last executing test programs: 8.750227312s ago: executing program 3 (id=242): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x382f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 8.454589642s ago: executing program 1 (id=243): r0 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, r0, 0x1, 0x70bd28, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket$pppl2tp(0x18, 0x1, 0x1) symlink(&(0x7f0000000780)='./file0/../file0\x00', &(0x7f00000017c0)='./file0\x00') readlink(&(0x7f0000000080)='./file0\x00', &(0x7f0000000000)=""/13, 0xd) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) syz_emit_ethernet(0x59, &(0x7f0000000180)={@local, @empty, @void, {@mpls_mc={0x8848, {[{0x9, 0x0, 0x1}, {0xdc7}, {0x1}, {0x7, 0x0, 0x1}, {0x10, 0x0, 0x1}, {0xb}, {0x8, 0x0, 0x1}, {0x7}], @ipv4=@dccp={{0x6, 0x4, 0x3, 0x21, 0x2b, 0x66, 0x0, 0xf, 0x21, 0x0, @private=0xa010102, @local, {[@end]}}, {{0x4e20, 0x4e20, 0x4, 0x1, 0x7, 0x0, 0x0, 0x4, 0x5, "0de4c3", 0x0, "5162f7"}, "aa9c06"}}}}}}, 0x0) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x25, 0x0, 0x3, 0x6a57}, {0x1d}, {0x28, 0x0, 0x81, 0x1}, {0xb1, 0x0, 0x28, 0x6}, {0x16, 0xff, 0x5, 0x557}]}) r3 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) r4 = dup2(r3, r3) recvmsg$unix(r4, &(0x7f0000000ac0)={&(0x7f0000000300), 0x6e, &(0x7f0000000900)=[{&(0x7f0000000380)=""/230, 0xe6}, {&(0x7f0000000480)=""/110, 0x6e}, {&(0x7f0000000500)=""/168, 0xa8}, {&(0x7f00000005c0)=""/87, 0x57}, {&(0x7f00000007c0)=""/230, 0xe6}], 0x5, &(0x7f0000000980)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x48}, 0x40010140) read$FUSE(r4, &(0x7f00000063c0)={0x2020, 0x0, 0x0}, 0x2020) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x3a) r6 = fsopen(&(0x7f0000000040)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) syz_open_dev$sg(&(0x7f00000000c0), 0x1, 0x200) fsmount(r6, 0x0, 0x82) r7 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120110c91ef7fd081c1b1a0a00000000000109022400010000b008090400fb02030002000921040003012228000905810340000cc1fd"], 0x0) write$FUSE_INIT(r4, &(0x7f0000000200)={0x50, 0x0, r5, {0x7, 0x2d, 0x5, 0x102000, 0x3, 0x1, 0x6, 0x1, 0x0, 0x0, 0x1, 0x1}}, 0x50) syz_usb_control_io$hid(r7, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a00)={0x1, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7fff}, [@alu={0x4, 0x0, 0x3, 0x0, 0x0, 0x1, 0x4}]}, &(0x7f00000002c0)='GPL\x00', 0xf}, 0x94) syz_usb_control_io(r7, &(0x7f00000006c0)={0x2c, &(0x7f0000000080)={0x20, 0x11, 0x2d, {0x2d, 0x20, "7135d94820d9cdbc1decabd4964aca837a2dddfbd1cff85ec89ab779e12fd24f246561e5016a544cce4863"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) getdents64(r8, 0xfffffffffffffffe, 0xff80) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) 8.209326251s ago: executing program 3 (id=244): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c832, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="240000005f000500000000000000000000000000020000000000000005000200", 0x20}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r0, 0x0, 0x0) r1 = userfaultfd(0x801) socketpair$unix(0x1, 0x3, 0x0, 0x0) r2 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r2, 0x4) r3 = landlock_create_ruleset(0x0, 0x0, 0x0) r4 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x15) socket$inet_tcp(0x2, 0x1, 0x6) write$uinput_user_dev(r4, 0x0, 0x0) landlock_restrict_self(r3, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x700}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r5 = socket(0xa, 0x3, 0x87) sendto(r5, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) 7.706576596s ago: executing program 3 (id=245): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCADDRT(r0, 0x890b, 0x0) mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000140)='securityfs\x00', 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000340), 0x42101, 0x0) writev(r1, &(0x7f0000000500)=[{&(0x7f0000000080)="153f204aba890558353208453e3040b19cb4c8c795fa2be7e44e5bde0c0aed700e6e9e2e8430a29686467184f7dcfc614ab3d5b943d1856e9f815f8e931baf3a3000452704715c030bb7aed865b2f32f74c5b0ba980fa6aa4c69304bcd2008f31977af11257c53a7df2a1182372b45a64f3d3ec8030dff24fdb16dc957980f90a8a4c3b970214036b55dddc5f5a1ae96c5a003ead17fe73730000000007c1efc7c22a98d09be19", 0xa7}], 0x1) ioctl$SNAPSHOT_FREE(r1, 0x3305) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000180)={'gre0\x00', 0x0, 0x7800, 0x7888, 0x6, 0x9, {{0x9, 0x4, 0x3, 0xb, 0x24, 0x45, 0x0, 0x8, 0x4, 0x0, @private=0xa014102, @private=0xa010101, {[@end, @timestamp={0x44, 0xc, 0xcd, 0x0, 0x2, [0x9, 0xd]}]}}}}}) openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0xe77d250bd47c6cbd, 0x1) 7.193672609s ago: executing program 4 (id=247): socket$kcm(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socket$kcm(0x1e, 0x4, 0x0) socket$kcm(0x1e, 0x4, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000004c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010001d0025bd7000fadbdf25000000", @ANYRES32=r2, @ANYBLOB="138000002b9201002400128009000100626f6e6400000000140002800800", @ANYRES16=r0], 0x44}, 0x1, 0x0, 0x0, 0x40448e0}, 0x0) 7.192189458s ago: executing program 2 (id=248): r0 = socket(0x2d, 0x2, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r1, 0x8) landlock_restrict_self(r1, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x1e3) landlock_restrict_self(0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) connect$netlink(r0, &(0x7f0000000140)=@unspec={0x2d, 0x0, 0xa00}, 0xc) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000200)) r3 = dup2(r2, r2) setreuid(0xffffffffffffffff, 0xee01) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) write$P9_RSTATu(r3, &(0x7f0000000500)={0x64, 0x7d, 0x1, {{0x0, 0x4e, 0x6, 0xc81, {0x4, 0x3, 0x1}, 0xe0100000, 0x6, 0x80000001, 0xd4, 0x6, '[P)/!/', 0x11, '/dev/vhost-vsock\x00', 0x4, '%%+['}, 0x1, '\x00'}}, 0x64) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000001100)=ANY=[@ANYBLOB="b7020000c54a4530bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b706000008ffffffcf6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a1a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895c679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2dff0f000000000000bf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c048d46362ea0d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d120ea257bba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337dbcf3456ff6cd0d6b98a258e3509a7d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f2cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2bc30a96767f500b9e26e3b12854da63083320d8bfe49d85e0842803dc59d6375bce2b8a93caf39c0ba767880b9bf9407e6a6c0f9a43d1ab51dabf9423b482e848fbe1653ff0c6161fa43543546ce17a42e6cddadaf0767d84407478ffe2d0b567d81201efc81e800d4c0874235ff5cd7f5f0ee71cc2b0193bfc9290627ceaeb0b02931a817688f3a51fa2861e70cbab50a5d434ed8d8841694dba46f3d5a95ae86e4d471684ccf427b2ba53a157b2a7cf7a4c10051bb77822190a14c2ab1f271a7cf9c240b99"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54}, 0x42) read$FUSE(r3, &(0x7f0000000a40)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x50a) read$FUSE(r3, &(0x7f0000002a80)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r6 = syz_clone(0x200, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp(r6, r6, 0x1, 0xffffffffffffffff, 0xffffffffffffffff) getgroups(0x7, &(0x7f0000005b40)=[r5, r4, r5, r5, r5, r5, r5]) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r3, 0xc0189375, &(0x7f0000005bc0)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) ioctl$F2FS_IOC_COMPRESS_FILE(r0, 0xf518, 0x0) 6.961674433s ago: executing program 0 (id=249): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x40, 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000140)='./file0\x00', 0xa4000041) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, 0x0, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}]}, 0x1c}}, 0x8001) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x7f}) write$sndseq(r1, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x227, @time={0x65757100, 0xfff}, 0x0, {}, 0x67, 0x2}) inotify_add_watch(r0, &(0x7f0000000000)='.\x00', 0xc100092e) openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x8000, 0x0) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r3, &(0x7f0000000480)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)="18", 0xffffffffffffffd5}], 0x1}}], 0x1, 0xb94b8ea7609ebf9f) shutdown(r3, 0x1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x7}, &(0x7f00000000c0)=0x8) bind$802154_raw(r2, 0x0, 0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$SO_J1939_PROMISC(r4, 0x6b, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x4) 6.728086148s ago: executing program 4 (id=250): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7, 0xff, &(0x7f0000006680)=0x1) semget$private(0x0, 0x4, 0x100) r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\a\x00\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x0}) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0xe, 0x10, 0x89, 0xffffffff}) kexec_load(0x8, 0x0, 0x0, 0x1) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 6.435612977s ago: executing program 3 (id=251): bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2}, {0x0, [0x0]}}, &(0x7f0000001f80)=""/226, 0x26, 0x81, 0x2}, 0x20) (fail_nth: 9) 6.257474782s ago: executing program 2 (id=252): r0 = open$dir(&(0x7f0000000000)='./file0\x00', 0x210300, 0x11) fchmodat(r0, 0x0, 0xb0) link(0x0, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000880)='./file0\x00', 0xc000, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000a00)={0x0, 0x1da}, 0x0) setreuid(0xee01, 0xee01) utimensat(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x7) r1 = memfd_create(&(0x7f0000000040)='\x02A\xbb\xcc\x96\x0e\x00\x00\x00\x00\x00\x00', 0x6) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3000002, 0x11, r1, 0x0) capset(&(0x7f0000000c00)={0x19980330}, &(0x7f0000000140)) syz_io_uring_setup(0x610b, &(0x7f0000000080)={0x0, 0x514f, 0x0, 0x3, 0x16b}, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) r2 = io_uring_setup(0x66a5, &(0x7f0000001300)={0x0, 0xbfb6, 0x80, 0x3, 0x397}) io_uring_register$IORING_REGISTER_BUFFERS2(r2, 0xf, &(0x7f0000001580)={0x3, 0x0, 0x0, &(0x7f00000014c0)=[{0x0}, {0x0}, {&(0x7f0000000280)=""/4094, 0xffe}], &(0x7f0000001540)=[0x0, 0x0, 0x4]}, 0x20) file_getattr(0xffffffffffffff9c, &(0x7f0000000d00)='./file0\x00', &(0x7f0000000d40), 0x18, 0x800) 5.83725678s ago: executing program 3 (id=253): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @loopback}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000000)="fd", 0x1}], 0x1, 0x0, 0x0, 0x804c044}, 0x881) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000000100001082abd62000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004004400000008001b"], 0x30}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r2 = dup(r0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x6f3e7a3b}}, 0x10) epoll_create1(0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1ff}, [@call={0x85, 0x0, 0x0, 0x7a}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xcd}, {0x85, 0x0, 0x0, 0x7b}}]}, &(0x7f0000000680)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000500)="0000000000000000000051229dc9", 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.030564369s ago: executing program 0 (id=254): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000080)="390000001000090468fe0700000000000000ff3f02000000480100100000000019002b000a00040005000000000000720000", 0x32}], 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r1, 0xc138fd05, &(0x7f0000000000)="0400000002000000000000007e01") mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'netdevsim0\x00', &(0x7f0000000080)=@ethtool_channels={0x3d, 0xfff7fffe, 0x7, 0xfffffffc, 0x0, 0x1, 0x9, 0x1000, 0x80}}) 4.914809109s ago: executing program 2 (id=255): r0 = socket$alg(0x26, 0x5, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) capset(0x0, &(0x7f0000000080)={0x6, 0x6, 0x0, 0x87, 0xffffffff, 0x2}) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x5b) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r1, 0x6, 0x1, &(0x7f0000000100), 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9c", 0x3}], 0x1}], 0x1, 0x40800) socket$kcm(0x1e, 0x4, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800}, 0x0, &(0x7f0000000240)={0x1f, 0x3}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 4.879363038s ago: executing program 1 (id=256): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c832, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="240000005f000500000000000000000000000000020000000000000005000200", 0x20}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r0, 0x0, 0x0) r1 = userfaultfd(0x801) socketpair$unix(0x1, 0x3, 0x0, 0x0) r2 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r2, 0x4) r3 = landlock_create_ruleset(0x0, 0x0, 0x0) r4 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x15) socket$inet_tcp(0x2, 0x1, 0x6) write$uinput_user_dev(r4, 0x0, 0x0) landlock_restrict_self(r3, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x700}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r5 = socket(0xa, 0x3, 0x87) sendto(r5, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) 4.610673068s ago: executing program 1 (id=257): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@newsa={0x180, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@mcast1, @in=@private=0xa010101, 0x1, 0x714, 0x4e20, 0x5, 0x0, 0x0, 0x0, 0x2b}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@remote, {0x20000, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x4000000001f, 0x2}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3505, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @algo_auth={0x48, 0x1, {{'hmac(sha1-neon)\x00'}}}]}, 0x180}, 0x1, 0x0, 0x0, 0x8801}, 0x10008800) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=ANY=[@ANYBLOB="3400000018000100000000000000000002002000fc000009000000000600150008000000100016"], 0x34}}, 0x0) 4.346244337s ago: executing program 1 (id=258): ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc45}) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) r0 = openat$kvm(0xffffff9c, &(0x7f0000000180), 0x129102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CLOCK(0xffffffffffffffff, 0x4030ae7b, &(0x7f0000000040)={0x6a7, 0xa, 0x3, 0x9, 0x2}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x71, 0x2, 0x2, 0x2d7, 0x8000000000000000, 0x8000000000000000, 0x5, 0x0, 0x4, 0x401, 0x2, 0x5, 0x8d], 0xeeee8000, 0x284e97}) syz_usb_connect(0x0, 0x55, &(0x7f0000000180)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c001090400000102020100052400100104240202052401000105240600010705810308000a09040100020a0000000705820200020007050302"], 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.899638409s ago: executing program 0 (id=259): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000240)={0x1, 0x1, 0x0, &(0x7f0000000200)=""/51, 