last executing test programs: 2m38.444305047s ago: executing program 1 (id=916): mkdirat(0xffffffffffffff9c, 0x0, 0xff) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) r1 = gettid() r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x12, 0xfffffff9, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2}, 0x50) close(r2) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) openat$cgroup_ro(r3, &(0x7f0000000040)='cpu.stat\x00', 0xf000, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000080)=0x1) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0xb}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000500)={'gre0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000004000000000000000300000784"], 0x0, 0x5, 0x0, 0x0, 0x41100, 0x9}, 0x94) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x4014001}, 0x9590f6cc3ea35512) socket$nl_sock_diag(0x10, 0x3, 0x4) socket(0x2, 0x80805, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) 2m36.06620465s ago: executing program 1 (id=924): process_madvise(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000380)="c0a78402a10c83375f7c3659c70d55a18f2f", 0x12}], 0x1, 0xe, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0) pwrite64(r1, 0x0, 0x0, 0x9000) link(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)}, &(0x7f0000000080)=0x10) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) r2 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket(0x10, 0x3, 0x0) write(r3, 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x20000023896) recvmmsg(r3, &(0x7f00000021c0), 0x5b, 0x40, 0x0) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(r6, 0xa) recvmmsg(r6, &(0x7f0000002740)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1b}}], 0x2, 0x2, 0x0) sendmsg(r6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) 2m34.661596946s ago: executing program 1 (id=928): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000f0ff00000200000008000a40000000010900020073797a31000000000900014073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000010c0001800800014000000004440000000c0a01010000000000000000020000000900020073797a31000000000900010073797a30000000001800038014000080100001800c0001"], 0xf0}}, 0x0) 2m33.355576098s ago: executing program 1 (id=932): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000480)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x14}}]}, &(0x7f0000000100)=0x10) add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, &(0x7f0000000340)="0000000000000002ff69000000000001000000c0000000060002", 0x1a, 0xffffffffffffffff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001000010809000000000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008000400"], 0x30}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000840)={r6, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) write$dsp(r1, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r4, 0x84, 0x12, &(0x7f0000000240), &(0x7f00000003c0)=0x4) ioctl$SOUND_MIXER_WRITE_RECSRC(r1, 0xc0044dff, &(0x7f0000000180)=0x4) ioctl$SNDCTL_DSP_SYNC(r1, 0x5001, 0x0) write(r3, &(0x7f0000000900)="5b026c7c84c906313302b74cffc27a06877c09dc61343ab65276f8fec7d70d600a4e16599c827105ac95a27e5d69965d6efcf10b548be2c2652136869bf33ebba0c83ceb383ae23d8de5c6a723a02371626ed111780e5753699f245bdaf68f90deb799a63358aaf3477cbdc040bbc446c98091e1672b61f8e2abfd421fb9eb1b5457e2baa3488e18a3e2dad9d4fa0ee235aa506f3bd63c0d7e04cc", 0x9b) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f00000009c0)={{{@in=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@empty}}, &(0x7f0000000280)=0xffffffffffffff88) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000d80)={0x6, 0x11, &(0x7f0000000ac0)=ANY=[@ANYBLOB="180000000e00000000000000ff01000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000003000000bf090000000000005509010000000000950000000000000017393000080000008520000003000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000b80)='GPL\x00', 0xff, 0x90, &(0x7f0000000bc0)=""/144, 0x41100, 0x24, '\x00', r7, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000c80)={0x6, 0x2}, 0x8, 0x10, &(0x7f0000000cc0)={0x3, 0xa, 0x3, 0x2}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000d00)=[0x1], &(0x7f0000000d40)=[{0x3, 0x1, 0x2, 0x6}], 0x10, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4000000000000007910900000000000620000000000000095000000000000009e574bffff1729aba9b39a58e3cd8757e44cf3611b8e327a0279acba1f7791408d1efa421239728e2e5cc319b58520609dfd4a1a021d000000000000efffff75c3d894d99aef659f8b0000c515d8c219fbd9da31fc3ce3e9a2653000aec385a84a3d3f466bba30ac1486a70037fb03adef1a427fb0f4cb3072182da7c30000000000000000000000000000000000000000000000000000297e9fed660213ecb576987ad0972f18fbb7c9ecc03901f028b15b30ecf3205f90c9684ddc80d13bf37afc00e5efd686e6fb5ef4ee00b66126f773434a5c0d2ad3526bc484a6b94396117615f78f97637d8f8838aa75efb657ddafb15b88d97e47731cc3f55ce4e6a42562e6fb1f0000003030249c350044b09c36d10549a5949ff21418f1517508fb13540a82b5030cd9bb1bb066ca833c1fef6cefa28543ee520e46a3e96aca0d5a5f8cb34ad9c54c3a9a698f835bb83bcfd81ac5cfa18ce0740717994b5152cd0fa735433e50dccee16a208245b4366d44bb7ebd169b9e3a66d0cb29291a50f642ae4cb007540c806cd1cf88fdcaa393d1e1a697649401a802b474e374c767cb1ce52fd917d6af3de547be8429540de37f868a7f25d47c4b710836436008d4e8c8b42aeee84629d06d75ef09e0260b41de1f750480e492b6822d6275b7ccda1141707069cdb21de7a98dc37efdd806cc3619ad0659998bdd90b008c1aed04ee682b8ffd25741abbd9c6482ca45b82b6b7f25f71280cd6ba8bbb1e32dfe84831d1fc132755ce9aaf1952cb6829e9d6f4cbd8a07dc0cebcad512b3e0f2daa622bc805d2e152e0765b20cd6c8e2f4fff81e1458a43f35d36b25225dc0fbaf3b8131f5a8ae73e8badc519350edf048d5f5"], &(0x7f0000000440)='GPL\x00', 0x5, 0xc3, &(0x7f0000000e40)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r8}, 0x94) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000000)={'dvmrp1\x00', {0x2, 0x0, @remote}}) r9 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) readv(r9, &(0x7f0000000a80)=[{&(0x7f00000009c0)=""/65, 0x41}], 0x1) r10 = fcntl$dupfd(r9, 0x0, r9) write$sndseq(r10, &(0x7f0000000400)=[{0x0, 0x0, 0x0, 0x3, @tick, {}, {0x5}, @result={0x3, 0xbb7}}, {0x9, 0x3, 0xa, 0x14, @time={0x2, 0x7ff}, {0x85, 0x80}, {0x10, 0x5}, @queue={0xae, {0xf2, 0x5}}}], 0x38) 2m29.593901406s ago: executing program 1 (id=939): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000013c0)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3b}}}}]}, @CTA_TIMEOUT={0x8}, @CTA_TUPLE_MASTER={0x4}]}, 0x68}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x8, &(0x7f0000000080)=0x7) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0xa7f3bbc663947270, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) syz_emit_ethernet(0x7e, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$tun(r6, 0x0, 0x141) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) 2m27.259188786s ago: executing program 1 (id=942): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) dup(r0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1e5) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1c0) landlock_create_ruleset(0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x204200, 0x91) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x2001, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x37, 0x7fffffff}]}) openat$ptp0(0xffffffffffffff9c, &(0x7f0000002140), 0x40801, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) capset(0x0, 0x0) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0, 0x1000) ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0x40043d0d, 0x0) 2m11.126577349s ago: executing program 32 (id=942): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) dup(r0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1e5) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1c0) landlock_create_ruleset(0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x204200, 0x91) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x2001, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x37, 0x7fffffff}]}) openat$ptp0(0xffffffffffffff9c, &(0x7f0000002140), 0x40801, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) capset(0x0, 0x0) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0, 0x1000) ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0x40043d0d, 0x0) 49.535951008s ago: executing program 0 (id=1221): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000001300)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff00000007050102000200070581020002"], 0x0) setns(0xc9, 0x0) socket(0x8, 0x5, 0x7fff) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) 46.915464081s ago: executing program 0 (id=1232): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) epoll_create1(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) r1 = socket$inet(0x2b, 0x801, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x48f, &(0x7f00000000c0)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) write(r2, &(0x7f00000006c0)="5226b445", 0x4) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x8408, &(0x7f0000000680)=[{&(0x7f0000000180)="5c00000014006b03c84e21008bf32c19021800f80200000044000200ac14143705251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b7800000000000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000200), 0x5, 0x86100) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000005c0)={r5, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1c, 0x1c, "fee8a2ab78fc179fd1f8a0e9a1af1ea09dc2b7fb0a010000000000000000030000000000000000000000000000000000000000000000001b00", "28095397bab22d0000b42076c1ce8ef05f819e01177d3d458dac0000000000000000000800000000003788cf8f00", "90be8b1c5512406c7f00", [0x4, 0xa]}}) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r7, 0x40383d0c, &(0x7f0000000040)={{0x5, 0x20000000}, {0x5, 0x1000}, 0xfffffe2a, 0x5}) ioctl$PTP_CLOCK_GETCAPS(r7, 0x80503d01, &(0x7f0000000240)) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r6, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd73, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x6, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd5, 0x0, 0x0, 0xf, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x100003, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x20000, 0xffffffff, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x934a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8d8, 0x4], 0x1, 0x400}) 46.570507788s ago: executing program 0 (id=1236): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x34c706aedb2d2400}) 46.367690817s ago: executing program 0 (id=1240): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="20000000360001002bfd7004fcdbdf250400"], 0x20}, 0x1, 0x0, 0x0, 0x24040050}, 0x24000080) 45.070513508s ago: executing program 0 (id=1243): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x168, 0x168, 0x0, 0x200, 0x168, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x3, 0x3}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x1], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'bond_slave_0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0x13}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @loopback, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x6, 0xfffffffffffffffe}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000000000000000000feffffff180100002000732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000050000008500000072000000b7080000000000007baaf8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a800000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r4}, 0xc) 44.029077798s ago: executing program 0 (id=1246): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r1 = socket$kcm(0x29, 0x5, 0x0) syz_emit_ethernet(0x76, 0x0, 0x0) sendmsg$kcm(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="f8", 0x1}], 0x1}, 0x5744935563dc5412) sendmsg(r1, &(0x7f0000003680)={0x0, 0x0, 0x0}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) accept4$alg(r2, 0x0, 0x0, 0x0) socket$can_raw(0x1d, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00', 0x0, 0x0, 0x200000}, {@loopback, 0x15, 0x0, 0x1, 0x1}}, 0x44) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000004}, 0x884) sendmsg$nl_generic(r3, 0x0, 0xc000) 28.12596638s ago: executing program 33 (id=1246): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r1 = socket$kcm(0x29, 0x5, 0x0) syz_emit_ethernet(0x76, 0x0, 0x0) sendmsg$kcm(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="f8", 0x1}], 0x1}, 0x5744935563dc5412) sendmsg(r1, &(0x7f0000003680)={0x0, 0x0, 0x0}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) accept4$alg(r2, 0x0, 0x0, 0x0) socket$can_raw(0x1d, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00', 0x0, 0x0, 0x200000}, {@loopback, 0x15, 0x0, 0x1, 0x1}}, 0x44) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000004}, 0x884) sendmsg$nl_generic(r3, 0x0, 0xc000) 13.11888381s ago: executing program 2 (id=1300): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/split_huge_pages\x00', 0x1, 0x0) write(r0, &(0x7f0000000600)='1,0x7f0000800000,0x7f0000a00000', 0x1f) 12.983855976s ago: executing program 2 (id=1301): truncate(0x0, 0x2fffffd) mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040a00e58684000010203010902270001010080320904000003ff00000007058102400000070502024000000705830308"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) fsopen(&(0x7f0000000200)='binder\x00', 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000400), 0xe) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000100)=0x1, 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0) unshare(0x44040000) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', 0x0, 0x0, 0x0) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f0000000180)={0x9, 0xc25, 0x1e, 0x695, 0xe, "502ca1ecab9861e4d8029df7b84e979ab09a04", 0xe9, 0xe29}) 6.748610361s ago: executing program 2 (id=1311): mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000200, 0x0, &(0x7f00000002c0)='./file0/file0\x00') 6.565851889s ago: executing program 2 (id=1313): add_key(&(0x7f0000000300)='dns_resolver\x00', 0x0, &(0x7f0000000200)="7589d70300", 0x5, 0xffffffffffffffff) 6.295610362s ago: executing program 2 (id=1316): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0xffffffffffffff76, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000240)='proc\x00', 0xc000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) syz_emit_ethernet(0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 6.018214805s ago: executing program 2 (id=1319): syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x1004801, &(0x7f0000000140)=ANY=[], 0x1, 0x224, &(0x7f0000000340)="$eJzsmb9rFFEQx7/v7d7uGUWw0MLmLAJGMHu7eyppLGIrgpCIWh5mDdFNTi5X5AIWwcbGP8B/RCGVhZ2NWFgJ/gDBwpQ2Cj55PzY7l70kS0KwyHyKx/fNzps3M5ebhRwYhjm2fPv668uLGzPzlwGcwiRCZ//hlT6S+H966TWcfLty+ummlY3t5wKAUqW/v8/9AU7izaynL7eo32qnj1JKzUNi0u3vQOKS03chEHnE0Z3OIHDfmR8ZbTPpnXDGPBMPevnCw6U8i/WS6CXVpXYANZL/1obAAoCmu0KQ3FaH64+7OdC3Is8K0VDFPZVHdYQ+WlhsoM9j+2fym5W4Tlqgi7j3/NmG3kfOHpP+JZBInO5AYM7pGYSIoqjltllC6j/vl/E9/bGN1F+3tmY957DsWniw9llxZnpPn6KIw1xRR/xVRxI5ONBHcDRC57G/s/7iUItsVU8FNeLQJtRzLgaUTWOnjyBftuG5rc131Tjf/2t7DyfM4AJQefRhIs9vUcv7m06cHYlzgfaHiIB2ddyfhJ0fwgcukvnkk7dCe7D8pL06XJ9eWu4uZovZSpp2rsVX4vhq2jaz2a5jZ5+N3zTzaYLEb+ziG4gAa93BoJ+sAYN+sr1P7VoWgLlXvZ/mjDTzT2Lqj1LF68WUHY6/w7z/QntOmN2Ut2vyDMMwDMMwDMMwDMMwDMMwe9D6WLHgNdz/KkXxm1gVP71tvP8FAAD//zPPXKY=") ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x4c000) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x40, 0x0, 0x0) epoll_create(0x1) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) chdir(&(0x7f00000000c0)='./sys\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r0, 0x5, 0x2) getdents64(r0, 0x0, 0x22) 3.977162372s ago: executing program 3 (id=1324): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv4/conf/all/rp_filter\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)="101d", 0x2) 3.79670282s ago: executing program 3 (id=1325): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl(r0, 0x3b8e, &(0x7f0000000580)) 3.577714791s ago: executing program 3 (id=1326): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) futex_waitv(&(0x7f0000001480)=[{0x2, &(0x7f0000001400)=0x2, 0x2}], 0x1, 0x0, 0x0, 0x1) 3.534475313s ago: executing program 5 (id=1327): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r2) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000100)={&(0x7f0000000200), 0xc, &(0x7f0000000300)={&(0x7f0000000400)={0x3c, r3, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}]}, 0x3c}}, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, r3, 0x301}, 0x14}}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc}, 0xc, &(0x7f00000004c0)={&(0x7f0000000840)={0xb4, r3, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x80}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xc}, @IPVS_CMD_ATTR_DEST={0x58, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x597}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xc07}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4008000}, 0x800) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x1c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x620b}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) 3.513200144s ago: executing program 4 (id=1328): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x4) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x2000010, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000009200)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x9, 0x9104, 0x40, 0x0, 0x6, 0x3fffff, 0x0, 0x0, 0x40}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="d56cea33946c0eae3241d3604bfce89adddb2eb96960338db7572fa254eb7c69dc0cb526989630e26224c258c8d70ccacc5564d67723f4756c0399174c5460c4995942d24092c36dc820e97344798b5bb45423f853bf50e374323abacf0388cd091016b7a3d7843f4d3ae1658bd34d967e3323a64908442788dbc99c1f4248da53fb5be2c8001236b994ca594e3b3c588beaf3cb1c32c072d768b9e665e7d87044fdfc1fd6452593e6793963153f3850bf85042a5c139799ba8f6cb8d877fc436c4f1601270d6e29d60a4c80d6315e46f4219494ce897127d0b76f5d681e90f4e9282468ef7993cd92076aed266c1db8b81b93adc4969c9b89b32b8768c9f39f2d148e933dbb651746a9364f49986ef73b4c29f647b82b83216bb8179fe5346fdacdc5fda4bd48875cd2f1cf57a0c9a91e059446bac310a6d68948675c35a8e442168fd84d78d9800e5b05bdbce3a6eac65bee7279a3628f2a08931d3d52ce490652c20f8ae529eaf24bf421dad976c68b234ee6f6210c9f9aac3a55c6939d6aa3805b95619546264ff3ff82d0dc690e8ead61b6ed528c3c117cd771a3b7feb214ce8d720640d97f14b399b7f46dc4aad83117e8e642ccb117d13f345536fc3801c124cfaf8aa7aafff6c8df3fdd4469c077eccbd8ddacad80d9113dfde26ae67b226185743b2d53667fb3016fe114f87484ab614ddf0887c4b2c85351ab21a0ece6c066a154b38b4d7c1792d2db2cc5f8ceb42078187949d354b7a08d1529f3d10814757179c860db031dad4a3dc13ca01d1013238ed5f7a9674fcc77f0d34e2118fb851c970d86ecf9de1cfdb8d3ab197480e263c3207c3d7ebe17f9547c7c56b08e83de875294d0fd68df1926ecac24350b2c70bd73e14122ed480c564353d34049e67c26036fc35d04022cd35d6ac00756d3b8550bb22ae80a4bd630a00268d07fa249b0bf545dfbf01bea2f12b30738c6e13156244eb24e6d69ba7c3acdbbefe8bbc06b821aebf836ca07a3cc7b6b24686ed8f3b23085c893e72188b797651c5ab5cceb1465414a325f793a3af6d06eed7eb734ad05bc1f6619e8485259f570a482a67273ee01fe15dd938afce026f1111c7a38ed6d1aba34f009ce1e99140fd0db2de74150541fd48dd2ec5b1d15669de2ffe3a198184b6186ccda31aa64c585ff8cb65b67fe1455753895a88b6ab4c6bf1bb8329739178147e6f15801bfa707bd9ec9da662573ce07af684bb7c880a7d63b0a0a7300881408c44e95c679ea32b0eab845d0b333f245e8d6006258678704aa8cccdaf80cc46138d5b7a0804fdfa34c91d61a0d2fa6c62e7d1a675e5743f845ab40ea5df0182d6eb9781905c94751c75a411699a76f48433142c5f109d5dfddcc0b1dc6254efd5ea50d6ffbc7b9ca031e1a0123844b63c48b964645c6d24707582825e219bcd61677ed4fc45ee1f4be91b4c1b856d65a86acf22b8b0d588bc473248ac040326b1490c2fea24bc0c0a721e2ed63e39973cd4d38df1001dba9b9d995c229655dd26f3cd3d64077ec111e2c370717cb4cd068e0d3a52f1027d3df953e1f1ac768a7215a3695722b1b6714ce43801451a9532212b651d073c780d61712aebadd145c1cd95c1dc0dcf51850046ae5771e365f45858a36e48afe563ec0afee3803ff6a35bc25217b53eda39bb813b8d3d728c21a0b80d014003143666c0d1398cc46a01aaaf97117edda217f984010e7c5cf32535a669d4f11f6b70e3a3b823987ef7c9f878415063bf05205e13bcf7acb287bd0bb0fce77529a711f0ed145ea2ecf2194658dff17c5681cf8c7ad8521d235a705292af4878b3f124be2df661026c091d6c07aae1a74c919f7478d1083f70b3a0fe00c2e220ab998b4595268b6f7cabbfc85e59dfb6ab7a794cd3fd70d5cc4d70ca933a4452df5a345cb31f3267de53519ba39c915d492cd4652843f1d30a5fb311e3b5d868347969f013c5e3b4841b22240abcb61a14ff567186766ce8f6ae64877f672835dbff4fcf19c8230d8a402397630effb698a8b0c9a28ae028d7938ffde488fd64113085bce504cd0551e0eb3730c3f781cbecf0c41d2338766d3f6096661c1f1bec3162b8a0c4099fccd9480e821df8782c2e070530befb62bccd8539fe9dc7d8d3f9bded1bb34db3f2d6050885c8f1d57f5e603f629de7491f5fd9fafcceb565abeaec838b10a763a00a4607d4330bdcedc066d8cf9790d806e03c219866bb8f053a6e602645436d1f469df1d5008f5dcd4bdb7ce5b76ec015a8f4693cb2a63ceb2be00bcf221f0ca32db4efaf8f7022622b335fa8dea4afdd86be10be6c4d66e5f57416add4480509cb98cf31cdda84644eeb782eea041d4bc0e005a20bccc3c4a08cefcdb91cc2c61d9231c4e36e96f6edd2133f9b34e7da90ce20d1c60ff223c6a204bb942766a359b923573bbbaf2a827d79e4f649e79a840216ac4ddb3409c94e71ff08d109bc3f0cf6583219de7d7131a956f835ecf5c131a0b1e