0xc0 [ 92.216908][ T5793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.216935][ T5793] RIP: 0033:0x7efffd59e159 [ 92.216959][ T5793] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.216980][ T5793] RSP: 002b:00007efffe4ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 92.217009][ T5793] RAX: ffffffffffffffda RBX: 00007efffd825fa0 RCX: 00007efffd59e159 [ 92.217028][ T5793] RDX: 00000000040001b6 RSI: 0000200000001540 RDI: 0000000000000004 [ 92.217045][ T5793] RBP: 00007efffd63506b R08: 0000000000000000 R09: 0000000000000000 [ 92.217061][ T5793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.217077][ T5793] R13: 00007efffd826038 R14: 00007efffd825fa0 R15: 00007fffcb50ff68 [ 92.217114][ T5793] [ 92.629650][ T989] cfg80211: failed to load regulatory.db [ 92.631947][ T5698] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 92.656060][ T5698] dvbdev: DVB: registering new adapter (AVerMedia AverTV DVB-T USB 2.0 (A800)) [ 92.656125][ T5698] usb 3-1: media controller created [ 92.659291][ T30] usb 4-1: USB disconnect, device number 2 [ 92.663268][ T5766] usb 4-1: cannot submit urb 0, error -19: no device [ 92.673018][ T5766] usb 4-1: cannot submit urb 0, error -19: no device [ 92.692326][ T5766] snd-usb-audio 4-1:0.0: Runtime PM usage count underflow! [ 92.778863][ T5698] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 92.836836][ T5698] dvb-usb: bulk message failed: -22 (6/0) [ 92.837141][ T5698] dvb-usb: bulk message failed: -22 (6/0) [ 92.837257][ T5698] dvb-usb: no frontend was attached by 'AVerMedia AverTV DVB-T USB 2.0 (A800)' [ 93.026381][ T5698] rc_core: IR keymap rc-avermedia-m135a not found [ 93.026401][ T5698] Registered IR keymap rc-empty [ 93.043345][ T5698] rc rc0: AVerMedia AverTV DVB-T USB 2.0 (A800) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 93.063099][ T5698] input: AVerMedia AverTV DVB-T USB 2.0 (A800) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input5 [ 93.086927][ T5698] dvb-usb: schedule remote query interval to 150 msecs. [ 93.086954][ T5698] dvb-usb: AVerMedia AverTV DVB-T USB 2.0 (A800) successfully initialized and connected. [ 93.092544][ T5698] usb 3-1: USB disconnect, device number 2 [ 93.225625][ T5801] FAULT_INJECTION: forcing a failure. [ 93.225625][ T5801] name fail_futex, interval 1, probability 0, space 0, times 1 [ 93.225667][ T5801] CPU: 0 UID: 0 PID: 5801 Comm: syz.0.12 Not tainted syzkaller #0 PREEMPT(full) [ 93.225692][ T5801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.225705][ T5801] Call Trace: [ 93.225713][ T5801] [ 93.225723][ T5801] dump_stack_lvl+0xe8/0x150 [ 93.225758][ T5801] should_fail_ex+0x3eb/0x540 [ 93.225788][ T5801] get_futex_key+0x1b4/0x1580 [ 93.225836][ T5801] ? __pfx_get_futex_key+0x10/0x10 [ 93.225873][ T5801] ? kstrtouint+0x6e/0xe0 [ 93.225902][ T5801] futex_wake_op+0x20d/0xdc0 [ 93.225940][ T5801] ? get_pid_task+0x20/0x1f0 [ 93.225977][ T5801] ? __pfx_futex_wake_op+0x10/0x10 [ 93.226029][ T5801] do_futex+0x480/0x4e0 [ 93.226059][ T5801] ? __pfx_do_futex+0x10/0x10 [ 93.226083][ T5801] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 93.226114][ T5801] __se_sys_futex+0x3a8/0x450 [ 93.226143][ T5801] ? ksys_write+0x242/0x270 [ 93.226175][ T5801] ? __pfx___se_sys_futex+0x10/0x10 [ 93.226200][ T5801] ? __pfx_ksys_write+0x10/0x10 [ 93.226236][ T5801] ? __x64_sys_futex+0x21/0xf0 [ 93.226264][ T5801] do_syscall_64+0x166/0x520 [ 93.226320][ T5801] ? trace_irq_disable+0x3b/0x140 [ 93.226353][ T5801] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.226376][ T5801] ? clear_bhb_loop+0x70/0xc0 [ 93.226405][ T5801] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.226428][ T5801] RIP: 0033:0x7efffd59e159 [ 93.226448][ T5801] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.226466][ T5801] RSP: 002b:00007efffe4ff028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 93.226491][ T5801] RAX: ffffffffffffffda RBX: 00007efffd825fa0 RCX: 00007efffd59e159 [ 93.226507][ T5801] RDX: 0000000000000000 RSI: 0000000000000085 RDI: 0000000000000000 [ 93.226524][ T5801] RBP: 00007efffe4ff090 R08: 0000000000000000 R09: 00000000b0090199 [ 93.226538][ T5801] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 93.226551][ T5801] R13: 00007efffd826038 R14: 00007efffd825fa0 R15: 00007fffcb50ff68 [ 93.226585][ T5801] [ 93.468090][ T5698] dvb-usb: AVerMedia AverTV DVB-T USB 2.0 (A800) successfully deinitialized and disconnected. [ 93.692185][ T5806] CIFS: Attempting to mount //127.0.0.1/share [ 93.810712][ T5809] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14'. [ 93.815423][ T5806] CIFS: VFS: cifs_mount failed w/return code = -112 [ 93.848071][ T5809] CIFS: Attempting to mount //127.0.0.1/share [ 93.853481][ T5806] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14'. [ 93.911770][ T5818] FAULT_INJECTION: forcing a failure. [ 93.911770][ T5818] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 93.911804][ T5818] CPU: 0 UID: 0 PID: 5818 Comm: syz.1.16 Not tainted syzkaller #0 PREEMPT(full) [ 93.911829][ T5818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.911847][ T5818] Call Trace: [ 93.911856][ T5818] [ 93.911866][ T5818] dump_stack_lvl+0xe8/0x150 [ 93.911900][ T5818] should_fail_ex+0x3eb/0x540 [ 93.911931][ T5818] _copy_to_user+0x31/0xb0 [ 93.911964][ T5818] simple_read_from_buffer+0xe1/0x170 [ 93.911999][ T5818] proc_fail_nth_read+0x1bb/0x230 [ 93.912037][ T5818] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 93.912074][ T5818] ? rw_verify_area+0x24a/0x4c0 [ 93.912107][ T5818] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 93.912140][ T5818] vfs_read+0x213/0xa80 [ 93.912176][ T5818] ? __pfx___mutex_lock+0x10/0x10 [ 93.912200][ T5818] ? __pfx_vfs_read+0x10/0x10 [ 93.912243][ T5818] ? __fget_files+0x2a/0x420 [ 93.912276][ T5818] ? __fget_files+0x3a2/0x420 [ 93.912303][ T5818] ? __fget_files+0x2a/0x420 [ 93.912340][ T5818] ksys_read+0x150/0x270 [ 93.912374][ T5818] ? __pfx_ksys_read+0x10/0x10 [ 93.912416][ T5818] do_syscall_64+0x166/0x520 [ 93.912436][ T5818] ? trace_irq_disable+0x3b/0x140 [ 93.912468][ T5818] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.912492][ T5818] ? clear_bhb_loop+0x70/0xc0 [ 93.912520][ T5818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.912543][ T5818] RIP: 0033:0x7f1f47f5e98e [ 93.912564][ T5818] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 93.912582][ T5818] RSP: 002b:00007f1f48e3ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 93.912606][ T5818] RAX: ffffffffffffffda RBX: 00007f1f48e406c0 RCX: 00007f1f47f5e98e [ 93.912623][ T5818] RDX: 000000000000000f RSI: 00007f1f48e400a0 RDI: 0000000000000004 [ 93.912637][ T5818] RBP: 00007f1f48e40090 R08: 0000000000000000 R09: 0000000000000000 [ 93.912651][ T5818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 93.912665][ T5818] R13: 00007f1f48226038 R14: 00007f1f48225fa0 R15: 00007ffcf1cd9798 [ 93.912700][ T5818] [ 94.269162][ T5623] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 94.295124][ T5822] Zero length message leads to an empty skb [ 94.342876][ T5824] FAULT_INJECTION: forcing a failure. [ 94.342876][ T5824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 94.342909][ T5824] CPU: 1 UID: 0 PID: 5824 Comm: syz.3.10 Not tainted syzkaller #0 PREEMPT(full) [ 94.342937][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.342950][ T5824] Call Trace: [ 94.342959][ T5824] [ 94.342969][ T5824] dump_stack_lvl+0xe8/0x150 [ 94.343003][ T5824] should_fail_ex+0x3eb/0x540 [ 94.343045][ T5824] _copy_from_user+0x2d/0xb0 [ 94.343074][ T5824] ___sys_sendmsg+0x1c6/0x360 [ 94.343097][ T5824] ? __lock_acquire+0x747/0x2de0 [ 94.343133][ T5824] ? __pfx____sys_sendmsg+0x10/0x10 [ 94.343190][ T5824] ? __fget_files+0x2a/0x420 [ 94.343216][ T5824] ? __fget_files+0x3a2/0x420 [ 94.343252][ T5824] __x64_sys_sendmsg+0x1b1/0x290 [ 94.343278][ T5824] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 94.343322][ T5824] do_syscall_64+0x166/0x520 [ 94.343342][ T5824] ? trace_irq_disable+0x3b/0x140 [ 94.343373][ T5824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.343395][ T5824] ? clear_bhb_loop+0x70/0xc0 [ 94.343425][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.343445][ T5824] RIP: 0033:0x7f2cf9b9e159 [ 94.343465][ T5824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.343482][ T5824] RSP: 002b:00007f2cfab51028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.343504][ T5824] RAX: ffffffffffffffda RBX: 00007f2cf9e25fa0 RCX: 00007f2cf9b9e159 [ 94.343519][ T5824] RDX: 0000000004000050 RSI: 0000200000000180 RDI: 0000000000000003 [ 94.343532][ T5824] RBP: 00007f2cfab51090 R08: 0000000000000000 R09: 0000000000000000 [ 94.343545][ T5824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 94.343557][ T5824] R13: 00007f2cf9e26038 R14: 00007f2cf9e25fa0 R15: 00007ffde57b7c28 [ 94.343584][ T5824] [ 94.435915][ T5623] usb 3-1: Using ep0 maxpacket: 16 [ 94.442831][ T5623] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 94.470290][ T5623] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.470317][ T5623] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 94.541137][ T5623] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.541221][ T5623] usb 3-1: Product: syz [ 94.541264][ T5623] usb 3-1: Manufacturer: syz [ 94.541307][ T5623] usb 3-1: SerialNumber: syz [ 94.599410][ T5809] CIFS: VFS: cifs_mount failed w/return code = -112 [ 94.649874][ T5623] usb 3-1: 0:2 : does not exist [ 94.826035][ T5833] gve 0000:00:00.0: Failed to map pci bar! [ 94.826150][ T5833] gve 0000:00:00.0: probe with driver gve failed with error -12 [ 94.861508][ T5623] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 94.958169][ T5623] usb 3-1: USB disconnect, device number 3 [ 94.966328][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 95.034291][ T5629] udevd[5629]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 95.067925][ T5620] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 95.136686][ T10] usb 2-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 95.139364][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.139390][ T10] usb 2-1: Product: syz [ 95.139412][ T10] usb 2-1: Manufacturer: syz [ 95.139423][ T10] usb 2-1: SerialNumber: syz [ 95.141885][ T10] usb 2-1: config 0 descriptor?? [ 95.154748][ T10] hub 2-1:0.0: bad descriptor, ignoring hub [ 95.154776][ T10] hub 2-1:0.0: probe with driver hub failed with error -5 [ 95.207053][ T5620] usb 1-1: device descriptor read/64, error -71 [ 95.348062][ T10] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 95.361745][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 95.364290][ T10] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 95.364427][ T10] usb 2-1: media controller created [ 95.412366][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 95.466285][ T5620] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 95.543846][ T10] DVB: Unable to find symbol dib7000p_attach() [ 95.543860][ T10] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 95.596486][ T5620] usb 1-1: device descriptor read/64, error -71 [ 95.626940][ T5847] block nbd1: Device being setup by another task [ 95.645737][ T10] rc_core: IR keymap rc-dib0700-rc5 not found [ 95.645756][ T10] Registered IR keymap rc-empty [ 95.646183][ T10] dvb-usb: could not initialize remote control. [ 95.646194][ T10] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 95.706421][ T5620] usb usb1-port1: attempt power cycle [ 96.065789][ T5620] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 96.090959][ T5620] usb 1-1: device descriptor read/8, error -71 [ 96.277911][ T5852] serial 00:02: in use; can't configure [ 96.337760][ T5620] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 96.383724][ T5620] usb 1-1: device descriptor read/8, error -71 [ 96.497495][ T5620] usb usb1-port1: unable to enumerate USB device [ 96.677578][ T5623] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 96.695607][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 96.846064][ T9] usb 3-1: device descriptor read/64, error -71 [ 96.876479][ T5623] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 96.877759][ T5623] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.900475][ T5623] usb 4-1: config 0 descriptor?? [ 96.919493][ T5623] pwc: Samsung MPC-C10 USB webcam detected. [ 97.095787][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 97.119106][ T5854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 97.120147][ T5854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 97.122100][ T5623] pwc: send_video_command error -71 [ 97.122116][ T5623] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 97.122248][ T5623] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 97.173843][ T5623] usb 4-1: USB disconnect, device number 3 [ 97.237056][ T9] usb 3-1: device descriptor read/64, error -71 [ 97.357116][ T9] usb usb3-port1: attempt power cycle [ 97.719747][ T5826] block nbd1: shutting down sockets [ 97.719911][ T9] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 97.757422][ T9] usb 3-1: device descriptor read/8, error -71 [ 97.764521][ T10] usb 2-1: USB disconnect, device number 2 [ 97.843645][ T5859] FAULT_INJECTION: forcing a failure. [ 97.843645][ T5859] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 97.843680][ T5859] CPU: 1 UID: 0 PID: 5859 Comm: syz.3.30 Not tainted syzkaller #0 PREEMPT(full) [ 97.843704][ T5859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.843718][ T5859] Call Trace: [ 97.843726][ T5859] [ 97.843736][ T5859] dump_stack_lvl+0xe8/0x150 [ 97.843772][ T5859] should_fail_ex+0x3eb/0x540 [ 97.843802][ T5859] _copy_from_iter+0x1d3/0x1660 [ 97.843842][ T5859] ? __pfx__copy_from_iter+0x10/0x10 [ 97.843867][ T5859] ? trace_kmalloc+0x2a/0xf0 [ 97.843902][ T5859] ? __kmalloc_noprof+0x387/0x710 [ 97.843934][ T5859] ? __kmalloc_noprof+0x1a6/0x710 [ 97.843965][ T5859] ? kernfs_fop_write_iter+0x157/0x540 [ 97.843999][ T5859] kernfs_fop_write_iter+0x19a/0x540 [ 97.844031][ T5859] vfs_write+0x612/0xba0 [ 97.844070][ T5859] ? __pfx_vfs_write+0x10/0x10 [ 97.844108][ T5859] ? __fget_files+0x2a/0x420 [ 97.844145][ T5859] ksys_write+0x150/0x270 [ 97.844191][ T5859] ? __pfx_ksys_write+0x10/0x10 [ 97.844234][ T5859] do_syscall_64+0x166/0x520 [ 97.844256][ T5859] ? trace_irq_disable+0x3b/0x140 [ 97.844289][ T5859] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.844313][ T5859] ? clear_bhb_loop+0x70/0xc0 [ 97.844340][ T5859] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.844363][ T5859] RIP: 0033:0x7f2cf9b9e159 [ 97.844383][ T5859] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.844401][ T5859] RSP: 002b:00007f2cfab51028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 97.844424][ T5859] RAX: ffffffffffffffda RBX: 00007f2cf9e25fa0 RCX: 00007f2cf9b9e159 [ 97.844439][ T5859] RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003 [ 97.844453][ T5859] RBP: 00007f2cfab51090 R08: 0000000000000000 R09: 0000000000000000 [ 97.844467][ T5859] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 97.844481][ T5859] R13: 00007f2cf9e26038 R14: 00007f2cf9e25fa0 R15: 00007ffde57b7c28 [ 97.844516][ T5859] [ 97.998912][ T10] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 98.062349][ T9] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 98.088787][ T9] usb 3-1: device descriptor read/8, error -71 [ 98.196729][ T9] usb usb3-port1: unable to enumerate USB device [ 98.444174][ T5870] netlink: 20 bytes leftover after parsing attributes in process `syz.1.34'. [ 98.548104][ T5870] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 99.021212][ T5881] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.132064][ T5881] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.203233][ T5881] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.352830][ T5881] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.430877][ T5889] CIFS: Attempting to mount //127.0.0.1/share [ 99.462524][ T5891] CIFS: VFS: \\127.0.0.1 SMB response too short (16 bytes) [ 99.595993][ T1373] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.596051][ T1373] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.611536][ T1018] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.611678][ T1018] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.661534][ T5877] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 99.661564][ T5877] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 99.726665][ T5877] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 99.726695][ T5877] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 99.751426][ T5877] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 99.751453][ T5877] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 99.950064][ T5904] FAULT_INJECTION: forcing a failure. [ 99.950064][ T5904] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 99.950106][ T5904] CPU: 0 UID: 0 PID: 5904 Comm: syz.0.42 Not tainted syzkaller #0 PREEMPT(full) [ 99.950132][ T5904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.950145][ T5904] Call Trace: [ 99.950154][ T5904] [ 99.950164][ T5904] dump_stack_lvl+0xe8/0x150 [ 99.950203][ T5904] should_fail_ex+0x3eb/0x540 [ 99.950234][ T5904] _copy_from_user+0x2d/0xb0 [ 99.950265][ T5904] ucma_resolve_ip+0xb8/0x490 [ 99.950295][ T5904] ? __pfx_ucma_resolve_ip+0x10/0x10 [ 99.950331][ T5904] ? __might_fault+0xaf/0x130 [ 99.950365][ T5904] ucma_write+0x249/0x2f0 [ 99.950393][ T5904] ? __pfx_ucma_write+0x10/0x10 [ 99.950417][ T5904] ? security_file_permission+0x75/0x260 [ 99.950453][ T5904] ? rw_verify_area+0x203/0x4c0 [ 99.950488][ T5904] vfs_writev+0x4bb/0x990 [ 99.950513][ T5904] ? __pfx_ucma_write+0x10/0x10 [ 99.950542][ T5904] ? __pfx_vfs_writev+0x10/0x10 [ 99.950578][ T5904] ? __fget_files+0x2a/0x420 [ 99.950612][ T5904] ? __fget_files+0x3a2/0x420 [ 99.950639][ T5904] ? __fget_files+0x2a/0x420 [ 99.950676][ T5904] do_writev+0x154/0x2e0 [ 99.950702][ T5904] ? __pfx_do_writev+0x10/0x10 [ 99.950737][ T5904] do_syscall_64+0x166/0x520 [ 99.950759][ T5904] ? trace_irq_disable+0x3b/0x140 [ 99.950791][ T5904] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.950814][ T5904] ? clear_bhb_loop+0x70/0xc0 [ 99.950841][ T5904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.950863][ T5904] RIP: 0033:0x7efffd59e159 [ 99.950883][ T5904] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.950901][ T5904] RSP: 002b:00007efffe4ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 99.950926][ T5904] RAX: ffffffffffffffda RBX: 00007efffd825fa0 RCX: 00007efffd59e159 [ 99.950942][ T5904] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 000000000000000a [ 99.950956][ T5904] RBP: 00007efffe4ff090 R08: 0000000000000000 R09: 0000000000000000 [ 99.950970][ T5904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 99.950984][ T5904] R13: 00007efffd826038 R14: 00007efffd825fa0 R15: 00007fffcb50ff68 [ 99.951018][ T5904] [ 100.233837][ T5908] netlink: 