0x0}) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000340)) r3 = dup(r2) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000000)={0x1, r3}) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000), 0x111, 0x4}}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.383612467s ago: executing program 4 (id=260): socket$kcm(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socket$kcm(0x1e, 0x4, 0x0) socket$kcm(0x1e, 0x4, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000004c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010001d0025bd7000fadbdf25000000", @ANYRES32=r2, @ANYBLOB="138000002b9201002400128009000100626f6e6400000000140002800800", @ANYRES16=r0], 0x44}, 0x1, 0x0, 0x0, 0x40448e0}, 0x0) 3.116354138s ago: executing program 2 (id=261): timerfd_settime(0xffffffffffffffff, 0x2, 0x0, 0x0) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x0, 0x3938700}) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_io_uring_setup(0x201, &(0x7f0000000580)={0x0, 0xc9f, 0x800, 0x83, 0x3d2}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r2, r3, 0x2c, 0x10000) io_uring_enter(r1, 0x1, 0x8000020, 0x1, 0x0, 0x0) io_uring_enter(r1, 0x6516, 0x6d93, 0x8, 0x0, 0x0) io_uring_enter(r1, 0x9ee, 0xa09a, 0x86, 0x0, 0x0) flistxattr(0xffffffffffffffff, 0x0, 0x0) dup3(r0, r0, 0x0) socket$igmp6(0xa, 0x3, 0x2) 2.691611388s ago: executing program 0 (id=262): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3, 0x0, 0x0, 0x6}, 0x30, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) r1 = socket(0x2000000000000021, 0x2, 0x2) shutdown(r1, 0x2) sendto$inet(r1, 0x0, 0x0, 0x20004000, 0x0, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r2, 0x6628) landlock_restrict_self(r2, 0x7) r3 = epoll_create1(0x80000) epoll_pwait(r3, &(0x7f0000000240)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_INO_PATHS(r3, 0xc0389423, &(0x7f0000000080)={0x800, 0x8, [0x1, 0xb, 0x6, 0x8], &(0x7f0000000000)=[0x0]}) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r4, 0x891a, &(0x7f00000001c0)={'batadv0\x00', {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xb}}}) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f00000000c0)={0x200, 0x6, 0x4, 0x0, 0x0, [{{r1}, 0xffffffff}, {{r0}, 0xfffffffffffffffc}, {{r4}, 0x8000000000000001}, {{r0}, 0xfffffffffffffffa}]}) landlock_restrict_self(r0, 0x1) syz_open_procfs(0x0, &(0x7f0000000240)='net/snmp\x00') 2.543229864s ago: executing program 2 (id=263): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32=0x0], 0x50) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r4, 0x84, 0x6d, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="043e1f0a"], 0x22) 1.121815352s ago: executing program 4 (id=264): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000c80)=ANY=[@ANYBLOB="10010000fe0901040000000000000000030000000900010073797a3000000000b80002002c00018014000300fe8000000000000000000000000000bb14000400fe88000000000000000000000000000106000340000000001400018008000100ac1414aa08000200e00000020c0002"], 0x110}, 0x1, 0x0, 0x0, 0x1}, 0x10) 1.031300123s ago: executing program 0 (id=265): r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000010"], 0xfe44, 0x400000000000000) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) 1.016287447s ago: executing program 2 (id=266): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000280)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="0000d0279bf760155fdf9f5d3a9eb90000", @ANYRES16=r2, @ANYBLOB="01002abd7000fddbdf252100000008000300", @ANYRES32=r3, @ANYRES32=0x0], 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x4) (async) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="0000d0279bf760155fdf9f5d3a9eb90000", @ANYRES16=r2, @ANYBLOB="01002abd7000fddbdf252100000008000300", @ANYRES32=r3, @ANYRES32=0x0], 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x4) r4 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) (async) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d40)=@newqdisc={0x14c, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x2, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x11c, 0x2, [@TCA_CHOKE_STAB={0x104, 0x2, "dc542b4e237011fb38ddb228806571a8633206e26df63a43bbc516382325dedd79c1cf0a26379dfaf72cb5ab9ab7efe16f312ee9ab598d1ac0d7903ac69c51f1b6842ebecf00dec5deff737b59f0c1f0b57cc6c2b7b8c5b2c527aafa57222f4bd2355ccab39fa20d4033b6b687491532080101805feb9c6fa8a56a77186efcb394ce1a1cd7f2130835e3bf9e3ac25d0a102a808be13beb51f37da6d10046f131834545ee5013f43e41e91eb18a12c28540ab4106286e0f7568f6a9cd0c0da51df08e42848096b25d455ebec9adfd6e493d8c9725bc2d49bbbae0a5375b359f91d9dad20ed109ffbc52469cd2cf5df7773f7a4c72ae167485315c326281efc400"}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x1ffff, 0xffff0100}}]}}]}, 0x14c}}, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x2000, 0x0, 0x1}) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000001"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="95a2b55431", @ANYRES16=r2, @ANYBLOB="00022dbd7000ffdbdf251d00000008000300", @ANYRES32=r3, @ANYBLOB="0c009900080000005b000000080001002f00000008020300", @ANYRES32=r3, @ANYRES32=r6, @ANYRES32=r3, @ANYBLOB="0c0099000500000028000000"], 0x6c}, 0x1, 0x0, 0x0, 0x4000014}, 0x44) socket$packet(0x11, 0x2, 0x300) (async) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000000), 0x8) (async) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000000), 0x8) unshare(0x42000000) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000000), 0x8) syz_usbip_server_init(0x3) (async) syz_usbip_server_init(0x3) syz_usbip_server_init(0x3) (async) syz_usbip_server_init(0x3) syz_usbip_server_init(0x3) syz_usbip_server_init(0x3) syz_usbip_server_init(0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000240), 0xffffffffffffffff) (async) r10 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$SEG6_CMD_GET_TUNSRC(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r10, 0x1, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x850}, 0x44000) syz_usbip_server_init(0x3) syz_usbip_server_init(0x2) (async) syz_usbip_server_init(0x2) syz_usbip_server_init(0x3) openat$kvm(0x0, 0x0, 0x0, 0x0) fanotify_init(0x40, 0x2) (async) fanotify_init(0x40, 0x2) 962.285134ms ago: executing program 3 (id=267): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c832, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="240000005f000500000000000000000000000000020000000000000005000200", 0x20}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r0, 0x0, 0x0) r1 = userfaultfd(0x801) socketpair$unix(0x1, 0x3, 0x0, 0x0) r2 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r2, 0x4) r3 = landlock_create_ruleset(0x0, 0x0, 0x0) r4 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x15) socket$inet_tcp(0x2, 0x1, 0x6) write$uinput_user_dev(r4, 0x0, 0x0) landlock_restrict_self(r3, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x700}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r5 = socket(0xa, 0x3, 0x87) sendto(r5, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) 932.701574ms ago: executing program 1 (id=268): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000400)={[0xfffffffffffffff5]}, 0x8, 0x80000) r2 = syz_ublk_add_dev(r1, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x2e, 0x14, 0x0, r1, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x3, 0x51d, 0x0, 0x0, 0x1000, 0x10, 0x0, 0x0, 0x8}}}, &(0x7f00000001c0)) syz_open_dev$ublk_chdev(&(0x7f0000000080), r2, 0x800) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x8, 0x20, 0xa, 0x2}, {0x6, 0x7, 0x1, 0x1000}]}) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0) 368.336794ms ago: executing program 0 (id=269): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b000100001000090455070103490200090582030004"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00N\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x2a8, &(0x7f0000000640)={[{0xc2, 0x4e00, "91e392de417b9c7f7a16d2a24884e7181568eafda927c6c2231d593ca0b4da1d46c15d1ce32cd7fdde8e1b2b2f91019929e8bef5d13fba5e3c26c998b1a0679d3f5803c463cf18c7c435b9809239af46fac69810e03396ff2d737526d523e59074500abecd941e97e4ce708a2d75d553fd94fba3781ee3d59cdde3c5f8dcd11c9c58fbfe3d5084ebe148664116679c16e816ddab8e5d8070f50f22d70326a1e58dd6c2f629f69e8bccc48a8efff414233d5056ff649daad018945157155b8b9ec358"}, {0x35, 0x4e00, "bbb67796a8b1cedbbd3f3987cb313b0917d386f4125cdd26341bc5be0d93bb6fca3fc833fcebdc735d3d047a2bdc9fe28c87f38019"}, {0xa4, 0x4e00, "e0d20aff71b6c6125317f1bcabaa3d1ece32e380c5f5162a97e7d4706b630f2d01aa19608d3040336b899a6cede8d8d24c327719de08c3e62f7a1afbca3dd3e2181ed57045a357ffc767f1e1b691f29c1e31676b16402218dd144188afed0a454e7a758dad2b334bada90eda800d289b16d6ba674ad1b69d6b558daf0c1851cf23865007ca9fd350aa1957692441bb8b86a4fcbc7f497ee4eb62e7735771c2ace54ae608"}, {0x63, 0x4e00, "e23e6c4c6979a72c82469c39b8f7a972b2ba5539c919225fcb3c633ec79928e7ab334445bce8f4b31815f54dcda59c3100887073bb93d49a2f751fcb0d479c25525733ec942fd9fceaf35fe56f589ca3bc12c0fc1eb6245500656f24009b502f4f5f2d"}, {0x3b, 0x4e00, "cf13486135bca79640b9f24800c19911b854bc8b71b5ce6057f6ebca390f285b257a2931a44c988fe8d1185db508be872f679060f7b522cf54fca3"}, {0x4f, 0x4e00, "07bf6120501d8f27778eee4348b9c3a2174aa61601e4d94739173c2b2860d0e65f318072c645e7ee4eb9a1e711290a19e649dcd40747ba2e01d5a65d128a32e589a52d598e117bb75899a57d99aaaa"}]}) syz_usb_control_io$printer(r0, 0x0, 0x0) 322.104184ms ago: executing program 4 (id=270): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000000, 0x10010, 0xffffffffffffffff, 0xec776000) write$UHID_INPUT(0xffffffffffffffff, &(0x7f00000005c0)={0x8, {"2921aa124ed2d506a97e7926a63b9f125f3d71c4bc462974624914b51d43ba5dab880d8567758aef5bd54b23d537161a622a86d11738f41bf37b1877af886dd6907244097fe5bbd1c8b6f7a0cc4e17d6d17e670327986720c450d6ba8a788a8fa709130b8ed9069887de66e3fc2224e35c8a2765f1d62d76c49cd22d9fba4427ed14e0902a5eb216540f071132f39667ef5b363957719a08ef2f67060e5ca88864379f6eb1f18b9b3e60a59c137171e5e5ba8e8edf243932c4ce14757c651944f56aeab70073b660cd88092f4680debd92cc035ee63f470a72c6212dfb977fda8376d97f584c7219ababf2c2937f53b66d9e913e9fb5ae0384b02ba72ef0cfd902dbc0b7d458e684bc664ef71372a809c3416697d91b0ae6f2e774371ba72c85876d462ab632119d51ce44896da2bb6515df38ff158f06748337057b817accad5d0aaa2eba57ceb910b7c2deaf15195763e62df2c2a044554fddd6c70122829c1298466a458920e9fcb01cfa8992785bc660fed8593a904a46ebbfc8d23710cc160962edbfbf422467ed954d618812d44db6833f7a7c97ad9866557d817f15b349b69d38e4a930f2c0c2e7244284bd40b17bf286b77c74ac0cf211f788c009e930207d4dee37673cfaea4ec811792ebdf1863cd50dd5557fca0bee98a4594f337b3d63437ecb31c8d3cbf7937cd602169723c030bc8f70f087a9f44a333df1ae4d219214d501145e58fac3076091e351d453fc54d7a28c27e5d4f00c3aa486bb8742f8386d3f7a10a2b1fd21221af0eee1f0c655952f104224b1b496a91028422bfa3f4b20cdb4cd3e287f8a8fa0bb034275721e7460f7b77b4400015a76cc43780ef97bc598a6edd3c8047d03a134e2d9835d03b16efd823311663a3e43ef23e3d4e6664ee42aec20910f94ffe95273f69cda7a25b3da36a0806445d5ce5ea24692bf0224354d5f648f0722cc9856e731b0bac4d14ccaf442977c719dcd136549c5868060be14fc8b73d60e1aaca3657357866e231cae2bd9cc17ee8355a01cd2d2166633bfeba98fd21c208b3ac03f8fb177bab518d420f83ad206ef255e664e36917221482aae512c4607bba422d668dbb072390f34d82c6d6f3f6c7ad5d9bbbe0afdc78d0259b0ee03368d196219888aa0df78b54aecd6c3dff8b9a2f47464bb701ea10748bbee17744815fdc696e0bc39de00ced1397e69d0ad7a5e7abdde032c46765be5b31ec93c137303808f84dfa5d297d07e99d548ff1f242f26bc501fae1336c30b4e51779ad4dcf9a805021cd3fbf65458ad23250c900fcb96b07da0ca94d1f36deaed625e135aee26c289738481a3688a9c3d3b5609444e34697f781bff4ef235c7a55f9206031529dac6489ee0bbf0095be74a3ba8462a78ba6fd645452d664016186e197976962aeed2561190e3ca6d8410e54f9ea0a1ed09f62cea5b64e50a95e3df5f148bad6510e240bd49ee95f437a06224cec7c58e53f7e5289fa9a04c2fc27b3580b89b38c75ff89318d21c0dcc659e87a78fdd4ddd56ebce1eaba97e1db8ce565bcebbb88c9725ec2cae11f8cf65e261a88506ac14b873d00ee0152d29334171313f5eaf4e11db5704e80282ca870ed677b8fabf07d17d18131211e0214bd2692239151e08ac1674444246063000060d44e4043cd4ff4267f4c8ab2296d5a3af9b31caced926efbf3ff5c8abe82fed63b98a27319fd082ef491a49565e6441b859aa79310eeddc7bcc6e4b7468d80c99d14af3390daeacaeecc4e5dd29ecf7df3a91989d6f5749506bf9089de0967db3ef48d5397180915936c53029d11317071c36f7881fbab0f1bba72eda4c2d6050fde29f12afd568c11d0703917faa77713e7b6b2a01ab7d544cbb58cb25fbd96ab9d659b70a99755fc7d7bec59c9f81be12e24f1cdc8ecea683367fca76588ad546812d2207c329970d74d9c049fcabea1c4da8dd14ef68e5091d14ed5996a381deab15376b0d1bd81e91eb5c32b98b4463901a134792725d91c95cfeb6e52aca22c42e8982c41c35164c8b02f447744e2342ab9b1d91382068c399e4a000a6502afaab87addc5236369bdb7cc9b26c01d7bd0ab7b67e7655861a99e32ba66460dd89d136812e9cefb1907a9ac6e073e075cbf3f83c2a82a7a4411d92014ff987ee0628491b0f22de225e67f38a43f5910ede6e98c2e50513fc9f4fcc660c6a214c6b6b600897d5b03fadddf57facbf6654120b79d8f773487c0e105e79cae61fb769f42599d7f0c382b3fb6fe4931552e14f01478961ab0542924542d682ef1f5fb4d0591208782a0a684014ae56b89f60f3e63d0448817385a3691061ac207ab2e1dbfbd5fa18088faa6a44b0d5cc243a79e3dc9663a134aa3b9eb8c1d04032d440ddf86a336090083b477ab7853c8698dd7dba21a8b149e328455a68d7a91cd329eebf53906147007df0c318e172d79088a9fa988934561f391da503d788e3bad27c12883397896798faba2efd0f879af2a7dae297a3e132f896aa9bccedb8c57a07c7f87e91766f4f63b468a4fe95b9b8d5016f0bce61d4ea0a502378a6af1b35100d6945d44f2d46f5ae31a8c5c4ccc69c794ee413a21e8b2246ce8b4590b1484c192884a55f0d61ec3a4b70a921b05007637ce3285bbd8a50dc056147059bb78873c71abae2ca72bc1655ed890b56563def14c3f934d139428d410ea6b582ff0695136c099f7b8934e9bbd81d5ff51d0cdca6524e65c3e7758f3f8a3f86fb9331ee760bc2680b69013b57438f5314245dba8738d9e4c78805bdd2425a8207c6ff847e4a3fbebebce98f5714c1c6697b0703afbc766b65156b4a59bb635083a5c01507b46152e80a95505e8e1ceb74d5e5c4a4fb912852c496b1a058c8324bc97c2a9fffccb92dbdfb8bf20f1b10fb71152458309efa39083403b50ff5298f654082dec24104fdaf67d3028f7a7e6c26ecc68bdf9a5b69c62921549608a34d9dfc1da7ebd4c5329825e926416bbb5ba4408843aa2b4aa12bf4ed8944f89727d99922729ec14aba247edb1ffbf255e3094f4b58cd2eb6811a3f2323bf0fd576c1b74587e97339e2af2ec2390175fbc78e79df8d86b585ad8be7aeb3a1f8d5c9e943a6b49716d018bf565a2355dd20d5fcdaba4f221104fa51abd7bd4663ef07e57d70c30062e44d089db4138ae2bb76ee0303ccffbec56128cd4b3c788e74a84477dcfdc8c40515cf591c1f26df9dca67825778a8e80c8e87c357219fc1f02c51cd50f7058c9963993e4e36dcde610fc8839ed25049afe2731863629b2cef3ae93069b5ba789f782acc4ce527e685b2395fd80b1219603d1b546aab8a733450e83875fa236902f36381571e641da395f478dfb54acc07bdc943c0b514fa3035636c3806d5219b9a04df5d9188d9b150fcda092e41009535c474a154c6aa0e8bf316b8902d1c5bfc77c971cbe983db9c123b062a9a8c91c404f5fc4d7f92264314a7a16433e6c3e799c6321f5dc3a825d04dbf8addf2d35b699b5cbc6a5a78d75e6fa2d50904dc77b76800c54752b94644d49233bc34341d9096dfc2ba3f64ba7d841670d69e394e9611882459d78491b4211d2f4c2d88ed8b5f99a65eacdb30fb56f8633b10f4758fc31b9ab1f2d6158a0c5489d1ea532269571090915fe6270f4d02e8120f076ccb026f772461956a42ece0262b26ddb4e37426084978692a724e668c6d65016bd36bb3f9c776e70936acdd708b4bbcc78a1421b0e797696c121e18de8204fac4b95435d0d125f5a14b88c569a4cf5ba4cf08946c87b16816907fb9cc7045fd459c987630ce45163478baa2982b88852225981e07