last executing test programs: 41.117145582s ago: executing program 4 (id=65): r0 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$inet6(r0, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x20}}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="24000000000000002900d8ff32"], 0x28}}], 0x1, 0x0) 40.972870207s ago: executing program 4 (id=67): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYRES64=r0, @ANYRES32, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffffbfa300000000000007030000f0ffffffb7040000e0ff00008500000002000000b70000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000080)='hugetlb.1GB.rsvd.limit_in_bytes\x00', 0x2, 0x0) writev(r2, &(0x7f0000000400)=[{&(0x7f0000000200)='KO', 0x2}], 0x1) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) r3 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0x2) write(0xffffffffffffffff, &(0x7f0000001000)="4f4f4f4fffffffff00000001", 0xc) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000040)={0x1, 0xb, 0x4}) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000080)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000340)=@userptr={0x0, 0x2, 0x4, 0x4000, 0x0, {0x77359400}, {0x5, 0x0, 0x0, 0x7}, 0x0, 0x2, {&(0x7f0000401000)}, 0x400001}) ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f00000001c0)=0x2) ioctl$VIDIOC_STREAMON(r3, 0x40045612, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000940)=ANY=[@ANYBLOB="400f01"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f00000013c0)={0x1c, &(0x7f0000000040)=ANY=[@ANYBLOB="401923b61623000070"], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000b40)={0x34, &(0x7f0000000700)={0x20, 0x16, 0x4, "d5885475"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 39.906718689s ago: executing program 2 (id=76): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489c", 0x25}], 0x1}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000ffff25bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB], 0x68}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000002) accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x6, 0x9, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r6, 0x10e, 0xc, &(0x7f0000000000)=0x201, 0x4) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="500000000a0601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e220000060005"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) 39.333535358s ago: executing program 4 (id=77): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140020001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000020000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a300000000028000480240001"], 0xc4}}, 0x0) 39.264796595s ago: executing program 4 (id=78): syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xfffffdfc}]) (fail_nth: 30) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r3 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x7a32, 0xc000, 0x7, 0x337}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x10, 0x3}}}, 0x24}}, 0x0) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) 38.792367621s ago: executing program 4 (id=79): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0xd}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xdc}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMKSA(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000780)={0x1c, r2, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x22044804) 38.577256434s ago: executing program 0 (id=81): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x100, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000001340)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000010000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c0012d5bfd0a97d2992a63b907f0848896522779c9762"]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) r3 = fsopen(&(0x7f0000000080)='ext3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000280)='auto_da_alloc', &(0x7f00000002c0)='8\x00', 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x22, &(0x7f00000001c0)=0x1, 0x4) sendmmsg$inet(r2, &(0x7f0000000100)=[{{&(0x7f0000000140)={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000040)='o', 0x1}], 0x1}}], 0x1, 0x20000057) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f00000005c0)=ANY=[@ANYBLOB="000000000000000002004e21e000000200000000000000000000003a4d5e730bec245000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008d58000000000000000000000000000000000000000000000000000000000000000000000000000600000002004e230000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24ac1e010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000054651693ff2e1f8a7a9100000000000000000000000000000000000000000000000000000000000002004e247f0000010000000000000000000000ef41090949811e865cc62f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21e00000010000000000000000007278b9f1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21ac1414bb0000000000000000000000000000000000000000000000000000000000f3ffffff0000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b367245002004e20ac14142100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005361f8985f002ae6138c701867409fee960744520aaa5fb1e084a50dfb3b0aec63222cf7f848fae30c69dbee691d2d349c4a649972ac4395b8862ae7c95ec6ccb95d62ffc5"], 0x390) 38.55222686s ago: executing program 2 (id=82): r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, 0x0, 0x0) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_io_uring_setup(0x4b6, &(0x7f0000000100)={0x0, 0x0, 0x400, 0x0, 0x20e}, &(0x7f0000ff0000), &(0x7f0000000000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000018c0)=[{0x0}, {0x0}], 0x2) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x10b85}, [@IFLA_IFNAME={0x14, 0x3, 'vlan1\x00'}, @IFLA_MTU={0x8, 0x4, 0x600}]}, 0x3c}, 0x1, 0x0, 0x0, 0x90}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340)}], 0x0, 0x2}, 0x20) r6 = socket(0x10, 0x803, 0x0) bind$netlink(r6, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) sendmsg$nl_route(r3, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000024d40)=ANY=[@ANYBLOB="4400000010000d042abd7000077bf7000000", @ANYRES32, @ANYBLOB="01000000000000002400128009000100626f6e", @ANYRES32=r2], 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r7 = syz_open_dev$video4linux(&(0x7f0000000040), 0x3, 0x101000) ioctl$VIDIOC_LOG_STATUS(r7, 0x5646, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) ioctl$BTRFS_IOC_BALANCE_CTL(r5, 0x40049421, 0x1) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000e00)=ANY=[@ANYBLOB="44000000100001042abd70000000000000000000", @ANYRES32=r2, @ANYBLOB="0028000000000000140012800c0001006d6163766c616e00", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r9], 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) 38.287886646s ago: executing program 2 (id=84): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) r1 = socket$inet(0x2, 0x3, 0x5) setsockopt$MRT_FLUSH(r1, 0x0, 0xd4, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000004800000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e0a01010000000000000000020000000900020073797a31000000000900010073797a30000000001800038014000080100001800c0001"], 0xf0}}, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) ioctl$KVM_IRQ_LINE_STATUS(0xffffffffffffffff, 0xc008ae67, &(0x7f0000000000)={0x4, 0x8}) writev(r0, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000000580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000000500)}, {&(0x7f00000014c0)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a0858fe5c7e75ecf92e735452456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9180517be0daca5deb10773f93e2c61a5fe9b823218a97c35d0d7b436b2e1afb670b5a4c6dacd401afd1832c1dd96e8eba7734954070c6796cc80707441404cfe95fabf214bf03a6e4643ca559c2b8dcf1fa871114f3dc973a056c9aee7cd0ed4cbaf18298377e750869551632c1713bd8372e3f11fa02edf0a68d2c01245459d9e78597ac1eec75064024c1f3c98260d34b611ba8fa4b2022babd44b76ea70c718df8268dba447038b1539f0499603cf2d79bcc49c35a8cf38892d982d153d72253a22ae68da65e84d6399e81a14ebf89ba446630814d9dcf8914acafc8603a5396167c5aa99814af62c1c39a6ba76ad2c6c51a6d56d89fbda5334e626540ef1b1ecad53247531fcdd661a48d28a6d48bac8ef70c888b00db57edceee94425df5161e1b1a1bec9c897e01867442ed8ba000b5f75832a8ec57ef0737994b95f40eac48f3c8da5db80e965fcdf3f0bbb4439a7123b59987f0fdac96bc7ce09c013562ff7c0cb23a882828e45a51f7e748db90c5eaacfdf3657d11a348f747ddd860387de41be3376a5dabf4296bc05282cb73fcd60c4a4148d9e872ae86e30b22db1ce5452ad9fe3fea029f94a583d301e74eac1818da3f1279c63690db6e7166ddaacd1278716fa3221daaa27c98fd97b88e63208d604505ad8f31bd2b83a19f89480b71198d8a31c89cadd258ce338afe1a26b0db248c1a39fe027716e417e45bb6c9a68cab1cd6c3445e9796ee1003650e97eccdadc9bea540e2c8253652c8f1586ba7e508cd29d53467bad11eef729796dbe83d3fc0bc15762c2f1de34c6380a6725f94600a82d87ccf80948babcadec31ca654671d17de360f20aaf04f4d44951661fe8fe7731174ec3", 0xdb6}], 0x5) syz_usb_connect$uac3(0x0, 0x107, &(0x7f0000000640)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x582, 0x582, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xf5, 0x3, 0x1, 0xf7, 0x10, 0x3, {0x8, 0xb, 0x2, 0x2, 0x1, 0x21, 0x30, 0xc1}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x6, 0x1d, 0xfffffffc}, [@output_terminal={0x13, 0x24, 0x3, 0x4, 0x1ff, 0x1, 0x3, 0x43, 0x8000, 0xb, 0x3, 0x7}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x16, 0x3, 0xb, 0x9, "17", "2fd2ce"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x9, 0x2c, 0x2, 0xe9, 0x6}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x7, 0x3, 0x6, 0x93}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x8, 0x4, 0x4, 0xe}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x5, 0xd, 0x8, {0xa, 0x25, 0x25, 0xfff, 0x7c, 0x3ff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x1, 0x80, 0xc, "", "aae7"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x2, 0xb, 0xa2, "0a603ba664961276"}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x3, 0x1, 0x8, 0x70, ',', "d7686d"}, @as_header={0x17, 0x24, 0x1, 0x8, 0x7f, 0x3, 0x3, 0x0, 0x7, 0x30, 0x40}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x2, 0xf9, 0x7f, 0x3, 0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0xe, 0x5, 0x7, {0xa, 0x25, 0x25, 0x9, 0x2, 0x3}}}}}}}}]}}, &(0x7f0000000c40)={0xa, &(0x7f0000000780)={0xa, 0x6, 0x201, 0xd5, 0x2, 0x0, 0xff, 0x3}, 0x121, &(0x7f00000007c0)={0x5, 0xf, 0x121, 0x6, [@generic={0xed, 0x10, 0x1, "dff5f9d2c813334e7a189c9134d2d2193c5a78dbe1f86cd51aa8a11b4b05d787d3ea3f7ee6a3d762ebedb1d5534a3a337bb7b8246404a854f1abcc37f92719f05d6a944cdab1be11057db20a041dde06bd826a99e5d439226413bceb7ea3cdd1f5c20d412f72ab9971ad6d939079789a8a6c38c6de2752aebf9ac7afdb622011a82317419a80aa1e83875c498325503ab109d7ca64946d9fb47b5392b3ec3ca5fa01ed664ec86b3f6e8ad50cc7cc824cb077f39dd47bb9e9b7381137ae93378668dd3c6508b0cb5b0961e1e683dc7c62901ceba061a568640e9202da68125ac26ba37a40b74b8039e06a"}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "a91e494d6fa90ea4f4a4a4f5094de7eb"}, @ptm_cap={0x3}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0x2, 