056a86d800a0204243f3b695029578c064306a31db53f28a8f0c0302486cd05970904e9b5c53100ac1aabb3110a89820e4d8307c3d46084999d0456c53fec61a9242b486eb41a90f3300fdfd0d8a472e8da7a842588721d1df1f5e4cc425efebc75a904ef4cc881346a4bc23eef4d492e3efccebab86ae4213f42671370579ee7f8341396e9515619e100a8fae2c5cba0139a088579ece7a603c8b8bab9998223fe862dff8480aeaa5970c90b894e5f71c2784e4dfd50ed3e9ed91036e8356c09464de13b4a95227203133b2c2c71cd6323492f083bda58ad7721b6666b9cd93f93f0288482813fd8aade02cca81cd35257e023504ac4f86be1c7a810b67c6d7077f5cdbd305b618a05c03d196894bfb1a6ff511e59ac8ce45d16cee95e1de0797a543728caaa43e5ae42a12b6bb7910d18d4e1ea89d264491287eb23a76095a12a39c46a7c85349e2969edaed3c1fa6a2150494f63f4c98c65fcdd650ac7424ac1ae64421294356ac1e4dbf9d4c817f081f4f7751ebf56788d799bac29dc0bfe83ead7ab3e338b8b84df4cad2b549aaac4e6048a6fa8f8f6f1f7e0e51c8b3c872f18c466e590222b03230f46bc8e9a0171bbd2096c7a480d6a6f29bd74b60105bebda42e59cc830c4b31f6c52687b4ec2ba869149ae363d711d099f94ceade1ada193e931ed9aea0a280ed5f25ad5ab3b4083f140ca17b43e5f6aef2c24a28a0262c80a040187e052ea7d54a528b6fcc176ed3afc07fe6a661d050fb4a3a6abfa3dac5f3230540b45af060781cb5499c2894d6a4a2bf908ddd48d6b34207f56c31229e206c88db3552ceb6e82a0fa2bf7f97baf603d37d6a8b1f2b1f5f95b251129ed05351681908b7cf5cf6cc86dd854174cc19713b4d262b021952b6da5f20f57bbacca62f5b7124409aa625bbea59819baebc1bc2dd188feba48c998d0dbed60d44b8a4f0ac28f6c1c8c9998f7406f1a34e4ce902be2420f7ff51a5ab3b1faa86ab2ec1edbea2493cae090abde43ff27d685c993dedb24eb255772cc56fbd104f4f5275f10d54d7cacb8cbf188ae1a4d29ea880068fb2696b3ba6e8a7c15939e1f7c394ab4bd4c4bef2383121cbeb18646a8e013d570cee3eeecd7fbe84a619f8aa2e34f2e1e9b99d0c7d7d179d9df8d2e2f1cd7ba2c7e60166dc14e5e4ed9c41195935e2884b5bd0057ed0155a5d4c6482e8f554e4cd0d0aef7d6487801ab54d54eb41755d833ab83883b40f47595063ad2a0fee5c661f86b8ab04ad0047d988ad86b3c520eb78dc3d750a57e777f5d766349f1a687e090f744206cb5d048346061b414060f6826d8a884e93f73f1f1f4cb8bd6e8d1215d436d390dbda35b555f550e11e6d8008fce1c429bd9bbd04a1fbb9de28663c1be4d8d7e506bc681ada28a69014b972919b5f70cbb770349324c9af0b7ee7ff4cc8bfe807fb9faa0a69498448b22192d578a1e82582b943051beb543ddca8b643ee6c76ee32278aa8bc92b44a8439a24ed5040545349ab05e831d4511a8da03ca539659585b2267a73775f1cb7c2c5548d3508c896f99a8e5cb55160ab1267e320ac2d7c8f8b57079dd14d301636a1374e24541f8d453978998ed256b381bcf638bb372ce1ebefb341656c02f4092a7667ffec5505e4938dcb03d404654430e244f9f7f7d0fb4189a93f7c2bd7a4fcb3ccff79e41a98adcac3e4c19eebebaec15bd8cea1df0e509cdef62ae10c66734d162caf35a6e511baa717f769c2e449892224fa8ae78de9138cf6ea1d939998a8cb68b0e83cf604e03b99634796d3d495e4617f8fdd9764631e7ed6eafa797deb1159259777bf2915d48b63286f6d6528ad4ca5783609263d9a03aad41ec8ef1e2e1e77734d27229f801192be238468854945c20dab4e1baff9dd593361efda1de95e04561d33cd73a45dff5f85b2e85b0747a49345ac8d38add8ef9c14685eb3d3432f3f994e3ddd4e45b16005870485253afc4f08d8a6d8023b722284d11d56c6ff9209a5bacb7ce1708244bd21878b8cd5c13ab453bd589f6196322de9faede39ce6f94c75d008d2d7ced27a2375cc62c3d5c15c1c4301a01299d8f4c41e5a44e4130e9555a356d6b19728c7d3c86cb9a1ddf906ab63a9447f8233bcd09bd74cf9749f085f0c4689ef40dbc41a7a299f0f891d9d0d3e39409d4d774da53bfb6e8ce668ce50885558e909add2cb9bda2f7e9232541b1a7f742a99740f486ef4f7c98e4052f2da705c56a18d5a8289ae6cbb9dc7de13a8cf420b7a930abaae813b40517d84ae984dfc94cd1021e0e4a7a9e7de841018d474083ca28a829ee03fe625cafcbedadcdef6621ccd679fcd9c9a9ab2136211f8c9a679895aa39facf2d6668e5098b3dd8e0ad78d8caf250dc38f2c9518bccb353ef3418d3906827514c1959d58344ee11a0ef1c1424495cc1a9910187685a47d6dd91f07e5081c5ac3f1b6e363069694dd9072684c5ab0ba56157c10f5fa8409e5bc43b38b31f24a306ca5f7e3de9a392eac1984e877ecb3dfd044f1449b4ae9b586051b1780c0ce462919f4a4b54ad8011d013c3962fc6697d33c2dc6771fec664c82cb16144619b207deb4391866d6c1976b945c5959d19018f15376ce3b05666747743527f22b54171da4dabee2f4e469a5521067de4f92e2bad02e15e812b6cbd27ec88a9eccf600ce7f5643392da9ff6b6412f8e7c68d8c8b9e0006e41777e2a1363a9556befbbb110dff3a84b179da3838acde0b25f53798733a9fb463d76b630aef7c8a43f6219482b34b893fd99cf3a013ecefde7c5c6528e304c1868ff3fd8dd5aba348a05dc950b1c4c281cbb28b800d6d0da180fdee06ec3bad6f97180295ed1d77078156a885b5b0c501ea563e8871adb97dd6052de0ab369bf2d98f434bb2d172d9967bb73d3eba6b52bb8d55d8963bf58d310afedb51c0f94c7814b6da30fd8056ab7be74ac31b1b75c217e3ab93eadcb2d253e5d8bbe47c0f1a411a9e502cf4301d898d905cd5db828e56a722394fa11cca64a03a42e7fc1b3481b71ca0b6a3d9bd1fc8229f7f9d3e6aa0d48051942579fb759201d4715db9a2d399e0745a66dbbd571accf1f2e15573ce832e91bd1f042ab758d9ec13e354f38454cc42668c8d60358916f7e937015f6c38732bcf6131ecde001892cb20fe47153e7e23b1cd2fc4a22662e7bde09f7df10fcbf475783fe23a0fdcb2c3bd8b28453ce523ac19ff77e68c3e9fa0193b796ea68f44132b3a96adebc04181e503f52be4778ef422ce3e6ca38514fa18b500ca518590479e8c73a7942dc2e237d82cda953ae1b296b97ee8ed62e2e755d6ddea7c0334e1b8d76c278bdc454724003106cb6fdc85340d1e784ac8b6551eaabc33c502163ce0d401627bd22ba6be90089372bfa3f91ee745e45844ef8dc0fe3936bef07f9c1d3aadfa4c8e99be6b038bed6beb9597add881da2acc1a3a471f500d68f639cd2bf6f4afab919a2cf747bcbb42b95684e8741b485c3297cf07c7bd98d6653421b61f701a06b82be0fbeecd32eb00feca9c5732bb5e565bccf8c9feb27a50760a785bbb50402768cbd458811e284a604b3374faf3480e1736743665617de9c32fd10e37105ac6dd5303f1a6dc78950bce56215c2a2f9e0ccbc0bf9fe8ccf7647ed29e2aa4948689d681a7a9fe582631338f3eea3df846f28564038ab75aa2a8ee5416b66ceeda9d8f56ecefe07f6a21ace83a2e15ad408d0a480f56708e3d1c96020b124c58f6ff5247f73aff7f77d389167650b8a0b98c97f87a1e5d6c08fa99874ff144bfa905e9da3812f010eeee00f3c9b594450faab5342e1b6e98fed5714a802b67b3e5b1964a62606aacb8222efd4980823f076675ae859e64de7b08f7a0b3d8bc829e1a93eb3b4975b4761cd7fa743e393da537c91f658ea2b23c94244498cdc4bc32c8b9859b9d9792eeabdce635b2d61c311949204826054dba0880505e2b53cc3521fa8b68bbba2ec05050bd3244c02752af1555625ddf50a3656c0043005c43c26a2dc907d5dd67efa831ad974151067b436a75fe99b8c94c9ca9737279fa1aaa09b0108c48c79c7e4ec1eeccfd43aa8e7ab6cacf5a956fc47d4ce77fe719d6eec1730d3e3b3be71d313f644177b6d16df0180848c28b850fbf71168a1ee4e5639bc46f2555b3984dbb91520538dfa6a1905abfb7238ff344d0a7d760f040718a57cfb56634e7de7584097f69f87630693bcf410796266cc3f50302feacfb556bad2506b7191023817527dfe5973101712bda922472076633133a11a76e8bc7d763a2cdaa53fa8d47d442fcc572f791d66d10d8d6a9058ecbbcd6d3dbe45d67b75e1091dd0368bea33ef0f56ba68885630429c24800922062e1066f2d4c4b795332ab03239548df4e6e01c432fe5eb29e8e63f6c7ba4f2edefa208c69e781786e4717c2f71dc2032a98cf1e6d66c10831e17ee776edc6b060ae20d025dc570a88e17da771acd32b7b93d46e43a917b8e2ba8232ad2707324b9b04dd8ee50c3c5a4372c0b1461ab2b7424faf00c7162bd8e8ffc7fadcb055403b0fa7087226ba4330e746af97a3f915f0b9e105759e81fe94a0df0cd6c324fb0b871491b5516c2fbc82c77b07159e3f4c0b7952b74cb4e203a69f241485191e1afc76d12a56db065b0513a41582f655340603c73cb39b728c97d1e919ecf963b91ec2282d25dc426db873394055beb0f9ba20545e2465ce2d0d962f42e1e4c79bdea4cd2829269ff7ef650bbeb5083d39dc7aad668af0b01c521192c548857473b29991f7bb917b5814fe945f4c3ed9bbe0563f4004b391b76860e9fd6b7c0baae82e4ac033f62a2c6ce6a2311b8700b06b5215e604a9b99d37e00450fc7790e893176e9fecda220f838a078a8ef7da7d499b1fe0eb8780c4b9705a6a10674e61b5c228fae1c13488f98c10c1792fa40229dba44b1cb534f9fab6a14407687761d738c91f4b8d4371a1de1a47bde0563a6fc88c4886be5d48c4cb89078c255eb1639598379daf50a672cbf4d8add2d4af6c02aeb1d0f86b611abd363409c7c7fc0b66f307ad3df24241fe06d0f7617d6c3987bb9e5d8f1712aebf095fad19b3b4fcb9cc4fb39012f333c4b040666259ee7bc43cff299a527a8914d71324e91c774b84e9392e615453e9fc648c539059b66f780c888892fe8b30eba799ed18fab08ebc3b9da8bc12a249456351bc0ebafc9f54d5d24697fb53eeb5e734527d690620989f605f57dc65a15a754d304be592acc616cd528b6986064b4457b96cf1fb0ab383a0585acf9887b18e1d6d3aff1e7f2328ea0313a2b36f6f79d671d9ddc4d34fb8fb55a596b2a16c63757083fb4bd01be2e1d82e47c5a44e052279097c5a18feae9884e102cf087611a3b94467ad61635dae6275974f6e6ca7a42ded0ee4577574d56b142853a8c955d92d1eb780de11dc9289acd193214ed4c9f5f26d0481cb3c0c0b8d4c9ad929c61ffeed66bf2e4f7018049593b99358d93559847d55654cee93da30f6578d2e295909791d227a12c09cd4a0edec25d3155086b64a787997a53265cbffb7fe6a2bfd589e12b4d0e21a600276e920397888443584aa99a06d7cfef8e68eeab8fa739c3d8fb74581ceff295110742e763320bed3a4be982b3ebed15ecde37e849aaa91959327d25149f38854ea1137f870aff99979e5e74cc9e45be12e3f0f9912a0955e718a4917e835bca50f43ce92a6bc60ed006b8f623fbacebbfb3dcb4fabd9941a5487c6f637de9a2005a6bc4062e1210a08a51d6f8a5e3f6f97fe90dc7e2e21d4d2f038c0fbc1918aa00e230a4a0e5c41a4808fb9a731271fcc1e73713c9592aa4b2ddccd0d13c3cb68d51166623153445c9ec955c6870dc8543c0684883186082e34ea5714febf8b46921015c3623220d17529896e1a6edac6e32fea2ba30db203238300353602c17dddad7608cad8170b520f6d9d32cdf0156a1de4e9b9eea78f73255ddc6da6994a6018ff900d9886590602ca6a072d8aa5645e2adac0744e2d5b2e1038c746635d5814692c3498aa9043b68f8ce79c44678c5a7d5bc26c085475853b229b2af3dc822ec58047f313c778aae2b64995148174e42908f3ecacd3921855790c0c5a25814416930293010b4f917979d837f4ef9d2d6dce804f5c0926244097746252124a6e0055559ffab197c38778f717362152af8f6dbf7ee03df050ab9b8909556691c2c2775f0f9c26a545db7ba698a4ce37de877705ea97ac0a002db274ea8360a4aa732c2d5e7417138c60cbea69d3b4993ada6a9d8f51d851543a6500a31bac5a057dbef498001f08a44e3c4141900e18b6d73c28c8c67dca805edeb5376384cefe75be1f127225e4d9724b7047d68fa2ed4629e91711a37c80158a07dbce78918931402b472a98a5d5c6b66a2d116314577e94298c37bc441499a9ecea132d87c5d305a0f8f0b3ed16f3b820941082c73b28391d8482ca0cfa78e1e09aa588b0eb1849c6c7916a6bbe56134a6bd93ea306dec125982628dea1db6d022d210627959e1dc819c841f173ed25f356909222e481a1ebb31185fbaeacbd359d2779efe4554ccdac7f4bcc528f656a45049331e16e9c0c796423ec9c7cba15c69d4a8a7741699910f33cc9798a8bf1e48182f08029a14d0131654fd388225d7509e1d7a484e9c7df34d1680bfc6b8d1f6f3920cc4113509fe42dfbd6b261000da9651f7e18088f6c2564472046e5eb7e8c9f8b5286a7452741a7103ced710bfb8e699fb8b1a85c0ae887cc06ef2ff9e2a2b1a77bb4d44ddd4a4e1ba60afcb92baaef108b60486d409889cbb2b1cc77ddff7e4b6caf8cf3488764d84bf3605eb9df709ac6cb36d1a3de89cdd6657f0e6b4009e6dac5d9be14f4ed997cf61e5aaec932520c321359cf286adf6e2dc3094794ae61a4f16089d06e3dc62c958950e73213c1e865c894fe7b8a30de65f5534a1e9c5d19ed49397980126322cb9c72c46a86d7487571300d85b3b5661555f20ab63a78f846c1b8f51a19610a11ffee44f7ccf0f1d67f4148b2c828d74c7f3993965c9067114467a71d242113a68574e28601fce343a023ecc68a72d75259f9a5dce144a7f61ef327192f6474d2bbd06fde3049fe7fb306ba3f54337008d7dbdeaf28a37a224e38ade23adb076cefd3148efcb62539a96d4dfc53f369e34c3d493ac3a5e8c8881133be630a2a906703da62ce7cc02ace9f666d6c3d4b9763a83548825ee1efb54ee3475b09e2616c5bdde3d193181bf020e8ac9ac25f32604b6c11de8ad1a15b9f908c6d7e79181aad1d741b7434aa92597a835c53b9e4b61d6069fa4ee921824d17c98784a8c04590f8d2cf877662b410cae4ebd1ba3616074c020d8cb6099a095735635490d318821310ddd016150edb80370b8d4e2f05557fd619b17192c13353cdae76d495821c610c8641e5b3dff1e7f2ea77b17810ca7975b8e36b7f501a8710b326ef92672096ef66598510902fe663e2a9ef00c3a052f1cfb1739fccb4371f8f28bb92654de5bf87cc2863e92e6d7e4b45d773f90f434eafc8f8398a48527af829a6cae359e7af5941bef158f53798058351107ce58f79ed21036770f6e10e7da92bbca25f369ee83a0f894bbf366a1361f8125b4ffd8e8b4d47ec68cd6b37c840cc5beb8cf65b2269ea1a0e9c371a571f30458ff8ad9bbf8723c19ddae1de5ca7461a436ffcd103c01a20f3252ba0965ee928cfb0d002b9aa4d4f20c805b77e67c8d991c4d07e5419bec9626a32c115d28253dd5f16c17182c1779edf49bdfe3823d87fec88929801163a27bfaeddfd8cdccae8cc3bfd6a9f2e2fec5971fa560c434debd434ff4d0058dcb05d9f3ac5193c458472d6d1685f9f46c8864900c5edbaeeee08971ee1c087f2e11467ff4766743bccf9e3414feedd6dcb904b92a05eec5de8db95444b920c995c770edcedcf7bffc48836c8f30037dde47f0e66fd79550de0ebc3c0c3eba0b66e2a353542eeb20397800e5f41635c5ec2f9a271461bcee8e570ddf945b186f15ab5cabe2a3123189935c6b9010b31732c425a9b2582b097486a5a7b1880b2f16104484e1ca83fa9c278b87e30e4b0cf6ed66c87a979c05683ac94a295d1c53e6f0975a079dd9a2825fdd6ae0926ba1a69f3f69f408eea9d00fbd43235a52c53d11963a611b81dd9f5e05582e1822398873e883662a64c225be19e0b85e102e23fb73d5dcb11435a5437d7418b0409f2e60793038f55ed54c79882b3a17e74ae2148bd558d131dbf446edeb0d05353492534e216761cfcf6582d066a8235a2bd5eb383350a52d7fc2761514e27b6125cb3e387c103dd62e31f5b789c217811c80ccbe3f10fec7a19ad32dc9271368b6d6ba549c45dfd8018507c40962b6ac6468c3078edb71d8ec7f728be8cc23dea1139ac30c2e8d0fc077280e420fbbffc896863db5f1e76922d7dd8e4479c1be822e74212c6f74765e108f916a1b83f6efc8ea54080e9a28b1ba5813a1fefddbe2d0cda413ee1463985b51b59f818f440c9b6a10e4ebf71d37995ae9694ba5867ca2eb2f7bf4e58d26149f2b25943fba216beb3de1f954bcf1bd32ce358b5d23023ab456ebbc493ead41e25b62b5b4ace6c5c18c9a8d512a9cbb4dd59f33663f6138d6b06bc8eb1ec9caccc0077b2e68e7a09d412dfa352e7e5c3942b710ab1648e16d0adda424d9fc2d15c619f4e8093c2b9521e4cdb3f22e655f52ce0fcc1bfd94e56cba8decadb68214451be53f9286c82d2a4912bd2394d1133be908409d791d6d8c2194ca37a76a38d6d0a1fced6478848891d9264cfc08fa849d720339ce00977cad8d9738372184098a7333dd1564d1d7754b4aa4afd6217585804159d31f53017869cb78b718c837b7fd176ce19e3d6996b6f055ed3ba7cd55b0349676c0c113c33d070081ce4ef29af156c4ac8ce760013688d0295d90271e23ef3ca10ec2b3b889855a153c867ce79297a10a02d21e5e8995fbc10d2f4d4bf521565376053b80937bfafaac688108f9962b7c72cf0111874ac8ae27d024ee2f9d57f15b9910a7486ef7542c6629fb0520c93a445542d", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x26d01, 0x0) dup3(r2, r0, 0x80000) close(0x3) 3.277892535s ago: executing program 5 (id=1329): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x21, 0x1, 0x1, 0x5, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8}}}}}}]}}, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000100), 0x12) listen(r2, 0x1) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000008050000010b007e0b0a42"], 0x97) 3.220225477s ago: executing program 4 (id=1330): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x3fa587e6) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_TSC_KHZ_cpu(r3, 0xaea2, 0xffffffff) r4 = socket$kcm(0xa, 0x1, 0x106) setsockopt$sock_attach_bpf(r4, 0x6, 0x17, 0x0, 0x0) r5 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) write$UHID_CREATE2(r5, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) writev(r6, &(0x7f0000000380)=[{&(0x7f0000000100)="cfed", 0xffda}], 0x1) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="09000000010000006d05000002"], 0x48) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x7, 0x200003, 0x801, 0x4, 0x7}) msgrcv(0x0, 0x0, 0x0, 0x3, 0x1000) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000002e40)={{0x3, 0xee00, 0x0, 0x0, 0x0, 0xc0, 0xffff}, 0x0, 0x0, 0xd, 0xd6, 0xa9, 0x1744cf12, 0x40, 0x94, 0x208, 0x2}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x20014000) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r7}, 0x38) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000040), 0x1000, r7, 0x0, 0x11000000}, 0x38) io_setup(0x5, &(0x7f0000000300)=0x0) r9 = eventfd2(0x1, 0x800) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x100}}, './file0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(r10, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x2, 0x4}}, 0x20) io_submit(r8, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x1, r9}]) shutdown(r0, 0x1) r11 = syz_open_dev$mtd(&(0x7f0000000240), 0x0, 0x2) writev(r11, &(0x7f0000000480)=[{&(0x7f0000000000)="bb20", 0x2}], 0x1) socket$nl_route(0x10, 0x3, 0x0) 2.645882655s ago: executing program 3 (id=1331): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40240) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) 2.399778446s ago: executing program 3 (id=1332): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x6, 0x9, 0x8}]}, 0x10) syz_emit_ethernet(0x6f, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x61, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x4d, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd, "9c67524ed6ed152d4f775bbc411126513b67aa2818e6f3aeb55bee6ae1049f195705bc8bd9b1085cd41af77353267df8a1d4cecdb0"}}}}}}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x0) 2.230528554s ago: executing program 3 (id=1333): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x6, 0x9, 0x8}]}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd}}}}}}, 0x0) 1.637180393s ago: executing program 34 (id=1333): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x6, 0x9, 0x8}]}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd}}}}}}, 0x0) 1.413625563s ago: executing program 4 (id=1335): mlock(&(0x7f0000a19000/0x3000)=nil, 0x3000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) 1.196390603s ago: executing program 5 (id=1336): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) epoll_create1(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) r1 = socket$inet(0x2b, 0x801, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x48f, &(0x7f00000000c0)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) write(r2, &(0x7f00000006c0)="5226b445", 0x4) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x8408, &(0x7f0000000680)=[{&(0x7f0000000180)="5c00000014006b03c84e21008bf32c19021800f80200000044000200ac14143705251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b7800000000000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000200), 0x5, 0x86100) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000005c0)={r5, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1c, 0x1c, "fee8a2ab78fc179fd1f8a0e9a1af1ea09dc2b7fb0a010000000000000000030000000000000000000000000000000000000000000000001b00", "28095397bab22d0000b42076c1ce8ef05f819e01177d3d458dac0000000000000000000800000000003788cf8f00", "90be8b1c5512406c7f00", [0x4, 0xa]}}) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r7, 0x40383d0c, &(0x7f0000000040)={{0x5, 0x20000000}, {0x5, 0x1000}, 0xfffffe2a, 0x5}) ioctl$PTP_CLOCK_GETCAPS(r7, 0x80503d01, &(0x7f0000000240)) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r6, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd73, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x6, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd5, 0x0, 0x0, 0xf, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x100003, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x20000, 0xffffffff, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x934a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8d8, 0x4], 0x1, 0x400}) 825.222261ms ago: executing program 5 (id=1337): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r2) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000100)={&(0x7f0000000200), 0xc, &(0x7f0000000300)={&(0x7f0000000400)={0x3c, r3, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}]}, 0x3c}}, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc}, 0xc, &(0x7f00000004c0)={&(0x7f0000000840)={0xb4, r3, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x80}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xc}, @IPVS_CMD_ATTR_DEST={0x58, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x597}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xc07}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4008000}, 0x800) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x1c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x620b}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) 549.849504ms ago: executing program 4 (id=1338): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x10000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000fec000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0xc8a0, 0xc000, 0x7, 0x10023}) 509.921226ms ago: executing program 5 (id=1339): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x40400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0xa, 0x2, 0x0) r2 = socket(0x2, 0x80805, 0x0) utimensat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', &(0x7f00000002c0)={{0x0, 0x3fffffff}}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x1}, 0x0) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x20000000) r3 = syz_open_dev$dri(0x0, 0x0, 0x402) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x9, 0x5, 0x20ffd}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x200000e, 0x11, r3, 0x100000000) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010105, 0x4e20, 0x3, 'lblcr\x00', 0x30, 0x660f5380, 0x3}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000440)={{0x84, @broadcast, 0x4f29, 0x3, 'ovf\x00', 0x5, 0xc, 0x6c}, {@rand_addr=0x64010101, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000022a00)={0x4000000, 0x92, 0x0, 0x0, 0x2}) 285.938436ms ago: executing program 4 (id=1340): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40240) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) 285.389036ms ago: executing program 5 (id=1341): unshare(0x22020400) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010d00000000000000850a00000000000000050000001400050020010000000000000000", @ANYRES32], 0x4c}}, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000240)={@local, @ipv4={'\x00', '\xff\xff', @empty}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20c200a2, r3}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000001900110100000000000000000a"], 0x1c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 0s ago: executing program 4 (id=1342): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x3fa587e6) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_TSC_KHZ_cpu(r3, 0xaea2, 0xffffffff) r4 = socket$kcm(0xa, 0x1, 0x106) setsockopt$sock_attach_bpf(r4, 0x6, 0x17, 0x0, 0x0) r5 