d48cd1799830e2f1ff60bf2ae9ed1b3eb93aeecb849ceb4c8f7d87eedb87507717f5ea82bff3bf5e4b28adf7d944bb58aec03d8127a9c86f03c086f7b6da8bc0d41dc87bfd8a5b7ba7f617e44b52d0e037b507f3345c119d265c4cc53645c52a1c2ea16ed45bd6b5451d454744e682ee837f82d70bb6a51b74400b4520668161fea1fabb93facf55ecb5375cbf1d6b9b724cd6d42b131901a7d7712f39163ee7069809dae21feaa8ea313cad0e00934ce8e642d1acc9c60e757af3882f2a8d52bbb8a339d787a4e3fc25ae5605d94bfd8f48a631f0b0f1682732e66ddc1cb6d1fcc05fdfd2b53d7fe2444786701ceebb520c63a176698bcce5d1831899074301a40295ff6deeb4c5012e7ce9a37db783257722c5f277e52dbd061e886daaa32f39ea6f5137bca2c06e2b188ccd3819d850c946e75cc822005fe15d716b7a988202bd4c3198e03af58c5fbcfdc028a57444afb9dbb603b4f60839ba1cd948a04f725ef91b9ad6c04484e943e58b696423edc55471bb94e5b3a81879afe3a0a2ed48fc57e147ae8caf2050b7c3ad212bc8b3b8e73f90252e8c8921d3c7f29ee026dad70753584283f09fe0250841c23a98bf8a2abefc004f36d5721fc80ca7a6f2f9c3173e27a52c011f69ef824b4ac53f4591ce2d452c1075cd504718ad1669dd5d756fb67ef29903782f9eb2704c94db33922ba2cbb3db69a6bff82bfa96243734bc37d5efdcf6f832e73c57844d010b788c0cccac4b5f4010bdf507fec42d9e1a8ee434e40a556832b7cad7dca37a75542e8cbbd9fc264790cacfe79562a5a089b9e0d666169492465d26fa0ae2ab67c719f2c4eb3a78657e1181e196de3079011629510c99f5b356c763a409f587598a60297db7852250c20cd71f6ddbe07c18d84713657af331db551052f39ff851ad867d7e8b0f1e8f6fa6486e9d39e200e57c33e4c9eca1d682a1051f1ac27f18dbe1ca3baf6adfa94ceba55b4d07ed57c760f8fe1ad3b595541bba63ae8f952a727c9b22f4ccc1a1422baf10e9cdacc3e0404d61281581fc2b04ac073519b1dc29334a9bc998f340dae95ed7c9af349a743d6d0dc2b65cc59be26c062b8ee30d1d768de49fb6eb6b72266f6c8112a0bcc41bc5e453502e5c66bf13fbe049c2bce6c1c0d4e5d5737d9a1925a7f393747735b40d5f70177c098bd8504003831ef8acec5a5640f1e37a63ca76c0024de4506a5d195fb29fff7a93fafa245e4d6155f123db1bc9f2c6b2ba7450d14ead25c044fab2603a5a46917cda98a55886b330455ebfa4db877b531339c77ccd8c21fb0ef9b7165ec504aaef2ca4089643ae27b09f58e9e87ee2a90f3cbddf68ba12f276d5fd651170ae63938fd131c4b22bda1c1bd2b39300875daecdca9d04507cde26c95de2d0807ce1f2f9ee5d3214955f7bc77fdd8657a10b1efecc9fa6153f8cb43086a3dd4d88932100f1a09a0447f3259efb6a0d11ed3138baaa79aed281dcd035b4b589ccb80bd562a9bbb64751e54e92490b1064c6fbacadd7c1114a261f3256773fc77ed9ebac38cb96f3886fa7096157d9124b8022c884034bd628ba52b5e4c24a3336ea1561a021fb0d03585cdc7629c5aa12df10388902f8e98cec7be4d557c0251f5af96a844c2c74c9227aefd1b58b5d61a2d65b4bc22d08fd273de9263526ba7019c2b03a34d15e79f4e91400bea250d72b83bc710d3be7c6bcaf3dd9f16483de32397173e0c6d4ef149c53a052b4eb34c1716f6bae3e0da52e44b3632e372e873163b3be20be3cfda12a65a448e8f2ef10ec883a688c9615157bdcafac49c9272d23ac231ee662262e1b6e7e6c360dbcf7d47ec65c3fa8875b0f541e9d163dc3a6414df21d590844fcf3586c57a8824a6efa3784739288620b32259bf372209261f20059b50ddac32750527df141d7babfb3d40b1095452823e3e4776e198f6e111b", 0x1000}}, 0x1006) r1 = syz_open_dev$sndctrl(&(0x7f0000000580), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f0000000000)=0xffb) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f00000001c0)={{0x1088, 0x4, 0x6, 0x80, 'syz0\x00', 0xfff}, 0x5, 0x4, 0x1, 0x0, 0xfffffffffffffd9a, 0x8, 'syz1\x00', 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3000001, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f0000000180)=0x7b1) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80100) write$FUSE_INIT(r2, &(0x7f0000000100)={0x50, 0xffffffffffffffda, 0x0, {0x7, 0x2d, 0x3, 0x10028400, 0x9, 0x9, 0x7, 0x3, 0x0, 0x0, 0x10, 0x1}}, 0x50) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000040), 0x3) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000000)) setns(0xc9, 0x0) r4 = socket(0x8, 0x2, 0x0) poll(&(0x7f0000000080)=[{r4, 0x3201}], 0x1, 0x7) 161.116861ms ago: executing program 1 (id=271): socket$kcm(0x1e, 0x4, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x40400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000003c0)={'pcl818\x00', [0x100, 0x7, 0x1, 0xfffffffe, 0x81, 0x1000, 0x80000, 0x20000004, 0x1, 0x1000a, 0x4, 0xb059, 0x100, 0xb6ac, 0x9, 0xffffffff, 0x20000008, 0x10008, 0xfe9, 0x401, 0x3, 0x8000, 0x4, 0x9, 0x48, 0x1, 0x80, 0x10, 0x81, 0x4000007, 0xff]}) r1 = socket(0xb, 0x5, 0x4e000000) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x34, 0x3, 0x6, 0x3, 0x0, 0x0, {0xa, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x48040}, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}) 0s ago: executing program 4 (id=272): r0 = syz_open_dev$sndctrl(&(0x7f00000001c0), 0x0, 0x500) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000440)={{0x7, 0x4, 0x6, 0x75, '\x00', 0x10000}, 0x2, 0x20, 0x7ff, r1, 0x1, 0xd4e5, 'syz1\x00', &(0x7f0000000100)=['veth0_to_bridge\x00'], 0x10}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0xc4c85513, &(0x7f0000000140)={0x8d, 0x0, 0xffffffff, 0x0, '\x00', 0x10000}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000040711227000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x11, 0x4, 0x4, 0x9}, 0x50) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/damon_reclaim/parameters/min_age\x00', 0x1, 0x0) syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000000)=ANY=[@ANYBLOB="12012002020000102505a1a440000102030109025c0002010120080904000001020d0000052406000105240005000d240f01040000000100fafffa06241a020032090581"], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r3, 0xc0189379, &(0x7f0000000240)={{0x1, 0x1, 0x18, r2}, './sys/module/damon_reclaim/parameters/min_age\x00'}) r5 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000005c0)={'veth0_to_bridge\x00', 0x0}) bind$packet(r5, &(0x7f00000000c0)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @remote}, 0x14) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x9, 0x3, 0x463c55f9, 0x1, 0x8, r4, 0x8001, '\x00', r6, r3, 0x1, 0x0, 0x5}, 0x50) write(r3, &(0x7f0000000140)="30bd", 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, &(0x7f0000000840), &(0x7f00000000c0)=r3}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYRES64=r0], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.181' (ED25519) to the list of known hosts. [ 91.216230][ T5572] cgroup: Unknown subsys name 'net' [ 91.488110][ T5572] cgroup: Unknown subsys name 'cpuset' [ 91.551923][ T5572] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 93.645432][ T5572] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 96.466768][ T5591] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 96.485288][ T5597] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.499035][ T5597] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 96.512601][ T5599] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 96.516746][ T5597] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 96.532615][ T5597] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 96.565736][ T5597] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 96.567261][ T5597] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 96.567949][ T5599] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 96.568470][ T5599] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 96.570911][ T5602] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 96.570934][ T5599] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 96.585069][ T5597] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 96.598305][ T5602] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 96.601915][ T5602] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 96.611263][ T5597] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 96.623954][ T4901] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 96.625003][ T4901] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 96.632418][ T5596] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 96.651376][ T5596] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 96.721524][ T5597] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 96.759788][ T5602] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 96.771984][ T5596] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 96.774357][ T5597] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 96.817171][ T5602] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 97.186632][ T999] cfg80211: failed to load regulatory.db [ 98.713636][ T5602] Bluetooth: hci0: command tx timeout [ 98.713827][ T5591] Bluetooth: hci2: command tx timeout [ 98.791310][ T5591] Bluetooth: hci1: command tx timeout [ 98.871880][ T5602] Bluetooth: hci3: command tx timeout [ 98.872060][ T5591] Bluetooth: hci4: command tx timeout [ 99.496239][ T5583] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.496337][ T5583] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.496706][ T5583] bridge_slave_0: entered allmulticast mode [ 99.499796][ T5583] bridge_slave_0: entered promiscuous mode [ 99.562391][ T5585] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.562519][ T5585] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.562687][ T5585] bridge_slave_0: entered allmulticast mode [ 99.565514][ T5585] bridge_slave_0: entered promiscuous mode [ 99.606690][ T5583] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.606775][ T5583] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.606914][ T5583] bridge_slave_1: entered allmulticast mode [ 99.609377][ T5583] bridge_slave_1: entered promiscuous mode [ 99.610505][ T5586] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.610602][ T5586] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.610745][ T5586] bridge_slave_0: entered allmulticast mode [ 99.629186][ T5586] bridge_slave_0: entered promiscuous mode [ 99.648793][ T5587] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.649079][ T5587] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.680517][ T5587] bridge_slave_0: entered allmulticast mode [ 99.692343][ T5587] bridge_slave_0: entered promiscuous mode [ 99.694603][ T5585] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.694725][ T5585] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.694895][ T5585] bridge_slave_1: entered allmulticast mode [ 99.697436][ T5585] bridge_slave_1: entered promiscuous mode [ 99.758082][ T5586] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.758211][ T5586] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.758354][ T5586] bridge_slave_1: entered allmulticast mode [ 99.760291][ T5586] bridge_slave_1: entered promiscuous mode [ 99.776917][ T5587] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.777419][ T5587] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.777976][ T5587] bridge_slave_1: entered allmulticast mode [ 99.788424][ T5587] bridge_slave_1: entered promiscuous mode [ 99.826720][ T5584] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.826848][ T5584] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.826974][ T5584] bridge_slave_0: entered allmulticast mode [ 99.828849][ T5584] bridge_slave_0: entered promiscuous mode [ 99.917863][ T5584] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.918052][ T5584] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.918636][ T5584] bridge_slave_1: entered allmulticast mode [ 99.921148][ T5584] bridge_slave_1: entered promiscuous mode [ 99.952476][ T5583] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.996950][ T5585] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.021896][ T5583] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.025061][ T5586] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.032549][ T5587] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.057856][ T5585] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.101982][ T5586] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.104489][ T5587] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.135371][ T5584] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.211022][ T5584] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.222335][ T5583] team0: Port device team_slave_0 added [ 100.277718][ T5585] team0: Port device team_slave_0 added [ 100.304304][ T5583] team0: Port device team_slave_1 added [ 100.306472][ T5586] team0: Port device team_slave_0 added [ 100.311028][ T5587] team0: Port device team_slave_0 added [ 100.328239][ T5585] team0: Port device team_slave_1 added [ 100.374567][ T5586] team0: Port device team_slave_1 added [ 100.377134][ T5587] team0: Port device team_slave_1 added [ 100.405145][ T5584] team0: Port device team_slave_0 added [ 100.477036][ T5584] team0: Port device team_slave_1 added [ 100.478272][ T5583] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.478284][ T5583] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.478303][ T5583] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.566614][ T5585] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.566626][ T5585] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.566646][ T5585] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.615958][ T5583] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.615970][ T5583] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.615990][ T5583] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.617086][ T5586] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.617096][ T5586] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.617115][ T5586] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.619285][ T5587] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.619299][ T5587] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.619327][ T5587] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.620684][ T5585] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.620699][ T5585] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.620728][ T5585] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.774910][ T5586] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.774960][ T5586] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.775034][ T5586] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.792065][ T5602] Bluetooth: hci0: command tx timeout [ 100.792359][ T5591] Bluetooth: hci2: command tx timeout [ 100.793922][ T5587] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.793961][ T5587] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.794057][ T5587] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.848958][ T5584] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.849000][ T5584] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.849079][ T5584] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.879021][ T5591] Bluetooth: hci1: command tx timeout [ 100.952328][ T5602] Bluetooth: hci3: command tx timeout [ 100.953476][ T5591] Bluetooth: hci4: command tx timeout [ 101.452763][ T5584] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.452776][ T5584] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.452796][ T5584] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.624879][ T5583] hsr_slave_0: entered promiscuous mode [ 101.626096][ T5583] hsr_slave_1: entered promiscuous mode [ 101.675802][ T5585] hsr_slave_0: entered promiscuous mode [ 101.677829][ T5585] hsr_slave_1: entered promiscuous mode [ 101.678560][ T5585] debugfs: 'hsr0' already exists in 'hsr' [ 101.678639][ T5585] Cannot create hsr debugfs directory [ 101.721154][ T5586] hsr_slave_0: entered promiscuous mode [ 101.722855][ T5586] hsr_slave_1: entered promiscuous mode [ 101.723670][ T5586] debugfs: 'hsr0' already exists in 'hsr' [ 101.723687][ T5586] Cannot create hsr debugfs directory [ 101.730435][ T5587] hsr_slave_0: entered promiscuous mode [ 101.742630][ T5587] hsr_slave_1: entered promiscuous mode [ 101.745367][ T5587] debugfs: 'hsr0' already exists in 'hsr' [ 101.745441][ T5587] Cannot create hsr debugfs directory [ 101.825790][ T5584] hsr_slave_0: entered promiscuous mode [ 101.827292][ T5584] hsr_slave_1: entered promiscuous mode [ 101.828374][ T5584] debugfs: 'hsr0' already exists in 'hsr' [ 101.828400][ T5584] Cannot create hsr debugfs directory [ 102.871460][ T5602] Bluetooth: hci0: command tx timeout [ 102.872100][ T5591] Bluetooth: hci2: command tx timeout [ 102.915306][ T5583] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 102.951444][ T5591] Bluetooth: hci1: command tx timeout [ 102.978569][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.985750][ T5583] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 103.016455][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.029181][ T5583] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 103.041388][ T5591] Bluetooth: hci4: command tx timeout [ 103.041408][ T5602] Bluetooth: hci3: command tx timeout [ 103.066366][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.091047][ T5583] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 103.116798][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.226090][ T5586] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 103.266782][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.286793][ T5586] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 103.334980][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.355717][ T5586] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 103.395663][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.422501][ T5586] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 103.460149][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.574134][ T5585] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 103.615832][ T5585] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.634762][ T5585] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 103.686489][ T5585] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.699878][ T5585] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 103.734953][ T5585] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.761042][ T5585] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 103.805985][ T5585] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.015901][ T5584] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.044711][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.065242][ T5584] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.095857][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.100191][ T5584] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 104.136654][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.196769][ T5584] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 104.217132][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.367410][ T5583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.400244][ T5587] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 104.427692][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.444478][ T5587] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 104.496319][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.514931][ T5587] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 104.555712][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.572776][ T5587] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 104.599131][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.659305][ T5583] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.709227][ T1019] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.723099][ T1019] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.771581][ T5586] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.818195][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.818303][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.896115][ T5586] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.942663][ T5585] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.954536][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.958707][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.966373][ T5602] Bluetooth: hci2: command tx timeout [ 104.966415][ T5602] Bluetooth: hci0: command tx timeout [ 105.027667][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.027815][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.031384][ T5591] Bluetooth: hci1: command tx timeout [ 105.111430][ T5591] Bluetooth: hci4: command tx timeout [ 105.111441][ T5602] Bluetooth: hci3: command tx timeout [ 105.113443][ T5585] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.170770][ T5584] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.189299][ T3371] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.189452][ T3371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.256087][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.256260][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.367959][ T5584] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.424234][ T5587] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.461696][ T3371] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.461869][ T3371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.557131][ T3371] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.559200][ T3371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.682033][ T5587] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.807184][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.809258][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.890885][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.891028][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.593482][ T5583] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.845255][ T5586] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.013745][ T5583] veth0_vlan: entered promiscuous mode [ 107.143613][ T5583] veth1_vlan: entered promiscuous mode [ 107.380941][ T5583] veth0_macvtap: entered promiscuous mode [ 107.429337][ T5583] veth1_macvtap: entered promiscuous mode [ 107.464675][ T5585] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.511848][ T5584] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.593284][ T5583] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.672669][ T5583] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.931097][ T5587] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.050107][ T5585] veth0_vlan: entered promiscuous mode [ 108.117473][ T5584] veth0_vlan: entered promiscuous mode [ 108.242042][ T5585] veth1_vlan: entered promiscuous mode [ 108.282931][ T5584] veth1_vlan: entered promiscuous mode [ 108.350730][ T5586] veth0_vlan: entered promiscuous mode [ 108.380004][ T1019] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.380031][ T1019] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.477416][ T5586] veth1_vlan: entered promiscuous mode [ 108.539455][ T5587] veth0_vlan: entered promiscuous mode [ 108.566344][ T3371] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.566360][ T3371] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.618998][ T5585] veth0_macvtap: entered promiscuous mode [ 108.643049][ T5587] veth1_vlan: entered promiscuous mode [ 108.659628][ T5584] veth0_macvtap: entered promiscuous mode [ 108.673071][ T5585] veth1_macvtap: entered promiscuous mode [ 108.722246][ T5584] veth1_macvtap: entered promiscuous mode [ 108.767722][ T5586] veth0_macvtap: entered promiscuous mode [ 108.807549][ T5585] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.810275][ T5586] veth1_macvtap: entered promiscuous mode [ 108.849069][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.866244][ T5585] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.914739][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.963686][ T5587] veth0_macvtap: entered promiscuous mode [ 108.987199][ T5586] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.040566][ T5587] veth1_macvtap: entered promiscuous mode [ 109.064520][ T5586] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.644778][ T5587] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.970270][ T5587] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.368917][ T1019] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.368938][ T1019] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.600179][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.600200][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.873664][ T1019] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.874144][ T1477] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.874343][ T1477] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.874834][ T1477] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.875039][ T1477] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.887561][ T3371] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.889261][ T3371] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.980258][ T1477] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.226865][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.226887][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.398359][ T3371] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.398382][ T3371] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.697210][ T5802] program syz.3.4 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 112.709562][ T5802] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 113.661621][ T5804] syz.1.11 uses obsolete (PF_INET,SOCK_PACKET) [ 113.780654][ T5804] xt_hashlimit: size too large, truncated to 1048576 [ 113.781090][ T1217] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.781109][ T1217] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.956849][ T3371] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.956870][ T3371] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.029738][ T3371] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.029760][ T3371] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.186607][ T1515] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.361059][ T1515] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.666752][ T104] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.667222][ T104] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.591924][ T104] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.831367][ T1477] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.838651][ T1477] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.922766][ T1477] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.923045][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.051465][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.051983][ T66] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.052025][ T66] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.052064][ T66] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.188505][ T1019] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.208282][ T5819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14'. [ 116.297729][ T5818] random: crng reseeded on system resumption [ 116.398481][ T5819] vxcan2: entered promiscuous mode [ 116.398509][ T5819] vxcan2: entered allmulticast mode [ 116.636956][ T5830] ======================================================= [ 116.636956][ T5830] WARNING: The mand mount option has been deprecated and [ 116.636956][ T5830] and is ignored by this kernel. Remove the mand [ 116.636956][ T5830] option from the mount to silence this warning. [ 116.636956][ T5830] ======================================================= [ 117.172897][ T5603] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 117.192178][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 117.391982][ T5603] usb 5-1: Using ep0 maxpacket: 16 [ 117.397570][ T5603] usb 5-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 117.471333][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 117.474130][ T9] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 117.509368][ T5603] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 117.511372][ T9] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 117.511398][ T9] usb 3-1: config 0 has no interface number 0 [ 117.511441][ T9] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 117.511462][ T9] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 117.511488][ T9] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 117.511514][ T9] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 117.511554][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.517998][ T5603] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 117.518046][ T5603] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.679247][ T5591] Bluetooth: hci1: command 0x2016 tx timeout [ 117.819533][ T5845] exFAT-fs (nullb0): invalid boot record signature [ 117.819549][ T5845] exFAT-fs (nullb0): failed to read boot sector [ 117.819559][ T5845] exFAT-fs (nullb0): failed to recognize exfat type [ 117.897049][ T9] usb 3-1: config 0 descriptor?? [ 117.935434][ T5603] usb 5-1: config 0 descriptor?? [ 118.570199][ T5850] xt_hashlimit: size too large, truncated to 1048576 [ 118.601842][ T9] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 119.042856][ T5603] corsair 0003:1B1C:1B02.0001: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.4-1/input0 [ 119.558326][ T5814] usb 3-1: USB disconnect, device number 2 [ 119.582304][ T5603] corsair 0003:1B1C:1B02.0001: Failed to get K90 initial state (error -71). [ 120.084552][ T5602] Bluetooth: hci1: command 0x2016 tx timeout [ 120.708006][ T5603] usb 5-1: USB disconnect, device number 2 [ 120.786627][ T5814] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 120.947958][ T5869] netlink: 144 bytes leftover after parsing attributes in process `syz.0.29'. [ 120.947979][ T5869] netlink: 12 bytes leftover after parsing attributes in process `syz.0.29'. [ 121.229322][ T5878] netlink: 'syz.4.32': attribute type 1 has an invalid length. [ 121.229346][ T5878] netlink: 'syz.4.32': attribute type 2 has an invalid length. [ 121.229360][ T5878] netlink: 236 bytes leftover after parsing attributes in process `syz.4.32'. [ 121.283213][ T5871] hfs: can't find a HFS filesystem on dev loop0 [ 121.602417][ T5715] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 121.817557][ T5715] usb 1-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 121.841725][ T5715] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.841755][ T5715] usb 1-1: Product: syz [ 121.841772][ T5715] usb 1-1: Manufacturer: syz [ 121.841788][ T5715] usb 1-1: SerialNumber: syz [ 125.069339][ T5908] warning: `syz.4.39' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 125.120901][ T5914] netlink: 'syz.4.39': attribute type 2 has an invalid length. [ 125.120923][ T5914] netlink: 'syz.4.39': attribute type 1 has an invalid length. [ 125.120937][ T5914] netlink: 'syz.4.39': attribute type 1 has an invalid length. [ 125.120950][ T5914] netlink: 'syz.4.39': attribute type 1 has an invalid length. [ 125.164073][ T5715] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 125.229290][ T5715] usb 1-1: USB disconnect, device number 2 [ 125.299198][ T5715] usblp0: removed [ 125.361086][ T5916] xt_hashlimit: size too large, truncated to 1048576 [ 125.768726][ T5921] comedi comedi0: pcmda12: I/O base address not correctly aligned [ 125.971339][ T5715] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 126.147660][ T5715] usb 4-1: device descriptor read/64, error -71 [ 126.357129][ T5927] jfs: Unknown parameter 'discardput/event#' [ 126.461326][ T5715] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 126.513527][ T5937] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 126.629301][ T5715] usb 4-1: device descriptor read/64, error -71 [ 126.733841][ T5715] usb usb4-port1: attempt power cycle [ 127.098615][ T5949] process 'syz.1.53' launched '/dev/fd/4' with NULL argv: empty string added [ 127.222663][ T5952] FAULT_INJECTION: forcing a failure. [ 127.222663][ T5952] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 127.222726][ T5952] CPU: 1 UID: 0 PID: 5952 Comm: syz.0.55 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 127.222757][ T5952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 127.222774][ T5952] Call Trace: [ 127.222782][ T5952] [ 127.222789][ T5952] dump_stack_lvl+0xe8/0x150 [ 127.222841][ T5952] should_fail_ex+0x467/0x600 [ 127.222871][ T5952] _copy_to_user+0x31/0xb0 [ 127.222892][ T5952] simple_read_from_buffer+0xe1/0x170 [ 127.222914][ T5952] proc_fail_nth_read+0x1be/0x230 [ 127.222936][ T5952] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 127.222958][ T5952] ? rw_verify_area+0x250/0x4d0 [ 127.222980][ T5952] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 127.222998][ T5952] vfs_read+0x219/0xa90 [ 127.223026][ T5952] ? __pfx_vfs_read+0x10/0x10 [ 127.223048][ T5952] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 127.223075][ T5952] ? lockdep_hardirqs_on+0x7a/0x110 [ 127.223100][ T5952] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 127.223127][ T5952] ? mutex_lock_nested+0x152/0x1d0 [ 127.223147][ T5952] ? fdget_pos+0x252/0x320 [ 127.223171][ T5952] ksys_read+0x156/0x270 [ 127.223193][ T5952] ? __pfx_ksys_read+0x10/0x10 [ 127.223219][ T5952] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.223238][ T5952] do_syscall_64+0x174/0x580 [ 127.223265][ T5952] ? trace_irq_disable+0x3b/0x140 [ 127.223293][ T5952] ? clear_bhb_loop+0x70/0xc0 [ 127.223318][ T5952] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.223338][ T5952] RIP: 0033:0x7f3303c4e90e [ 127.223362][ T5952] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 127.223376][ T5952] RSP: 002b:00007f3301ee5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 127.223402][ T5952] RAX: ffffffffffffffda RBX: 00007f3301ee66c0 RCX: 00007f3303c4e90e [ 127.223415][ T5952] RDX: 000000000000000f RSI: 00007f3301ee60a0 RDI: 0000000000000003 [ 127.223425][ T5952] RBP: 00007f3301ee6090 R08: 0000000000000000 R09: 0000000000000000 [ 127.223435][ T5952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 127.223446][ T5952] R13: 00007f3303f16038 R14: 00007f3303f15fa0 R15: 00007ffcf9783548 [ 127.223472][ T5952] [ 127.303136][ T5715] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 127.379044][ T5715] usb 4-1: device descriptor read/8, error -71 [ 127.631347][ T5715] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 127.659824][ T5715] usb 4-1: device descriptor read/8, error -71 [ 127.776417][ T5715] usb usb4-port1: unable to enumerate USB device [ 127.950279][ T5962] netlink: 8 bytes leftover after parsing attributes in process `syz.0.59'. [ 128.194502][ T5968] xt_hashlimit: size too large, truncated to 1048576 [ 128.222415][ T5970] netlink: 76 bytes leftover after parsing attributes in process `syz.4.63'. [ 129.216768][ T5979] binder: 5976:5979 ioctl c0306201 200000000480 returned -14 [ 130.981908][ T5979] netlink: 8 bytes leftover after parsing attributes in process `syz.4.66'. [ 130.982140][ T5979] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 132.423693][ T5997] xt_hashlimit: size too large, truncated to 1048576 [ 132.423876][ T5997] xt_hashlimit: max too large, truncated to 1048576 [ 133.106020][ T1327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 133.125143][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.125970][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.276037][ T6006] Driver unsupported XDP return value 0 on prog (id 4) dev N/A, expect packet loss! [ 133.767549][ T5592] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 133.921308][ T5592] usb 2-1: Using ep0 maxpacket: 16 [ 133.922281][ T5592] usb 2-1: New USB device found, idVendor=046c, idProduct=14e8, bcdDevice= b.28 [ 133.924134][ T5592] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 133.924160][ T5592] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 133.924180][ T5592] usb 2-1: config 0 has no interface number 0 [ 133.927835][ T5592] usb 2-1: New USB device strings: Mfr=5, Product=2, SerialNumber=3 [ 133.927861][ T5592] usb 2-1: Product: syz [ 133.927876][ T5592] usb 2-1: Manufacturer: syz [ 133.927900][ T5592] usb 2-1: SerialNumber: syz [ 134.206700][ T6030] xt_hashlimit: size too large, truncated to 1048576 [ 134.383532][ T5591] Bluetooth: hci3: command 0x2016 tx timeout [ 134.421909][ T5592] usb 2-1: config 0 descriptor?? [ 135.328093][ T5592] uvcvideo 2-1:0.105: Found UVC 0.00 device syz (046c:14e8) [ 135.328209][ T5592] uvcvideo 2-1:0.105: No valid video chain found. [ 135.491453][ T5592] usb 2-1: USB disconnect, device number 2 [ 136.225425][ T36] audit: type=1326 audit(1786289692.961:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6048 comm="syz.1.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 136.729452][ T36] audit: type=1326 audit(1786289692.961:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6048 comm="syz.1.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 136.729925][ T36] audit: type=1326 audit(1786289692.961:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6048 comm="syz.1.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=30 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 136.885956][ T36] audit: type=1326 audit(1786289693.021:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6048 comm="syz.1.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 136.886872][ T36] audit: type=1326 audit(1786289693.461:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6048 comm="syz.1.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 136.972148][ T36] audit: type=1326 audit(1786289693.621:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6048 comm="syz.1.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 137.183841][ T36] audit: type=1326 audit(1786289693.891:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6048 comm="syz.1.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 137.263572][ T5591] Bluetooth: hci3: command 0x2016 tx timeout [ 137.282602][ T36] audit: type=1326 audit(1786289693.901:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6048 comm="syz.1.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 137.282661][ T36] audit: type=1326 audit(1786289694.001:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6048 comm="syz.1.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 137.282710][ T36] audit: type=1326 audit(1786289694.001:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6048 comm="syz.1.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 137.972692][ T6060] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 138.256455][ T6072] xt_hashlimit: size too large, truncated to 1048576 [ 139.393411][ T5602] Bluetooth: hci2: command 0x2016 tx timeout [ 141.210576][ T6100] FAULT_INJECTION: forcing a failure. [ 141.210576][ T6100] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 141.210615][ T6100] CPU: 1 UID: 0 PID: 6100 Comm: syz.4.99 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 141.210653][ T6100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 141.210667][ T6100] Call Trace: [ 141.210675][ T6100] [ 141.210685][ T6100] dump_stack_lvl+0xe8/0x150 [ 141.210725][ T6100] should_fail_ex+0x467/0x600 [ 141.210763][ T6100] _copy_to_user+0x31/0xb0 [ 141.210791][ T6100] simple_read_from_buffer+0xe1/0x170 [ 141.210819][ T6100] proc_fail_nth_read+0x1be/0x230 [ 141.210848][ T6100] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 141.210876][ T6100] ? rw_verify_area+0x250/0x4d0 [ 141.210904][ T6100] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 141.210927][ T6100] vfs_read+0x219/0xa90 [ 141.210968][ T6100] ? __pfx_vfs_read+0x10/0x10 [ 141.211010][ T6100] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 141.211043][ T6100] ? lockdep_hardirqs_on+0x7a/0x110 [ 141.211076][ T6100] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 141.211108][ T6100] ? mutex_lock_nested+0x152/0x1d0 [ 141.211131][ T6100] ? fdget_pos+0x252/0x320 [ 141.211161][ T6100] ksys_read+0x156/0x270 [ 141.211187][ T6100] ? __pfx_ksys_read+0x10/0x10 [ 141.211209][ T6100] ? __se_sys_linkat+0x190/0x2d0 [ 141.211248][ T6100] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.211274][ T6100] do_syscall_64+0x174/0x580 [ 141.211305][ T6100] ? trace_irq_disable+0x3b/0x140 [ 141.211341][ T6100] ? clear_bhb_loop+0x70/0xc0 [ 141.211369][ T6100] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.211392][ T6100] RIP: 0033:0x7f40154ee90e [ 141.211413][ T6100] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 141.211431][ T6100] RSP: 002b:00007f4013785fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 141.211454][ T6100] RAX: ffffffffffffffda RBX: 00007f40137866c0 RCX: 00007f40154ee90e [ 141.211469][ T6100] RDX: 000000000000000f RSI: 00007f40137860a0 RDI: 0000000000000004 [ 141.211481][ T6100] RBP: 00007f4013786090 R08: 0000000000000000 R09: 0000000000000000 [ 141.211501][ T6100] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 141.211513][ T6100] R13: 00007f40157b6038 R14: 00007f40157b5fa0 R15: 00007ffc6dd376d8 [ 141.211546][ T6100] [ 141.219475][ T5603] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 141.441577][ T5591] Bluetooth: hci2: command 0x2016 tx timeout [ 141.652373][ T5603] usb 3-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 141.653954][ T5603] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 141.726693][ T5603] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.726725][ T5603] usb 3-1: Product: syz [ 141.726741][ T5603] usb 3-1: Manufacturer: syz [ 141.726757][ T5603] usb 3-1: SerialNumber: syz [ 141.840895][ T5603] ums-karma 3-1:1.0: USB Mass Storage device detected [ 141.896146][ T6106] trusted_key: syz.3.100 sent an empty control message without MSG_MORE. [ 143.321853][ T5602] Bluetooth: hci1: command 0x2016 tx timeout [ 143.499527][ T5603] ums-karma 3-1:1.0: This device (045a,5210,0101 S 06 P f5) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 143.499527][ T5603] Please send a copy of this message to and [ 143.842517][ T6129] xt_hashlimit: size too large, truncated to 1048576 [ 144.121253][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 144.141212][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 144.151222][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 144.161279][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 144.171265][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 144.181278][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 144.191268][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 144.201306][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 144.211275][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 144.221250][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 146.510475][ T5600] Bluetooth: hci1: command 0x2016 tx timeout [ 146.691596][ T5858] usb 3-1: USB disconnect, device number 3 [ 147.327931][ T6140] kAFS: Invalid Command on /proc/fs/afs/cells file [ 147.543401][ T6142] netlink: 8 bytes leftover after parsing attributes in process `syz.4.113'. [ 149.069026][ T5707] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 150.041432][ T5858] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 150.244894][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 150.250042][ T5858] usb 4-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 150.309602][ T5858] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 150.309642][ T5858] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 150.309685][ T5858] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.417407][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 150.417464][ T9] usb 1-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 150.418917][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 150.418967][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 9 [ 150.418992][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 150.419014][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 0 [ 150.449518][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.449547][ T9] usb 1-1: Product: syz [ 150.449560][ T9] usb 1-1: Manufacturer: syz [ 150.449573][ T9] usb 1-1: SerialNumber: syz [ 150.530893][ T9] usb 1-1: config 0 descriptor?? [ 150.532566][ T6156] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 150.586024][ C0] usb 1-1: NFC: Urb failure (status -71) [ 150.588316][ T9] usb 1-1: NFC: Unable to get FW version [ 150.637040][ T9] pn533_usb 1-1:0.0: probe with driver pn533_usb failed with error -90 [ 150.720773][ T5858] usb 4-1: config 0 descriptor?? [ 150.759329][ T31] usb 1-1: USB disconnect, device number 3 [ 150.976355][ T6165] netlink: 28 bytes leftover after parsing attributes in process `syz.2.121'. [ 151.170087][ T5858] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 151.170159][ T5858] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 151.170194][ T5858] playstation 0003:054C:0DF2.0002: unknown global tag 0xd [ 151.170212][ T5858] playstation 0003:054C:0DF2.0002: item 0 0 1 13 parsing failed [ 151.170965][ T5858] playstation 0003:054C:0DF2.0002: Parse failed [ 151.171046][ T5858] playstation 0003:054C:0DF2.0002: probe with driver playstation failed with error -22 [ 151.193438][ T5600] Bluetooth: hci3: command 0x2016 tx timeout [ 151.327606][ T6168] netlink: 'syz.2.122': attribute type 21 has an invalid length. [ 151.396100][ T6167] capability: warning: `syz.2.122' uses deprecated