0xab, 0x5}, @wireless={0xb, 0x10, 0x1, 0x1170fb9dca3bcb36, 0xcc, 0x2, 0x8, 0x4, 0xc8}]}, 0x6, [{0x0, 0x0}, {0xf2, &(0x7f0000000a40)=@string={0xf2, 0x3, "af7d2845bfc932ad04cbb03bb2de191a61dfc9c32103911af47b06ebbfd3c42d4e18535e7bda3019a78d0e152bb664c29fe5f3b36f267341c49a13de0d2f38855c22c1b4b64ed963651b7835c67134aea880e3b42b4cc12d633326906a72de7515f5be633cc5dbcefa27f4a67be2c28db7f8fdacc726476a3c2404ecd21673a721bc0fffeef2826661df64364b551d11ca9a28411c913e747674449c1a9c0e1867ba5c30557e17fb3aa10fedeacca92da48a95f99a9772d73f15f1b15ccfcbee24b7d10ede36d9c0ddf8752024881123bd1fa5dbb76f779868188c8cd602c2c0f833257ad235e67fe08fcfe6c8680116"}}, {0x4, &(0x7f0000000b40)=@lang_id={0x4, 0x3, 0x100c}}, {0x31, &(0x7f0000000b80)=@string={0x31, 0x3, "22b398d986ecb07f9e44518021b7ade66b622ed95c598df2bdf77b7b98017d5d65f1a70c0e23770c412c51fffe74a7"}}, {0x4, &(0x7f0000000bc0)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f0000000c00)=@lang_id={0x4, 0x3, 0x240a}}]}) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 38.284450599s ago: executing program 0 (id=85): unshare(0x60000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000020000000000000800040001002000", 0x24) 37.801178444s ago: executing program 4 (id=87): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_usb_connect(0x2, 0x36, &(0x7f0000000480)=ANY=[@ANYRES64=r0], 0x0) syz_usb_control_io(r1, &(0x7f0000000a00)={0x2c, 0x0, &(0x7f0000000740)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "2fc91ea7", {0x1, 0x1, 0xfffc, 0x0, 0x1}}) r3 = syz_open_dev$loop(&(0x7f0000000140), 0x10, 0x200) r4 = syz_open_dev$loop(&(0x7f0000000080), 0x6, 0x4ad00) ioctl$BLKRAGET(r4, 0x1263, &(0x7f00000000c0)) ioctl$BLKRASET(r3, 0x1262, &(0x7f0000000000)=0xffffffff) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000140)={0x40, 0x17, 0x7, "09f08c13dd1058"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000900)={0x14, 0x1, 0x2, 0x5, 0x0, 0x0, {0xa, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x810}, 0x8000) ioctl$VIDIOC_G_FMT(r2, 0xc0d05604, &(0x7f0000000180)={0x4, @meta={0x4d503343, 0x5a03799a, 0x5719, 0xf253, 0x420cf19a}}) 37.526297002s ago: executing program 1 (id=89): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x76980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_RUN(r2, 0xae80, 0x0) mmap(&(0x7f000031c000/0x3000)=nil, 0x3000, 0x8, 0x11, 0xffffffffffffffff, 0xf5d76000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x10, 0xffffffffffffffff, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000005, 0x8031, r1, 0x3b552000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x88206100, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_linger(r6, 0x1, 0xd, &(0x7f0000000000)={0x1, 0x1}, 0x8) setsockopt$inet_int(r6, 0x0, 0x18, &(0x7f0000000040)=0x8003, 0x4) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r7, 0x84, 0x14, &(0x7f0000000040)="0100008000000000", 0x8) socket$inet(0x2, 0x800, 0x80000001) socket$inet_icmp_raw(0x2, 0x3, 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') preadv(r8, &(0x7f00000026c0)=[{&(0x7f0000000240)=""/4088, 0xff8}], 0x1, 0xea, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000002180)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYRES64=r3, @ANYRESHEX=r9, @ANYBLOB=',rootmode=00000000000000000010000,user_id=', @ANYRESDEC=0x0, @ANYRESHEX=r7, @ANYRESDEC=0x0, @ANYBLOB="ae0100"], 0x1, 0x0, 0x0) close_range(r0, r0, 0x0) ioctl$USBDEVFS_GET_CAPABILITIES(0xffffffffffffffff, 0x8004551a, &(0x7f0000000140)) r10 = openat$cgroup_procs(r5, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) unshare(0x2c020400) socket(0x1, 0x803, 0x0) write$cgroup_pid(r10, &(0x7f0000000040)=r4, 0x12) 37.353320478s ago: executing program 0 (id=90): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sg(0x0, 0x0, 0x8002) r1 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, 0x0) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="230000000700000002"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000006c0), &(0x7f00000006c0), 0xffffa7ef, r5}, 0x38) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) pread64(0xffffffffffffffff, &(0x7f0000000480)=""/96, 0x60, 0x7fff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={r2, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000200)=[0x0], &(0x7f0000000340), 0x0, 0xa3, &(0x7f0000000380)=[{}], 0x8, 0x10, &(0x7f0000000440), &(0x7f0000000480), 0x8, 0xdb, 0x8, 0x8, &(0x7f00000004c0)}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000700)='veno', 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0xc1485544, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r2, &(0x7f0000000240)="c9273f6a588e06d9965d342faebf43144af3ca89b935b6747f7184", 0x1b, 0x4044880, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0xffffffff) read$char_usb(r9, &(0x7f0000000000)=""/195, 0xc3) sendmsg$NL80211_CMD_SET_CHANNEL(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="010027bd7000fedbdf254100000008000300", @ANYRES32=r8, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x40) 37.291378066s ago: executing program 3 (id=91): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)={0x10, 0x12, 0x1}, 0x10}], 0x1, 0x0, 0x0, 0x24008800}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001480)=[{&(0x7f0000000780)=@in={0x2, 0x4e21, @rand_addr=0x64010100}, 0x10, &(0x7f00000008c0)=[{&(0x7f00000007c0)="18de4512421b", 0x6}], 0x1, &(0x7f0000000980)=[@dstaddrv4={0x18, 0x84, 0x7, @rand_addr=0x64010100}], 0x18, 0x4000}], 0x1, 0x20000006) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@getlink={0x28, 0x12, 0x1, 0x0, 0x0, {}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x3ff}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 37.1177367s ago: executing program 1 (id=92): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489c", 0x25}], 0x1}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000ffff25bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB], 0x68}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000002) accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x6, 0x9, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="500000000a0601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e220000060005"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) 37.017335906s ago: executing program 3 (id=93): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020200000d0000000000000000000003030006000000000002000000ac1414bb000000000000000002000100000000000000001600000000030005000000000002000000ac1414aa000000000000000001001500000000000100140000000000010016"], 0x68}, 0x1, 0x7}, 0x0) 36.945476966s ago: executing program 2 (id=94): r0 = open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1000) ioctl$XFS_IOC_ERROR_CLEARALL(r0, 0x40085875) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvfrom(r1, &(0x7f00000004c0)=""/175, 0xaf, 0xc0012000, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(r2, 0x10f, 0x88) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x8, 0x9, 0x10000007}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000240)={0x1, 0x6576, 0x9}) close_range(r3, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$rds(0x15, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r4 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0x1000, 0x7, 0x20002f9}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x100002}, 0x50) r5 = socket$inet(0x2, 0x6, 0x5) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000800)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="14000000"], 0x18}}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r6, 0x8982, &(0x7f0000000040)={0x0, 'gre0\x00', {0x2}, 0x5}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) userfaultfd(0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f00000e6000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) 36.80411989s ago: executing program 3 (id=95): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r0}, 0x94) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x24, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0xb}}}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x81151c099a4f3d41) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = memfd_create(&(0x7f00000006c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xact\xf4\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xfbF\x99V4\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xe8\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`\x01Os\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x8f\x13\xda\x95\xec\"\x95\xc5B\x9dE\xe1\xd0_b\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W\x06|\x1c\x80\xbc\x840x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x2c, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}, @NL80211_ATTR_4ADDR={0x5}]}, 0x2c}}, 0x48040) 36.494284243s ago: executing program 1 (id=96): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000004c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c00000010000100297000fadbdf250000000000", @ANYRES32=r1, @ANYBLOB="1380000023b205003c00128009000100626f6e64000000002c0002800800070081"], 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0xc094) (fail_nth: 1) 36.434233477s ago: executing program 0 (id=97): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x1, &(0x7f0000000900)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x3}], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa00}, 0x94) 36.36336686s ago: executing program 2 (id=98): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x4001, 0x3, 0x2b8, 0x128, 0x700001b, 0x148, 0x128, 0x148, 0x220, 0x206, 0x240, 0x220, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x1ea, 0xc8, 0x158, 0x0, {0x390, 0x8f00}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@unspec=@cluster={{0x30}, {0x9, 0xa, 0x7, 0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x3, 0x1, 0x2, 0x4, 0x1, 0x2], 0x1, 0x6}, {0xffffffffffffffff, [0x0, 0x1, 0x1, 0x0, 0x7, 0x2], 0x0, 0x2}}}}, {{@ip={@broadcast, @rand_addr=0x64010101, 0xffffffff, 0xffffff00, 'virt_wifi0\x00', 'syzkaller1\x00', {0xff}, {}, 0x9d, 0x2, 0x18}, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x2, [0x3, 0x0, 0x3, 0x0, 0x1, 0x5], 0x3, 0x7}, {0xffffffffffffffff, [0x1, 0x6, 0x4, 0x0, 0x2, 0x1], 0x5, 0x1}}}}], {{'\x00', 0x128, 0x70, 0x98}, {0x28}}}}, 0x318) 36.293840594s ago: executing program 3 (id=99): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, 0x0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x149002, 