8 bytes leftover after parsing attributes in process `syz.1.43'. [ 100.257433][ T5910] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 100.257720][ T5889] CIFS: VFS: cifs_mount failed w/return code = -112 [ 100.326058][ T5912] FAULT_INJECTION: forcing a failure. [ 100.326058][ T5912] name failslab, interval 1, probability 0, space 0, times 0 [ 100.326091][ T5912] CPU: 0 UID: 0 PID: 5912 Comm: syz.2.44 Not tainted syzkaller #0 PREEMPT(full) [ 100.326116][ T5912] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.326130][ T5912] Call Trace: [ 100.326138][ T5912] [ 100.326148][ T5912] dump_stack_lvl+0xe8/0x150 [ 100.326183][ T5912] should_fail_ex+0x3eb/0x540 [ 100.326213][ T5912] should_failslab+0xa8/0x100 [ 100.326239][ T5912] __kmalloc_noprof+0xf9/0x710 [ 100.326272][ T5912] ? __kmalloc_cache_noprof+0x148/0x600 [ 100.326303][ T5912] ? alloc_pipe_info+0x1f4/0x4c0 [ 100.326336][ T5912] ? alloc_pipe_info+0x1f4/0x4c0 [ 100.326378][ T5912] alloc_pipe_info+0x1f4/0x4c0 [ 100.326415][ T5912] splice_direct_to_actor+0xa41/0xcb0 [ 100.326459][ T5912] ? lock_acquire+0x115/0x350 [ 100.326493][ T5912] ? __pfx_aa_file_perm+0x10/0x10 [ 100.326522][ T5912] ? __pfx_direct_splice_actor+0x10/0x10 [ 100.326553][ T5912] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 100.326593][ T5912] do_splice_direct+0x195/0x290 [ 100.326627][ T5912] ? __pfx_do_splice_direct+0x10/0x10 [ 100.326659][ T5912] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 100.326699][ T5912] ? rw_verify_area+0x203/0x4c0 [ 100.326733][ T5912] do_sendfile+0x52e/0x7c0 [ 100.326767][ T5912] ? __pfx_do_sendfile+0x10/0x10 [ 100.326792][ T5912] ? __fget_files+0x3a2/0x420 [ 100.326830][ T5912] __se_sys_sendfile64+0x144/0x1a0 [ 100.326855][ T5912] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 100.326889][ T5912] do_syscall_64+0x166/0x520 [ 100.326910][ T5912] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.326933][ T5912] ? clear_bhb_loop+0x70/0xc0 [ 100.326960][ T5912] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.326982][ T5912] RIP: 0033:0x7fb57079e159 [ 100.327001][ T5912] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.327020][ T5912] RSP: 002b:00007fb56e9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 100.327053][ T5912] RAX: ffffffffffffffda RBX: 00007fb570a25fa0 RCX: 00007fb57079e159 [ 100.327068][ T5912] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003 [ 100.327081][ T5912] RBP: 00007fb56e9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 100.327094][ T5912] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 100.327107][ T5912] R13: 00007fb570a26038 R14: 00007fb570a25fa0 R15: 00007fff382675a8 [ 100.327141][ T5912] [ 100.922543][ T5925] FAULT_INJECTION: forcing a failure. [ 100.922543][ T5925] name failslab, interval 1, probability 0, space 0, times 0 [ 100.922576][ T5925] CPU: 0 UID: 0 PID: 5925 Comm: syz.0.49 Not tainted syzkaller #0 PREEMPT(full) [ 100.922601][ T5925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.922615][ T5925] Call Trace: [ 100.922623][ T5925] [ 100.922634][ T5925] dump_stack_lvl+0xe8/0x150 [ 100.922670][ T5925] should_fail_ex+0x3eb/0x540 [ 100.922702][ T5925] should_failslab+0xa8/0x100 [ 100.922730][ T5925] __kmalloc_noprof+0xf9/0x710 [ 100.922764][ T5925] ? tomoyo_encode+0x2ad/0x570 [ 100.922792][ T5925] ? tomoyo_encode+0x2ad/0x570 [ 100.922828][ T5925] tomoyo_encode+0x2ad/0x570 [ 100.922863][ T5925] tomoyo_realpath_from_path+0x5fa/0x640 [ 100.922904][ T5925] ? tomoyo_path_number_perm+0x219/0x5f0 [ 100.922929][ T5925] tomoyo_path_number_perm+0x246/0x5f0 [ 100.922957][ T5925] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 100.922980][ T5925] ? __lock_acquire+0x747/0x2de0 [ 100.923031][ T5925] ? hook_file_ioctl+0x1f2/0x600 [ 100.923077][ T5925] ? __fget_files+0x2a/0x420 [ 100.923110][ T5925] ? __fget_files+0x2a/0x420 [ 100.923136][ T5925] ? __fget_files+0x3a2/0x420 [ 100.923161][ T5925] ? __fget_files+0x2a/0x420 [ 100.923191][ T5925] security_file_ioctl+0xc3/0x2a0 [ 100.923228][ T5925] __se_sys_ioctl+0x47/0x170 [ 100.923266][ T5925] do_syscall_64+0x166/0x520 [ 100.923287][ T5925] ? trace_irq_disable+0x3b/0x140 [ 100.923319][ T5925] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.923353][ T5925] ? clear_bhb_loop+0x70/0xc0 [ 100.923381][ T5925] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.923405][ T5925] RIP: 0033:0x7efffd59e159 [ 100.923426][ T5925] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.923444][ T5925] RSP: 002b:00007efffe4ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 100.923473][ T5925] RAX: ffffffffffffffda RBX: 00007efffd825fa0 RCX: 00007efffd59e159 [ 100.923490][ T5925] RDX: 0000200000000080 RSI: 00000000400442c8 RDI: 0000000000000004 [ 100.923505][ T5925] RBP: 00007efffe4ff090 R08: 0000000000000000 R09: 0000000000000000 [ 100.923519][ T5925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 100.923532][ T5925] R13: 00007efffd826038 R14: 00007efffd825fa0 R15: 00007fffcb50ff68 [ 100.923567][ T5925] [ 100.927987][ T5925] ERROR: Out of memory at tomoyo_realpath_from_path. [ 101.410820][ T5932] FAULT_INJECTION: forcing a failure. [ 101.410820][ T5932] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 101.410853][ T5932] CPU: 1 UID: 0 PID: 5932 Comm: syz.1.51 Not tainted syzkaller #0 PREEMPT(full) [ 101.410879][ T5932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.410891][ T5932] Call Trace: [ 101.410901][ T5932] [ 101.410910][ T5932] dump_stack_lvl+0xe8/0x150 [ 101.410946][ T5932] should_fail_ex+0x3eb/0x540 [ 101.410988][ T5932] prepare_alloc_pages+0x21e/0x5f0 [ 101.411029][ T5932] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 101.411068][ T5932] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 101.411124][ T5932] alloc_pages_mpol+0x21e/0x390 [ 101.411160][ T5932] alloc_pages_noprof+0xb1/0x2b0 [ 101.411190][ T5932] folio_alloc_noprof+0x1e/0x30 [ 101.411216][ T5932] filemap_alloc_folio_noprof+0x111/0x460 [ 101.411248][ T5932] ? __pfx_filemap_alloc_folio_noprof+0x10/0x10 [ 101.411283][ T5932] __filemap_get_folio_mpol+0x3fd/0xff0 [ 101.411320][ T5932] ext4_da_write_begin+0x67c/0xd70 [ 101.411361][ T5932] ? __pfx_ext4_da_write_begin+0x10/0x10 [ 101.411387][ T5932] ? balance_dirty_pages_ratelimited_flags+0x8e4/0xd20 [ 101.411427][ T5932] generic_perform_write+0x2d5/0x8e0 [ 101.411471][ T5932] ? __pfx_generic_perform_write+0x10/0x10 [ 101.411500][ T5932] ? file_update_time_flags+0x3ab/0x440 [ 101.411547][ T5932] ext4_buffered_write_iter+0xd4/0x380 [ 101.411581][ T5932] ext4_file_write_iter+0xae4/0x1cd0 [ 101.411621][ T5932] ? lock_acquire+0x115/0x350 [ 101.411659][ T5932] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 101.411700][ T5932] vfs_write+0x612/0xba0 [ 101.411746][ T5932] ? __pfx_vfs_write+0x10/0x10 [ 101.411789][ T5932] ? __fget_files+0x2a/0x420 [ 101.411827][ T5932] ksys_write+0x150/0x270 [ 101.411866][ T5932] ? __pfx_ksys_write+0x10/0x10 [ 101.411909][ T5932] do_syscall_64+0x166/0x520 [ 101.411930][ T5932] ? trace_irq_disable+0x3b/0x140 [ 101.411970][ T5932] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.411993][ T5932] ? clear_bhb_loop+0x70/0xc0 [ 101.412022][ T5932] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.412045][ T5932] RIP: 0033:0x7f1f47f9e159 [ 101.412065][ T5932] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.412083][ T5932] RSP: 002b:00007f1f48e40028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 101.412108][ T5932] RAX: ffffffffffffffda RBX: 00007f1f48225fa0 RCX: 00007f1f47f9e159 [ 101.412124][ T5932] RDX: 0000000000000001 RSI: 0000200000001640 RDI: 0000000000000003 [ 101.412138][ T5932] RBP: 00007f1f48e40090 R08: 0000000000000000 R09: 0000000000000000 [ 101.412152][ T5932] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 101.412165][ T5932] R13: 00007f1f48226038 R14: 00007f1f48225fa0 R15: 00007ffcf1cd9798 [ 101.412201][ T5932] [ 102.046172][ T5690] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 102.069254][ T3217] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 102.195744][ T5690] usb 2-1: Using ep0 maxpacket: 16 [ 102.196747][ T5690] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 102.198005][ T5690] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 102.198029][ T5690] usb 2-1: config 0 has no interface number 0 [ 102.198069][ T5690] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 102.200831][ T5690] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 102.200858][ T5690] usb 2-1: Product: syz [ 102.200875][ T5690] usb 2-1: SerialNumber: syz [ 102.205224][ T5690] usb 2-1: config 0 descriptor?? [ 102.241231][ T3217] usb 1-1: Using ep0 maxpacket: 16 [ 102.265876][ T3217] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 102.282058][ T5946] FAULT_INJECTION: forcing a failure. [ 102.282058][ T5946] name failslab, interval 1, probability 0, space 0, times 0 [ 102.282209][ T5946] CPU: 0 UID: 0 PID: 5946 Comm: syz.2.56 Not tainted syzkaller #0 PREEMPT(full) [ 102.282288][ T5946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 102.282322][ T5946] Call Trace: [ 102.282345][ T5946] [ 102.282375][ T5946] dump_stack_lvl+0xe8/0x150 [ 102.282471][ T5946] should_fail_ex+0x3eb/0x540 [ 102.282553][ T5946] ? __alloc_skb+0x1db/0x7a0 [ 102.282608][ T5946] should_failslab+0xa8/0x100 [ 102.282673][ T5946] ? __alloc_skb+0x1db/0x7a0 [ 102.282726][ T5946] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 102.282809][ T5946] ? __alloc_skb+0x18d/0x7a0 [ 102.282864][ T5946] ? __alloc_skb+0x1db/0x7a0 [ 102.282924][ T5946] __alloc_skb+0x1db/0x7a0 [ 102.282997][ T5946] netlink_sendmsg+0x577/0xae0 [ 102.283083][ T5946] ? __pfx_netlink_sendmsg+0x10/0x10 [ 102.283181][ T5946] ? apparmor_socket_sendmsg+0x98/0x360 [ 102.283253][ T5946] ? __pfx_netlink_sendmsg+0x10/0x10 [ 102.283321][ T5946] sock_sendmsg_nosec+0x13a/0x180 [ 102.283425][ T5946] ____sys_sendmsg+0x54e/0x850 [ 102.283520][ T5946] ? __pfx_____sys_sendmsg+0x10/0x10 [ 102.283622][ T5946] ? import_iovec+0x73/0xa0 [ 102.283720][ T5946] ___sys_sendmsg+0x2a5/0x360 [ 102.283782][ T5946] ? __lock_acquire+0x747/0x2de0 [ 102.283879][ T5946] ? __pfx____sys_sendmsg+0x10/0x10 [ 102.284042][ T5946] ? __fget_files+0x2a/0x420 [ 102.284115][ T5946] ? __fget_files+0x3a2/0x420 [ 102.284212][ T5946] __x64_sys_sendmsg+0x1b1/0x290 [ 102.284286][ T5946] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 102.284406][ T5946] do_syscall_64+0x166/0x520 [ 102.284460][ T5946] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.284523][ T5946] ? clear_bhb_loop+0x70/0xc0 [ 102.284594][ T5946] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.284657][ T5946] RIP: 0033:0x7fb57079e159 [ 102.284702][ T5946] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.284755][ T5946] RSP: 002b:00007fb56e9f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 102.284817][ T5946] RAX: ffffffffffffffda RBX: 00007fb570a25fa0 RCX: 00007fb57079e159 [ 102.284860][ T5946] RDX: 000000000004c040 RSI: 0000200000000040 RDI: 0000000000000005 [ 102.284886][ T5946] RBP: 00007fb56e9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 102.284927][ T5946] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 102.284965][ T5946] R13: 00007fb570a26038 R14: 00007fb570a25fa0 R15: 00007fff382675a8 [ 102.285072][ T5946] [ 102.312027][ T5690] cm109 2-1:0.8: invalid payload size 8, expected 4 [ 102.314476][ T5690] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input7 [ 102.407332][ T3217] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 102.407368][ T3217] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 102.407392][ T3217] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 102.407462][ T3217] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.595192][ T3217] usb 1-1: config 0 descriptor?? [ 102.647858][ T5948] netlink: 'syz.2.57': attribute type 5 has an invalid length. [ 102.647883][ T5948] netlink: 16 bytes leftover after parsing attributes in process `syz.2.57'. [ 102.653980][ T5947] workqueue: work func _RNvXs8_NtCsbuTvttuFvbr_6kernel9workqueueINtNtNtB7_4sync3arc3ArcNtNtCswPamI0U300_11rust_binder7process7ProcessEINtB5_15WorkItemPointerKy0_E3runB13_ enqueued on deprecated workqueue. Use system_{percpu|dfl}_wq instead. [ 102.879808][ T5953] FAULT_INJECTION: forcing a failure. [ 102.879808][ T5953] name failslab, interval 1, probability 0, space 0, times 0 [ 102.879844][ T5953] CPU: 0 UID: 0 PID: 5953 Comm: syz.2.59 Not tainted syzkaller #0 PREEMPT(full) [ 102.879874][ T5953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 102.879889][ T5953] Call Trace: [ 102.879899][ T5953] [ 102.879909][ T5953] dump_stack_lvl+0xe8/0x150 [ 102.879948][ T5953] should_fail_ex+0x3eb/0x540 [ 102.879981][ T5953] should_failslab+0xa8/0x100 [ 102.880012][ T5953] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 102.880051][ T5953] ? __d_alloc+0x37/0x6f0 [ 102.880084][ T5953] ? __d_alloc+0x37/0x6f0 [ 102.880123][ T5953] __d_alloc+0x37/0x6f0 [ 102.880158][ T5953] ? inode_set_ctime_to_ts+0x116/0x2e0 [ 102.880201][ T5953] d_alloc_pseudo+0x21/0xc0 [ 102.880237][ T5953] alloc_path_pseudo+0x107/0x220 [ 102.880270][ T5953] ? __pfx_alloc_path_pseudo+0x10/0x10 [ 102.880298][ T5953] ? inode_set_ctime_current+0x287/0xb60 [ 102.880361][ T5953] alloc_file_pseudo+0xa8/0x1e0 [ 102.880392][ T5953] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 102.880426][ T5953] ? alloc_anon_inode+0x194/0x330 [ 102.880463][ T5953] dma_buf_export+0x648/0xab0 [ 102.880500][ T5953] iommufd_test+0x1316/0x6360 [ 102.880550][ T5953] ? __lock_acquire+0x747/0x2de0 [ 102.880584][ T5953] ? __pfx_iommufd_test+0x10/0x10 [ 102.880632][ T5953] ? tomoyo_path_number_perm+0x219/0x5f0 [ 102.880661][ T5953] ? tomoyo_path_number_perm+0x219/0x5f0 [ 102.880691][ T5953] ? lock_acquire+0x115/0x350 [ 102.880742][ T5953] ? __might_fault+0xaf/0x130 [ 102.880782][ T5953] iommufd_fops_ioctl+0x465/0x600 [ 102.880818][ T5953] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 102.880851][ T5953] ? __fget_files+0x2a/0x420 [ 102.880890][ T5953] ? __fget_files+0x2a/0x420 [ 102.880930][ T5953] ? bpf_lsm_file_ioctl+0x9/0x20 [ 102.880962][ T5953] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 102.880991][ T5953] __se_sys_ioctl+0xfc/0x170 [ 102.881034][ T5953] do_syscall_64+0x166/0x520 [ 102.881058][ T5953] ? trace_irq_disable+0x3b/0x140 [ 102.881095][ T5953] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.881122][ T5953] ? clear_bhb_loop+0x70/0xc0 [ 102.881154][ T5953] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.881180][ T5953] RIP: 0033:0x7fb57079e159 [ 102.881204][ T5953] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.881224][ T5953] RSP: 002b:00007fb56e9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.881253][ T5953] RAX: ffffffffffffffda RBX: 00007fb570a25fa0 RCX: 00007fb57079e159 [ 102.881272][ T5953] RDX: 0000200000000d40 RSI: 0000000000003ba0 RDI: 0000000000000005 [ 102.881289][ T5953] RBP: 00007fb57083506b R08: 0000000000000000 R09: 0000000000000000 [ 102.881305][ T5953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.881331][ T5953] R13: 00007fb570a26038 R14: 00007fb570a25fa0 R15: 00007fff382675a8 [ 102.881370][ T5953] [ 103.235216][ T3217] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 103.235257][ T3217] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 103.235285][ T3217] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 103.235308][ T3217] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 103.235361][ T3217] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 103.235388][ T3217] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 103.235415][ T3217] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 103.252592][ T3217] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 103.252639][ T3217] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 103.252696][ T3217] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 103.342015][ T3217] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0001/input/input8 [ 103.409955][ T3217] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 103.453704][ T3217] usb 1-1: USB disconnect, device number 6 [ 103.505214][ T5960] rust_binder: 5959:5960 no such ref 3 [ 103.505288][ T5960] rust_binder: 5959:5960 no such ref 0 [ 103.506325][ T30] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 103.561822][ T5960] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 103.561856][ T5960] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 103.563297][ T5961] netlink: 172 bytes leftover after parsing attributes in process `syz.2.62'. [ 103.611415][ T5958] fido_id[5958]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 103.666520][ T30] usb 4-1: Using ep0 maxpacket: 8 [ 103.668356][ T30] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 103.672139][ T30] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 103.672166][ T30] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 103.672270][ T30] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 103.672300][ T30] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 103.672344][ T30] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.776556][ T30] hub 4-1:1.0: bad descriptor, ignoring hub [ 103.776612][ T30] hub 4-1:1.0: probe with driver hub failed with error -5 [ 103.809098][ T30] cdc_wdm 4-1:1.0: skipping garbage [ 103.809121][ T30] cdc_wdm 4-1:1.0: skipping garbage [ 103.839078][ T30] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 103.839115][ T30] cdc_wdm 4-1:1.0: Unknown control protocol [ 104.315713][ T5620] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 104.322814][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 104.322933][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 104.323234][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 104.323259][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 104.323569][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 104.323594][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 104.323871][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 104.323895][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 104.324113][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 104.324137][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 104.324360][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 104.324386][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 104.324596][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 104.324619][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 104.324842][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 104.324865][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 104.325084][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 104.325108][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 104.325129][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 104.325232][ T30] usb 4-1: USB disconnect, device number 4 [ 104.486289][ T5620] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 104.490212][ T5620] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.490245][ T5620] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.490285][ T5620] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.553842][ T5620] usb 3-1: config 0 descriptor?? [ 104.869571][ C1] cm109 2-1:0.8: cm109_urb_irq_callback: urb status -71 [ 104.869644][ C1] ------------[ cut here ]------------ [ 104.869657][ C1] URB ffff88802ae0de00 submitted while active [ 104.869679][ C1] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#1: syz.1.54/5941 [ 104.898190][ C1] Modules linked in: [ 104.902141][ C1] CPU: 1 UID: 0 PID: 5941 Comm: syz.1.54 Not tainted syzkaller #0 PREEMPT(full) [ 104.911317][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.921426][ C1] RIP: 0010:usb_submit_urb+0x7c/0x18b0 [ 104.926965][ C1] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 69 02 be fa 49 83 3e 00 74 40 e8 3e d9 4d fa 48 8d 3d f7 3d 2f 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 23 d9 4d fa eb 05 e8 1c d9 [ 104.946625][ C1] RSP: 0018:ffffc90000a189f8 EFLAGS: 00010087 [ 104.952827][ C1] RAX: ffffffff877a2bb2 RBX: ffff88802ae0de00 RCX: 0000000000040000 [ 104.960844][ C1] RDX: ffffc900022c2000 RSI: ffff88802ae0de00 RDI: ffffffff90a969b0 [ 104.968863][ C1] RBP: dffffc0000000000 R08: 0000000000000100 R09: 0000000000000004 [ 104.976872][ C1] R10: dffffc0000000000 R11: fffff5200014313c R12: ffff888022a92048 [ 104.984890][ C1] R13: ffff888022a92030 R14: ffff88802ae0de08 R15: 0000000000000820 [ 104.992906][ C1] FS: 0000000000000000(0000) GS:ffff88812495b000(0000) knlGS:0000000000000000 [ 105.001897][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.008543][ C1] CR2: 000000110c27710c CR3: 000000000ed48000 CR4: 00000000003526f0 [ 105.016552][ C1] Call Trace: [ 105.019865][ C1] [ 105.022735][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 105.028596][ C1] cm109_urb_irq_callback+0x6fb/0xca0 [ 105.034016][ C1] __usb_hcd_giveback_urb+0x378/0x540 [ 105.039423][ C1] dummy_timer+0xa91/0x4cf0 [ 105.043983][ C1] ? __lock_acquire+0x747/0x2de0 [ 105.048995][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 105.054419][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 105.059394][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 105.065244][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 105.070264][ C1] __hrtimer_run_queues+0x3bc/0xa10 [ 105.075531][ C1] hrtimer_run_softirq+0x1e3/0x2e0 [ 105.080805][ C1] handle_softirqs+0x226/0x860 [ 105.085622][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 105.090434][ C1] __irq_exit_rcu+0xcb/0x220 [ 105.095067][ C1] irq_exit_rcu+0x9/0x30 [ 105.099347][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 105.105042][ C1] [ 105.107998][ C1] [ 105.110964][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 105.117074][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 105.123538][ C1] Code: f7 e8 bd eb aa f5 f7 c3 00 02 00 00 74 05 e8 10 35 d7 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 54 00 9c f5 65 48 8b 05 dc 38 c3 07 48 85 c0 74 18 5b 41 5e c3 [ 105.143223][ C1] RSP: 0018:ffffc90004fe76e8 EFLAGS: 00000206 [ 105.149332][ C1] RAX: 0000000000000006 RBX: 0000000000000202 RCX: 0000000000000001 [ 105.157331][ C1] RDX: 0000000000000006 RSI: ffffffff8e59e74c RDI: 0000000000000001 [ 105.165330][ C1] RBP: ffffc90004fe77e0 R08: ffffffff909bb37f R09: 1ffffffff213766f [ 105.173334][ C1] R10: dffffc0000000000 R11: fffffbfff2137670 R12: dffffc0000000000 [ 105.181334][ C1] R13: ffff888029229400 R14: ffffffff8fd19780 R15: 0000000000000001 [ 105.189353][ C1] usb_hcd_poll_rh_status+0x3e9/0x600 [ 105.194767][ C1] ? __pfx_usb_hcd_poll_rh_status+0x10/0x10 [ 105.200694][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 105.206553][ C1] dummy_pullup+0xde/0x120 [ 105.211000][ C1] ? __pfx_dummy_pullup+0x10/0x10 [ 105.216065][ C1] usb_gadget_disconnect_locked+0x126/0x480 [ 105.222001][ C1] gadget_unbind_driver+0xc2/0x410 [ 105.227181][ C1] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 105.232954][ C1] device_release_driver_internal+0x48b/0x880 [ 105.239079][ C1] driver_detach+0x1f3/0x2d0 [ 105.243747][ C1] bus_remove_driver+0x226/0x320 [ 105.248722][ C1] usb_gadget_unregister_driver+0x4e/0x70 [ 105.254486][ C1] raw_release+0xd7/0x260 [ 105.258850][ C1] ? __pfx_raw_release+0x10/0x10 [ 105.263811][ C1] __fput+0x413/0xa50 [ 105.267839][ C1] task_work_run+0x1d9/0x260 [ 105.272496][ C1] ? __pfx_task_work_run+0x10/0x10 [ 105.277657][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 105.282818][ C1] do_exit+0x73a/0x2360 [ 105.287026][ C1] ? __pfx_do_exit+0x10/0x10 [ 105.291656][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 105.296808][ C1] do_group_exit+0x22d/0x2f0 [ 105.301437][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 105.306704][ C1] get_signal+0x1216/0x12c0 [ 105.311299][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 105.316878][ C1] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 105.322115][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 105.328313][ C1] ? __se_sys_clock_nanosleep+0x35b/0x3b0 [ 105.334081][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 105.339490][ C1] ? rcu_is_watching+0x16/0xb0 [ 105.344287][ C1] do_syscall_64+0x328/0x520 [ 105.348898][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.354990][ C1] ? clear_bhb_loop+0x70/0xc0 [ 105.359795][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.365723][ C1] RIP: 0033:0x7f1f47f5e98e [ 105.370168][ C1] Code: Unable to access opcode bytes at 0x7f1f47f5e964. [ 105.377304][ C1] RSP: 002b:00007ffcf1cd9878 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 105.385769][ C1] RAX: 0000000000000000 RBX: 000055555b155500 RCX: 00007f1f47f5e98e [ 105.393777][ C1] RDX: 00007ffcf1cd98d0 RSI: 0000000000000000 RDI: 0000000000000000 [ 105.401948][ C1] RBP: 00007f1f48227da0 R08: 0000000000000000 R09: 0000000000000000 [ 105.409976][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000019de7 [ 105.417983][ C1] R13: 00007f1f4822609c R14: 00000000000192ae R15: 00007f1f48226090 [ 105.426015][ C1] [ 105.429072][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 105.436378][ C1] CPU: 1 UID: 0 PID: 5941 Comm: syz.1.54 Not tainted syzkaller #0 PREEMPT(full) [ 