v2 capabilities in a way that may be insecure [ 151.460437][ T6151] netlink: 24 bytes leftover after parsing attributes in process `syz.3.114'. [ 151.460455][ T6151] netlink: 24 bytes leftover after parsing attributes in process `syz.3.114'. [ 151.787544][ T5858] usb 4-1: USB disconnect, device number 6 [ 152.194556][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 152.832924][ T9] usb 1-1: device descriptor read/64, error -71 [ 153.271406][ T5600] Bluetooth: hci3: command 0x2016 tx timeout [ 153.456355][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 154.448532][ T9] usb 1-1: device descriptor read/64, error -71 [ 154.738550][ T9] usb usb1-port1: attempt power cycle [ 155.448787][ T6199] netlink: 36 bytes leftover after parsing attributes in process `syz.1.131'. [ 155.779167][ T6205] Dead loop on virtual device ip6_vti0 (net 36), fix it urgently! [ 156.928348][ T6213] FAULT_INJECTION: forcing a failure. [ 156.928348][ T6213] name failslab, interval 1, probability 0, space 0, times 1 [ 156.928390][ T6213] CPU: 1 UID: 0 PID: 6213 Comm: syz.3.134 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 156.928416][ T6213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 156.928430][ T6213] Call Trace: [ 156.928439][ T6213] [ 156.928448][ T6213] dump_stack_lvl+0xe8/0x150 [ 156.928490][ T6213] should_fail_ex+0x467/0x600 [ 156.928532][ T6213] should_failslab+0xa8/0x100 [ 156.928562][ T6213] __kmalloc_cache_noprof+0xa0/0x6b0 [ 156.928587][ T6213] ? tipc_topsrv_queue_evt+0xec/0x300 [ 156.928618][ T6213] ? tipc_topsrv_queue_evt+0xec/0x300 [ 156.928658][ T6213] tipc_topsrv_queue_evt+0xec/0x300 [ 156.928695][ T6213] tipc_sub_report_overlap+0x4bd/0x8b0 [ 156.928742][ T6213] tipc_nametbl_insert_publ+0xe12/0x1380 [ 156.928785][ T6213] ? tipc_nametbl_insert_publ+0x4e9/0x1380 [ 156.928836][ T6213] ? tipc_nametbl_publish+0x76/0x210 [ 156.928876][ T6213] tipc_nametbl_publish+0xdd/0x210 [ 156.928915][ T6213] ? tipc_nametbl_publish+0x76/0x210 [ 156.928958][ T6213] tipc_sk_publish+0x176/0x380 [ 156.928986][ T6213] ? __pfx_tipc_sk_publish+0x10/0x10 [ 156.929009][ T6213] ? tipc_nametbl_build_group+0x2e/0x530 [ 156.929045][ T6213] ? tipc_nametbl_build_group+0x4f9/0x530 [ 156.929081][ T6213] ? tipc_nametbl_build_group+0x2e/0x530 [ 156.929128][ T6213] tipc_sk_join+0x3b3/0x6a0 [ 156.929167][ T6213] ? __pfx_tipc_sk_join+0x10/0x10 [ 156.929197][ T6213] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 156.929225][ T6213] ? lockdep_hardirqs_on+0x7a/0x110 [ 156.929265][ T6213] tipc_setsockopt+0x73e/0x9a0 [ 156.929309][ T6213] ? __pfx_tipc_setsockopt+0x10/0x10 [ 156.929338][ T6213] ? __fget_files+0x2a/0x420 [ 156.929366][ T6213] ? __fget_files+0x2a/0x420 [ 156.929386][ T6213] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 156.929417][ T6213] ? __pfx_tipc_setsockopt+0x10/0x10 [ 156.929447][ T6213] do_sock_setsockopt+0x17c/0x1b0 [ 156.929481][ T6213] __x64_sys_setsockopt+0x143/0x1b0 [ 156.929512][ T6213] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.929538][ T6213] do_syscall_64+0x174/0x580 [ 156.929570][ T6213] ? trace_irq_disable+0x3b/0x140 [ 156.929607][ T6213] ? clear_bhb_loop+0x70/0xc0 [ 156.929636][ T6213] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.929658][ T6213] RIP: 0033:0x7fdf3130e0d9 [ 156.929681][ T6213] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.929699][ T6213] RSP: 002b:00007fdf2f524028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 156.929725][ T6213] RAX: ffffffffffffffda RBX: 00007fdf31596180 RCX: 00007fdf3130e0d9 [ 156.929742][ T6213] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000005 [ 156.929754][ T6213] RBP: 00007fdf2f524090 R08: 0000000000000010 R09: 0000000000000000 [ 156.929767][ T6213] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 156.929781][ T6213] R13: 00007fdf31596218 R14: 00007fdf31596180 R15: 00007ffcbf74e228 [ 156.929818][ T6213] [ 157.762709][ T5600] Bluetooth: hci4: command 0x2016 tx timeout [ 157.765923][ T5600] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 157.765953][ T5600] CPU: 0 UID: 0 PID: 5600 Comm: kworker/u9:6 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 157.765981][ T5600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 157.765996][ T5600] Workqueue: hci4 hci_rx_work [ 157.766033][ T5600] Call Trace: [ 157.766042][ T5600] [ 157.766053][ T5600] dump_stack_lvl+0xe8/0x150 [ 157.766092][ T5600] sysfs_create_dir_ns+0x271/0x2a0 [ 157.766121][ T5600] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 157.766152][ T5600] ? rt_spin_unlock+0x163/0x200 [ 157.766185][ T5600] kobject_add_internal+0x62c/0xce0 [ 157.766220][ T5600] kobject_add+0x163/0x240 [ 157.766241][ T5600] ? rt_spin_unlock+0x157/0x200 [ 157.766272][ T5600] ? __pfx_kobject_add+0x10/0x10 [ 157.766303][ T5600] ? get_device_parent+0x370/0x3a0 [ 157.766337][ T5600] device_add+0x3fa/0xb80 [ 157.766367][ T5600] hci_conn_add_sysfs+0xd5/0x210 [ 157.766400][ T5600] le_conn_complete_evt+0xfef/0x1580 [ 157.766434][ T5600] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 157.766472][ T5600] ? lockdep_hardirqs_on+0x7a/0x110 [ 157.766505][ T5600] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 157.766538][ T5600] ? rt_mutex_slowunlock+0x219/0x460 [ 157.766566][ T5600] ? skb_pull_data+0xf0/0x200 [ 157.766602][ T5600] hci_le_enh_conn_complete_evt+0x189/0x490 [ 157.766640][ T5600] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 157.766684][ T5600] hci_event_packet+0x67a/0xf10 [ 157.766722][ T5600] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 157.766755][ T5600] ? __pfx_hci_event_packet+0x10/0x10 [ 157.766795][ T5600] ? rt_spin_unlock+0x157/0x200 [ 157.766832][ T5600] ? hci_send_to_monitor+0xe2/0x590 [ 157.766860][ T5600] hci_rx_work+0x3ee/0x1020 [ 157.766903][ T5600] ? process_scheduled_works+0xa20/0x14e0 [ 157.766931][ T5600] process_scheduled_works+0xa8e/0x14e0 [ 157.766991][ T5600] ? __pfx_process_scheduled_works+0x10/0x10 [ 157.767025][ T5600] ? assign_work+0x3cf/0x5d0 [ 157.767058][ T5600] worker_thread+0xa47/0xfb0 [ 157.767102][ T5600] ? __kthread_parkme+0x71/0x1f0 [ 157.767144][ T5600] kthread+0x388/0x470 [ 157.767177][ T5600] ? __pfx_worker_thread+0x10/0x10 [ 157.767202][ T5600] ? __pfx_kthread+0x10/0x10 [ 157.767238][ T5600] ret_from_fork+0x514/0xb70 [ 157.767276][ T5600] ? __pfx_ret_from_fork+0x10/0x10 [ 157.767309][ T5600] ? __switch_to+0xc89/0x1420 [ 157.767359][ T5600] ? __pfx_kthread+0x10/0x10 [ 157.767395][ T5600] ret_from_fork_asm+0x1a/0x30 [ 157.767452][ T5600] [ 157.767487][ T5600] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 157.767531][ T5600] Bluetooth: hci4: failed to register connection device [ 159.002813][ T6231] netlink: 'syz.0.139': attribute type 10 has an invalid length. [ 159.219503][ T6231] syz_tun: entered promiscuous mode [ 159.389290][ T6249] netlink: 36 bytes leftover after parsing attributes in process `syz.2.143'. [ 159.434354][ T6231] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 159.634323][ T6246] netlink: 24 bytes leftover after parsing attributes in process `syz.3.142'. [ 159.833932][ T5591] Bluetooth: hci4: command 0x2016 tx timeout [ 159.912845][ T197] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 160.070975][ T197] usb 4-1: unable to get BOS descriptor or descriptor too short [ 160.071047][ T197] usb 4-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 160.079839][ T197] usb 4-1: config 63 has an invalid interface number: 66 but max is 0 [ 160.079869][ T197] usb 4-1: config 63 has an invalid descriptor of length 101, skipping remainder of the config [ 160.079890][ T197] usb 4-1: config 63 has no interface number 0 [ 160.079924][ T197] usb 4-1: config 63 interface 66 has no altsetting 0 [ 160.130398][ T197] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.130428][ T197] usb 4-1: Product: syz [ 160.130443][ T197] usb 4-1: Manufacturer: syz [ 160.130458][ T197] usb 4-1: SerialNumber: syz [ 160.271364][ T5603] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 160.328130][ T6260] netlink: 36 bytes leftover after parsing attributes in process `syz.0.147'. [ 160.391317][ T6246] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 160.391984][ T6246] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 160.554284][ T6273] 9p: Bad value for 'timeout' [ 161.998549][ T5591] Bluetooth: hci4: command 0x2016 tx timeout [ 162.013264][ T5603] usb 3-1: Using ep0 maxpacket: 8 [ 162.082180][ T5603] usb 3-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 162.087571][ T5603] usb 3-1: config 0 has an invalid interface number: 143 but max is 0 [ 162.087602][ T5603] usb 3-1: config 0 has no interface number 0 [ 162.087653][ T5603] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.135545][ T197] uvcvideo 4-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 162.135583][ T197] uvcvideo 4-1:63.66: No valid video chain found. [ 162.172649][ T197] usb 4-1: USB disconnect, device number 7 [ 162.175611][ T5603] usb 3-1: config 0 descriptor?? [ 162.296870][ T6280] netlink: 8 bytes leftover after parsing attributes in process `syz.0.155'. [ 162.354890][ T5603] viperboard 3-1:0.143: version 0.00 found at bus 003 address 004 [ 162.387453][ T6284] netlink: 36 bytes leftover after parsing attributes in process `syz.4.156'. [ 162.688551][ T6280] netlink: 'syz.0.155': attribute type 1 has an invalid length. [ 162.688576][ T6280] netlink: 'syz.0.155': attribute type 2 has an invalid length. [ 162.737795][ T5603] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 162.737849][ T5603] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 162.857002][ T5595] usb 3-1: USB disconnect, device number 4 [ 163.322197][ T6293] netlink: 4 bytes leftover after parsing attributes in process `syz.0.159'. [ 163.607890][ T6300] batman_adv: batadv0: Adding interface: veth0 [ 163.607910][ T6300] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 163.607946][ T6300] batman_adv: batadv0: Interface activated: veth0 [ 163.708207][ T6300] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 163.708243][ T6300] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 163.850887][ T6300] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 163.850921][ T6300] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 163.902263][ T6300] batman_adv: batadv0: Interface deactivated: veth0 [ 163.902326][ T6300] batman_adv: batadv0: Removing interface: veth0 [ 163.969913][ T6307] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 164.085593][ T6306] loop4: detected capacity change from 0 to 524287964 [ 164.231346][ T5591] Bluetooth: hci4: command 0x2016 tx timeout [ 164.500979][ T36] kauditd_printk_skb: 71 callbacks suppressed [ 164.501002][ T36] audit: type=1326 audit(1786289721.231:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6314 comm="syz.1.164" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 164.501055][ T36] audit: type=1326 audit(1786289721.231:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6314 comm="syz.1.164" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 164.515160][ T36] audit: type=1326 audit(1786289721.251:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6314 comm="syz.1.164" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 164.516634][ T36] audit: type=1326 audit(1786289721.251:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6314 comm="syz.1.164" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 164.516791][ T36] audit: type=1326 audit(1786289721.251:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6314 comm="syz.1.164" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 164.537738][ T36] audit: type=1326 audit(1786289721.261:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6314 comm="syz.1.164" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 164.537892][ T36] audit: type=1326 audit(1786289721.271:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6314 comm="syz.1.164" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 164.538048][ T36] audit: type=1326 audit(1786289721.271:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6314 comm="syz.1.164" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 164.538174][ T36] audit: type=1326 audit(1786289721.271:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6314 comm="syz.1.164" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 164.549156][ T36] audit: type=1326 audit(1786289721.281:92): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6314 comm="syz.1.164" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 165.203740][ T5595] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 165.351737][ T5595] usb 1-1: device descriptor read/64, error -71 [ 165.458302][ T6323] xt_hashlimit: size too large, truncated to 1048576 [ 165.611323][ T5595] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 165.753241][ T5595] usb 1-1: device descriptor read/64, error -71 [ 165.900377][ T5595] usb usb1-port1: attempt power cycle [ 166.281613][ T5595] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 166.304829][ T5595] usb 1-1: device descriptor read/8, error -71 [ 166.562272][ T5595] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 166.593393][ T5595] usb 1-1: device descriptor read/8, error -71 [ 166.613820][ T6330] netlink: 36 bytes leftover after parsing attributes in process `syz.3.170'. [ 166.705567][ T5595] usb usb1-port1: unable to enumerate USB device [ 169.854481][ T6374] netlink: 36 bytes leftover after parsing attributes in process `syz.0.182'. [ 170.033371][ T9] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 170.182224][ T9] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 170.187634][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.187664][ T9] usb 5-1: Product: syz [ 170.187682][ T9] usb 5-1: Manufacturer: syz [ 170.187697][ T9] usb 5-1: SerialNumber: syz [ 170.503630][ T36] kauditd_printk_skb: 233 callbacks suppressed [ 170.503650][ T36] audit: type=1326 audit(1786289727.241:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6384 comm="syz.1.185" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 170.504222][ T36] audit: type=1326 audit(1786289727.241:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6384 comm="syz.1.185" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 170.579594][ T36] audit: type=1326 audit(1786289727.311:328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6384 comm="syz.1.185" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 170.579655][ T36] audit: type=1326 audit(1786289727.311:329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6384 comm="syz.1.185" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 170.587115][ T36] audit: type=1326 audit(1786289727.311:330): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6384 comm="syz.1.185" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 170.587236][ T36] audit: type=1326 audit(1786289727.311:331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6384 