0x0) getitimer(0x1, &(0x7f0000000000)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = fcntl$getown(r2, 0x9) r4 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt(r4, 0x1, 0x14, &(0x7f0000000340)=""/56, &(0x7f0000000380)=0x38) sched_getparam(r3, &(0x7f0000000100)) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fed000/0x13000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r5 = io_uring_setup(0x7, &(0x7f0000000140)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) write$P9_RSTATu(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="3202fffe7dfeff0005f10000000000000500000000000000000000000000000000000000000000000000feffffffffffffff1f00046e6f6465767b6376666f7892ffffff8102000000000031ffcebc920000003800704a86cec602007dfa673effeb09b5351f5bde05f700000000187b8200b500003b595fcb14034354b9fd9ef196a51cd5157adc8106b494e11200cfc200b0862ce2ef540010000000f313f6005500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cc280e8d489da649a37002c016f6465762d6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae12516105c9ce887df5a6e0b6a77d596cf88ba6e5c6", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], 0x232) 36.293287s ago: executing program 1 (id=100): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000180), &(0x7f00000001c0)=0x8) syz_open_dev$sndpcmc(&(0x7f0000000140), 0x8, 0x4000) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x405, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x48}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWCHAIN={0x5c, 0x3, 0xa, 0x405, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_HOOK_DEV={0x14, 0x3, 'netdevsim0\x00'}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x84}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0xc0, 0x6, 0xa, 0xc05, 0x0, 0x0, {0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x94, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_BASE={0x8}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x4}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}, {0x2c, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_CMP_OP={0x8}, @NFTA_CMP_DATA={0xc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}}}, {0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}]}]}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0xe8}}, 0x0) 36.176563592s ago: executing program 0 (id=101): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r0, 0xd) sendmmsg(r0, &(0x7f0000000540)=[{{&(0x7f00000000c0)=@l2tp6={0xa, 0x0, 0x0, @private1, 0xa, 0x1}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000380)="8c9bbfe29534904458b283dc080058441cc17e236a830c913fbf0512f27ea546c47237b3c2074c7efb253a5d96819cc07e058e56a08a26a93c1d32bd56818b4c74f88ba75f8043ddf3a74236ab3fb7271fa88745165f3b23dbda49328c76e7fa1b1a270624ffaa6d1605cc5a430aad7aff9192d3d294e9bb2564c04d7176fadaba99c4be34be68a778fc27b3beb9e267375c394c8bdaba34b21aed18fc987cc9b2632ee05d", 0x1}, {&(0x7f0000000140)="a010544f4f143a2a5efd9e485e893ccfc88e372dae260d417bc223306532d64fbe4d5d50d4b6e0faedcfbb13220779fd6ae7519a91b116b378cb615c5b8957cd2866ac6b111442de8ba20902519d05a8f7a0b99b23483c0eb9ebe1e973da89789cb2748b59ae42fd35df539706f406c5a0000e3dbe7a6c417f8de25de3843e2699df728be59ea008f3a817dfbfb923e0e92aad8d1077c15fabe5a20723d40df02e11587aae01a400", 0xa8}, {&(0x7f0000000200)="1843cd6e849bde59991e44c40506b4b54a5c5b0d534d20eff5e023da38bc608954016451780aedb124fa08400547ab29dc4644443bee2334b48b637a69f532b65caec93db1e12c1c04536dbed857a8f2d921eb9fd815d69df4ced8b0b2968c7a05a387e35c0ce4c1d2a78c99c5f8ba0b3fdc649a1d9c363ddcbdfd02c48242a411281df0d1b472e05d50d4f180ba86", 0x8f}], 0x3}}, {{0x0, 0xff9c, 0x0, 0x0, &(0x7f0000000340)=[{0x10, 0x84, 0x8}], 0x10}}], 0x2, 0x0) 36.093857902s ago: executing program 2 (id=102): sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async, rerun: 32) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) (async, rerun: 32) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async) r0 = socket(0x2b, 0x80801, 0x1) setsockopt$inet6_mtu(r0, 0x29, 0x1e, &(0x7f0000000040), 0x4) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) (async) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x8083) (async, rerun: 64) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000280)=""/160, 0xa0}], 0x1) (async, rerun: 64) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200000}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000040)={0x0, 0x0, {0x3, 0x0, 0x1, 0x0, 0x4}, 0x3}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) write$sndseq(r3, &(0x7f0000000000)=[{0x1e, 0x0, 0x8, 0xfd, @tick=0x8, {0x0, 0xfe}, {}, @result}], 0x1c) 35.91300513s ago: executing program 3 (id=103): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x2c000010) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000000c0)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip6_vti0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="10031200e0ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x12) 35.79621484s ago: executing program 0 (id=104): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0x3, 0x7fff0040}]}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x0, r0, 0x4, 0x80000}) r1 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000002c80)={0xa, 0x14e24, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x15}}}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e2c, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xfffffffe}, 0x1c) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newqdisc={0x48, 0x24, 0xe0b, 0x1, 0xfffbfffc, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_FWMARK={0x8, 0x12, 0x80}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x489}]}}]}, 0x48}}, 0x80) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x87) connect$inet6(r6, &(0x7f0000000500)={0xa, 0xfffd, 0xffffffff, @local, 0x6}, 0x1c) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='freezer.parent_freezing\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000440), 0x1000a) sendfile(r6, r7, &(0x7f0000000080)=0x11, 0x7fff) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r2, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x0, 0xf}, {0xffff, 0xffff}, {0xfff2, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x44}}}]}, 0x38}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, {0x4, 0xa}, {0x0, 0xf}, {0xfff2, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x4080) 35.683808275s ago: executing program 3 (id=105): r0 = socket$kcm(0x1e, 0x4, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'veth1_to_team\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000540)={'hsr0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010000104000000000000000000000200", @ANYRES32=0x0, @ANYBLOB="400d0000000000003000128008000100687372002400028008000200", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r2], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) 35.273023668s ago: executing program 1 (id=106): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489c", 0x25}], 0x1}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000ffff25bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB], 0x68}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000002) accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x6, 0x9, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="500000000a0601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e220000060005"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) 35.218415011s ago: executing program 1 (id=107): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sg(0x0, 0x0, 0x8002) r1 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, 0x0) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="230000000700000002"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000006c0), &(0x7f00000006c0), 0xffffa7ef, r5}, 0x38) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) pread64(0xffffffffffffffff, &(0x7f0000000480)=""/96, 0x60, 0x7fff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={r2, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000200)=[0x0], &(0x7f0000000340), 0x0, 0xa3, &(0x7f0000000380)=[{}], 0x8, 0x10, &(0x7f0000000440), &(0x7f0000000480), 0x8, 0xdb, 0x8, 0x8, &(0x7f00000004c0)}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000700)='veno', 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0xc1485544, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r2, &(0x7f0000000240)="c9273f6a588e06d9965d342faebf43144af3ca89b935b6747f7184", 0x1b, 0x4044880, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0xffffffff) read$char_usb(r9, &(0x7f0000000000)=""/195, 0xc3) sendmsg$NL80211_CMD_SET_CHANNEL(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="010027bd7000fedbdf254100000008000300", @ANYRES32=r8, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x40) 0s ago: executing program 32 (id=104): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0x3, 0x7fff0040}]}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x0, r0, 0x4, 0x80000}) r1 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000002c80)={0xa, 0x14e24, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x15}}}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e2c, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xfffffffe}, 0x1c) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newqdisc={0x48, 0x24, 0xe0b, 0x1, 0xfffbfffc, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_FWMARK={0x8, 0x12, 0x80}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x489}]}}]}, 0x48}}, 0x80) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x87) connect$inet6(r6, &(0x7f0000000500)={0xa, 0xfffd, 0xffffffff, @local, 0x6}, 0x1c) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='freezer.parent_freezing\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000440), 0x1000a) sendfile(r6, r7, &(0x7f0000000080)=0x11, 0x7fff) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r2, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x0, 0xf}, {0xffff, 0xffff}, {0xfff2, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x44}}}]}, 0x38}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, {0x4, 0xa}, {0x0, 0xf}, {0xfff2, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x4080) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.66' (ED25519) to the list of known hosts. [ 69.140787][ T5603] cgroup: Unknown subsys name 'net' [ 69.256099][ T5603] cgroup: Unknown subsys name 'cpuset' [ 69.259190][ T5603] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 70.656378][ T5603] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.355076][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.355122][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.763197][ T5618] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 72.764945][ T5618] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 72.768145][ T5620] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 72.770818][ T5626] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 72.772533][ T5626] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 72.775236][ T5626] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 72.781279][ T5626] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 72.783184][ T5626] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 72.784797][ T5626] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 72.785403][ T5626] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 72.786075][ T5620] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 72.789689][ T5620] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 72.790052][ T5620] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 72.797367][ T5615] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 72.799979][ T5627] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 72.801472][ T5620] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 72.809085][ T5627] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 72.817120][ T5627] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 72.817761][ T5627] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 72.818773][ T5628] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 72.820188][ T5628] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 72.840330][ T5627] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 72.841163][ T5628] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 72.855512][ T5628] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 72.856364][ T5628] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 73.904112][ T5634] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.904221][ T5634] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.904353][ T5634] bridge_slave_0: entered allmulticast mode [ 73.906451][ T5634] bridge_slave_0: entered promiscuous mode [ 73.970176][ T5634] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.970302][ T5634] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.970521][ T5634] bridge_slave_1: entered allmulticast mode [ 73.971509][ T5634] bridge_slave_1: entered promiscuous mode [ 74.025854][ T5633] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.025954][ T5633] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.026286][ T5633] bridge_slave_0: entered allmulticast mode [ 74.027692][ T5633] bridge_slave_0: entered promiscuous mode [ 74.048996][ T5634] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.069639][ T5632] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.069725][ T5632] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.070047][ T5632] bridge_slave_0: entered allmulticast mode [ 74.071734][ T5632] bridge_slave_0: entered promiscuous mode [ 74.084160][ T5632] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.084263][ T5632] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.085081][ T5632] bridge_slave_1: entered allmulticast mode [ 74.086843][ T5632] bridge_slave_1: entered promiscuous mode [ 74.088886][ T5631] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.088981][ T5631] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.089364][ T5631] bridge_slave_0: entered allmulticast mode [ 74.091233][ T5631] bridge_slave_0: entered promiscuous mode [ 74.095888][ T5633] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.095985][ T5633] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.096105][ T5633] bridge_slave_1: entered allmulticast mode [ 74.098672][ T5633] bridge_slave_1: entered promiscuous mode [ 74.103884][ T5634] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.165472][ T5631] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.165643][ T5631] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.165766][ T5631] bridge_slave_1: entered allmulticast mode [ 74.167833][ T5631] bridge_slave_1: entered promiscuous mode [ 74.219517][ T5635] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.219660][ T5635] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.219777][ T5635] bridge_slave_0: entered allmulticast mode [ 74.221400][ T5635] bridge_slave_0: entered promiscuous mode [ 74.223964][ T5635] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.224061][ T5635] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.224178][ T5635] bridge_slave_1: entered allmulticast mode [ 74.226805][ T5635] bridge_slave_1: entered promiscuous mode [ 74.231699][ T5632] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.268782][ T5634] team0: Port device team_slave_0 added [ 74.287095][ T5632] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.290836][ T5631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.295375][ T5633] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.298578][ T5634] team0: Port device team_slave_1 added [ 74.317300][ T5635] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.335571][ T5631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.337759][ T5633] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.367695][ T5635] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.419624][ T5632] team0: Port device team_slave_0 added [ 74.441659][ T5634] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.441674][ T5634] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.441691][ T5634] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.445173][ T5634] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.445186][ T5634] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.445207][ T5634] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.462560][ T5632] team0: Port device team_slave_1 added [ 74.479611][ T5631] team0: Port device team_slave_0 added [ 74.482512][ T5631] team0: Port device team_slave_1 added [ 74.484991][ T5633] team0: Port device team_slave_0 added [ 74.501143][ T5635] team0: Port device team_slave_0 added [ 74.581973][ T5633] team0: Port device team_slave_1 added [ 74.596304][ T5635] team0: Port device team_slave_1 added [ 74.596960][ T5632] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.596972][ T5632] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.596991][ T5632] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.656745][ T5632] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.656760][ T5632] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.656778][ T5632] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.673263][ T5631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.673278][ T5631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.673298][ T5631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.676126][ T5633] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.676138][ T5633] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.676157][ T5633] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.677820][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.677831][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.677851][ T5635] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.735029][ T5631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.735046][ T5631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.735067][ T5631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.737750][ T5633] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.737763][ T5633] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.737784][ T5633] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.749521][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.749535][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.749555][ T5635] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.759238][ T5634] hsr_slave_0: entered promiscuous mode [ 74.760709][ T5634] hsr_slave_1: entered promiscuous mode [ 74.881395][ T5620] Bluetooth: hci3: command tx timeout [ 74.881514][ T5620] Bluetooth: hci2: command tx timeout [ 74.881586][ T5620] Bluetooth: hci0: command tx timeout [ 74.881663][ T5620] Bluetooth: hci1: command tx timeout [ 74.902319][ T5632] hsr_slave_0: entered promiscuous mode [ 74.903646][ T5632] hsr_slave_1: entered promiscuous mode [ 74.904679][ T5632] debugfs: 'hsr0' already exists in 'hsr' [ 74.904774][ T5632] Cannot create hsr debugfs directory [ 74.959086][ T5628] Bluetooth: hci4: command tx timeout [ 75.002443][ T5631] hsr_slave_0: entered promiscuous mode [ 75.013957][ T5631] hsr_slave_1: entered promiscuous mode [ 75.015011][ T5631] debugfs: 'hsr0' already exists in 'hsr' [ 75.015030][ T5631] Cannot create hsr debugfs directory [ 75.066127][ T5635] hsr_slave_0: entered promiscuous mode [ 75.066730][ T5635] hsr_slave_1: entered promiscuous mode [ 75.067173][ T5635] debugfs: 'hsr0' already exists in 'hsr' [ 75.067190][ T5635] Cannot create hsr debugfs directory [ 75.090902][ T5633] hsr_slave_0: entered promiscuous mode [ 75.091963][ T5633] hsr_slave_1: entered promiscuous mode [ 75.092679][ T5633] debugfs: 'hsr0' already exists in 'hsr' [ 75.092696][ T5633] Cannot create hsr debugfs directory [ 75.559161][ T5634] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 75.564415][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 75.565555][ T5634] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 75.575841][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 75.582008][ T5634] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 75.597756][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 75.598636][ T5634] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 75.612740][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 75.676009][ T5631] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 75.681425][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 75.682086][ T5631] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 75.686867][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 75.692401][ T5631] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 75.704395][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 75.710920][ T5631] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 75.718971][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 75.812188][ T5632] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 75.822459][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 75.842668][ T5632] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 75.852920][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 75.854392][ T5632] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 75.869946][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 75.888424][ T5632] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 75.891154][ T5632] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 75.984160][ T5635] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 75.988876][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 75.997774][ T5634] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.006345][ T5635] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 76.015877][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 76.036103][ T5635] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 76.038600][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 76.040042][ T5635] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 76.042496][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 76.102831][ T5634] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.135925][ T5633] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 76.138943][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 76.147272][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.147507][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.175939][ T5633] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 76.179135][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 76.192826][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.193257][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.215748][ T5633] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 76.218373][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 76.219657][ T5633] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 76.222014][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 76.288731][ T5631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.312579][ T5632] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.356781][ T5631] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.382719][ T1009] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.382809][ T1009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.388423][ T5632] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.410557][ T1009] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.410615][ T1009] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.412426][ T5634] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.450947][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.451007][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.452433][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.452488][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.585202][ T5634] veth0_vlan: entered promiscuous mode [ 76.611367][ T5635] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.643357][ T5634] veth1_vlan: entered promiscuous mode [ 76.678753][ T5633] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.681632][ T5635] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.709136][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.709200][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.728766][ T5633] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.751750][ T95] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.751816][ T95] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.768192][ T95] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.768260][ T95] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.781788][ T5631] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.800888][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.800980][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.839422][ T5634] veth0_macvtap: entered promiscuous mode [ 76.856896][ T5634] veth1_macvtap: entered promiscuous mode [ 76.890359][ T5632] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.921135][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.953461][ T5620] Bluetooth: hci0: command tx timeout [ 76.953493][ T5620] Bluetooth: hci2: command tx timeout [ 76.953513][ T5620] Bluetooth: hci3: command tx timeout [ 76.953651][ T5628] Bluetooth: hci1: command tx timeout [ 76.955532][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.997181][ T95] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.021830][ T5631] veth0_vlan: entered promiscuous mode [ 77.033874][ T5628] Bluetooth: hci4: command tx timeout [ 77.074245][ T5631] veth1_vlan: entered promiscuous mode [ 77.078395][ T5633] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.128464][ T5632] veth0_vlan: entered promiscuous mode [ 77.130943][ T5635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.195018][ T5632] veth1_vlan: entered promiscuous mode [ 77.211797][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.211821][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.223251][ T60] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.253986][ T95] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.254027][ T95] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.258143][ T5631] veth0_macvtap: entered promiscuous mode [ 77.301226][ T5631] veth1_macvtap: entered promiscuous mode [ 77.338057][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.338077][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.399529][ T5632] veth0_macvtap: entered promiscuous mode [ 77.402938][ T5633] veth0_vlan: entered promiscuous mode [ 77.430561][ T5631] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.437532][ T5631] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.470760][ T5632] veth1_macvtap: entered promiscuous mode [ 77.476133][ T5635] veth0_vlan: entered promiscuous mode [ 77.494040][ T5633] veth1_vlan: entered promiscuous mode [ 77.494105][ T5634] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 77.524367][ T60] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.524784][ T60] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.524915][ T60] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.530712][ T60] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.548926][ T5635] veth1_vlan: entered promiscuous mode [ 77.641038][ T5632] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.681750][ T5632] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.715278][ T5633] veth0_macvtap: entered promiscuous mode [ 77.718336][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.718354][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.752361][ T5633] veth1_macvtap: entered promiscuous mode [ 77.780341][ T5635] veth0_macvtap: entered promiscuous mode [ 77.869441][ T5635] veth1_macvtap: entered promiscuous mode [ 77.874985][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.875004][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.893318][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.902298][ T5711] FAULT_INJECTION: forcing a failure. [ 77.902298][ T5711] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 77.902335][ T5711] CPU: 1 UID: 0 PID: 5711 Comm: syz.2.6 Not tainted syzkaller #0 PREEMPT(full) [ 77.902355][ T5711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 77.902372][ T5711] Call Trace: [ 77.902383][ T5711] [ 77.902390][ T5711] dump_stack_lvl+0xe8/0x150 [ 77.902427][ T5711] should_fail_ex+0x410/0x560 [ 77.902452][ T5711] _copy_to_user+0x31/0xb0 [ 77.902477][ T5711] map_get_next_key+0x4ac/0x610 [ 77.902499][ T5711] ? map_get_next_key+0x27d/0x610 [ 77.902522][ T5711] __sys_bpf+0xb83/0xd90 [ 77.902549][ T5711] ? __pfx___sys_bpf+0x10/0x10 [ 77.902580][ T5711] ? __fget_files+0x2a/0x420 [ 77.902620][ T5711] ? ksys_write+0x242/0x270 [ 77.902648][ T5711] ? __pfx_ksys_write+0x10/0x10 [ 77.902678][ T5711] __x64_sys_bpf+0xba/0xd0 [ 77.902713][ T5711] do_syscall_64+0x166/0x520 [ 77.902735][ T5711] ? trace_irq_disable+0x3b/0x140 [ 77.902752][ T5711] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.902799][ T5711] ? clear_bhb_loop+0x70/0xc0 [ 77.902820][ T5711] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.902838][ T5711] RIP: 0033:0x7f420d99e159 [ 77.902859][ T5711] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.902872][ T5711] RSP: 002b:00007f420e7f4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 77.902894][ T5711] RAX: ffffffffffffffda RBX: 00007f420dc25fa0 RCX: 00007f420d99e159 [ 77.902907][ T5711] RDX: 0000000000000020 RSI: 0000200000000340 RDI: 0000000000000004 [ 77.902918][ T5711] RBP: 00007f420e7f4090 R08: 0000000000000000 R09: 0000000000000000 [ 77.902928][ T5711] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.902938][ T5711] R13: 00007f420dc26038 R14: 00007f420dc25fa0 R15: 00007f420dd4fa48 [ 77.902969][ T5711] [ 77.936716][ T95] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.958491][ T5633] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.967563][ T1009] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.967781][ T1009] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.006982][ T5633] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.164940][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.207133][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.213128][ T95] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.213145][ T95] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.245460][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.246300][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.246337][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.246368][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.353679][ T5719] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 78.363712][ T95] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.363754][ T95] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.363786][ T95] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.363818][ T95] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.402415][ T5719] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 78.433413][ T95] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.433433][ T95] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.434170][ T5717] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 78.657545][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.657565][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.742720][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.742749][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.773694][ T5726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.774302][ T5726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.820225][ T1009] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.820254][ T1009] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.918271][ T5729] FAULT_INJECTION: forcing a failure. [ 78.918271][ T5729] name failslab, interval 1, probability 0, space 0, times 1 [ 78.918314][ T5729] CPU: 0 UID: 0 PID: 5729 Comm: syz.2.10 Not tainted syzkaller #0 PREEMPT(full) [ 78.918334][ T5729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 78.918344][ T5729] Call Trace: [ 78.918352][ T5729] [ 78.918359][ T5729] dump_stack_lvl+0xe8/0x150 [ 78.918390][ T5729] should_fail_ex+0x410/0x560 [ 78.918417][ T5729] should_failslab+0xa8/0x100 [ 78.918441][ T5729] __kmalloc_cache_noprof+0xa3/0x600 [ 78.918462][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.918459][ T5729] ? tcf_block_get_ext+0x14f/0x17d0 [ 78.918475][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.918483][ T5729] ? tcf_block_get_ext+0x14f/0x17d0 [ 78.918512][ T5729] tcf_block_get_ext+0x14f/0x17d0 [ 78.918544][ T5729] tcf_block_get+0x67/0xa0 [ 78.918567][ T5729] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 78.918595][ T5729] htb_change_class+0xfc8/0x2c30 [ 78.918612][ T5729] ? stack_depot_save_flags+0x33/0x7f0 [ 78.918645][ T5729] ? netlink_sendmsg+0x813/0xb40 [ 78.918659][ T5729] ? sock_sendmsg_nosec+0x13a/0x180 [ 78.918676][ T5729] ? __pfx_htb_change_class+0x10/0x10 [ 78.918713][ T5729] ? lockdep_rtnl_is_held+0x26/0x40 [ 78.918734][ T5729] ? qdisc_lookup+0x179/0x6c0 [ 78.918753][ T5729] tc_ctl_tclass+0xae1/0x1600 [ 78.918784][ T5729] ? __pfx___mutex_trylock_common+0x10/0x10 [ 78.918805][ T5729] ? __pfx_tc_ctl_tclass+0x10/0x10 [ 78.918824][ T5729] ? rcu_is_watching+0x16/0xb0 [ 78.918845][ T5729] ? trace_contention_end+0x3d/0x140 [ 78.918867][ T5729] ? __mutex_lock+0x30b/0x1550 [ 78.918892][ T5729] ? __local_bh_enable_ip+0xd6/0x140 [ 78.918913][ T5729] ? lockdep_hardirqs_on+0x7b/0x110 [ 78.918932][ T5729] ? __dev_queue_xmit+0x29b/0x3820 [ 78.918977][ T5729] ? __pfx_tc_ctl_tclass+0x10/0x10 [ 78.918995][ T5729] rtnetlink_rcv_msg+0x7b9/0xc00 [ 78.919018][ T5729] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 78.919037][ T5729] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 78.919055][ T5729] ? ref_tracker_free+0x689/0x830 [ 78.919076][ T5729] ? __pfx_ref_tracker_free+0x10/0x10 [ 78.919095][ T5729] ? __asan_memcpy+0x40/0x70 [ 78.919109][ T5729] ? __skb_clone+0x5c/0x6c0 [ 78.919136][ T5729] netlink_rcv_skb+0x226/0x4a0 [ 78.919165][ T5729] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 78.919186][ T5729] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 78.919220][ T5729] ? netlink_deliver_tap+0x2e/0x1b0 [ 78.919242][ T5729] ? netlink_deliver_tap+0x2e/0x1b0 [ 78.919262][ T5729] netlink_unicast+0x7bd/0x940 [ 78.919292][ T5729] netlink_sendmsg+0x813/0xb40 [ 78.919315][ T5729] ? __pfx_netlink_sendmsg+0x10/0x10 [ 78.919338][ T5729] ? apparmor_socket_sendmsg+0x18b/0x360 [ 78.919358][ T5729] ? __pfx_netlink_sendmsg+0x10/0x10 [ 78.919373][ T5729] sock_sendmsg_nosec+0x13a/0x180 [ 78.919392][ T5729] ____sys_sendmsg+0x54e/0x850 [ 78.919418][ T5729] ? __pfx_____sys_sendmsg+0x10/0x10 [ 78.919447][ T5729] ? import_iovec+0x73/0xa0 [ 78.919469][ T5729] ___sys_sendmsg+0x2a5/0x360 [ 78.919491][ T5729] ? __lock_acquire+0x747/0x2de0 [ 78.919512][ T5729] ? __pfx____sys_sendmsg+0x10/0x10 [ 78.919563][ T5729] ? __fget_files+0x2a/0x420 [ 78.919583][ T5729] ? __fget_files+0x3a2/0x420 [ 78.919613][ T5729] __x64_sys_sendmsg+0x1b1/0x290 [ 78.919637][ T5729] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 78.919676][ T5729] do_syscall_64+0x166/0x520 [ 78.919695][ T5729] ? trace_irq_disable+0x3b/0x140 [ 78.919710][ T5729] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.919726][ T5729] ? clear_bhb_loop+0x70/0xc0 [ 78.919746][ T5729] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.919761][ T5729] RIP: 0033:0x7f420d99e159 [ 78.919777][ T5729] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.919789][ T5729] RSP: 002b:00007f420e7f4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 78.919806][ T5729] RAX: ffffffffffffffda RBX: 00007f420dc25fa0 RCX: 00007f420d99e159 [ 78.919817][ T5729] RDX: 0000000020000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 78.919827][ T5729] RBP: 00007f420e7f4090 R08: 0000000000000000 R09: 0000000000000000 [ 78.919836][ T5729] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 78.919845][ T5729] R13: 00007f420dc26038 R14: 00007f420dc25fa0 R15: 00007f420dd4fa48 [ 78.919870][ T5729] [ 79.043681][ T4931] Bluetooth: hci3: command tx timeout [ 79.043737][ T4931] Bluetooth: hci2: command tx timeout [ 79.043758][ T4931] Bluetooth: hci0: command tx timeout [ 79.043910][ T5628] Bluetooth: hci1: command tx timeout [ 79.081989][ T44] usb 5-1: new low-speed USB device number 2 using dummy_hcd [ 79.123207][ T5628] Bluetooth: hci4: command tx timeout [ 79.278862][ T44] usb 5-1: device descriptor read/64, error -71 [ 79.576571][ T5740] syz.0.1 uses obsolete (PF_INET,SOCK_PACKET) [ 79.637411][ T5734] sctp: [Deprecated]: syz.1.11 (pid 5734) Use of struct sctp_assoc_value in delayed_ack socket option. [ 79.637411][ T5734] Use struct sctp_sack_info instead [ 79.649914][ T5742] FAULT_INJECTION: forcing a failure. [ 79.649914][ T5742] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 79.649945][ T5742] CPU: 1 UID: 0 PID: 5742 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT(full) [ 79.649965][ T5742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.649975][ T5742] Call Trace: [ 79.649982][ T5742] [ 79.649990][ T5742] dump_stack_lvl+0xe8/0x150 [ 79.650020][ T5742] should_fail_ex+0x410/0x560 [ 79.650055][ T5742] prepare_alloc_pages+0x223/0x600 [ 79.650081][ T5742] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 79.650106][ T5742] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 79.650129][ T5742] ? __pfx_policy_nodemask+0x10/0x10 [ 79.650162][ T5742] alloc_pages_mpol+0x21e/0x390 [ 79.650191][ T5742] alloc_pages_noprof+0xb1/0x2b0 [ 79.650216][ T5742] get_free_pages_noprof+0xf/0x80 [ 79.650235][ T5742] __kasan_populate_vmalloc+0x38/0x1c0 [ 79.650253][ T5742] ? do_raw_spin_unlock+0xf5/0x200 [ 79.650283][ T5742] alloc_vmap_area+0xd1a/0x1420 [ 79.650322][ T5742] ? __pfx_alloc_vmap_area+0x10/0x10 [ 79.650346][ T5742] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 79.650367][ T5742] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 79.650384][ T5742] ? __get_vm_area_node+0x155/0x2f0 [ 79.650413][ T5742] __get_vm_area_node+0x200/0x2f0 [ 79.650444][ T5742] __vmalloc_node_range_noprof+0x343/0x1540 [ 79.650471][ T5742] ? copy_process+0x7e0/0x4400 [ 79.650496][ T5742] ? percpu_ref_get_many+0x19/0x140 [ 79.650520][ T5742] ? percpu_ref_get_many+0x19/0x140 [ 79.650546][ T5742] ? __memcg_slab_post_alloc_hook+0x487/0xd90 [ 79.650576][ T5742] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 79.650602][ T5742] ? dup_task_struct+0x52/0xa00 [ 79.650622][ T5742] ? trace_kmem_cache_alloc+0x29/0xe0 [ 79.650649][ T5742] ? memcpy_and_pad+0x48/0x80 [ 79.650678][ T5742] __vmalloc_node_noprof+0xc2/0x100 [ 79.650704][ T5742] ? copy_process+0x7e0/0x4400 [ 79.650724][ T5742] ? copy_process+0x7e0/0x4400 [ 79.650748][ T5742] dup_task_struct+0x2c6/0xa00 [ 79.650777][ T5742] copy_process+0x7e0/0x4400 [ 79.650826][ T5742] ? rcu_is_watching+0x16/0xb0 [ 79.650851][ T5742] ? __pfx_copy_process+0x10/0x10 [ 79.650880][ T5742] ? mutex_init_lockdep+0xdf/0x110 [ 79.650904][ T5742] vhost_task_create+0x1f9/0x380 [ 79.650922][ T5742] ? check_path+0x21/0x40 [ 79.650941][ T5742] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 79.650960][ T5742] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 79.650983][ T5742] ? __pfx_vhost_task_create+0x10/0x10 [ 79.651010][ T5742] ? __pfx_vhost_task_fn+0x10/0x10 [ 79.651052][ T5742] kvm_mmu_post_init_vm+0x147/0x2b0 [ 79.651077][ T5742] kvm_arch_vcpu_ioctl_run+0x7c/0x19c0 [ 79.651112][ T5742] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 79.651136][ T5742] kvm_vcpu_ioctl+0xa61/0xfd0 [ 79.651161][ T5742] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 79.651177][ T5742] ? hook_file_ioctl+0x1f2/0x600 [ 79.651218][ T5742] ? __fget_files+0x2a/0x420 [ 79.651245][ T5742] ? __fget_files+0x2a/0x420 [ 79.651267][ T5742] ? __fget_files+0x3a2/0x420 [ 79.651289][ T5742] ? __fget_files+0x2a/0x420 [ 79.651316][ T5742] ? bpf_lsm_file_ioctl+0x9/0x20 [ 79.651340][ T5742] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 79.651360][ T5742] __se_sys_ioctl+0xfc/0x170 [ 79.651381][ T5742] do_syscall_64+0x166/0x520 [ 79.651403][ T5742] ? trace_irq_disable+0x3b/0x140 [ 79.651420][ T5742] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.651438][ T5742] ? clear_bhb_loop+0x70/0xc0 [ 79.651460][ T5742] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.651477][ T5742] RIP: 0033:0x7f61a999e159 [ 79.651494][ T5742] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.651508][ T5742] RSP: 002b:00007f61aa7fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 79.651527][ T5742] RAX: ffffffffffffffda RBX: 00007f61a9c25fa0 RCX: 00007f61a999e159 [ 79.651538][ T5742] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 79.651546][ T5742] RBP: 00007f61aa7fe090 R08: 0000000000000000 R09: 0000000000000000 [ 79.651554][ T5742] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.651563][ T5742] R13: 00007f61a9c26038 R14: 00007f61a9c25fa0 R15: 00007f61a9d4fa48 [ 79.651589][ T5742] [ 79.775303][ T5742] syz.3.4: vmalloc error: size 32768, align 0x8000, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 79.800432][ T5742] CPU: 1 UID: 0 PID: 5742 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT(full) [ 79.800453][ T5742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.800463][ T5742] Call Trace: [ 79.800470][ T5742] [ 79.800477][ T5742] dump_stack_lvl+0xe8/0x150 [ 79.800507][ T5742] warn_alloc+0x24d/0x270 [ 79.800527][ T5742] ? lockdep_hardirqs_on+0x7b/0x110 [ 79.800551][ T5742] ? __pfx_warn_alloc+0x10/0x10 [ 79.800567][ T5742] ? kfree+0x1c5/0x650 [ 79.800605][ T5742] ? __get_vm_area_node+0x219/0x2f0 [ 79.800642][ T5742] __vmalloc_node_range_noprof+0x36b/0x1540 [ 79.800672][ T5742] ? percpu_ref_get_many+0x19/0x140 [ 79.800696][ T5742] ? percpu_ref_get_many+0x19/0x140 [ 79.800724][ T5742] ? __memcg_slab_post_alloc_hook+0x487/0xd90 [ 79.800754][ T5742] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 79.800780][ T5742] ? dup_task_struct+0x52/0xa00 [ 79.800801][ T5742] ? trace_kmem_cache_alloc+0x29/0xe0 [ 79.800828][ T5742] ? memcpy_and_pad+0x48/0x80 [ 79.800858][ T5742] __vmalloc_node_noprof+0xc2/0x100 [ 79.800883][ T5742] ? copy_process+0x7e0/0x4400 [ 79.800903][ T5742] ? copy_process+0x7e0/0x4400 [ 79.800928][ T5742] dup_task_struct+0x2c6/0xa00 [ 79.800957][ T5742] copy_process+0x7e0/0x4400 [ 79.801006][ T5742] ? rcu_is_watching+0x16/0xb0 [ 79.801031][ T5742] ? __pfx_copy_process+0x10/0x10 [ 79.801061][ T5742] ? mutex_init_lockdep+0xdf/0x110 [ 79.801085][ T5742] vhost_task_create+0x1f9/0x380 [ 79.801102][ T5742] ? check_path+0x21/0x40 [ 79.801122][ T5742] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 79.801142][ T5742] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 79.801165][ T5742] ? __pfx_vhost_task_create+0x10/0x10 [ 79.801191][ T5742] ? __pfx_vhost_task_fn+0x10/0x10 [ 79.801228][ T5742] kvm_mmu_post_init_vm+0x147/0x2b0 [ 79.801254][ T5742] kvm_arch_vcpu_ioctl_run+0x7c/0x19c0 [ 79.801288][ T5742] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 79.801313][ T5742] kvm_vcpu_ioctl+0xa61/0xfd0 [ 79.801338][ T5742] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 79.801355][ T5742] ? hook_file_ioctl+0x1f2/0x600 [ 79.801396][ T5742] ? __fget_files+0x2a/0x420 [ 79.801423][ T5742] ? __fget_files+0x2a/0x420 [ 79.801445][ T5742] ? __fget_files+0x3a2/0x420 [ 79.801467][ T5742] ? __fget_files+0x2a/0x420 [ 79.801492][ T5742] ? bpf_lsm_file_ioctl+0x9/0x20 [ 79.801517][ T5742] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 79.801536][ T5742] __se_sys_ioctl+0xfc/0x170 [ 79.801558][ T5742] do_syscall_64+0x166/0x520 [ 79.801585][ T5742] ? trace_irq_disable+0x3b/0x140 [ 79.801602][ T5742] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.801620][ T5742] ? clear_bhb_loop+0x70/0xc0 [ 79.801642][ T5742] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.801659][ T5742] RIP: 0033:0x7f61a999e159 [ 79.801676][ T5742] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.801689][ T5742] RSP: 002b:00007f61aa7fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 79.801706][ T5742] RAX: ffffffffffffffda RBX: 00007f61a9c25fa0 RCX: 00007f61a999e159 [ 79.801719][ T5742] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 79.801729][ T5742] RBP: 00007f61aa7fe090 R08: 0000000000000000 R09: 0000000000000000 [ 79.801739][ T5742] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.801750][ T5742] R13: 00007f61a9c26038 R14: 00007f61a9c25fa0 R15: 00007f61a9d4fa48 [ 79.801779][ T5742] [ 79.840636][ T5742] Mem-Info: [ 79.840652][ T5742] active_anon:5607 inactive_anon:0 isolated_anon:0 [ 79.840652][ T5742] active_file:0 inactive_file:42669 isolated_file:0 [ 79.840652][ T5742] unevictable:0 dirty:1743 writeback:32 [ 79.840652][ T5742] slab_reclaimable:10255 slab_unreclaimable:92566 [ 79.840652][ T5742] mapped:29329 shmem:520 pagetables:1124 [ 79.840652][ T5742] sec_pagetables:0 bounce:0 [ 79.840652][ T5742] kernel_misc_reclaimable:0 [ 79.840652][ T5742] free:1329838 free_pcp:20869 free_cma:0 [ 79.840727][ T5742] Node 0 active_anon:22428kB inactive_anon:0kB active_file:0kB inactive_file:170472kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:117316kB dirty:6964kB writeback:128kB shmem:2080kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12088kB pagetables:4356kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 79.840773][ T5742] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:8kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 79.840820][ T5742] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 79.840870][ T5742] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 79.840902][ T5742] Node 0 DMA32 free:1354516kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:22428kB inactive_anon:0kB active_file:0kB inactive_file:170472kB unevictable:0kB writepending:6932kB zspages:0kB present:3129332kB managed:2546896kB mlocked:0kB bounce:0kB free_pcp:83228kB local_pcp:9616kB free_cma:0kB [ 79.840953][ T5742] lowmem_reserve[]: 0 0 0 0 0 [ 79.840983][ T5742] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 79.841028][ T5742] lowmem_reserve[]: 0 0 0 0 0 [ 79.841065][ T5742] Node 1 Normal free:3949476kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:8kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:248kB local_pcp:0kB free_cma:0kB [ 79.841131][ T5742] lowmem_reserve[]: 0 0 0 0 0 [ 79.841161][ T5742] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 79.841288][ T5742] Node 0 DMA32: 1*4kB (E) 2*8kB (UM) 1*16kB (U) 3*32kB (UME) 2*64kB (ME) 2*128kB (UE) 1*256kB (E) 2*512kB (ME) 7*1024kB (UM) 5*2048kB (UME) 326*4096kB (M) = 1354500kB [ 79.841426][ T5742] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 79.841512][ T5742] Node 1 Normal: 3*4kB (UM) 1*8kB (M) 1*16kB (M) 6*32kB (UM) 11*64kB (UM) 6*128kB (UM) 3*256kB (UM) 5*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 962*4096kB (M) = 3949476kB [ 79.841650][ T5742] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 79.841664][ T5742] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 79.841681][ T5742] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 79.841695][ T5742] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 79.841708][ T5742] 43212 total pagecache pages [ 79.841718][ T5742] 0 pages in swap cache [ 79.841724][ T5742] Free swap = 124996kB [ 79.841731][ T5742] Total swap = 124996kB [ 79.841737][ T5742] 2097051 pages RAM [ 79.841743][ T5742] 0 pages HighMem/MovableOnly [ 79.841750][ T5742] 428711 pages reserved [ 79.841756][ T5742] 0 pages cma reserved [ 81.117348][ T5620] Bluetooth: hci0: command tx timeout [ 81.117379][ T5620] Bluetooth: hci2: command tx timeout [ 81.117399][ T5620] Bluetooth: hci3: command tx timeout [ 81.117456][ T5628] Bluetooth: hci1: command tx timeout [ 81.165017][ T5759] FAULT_INJECTION: forcing a failure. [ 81.165017][ T5759] name failslab, interval 1, probability 0, space 0, times 0 [ 81.165046][ T5759] CPU: 1 UID: 0 PID: 5759 Comm: syz.3.16 Not tainted syzkaller #0 PREEMPT(full) [ 81.165065][ T5759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 81.165074][ T5759] Call Trace: [ 81.165081][ T5759] [ 81.165088][ T5759] dump_stack_lvl+0xe8/0x150 [ 81.165117][ T5759] should_fail_ex+0x410/0x560 [ 81.165138][ T5759] ? __alloc_skb+0x1db/0x7a0 [ 81.165158][ T5759] should_failslab+0xa8/0x100 [ 81.165180][ T5759] ? __alloc_skb+0x1db/0x7a0 [ 81.165195][ T5759] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 81.165215][ T5759] ? __alloc_skb+0x18d/0x7a0 [ 81.165231][ T5759] ? __alloc_skb+0x1db/0x7a0 [ 81.165251][ T5759] __alloc_skb+0x1db/0x7a0 [ 81.165270][ T5759] netlink_sendmsg+0x5d4/0xb40 [ 81.165291][ T5759] ? __pfx_netlink_sendmsg+0x10/0x10 [ 81.165311][ T5759] ? apparmor_socket_sendmsg+0x18b/0x360 [ 81.165329][ T5759] ? __pfx_netlink_sendmsg+0x10/0x10 [ 81.165342][ T5759] sock_sendmsg_nosec+0x13a/0x180 [ 81.165359][ T5759] ____sys_sendmsg+0x54e/0x850 [ 81.165381][ T5759] ? __pfx_____sys_sendmsg+0x10/0x10 [ 81.165406][ T5759] ? import_iovec+0x73/0xa0 [ 81.165428][ T5759] ___sys_sendmsg+0x2a5/0x360 [ 81.165447][ T5759] ? __lock_acquire+0x747/0x2de0 [ 81.165467][ T5759] ? __pfx____sys_sendmsg+0x10/0x10 [ 81.165516][ T5759] ? __fget_files+0x2a/0x420 [ 81.165534][ T5759] ? __fget_files+0x3a2/0x420 [ 81.165563][ T5759] __x64_sys_sendmsg+0x1b1/0x290 [ 81.165587][ T5759] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 81.165630][ T5759] do_syscall_64+0x166/0x520 [ 81.165652][ T5759] ? trace_irq_disable+0x3b/0x140 [ 81.165669][ T5759] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.165686][ T5759] ? clear_bhb_loop+0x70/0xc0 [ 81.165705][ T5759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.165722][ T5759] RIP: 0033:0x7f61a999e159 [ 81.165739][ T5759] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.165751][ T5759] RSP: 002b:00007f61aa7fe028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 81.165768][ T5759] RAX: ffffffffffffffda RBX: 00007f61a9c25fa0 RCX: 00007f61a999e159 [ 81.165780][ T5759] RDX: 0000000020000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 81.165791][ T5759] RBP: 00007f61aa7fe090 R08: 0000000000000000 R09: 0000000000000000 [ 81.165801][ T5759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 81.165811][ T5759] R13: 00007f61a9c26038 R14: 00007f61a9c25fa0 R15: 00007f61a9d4fa48 [ 81.165840][ T5759] [ 81.193761][ T5628] Bluetooth: hci4: command tx timeout [ 81.707611][ T50] nvmet: connect request for invalid subsystem testsubsys! [ 81.711211][ T5761] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 81.815513][ T5778] FAULT_INJECTION: forcing a failure. [ 81.815513][ T5778] name failslab, interval 1, probability 0, space 0, times 0 [ 81.815543][ T5778] CPU: 0 UID: 0 PID: 5778 Comm: syz.3.21 Not tainted syzkaller #0 PREEMPT(full) [ 81.815563][ T5778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 81.815573][ T5778] Call Trace: [ 81.815580][ T5778] [ 81.815588][ T5778] dump_stack_lvl+0xe8/0x150 [ 81.815618][ T5778] should_fail_ex+0x410/0x560 [ 81.815645][ T5778] should_failslab+0xa8/0x100 [ 81.815667][ T5778] ? vm_area_alloc+0x24/0x140 [ 81.815684][ T5778] kmem_cache_alloc_noprof+0xa1/0x600 [ 81.815711][ T5778] ? vm_area_alloc+0x24/0x140 [ 81.815734][ T5778] vm_area_alloc+0x24/0x140 [ 81.815753][ T5778] mmap_region+0x1298/0x2270 [ 81.815785][ T5778] ? __pfx_mmap_region+0x10/0x10 [ 81.815800][ T5778] ? process_measurement+0x7b2/0x1c10 [ 81.815823][ T5778] ? up_write+0x19d/0x4a0 [ 81.815900][ T5778] ? __asan_memset+0x22/0x50 [ 81.815914][ T5778] ? process_measurement+0x14fb/0x1c10 [ 81.815957][ T5778] ? __lock_acquire+0x747/0x2de0 [ 81.815972][ T5778] ? cap_mmap_addr+0xaf/0x100 [ 81.815987][ T5778] ? bpf_lsm_mmap_addr+0x9/0x50 [ 81.816005][ T5778] ? security_mmap_addr+0x71/0x240 [ 81.816022][ T5778] ? shmem_mapping+0xd/0x50 [ 81.816039][ T5778] ? memfd_check_seals_mmap+0xc5/0x220 [ 81.816061][ T5778] do_mmap+0xe0a/0x1300 [ 81.816081][ T5778] ? get_pid_task+0x20/0x1f0 [ 81.816103][ T5778] ? __pfx_do_mmap+0x10/0x10 [ 81.816130][ T5778] ? vm_mmap_pgoff+0x1dd/0x4e0 [ 81.816147][ T5778] ? down_write_killable+0x17e/0x240 [ 81.816172][ T5778] ? __pfx_down_write_killable+0x10/0x10 [ 81.816207][ T5778] vm_mmap_pgoff+0x272/0x4e0 [ 81.816228][ T5778] ? lock_acquire+0x115/0x350 [ 81.816250][ T5778] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 81.816272][ T5778] ? __fget_files+0x2a/0x420 [ 81.816297][ T5778] ? __fget_files+0x3a2/0x420 [ 81.816318][ T5778] ? __fget_files+0x2a/0x420 [ 81.816346][ T5778] ksys_mmap_pgoff+0x4dc/0x760 [ 81.816376][ T5778] do_syscall_64+0x166/0x520 [ 81.816396][ T5778] ? trace_irq_disable+0x3b/0x140 [ 81.816409][ T5778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.816423][ T5778] ? clear_bhb_loop+0x70/0xc0 [ 81.816440][ T5778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.816454][ T5778] RIP: 0033:0x7f61a999e159 [ 81.816468][ T5778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.816478][ T5778] RSP: 002b:00007f61aa7fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 81.816495][ T5778] RAX: ffffffffffffffda RBX: 00007f61a9c25fa0 RCX: 00007f61a999e159 [ 81.816505][ T5778] RDX: 0000000001000007 RSI: 000000000000c000 RDI: 0000200000ffc000 [ 81.816515][ T5778] RBP: 00007f61aa7fe090 R08: 0000000000000003 R09: 0000000000000000 [ 81.816524][ T5778] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000001 [ 81.816532][ T5778] R13: 00007f61a9c26038 R14: 