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) write$UHID_CREATE2(r5, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) writev(r6, &(0x7f0000000380)=[{&(0x7f0000000100)="cfed", 0xffda}], 0x1) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="09000000010000006d05000002"], 0x48) msgrcv(0x0, 0x0, 0x0, 0x3, 0x1000) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000002e40)={{0x3, 0xee00, 0x0, 0x0, 0x0, 0xc0, 0xffff}, 0x0, 0x0, 0xd, 0xd6, 0xa9, 0x1744cf12, 0x40, 0x94, 0x208, 0x2}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x20014000) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r7}, 0x38) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000040), 0x1000, r7, 0x0, 0x11000000}, 0x38) io_setup(0x5, &(0x7f0000000300)=0x0) r9 = eventfd2(0x1, 0x800) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x100}}, './file0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(r10, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x2, 0x4}}, 0x20) io_submit(r8, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x1, r9}]) shutdown(r0, 0x1) r11 = syz_open_dev$mtd(&(0x7f0000000240), 0x0, 0x2) writev(r11, &(0x7f0000000480)=[{&(0x7f0000000000)="bb20", 0x2}], 0x1) socket$nl_route(0x10, 0x3, 0x0) kernel console output (not intermixed with test programs): 1/input/input7 [ 250.139212][ T28] dvb-usb: schedule remote query interval to 150 msecs. [ 250.168409][ T28] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 250.333761][ T28] dvb-usb: bulk message failed: -22 (1/0) [ 250.348299][ T28] dvb-usb: error while querying for an remote control event. [ 252.415575][ T5777] Bluetooth: hci3: command 0x0406 tx timeout [ 252.457383][ T28] dvb-usb: bulk message failed: -22 (1/0) [ 252.463137][ T28] dvb-usb: error while querying for an remote control event. [ 252.536355][ T28] usb 1-1: USB disconnect, device number 6 [ 252.629732][ T28] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 255.467637][ T7205] netlink: 'syz.2.439': attribute type 2 has an invalid length. [ 255.859976][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.869384][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.796016][ T5771] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 258.988169][ T5771] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 259.009114][ T5771] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 259.092375][ T5771] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 259.147429][ T5771] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.410630][ T5771] usb 4-1: config 0 descriptor?? [ 259.611186][ T5771] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 259.678814][ T5771] dvb-usb: bulk message failed: -22 (3/0) [ 260.059330][ T5771] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 260.116159][ T5771] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 260.142468][ T5771] usb 4-1: media controller created [ 265.757739][ T5771] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 265.961647][ T5771] dvb-usb: bulk message failed: -22 (6/0) [ 265.967644][ T5771] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 265.975622][ T5777] Bluetooth: hci3: command 0x0406 tx timeout [ 265.985196][ T5771] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input8 [ 267.782543][ T5771] dvb-usb: schedule remote query interval to 150 msecs. [ 267.805480][ T5771] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 267.817877][ T5771] usb 4-1: USB disconnect, device number 4 [ 268.031484][ T5771] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 268.695862][ T5771] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 269.476539][ T7277] netlink: 8 bytes leftover after parsing attributes in process `syz.0.462'. [ 269.678130][ T5771] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 270.485189][ T5771] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 270.515506][ T5771] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 270.555184][ T5771] usb 4-1: SerialNumber: syz [ 270.596689][ T5771] hub 4-1:1.0: bad descriptor, ignoring hub [ 270.602656][ T5771] hub: probe of 4-1:1.0 failed with error -5 [ 271.942714][ T5771] cdc_ether: probe of 4-1:1.0 failed with error -71 [ 272.941000][ T5771] usb 4-1: USB disconnect, device number 5 [ 277.728326][ T5772] Bluetooth: hci0: unexpected event for opcode 0x2002 [ 284.951619][ T7371] syz.3.491: attempt to access beyond end of device [ 284.951619][ T7371] nbd3: rw=0, sector=0, nr_sectors = 1 limit=0 [ 287.012741][ T5807] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 287.028877][ T5807] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 287.316137][ T7401] netlink: 'syz.3.501': attribute type 1 has an invalid length. [ 287.355627][ T7401] bond1: entered promiscuous mode [ 287.361032][ T7401] 8021q: adding VLAN 0 to HW filter on device bond1 [ 287.365568][ T7388] hid-generic 0000:0000:0000.0002: pid 7388 passed too large report [ 287.396973][ T7401] 8021q: adding VLAN 0 to HW filter on device bond1 [ 287.404383][ T7401] bond1: (slave gre1): The slave device specified does not support setting the MAC address [ 287.415211][ T7401] bond1: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 287.430482][ T7401] bond1: (slave gre1): making interface the new active one [ 287.438359][ T7401] gre1: entered promiscuous mode [ 287.446537][ T7401] bond1: (slave gre1): Enslaving as an active interface with an up link [ 287.715602][ T8] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 287.897910][ T8] usb 4-1: Using ep0 maxpacket: 32 [ 287.907642][ T8] usb 4-1: config 0 has an invalid interface number: 37 but max is 1 [ 287.917213][ T8] usb 4-1: config 0 has no interface number 1 [ 287.932771][ T8] usb 4-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=20.a3 [ 287.943483][ T8] usb 4-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 287.954628][ T8] usb 4-1: Product: syz [ 287.959750][ T8] usb 4-1: Manufacturer: syz [ 287.968670][ T8] usb 4-1: SerialNumber: syz [ 287.984529][ T8] usb 4-1: config 0 descriptor?? [ 288.404842][ T7422] netlink: 'syz.0.507': attribute type 2 has an invalid length. [ 289.625596][ T8] usb 4-1: Could not set interface, error -71 [ 289.686736][ T8] usb 4-1: USB disconnect, device number 6 [ 290.651354][ T7457] netlink: 'syz.0.518': attribute type 2 has an invalid length. [ 292.143054][ T5772] Bluetooth: hci3: command 0x0406 tx timeout [ 297.765909][ T8] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 297.983201][ T8] usb 3-1: Using ep0 maxpacket: 8 [ 298.003596][ T8] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 298.018157][ T8] usb 3-1: config 179 has no interface number 0 [ 298.033081][ T8] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 298.049218][ T8] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 298.065652][ T8] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 298.076472][ T8] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 298.114277][ T8] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 298.142355][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.164188][ T7488] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 298.497581][ T8] usb 3-1: USB disconnect, device number 5 [ 298.729498][ T7505] netlink: 'syz.3.533': attribute type 2 has an invalid length. [ 305.007309][ T27] audit: type=1326 audit(1789312931.957:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7542 comm="syz.0.545" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ab3b9e159 code=0x7ffc0000 [ 305.042466][ T27] audit: type=1326 audit(1789312931.957:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7542 comm="syz.0.545" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ab3b9e159 code=0x7ffc0000 [ 305.072030][ T27] audit: type=1326 audit(1789312931.987:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7542 comm="syz.0.545" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=199 compat=0 ip=0x7f9ab3b9e159 code=0x7ffc0000 [ 305.248611][ T27] audit: type=1326 audit(1789312931.987:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7542 comm="syz.0.545" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ab3b9e159 code=0x7ffc0000 [ 305.352554][ T27] audit: type=1326 audit(1789312931.987:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7542 comm="syz.0.545" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ab3b9e159 code=0x7ffc0000 [ 305.488724][ T27] audit: type=1326 audit(1789312931.987:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7542 comm="syz.0.545" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f9ab3b9e159 code=0x7ffc0000 [ 305.668675][ T27] audit: type=1326 audit(1789312931.987:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7542 comm="syz.0.545" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ab3b9e159 code=0x7ffc0000 [ 305.773632][ T27] audit: type=1326 audit(1789312931.987:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7542 comm="syz.0.545" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ab3b9e159 code=0x7ffc0000 [ 305.883164][ T7545] ip_tables: iptables: counters copy to user failed while replacing table [ 306.286139][ T5842] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 306.321528][ T27] audit: type=1326 audit(1789312931.987:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7542 comm="syz.0.545" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f9ab3b9e159 code=0x7ffc0000 [ 306.447787][ T27] audit: type=1326 audit(1789312931.987:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7542 comm="syz.0.545" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ab3b9e159 code=0x7ffc0000 [ 306.656377][ T5842] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 306.805533][ T5842] usb 1-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice= 1.00 [ 306.907374][ T5842] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.044429][ T5842] usb 1-1: Product: syz [ 307.118722][ T5842] usb 1-1: Manufacturer: syz [ 307.202224][ T5842] usb 1-1: SerialNumber: syz [ 307.747034][ T5842] kalmia: probe of 1-1:1.0 failed with error -22 [ 308.928656][ T28] usb 1-1: USB disconnect, device number 7 [ 309.832911][ T7593] netlink: 12 bytes leftover after parsing attributes in process `syz.3.562'. [ 310.981295][ T7598] netlink: 72 bytes leftover after parsing attributes in process `syz.3.563'. [ 311.034846][ T7598] netlink: 28 bytes leftover after parsing attributes in process `syz.3.563'. [ 313.411278][ T7628] netlink: 72 bytes leftover after parsing attributes in process `syz.3.574'. [ 313.498258][ T7628] netlink: 28 bytes leftover after parsing attributes in process `syz.3.574'. [ 313.825793][ T5842] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 314.065863][ T5842] usb 1-1: Using ep0 maxpacket: 16 [ 314.082176][ T5842] usb 1-1: config 1 has an invalid interface number: 105 but max is 0 [ 314.095552][ T5842] usb 1-1: config 1 has no interface number 0 [ 314.122687][ T5842] usb 1-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 314.139627][ T5842] usb 1-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 314.180825][ T5842] usb 1-1: config 1 interface 105 has no altsetting 0 [ 314.209916][ T5842] usb 1-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 314.233581][ T5842] usb 1-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 314.255470][ T5842] usb 1-1: Product: syz [ 314.272907][ T5842] usb 1-1: Manufacturer: syz [ 314.279727][ T5842] usb 1-1: SerialNumber: syz [ 314.319147][ T7632] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 314.360877][ T7632] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 317.101766][ T5842] aqc111: probe of 1-1:1.105 failed with error -71 [ 317.116566][ T7654] netlink: 72 bytes leftover after parsing attributes in process `syz.0.586'. [ 317.135600][ T7654] netlink: 28 bytes leftover after parsing attributes in process `syz.0.586'. [ 317.265643][ T5842] usb 1-1: USB disconnect, device number 8 [ 317.308501][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.314849][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 319.626349][ T7675] Cannot find del_set index 0 as target [ 322.521817][ T7691] netlink: 'syz.3.598': attribute type 2 has an invalid length. [ 326.746032][ T7734] netlink: 44 bytes leftover after parsing attributes in process `syz.0.612'. [ 329.427671][ T7765] io-wq is not configured for unbound workers [ 329.514360][ T7768] netlink: 'syz.1.625': attribute type 1 has an invalid length. [ 329.701544][ T7768] bond1: entered promiscuous mode [ 329.707252][ T7768] 8021q: adding VLAN 0 to HW filter on device bond1 [ 329.738581][ T7765] netlink: 8 bytes leftover after parsing attributes in process `syz.0.621'. [ 329.900262][ T7778] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 330.015840][ T23] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 330.225673][ T23] usb 2-1: Using ep0 maxpacket: 32 [ 330.235169][ T23] usb 2-1: config 0 has an invalid interface number: 37 but max is 1 [ 330.263283][ T23] usb 2-1: config 0 has no interface number 1 [ 330.312740][ T23] usb 2-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=20.a3 [ 330.345823][ T23] usb 2-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 330.364664][ T23] usb 2-1: Product: syz [ 330.383924][ T23] usb 2-1: Manufacturer: syz [ 330.400976][ T23] usb 2-1: SerialNumber: syz [ 330.436210][ T23] usb 2-1: config 0 descriptor?? [ 331.485664][ T23] usb 2-1: Could not set interface, error -71 [ 331.631408][ T23] usb 2-1: USB disconnect, device number 5 [ 332.176122][ T7813] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0, syncid = 1, id = 0 [ 333.306457][ T7841] netlink: 12 bytes leftover after parsing attributes in process `syz.0.651'. [ 334.290250][ T7864] FAULT_INJECTION: forcing a failure. [ 334.290250][ T7864] name fail_futex, interval 1, probability 0, space 0, times 1 [ 334.308490][ T7864] CPU: 0 PID: 7864 Comm: syz.2.658 Not tainted syzkaller #0 [ 334.315810][ T7864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 334.325882][ T7864] Call Trace: [ 334.329149][ T7864] [ 334.332065][ T7864] dump_stack_lvl+0x18c/0x250 [ 334.336756][ T7864] ? show_regs_print_info+0x20/0x20 [ 334.341998][ T7864] ? load_image+0x420/0x420 [ 334.346527][ T7864] ? stack_trace_save+0xaa/0x100 [ 334.351511][ T7864] should_fail_ex+0x394/0x4c0 [ 334.356229][ T7864] get_futex_key+0x136/0x1030 [ 334.360929][ T7864] ? futex_setup_timer+0xc0/0xc0 [ 334.365862][ T7864] futex_wake+0x127/0x4f0 [ 334.370184][ T7864] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 334.376163][ T7864] ? futex_wake_mark+0x150/0x150 [ 334.381116][ T7864] ? lockdep_hardirqs_on+0x98/0x150 [ 334.386343][ T7864] do_futex+0x35d/0x3e0 [ 334.390511][ T7864] ? __ia32_sys_get_robust_list+0x110/0x110 [ 334.396437][ T7864] __se_sys_futex+0x3a9/0x440 [ 334.401143][ T7864] ? __x64_sys_futex+0xf0/0xf0 [ 334.405935][ T7864] ? __x64_sys_futex+0x21/0xf0 [ 334.410723][ T7864] do_syscall_64+0x55/0xb0 [ 334.415170][ T7864] ? clear_bhb_loop+0x40/0x90 [ 334.419869][ T7864] ? clear_bhb_loop+0x40/0x90 [ 334.424570][ T7864] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 334.430485][ T7864] RIP: 0033:0x7f4796f9e159 [ 334.434919][ T7864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 334.454546][ T7864] RSP: 002b:00007f4797d9f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 334.462985][ T7864] RAX: ffffffffffffffda RBX: 00007f4797225fa8 RCX: 00007f4796f9e159 [ 334.470978][ T7864] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f4797225fac [ 334.478970][ T7864] RBP: 00007f4797225fa0 R08: 0000000000745a2b R09: 0000000000000000 [ 334.486960][ T7864] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000 [ 334.494946][ T7864] R13: 00007f4797226038 R14: 00007ffd534af3e0 R15: 00007ffd534af4c8 [ 334.502950][ T7864] [ 334.692269][ T7869] netlink: 'syz.1.660': attribute type 2 has an invalid length. [ 339.755523][ T7885] null_blk: disk nullb1 created [ 342.737690][ T7915] netlink: 'syz.1.672': attribute type 2 has an invalid length. [ 346.848133][ T7920] netlink: 'syz.2.675': attribute type 2 has an invalid length. [ 347.236043][ T5842] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 347.631576][ T5842] usb 4-1: Using ep0 maxpacket: 8 [ 347.710760][ T5842] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 348.195678][ T5842] usb 4-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 348.235635][ T5842] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.311993][ T5842] usb 4-1: Product: syz [ 348.321711][ T5842] usb 4-1: Manufacturer: syz [ 348.329627][ T5842] usb 4-1: SerialNumber: syz [ 350.690399][ T7956] netlink: 'syz.1.685': attribute type 2 has an invalid length. [ 353.147189][ T5842] vmk80xx 4-1:8.0: driver 'vmk80xx' failed to auto-configure device. [ 353.188445][ T5842] usb 4-1: USB disconnect, device number 7 [ 353.298397][ T7960] netlink: 'syz.3.688': attribute type 2 has an invalid length. [ 353.675739][ T7971] nvme nvme0: rdma_resolve_addr failed (-19). [ 353.833237][ T7980] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0, syncid = 1, id = 0 [ 354.030442][ T7983] netlink: 'syz.2.696': attribute type 2 has an invalid length. [ 356.030086][ T7991] netlink: 'syz.3.699': attribute type 2 has an invalid length. [ 356.185704][ T23] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 356.275518][ T5806] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 356.385537][ T23] usb 2-1: Using ep0 maxpacket: 8 [ 356.393504][ T23] usb 2-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 356.431210][ T23] usb 2-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 356.452905][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.475900][ T5806] usb 1-1: Using ep0 maxpacket: 8 [ 356.484869][ T23] usb 2-1: Product: syz [ 356.487307][ T5806] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 356.506790][ T23] usb 2-1: Manufacturer: syz [ 356.515750][ T23] usb 2-1: SerialNumber: syz [ 356.525557][ T5806] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 356.538594][ T5806] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 356.549728][ T5806] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 356.562878][ T5806] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 356.597594][ T5806] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 356.636968][ T5806] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.056667][ T5806] usb 1-1: usb_control_msg returned -32 [ 357.072705][ T5806] usbtmc 1-1:16.0: can't read capabilities [ 357.660063][ T8010] virtio_blk virtio4: 1/0/0 default/read/poll queues [ 357.679432][ T8010] virtio_blk virtio4: [vda] 262144 512-byte logical blocks (134 MB/128 MiB) [ 358.989690][ T8010] syz.1.697 (8010) used greatest stack depth: 19496 bytes left [ 359.012337][ T23] vmk80xx 2-1:8.0: driver 'vmk80xx' failed to auto-configure device. [ 359.041730][ T23] usb 2-1: USB disconnect, device number 6 [ 360.962755][ T8026] netlink: 'syz.3.708': attribute type 2 has an invalid length. [ 361.195580][ T23] usb 1-1: USB disconnect, device number 9 [ 361.328294][ T8043] netlink: 'syz.2.715': attribute type 1 has an invalid length. [ 361.462087][ T8049] null_blk: disk nullb1 created [ 361.655684][ T5771] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 361.780743][ T8055] netlink: 'syz.0.721': attribute type 2 has an invalid length. [ 361.860261][ T5771] usb 2-1: Using ep0 maxpacket: 8 [ 361.883695][ T5771] usb 2-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 361.921385][ T5771] usb 2-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 361.946833][ T5771] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.968416][ T5771] usb 2-1: Product: syz [ 361.972741][ T5771] usb 2-1: Manufacturer: syz [ 361.984164][ T5771] usb 2-1: SerialNumber: syz [ 363.756186][ T8075] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0, syncid = 1, id = 0 [ 364.256674][ T8085] netlink: 'syz.0.732': attribute type 2 has an invalid length. [ 364.724944][ T5771] vmk80xx 2-1:8.0: driver 'vmk80xx' failed to auto-configure device. [ 364.802939][ T5771] usb 2-1: USB disconnect, device number 7 [ 368.338723][ T8116] netlink: 'syz.0.741': attribute type 2 has an invalid length. [ 369.263637][ T8130] rnbd_client L602: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 369.639448][ T8130] rtrs_client L2075: : Failed to resolve address, err: -19 [ 369.650221][ T8130] rtrs_client L2618: : init_conns() failed: err=-19 path=@ip:127.0.0.1 [:0] [ 375.858141][ T8122] syz.0.744: vmalloc error: size 134217728, failed to allocated page array size 262144, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 375.946041][ T8122] CPU: 0 PID: 8122 Comm: syz.0.744 Not tainted syzkaller #0 [ 375.953402][ T8122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 375.963575][ T8122] Call Trace: [ 375.966877][ T8122] [ 375.969796][ T8122] dump_stack_lvl+0x18c/0x250 [ 375.974469][ T8122] ? show_regs_print_info+0x20/0x20 [ 375.979652][ T8122] ? load_image+0x420/0x420 [ 375.984143][ T8122] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 375.990548][ T8122] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 375.997058][ T8122] warn_alloc+0x246/0x340 [ 376.001415][ T8122] ? zone_watermark_ok_safe+0x230/0x230 [ 376.007003][ T8122] ? _raw_spin_unlock+0x28/0x40 [ 376.011887][ T8122] __vmalloc_node_range+0x661/0x1320 [ 376.017210][ T8122] ? __asan_memset+0x22/0x40 [ 376.021859][ T8122] ? free_vm_area+0x50/0x50 [ 376.026394][ T8122] ? kvmalloc_node+0x70/0x180 [ 376.031100][ T8122] ? rcu_is_watching+0x15/0xb0 [ 376.035902][ T8122] ? kvmalloc_node+0x70/0x180 [ 376.040613][ T8122] ? trace_kmalloc+0x1f/0xa0 [ 376.045227][ T8122] kvmalloc_node+0x13f/0x180 [ 376.049825][ T8122] ? vdpasim_blk_dev_add+0x1a8/0x290 [ 376.055135][ T8122] vdpasim_blk_dev_add+0x1a8/0x290 [ 376.060251][ T8122] ? vdpasim_net_mgmtdev_release+0x10/0x10 [ 376.066063][ T8122] ? vdpasim_blk_get_config+0x5a0/0x5a0 [ 376.071636][ T8122] ? vdpasim_blk_dev_del+0x20/0x20 [ 376.076747][ T8122] ? vdpasim_blk_work+0x15b0/0x15b0 [ 376.081947][ T8122] ? vdpa_mgmtdev_get_from_attr+0x267/0x270 [ 376.087841][ T8122] vdpa_nl_cmd_dev_add_set_doit+0xa85/0xbd0 [ 376.093743][ T8122] ? vdpa_nl_cmd_mgmtdev_get_dumpit+0x270/0x270 [ 376.099983][ T8122] ? __nla_parse+0x40/0x50 [ 376.104403][ T8122] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 376.110736][ T8122] genl_family_rcv_msg_doit+0x21a/0x310 [ 376.116284][ T8122] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 376.122184][ T8122] ? bpf_lsm_capable+0x9/0x10 [ 376.126860][ T8122] ? security_capable+0x89/0xb0 [ 376.131800][ T8122] genl_rcv_msg+0x611/0x7a0 [ 376.136304][ T8122] ? genl_bind+0x360/0x360 [ 376.140716][ T8122] ? vdpa_nl_cmd_mgmtdev_get_dumpit+0x270/0x270 [ 376.146968][ T8122] netlink_rcv_skb+0x235/0x4c0 [ 376.151730][ T8122] ? genl_bind+0x360/0x360 [ 376.156155][ T8122] ? netlink_ack+0x1160/0x1160 [ 376.160928][ T8122] ? __lock_acquire+0x7d80/0x7d80 [ 376.165953][ T8122] ? net_generic+0x1e/0x240 [ 376.170462][ T8122] ? down_read+0x1ac/0x2e0 [ 376.174880][ T8122] genl_rcv+0x28/0x40 [ 376.178860][ T8122] netlink_unicast+0x7b1/0x930 [ 376.183628][ T8122] netlink_sendmsg+0x8d0/0xbf0 [ 376.188395][ T8122] ? netlink_getsockopt+0x590/0x590 [ 376.193597][ T8122] ? apparmor_socket_sendmsg+0x8e/0x330 [ 376.199144][ T8122] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 376.204429][ T8122] ? security_socket_sendmsg+0x80/0xa0 [ 376.209884][ T8122] ? netlink_getsockopt+0x590/0x590 [ 376.215080][ T8122] ____sys_sendmsg+0x61b/0x980 [ 376.219849][ T8122] ? __asan_memset+0x22/0x40 [ 376.224441][ T8122] ? __sys_sendmsg_sock+0x30/0x30 [ 376.229461][ T8122] ? __import_iovec+0x5f2/0x850 [ 376.234319][ T8122] ? import_iovec+0x73/0xa0 [ 376.240496][ T8122] ___sys_sendmsg+0x2a6/0x360 [ 376.245178][ T8122] ? __sys_sendmsg+0x2b0/0x2b0 [ 376.249977][ T8122] __se_sys_sendmsg+0x1d0/0x2c0 [ 376.254832][ T8122] ? __x64_sys_sendmsg+0x80/0x80 [ 376.259781][ T8122] ? lockdep_hardirqs_on+0x98/0x150 [ 376.264986][ T8122] do_syscall_64+0x55/0xb0 [ 376.269402][ T8122] ? clear_bhb_loop+0x40/0x90 [ 376.274075][ T8122] ? clear_bhb_loop+0x40/0x90 [ 376.278752][ T8122] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 376.284643][ T8122] RIP: 0033:0x7f9ab3b9e159 [ 376.289055][ T8122] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.308659][ T8122] RSP: 002b:00007f9ab1df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 376.317076][ T8122] RAX: ffffffffffffffda RBX: 00007f9ab3e25fa0 RCX: 00007f9ab3b9e159 [ 376.325042][ T8122] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 376.333008][ T8122] RBP: 00007f9ab3c3503b R08: 0000000000000000 R09: 0000000000000000 [ 376.340973][ T8122] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 376.348939][ T8122] R13: 00007f9ab3e26038 R14: 00007f9ab3e25fa0 R15: 00007ffce8d6a0b8 [ 376.356931][ T8122] [ 376.429982][ T8122] Mem-Info: [ 376.433164][ T8122] active_anon:23216 inactive_anon:0 isolated_anon:0 [ 376.433164][ T8122] active_file:13026 inactive_file:44276 isolated_file:0 [ 376.433164][ T8122] unevictable:768 dirty:124 writeback:0 [ 376.433164][ T8122] slab_reclaimable:10620 slab_unreclaimable:91183 [ 376.433164][ T8122] mapped:37293 shmem:18659 pagetables:660 [ 376.433164][ T8122] sec_pagetables:0 bounce:0 [ 376.433164][ T8122] kernel_misc_reclaimable:0 [ 376.433164][ T8122] free:1161338 free_pcp:7426 free_cma:0 [ 376.529251][ T8122] Node 0 active_anon:97264kB inactive_anon:0kB active_file:52104kB inactive_file:176904kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:149172kB dirty:496kB writeback:0kB shmem:77500kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11188kB pagetables:2640kB sec_pagetables:0kB all_unreclaimable? no [ 376.578728][ T8139] netlink: 'syz.2.739': attribute type 2 has an invalid length. [ 376.645467][ T8122] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 376.725491][ T8122] Node 0 [ 376.727861][ T8141] ======================================================= [ 376.727861][ T8141] WARNING: The mand mount option has been deprecated and [ 376.727861][ T8141] and is ignored by this kernel. Remove the mand [ 376.727861][ T8141] option from the mount to silence this warning. [ 376.727861][ T8141] ======================================================= [ 378.348679][ T8141] sched: RT throttling activated [ 378.366511][ T8122] DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 378.887025][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.893378][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.903426][ T8122] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 378.911343][ T8122] Node 0 DMA32 free:899492kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:183568kB inactive_anon:0kB active_file:53804kB inactive_file:176088kB unevictable:1536kB writepending:504kB present:3129332kB managed:2586820kB mlocked:0kB bounce:0kB free_pcp:15048kB local_pcp:13772kB free_cma:0kB [ 378.943802][ T8122] lowmem_reserve[]: 0 0 0 0 0 [ 378.949307][ T8122] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:816kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 378.982276][ T8122] lowmem_reserve[]: 0 0 0 0 0 [ 378.992875][ T8122] Node 1 Normal free:3635152kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:17728kB local_pcp:5184kB free_cma:0kB [ 379.061763][ T8122] lowmem_reserve[]: 0 0 0 0 0 [ 379.075116][ T8122] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 379.093940][ T8122] Node 0 DMA32: 3*4kB (ME) 3*8kB (E) 0*16kB 8*32kB (E) 2*64kB (UE) 2*128kB (ME) 1*256kB (M) 9*512kB (U) 11*1024kB (UM) 21*2048kB (UME) 205*4096kB (UM) = 899492kB [ 379.115673][ T8122] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 379.134328][ T8122] Node 1 Normal: 198*4kB (UE) 43*8kB (UE) 38*16kB (UE) 96*32kB (UE) 28*64kB (UME) 8*128kB (UME) 0*256kB 3*512kB (UME) 1*1024kB (U) 2*2048kB (UE) 884*4096kB (M) = 3635152kB [ 379.157717][ T8122] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 379.270482][ T8122] Node 0 hugepages_total=129 hugepages_free=129 hugepages_surp=0 hugepages_size=2048kB [ 379.286337][ T8122] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 379.960692][ T8122] Node 1 hugepages_total=129 hugepages_free=129 hugepages_surp=0 hugepages_size=2048kB [ 380.002115][ T8122] 98367 total pagecache pages [ 380.025175][ T8122] 0 pages in swap cache [ 380.044246][ T8122] Free swap = 124728kB [ 380.065506][ T8122] Total swap = 124996kB [ 380.069811][ T8122] 2097051 pages RAM [ 380.073627][ T8122] 0 pages HighMem/MovableOnly [ 380.085597][ T8122] 416960 pages reserved [ 380.095507][ T8122] 0 pages cma reserved [ 381.580299][ T8164] netlink: 'syz.1.758': attribute type 2 has an invalid length. [ 382.108065][ T5842] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 383.113031][ T5842] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 383.134450][ T5842] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 383.167954][ T5842] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 383.190837][ T5842] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.549468][ T5842] usb 2-1: usb_control_msg returned -32 [ 383.607538][ T5842] usbtmc 2-1:16.0: can't read capabilities [ 384.739291][ T8206] netlink: 'syz.2.768': attribute type 2 has an invalid length. [ 386.074913][ T9] usb 2-1: USB disconnect, device number 8 [ 386.233692][ T8218] loop8: detected capacity change from 0 to 16384 [ 386.677130][ T9] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 387.326168][ T9] usb 1-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 387.356723][ T9] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 387.374580][ T9] usb 1-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 387.409671][ T9] usb 1-1: config 1 interface 0 has no altsetting 0 [ 387.435007][ T9] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 387.482744][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.183975][ T9] usb 1-1: Product: syz [ 388.192533][ T27] kauditd_printk_skb: 5 callbacks suppressed [ 388.192547][ T27] audit: type=1800 audit(1789313014.817:111): pid=8237 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.776" name="c_srate" dev="configfs" ino=17856 res=0 errno=0 [ 388.219246][ T9] usb 1-1: Manufacturer: syz [ 388.223871][ T9] usb 1-1: SerialNumber: syz [ 388.271167][ T8221] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 388.318440][ T8221] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 388.587695][ T9] rtl8150 1-1:1.0: couldn't find required endpoints [ 388.617048][ T9] rtl8150: probe of 1-1:1.0 failed with error -5 [ 388.683615][ T9] usb 1-1: USB disconnect, device number 10 [ 390.552997][ T8251] warn_alloc: 3 callbacks suppressed [ 390.553014][ T8251] syz.3.780: vmalloc error: size 134217728, failed to allocated page array size 262144, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 390.625588][ T8274] binder: 8273:8274 ioctl c0306201 0 returned -14 [ 390.685834][ T8251] CPU: 1 PID: 8251 Comm: syz.3.780 Not tainted syzkaller #0 [ 390.693182][ T8251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 390.703259][ T8251] Call Trace: [ 390.706560][ T8251] [ 390.709510][ T8251] dump_stack_lvl+0x18c/0x250 [ 390.714228][ T8251] ? show_regs_print_info+0x20/0x20 [ 390.719458][ T8251] ? load_image+0x420/0x420 [ 390.723993][ T8251] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 390.730439][ T8251] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 390.736973][ T8251] warn_alloc+0x246/0x340 [ 390.741339][ T8251] ? zone_watermark_ok_safe+0x230/0x230 [ 390.746918][ T8251] ? _raw_spin_unlock+0x28/0x40 [ 390.751801][ T8251] __vmalloc_node_range+0x661/0x1320 [ 390.757110][ T8251] ? __asan_memset+0x22/0x40 [ 390.761733][ T8251] ? free_vm_area+0x50/0x50 [ 390.766245][ T8251] ? kvmalloc_node+0x70/0x180 [ 390.770929][ T8251] ? rcu_is_watching+0x15/0xb0 [ 390.775698][ T8251] ? kvmalloc_node+0x70/0x180 [ 390.780375][ T8251] ? trace_kmalloc+0x1f/0xa0 [ 390.784971][ T8251] kvmalloc_node+0x13f/0x180 [ 390.789565][ T8251] ? vdpasim_blk_dev_add+0x1a8/0x290 [ 390.794851][ T8251] vdpasim_blk_dev_add+0x1a8/0x290 [ 390.799965][ T8251] ? vdpasim_net_mgmtdev_release+0x10/0x10 [ 390.805786][ T8251] ? vdpasim_blk_get_config+0x5a0/0x5a0 [ 390.811345][ T8251] ? vdpasim_blk_dev_del+0x20/0x20 [ 390.816458][ T8251] ? vdpasim_blk_work+0x15b0/0x15b0 [ 390.821659][ T8251] ? vdpa_mgmtdev_get_from_attr+0x267/0x270 [ 390.827555][ T8251] vdpa_nl_cmd_dev_add_set_doit+0xa85/0xbd0 [ 390.833456][ T8251] ? vdpa_nl_cmd_mgmtdev_get_dumpit+0x270/0x270 [ 390.839693][ T8251] ? __nla_parse+0x40/0x50 [ 390.844116][ T8251] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 390.850449][ T8251] genl_family_rcv_msg_doit+0x21a/0x310 [ 390.856000][ T8251] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 390.861901][ T8251] ? bpf_lsm_capable+0x9/0x10 [ 390.866577][ T8251] ? security_capable+0x89/0xb0 [ 390.871435][ T8251] genl_rcv_msg+0x611/0x7a0 [ 390.875942][ T8251] ? genl_bind+0x360/0x360 [ 390.880354][ T8251] ? vdpa_nl_cmd_mgmtdev_get_dumpit+0x270/0x270 [ 390.886611][ T8251] netlink_rcv_skb+0x235/0x4c0 [ 390.891380][ T8251] ? genl_bind+0x360/0x360 [ 390.895804][ T8251] ? netlink_ack+0x1160/0x1160 [ 390.900588][ T8251] ? __lock_acquire+0x7d80/0x7d80 [ 390.905627][ T8251] ? net_generic+0x1e/0x240 [ 390.910138][ T8251] ? down_read+0x1ac/0x2e0 [ 390.914558][ T8251] genl_rcv+0x28/0x40 [ 390.918538][ T8251] netlink_unicast+0x7b1/0x930 [ 390.923307][ T8251] netlink_sendmsg+0x8d0/0xbf0 [ 390.928076][ T8251] ? netlink_getsockopt+0x590/0x590 [ 390.933275][ T8251] ? apparmor_socket_sendmsg+0x8e/0x330 [ 390.938819][ T8251] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 390.944103][ T8251] ? security_socket_sendmsg+0x80/0xa0 [ 390.949556][ T8251] ? netlink_getsockopt+0x590/0x590 [ 390.954756][ T8251] ____sys_sendmsg+0x61b/0x980 [ 390.959525][ T8251] ? __asan_memset+0x22/0x40 [ 390.964116][ T8251] ? __sys_sendmsg_sock+0x30/0x30 [ 390.969136][ T8251] ? __import_iovec+0x5f2/0x850 [ 390.973996][ T8251] ? import_iovec+0x73/0xa0 [ 390.978504][ T8251] ___sys_sendmsg+0x2a6/0x360 [ 390.983183][ T8251] ? __sys_sendmsg+0x2b0/0x2b0 [ 390.987986][ T8251] __se_sys_sendmsg+0x1d0/0x2c0 [ 390.992840][ T8251] ? __x64_sys_sendmsg+0x80/0x80 [ 390.997788][ T8251] ? lockdep_hardirqs_on+0x98/0x150 [ 391.002994][ T8251] do_syscall_64+0x55/0xb0 [ 391.007411][ T8251] ? clear_bhb_loop+0x40/0x90 [ 391.012086][ T8251] ? clear_bhb_loop+0x40/0x90 [ 391.016764][ T8251] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 391.022656][ T8251] RIP: 0033:0x7f689d39e159 [ 391.027066][ T8251] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 391.046665][ T8251] RSP: 002b:00007f689e2aa028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 391.055077][ T8251] RAX: ffffffffffffffda RBX: 00007f689d625fa0 RCX: 00007f689d39e159 [ 391.063047][ T8251] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 391.071009][ T8251] RBP: 00007f689d43503b R08: 0000000000000000 R09: 0000000000000000 [ 391.078975][ T8251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 391.086957][ T8251] R13: 00007f689d626038 R14: 00007f689d625fa0 R15: 00007ffe0c2564a8 [ 391.094938][ T8251] [ 391.115802][ T8251] Mem-Info: [ 391.118956][ T8251] active_anon:5754 inactive_anon:0 isolated_anon:0 [ 391.118956][ T8251] active_file:13461 inactive_file:44280 isolated_file:0 [ 391.118956][ T8251] unevictable:768 dirty:85 writeback:0 [ 391.118956][ T8251] slab_reclaimable:10676 slab_unreclaimable:91175 [ 391.118956][ T8251] mapped:24495 shmem:1362 pagetables:576 [ 391.118956][ T8251] sec_pagetables:0 bounce:0 [ 391.118956][ T8251] kernel_misc_reclaimable:0 [ 391.118956][ T8251] free:1178306 free_pcp:7654 free_cma:0 [ 391.190337][ T8251] Node 0 active_anon:23016kB inactive_anon:0kB active_file:53844kB inactive_file:176920kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:97980kB dirty:340kB writeback:0kB shmem:3912kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11108kB pagetables:2304kB sec_pagetables:0kB all_unreclaimable? no [ 391.243770][ T8251] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 391.307883][ T5757] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 391.354329][ T8251] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 391.444124][ T8251] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 391.453266][ T8251] Node 0 DMA32 free:1062712kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:22972kB inactive_anon:0kB active_file:53844kB inactive_file:176104kB unevictable:1536kB writepending:340kB present:3129332kB managed:2586820kB mlocked:0kB bounce:0kB free_pcp:12968kB local_pcp:5952kB free_cma:0kB [ 391.497111][ T8251] lowmem_reserve[]: 0 0 0 0 0 [ 391.513297][ T8251] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:816kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 391.580449][ T8251] lowmem_reserve[]: 0 0 0 0 0 [ 391.592781][ T5757] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 391.605915][ T8251] Node 1 Normal free:3635152kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:17728kB local_pcp:12544kB free_cma:0kB [ 391.636785][ T5757] usb 2-1: can't read configurations, error -71 [ 391.645348][ T8251] lowmem_reserve[]: 0 0 0 0 0 [ 391.650476][ T8251] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 391.664522][ T8251] Node 0 DMA32: 263*4kB (M) 490*8kB (M) 765*16kB (M) 503*32kB (UME) 425*64kB (ME) 158*128kB (M) 71*256kB (M) 60*512kB (UM) 48*1024kB (UM) 20*2048kB (UME) 205*4096kB (UM) = 1059420kB [ 391.689600][ T8251] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 391.707005][ T8251] Node 1 Normal: 198*4kB (UE) 43*8kB (UE) 38*16kB (UE) 96*32kB (UE) 28*64kB (UME) 8*128kB (UME) 0*256kB 3*512kB (UME) 1*1024kB (U) 2*2048kB (UE) 884*4096kB (M) = 3635152kB [ 391.735008][ T8251] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 391.745634][ T8251] Node 0 hugepages_total=129 hugepages_free=129 hugepages_surp=0 hugepages_size=2048kB [ 391.760737][ T8251] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 391.770919][ T8251] Node 1 hugepages_total=129 hugepages_free=129 hugepages_surp=0 hugepages_size=2048kB [ 391.781343][ T8251] 59103 total pagecache pages [ 391.786527][ T8251] 0 pages in swap cache [ 391.795895][ T8251] Free swap = 124728kB [ 391.801303][ T8251] Total swap = 124996kB [ 391.808531][ T8251] 2097051 pages RAM [ 391.812782][ T8251] 0 pages HighMem/MovableOnly [ 391.818436][ T8251] 416960 pages reserved [ 391.827032][ T8251] 0 pages cma reserved [ 397.657018][ T5842] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 397.855506][ T5842] usb 2-1: Using ep0 maxpacket: 8 [ 397.889791][ T5842] usb 2-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 397.908557][ T5842] usb 2-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 397.928200][ T5842] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.978228][ T5842] usb 2-1: Product: syz [ 397.987922][ T5842] usb 2-1: Manufacturer: syz [ 397.994926][ T5842] usb 2-1: SerialNumber: syz [ 400.483245][ T5842] vmk80xx 2-1:8.0: driver 'vmk80xx' failed to auto-configure device. [ 400.553492][ T5842] usb 2-1: USB disconnect, device number 11 [ 402.392286][ T8421] netlink: 'syz.1.820': attribute type 2 has an invalid length. [ 402.939534][ T8418] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 402.946110][ T8418] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 402.957137][ T8418] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 402.963262][ T8418] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 402.971939][ T8418] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 402.978013][ T8418] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 402.988377][ T8418] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 402.994634][ T8418] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 403.074734][ T8430] netlink: 36 bytes leftover after parsing attributes in process `syz.0.826'. [ 403.275568][ T9] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 404.427265][ T5777] Bluetooth: hci0: command 0x0406 tx timeout [ 404.445518][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 404.452972][ T9] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 404.529631][ T9] usb 4-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 404.549320][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.635912][ T9] usb 4-1: Product: syz [ 404.640240][ T9] usb 4-1: Manufacturer: syz [ 404.644989][ T9] usb 4-1: SerialNumber: syz [ 404.734300][ T8450] netlink: 20 bytes leftover after parsing attributes in process `syz.2.834'. [ 404.975872][ T5777] Bluetooth: hci2: command 0x0406 tx timeout [ 404.982087][ T5772] Bluetooth: hci1: command 0x0406 tx timeout [ 405.055588][ T5777] Bluetooth: hci3: command 0x0406 tx timeout [ 406.495539][ T5777] Bluetooth: hci0: command 0x0406 tx timeout [ 407.055852][ T5777] Bluetooth: hci2: command 0x0406 tx timeout [ 407.056240][ T5772] Bluetooth: hci1: command 0x0406 tx timeout [ 407.135865][ T5772] Bluetooth: hci3: command 0x0406 tx timeout [ 408.376150][ T9] vmk80xx 4-1:8.0: driver 'vmk80xx' failed to auto-configure device. [ 408.409886][ T9] usb 4-1: USB disconnect, device number 8 [ 408.536667][ T8457] netlink: 'syz.2.836': attribute type 2 has an invalid length. [ 411.125497][ T23] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 411.375671][ T23] usb 3-1: Using ep0 maxpacket: 8 [ 411.427577][ T8500] netlink: 'syz.3.849': attribute type 2 has an invalid length. [ 413.216476][ T5772] Bluetooth: hci0: command 0x0406 tx timeout [ 413.418411][ T23] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 415.273363][ T23] usb 3-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 415.285600][ T23] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.305526][ T23] usb 3-1: Product: syz [ 415.342159][ T23] usb 3-1: can't set config #8, error -71 [ 415.373414][ T23] usb 3-1: USB disconnect, device number 6 [ 416.676901][ T8516] FAULT_INJECTION: forcing a failure. [ 416.676901][ T8516] name failslab, interval 1, probability 0, space 0, times 0 [ 416.692205][ T8516] CPU: 1 PID: 8516 Comm: syz.2.854 Not tainted syzkaller #0 [ 416.699498][ T8516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 416.709570][ T8516] Call Trace: [ 416.712840][ T8516] [ 416.715759][ T8516] dump_stack_lvl+0x18c/0x250 [ 416.720445][ T8516] ? show_regs_print_info+0x20/0x20 [ 416.725639][ T8516] ? load_image+0x420/0x420 [ 416.730136][ T8516] ? __lock_acquire+0x7d80/0x7d80 [ 416.735158][ T8516] should_fail_ex+0x394/0x4c0 [ 416.739829][ T8516] should_failslab+0x9/0x20 [ 416.744325][ T8516] slab_pre_alloc_hook+0x59/0x300 [ 416.749351][ T8516] ? do_check_common+0xcc/0x1410 [ 416.754283][ T8516] __kmem_cache_alloc_node+0x53/0x250 [ 416.759652][ T8516] ? do_check_common+0xcc/0x1410 [ 416.764582][ T8516] kmalloc_trace+0x2a/0xe0 [ 416.768989][ T8516] do_check_common+0xcc/0x1410 [ 416.773761][ T8516] ? add_subprog+0x2c0/0x3d0 [ 416.778347][ T8516] bpf_check+0x65d1/0xec30 [ 416.782760][ T8516] ? __lock_acquire+0x1336/0x7d80 [ 416.787775][ T8516] ? bpf_get_btf_vmlinux+0x20/0x20 [ 416.792872][ T8516] ? __lock_acquire+0x1262/0x7d80 [ 416.797885][ T8516] ? mark_lock+0x94/0x320 [ 416.802206][ T8516] ? __lock_acquire+0x1336/0x7d80 [ 416.807232][ T8516] ? verify_lock_unused+0x140/0x140 [ 416.812420][ T8516] ? verify_lock_unused+0x140/0x140 [ 416.817604][ T8516] ? verify_lock_unused+0x140/0x140 [ 416.822789][ T8516] ? pcpu_memcg_post_alloc_hook+0xef/0x3f0 [ 416.828595][ T8516] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 416.834564][ T8516] ? __lock_acquire+0x7d80/0x7d80 [ 416.839574][ T8516] ? lock_chain_count+0x20/0x20 [ 416.844411][ T8516] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 416.850637][ T8516] ? lockdep_hardirqs_on+0x98/0x150 [ 416.855842][ T8516] ? ktime_get_with_offset+0x103/0x330 [ 416.861310][ T8516] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 416.867536][ T8516] ? ktime_get_real_ts64+0x440/0x440 [ 416.872835][ T8516] ? do_raw_spin_unlock+0x121/0x230 [ 416.878030][ T8516] ? bpf_obj_name_cpy+0x194/0x1e0 [ 416.883055][ T8516] bpf_prog_load+0x10fa/0x1610 [ 416.887815][ T8516] ? map_freeze+0x420/0x420 [ 416.892326][ T8516] ? __might_fault+0xaa/0x120 [ 416.896992][ T8516] ? __might_fault+0xc6/0x120 [ 416.901654][ T8516] ? __might_fault+0xaa/0x120 [ 416.906315][ T8516] ? bpf_lsm_bpf+0x9/0x10 [ 416.910638][ T8516] ? security_bpf+0x7e/0xa0 [ 416.915141][ T8516] __sys_bpf+0x5ba/0x890 [ 416.919379][ T8516] ? bpf_link_show_fdinfo+0x390/0x390 [ 416.924745][ T8516] ? lock_chain_count+0x20/0x20 [ 416.929588][ T8516] __x64_sys_bpf+0x7c/0x90 [ 416.933988][ T8516] do_syscall_64+0x55/0xb0 [ 416.938395][ T8516] ? clear_bhb_loop+0x40/0x90 [ 416.943060][ T8516] ? clear_bhb_loop+0x40/0x90 [ 416.947738][ T8516] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 416.953625][ T8516] RIP: 0033:0x7f4796f9e159 [ 416.958047][ T8516] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 416.977644][ T8516] RSP: 002b:00007f4797d9f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 416.986044][ T8516] RAX: ffffffffffffffda RBX: 00007f4797225fa0 RCX: 00007f4796f9e159 [ 416.994001][ T8516] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 417.001955][ T8516] RBP: 00007f479703503b R08: 0000000000000000 R09: 0000000000000000 [ 417.009924][ T8516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 417.017902][ T8516] R13: 00007f4797226038 R14: 00007f4797225fa0 R15: 00007ffd534af4c8 [ 417.025872][ T8516] [ 417.100775][ T8511] FAULT_INJECTION: forcing a failure. [ 417.100775][ T8511] name failslab, interval 1, probability 0, space 0, times 0 [ 417.209237][ T8511] CPU: 0 PID: 8511 Comm: syz.3.851 Not tainted syzkaller #0 [ 417.216598][ T8511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 417.226669][ T8511] Call Trace: [ 417.229937][ T8511] [ 417.232855][ T8511] dump_stack_lvl+0x18c/0x250 [ 417.237553][ T8511] ? show_regs_print_info+0x20/0x20 [ 417.242755][ T8511] ? load_image+0x420/0x420 [ 417.247244][ T8511] ? __might_sleep+0xe0/0xe0 [ 417.251822][ T8511] ? __lock_acquire+0x7d80/0x7d80 [ 417.256838][ T8511] should_fail_ex+0x394/0x4c0 [ 417.261507][ T8511] should_failslab+0x9/0x20 [ 417.266001][ T8511] slab_pre_alloc_hook+0x59/0x300 [ 417.271021][ T8511] ? memcg_alloc_slab_cgroups+0x85/0x120 [ 417.276640][ T8511] ? memcg_alloc_slab_cgroups+0x85/0x120 [ 417.282257][ T8511] __kmem_cache_alloc_node+0x53/0x250 [ 417.287626][ T8511] ? memcg_alloc_slab_cgroups+0x85/0x120 [ 417.293242][ T8511] __kmalloc_node+0xa6/0x240 [ 417.297819][ T8511] ? lock_chain_count+0x20/0x20 [ 417.302657][ T8511] memcg_alloc_slab_cgroups+0x85/0x120 [ 417.308103][ T8511] new_slab+0xc3/0x2d0 [ 417.312155][ T8511] ___slab_alloc+0xc5c/0x12f0 [ 417.316833][ T8511] ? jfs_alloc_inode+0x28/0x60 [ 417.321616][ T8511] kmem_cache_alloc_lru+0xfc/0x2b0 [ 417.326718][ T8511] ? jfs_alloc_inode+0x28/0x60 [ 417.331470][ T8511] jfs_alloc_inode+0x28/0x60 [ 417.336075][ T8511] ? parse_options+0xe90/0xe90 [ 417.340826][ T8511] new_inode_pseudo+0x63/0x1d0 [ 417.345620][ T8511] new_inode+0x22/0x1d0 [ 417.349759][ T8511] ? sb_set_blocksize+0x9b/0x100 [ 417.354682][ T8511] jfs_fill_super+0x393/0xab0 [ 417.359350][ T8511] ? jfs_do_mount+0x40/0x40 [ 417.363842][ T8511] ? setup_bdev_super+0x56b/0x660 [ 417.368857][ T8511] mount_bdev+0x21c/0x2c0 [ 417.373168][ T8511] ? kfree+0x31/0x1a0 [ 417.377137][ T8511] ? jfs_do_mount+0x40/0x40 [ 417.381629][ T8511] ? get_tree_bdev+0x520/0x520 [ 417.386376][ T8511] ? vfs_parse_fs_param+0x420/0x420 [ 417.391567][ T8511] legacy_get_tree+0xea/0x180 [ 417.396251][ T8511] ? omfs_show_options+0x360/0x360 [ 417.401354][ T8511] vfs_get_tree+0x8c/0x280 [ 417.405772][ T8511] do_new_mount+0x24a/0xa40 [ 417.410261][ T8511] __se_sys_mount+0x2e7/0x3d0 [ 417.414924][ T8511] ? __x64_sys_mount+0xc0/0xc0 [ 417.419691][ T8511] ? lockdep_hardirqs_on+0x98/0x150 [ 417.424923][ T8511] ? __x64_sys_mount+0x20/0xc0 [ 417.429716][ T8511] do_syscall_64+0x55/0xb0 [ 417.434166][ T8511] ? clear_bhb_loop+0x40/0x90 [ 417.438864][ T8511] ? clear_bhb_loop+0x40/0x90 [ 417.443532][ T8511] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 417.449443][ T8511] RIP: 0033:0x7f689d39e159 [ 417.453850][ T8511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 417.473457][ T8511] RSP: 002b:00007f689e2aa028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 417.481875][ T8511] RAX: ffffffffffffffda RBX: 00007f689d625fa0 RCX: 00007f689d39e159 [ 417.489831][ T8511] RDX: 0000200000000040 RSI: 0000200000000240 RDI: 0000200000000000 [ 417.497792][ T8511] RBP: 00007f689d43503b R08: 0000000000000000 R09: 0000000000000000 [ 417.505751][ T8511] R10: 0000000002200010 R11: 0000000000000246 R12: 0000000000000000 [ 417.513704][ T8511] R13: 00007f689d626038 R14: 00007f689d625fa0 R15: 00007ffe0c2564a8 [ 417.521690][ T8511] [ 417.639557][ T8511] syz.3.851: attempt to access beyond end of device [ 417.639557][ T8511] nbd3: rw=0, sector=64, nr_sectors = 8 limit=0 [ 417.735627][ T9] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 417.749480][ T8511] syz.3.851: attempt to access beyond end of device [ 417.749480][ T8511] nbd3: rw=0, sector=120, nr_sectors = 8 limit=0 [ 417.851376][ T8511] Mount JFS Failure: -5 [ 417.902135][ T8511] jfs_mount failed w/return code = -5 [ 417.977954][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 417.993884][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 418.004935][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 418.015006][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 418.199609][ T9] usb 4-1: New USB device found, idVendor=0a12, idProduct=0001, bcdDevice= 0.00 [ 418.230223][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.242037][ T9] usb 4-1: Product: syz [ 418.248586][ T9] usb 4-1: Manufacturer: syz [ 418.255154][ T9] usb 4-1: SerialNumber: syz [ 418.308441][ T8532] netlink: 'syz.0.859': attribute type 2 has an invalid length. [ 418.752918][ T8535] xt_CT: No such helper "snmp_trap" [ 418.810352][ T27] audit: type=1326 audit(1789313045.757:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8540 comm="syz.1.861" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff8ee79e159 code=0x0 [ 418.855952][ T9] usb 4-1: can't set config #1, error -71 [ 418.864378][ T8542] loop0: detected capacity change from 0 to 3904 [ 418.879071][ T9] usb 4-1: USB disconnect, device number 9 [ 418.948111][ T8542] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 418.975897][ T8542] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 419.016532][ T8542] loop0: [ 419.035532][ T5842] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 419.287329][ T5842] usb 3-1: Using ep0 maxpacket: 8 [ 419.702487][ T9] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 420.145508][ T5842] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 420.297451][ T5842] usb 3-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 420.313144][ T5842] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.342270][ T5842] usb 3-1: Product: syz [ 420.350891][ T5842] usb 3-1: Manufacturer: syz [ 420.384304][ T5842] usb 3-1: SerialNumber: syz [ 420.527164][ T9] usb 1-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 420.544586][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 420.567594][ T9] usb 1-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 420.585656][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.594093][ T8555] FAULT_INJECTION: forcing a failure. [ 420.594093][ T8555] name failslab, interval 1, probability 0, space 0, times 0 [ 420.594122][ T8555] CPU: 1 PID: 8555 Comm: syz.3.869 Not tainted syzkaller #0 [ 420.594143][ T8555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 420.594154][ T8555] Call Trace: [ 420.594162][ T8555] [ 420.594170][ T8555] dump_stack_lvl+0x18c/0x250 [ 420.594203][ T8555] ? show_regs_print_info+0x20/0x20 [ 420.632669][ T9] usb 1-1: Product: syz [ 420.635026][ T8555] ? load_image+0x420/0x420 [ 420.640543][ T9] usb 1-1: Manufacturer: syz [ 420.644351][ T8555] ? __lock_acquire+0x7d80/0x7d80 [ 420.644386][ T8555] should_fail_ex+0x394/0x4c0 [ 420.654812][ T9] usb 1-1: SerialNumber: syz [ 420.658454][ T8555] should_failslab+0x9/0x20 [ 420.658484][ T8555] slab_pre_alloc_hook+0x59/0x300 [ 420.658512][ T8555] ? do_check_common+0x170/0x1410 [ 420.658539][ T8555] __kmem_cache_alloc_node+0x53/0x250 [ 420.658569][ T8555] ? do_check_common+0x170/0x1410 [ 420.658597][ T8555] kmalloc_trace+0x2a/0xe0 [ 420.697183][ T8555] do_check_common+0x170/0x1410 [ 420.702067][ T8555] bpf_check+0x65d1/0xec30 [ 420.706514][ T8555] ? __lock_acquire+0x1336/0x7d80 [ 420.711559][ T8555] ? bpf_get_btf_vmlinux+0x20/0x20 [ 420.716675][ T8555] ? __lock_acquire+0x1262/0x7d80 [ 420.721712][ T8555] ? mark_lock+0x94/0x320 [ 420.726045][ T8555] ? __lock_acquire+0x1336/0x7d80 [ 420.731095][ T8555] ? verify_lock_unused+0x140/0x140 [ 420.736304][ T8555] ? verify_lock_unused+0x140/0x140 [ 420.741505][ T8555] ? verify_lock_unused+0x140/0x140 [ 420.746715][ T8555] ? pcpu_memcg_post_alloc_hook+0xef/0x3f0 [ 420.752545][ T8555] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 420.758525][ T8555] ? __lock_acquire+0x7d80/0x7d80 [ 420.763549][ T8555] ? lock_chain_count+0x20/0x20 [ 420.768402][ T8555] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 420.774643][ T8555] ? lockdep_hardirqs_on+0x98/0x150 [ 420.779843][ T8555] ? ktime_get_with_offset+0x103/0x330 [ 420.785312][ T8555] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 420.791553][ T8555] ? ktime_get_real_ts64+0x440/0x440 [ 420.796840][ T8555] ? do_raw_spin_unlock+0x121/0x230 [ 420.802050][ T8555] ? bpf_obj_name_cpy+0x194/0x1e0 [ 420.807078][ T8555] bpf_prog_load+0x10fa/0x1610 [ 420.811849][ T8555] ? map_freeze+0x420/0x420 [ 420.816363][ T8555] ? __might_fault+0xaa/0x120 [ 420.821038][ T8555] ? __might_fault+0xc6/0x120 [ 420.825713][ T8555] ? __might_fault+0xaa/0x120 [ 420.830388][ T8555] ? bpf_lsm_bpf+0x9/0x10 [ 420.834716][ T8555] ? security_bpf+0x7e/0xa0 [ 420.839217][ T8555] __sys_bpf+0x5ba/0x890 [ 420.843460][ T8555] ? bpf_link_show_fdinfo+0x390/0x390 [ 420.848845][ T8555] ? lock_chain_count+0x20/0x20 [ 420.853703][ T8555] __x64_sys_bpf+0x7c/0x90 [ 420.858119][ T8555] do_syscall_64+0x55/0xb0 [ 420.862533][ T8555] ? clear_bhb_loop+0x40/0x90 [ 420.867209][ T8555] ? clear_bhb_loop+0x40/0x90 [ 420.871884][ T8555] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 420.877778][ T8555] RIP: 0033:0x7f689d39e159 [ 420.882198][ T8555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 420.901808][ T8555] RSP: 002b:00007f689e2aa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 420.910227][ T8555] RAX: ffffffffffffffda RBX: 00007f689d625fa0 RCX: 00007f689d39e159 [ 420.918201][ T8555] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 420.926177][ T8555] RBP: 00007f689d43503b R08: 0000000000000000 R09: 0000000000000000 [ 420.934141][ T8555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 420.942112][ T8555] R13: 00007f689d626038 R14: 00007f689d625fa0 R15: 00007ffe0c2564a8 [ 420.950091][ T8555] [ 420.961317][ T9] usb 1-1: config 0 descriptor?? [ 420.976202][ T9] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 422.842889][ T8559] netlink: 'syz.1.868': attribute type 2 has an invalid length. [ 423.208785][ T9] gspca_sunplus: reg_r err -110 [ 424.255055][ T9] sunplus: probe of 1-1:0.0 failed with error -110 [ 424.400324][ T5842] vmk80xx 3-1:8.0: driver 'vmk80xx' failed to auto-configure device. [ 424.414752][ T5842] usb 3-1: USB disconnect, device number 7 [ 424.745989][ T9] usb 1-1: USB disconnect, device number 11 [ 425.013076][ T8572] netlink: 12 bytes leftover after parsing attributes in process `syz.1.871'. [ 425.168326][ T8575] netlink: 'syz.2.872': attribute type 2 has an invalid length. [ 425.236382][ T9] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 426.447176][ T8590] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 426.563214][ T9] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 148, changing to 7 [ 426.590663][ T9] usb 1-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 426.723060][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.725612][ T9] usb 1-1: Product: syz [ 428.770792][ T9] usb 1-1: Manufacturer: syz [ 428.862224][ T9] usb 1-1: SerialNumber: syz [ 429.035042][ T8599] netlink: 'syz.1.880': attribute type 2 has an invalid length. [ 429.820527][ T9] usb 1-1: can't set config #1, error -71 [ 429.836053][ T9] usb 1-1: USB disconnect, device number 12 [ 429.874283][ T5842] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 430.388340][ T8611] lo: entered allmulticast mode [ 430.396083][ T8611] tunl0: entered allmulticast mode [ 430.404284][ T8611] gre0: entered allmulticast mode [ 430.414991][ T8611] gretap0: entered allmulticast mode [ 430.426751][ T8611] erspan0: entered allmulticast mode [ 430.434409][ T8611] ip_vti0: entered allmulticast mode [ 432.136627][ T5842] usb 4-1: Using ep0 maxpacket: 8 [ 432.705784][ T5842] usb 4-1: device descriptor read/all, error -71 [ 434.356466][ T5842] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 434.463920][ T8651] netlink: 'syz.2.893': attribute type 2 has an invalid length. [ 434.985583][ T5842] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 435.168869][ T5842] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 435.317759][ T5842] usb 4-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 435.522381][ T5842] usb 4-1: config 1 interface 0 has no altsetting 0 [ 435.623489][ T5842] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 435.644293][ T5842] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.685435][ T5842] usb 4-1: Product: syz [ 435.707185][ T5842] usb 4-1: Manufacturer: syz [ 435.752983][ T5842] usb 4-1: SerialNumber: syz [ 435.775269][ T8624] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 435.783142][ T8624] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 435.999103][ T5842] rtl8150 4-1:1.0: couldn't find required endpoints [ 436.005578][ T9] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 436.011377][ T5842] rtl8150: probe of 4-1:1.0 failed with error -5 [ 436.063913][ T5842] usb 4-1: USB disconnect, device number 11 [ 436.205596][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 436.228197][ T9] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 436.258940][ T9] usb 3-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 436.274206][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.294724][ T9] usb 3-1: Product: syz [ 436.310196][ T9] usb 3-1: Manufacturer: syz [ 436.323565][ T9] usb 3-1: SerialNumber: syz [ 440.174225][ T9] vmk80xx 3-1:8.0: driver 'vmk80xx' failed to auto-configure device. [ 440.193062][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.199435][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.660790][ T9] usb 3-1: USB disconnect, device number 8 [ 442.245534][ T9] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 442.677579][ T9] usb 1-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 442.884708][ T9] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 443.111882][ T9] usb 1-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 443.328555][ T9] usb 1-1: config 1 interface 0 has no altsetting 0 [ 443.400138][ T9] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 443.414292][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.449867][ T9] usb 1-1: Product: syz [ 443.488801][ T9] usb 1-1: Manufacturer: syz [ 443.493462][ T9] usb 1-1: SerialNumber: syz [ 443.546508][ T8708] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 443.557875][ T8708] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 443.831870][ T9] rtl8150 1-1:1.0: couldn't find required endpoints [ 443.849445][ T9] rtl8150: probe of 1-1:1.0 failed with error -5 [ 443.898752][ T9] usb 1-1: USB disconnect, device number 13 [ 445.154907][ T8762] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.164290][ T8762] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.173890][ T8762] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.182794][ T8762] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.555681][ T5842] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 446.757446][ T5842] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 446.787065][ T5842] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 446.807438][ T5842] usb 4-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 446.835591][ T5842] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.261914][ T5842] pegasus: probe of 4-1:1.0 failed with error -71 [ 447.294780][ T5842] usb 4-1: USB disconnect, device number 12 [ 449.185694][ T9] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 449.966272][ T9] usb 1-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 449.991266][ T9] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 450.001650][ T9] usb 1-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 450.020579][ T9] usb 1-1: config 1 interface 0 has no altsetting 0 [ 450.143351][ T9] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 450.155627][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.176986][ T9] usb 1-1: Product: syz [ 450.181196][ T9] usb 1-1: Manufacturer: syz [ 450.192956][ T9] usb 1-1: SerialNumber: syz [ 450.396437][ T8809] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 450.461602][ T8809] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 451.776762][ T9] rtl8150 1-1:1.0: couldn't find required endpoints [ 451.783680][ T9] rtl8150: probe of 1-1:1.0 failed with error -5 [ 453.471791][ T9] usb 1-1: USB disconnect, device number 14 [ 456.653915][ T8866] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 456.926884][ T8866] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 468.508787][ T5771] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 468.875915][ T5771] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 468.890431][ T5771] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 468.911574][ T5771] usb 4-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 468.932346][ T5771] usb 4-1: config 1 interface 0 has no altsetting 0 [ 469.220417][ T5771] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 469.230077][ T5771] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.247344][ T5771] usb 4-1: Product: syz [ 469.251986][ T5771] usb 4-1: Manufacturer: syz [ 469.264640][ T5771] usb 4-1: SerialNumber: syz [ 469.471593][ T8879] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 469.591802][ T8879] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 470.481551][ T5771] rtl8150 4-1:1.0: couldn't find required endpoints [ 470.492554][ T5771] rtl8150: probe of 4-1:1.0 failed with error -5 [ 470.698432][ T5771] usb 4-1: USB disconnect, device number 13 [ 472.243171][ T5757] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 472.825629][ T5757] usb 3-1: Using ep0 maxpacket: 8 [ 472.833725][ T5757] usb 3-1: unable to get BOS descriptor or descriptor too short [ 472.866053][ T5757] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 179, changing to 7 [ 472.908479][ T5757] usb 3-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 472.943337][ T5757] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.975480][ T5757] usb 3-1: Product: syz [ 472.985545][ T5757] usb 3-1: Manufacturer: syz [ 473.005656][ T5757] usb 3-1: SerialNumber: syz [ 473.053327][ T5757] snd-ua101 3-1:1.0: invalid