comm="syz.1.185" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 170.587285][ T36] audit: type=1326 audit(1786289727.311:332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6384 comm="syz.1.185" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 170.587331][ T36] audit: type=1326 audit(1786289727.311:333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6384 comm="syz.1.185" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 170.587948][ T36] audit: type=1326 audit(1786289727.311:334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6384 comm="syz.1.185" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 170.587996][ T36] audit: type=1326 audit(1786289727.321:336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6384 comm="syz.1.185" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f591aa2e0d9 code=0x7ffc0000 [ 171.805946][ T6388] netlink: 'syz.4.181': attribute type 11 has an invalid length. [ 172.175316][ T6392] MTD: Couldn't look up './file0': -15 [ 172.284943][ T6398] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.1.188:6398 [ 172.884746][ T9] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 172.944850][ T9] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 173.558602][ T5600] Bluetooth: hci3: unexpected cc 0x2027 length: 9 > 1 [ 173.558662][ T5600] Bluetooth: hci3: unexpected event for opcode 0x2027 [ 174.268746][ T6407] batman_adv: batadv0: Adding interface: veth0 [ 174.268767][ T6407] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 174.268803][ T6407] batman_adv: batadv0: Interface activated: veth0 [ 174.279241][ T9] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 174.279303][ T9] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 174.371009][ T6409] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 174.371035][ T6409] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 174.500517][ T9] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 174.582289][ T6409] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 174.582320][ T6409] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 174.640445][ T9] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 174.678750][ T9] usb 5-1: USB disconnect, device number 3 [ 174.705257][ T6409] batman_adv: batadv0: Interface deactivated: veth0 [ 174.705290][ T6409] batman_adv: batadv0: Removing interface: veth0 [ 175.074932][ T6417] comedi comedi3: comedi_config --init_data is deprecated [ 175.631370][ T5707] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 175.812536][ T5707] usb 1-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice= 1.00 [ 175.821117][ T5707] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.826403][ T5707] usb 1-1: Product: syz [ 175.826475][ T5707] usb 1-1: Manufacturer: syz [ 175.826550][ T5707] usb 1-1: SerialNumber: syz [ 176.256404][ T6416] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.257088][ T6416] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.137129][ T6435] netlink: 36 bytes leftover after parsing attributes in process `syz.3.195'. [ 177.627880][ T6437] FAULT_INJECTION: forcing a failure. [ 177.627880][ T6437] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 177.627916][ T6437] CPU: 1 UID: 0 PID: 6437 Comm: syz.2.196 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 177.627949][ T6437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 177.627960][ T6437] Call Trace: [ 177.627966][ T6437] [ 177.627973][ T6437] dump_stack_lvl+0xe8/0x150 [ 177.628003][ T6437] should_fail_ex+0x467/0x600 [ 177.628031][ T6437] _copy_from_user+0x2d/0xb0 [ 177.628049][ T6437] restore_altstack+0xae/0x4f0 [ 177.628075][ T6437] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 177.628098][ T6437] ? __pfx_restore_altstack+0x10/0x10 [ 177.628121][ T6437] ? rt_spin_unlock+0x157/0x200 [ 177.628142][ T6437] ? rt_spin_unlock+0x163/0x200 [ 177.628161][ T6437] __ia32_sys_rt_sigreturn+0x2bd/0x8c0 [ 177.628185][ T6437] ? __lock_acquire+0x683/0x2ce0 [ 177.628205][ T6437] ? __pfx___ia32_sys_rt_sigreturn+0x10/0x10 [ 177.628226][ T6437] ? signal_setup_done+0x22f/0x310 [ 177.628248][ T6437] ? arch_do_signal_or_restart+0x4f9/0x860 [ 177.628282][ T6437] ? __task_pid_nr_ns+0x28/0x470 [ 177.628312][ T6437] ? __task_pid_nr_ns+0x28/0x470 [ 177.628340][ T6437] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.628358][ T6437] do_syscall_64+0x174/0x580 [ 177.628383][ T6437] ? clear_bhb_loop+0x70/0xc0 [ 177.628404][ T6437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.628419][ T6437] RIP: 0033:0x7f235ac3f459 [ 177.628434][ T6437] Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25 [ 177.628446][ T6437] RSP: 002b:00007f2358ef5a80 EFLAGS: 00000202 ORIG_RAX: 000000000000000f [ 177.628463][ T6437] RAX: ffffffffffffffda RBX: 00007f235af25fa0 RCX: 00007f235ac3f459 [ 177.628475][ T6437] RDX: 00007f2358ef5a80 RSI: 00007f2358ef5bb0 RDI: 0000000000000021 [ 177.628485][ T6437] RBP: 00007f2358ef6090 R08: 0000000000000006 R09: 0000000000000000 [ 177.628495][ T6437] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 [ 177.628504][ T6437] R13: 00007f235af26038 R14: 00007f235af25fa0 R15: 00007fff78370638 [ 177.628527][ T6437] [ 178.806808][ T6447] 9p: Bad value for 'wfdno' [ 179.448385][ T5707] kalmia 1-1:1.0 (unnamed net_device) (uninitialized): Error sending init packet. Status -71 [ 179.450175][ T5707] kalmia 1-1:1.0: probe with driver kalmia failed with error -71 [ 179.639693][ T5707] usb 1-1: USB disconnect, device number 11 [ 180.318719][ T5707] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 180.504430][ T5707] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 180.505627][ T5707] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 180.505660][ T5707] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.558005][ T6458] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 180.671840][ T5707] usb 4-1: config 0 descriptor?? [ 180.818591][ T5707] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 180.995747][ T5814] usb 4-1: USB disconnect, device number 8 [ 181.176776][ T6461] Zero length message leads to an empty skb [ 181.511513][ T5814] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 181.701333][ T5814] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 181.709751][ T5814] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 181.709806][ T5814] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.782781][ T5814] usb 4-1: config 0 descriptor?? [ 181.889600][ T5814] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 181.907681][ T6482] netlink: 36 bytes leftover after parsing attributes in process `syz.0.210'. [ 182.020707][ T5715] usb 4-1: USB disconnect, device number 9 [ 182.577546][ T6489] jffs2: notice: (6489) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 182.631369][ T5592] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 182.782980][ T5592] usb 5-1: Using ep0 maxpacket: 32 [ 182.784112][ T5592] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 182.832494][ T5592] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 182.832517][ T5592] usb 5-1: config 0 has no interface number 0 [ 182.832549][ T5592] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 182.832569][ T5592] usb 5-1: config 0 interface 85 has no altsetting 0 [ 182.836057][ T5592] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.836086][ T5592] usb 5-1: Product: syz [ 182.836102][ T5592] usb 5-1: Manufacturer: syz [ 182.836117][ T5592] usb 5-1: SerialNumber: syz [ 182.925347][ T5592] usb 5-1: config 0 descriptor?? [ 183.284146][ T5600] Bluetooth: hci3: link tx timeout [ 183.284359][ T5600] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 183.304558][ T5600] Bluetooth: hci3: link tx timeout [ 183.304590][ T5600] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 183.800055][ T5592] appletouch 5-1:0.85: Geyser mode initialized. [ 184.090662][ T5592] input: appletouch as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.85/input/input8 [ 184.124884][ T5600] Bluetooth: hci1: Malformed Event: 0x13 [ 184.206352][ T6506] netlink: 28 bytes leftover after parsing attributes in process `syz.0.215'. [ 184.912886][ C1] appletouch 5-1:0.85: appletouch: OVERFLOW with data length 64, actual length is 64 [ 185.353565][ T5600] Bluetooth: hci3: command 0x2016 tx timeout [ 185.394626][ T5592] usb 5-1: USB disconnect, device number 4 [ 185.477644][ C0] appletouch 5-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 185.479672][ T6521] FAULT_INJECTION: forcing a failure. [ 185.479672][ T6521] name failslab, interval 1, probability 0, space 0, times 0 [ 185.479708][ T6521] CPU: 0 UID: 0 PID: 6521 Comm: syz.2.222 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 185.479733][ T6521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 185.479747][ T6521] Call Trace: [ 185.479755][ T6521] [ 185.479764][ T6521] dump_stack_lvl+0xe8/0x150 [ 185.479805][ T6521] should_fail_ex+0x467/0x600 [ 185.479844][ T6521] should_failslab+0xa8/0x100 [ 185.479872][ T6521] __kmalloc_cache_noprof+0xa0/0x6b0 [ 185.479897][ T6521] ? __netlink_diag_dump+0x167/0x640 [ 185.479924][ T6521] ? __netlink_diag_dump+0x167/0x640 [ 185.479954][ T6521] __netlink_diag_dump+0x167/0x640 [ 185.479986][ T6521] netlink_diag_dump+0xef/0x230 [ 185.480012][ T6521] netlink_dump+0x711/0xee0 [ 185.480038][ T6521] ? __netlink_lookup+0xc6/0x8b0 [ 185.480079][ T6521] ? __pfx_netlink_dump+0x10/0x10 [ 185.480119][ T6521] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 185.480162][ T6521] __netlink_dump_start+0x589/0x7b0 [ 185.480207][ T6521] netlink_diag_handler_dump+0x19e/0x240 [ 185.480229][ T6521] ? sock_diag_lock_handler+0x19/0x290 [ 185.480268][ T6521] ? __pfx_netlink_diag_handler_dump+0x10/0x10 [ 185.480308][ T6521] ? __pfx_netlink_diag_dump+0x10/0x10 [ 185.480328][ T6521] ? __pfx_netlink_diag_dump_done+0x10/0x10 [ 185.480354][ T6521] ? sock_diag_lock_handler+0x19/0x290 [ 185.480390][ T6521] ? sock_diag_lock_handler+0x19/0x290 [ 185.480432][ T6521] sock_diag_rcv_msg+0x4b0/0x5f0 [ 185.480472][ T6521] netlink_rcv_skb+0x226/0x4a0 [ 185.480502][ T6521] ? __pfx_sock_diag_rcv_msg+0x10/0x10 [ 185.480538][ T6521] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 185.480578][ T6521] ? netlink_deliver_tap+0x2e/0x1b0 [ 185.480606][ T6521] ? netlink_deliver_tap+0x2e/0x1b0 [ 185.480640][ T6521] netlink_unicast+0x7f5/0x990 [ 185.480678][ T6521] netlink_sendmsg+0x813/0xb40 [ 185.480715][ T6521] ? __pfx_netlink_sendmsg+0x10/0x10 [ 185.480747][ T6521] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 185.480778][ T6521] ? __kernel_text_address+0xd/0x30 [ 185.480820][ T6521] ? unwind_get_return_address+0x4d/0x90 [ 185.480847][ T6521] ? __pfx_netlink_sendmsg+0x10/0x10 [ 185.480875][ T6521] sock_sendmsg_nosec+0x13a/0x180 [ 185.480914][ T6521] sock_write_iter+0x2e4/0x3f0 [ 185.480947][ T6521] ? __pfx_sock_write_iter+0x10/0x10 [ 185.480998][ T6521] do_iter_readv_writev+0x624/0x8d0 [ 185.481030][ T6521] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 185.481065][ T6521] ? bpf_lsm_file_permission+0x9/0x20 [ 185.481097][ T6521] ? security_file_permission+0x75/0x260 [ 185.481120][ T6521] ? rw_verify_area+0x209/0x4d0 [ 185.481149][ T6521] vfs_writev+0x34c/0x990 [ 185.481193][ T6521] ? do_raw_spin_lock+0x12b/0x2f0 [ 185.481228][ T6521] ? __pfx_vfs_writev+0x10/0x10 [ 185.481278][ T6521] ? __fget_files+0x2a/0x420 [ 185.481306][ T6521] ? __fget_files+0x3a8/0x420 [ 185.481327][ T6521] ? __fget_files+0x2a/0x420 [ 185.481358][ T6521] do_writev+0x15a/0x2e0 [ 185.481396][ T6521] ? __pfx_do_writev+0x10/0x10 [ 185.481438][ T6521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.481463][ T6521] do_syscall_64+0x174/0x580 [ 185.481494][ T6521] ? trace_irq_disable+0x3b/0x140 [ 185.481532][ T6521] ? clear_bhb_loop+0x70/0xc0 [ 185.481558][ T6521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.481580][ T6521] RIP: 0033:0x7f235ac9e0d9 [ 185.481601][ T6521] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 185.481620][ T6521] RSP: 002b:00007f2358ef6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 185.481643][ T6521] RAX: ffffffffffffffda RBX: 00007f235af25fa0 RCX: 00007f235ac9e0d9 [ 185.481659][ T6521] RDX: 0000000000000001 RSI: 0000200000000100 RDI: 0000000000000006 [ 185.481672][ T6521] RBP: 00007f2358ef6090 R08: 0000000000000000 R09: 0000000000000000 [ 185.481685][ T6521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 185.481699][ T6521] R13: 00007f235af26038 R14: 00007f235af25fa0 R15: 00007fff78370638 [ 185.481734][ T6521] [ 185.527213][ T6522] netlink: 36 bytes leftover after parsing attributes in process `syz.1.223'. [ 186.589366][ T6533] netlink: 'syz.3.224': attribute type 5 has an invalid length. [ 186.589390][ T6533] netlink: 156 bytes leftover after parsing attributes in process `syz.3.224'. [ 186.658702][ T5778] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 186.791759][ T9] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 186.836022][ T5778] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 186.840425][ T5778] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 186.840476][ T5778] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.954949][ T9] usb 1-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 186.984766][ T9] usb 1-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 186.984795][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 186.984812][ T9] usb 1-1: config 0 has no interfaces? [ 186.984842][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.085370][ T5778] usb 2-1: config 0 descriptor?? [ 187.099798][ T9] usb 1-1: config 0 descriptor?? [ 187.137840][ T6540] tipc: Started in network mode [ 187.137877][ T6540] tipc: Node identity aaaaaaaaaa2a, cluster identity 4711 [ 187.275010][ T5592] appletouch 5-1:0.85: input: appletouch disconnected [ 187.312298][ T5814] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 187.383356][ T5778] usbhid 2-1:0.0: can't add hid device: -71 [ 187.383465][ T5778] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 187.394909][ T6540] tipc: Enabled bearer , priority 10 [ 187.431820][ T36] kauditd_printk_skb: 133 callbacks suppressed [ 187.433430][ T36] audit: type=1326 audit(1786289744.161:469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6531 comm="syz.0.227" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3303c8e0d9 code=0x7ffc0000 [ 187.433519][ T36] audit: type=1326 audit(1786289744.161:470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6531 comm="syz.0.227" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3303c8e0d9 code=0x7ffc0000 [ 187.433555][ T36] audit: type=1326 audit(1786289744.161:471): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6531 comm="syz.0.227" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3303c8e0d9 code=0x7ffc0000 [ 187.438499][ T36] audit: type=1326 audit(1786289744.171:472): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6531 comm="syz.0.227" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=82 compat=0 ip=0x7f3303c8e0d9 