105.445532][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 105.455703][ C1] Call Trace: [ 105.459018][ C1] [ 105.461889][ C1] vpanic+0x56d/0xa70 [ 105.465921][ C1] ? __pfx__printk+0x10/0x10 [ 105.470548][ C1] ? __pfx_vpanic+0x10/0x10 [ 105.475091][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 105.480401][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 105.485632][ C1] panic+0xc5/0xd0 [ 105.489399][ C1] ? __pfx_panic+0x10/0x10 [ 105.493868][ C1] __warn+0x315/0x4c0 [ 105.497894][ C1] ? usb_submit_urb+0x79/0x18b0 [ 105.502819][ C1] ? usb_submit_urb+0x79/0x18b0 [ 105.507712][ C1] __report_bug+0x276/0x570 [ 105.512287][ C1] ? usb_submit_urb+0x79/0x18b0 [ 105.517181][ C1] ? __pfx___report_bug+0x10/0x10 [ 105.522255][ C1] ? __lock_acquire+0x747/0x2de0 [ 105.527245][ C1] report_bug_entry+0x19b/0x290 [ 105.532143][ C1] ? usb_submit_urb+0x7c/0x18b0 [ 105.537028][ C1] ? usb_submit_urb+0x81/0x18b0 [ 105.541936][ C1] handle_bug+0xce/0x200 [ 105.546247][ C1] exc_invalid_op+0x1a/0x50 [ 105.550780][ C1] asm_exc_invalid_op+0x1a/0x20 [ 105.555661][ C1] RIP: 0010:usb_submit_urb+0x7c/0x18b0 [ 105.561161][ C1] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 69 02 be fa 49 83 3e 00 74 40 e8 3e d9 4d fa 48 8d 3d f7 3d 2f 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 23 d9 4d fa eb 05 e8 1c d9 [ 105.580787][ C1] RSP: 0018:ffffc90000a189f8 EFLAGS: 00010087 [ 105.586898][ C1] RAX: ffffffff877a2bb2 RBX: ffff88802ae0de00 RCX: 0000000000040000 [ 105.594922][ C1] RDX: ffffc900022c2000 RSI: ffff88802ae0de00 RDI: ffffffff90a969b0 [ 105.602954][ C1] RBP: dffffc0000000000 R08: 0000000000000100 R09: 0000000000000004 [ 105.610970][ C1] R10: dffffc0000000000 R11: fffff5200014313c R12: ffff888022a92048 [ 105.618977][ C1] R13: ffff888022a92030 R14: ffff88802ae0de08 R15: 0000000000000820 [ 105.627083][ C1] ? usb_submit_urb+0x72/0x18b0 [ 105.631988][ C1] ? usb_submit_urb+0x72/0x18b0 [ 105.636897][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 105.642773][ C1] cm109_urb_irq_callback+0x6fb/0xca0 [ 105.648194][ C1] __usb_hcd_giveback_urb+0x378/0x540 [ 105.653602][ C1] dummy_timer+0xa91/0x4cf0 [ 105.658143][ C1] ? __lock_acquire+0x747/0x2de0 [ 105.663137][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 105.668561][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 105.673537][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 105.679380][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 105.684352][ C1] __hrtimer_run_queues+0x3bc/0xa10 [ 105.689597][ C1] hrtimer_run_softirq+0x1e3/0x2e0 [ 105.694740][ C1] handle_softirqs+0x226/0x860 [ 105.699536][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 105.704338][ C1] __irq_exit_rcu+0xcb/0x220 [ 105.708965][ C1] irq_exit_rcu+0x9/0x30 [ 105.713242][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 105.718932][ C1] [ 105.721888][ C1] [ 105.724845][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 105.731285][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 105.737742][ C1] Code: f7 e8 bd eb aa f5 f7 c3 00 02 00 00 74 05 e8 10 35 d7 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 54 00 9c f5 65 48 8b 05 dc 38 c3 07 48 85 c0 74 18 5b 41 5e c3 [ 105.757380][ C1] RSP: 0018:ffffc90004fe76e8 EFLAGS: 00000206 [ 105.763489][ C1] RAX: 0000000000000006 RBX: 0000000000000202 RCX: 0000000000000001 [ 105.771490][ C1] RDX: 0000000000000006 RSI: ffffffff8e59e74c RDI: 0000000000000001 [ 105.779508][ C1] RBP: ffffc90004fe77e0 R08: ffffffff909bb37f R09: 1ffffffff213766f [ 105.787529][ C1] R10: dffffc0000000000 R11: fffffbfff2137670 R12: dffffc0000000000 [ 105.795538][ C1] R13: ffff888029229400 R14: ffffffff8fd19780 R15: 0000000000000001 [ 105.803572][ C1] usb_hcd_poll_rh_status+0x3e9/0x600 [ 105.808991][ C1] ? __pfx_usb_hcd_poll_rh_status+0x10/0x10 [ 105.814937][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 105.820795][ C1] dummy_pullup+0xde/0x120 [ 105.825246][ C1] ? __pfx_dummy_pullup+0x10/0x10 [ 105.830303][ C1] usb_gadget_disconnect_locked+0x126/0x480 [ 105.836322][ C1] gadget_unbind_driver+0xc2/0x410 [ 105.841493][ C1] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 105.847261][ C1] device_release_driver_internal+0x48b/0x880 [ 105.853366][ C1] driver_detach+0x1f3/0x2d0 [ 105.858002][ C1] bus_remove_driver+0x226/0x320 [ 105.863019][ C1] usb_gadget_unregister_driver+0x4e/0x70 [ 105.869050][ C1] raw_release+0xd7/0x260 [ 105.873409][ C1] ? __pfx_raw_release+0x10/0x10 [ 105.878371][ C1] __fput+0x413/0xa50 [ 105.882389][ C1] task_work_run+0x1d9/0x260 [ 105.887026][ C1] ? __pfx_task_work_run+0x10/0x10 [ 105.892169][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 105.897320][ C1] do_exit+0x73a/0x2360 [ 105.901530][ C1] ? __pfx_do_exit+0x10/0x10 [ 105.906170][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 105.911276][ C1] do_group_exit+0x22d/0x2f0 [ 105.915919][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 105.921160][ C1] get_signal+0x1216/0x12c0 [ 105.925711][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 105.931291][ C1] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 105.936535][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 105.942727][ C1] ? __se_sys_clock_nanosleep+0x35b/0x3b0 [ 105.948495][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 105.954000][ C1] ? rcu_is_watching+0x16/0xb0 [ 105.958792][ C1] do_syscall_64+0x328/0x520 [ 105.963413][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.969531][ C1] ? clear_bhb_loop+0x70/0xc0 [ 105.974247][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.980173][ C1] RIP: 0033:0x7f1f47f5e98e [ 105.984615][ C1] Code: Unable to access opcode bytes at 0x7f1f47f5e964. [ 105.991684][ C1] RSP: 002b:00007ffcf1cd9878 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 106.000135][ C1] RAX: 0000000000000000 RBX: 000055555b155500 RCX: 00007f1f47f5e98e [ 106.008135][ C1] RDX: 00007ffcf1cd98d0 RSI: 0000000000000000 RDI: 0000000000000000 [ 106.016132][ C1] RBP: 00007f1f48227da0 R08: 0000000000000000 R09: 0000000000000000 [ 106.024129][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000019de7 [ 106.032130][ C1] R13: 00007f1f4822609c R14: 00000000000192ae R15: 00007f1f48226090 [ 106.040147][ C1] [ 106.043799][ C1] Kernel Offset: disabled [ 106.048141][ C1] Rebooting in 86400 seconds..