num_altsetting [ 475.372885][ T8] usb 3-1: USB disconnect, device number 9 [ 476.382619][ T5777] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 476.393032][ T5777] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 476.404331][ T5777] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 476.423677][ T5777] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 476.446530][ T5777] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 476.461255][ T5777] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 476.829381][ T5869] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 476.995617][ T5842] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 477.000894][ T5869] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.114796][ T5869] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.178439][ T5842] usb 1-1: Using ep0 maxpacket: 8 [ 477.198911][ T5842] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 477.211244][ T5869] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.228762][ T5842] usb 1-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 477.248563][ T5842] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.261519][ T8936] chnl_net:caif_netlink_parms(): no params data found [ 477.265461][ T5842] usb 1-1: Product: syz [ 477.293182][ T5842] usb 1-1: Manufacturer: syz [ 477.303329][ T5842] usb 1-1: SerialNumber: syz [ 477.500120][ T8936] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.509754][ T8936] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.517941][ T8936] bridge_slave_0: entered allmulticast mode [ 477.525974][ T8936] bridge_slave_0: entered promiscuous mode [ 477.551305][ T8936] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.584740][ T8936] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.635862][ T8936] bridge_slave_1: entered allmulticast mode [ 477.693036][ T8936] bridge_slave_1: entered promiscuous mode [ 478.641256][ T5777] Bluetooth: hci4: command tx timeout [ 479.904162][ T5842] vmk80xx 1-1:8.0: driver 'vmk80xx' failed to auto-configure device. [ 480.094877][ T5842] usb 1-1: USB disconnect, device number 15 [ 480.468876][ T8936] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 480.616434][ T8936] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 480.736136][ T5772] Bluetooth: hci4: command tx timeout [ 481.918585][ T8936] team0: Port device team_slave_0 added [ 482.576440][ T8936] team0: Port device team_slave_1 added [ 482.688399][ T9002] netlink: 12 bytes leftover after parsing attributes in process `syz.2.967'. [ 484.925345][ T5772] Bluetooth: hci4: command tx timeout [ 485.164711][ T8936] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 485.197829][ T8936] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 485.253962][ T8936] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 485.337151][ T8936] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 485.345700][ T8936] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 485.412166][ T8936] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 485.555702][ T5771] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 485.709714][ T8936] hsr_slave_0: entered promiscuous mode [ 485.735883][ T8936] hsr_slave_1: entered promiscuous mode [ 485.753427][ T8936] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 485.762997][ T5771] usb 3-1: Using ep0 maxpacket: 8 [ 485.773299][ T8936] Cannot create hsr debugfs directory [ 485.781580][ T5771] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 485.812884][ T5771] usb 3-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 485.841599][ T5771] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.872457][ T5771] usb 3-1: Product: syz [ 485.881637][ T5771] usb 3-1: Manufacturer: syz [ 485.903292][ T5771] usb 3-1: SerialNumber: syz [ 487.035836][ T5772] Bluetooth: hci4: command tx timeout [ 487.408126][ T5771] vmk80xx 3-1:8.0: driver 'vmk80xx' failed to auto-configure device. [ 487.886127][ T5771] usb 3-1: USB disconnect, device number 10 [ 489.154375][ T5869] hsr_slave_0: left promiscuous mode [ 489.180043][ T5869] hsr_slave_1: left promiscuous mode [ 489.215064][ T5869] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 489.224835][ T5869] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 489.234918][ T5869] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 489.242931][ T5869] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 489.252330][ T5869] bridge_slave_1: left allmulticast mode [ 489.268029][ T5869] bridge_slave_1: left promiscuous mode [ 489.295924][ T5869] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.372305][ T5869] bridge_slave_0: left allmulticast mode [ 489.382933][ T5869] bridge_slave_0: left promiscuous mode [ 489.388818][ T5869] bridge0: port 1(bridge_slave_0) entered disabled state [ 489.757765][ T8] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 489.858112][ T5869] veth1_macvtap: left promiscuous mode [ 489.894980][ T5869] veth0_macvtap: left promiscuous mode [ 490.063959][ T5869] veth1_vlan: left promiscuous mode [ 490.119504][ T8] usb 4-1: Using ep0 maxpacket: 8 [ 490.154681][ T5869] veth0_vlan: left promiscuous mode [ 490.612534][ T8] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 491.029097][ T8] usb 4-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 491.092661][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.108343][ T8] usb 4-1: Product: syz [ 491.114280][ T8] usb 4-1: Manufacturer: syz [ 491.165950][ T8] usb 4-1: SerialNumber: syz [ 492.025543][ T8] vmk80xx 4-1:8.0: driver 'vmk80xx' failed to auto-configure device. [ 492.037296][ T8] usb 4-1: USB disconnect, device number 14 [ 492.597018][ T5869] bond1 (unregistering): Released all slaves [ 493.802703][ T9088] comedi comedi0: comedi_test: 1000000 microvolt, 100000 microsecond waveform attached [ 493.847037][ T5869] team0 (unregistering): Port device team_slave_1 removed [ 493.913486][ T5869] team0 (unregistering): Port device team_slave_0 removed [ 493.978306][ T5869] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 494.039549][ T5869] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 496.929438][ T5869] bond0 (unregistering): Released all slaves [ 498.897810][ T8936] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 499.017626][ T8936] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 499.254796][ T8936] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 500.163128][ T8936] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 500.650691][ T9130] syz.3.1001 invoked oom-killer: gfp_mask=0xdc0(GFP_KERNEL|__GFP_ZERO), order=0, oom_score_adj=1000 [ 500.656695][ T8936] 8021q: adding VLAN 0 to HW filter on device bond0 [ 500.676686][ T9129] netlink: 'syz.2.1002': attribute type 1 has an invalid length. [ 500.728710][ T9130] CPU: 0 PID: 9130 Comm: syz.3.1001 Not tainted syzkaller #0 [ 500.736161][ T9130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 500.746233][ T9130] Call Trace: [ 500.749608][ T9130] [ 500.752622][ T9130] dump_stack_lvl+0x18c/0x250 [ 500.757416][ T9130] ? show_regs_print_info+0x20/0x20 [ 500.762704][ T9130] ? load_image+0x420/0x420 [ 500.767258][ T9130] ? ___ratelimit+0x478/0x610 [ 500.772009][ T9130] ? radix_tree_cpu_dead+0x160/0x160 [ 500.772089][ T8936] 8021q: adding VLAN 0 to HW filter on device team0 [ 500.777316][ T9130] dump_header+0xd8/0x820 [ 500.777365][ T9130] oom_kill_process+0x390/0x580 [ 500.777429][ T9130] out_of_memory+0xe0e/0x1200 [ 500.777458][ T9130] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 500.777487][ T9130] ? mutex_lock_nested+0x20/0x20 [ 500.777584][ T9130] ? unregister_oom_notifier+0x20/0x20 [ 500.777622][ T9130] mem_cgroup_out_of_memory+0x2c2/0x390 [ 500.777648][ T9130] ? try_charge_memcg+0xc91/0x17c0 [ 500.777674][ T9130] ? drain_local_stock+0x630/0x630 [ 500.777709][ T9130] ? do_raw_spin_unlock+0x121/0x230 [ 500.777750][ T9130] try_charge_memcg+0xca1/0x17c0 [ 500.777797][ T9130] ? folio_flags+0x120/0x120 [ 500.777819][ T9130] ? percpu_ref_tryget+0x15/0x180 [ 500.777845][ T9130] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 500.777874][ T9130] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 500.798761][ T9129] Cannot find set identified by id 0 to match [ 500.803937][ T9130] ? percpu_ref_tryget+0x15/0x180 [ 500.859550][ T8936] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 500.861517][ T9130] ? percpu_ref_tryget+0x15/0x180 [ 500.861548][ T9130] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 500.861573][ T9130] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 500.867863][ T8936] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 500.872624][ T9130] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 500.915553][ T9130] obj_cgroup_charge+0x36e/0x630 [ 500.920511][ T9130] ? get_obj_cgroup_from_current+0xd4/0x280 [ 500.926413][ T9130] ? obj_cgroup_charge+0xed/0x630 [ 500.931447][ T9130] ? mod_objcg_mlstate+0x320/0x320 [ 500.936572][ T9130] ? percpu_ref_tryget+0x15/0x180 [ 500.941603][ T9130] ? get_obj_cgroup_from_current+0xd4/0x280 [ 500.947524][ T9130] ? get_obj_cgroup_from_current+0xd4/0x280 [ 500.953419][ T9130] slab_pre_alloc_hook+0x2e2/0x300 [ 500.958533][ T9130] ? mark_lock+0x94/0x320 [ 500.962863][ T9130] kmem_cache_alloc+0x5a/0x2c0 [ 500.967632][ T9130] ? alloc_empty_file+0x9e/0x1d0 [ 500.972571][ T9130] alloc_empty_file+0x9e/0x1d0 [ 500.977337][ T9130] path_openat+0x120/0x3270 [ 500.981872][ T9130] ? verify_lock_unused+0x140/0x140 [ 500.987160][ T9130] ? do_sys_openat2+0xda/0x1d0 [ 500.991925][ T9130] ? __x64_sys_openat+0x139/0x160 [ 500.996949][ T9130] ? do_syscall_64+0x55/0xb0 [ 501.001561][ T9130] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 501.007651][ T9130] ? verify_lock_unused+0x140/0x140 [ 501.012864][ T9130] ? do_filp_open+0x430/0x430 [ 501.017560][ T9130] do_filp_open+0x1f2/0x430 [ 501.022066][ T9130] ? vfs_tmpfile+0x620/0x620 [ 501.026675][ T9130] ? _raw_spin_unlock+0x28/0x40 [ 501.031520][ T9130] ? alloc_fd+0x590/0x640 [ 501.035860][ T9130] do_sys_openat2+0x134/0x1d0 [ 501.040545][ T9130] ? do_sys_open+0xe0/0xe0 [ 501.044960][ T9130] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 501.050942][ T9130] ? lock_chain_count+0x20/0x20 [ 501.055801][ T9130] __x64_sys_openat+0x139/0x160 [ 501.060654][ T9130] do_syscall_64+0x55/0xb0 [ 501.065069][ T9130] ? clear_bhb_loop+0x40/0x90 [ 501.069742][ T9130] ? clear_bhb_loop+0x40/0x90 [ 501.074424][ T9130] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 501.080321][ T9130] RIP: 0033:0x7f689d35e98e [ 501.084809][ T9130] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 501.104461][ T9130] RSP: 002b:00007f689e2a9ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 501.112878][ T9130] RAX: ffffffffffffffda RBX: 00007f689e2aa6c0 RCX: 00007f689d35e98e [ 501.120845][ T9130] RDX: 0000000000000002 RSI: 00007f689e2a9f90 RDI: ffffffffffffff9c [ 501.128818][ T9130] RBP: 00007f689d43503b R08: 0000000000000000 R09: 0000000000000000 [ 501.136791][ T9130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 501.144763][ T9130] R13: 00007f689d626038 R14: 00007f689d625fa0 R15: 00007ffe0c2564a8 [ 501.152749][ T9130] [ 501.172072][ T5869] IPVS: stop unused estimator thread 0... [ 501.184560][ T9130] memory: usage 0kB, limit 0kB, failcnt 38 [ 501.190641][ T9130] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 501.197075][ T7905] bridge0: port 1(bridge_slave_0) entered blocking state [ 501.198805][ T9130] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 501.205198][ T7905] bridge0: port 1(bridge_slave_0) entered forwarding state [ 501.213018][ T9130] Memory cgroup stats for /syz3/test: [ 501.219579][ T9130] cache 0 [ 501.228198][ T9130] rss 0 [ 501.230980][ T9130] rss_huge 0 [ 501.234187][ T9130] shmem 0 [ 501.237646][ T9130] mapped_file 0 [ 501.241300][ T9130] dirty 0 [ 501.247050][ T9130] writeback 0 [ 501.250370][ T9130] workingset_refault_anon 0 [ 501.269859][ T9130] workingset_refault_file 0 [ 501.274417][ T9130] swap 0 [ 501.275881][ T7905] bridge0: port 2(bridge_slave_1) entered blocking state [ 501.278045][ T9130] pgpgin 0 [ 501.284476][ T7905] bridge0: port 2(bridge_slave_1) entered forwarding state [ 501.288816][ T9130] pgpgout 0 [ 501.310318][ T9130] pgfault 0 [ 501.313490][ T9130] pgmajfault 0 [ 501.329029][ T9130] inactive_anon 0 [ 501.341991][ T9130] active_anon 0 [ 501.349565][ T9130] inactive_file 0 [ 501.353627][ T9130] active_file 0 [ 501.436875][ T9130] unevictable 0 [ 501.440411][ T9130] hierarchical_memory_limit 0 [ 501.445104][ T9130] hierarchical_memsw_limit 9223372036854771712 [ 501.516008][ T9130] total_cache 0 [ 501.529010][ T9130] total_rss 0 [ 501.532352][ T9130] total_rss_huge 0 [ 501.553461][ T9130] total_shmem 0 [ 501.608362][ T9130] total_mapped_file 0 [ 501.617706][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.624079][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.664088][ T9130] total_dirty 0 [ 501.734015][ T9130] total_writeback 0 [ 501.799006][ T9130] total_workingset_refault_anon 0 [ 501.913554][ T9130] total_workingset_refault_file 0 [ 502.039543][ T9130] total_swap 0 [ 502.109787][ T9130] total_pgpgin 0 [ 502.219586][ T9130] total_pgpgout 0 [ 502.322608][ T9130] total_pgfault 0 [ 502.416652][ T9130] total_pgmajfault 0 [ 502.500053][ T9130] total_inactive_anon 0 [ 502.576553][ T9130] total_active_anon 0 [ 502.605605][ T9130] total_inactive_file 0 [ 502.609808][ T9130] total_active_file 0 [ 502.613834][ T9130] total_unevictable 0 [ 502.618648][ T9130] anon_cost 0 [ 502.621965][ T9130] file_cost 0 [ 502.625267][ T9130] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.1001,pid=9127,uid=0 [ 502.643298][ T9130] Memory cgroup out of memory: Killed process 9127 (syz.3.1001) total-vm:104424kB, anon-rss:1244kB, file-rss:23040kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 502.753944][ T8936] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 504.190360][ T8936] veth0_vlan: entered promiscuous mode [ 504.227701][ T8936] veth1_vlan: entered promiscuous mode [ 504.352175][ T8936] veth0_macvtap: entered promiscuous mode [ 504.404782][ T8936] veth1_macvtap: entered promiscuous mode [ 504.499814][ T8936] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 504.516434][ T9193] null_blk: disk nullb1 created [ 504.532955][ T8936] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 504.547216][ T8936] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 504.567813][ T8936] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 504.579372][ T8936] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 504.593408][ T8936] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 504.615341][ T8936] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 504.644532][ T8936] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 504.676080][ T8936] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 504.691092][ T8936] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 504.701918][ T8936] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 504.715516][ T8936] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 504.741525][ T8936] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 504.767787][ T8936] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 504.793728][ T8936] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.819012][ T8936] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.843789][ T8936] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.859858][ T8936] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.887662][ T9205] FAULT_INJECTION: forcing a failure. [ 504.887662][ T9205] name failslab, interval 1, probability 0, space 0, times 0 [ 505.002441][ T9205] CPU: 1 PID: 9205 Comm: syz.3.1016 Not tainted syzkaller #0 [ 505.009885][ T9205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 505.019968][ T9205] Call Trace: [ 505.023270][ T9205] [ 505.026219][ T9205] dump_stack_lvl+0x18c/0x250 [ 505.030925][ T9205] ? show_regs_print_info+0x20/0x20 [ 505.036158][ T9205] ? load_image+0x420/0x420 [ 505.040686][ T9205] ? __might_sleep+0xe0/0xe0 [ 505.045333][ T9205] ? __lock_acquire+0x7d80/0x7d80 [ 505.050383][ T9205] ? trace_raw_output_percpu_destroy_chunk+0xc0/0xc0 [ 505.057088][ T9205] should_fail_ex+0x394/0x4c0 [ 505.061844][ T9205] should_failslab+0x9/0x20 [ 505.066375][ T9205] slab_pre_alloc_hook+0x59/0x300 [ 505.071431][ T9205] ? pcpu_alloc+0x11e7/0x1880 [ 505.076132][ T9205] ? percpu_ref_init+0xc3/0x340 [ 505.081009][ T9205] __kmem_cache_alloc_node+0x53/0x250 [ 505.086457][ T9205] ? percpu_ref_init+0xc3/0x340 [ 505.091326][ T9205] ? io_allocate_scq_urings+0x620/0x620 [ 505.096951][ T9205] kmalloc_trace+0x2a/0xe0 [ 505.101396][ T9205] percpu_ref_init+0xc3/0x340 [ 505.106097][ T9205] io_ring_ctx_alloc+0x205/0xc10 [ 505.111067][ T9205] io_uring_create+0x2df/0x1330 [ 505.115948][ T9205] ? __might_fault+0xc6/0x120 [ 505.120653][ T9205] ? __might_fault+0xaa/0x120 [ 505.125353][ T9205] __se_sys_io_uring_setup+0x29f/0x2b0 [ 505.130866][ T9205] ? __x64_sys_io_uring_setup+0x60/0x60 [ 505.136455][ T9205] ? lockdep_hardirqs_on+0x98/0x150 [ 505.141687][ T9205] do_syscall_64+0x55/0xb0 [ 505.146126][ T9205] ? clear_bhb_loop+0x40/0x90 [ 505.150828][ T9205] ? clear_bhb_loop+0x40/0x90 [ 505.155525][ T9205] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 505.161438][ T9205] RIP: 0033:0x7f689d39e159 [ 505.165874][ T9205] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 505.185511][ T9205] RSP: 002b:00007f689e2a9fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 505.193956][ T9205] RAX: ffffffffffffffda RBX: 0000200000001280 RCX: 00007f689d39e159 [ 505.201974][ T9205] RDX: 0000200000000100 RSI: 0000200000001280 RDI: 0000000000000110 [ 505.209971][ T9205] RBP: 00007f689d43503b R08: 0000000000000000 R09: 0000000000000000 [ 505.217970][ T9205] R10: 0000200000000000 R11: 0000000000000206 R12: 0000200000000100 [ 505.225967][ T9205] R13: 0000200000000000 R14: 0000200000000240 R15: 00007ffe0c2564a8 [ 505.233975][ T9205] [ 506.198058][ T7905] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 506.227137][ T7905] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 506.284126][ T1147] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 506.301110][ T1147] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 510.594515][ T9265] netlink: 'syz.0.1033': attribute type 2 has an invalid length. [ 510.659328][ T9272] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1035'. [ 510.746184][ T9272] 8021q: adding VLAN 0 to HW filter on device bond1 [ 513.227475][ T9309] netlink: 'syz.4.1044': attribute type 2 has an invalid length. [ 513.844116][ T9329] netlink: 'syz.2.1049': attribute type 2 has an invalid length. [ 515.820381][ T9358] netlink: 'syz.0.1056': attribute type 2 has an invalid length. [ 515.870543][ T9] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 516.012536][ T9367] netlink: 'syz.2.1058': attribute type 2 has an invalid length. [ 516.065718][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 516.098427][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 516.141821][ T9] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 516.201070][ T9] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 516.225611][ T9] usb 4-1: config 14 has no interface number 0 [ 516.243822][ T9] usb 4-1: config 14 has no interface number 1 [ 516.283313][ T9] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 516.321890][ T9] usb 4-1: config 14 interface 228 altsetting 5 has an invalid endpoint with address 0xD1, skipping [ 517.313000][ T9] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 517.345510][ T9] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 517.403902][ T9] usb 4-1: config 14 interface 57 has no altsetting 0 [ 517.425795][ T9] usb 4-1: config 14 interface 228 has no altsetting 0 [ 517.456557][ T9] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 517.471099][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.502395][ T9] usb 4-1: Product: syz [ 517.516431][ T9] usb 4-1: Manufacturer: syz [ 517.521209][ T9] usb 4-1: SerialNumber: syz [ 517.567279][ T9386] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1064'. [ 517.758224][ T9] legousbtower 4-1:14.57: interrupt endpoints not found [ 517.781961][ T9] legousbtower 4-1:14.228: interrupt endpoints not found [ 517.804351][ T9] usb 4-1: USB disconnect, device number 15 [ 517.814469][ T9394] netlink: 'syz.2.1067': attribute type 2 has an invalid length. [ 518.091375][ T9405] netlink: 'syz.4.1070': attribute type 2 has an invalid length. [ 518.730772][ T9424] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1075'. [ 518.997030][ T9431] netlink: 'syz.3.1077': attribute type 2 has an invalid length. [ 519.217794][ T9437] FAULT_INJECTION: forcing a failure. [ 519.217794][ T9437] name failslab, interval 1, probability 0, space 0, times 0 [ 519.278379][ T9437] CPU: 1 PID: 9437 Comm: syz.3.1079 Not tainted syzkaller #0 [ 519.285818][ T9437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 519.295896][ T9437] Call Trace: [ 519.299201][ T9437] [ 519.302153][ T9437] dump_stack_lvl+0x18c/0x250 [ 519.306866][ T9437] ? show_regs_print_info+0x20/0x20 [ 519.312101][ T9437] ? load_image+0x420/0x420 [ 519.316633][ T9437] ? __might_sleep+0xe0/0xe0 [ 519.320469][ T9439] netlink: 'syz.0.1080': attribute type 1 has an invalid length. [ 519.321235][ T9437] ? __lock_acquire+0x7d80/0x7d80 [ 519.334001][ T9437] should_fail_ex+0x394/0x4c0 [ 519.338722][ T9437] should_failslab+0x9/0x20 [ 519.343260][ T9437] slab_pre_alloc_hook+0x59/0x300 [ 519.348319][ T9437] ? __up_read+0x2b8/0x6b0 [ 519.352763][ T9437] ? crypto_create_tfm_node+0x77/0x380 [ 519.358306][ T9437] ? crypto_create_tfm_node+0x77/0x380 [ 519.363801][ T9437] __kmem_cache_alloc_node+0x53/0x250 [ 519.369211][ T9437] ? crypto_create_tfm_node+0x77/0x380 [ 519.374707][ T9437] __kmalloc_node+0xa6/0x240 [ 519.379341][ T9437] crypto_create_tfm_node+0x77/0x380 [ 519.384669][ T9437] ? crypto_alg_mod_lookup+0x1ad/0x570 [ 519.390168][ T9437] crypto_alloc_tfm_node+0x17b/0x360 [ 519.395499][ T9437] ? hash_check_key+0x1d0/0x1d0 [ 519.400413][ T9437] alg_bind+0x2f5/0x550 [ 519.404608][ T9437] __sys_bind+0x2f0/0x3f0 [ 519.409071][ T9437] ? __ia32_sys_socketpair+0xb0/0xb0 [ 519.414403][ T9437] __x64_sys_bind+0x7a/0x90 [ 519.418966][ T9437] do_syscall_64+0x55/0xb0 [ 519.423408][ T9437] ? clear_bhb_loop+0x40/0x90 [ 519.428109][ T9437] ? clear_bhb_loop+0x40/0x90 [ 519.432817][ T9437] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 519.438745][ T9437] RIP: 0033:0x7f689d39e159 [ 519.443182][ T9437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 519.457581][ T9439] 8021q: adding VLAN 0 to HW filter on device bond1 [ 519.462789][ T9437] RSP: 002b:00007f689e2aa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 519.477824][ T9437] RAX: ffffffffffffffda RBX: 00007f689d625fa0 RCX: 00007f689d39e159 [ 519.485814][ T9437] RDX: 0000000000000058 RSI: 0000200000000040 RDI: 0000000000000003 [ 519.493800][ T9437] RBP: 00007f689d43503b R08: 0000000000000000 R09: 0000000000000000 [ 519.501790][ T9437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 519.509783][ T9437] R13: 00007f689d626038 R14: 00007f689d625fa0 R15: 00007ffe0c2564a8 [ 519.517797][ T9437] [ 519.643282][ T9442] bond1: (slave veth3): Enslaving as an active interface with a down link [ 519.695650][ T9439] bond1: (slave dummy0): making interface the new active one [ 519.720698][ T9439] dummy0: entered promiscuous mode [ 519.748162][ T9439] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 519.929466][ T9439] netlink: 'syz.0.1080': attribute type 10 has an invalid length. [ 519.955733][ T9439] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1080'. [ 519.981461][ T9439] bond1: (slave dummy0): Releasing active interface [ 520.169976][ T9457] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1085'. [ 520.282425][ T9462] netlink: 'syz.0.1087': attribute type 2 has an invalid length. [ 523.502671][ T9499] netlink: 'syz.2.1097': attribute type 2 has an invalid length. [ 523.545825][ T9502] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1099'. [ 523.760983][ T9506] mmap: syz.2.1100 (9506) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 524.786946][ T9535] netlink: 'syz.0.1108': attribute type 2 has an invalid length. [ 526.885956][ T9552] sctp: failed to load transform for md5: -2 [ 527.560903][ T9569] tipc: Started in network mode [ 527.576183][ T9569] tipc: Node identity 4, cluster identity 4711 [ 527.598099][ T9569] tipc: Node number set to 4 [ 527.641590][ T9569] tipc: Enabled bearer , priority 0 [ 527.710249][ T9569] tipc: Resetting bearer [ 527.802751][ T5757] IPVS: starting estimator thread 0... [ 527.839718][ T9569] tipc: Disabling bearer [ 527.905999][ T9580] IPVS: using max 19 ests per chain, 45600 per kthread [ 530.995534][ T5807] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 531.219682][ T5807] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 531.247348][ T5807] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 531.300411][ T5807] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 531.340589][ T5807] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 531.360572][ T5807] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 531.382994][ T5807] usb 5-1: Product: syz [ 531.393308][ T5807] usb 5-1: Manufacturer: syz [ 531.412525][ T5807] usb 5-1: SerialNumber: syz [ 531.762452][ T5807] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 532.183014][ T8] usb 5-1: USB disconnect, device number 2 [ 532.237660][ T8] usblp0: removed [ 539.105602][ T9] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 539.161998][ T5842] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 539.784192][ T5842] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 539.965569][ T5842] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 539.997046][ T5842] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 540.010726][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 540.025962][ T9] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 540.034108][ T9] usb 4-1: config 0 has no interface number 0 [ 540.058320][ T9] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 540.075584][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 540.082575][ T5842] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 540.083615][ T9] usb 4-1: Product: syz [ 540.113917][ T5842] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 540.143843][ T9] usb 4-1: Manufacturer: syz [ 540.146969][ T5842] usb 5-1: Product: syz [ 540.152675][ T5842] usb 5-1: Manufacturer: syz [ 540.154644][ T9] usb 4-1: SerialNumber: syz [ 540.158050][ T5842] usb 5-1: SerialNumber: syz [ 540.177338][ T9] usb 4-1: config 0 descriptor?? [ 540.202982][ T9] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 540.250230][ T9755] null_blk: disk nullb1 created [ 540.418405][ T9] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 540.443679][ T5842] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 540.499537][ T9] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 540.653332][ T5842] usb 5-1: USB disconnect, device number 3 [ 540.698019][ T5842] usblp0: removed [ 540.745006][ T9766] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1173'. [ 540.824034][ C0] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 540.851065][ T5771] usb 4-1: USB disconnect, device number 16 [ 541.899688][ T5771] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 542.033095][ T5771] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 542.133588][ T5771] quatech2 4-1:0.51: device disconnected [ 542.750033][ T5771] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 543.190380][ T5771] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 543.232349][ T9798] gadgetfs: bound to dummy_udc driver [ 543.238302][ T8] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 543.249538][ T5771] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 543.259652][ T8] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 543.277202][ T5771] usb 4-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.03 [ 543.315641][ T5771] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.323701][ T5771] usb 4-1: Product: syz [ 543.348340][ T5771] usb 4-1: Manufacturer: syz [ 543.353014][ T5771] usb 4-1: SerialNumber: syz [ 543.381659][ T27] audit: type=1326 audit(1789313170.327:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9797 comm="syz.4.1182" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc0d859e159 code=0x0 [ 543.525975][ T5842] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 543.546051][ C1] gadgetfs: connected [ 543.562142][ T5842] gadgetfs: disconnected [ 543.630677][ T5771] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 17 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 543.670892][ T9811] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.708459][ T9811] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.756133][ C1] gadgetfs: connected [ 543.763353][ T5842] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 543.788165][ T5842] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 543.812966][ T5842] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.813122][ T9799] hid-generic 0000:0000:0000.0003: pid 9799 passed too large report [ 543.854414][ C1] gadgetfs: configuration #1 [ 543.941125][ T5842] usb 4-1: USB disconnect, device number 17 [ 543.954829][ T5842] usblp0: removed [ 544.011954][ T9797] gadgetfs: suspended from state 3 [ 544.032313][ T5771] usb 1-1: USB disconnect, device number 16 [ 544.038910][ T9797] gadgetfs: disconnected [ 546.141068][ T9] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 547.119815][ T9] usb 1-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 547.134567][ T9] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 547.146201][ T9] usb 1-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 547.175896][ T9] usb 1-1: config 1 interface 0 has no altsetting 0 [ 547.213714][ T9] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 547.224662][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.232832][ T9] usb 1-1: Product: syz [ 547.237299][ T9] usb 1-1: Manufacturer: syz [ 547.256772][ T9] usb 1-1: SerialNumber: syz [ 547.283139][ T9846] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 547.342690][ T9846] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 547.579180][ T9] rtl8150 1-1:1.0: couldn't find required endpoints [ 547.595987][ T9] rtl8150: probe of 1-1:1.0 failed with error -5 [ 547.629285][ T9] usb 1-1: USB disconnect, device number 17 [ 547.670247][ T5842] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 547.711155][ T5842] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 548.186723][ T9883] hid-generic 0000:0000:0000.0004: pid 9883 passed too large report [ 550.062090][ T9915] syz.0.1210: attempt to access beyond end of device [ 550.062090][ T9915] nbd0: rw=0, sector=0, nr_sectors = 2 limit=0 [ 550.079002][ T9915] befs: (nbd0): unable to read superblock [ 550.494815][ T9919] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 552.739452][ T9955] netlink: 'syz.4.1219': attribute type 2 has an invalid length. [ 552.845747][ T5771] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 554.018374][ T5771] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 554.036216][ T5771] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 554.062574][ T5771] usb 4-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 554.105602][ T5771] usb 4-1: config 1 interface 0 has no altsetting 0 [ 554.126970][ T5771] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 554.150821][ T5771] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.185892][ T9] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 554.195230][ T5771] usb 4-1: Product: syz [ 554.202346][ T5771] usb 4-1: Manufacturer: syz [ 554.213691][ T5771] usb 4-1: SerialNumber: syz [ 554.233152][ T9948] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 554.251956][ T9948] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 554.382306][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 554.413640][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 554.481976][ T9] usb 1-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 554.491848][ T5771] rtl8150 4-1:1.0: couldn't find required endpoints [ 554.515934][ T5771] rtl8150: probe of 4-1:1.0 failed with error -5 [ 554.522366][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 554.618143][ T5771] usb 4-1: USB disconnect, device number 18 [ 554.661405][ T9969] VFS: Can't find a romfs filesystem on dev mtdblock0. [ 554.661405][ T9969] [ 554.811984][ T9] cxacru 1-1:1.0: invalid response length to cm 0x90: 0 [ 554.852491][ T9] cxacru 1-1:1.0: usbatm_usb_probe: invalid endpoint 02! [ 554.886208][ T9] cxacru: probe of 1-1:1.0 failed with error -22 [ 555.013704][ T9] usb 1-1: USB disconnect, device number 18 [ 555.351261][ T9995] netlink: 'syz.4.1230': attribute type 2 has an invalid length. [ 555.365789][ T5757] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 556.674523][ T5757] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 556.694876][T10003] netlink: 'syz.0.1232': attribute type 2 has an invalid length. [ 556.716716][ T5757] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 556.755068][ T5757] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 556.765183][ T5757] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 556.829673][ T5757] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 556.858463][ T5757] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 556.916149][ T5757] usb 3-1: Product: syz [ 556.920379][ T5757] usb 3-1: Manufacturer: syz [ 557.144777][T10023] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1240'. [ 557.367670][T10025] netlink: 'syz.4.1239': attribute type 2 has an invalid length. [ 558.376521][ T5757] usb 3-1: USB disconnect, device number 11 [ 559.506006][ T8] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 559.549055][T10044] netlink: 'syz.4.1245': attribute type 2 has an invalid length. [ 559.698684][T10040] kAFS: No cell specified [ 559.699956][ T8] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 559.740440][ T8] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 559.785580][ T8] usb 4-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 559.819629][ T8] usb 4-1: config 1 interface 0 has no altsetting 0 [ 559.842507][ T8] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 559.872965][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.909669][ T8] usb 4-1: Product: syz [ 559.913906][ T8] usb 4-1: Manufacturer: syz [ 559.939583][ T8] usb 4-1: SerialNumber: syz [ 559.962545][T10027] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 559.971470][T10027] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 563.499780][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.520019][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 570.182013][ T8] rtl8150 4-1:1.0: couldn't find required endpoints [ 570.188956][ T8] rtl8150: probe of 4-1:1.0 failed with error -5 [ 570.200733][ T8] usb 4-1: USB disconnect, device number 19 [ 570.488320][T10072] netlink: 'syz.2.1251': attribute type 2 has an invalid length. [ 578.391279][T10116] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 578.403933][T10116] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 578.430637][T10116] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 578.486706][T10116] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 578.515824][T10116] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 578.523343][T10116] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 578.831376][ T6991] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.988584][ T6991] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.005785][ T5771] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 579.084187][ T6991] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.199593][ T5771] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 579.211949][ T5771] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 579.226294][ T5771] usb 4-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 579.255447][ T5771] usb 4-1: config 1 interface 0 has no altsetting 0 [ 579.268732][ T5771] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 579.288249][ T5771] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.338213][ T6991] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.355981][ T5771] usb 4-1: Product: syz [ 579.416439][ T5771] usb 4-1: Manufacturer: syz [ 579.451009][ T5771] usb 4-1: SerialNumber: syz [ 579.495196][T10113] chnl_net:caif_netlink_parms(): no params data found [ 579.495626][T10121] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 579.536181][T10121] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 579.812614][ T5771] rtl8150 4-1:1.0: couldn't find required endpoints [ 579.883692][ T5771] rtl8150: probe of 4-1:1.0 failed with error -5 [ 580.004605][ T5771] usb 4-1: USB disconnect, device number 20 [ 580.016709][T10139] netlink: 'syz.4.1263': attribute type 21 has an invalid length. [ 580.024659][T10139] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1263'. [ 580.099781][T10139] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1263'. [ 580.575561][T10116] Bluetooth: hci0: command tx timeout [ 580.656412][T10148] netlink: 'syz.2.1264': attribute type 2 has an invalid length. [ 580.664677][T10113] bridge0: port 1(bridge_slave_0) entered blocking state [ 580.675332][T10113] bridge0: port 1(bridge_slave_0) entered disabled state [ 580.694904][T10113] bridge_slave_0: entered allmulticast mode [ 580.739106][T10113] bridge_slave_0: entered promiscuous mode [ 580.759516][T10113] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.818424][T10113] bridge0: port 2(bridge_slave_1) entered disabled state [ 580.835782][T10113] bridge_slave_1: entered allmulticast mode [ 580.867175][T10113] bridge_slave_1: entered promiscuous mode [ 580.998351][T10113] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 581.205097][T10113] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 583.786178][T10116] Bluetooth: hci0: command tx timeout [ 583.960269][T10113] team0: Port device team_slave_0 added [ 583.961793][T10113] team0: Port device team_slave_1 added [ 584.099200][T10113] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 584.099213][T10113] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 584.099227][T10113] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 584.170677][T10113] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 584.170696][T10113] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 584.170722][T10113] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 584.376811][ C1] vkms_vblank_simulate: vblank timer overrun [ 584.498066][T10113] hsr_slave_0: entered promiscuous mode [ 584.525339][T10113] hsr_slave_1: entered promiscuous mode [ 584.705802][ T23] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 585.085917][ T23] usb 3-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 585.117980][ T23] usb 3-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 585.155940][T10200] netlink: 'syz.3.1274': attribute type 2 has an invalid length. [ 585.255649][ T23] usb 3-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 585.334604][ T23] usb 3-1: config 1 interface 0 has no altsetting 0 [ 585.376304][ T23] usb 3-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 585.386691][ T23] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 585.419166][ T23] usb 3-1: Product: syz [ 585.423378][ T23] usb 3-1: Manufacturer: syz [ 586.254874][ T23] usb 3-1: SerialNumber: syz [ 586.412760][T10116] Bluetooth: hci0: command tx timeout [ 587.127974][T10191] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 587.138979][T10191] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 587.322455][ T23] rtl8150 3-1:1.0: couldn't find required endpoints [ 587.355328][ T23] rtl8150: probe of 3-1:1.0 failed with error -5 [ 587.439218][ T23] usb 3-1: USB disconnect, device number 12 [ 587.688405][ T6991] IPVS: stopping master sync thread 8075 ... [ 588.002482][T10113] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 588.242482][T10113] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 588.275721][T10113] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 588.473496][ T6991] hsr_slave_0: left promiscuous mode [ 588.483489][ T6991] hsr_slave_1: left promiscuous mode [ 588.505947][T10116] Bluetooth: hci0: command tx timeout [ 588.536071][ T6991] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 588.582388][ T6991] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 588.633183][ T6991] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 588.664405][ T6991] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 588.695708][ T23] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 588.704236][ T6991] bridge_slave_1: left allmulticast mode [ 588.716502][ T6991] bridge_slave_1: left promiscuous mode [ 588.735195][ T6991] bridge0: port 2(bridge_slave_1) entered disabled state [ 588.782810][ T6991] bridge_slave_0: left allmulticast mode [ 588.805707][ T6991] bridge_slave_0: left promiscuous mode [ 588.811523][ T6991] bridge0: port 1(bridge_slave_0) entered disabled state [ 588.903984][ T23] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 588.921723][ T6991] veth1_macvtap: left promiscuous mode [ 588.929169][ T6991] veth0_macvtap: left promiscuous mode [ 588.934780][ T23] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 588.940104][ T6991] veth1_vlan: left promiscuous mode [ 588.953615][ T6991] veth0_vlan: left promiscuous mode [ 588.957771][ T23] usb 4-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 588.974383][ T23] usb 4-1: config 1 interface 0 has no altsetting 0 [ 588.994932][ T23] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 589.013995][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 589.040341][ T23] usb 4-1: Product: syz [ 589.046162][ T23] usb 4-1: Manufacturer: syz [ 589.051186][ T23] usb 4-1: SerialNumber: syz [ 589.095231][T10249] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 