code=0x7ffc0000 [ 187.492515][ T5778] usb 2-1: USB disconnect, device number 4 [ 187.512229][ T5814] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 187.522251][ T36] audit: type=1326 audit(1786289744.251:473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6531 comm="syz.0.227" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3303c8e0d9 code=0x7ffc0000 [ 187.522366][ T36] audit: type=1326 audit(1786289744.251:474): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6531 comm="syz.0.227" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f3303c8de42 code=0x7ffc0000 [ 187.522435][ T36] audit: type=1326 audit(1786289744.251:475): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6531 comm="syz.0.227" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f3303c8ded7 code=0x7ffc0000 [ 187.551333][ T36] audit: type=1326 audit(1786289744.281:477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6531 comm="syz.0.227" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f3303c4add1 code=0x7ffc0000 [ 187.551464][ T36] audit: type=1326 audit(1786289744.281:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6531 comm="syz.0.227" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f3303c8eec9 code=0x7ffc0000 [ 187.558190][ T36] audit: type=1326 audit(1786289744.271:476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6531 comm="syz.0.227" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3303c8e0d9 code=0x7ffc0000 [ 187.558282][ T5814] usb 3-1: config 1 interface 0 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 187.558312][ T5814] usb 3-1: config 1 interface 0 has no altsetting 0 [ 187.703578][ T5814] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.703612][ T5814] usb 3-1: Product: syz [ 187.703628][ T5814] usb 3-1: Manufacturer: syz [ 187.703643][ T5814] usb 3-1: SerialNumber: syz [ 188.441300][ T5778] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 188.502298][ T5814] usb 3-1: USB disconnect, device number 5 [ 188.532674][ T5592] tipc: Node number set to 8432298 [ 188.615585][ T5778] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 188.636945][ T5778] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 188.637048][ T5778] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 188.703380][ T5778] usb 2-1: config 0 descriptor?? [ 188.767113][ T6552] netlink: 8 bytes leftover after parsing attributes in process `syz.3.233'. [ 189.260300][ T6558] netlink: 36 bytes leftover after parsing attributes in process `syz.3.235'. [ 189.549183][ T5778] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 189.592931][ T5778] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input9 [ 189.683305][ T6562] overlayfs: conflicting options: userxattr,metacopy=on [ 189.832368][ T5603] usb 1-1: USB disconnect, device number 12 [ 190.932529][ T5778] usb 2-1: USB disconnect, device number 5 [ 190.932625][ C0] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 192.484531][ T6596] random: crng reseeded on system resumption [ 192.585088][ T6598] FAULT_INJECTION: forcing a failure. [ 192.585088][ T6598] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 192.585116][ T6598] CPU: 1 UID: 0 PID: 6598 Comm: syz.4.246 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 192.585134][ T6598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 192.585143][ T6598] Call Trace: [ 192.585148][ T6598] [ 192.585155][ T6598] dump_stack_lvl+0xe8/0x150 [ 192.585182][ T6598] should_fail_ex+0x467/0x600 [ 192.585209][ T6598] _copy_from_user+0x2d/0xb0 [ 192.585227][ T6598] ___sys_recvmsg+0x173/0x5a0 [ 192.585256][ T6598] ? __pfx____sys_recvmsg+0x10/0x10 [ 192.585279][ T6598] ? __fget_files+0x2a/0x420 [ 192.585307][ T6598] ? __fget_files+0x3a8/0x420 [ 192.585330][ T6598] __x64_sys_recvmsg+0x1b4/0x290 [ 192.585352][ T6598] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 192.585385][ T6598] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.585403][ T6598] do_syscall_64+0x174/0x580 [ 192.585425][ T6598] ? trace_irq_disable+0x3b/0x140 [ 192.585450][ T6598] ? clear_bhb_loop+0x70/0xc0 [ 192.585470][ T6598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.585485][ T6598] RIP: 0033:0x7f401552e0d9 [ 192.585499][ T6598] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 192.585512][ T6598] RSP: 002b:00007f4013786028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 192.585528][ T6598] RAX: ffffffffffffffda RBX: 00007f40157b5fa0 RCX: 00007f401552e0d9 [ 192.585546][ T6598] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 192.585556][ T6598] RBP: 00007f4013786090 R08: 0000000000000000 R09: 0000000000000000 [ 192.585565][ T6598] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 192.585574][ T6598] R13: 00007f40157b6038 R14: 00007f40157b5fa0 R15: 00007ffc6dd376d8 [ 192.585598][ T6598] [ 192.691323][ T5778] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 192.871936][ T5778] usb 2-1: Using ep0 maxpacket: 8 [ 193.090980][ T6604] netlink: 36 bytes leftover after parsing attributes in process `syz.4.247'. [ 193.207788][ T6590] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 193.220444][ T6590] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 193.824449][ T5778] usb 2-1: unable to get BOS descriptor or descriptor too short [ 193.824509][ T5778] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0a1a, bcdDevice= 0.00 [ 193.826541][ T5778] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 193.826569][ T5778] usb 2-1: can't read configurations, error -71 [ 193.911769][ T6615] FAULT_INJECTION: forcing a failure. [ 193.911769][ T6615] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 193.911804][ T6615] CPU: 1 UID: 0 PID: 6615 Comm: syz.3.251 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 193.911828][ T6615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 193.911842][ T6615] Call Trace: [ 193.911850][ T6615] [ 193.911859][ T6615] dump_stack_lvl+0xe8/0x150 [ 193.911895][ T6615] should_fail_ex+0x467/0x600 [ 193.911931][ T6615] _copy_to_user+0x31/0xb0 [ 193.911958][ T6615] bpf_verifier_vlog+0x496/0x900 [ 193.912000][ T6615] __btf_verifier_log+0xe2/0x140 [ 193.912039][ T6615] ? __pfx___btf_verifier_log+0x10/0x10 [ 193.912079][ T6615] ? __might_fault+0xaf/0x130 [ 193.912109][ T6615] ? btf_parse_hdr+0x1da/0x810 [ 193.912139][ T6615] btf_parse_hdr+0x2ea/0x810 [ 193.912168][ T6615] btf_new_fd+0x32f/0xc10 [ 193.912203][ T6615] __sys_bpf+0xd2e/0xd90 [ 193.912233][ T6615] ? __pfx___sys_bpf+0x10/0x10 [ 193.912258][ T6615] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 193.912297][ T6615] ? rt_mutex_slowunlock+0x219/0x460 [ 193.912347][ T6615] ? ksys_write+0x248/0x270 [ 193.912376][ T6615] ? __pfx_ksys_write+0x10/0x10 [ 193.912409][ T6615] __x64_sys_bpf+0xba/0xd0 [ 193.912443][ T6615] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.912468][ T6615] do_syscall_64+0x174/0x580 [ 193.912500][ T6615] ? trace_irq_disable+0x3b/0x140 [ 193.912535][ T6615] ? clear_bhb_loop+0x70/0xc0 [ 193.912564][ T6615] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.912588][ T6615] RIP: 0033:0x7fdf3130e0d9 [ 193.912609][ T6615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 193.912627][ T6615] RSP: 002b:00007fdf2f566028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 193.912651][ T6615] RAX: ffffffffffffffda RBX: 00007fdf31595fa0 RCX: 00007fdf3130e0d9 [ 193.912667][ T6615] RDX: 0000000000000020 RSI: 0000200000000080 RDI: 0000000000000012 [ 193.912681][ T6615] RBP: 00007fdf2f566090 R08: 0000000000000000 R09: 0000000000000000 [ 193.912695][ T6615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 193.912707][ T6615] R13: 00007fdf31596038 R14: 00007fdf31595fa0 R15: 00007ffcbf74e228 [ 193.912741][ T6615] [ 194.393565][ T1327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 194.431869][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.431943][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.565836][ T6621] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 194.878171][ T6619] capability: warning: `syz.2.252' uses 32-bit capabilities (legacy support in use) [ 195.202493][ T6624] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 195.517789][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 195.632543][ T5715] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 195.803677][ T5715] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 195.805547][ T5715] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 195.805579][ T5715] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 195.805608][ T5715] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 195.866953][ T5715] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.866980][ T5715] usb 3-1: Product: syz [ 195.866994][ T5715] usb 3-1: Manufacturer: syz [ 195.867008][ T5715] usb 3-1: SerialNumber: syz [ 195.941086][ T5715] usb 3-1: config 0 descriptor?? [ 195.959446][ T5715] streamzap 3-1:0.0: streamzap_probe: endpoint Max Packet Size is 0!?! [ 196.281348][ T5814] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 196.281680][ T5595] usb 3-1: USB disconnect, device number 6 [ 196.462954][ T5814] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 196.464460][ T5814] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 196.464487][ T5814] usb 2-1: config 1 interface 1 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 196.464527][ T5814] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.586573][ T5814] cdc_acm 2-1:1.0: probe with driver cdc_acm failed with error -12 [ 196.949522][ T5778] usb 2-1: USB disconnect, device number 8 [ 197.592823][ T6650] netlink: 36 bytes leftover after parsing attributes in process `syz.4.260'. [ 200.084861][ T197] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 200.252866][ T197] usb 1-1: Using ep0 maxpacket: 32 [ 200.253788][ T197] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 200.255252][ T197] usb 1-1: config 0 has an invalid interface number: 85 but max is 0 [ 200.255277][ T197] usb 1-1: config 0 has no interface number 0 [ 200.255323][ T197] usb 1-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 200.255351][ T197] usb 1-1: config 0 interface 85 has no altsetting 0 [ 200.258160][ T197] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.258183][ T197] usb 1-1: Product: syz [ 200.258197][ T197] usb 1-1: Manufacturer: syz [ 200.258211][ T197] usb 1-1: SerialNumber: syz [ 200.344364][ T197] usb 1-1: config 0 descriptor?? [ 200.430402][ T5602] =========[ 200.430402][ T5602] ================================================================== [ 200.430416][ T5602] BUG: KASAN: vmalloc-out-of-bounds in __list_del_entry_valid_or_report+0xb5/0x190 [ 200.430454][ T5602] Read of size 8 at addr ffffc9000edc9008 by task kworker/u9:7/5602 [ 200.430469][ T5602] [ 200.430479][ T5602] CPU: 1 UID: 0 PID: 5602 Comm: kworker/u9:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 200.430499][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 200.430510][ T5602] Workqueue: hci3 hci_rx_work [ 200.430537][ T5602] Call Trace: [ 200.430544][ T5602] [ 200.430551][ T5602] dump_stack_lvl+0xe8/0x150 [ 200.430578][ T5602] print_address_description+0x55/0x1e0 [ 200.430605][ T5602] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 200.430634][ T5602] print_report+0x58/0x70 [ 200.430657][ T5602] kasan_report+0x117/0x150 [ 200.430678][ T5602] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 200.430712][ T5602] __list_del_entry_valid_or_report+0xb5/0x190 [ 200.430744][ T5602] kcov_remote_start+0x295/0x6f0 [ 200.430770][ T5602] hci_rx_work+0x10f/0x1020 [ 200.430796][ T5602] ? process_scheduled_works+0xa20/0x14e0 [ 200.430815][ T5602] process_scheduled_works+0xa8e/0x14e0 [ 200.430845][ T5602] ? __pfx_process_scheduled_works+0x10/0x10 [ 200.430866][ T5602] ? assign_work+0x3cf/0x5d0 [ 200.430886][ T5602] worker_thread+0xa47/0xfb0 [ 200.430918][ T5602] kthread+0x388/0x470 [ 200.430945][ T5602] ? __pfx_worker_thread+0x10/0x10 [ 200.430969][ T5602] ? __pfx_kthread+0x10/0x10 [ 200.431001][ T5602] ret_from_fork+0x514/0xb70 [ 200.431035][ T5602] ? __pfx_ret_from_fork+0x10/0x10 [ 200.431066][ T5602] ? __switch_to+0xc89/0x1420 [ 200.431102][ T5602] ? __pfx_kthread+0x10/0x10 [ 200.431135][ T5602] ret_from_fork_asm+0x1a/0x30 [ 200.431174][ T5602] [ 200.431182][ T5602] [ 200.431188][ T5602] The buggy address belongs to a vmalloc virtual mapping [ 200.431206][ T5602] Memory state around the buggy address: [ 200.431218][ T5602] ffffc9000edc8f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 200.431233][ T5602] ffffc9000edc8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 200.431247][ T5602] >ffffc9000edc9000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 200.431257][ T5602] ^ [ 200.431267][ T5602] ffffc9000edc9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 200.431281][ T5602] ffffc9000edc9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 200.431292][ T5602] ================================================================== [ 200.432401][ T5602] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 200.432421][ T5602] CPU: 1 UID: 0 PID: 5602 Comm: kworker/u9:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 200.432492][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 200.432525][ T5602] Workqueue: hci3 hci_rx_work [ 200.432556][ T5602] Call Trace: [ 200.432564][ T5602] [ 200.432573][ T5602] vpanic+0x56c/0xa60 [ 200.432652][ T5602] ? __pfx_vpanic+0x10/0x10 [ 200.432712][ T5602] ? __pfx___schedule+0x10/0x10 [ 200.432745][ T5602] panic+0xc5/0xd0 [ 200.432822][ T5602] ? __pfx_panic+0x10/0x10 [ 200.432878][ T5602] ? preempt_schedule_common+0x82/0xd0 [ 200.432918][ T5602] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 200.433010][ T5602] check_panic_on_warn+0x89/0xb0 [ 200.433044][ T5602] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 200.433114][ T5602] end_report+0x73/0x170 [ 200.433178][ T5602] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 200.433211][ T5602] kasan_report+0x128/0x150 [ 200.433243][ T5602] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 200.433344][ T5602] __list_del_entry_valid_or_report+0xb5/0x190 [ 200.433382][ T5602] kcov_remote_start+0x295/0x6f0 [ 200.433442][ T5602] hci_rx_work+0x10f/0x1020 [ 200.433495][ T5602] ? process_scheduled_works+0xa20/0x14e0 [ 200.433527][ T5602] process_scheduled_works+0xa8e/0x14e0 [ 200.433574][ T5602] ? __pfx_process_scheduled_works+0x10/0x10 [ 200.433655][ T5602] ? assign_work+0x3cf/0x5d0 [ 200.433694][ T5602] worker_thread+0xa47/0xfb0 [ 200.433741][ T5602] kthread+0x388/0x470 [ 200.433815][ T5602] ? __pfx_worker_thread+0x10/0x10 [ 200.433858][ T5602] ? __pfx_kthread+0x10/0x10 [ 200.433891][ T5602] ret_from_fork+0x514/0xb70 [ 200.433963][ T5602] ? __pfx_ret_from_fork+0x10/0x10 [ 200.434025][ T5602] ? __switch_to+0xc89/0x1420 [ 200.434054][ T5602] ? __pfx_kthread+0x10/0x10 [ 200.434120][ T5602] ret_from_fork_asm+0x1a/0x30 [ 200.434200][ T5602] [ 200.434794][ T5602] Kernel Offset: disabled