589.103629][T10249] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 589.329347][ T6991] bond1 (unregistering): (slave veth3): Releasing active interface [ 589.651277][ T6991] bond1 (unregistering): Released all slaves [ 590.795537][ T5842] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 590.925317][ T6991] team0 (unregistering): Port device team_slave_1 removed [ 590.998087][ T5842] usb 3-1: not running at top speed; connect to a high speed hub [ 591.010651][ T5842] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 591.030128][ T5842] usb 3-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 591.041029][ T5842] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 591.050150][ T6991] team0 (unregistering): Port device team_slave_0 removed [ 591.057949][ T5842] usb 3-1: Product: syz [ 591.062512][ T5842] usb 3-1: Manufacturer: syz [ 591.067189][ T5842] usb 3-1: SerialNumber: syz [ 591.079563][ T5842] oti6858 3-1:1.0: oti6858 converter detected [ 591.092049][ T5842] usb 3-1: oti6858 converter now attached to ttyUSB0 [ 591.171640][ T6991] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 591.313595][ T6991] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 591.340502][ T8] infiniband syz1: ib_query_port failed (-19) [ 592.051598][ T6991] bond0 (unregistering): Released all slaves [ 592.224161][T10113] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 592.329520][ T23] rtl8150 4-1:1.0: couldn't find required endpoints [ 592.336929][ T23] rtl8150: probe of 4-1:1.0 failed with error -5 [ 592.368565][ T23] usb 4-1: USB disconnect, device number 21 [ 592.955325][ T23] usb 3-1: USB disconnect, device number 13 [ 593.839710][ T23] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 594.087054][ T23] oti6858 3-1:1.0: device disconnected [ 594.836289][ T6991] IPVS: stop unused estimator thread 0... [ 596.403629][T10113] 8021q: adding VLAN 0 to HW filter on device bond0 [ 596.721589][T10113] 8021q: adding VLAN 0 to HW filter on device team0 [ 596.789278][ T5869] bridge0: port 1(bridge_slave_0) entered blocking state [ 596.796482][ T5869] bridge0: port 1(bridge_slave_0) entered forwarding state [ 596.841201][ T5869] bridge0: port 2(bridge_slave_1) entered blocking state [ 596.848413][ T5869] bridge0: port 2(bridge_slave_1) entered forwarding state [ 597.468755][T10113] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 597.585693][ T5842] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 597.788249][ T5842] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 597.805504][ T5842] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 597.838837][ T5842] usb 4-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 597.893237][ T5842] usb 4-1: config 1 interface 0 has no altsetting 0 [ 597.922978][ T5842] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 597.946164][ T5842] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 597.968710][ T5842] usb 4-1: Product: syz [ 597.972930][ T5842] usb 4-1: Manufacturer: syz [ 597.980202][T10379] loop4: detected capacity change from 0 to 128 [ 597.998278][ T5842] usb 4-1: SerialNumber: syz [ 598.024227][T10355] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 598.036501][T10355] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 598.206089][T10113] veth0_vlan: entered promiscuous mode [ 598.249509][T10113] veth1_vlan: entered promiscuous mode [ 598.292995][ T5842] rtl8150 4-1:1.0: couldn't find required endpoints [ 598.332851][ T5842] rtl8150: probe of 4-1:1.0 failed with error -5 [ 598.381242][ T5842] usb 4-1: USB disconnect, device number 22 [ 598.445077][T10113] veth0_macvtap: entered promiscuous mode [ 598.498169][T10113] veth1_macvtap: entered promiscuous mode [ 598.567362][T10113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 598.596611][T10113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 598.618550][T10113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 598.645566][T10113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 598.665491][T10113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 598.701600][T10113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 598.723842][T10113] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 598.779208][T10113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 598.815825][T10113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 598.834433][T10113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 598.861000][T10113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 598.886593][T10113] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 598.915715][T10113] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 598.931170][T10113] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 598.962465][T10113] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.009847][T10113] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.026091][T10113] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.034841][T10113] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.332320][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 599.355447][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 599.464077][ T6991] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 599.500694][ T6991] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 599.795140][T10406] netlink: 'syz.5.1255': attribute type 2 has an invalid length. [ 600.043497][T10417] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0, syncid = 1, id = 0 [ 600.344268][ T968] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 600.382468][ T968] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz1] on syz0 [ 600.586194][T10393] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 600.777785][T10393] usb 6-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 600.802305][T10393] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 600.846457][T10393] usb 6-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 600.888845][T10393] usb 6-1: config 1 interface 0 has no altsetting 0 [ 600.900907][T10436] gadgetfs: bound to dummy_udc driver [ 600.908602][T10393] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 600.933056][T10393] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.941004][T10425] hid-generic 0000:0000:0000.0005: pid 10425 passed too large report [ 600.956354][T10393] usb 6-1: Product: syz [ 600.960564][T10393] usb 6-1: Manufacturer: syz [ 600.965217][T10393] usb 6-1: SerialNumber: syz [ 600.976751][ T5772] Bluetooth: hci4: command 0x0406 tx timeout [ 601.021504][T10428] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 601.037559][T10428] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 601.286852][T10393] rtl8150 6-1:1.0: couldn't find required endpoints [ 601.293645][T10393] rtl8150: probe of 6-1:1.0 failed with error -5 [ 601.334916][T10393] usb 6-1: USB disconnect, device number 2 [ 601.503706][ T5869] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 601.542277][ T5869] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.698798][ T5869] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 601.735726][ T5869] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.861731][ T5869] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 601.904029][ T5869] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.073917][ T5869] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 602.099090][ T5869] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.420661][T10456] netlink: 'syz.5.1336': attribute type 2 has an invalid length. [ 602.528669][ T5869] tipc: Left network mode [ 602.760923][ T5772] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 602.771603][ T5772] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 602.781657][ T5772] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 602.790027][ T5772] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 602.799359][ T5772] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 602.806906][ T5772] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 603.049458][T10393] IPVS: starting estimator thread 0... [ 603.155790][T10472] IPVS: using max 22 ests per chain, 52800 per kthread [ 603.259116][T10476] gadgetfs: bound to dummy_udc driver [ 603.358058][T10480] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1341'. [ 603.426581][ T8936] ================================================================== [ 603.434775][ T8936] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfc/0xc80 [ 603.442272][ T8936] Read of size 8 at addr ffff88801bb9bc60 by task syz-executor/8936 [ 603.450277][ T8936] [ 603.452658][ T8936] CPU: 1 PID: 8936 Comm: syz-executor Not tainted syzkaller #0 [ 603.460226][ T8936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 603.470271][ T8936] Call Trace: [ 603.473543][ T8936] [ 603.476463][ T8936] dump_stack_lvl+0x18c/0x250 [ 603.481144][ T8936] ? __lock_acquire+0x7d80/0x7d80 [ 603.486172][ T8936] ? show_regs_print_info+0x20/0x20 [ 603.491371][ T8936] ? load_image+0x420/0x420 [ 603.495865][ T8936] ? __virt_addr_valid+0x10c/0x380 [ 603.500995][ T8936] ? __virt_addr_valid+0x10c/0x380 [ 603.506097][ T8936] ? __virt_addr_valid+0x10c/0x380 [ 603.511198][ T8936] print_report+0xa8/0x210 [ 603.515610][ T8936] ? __mutex_lock+0xfc/0xc80 [ 603.520201][ T8936] kasan_report+0x117/0x150 [ 603.524696][ T8936] ? tomoyo_check_open_permission+0x384/0x460 [ 603.530761][ T8936] ? __mutex_lock+0xfc/0xc80 [ 603.535345][ T8936] __mutex_lock+0xfc/0xc80 [ 603.539759][ T8936] ? end_current_label_crit_section+0x170/0x170 [ 603.545995][ T8936] ? ep_open+0x4e/0x270 [ 603.550242][ T8936] ? mutex_lock_nested+0x20/0x20 [ 603.555170][ T8936] ? apparmor_file_open+0x5ab/0x760 [ 603.560358][ T8936] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 603.565893][ T8936] ? __rwlock_init+0x150/0x150 [ 603.570652][ T8936] ep_open+0x4e/0x270 [ 603.574621][ T8936] ? do_dentry_open+0x86f/0x14b0 [ 603.579551][ T8936] do_dentry_open+0x880/0x14b0 [ 603.584309][ T8936] ? ep_ioctl+0x1c0/0x1c0 [ 603.588632][ T8936] path_openat+0x284f/0x3270 [ 603.593221][ T8936] ? do_sys_openat2+0xda/0x1d0 [ 603.597975][ T8936] ? __x64_sys_openat+0x139/0x160 [ 603.602995][ T8936] ? verify_lock_unused+0x140/0x140 [ 603.608183][ T8936] ? do_filp_open+0x430/0x430 [ 603.612856][ T8936] do_filp_open+0x1f2/0x430 [ 603.617354][ T8936] ? vfs_tmpfile+0x620/0x620 [ 603.621941][ T8936] ? _raw_spin_unlock+0x28/0x40 [ 603.626780][ T8936] ? alloc_fd+0x590/0x640 [ 603.631111][ T8936] do_sys_openat2+0x134/0x1d0 [ 603.635782][ T8936] ? do_sys_open+0xe0/0xe0 [ 603.640193][ T8936] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 603.646165][ T8936] ? fsnotify_link_count+0xf0/0xf0 [ 603.651268][ T8936] ? lock_chain_count+0x20/0x20 [ 603.656108][ T8936] __x64_sys_openat+0x139/0x160 [ 603.660966][ T8936] do_syscall_64+0x55/0xb0 [ 603.665388][ T8936] ? clear_bhb_loop+0x40/0x90 [ 603.670069][ T8936] ? clear_bhb_loop+0x40/0x90 [ 603.674748][ T8936] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 603.680639][ T8936] RIP: 0033:0x7fc0d855e98e [ 603.685049][ T8936] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 603.704657][ T8936] RSP: 002b:00007fff6f9ce268 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 603.713098][ T8936] RAX: ffffffffffffffda RBX: 000055557ddf0500 RCX: 00007fc0d855e98e [ 603.721062][ T8936] RDX: 0000000000000000 RSI: 00007fff6f9ce3d0 RDI: ffffffffffffff9c [ 603.729021][ T8936] RBP: 00007fff6f9ce3d0 R08: 0000000000000000 R09: 0000000000000000 [ 603.736980][ T8936] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6f9cf4c0 [ 603.744940][ T8936] R13: 00007fc0d863448b R14: 000055557ddf04e8 R15: 0000000000000006 [ 603.752908][ T8936] [ 603.755918][ T8936] [ 603.758226][ T8936] Allocated by task 10476: [ 603.762710][ T8936] kasan_set_track+0x4e/0x70 [ 603.767292][ T8936] __kasan_kmalloc+0x8f/0xa0 [ 603.771869][ T8936] gadgetfs_bind+0x25f/0x830 [ 603.776451][ T8936] gadget_bind_driver+0x2b3/0x770 [ 603.781483][ T8936] really_probe+0x247/0xae0 [ 603.785992][ T8936] __driver_probe_device+0x1f5/0x390 [ 603.791271][ T8936] driver_probe_device+0x4f/0x420 [ 603.796280][ T8936] __driver_attach+0x444/0x6d0 [ 603.801034][ T8936] bus_for_each_dev+0x235/0x2b0 [ 603.805874][ T8936] bus_add_driver+0x340/0x630 [ 603.810540][ T8936] driver_register+0x23a/0x310 [ 603.815291][ T8936] usb_gadget_register_driver_owner+0xf9/0x270 [ 603.821435][ T8936] dev_config+0xe49/0x1260 [ 603.825836][ T8936] vfs_write+0x299/0x9a0 [ 603.830073][ T8936] ksys_write+0x151/0x260 [ 603.834392][ T8936] do_syscall_64+0x55/0xb0 [ 603.838849][ T8936] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 603.844732][ T8936] [ 603.847041][ T8936] Freed by task 5807: [ 603.851021][ T8936] kasan_set_track+0x4e/0x70 [ 603.855616][ T8936] kasan_save_free_info+0x28/0x40 [ 603.860644][ T8936] ____kasan_slab_free+0x126/0x1f0 [ 603.865748][ T8936] slab_free_freelist_hook+0x130/0x1a0 [ 603.871194][ T8936] __kmem_cache_free+0xba/0x1f0 [ 603.876042][ T8936] destroy_ep_files+0x280/0x340 [ 603.880879][ T8936] gadgetfs_unbind+0x109/0x2b0 [ 603.885631][ T8936] gadget_unbind_driver+0x1bf/0x3e0 [ 603.890833][ T8936] device_release_driver_internal+0x408/0x6f0 [ 603.896897][ T8936] driver_detach+0x1f3/0x2d0 [ 603.901487][ T8936] bus_remove_driver+0x221/0x2f0 [ 603.906413][ T8936] usb_gadget_unregister_driver+0x4e/0x70 [ 603.912123][ T8936] dev_release+0x86/0x200 [ 603.916439][ T8936] __fput+0x221/0x940 [ 603.920406][ T8936] delayed_fput+0x58/0x80 [ 603.924722][ T8936] process_scheduled_works+0xa60/0x1600 [ 603.930259][ T8936] worker_thread+0xa5e/0xfe0 [ 603.934837][ T8936] kthread+0x2fa/0x390 [ 603.938894][ T8936] ret_from_fork+0x48/0x80 [ 603.943304][ T8936] ret_from_fork_asm+0x11/0x20 [ 603.948102][ T8936] [ 603.950413][ T8936] Last potentially related work creation: [ 603.956109][ T8936] kasan_save_stack+0x3e/0x60 [ 603.960772][ T8936] __kasan_record_aux_stack+0xaf/0xc0 [ 603.966135][ T8936] insert_work+0x3d/0x310 [ 603.970452][ T8936] __queue_work+0xcf4/0xfd0 [ 603.974951][ T8936] call_timer_fn+0x189/0x540 [ 603.979527][ T8936] __run_timers+0x59c/0x810 [ 603.984018][ T8936] run_timer_softirq+0x67/0xf0 [ 603.988767][ T8936] handle_softirqs+0x27d/0x820 [ 603.993522][ T8936] __irq_exit_rcu+0xd3/0x190 [ 603.998099][ T8936] irq_exit_rcu+0x9/0x20 [ 604.002331][ T8936] sysvec_apic_timer_interrupt+0x56/0xc0 [ 604.007955][ T8936] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 604.013924][ T8936] [ 604.016231][ T8936] Second to last potentially related work creation: [ 604.022872][ T8936] kasan_save_stack+0x3e/0x60 [ 604.027538][ T8936] __kasan_record_aux_stack+0xaf/0xc0 [ 604.032899][ T8936] insert_work+0x3d/0x310 [ 604.037222][ T8936] __queue_work+0xcf4/0xfd0 [ 604.041718][ T8936] call_timer_fn+0x189/0x540 [ 604.046296][ T8936] __run_timers+0x59c/0x810 [ 604.050786][ T8936] run_timer_softirq+0x67/0xf0 [ 604.055533][ T8936] handle_softirqs+0x27d/0x820 [ 604.060287][ T8936] __irq_exit_rcu+0xd3/0x190 [ 604.064862][ T8936] irq_exit_rcu+0x9/0x20 [ 604.069088][ T8936] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 604.074712][ T8936] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 604.080683][ T8936] [ 604.082994][ T8936] The buggy address belongs to the object at ffff88801bb9bc00 [ 604.082994][ T8936] which belongs to the cache kmalloc-512 of size 512 [ 604.097056][ T8936] The buggy address is located 96 bytes inside of [ 604.097056][ T8936] freed 512-byte region [ffff88801bb9bc00, ffff88801bb9be00) [ 604.110752][ T8936] [ 604.113064][ T8936] The buggy address belongs to the physical page: [ 604.119537][ T8936] page:ffffea00006ee600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bb98 [ 604.129675][ T8936] head:ffffea00006ee600 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 604.138604][ T8936] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 604.146569][ T8936] page_type: 0xffffffff() [ 604.150884][ T8936] raw: 00fff00000000840 ffff888017c41c80 dead000000000100 dead000000000122 [ 604.159451][ T8936] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 604.168013][ T8936] page dumped because: kasan: bad access detected [ 604.174405][ T8936] page_owner tracks the page as allocated [ 604.180102][ T8936] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 212, tgid 212 (kworker/u4:0), ts 5542541731, free_ts 0 [ 604.200323][ T8936] post_alloc_hook+0x1c1/0x200 [ 604.205086][ T8936] get_page_from_freelist+0x2181/0x22a0 [ 604.210620][ T8936] __alloc_pages+0x1f0/0x460 [ 604.215196][ T8936] alloc_slab_page+0x5d/0x180 [ 604.219859][ T8936] new_slab+0x87/0x2d0 [ 604.223915][ T8936] ___slab_alloc+0xc5c/0x12f0 [ 604.228579][ T8936] __kmem_cache_alloc_node+0x11f/0x250 [ 604.234026][ T8936] kmalloc_trace+0x2a/0xe0 [ 604.238433][ T8936] alloc_bprm+0x56/0x9a0 [ 604.242714][ T8936] kernel_execve+0x98/0x980 [ 604.247205][ T8936] call_usermodehelper_exec_async+0x20b/0x350 [ 604.253262][ T8936] ret_from_fork+0x48/0x80 [ 604.257670][ T8936] ret_from_fork_asm+0x11/0x20 [ 604.262423][ T8936] page_owner free stack trace missing [ 604.267784][ T8936] [ 604.270093][ T8936] Memory state around the buggy address: [ 604.275785][ T8936] ffff88801bb9bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 604.283830][ T8936] ffff88801bb9bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 604.291879][ T8936] >ffff88801bb9bc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 604.299926][ T8936] ^ [ 604.307108][ T8936] ffff88801bb9bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 604.315152][ T8936] ffff88801bb9bd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 604.323209][ T8936] ================================================================== [ 604.387354][ T8936] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 604.394596][ T8936] CPU: 0 PID: 8936 Comm: syz-executor Not tainted syzkaller #0 [ 604.402154][ T8936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 604.412224][ T8936] Call Trace: [ 604.415513][ T8936] [ 604.418452][ T8936] dump_stack_lvl+0x18c/0x250 [ 604.423151][ T8936] ? show_regs_print_info+0x20/0x20 [ 604.428361][ T8936] ? load_image+0x420/0x420 [ 604.432864][ T8936] panic+0x2ca/0x720 [ 604.436756][ T8936] ? bpf_jit_dump+0xd0/0xd0 [ 604.441253][ T8936] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 604.447222][ T8936] ? _raw_spin_unlock+0x40/0x40 [ 604.452057][ T8936] ? print_memory_metadata+0x314/0x400 [ 604.457503][ T8936] ? __mutex_lock+0xfc/0xc80 [ 604.462083][ T8936] check_panic_on_warn+0x84/0xa0 [ 604.467010][ T8936] ? __mutex_lock+0xfc/0xc80 [ 604.471589][ T8936] end_report+0x6f/0x130 [ 604.475821][ T8936] kasan_report+0x128/0x150 [ 604.480312][ T8936] ? tomoyo_check_open_permission+0x384/0x460 [ 604.486379][ T8936] ? __mutex_lock+0xfc/0xc80 [ 604.490960][ T8936] __mutex_lock+0xfc/0xc80 [ 604.495373][ T8936] ? end_current_label_crit_section+0x170/0x170 [ 604.501621][ T8936] ? ep_open+0x4e/0x270 [ 604.505770][ T8936] ? mutex_lock_nested+0x20/0x20 [ 604.510698][ T8936] ? apparmor_file_open+0x5ab/0x760 [ 604.515883][ T8936] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 604.521418][ T8936] ? __rwlock_init+0x150/0x150 [ 604.526173][ T8936] ep_open+0x4e/0x270 [ 604.530143][ T8936] ? do_dentry_open+0x86f/0x14b0 [ 604.535071][ T8936] do_dentry_open+0x880/0x14b0 [ 604.539825][ T8936] ? ep_ioctl+0x1c0/0x1c0 [ 604.544141][ T8936] path_openat+0x284f/0x3270 [ 604.548730][ T8936] ? do_sys_openat2+0xda/0x1d0 [ 604.553483][ T8936] ? __x64_sys_openat+0x139/0x160 [ 604.558503][ T8936] ? verify_lock_unused+0x140/0x140 [ 604.563693][ T8936] ? do_filp_open+0x430/0x430 [ 604.568363][ T8936] do_filp_open+0x1f2/0x430 [ 604.572856][ T8936] ? vfs_tmpfile+0x620/0x620 [ 604.577440][ T8936] ? _raw_spin_unlock+0x28/0x40 [ 604.582278][ T8936] ? alloc_fd+0x590/0x640 [ 604.586602][ T8936] do_sys_openat2+0x134/0x1d0 [ 604.591273][ T8936] ? do_sys_open+0xe0/0xe0 [ 604.595680][ T8936] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 604.601650][ T8936] ? fsnotify_link_count+0xf0/0xf0 [ 604.606750][ T8936] ? lock_chain_count+0x20/0x20 [ 604.611596][ T8936] __x64_sys_openat+0x139/0x160 [ 604.616442][ T8936] do_syscall_64+0x55/0xb0 [ 604.620847][ T8936] ? clear_bhb_loop+0x40/0x90 [ 604.625515][ T8936] ? clear_bhb_loop+0x40/0x90 [ 604.630179][ T8936] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 604.636062][ T8936] RIP: 0033:0x7fc0d855e98e [ 604.640467][ T8936] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 604.660064][ T8936] RSP: 002b:00007fff6f9ce268 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 604.668467][ T8936] RAX: ffffffffffffffda RBX: 000055557ddf0500 RCX: 00007fc0d855e98e [ 604.676427][ T8936] RDX: 0000000000000000 RSI: 00007fff6f9ce3d0 RDI: ffffffffffffff9c [ 604.684397][ T8936] RBP: 00007fff6f9ce3d0 R08: 0000000000000000 R09: 0000000000000000 [ 604.692368][ T8936] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6f9cf4c0 [ 604.700341][ T8936] R13: 00007fc0d863448b R14: 000055557ddf04e8 R15: 0000000000000006 [ 604.708313][ T8936] [ 604.711565][ T8936] Kernel Offset: disabled [ 604.715874][ T8936] Rebooting in 86400 seconds..