00007f61a9c25fa0 R15: 00007f61a9d4fa48 [ 81.816560][ T5778] [ 81.885598][ T5692] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 82.081538][ T5692] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 82.099579][ T5692] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.176747][ T5692] usb 3-1: config 0 descriptor?? [ 82.240160][ T5692] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 82.904559][ T5791] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 83.358177][ T5804] FAULT_INJECTION: forcing a failure. [ 83.358177][ T5804] name failslab, interval 1, probability 0, space 0, times 0 [ 83.358208][ T5804] CPU: 0 UID: 0 PID: 5804 Comm: syz.4.28 Not tainted syzkaller #0 PREEMPT(full) [ 83.358228][ T5804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.358238][ T5804] Call Trace: [ 83.358245][ T5804] [ 83.358252][ T5804] dump_stack_lvl+0xe8/0x150 [ 83.358282][ T5804] should_fail_ex+0x410/0x560 [ 83.358308][ T5804] should_failslab+0xa8/0x100 [ 83.358333][ T5804] __kvmalloc_node_noprof+0x176/0x820 [ 83.358355][ T5804] ? __kvmalloc_node_noprof+0x345/0x820 [ 83.358374][ T5804] ? bpf_check_cfg+0x1ad/0x3840 [ 83.358391][ T5804] ? bpf_check_cfg+0x1ad/0x3840 [ 83.358413][ T5804] bpf_check_cfg+0x1ad/0x3840 [ 83.358440][ T5804] ? lock_acquire+0x115/0x350 [ 83.358469][ T5804] ? __fget_files+0x2a/0x420 [ 83.358500][ T5804] ? __pfx_bpf_check_cfg+0x10/0x10 [ 83.358522][ T5804] ? fput+0xa0/0xd0 [ 83.358541][ T5804] ? add_used_map+0xff/0x110 [ 83.358563][ T5804] ? check_and_resolve_insns+0x1d54/0x21d0 [ 83.358593][ T5804] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 83.358617][ T5804] ? add_kfuncs+0x251/0x2e0 [ 83.358641][ T5804] bpf_check+0x25fd/0x2ef0 [ 83.358678][ T5804] ? __pfx_bpf_check+0x10/0x10 [ 83.358699][ T5804] ? bpf_obj_name_cpy+0x194/0x1e0 [ 83.358727][ T5804] bpf_prog_load+0x14d6/0x1c20 [ 83.358760][ T5804] ? __pfx_bpf_prog_load+0x10/0x10 [ 83.358816][ T5804] __sys_bpf+0xd0d/0xd90 [ 83.358843][ T5804] ? __pfx___sys_bpf+0x10/0x10 [ 83.358874][ T5804] ? __fget_files+0x2a/0x420 [ 83.358915][ T5804] ? ksys_write+0x242/0x270 [ 83.358944][ T5804] ? __pfx_ksys_write+0x10/0x10 [ 83.358975][ T5804] __x64_sys_bpf+0xba/0xd0 [ 83.358997][ T5804] do_syscall_64+0x166/0x520 [ 83.359018][ T5804] ? trace_irq_disable+0x3b/0x140 [ 83.359036][ T5804] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.359054][ T5804] ? clear_bhb_loop+0x70/0xc0 [ 83.359076][ T5804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.359093][ T5804] RIP: 0033:0x7f0a0b39e159 [ 83.359108][ T5804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.359122][ T5804] RSP: 002b:00007f0a0c2f8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 83.359141][ T5804] RAX: ffffffffffffffda RBX: 00007f0a0b625fa0 RCX: 00007f0a0b39e159 [ 83.359153][ T5804] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 83.359164][ T5804] RBP: 00007f0a0c2f8090 R08: 0000000000000000 R09: 0000000000000000 [ 83.359175][ T5804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 83.359184][ T5804] R13: 00007f0a0b626038 R14: 00007f0a0b625fa0 R15: 00007f0a0b74fa48 [ 83.359211][ T5804] [ 83.463122][ T5692] usb 3-1: USB disconnect, device number 2 [ 83.500430][ T5706] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 83.676473][ T5706] usb 1-1: device descriptor read/64, error -71 [ 83.804446][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 83.869460][ T5814] netlink: 'syz.4.31': attribute type 1 has an invalid length. [ 83.928049][ T5706] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 83.930528][ T5816] netlink: 8 bytes leftover after parsing attributes in process `syz.4.31'. [ 83.957933][ T5812] netlink: 'syz.4.31': attribute type 10 has an invalid length. [ 83.957954][ T5812] netlink: 40 bytes leftover after parsing attributes in process `syz.4.31'. [ 83.958486][ T5812] dummy0: entered promiscuous mode [ 83.964084][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 83.972354][ T9] usb 4-1: New USB device found, idVendor=054c, idProduct=002e, bcdDevice= 5.00 [ 84.009612][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.009638][ T9] usb 4-1: Product: syz [ 84.009651][ T9] usb 4-1: Manufacturer: syz [ 84.009664][ T9] usb 4-1: SerialNumber: syz [ 84.014130][ T9] usb 4-1: config 0 descriptor?? [ 84.036727][ T1220] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 84.053612][ T9] usb-storage 4-1:0.0: USB Mass Storage device detected [ 84.074452][ T5706] usb 1-1: device descriptor read/64, error -71 [ 84.092875][ T9] usb-storage 4-1:0.0: Quirks match for vid 054c pid 002e: 1 [ 84.092907][ T9] usb-storage 4-1:0.0: This device (054c,002e,0500 S 04 P 00) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 84.092907][ T9] Please send a copy of this message to and [ 84.184420][ T5706] usb usb1-port1: attempt power cycle [ 84.207936][ T1220] usb 2-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 84.208940][ T1220] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 84.208967][ T1220] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 84.208986][ T1220] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 84.209022][ T1220] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.266085][ T1220] usb 2-1: config 0 descriptor?? [ 84.276569][ T5692] usb 4-1: USB disconnect, device number 2 [ 84.303294][ T5820] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 84.543563][ T5706] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 84.565265][ T5706] usb 1-1: device descriptor read/8, error -71 [ 84.598622][ T1220] input: HID 041e:3100 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:041E:3100.0001/input/input5 [ 84.721303][ T5835] FAULT_INJECTION: forcing a failure. [ 84.721303][ T5835] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 84.721326][ T5835] CPU: 1 UID: 0 PID: 5835 Comm: syz.2.34 Not tainted syzkaller #0 PREEMPT(full) [ 84.721337][ T5835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 84.721343][ T5835] Call Trace: [ 84.721348][ T5835] [ 84.721353][ T5835] dump_stack_lvl+0xe8/0x150 [ 84.721373][ T5835] should_fail_ex+0x410/0x560 [ 84.721389][ T5835] _copy_to_iter+0x1e4/0x1810 [ 84.721408][ T5835] ? __pfx__copy_to_iter+0x10/0x10 [ 84.721419][ T5835] ? __pfx_woken_wake_function+0x10/0x10 [ 84.721436][ T5835] ? ldsem_down_read+0x12/0x40 [ 84.721452][ T5835] tty_read+0x2c1/0x710 [ 84.721467][ T5835] ? __pfx_tty_read+0x10/0x10 [ 84.721483][ T5835] ? bpf_lsm_file_permission+0x9/0x20 [ 84.721497][ T5835] ? security_file_permission+0x75/0x260 [ 84.721513][ T5835] vfs_read+0x595/0xa80 [ 84.721532][ T5835] ? __pfx_vfs_read+0x10/0x10 [ 84.721552][ T5835] ? __fget_files+0x2a/0x420 [ 84.721571][ T5835] ksys_read+0x150/0x270 [ 84.721587][ T5835] ? __pfx_ksys_read+0x10/0x10 [ 84.721607][ T5835] do_syscall_64+0x166/0x520 [ 84.721629][ T5835] ? trace_irq_disable+0x3b/0x140 [ 84.721639][ T5835] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.721649][ T5835] ? clear_bhb_loop+0x70/0xc0 [ 84.721661][ T5835] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.721671][ T5835] RIP: 0033:0x7f420d99e159 [ 84.721681][ T5835] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.721689][ T5835] RSP: 002b:00007f420e7b2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 84.721700][ T5835] RAX: ffffffffffffffda RBX: 00007f420dc26180 RCX: 00007f420d99e159 [ 84.721707][ T5835] RDX: 0000000000002053 RSI: 0000200000002900 RDI: 0000000000000003 [ 84.721713][ T5835] RBP: 00007f420e7b2090 R08: 0000000000000000 R09: 0000000000000000 [ 84.721719][ T5835] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 84.721725][ T5835] R13: 00007f420dc26218 R14: 00007f420dc26180 R15: 00007f420dd4fa48 [ 84.721741][ T5835] [ 84.825792][ T5706] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 84.858650][ T5706] usb 1-1: device descriptor read/8, error -71 [ 84.975531][ T5706] usb usb1-port1: unable to enumerate USB device [ 84.977630][ T1220] creative-sb0540 0003:041E:3100.0001: input,hidraw0: USB HID v0.00 Joystick [HID 041e:3100] on usb-dummy_hcd.1-1/input0 [ 85.117056][ T5692] usb 2-1: USB disconnect, device number 2 [ 85.244627][ T5840] ip_tables: iptables: counters copy to user failed while replacing table [ 85.769810][ T5856] xt_CT: You must specify a L4 protocol and not use inversions on it [ 85.835508][ T1220] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 85.963139][ T44] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 85.983811][ T1220] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 85.984526][ T1220] usb 5-1: config 0 has no interfaces? [ 85.988922][ T1220] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.988937][ T1220] usb 5-1: Product: syz [ 85.988944][ T1220] usb 5-1: Manufacturer: syz [ 85.988951][ T1220] usb 5-1: SerialNumber: syz [ 86.037786][ T1220] usb 5-1: config 0 descriptor?? [ 86.114475][ T44] usb 2-1: Using ep0 maxpacket: 16 [ 86.115366][ T44] usb 2-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 86.116441][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 86.121314][ T44] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.121328][ T44] usb 2-1: Product: syz [ 86.121336][ T44] usb 2-1: Manufacturer: syz [ 86.121343][ T44] usb 2-1: SerialNumber: syz [ 86.135521][ T44] usb 2-1: config 0 descriptor?? [ 86.146349][ T44] hub 2-1:0.0: bad descriptor, ignoring hub [ 86.146374][ T44] hub 2-1:0.0: probe with driver hub failed with error -5 [ 86.179804][ T44] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 86.467525][ T44] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 86.521085][ T44] usb 2-1: USB disconnect, device number 3 [ 86.545129][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 86.710927][ T5866] FAULT_INJECTION: forcing a failure. [ 86.710927][ T5866] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 86.710958][ T5866] CPU: 0 UID: 0 PID: 5866 Comm: syz.2.45 Not tainted syzkaller #0 PREEMPT(full) [ 86.710979][ T5866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 86.710990][ T5866] Call Trace: [ 86.710997][ T5866] [ 86.711005][ T5866] dump_stack_lvl+0xe8/0x150 [ 86.711036][ T5866] should_fail_ex+0x410/0x560 [ 86.711063][ T5866] _copy_from_user+0x2d/0xb0 [ 86.711088][ T5866] snd_seq_oss_write+0x6e2/0x950 [ 86.711131][ T5866] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 86.711170][ T5866] ? security_file_permission+0x75/0x260 [ 86.711195][ T5866] odev_write+0x5a/0x80 [ 86.711219][ T5866] ? __pfx_odev_write+0x10/0x10 [ 86.711244][ T5866] vfs_write+0x296/0xba0 [ 86.711279][ T5866] ? __pfx_vfs_write+0x10/0x10 [ 86.711308][ T5866] ? __fget_files+0x2a/0x420 [ 86.711335][ T5866] ? __fget_files+0x2a/0x420 [ 86.711358][ T5866] ? __fget_files+0x3a2/0x420 [ 86.711381][ T5866] ? __fget_files+0x2a/0x420 [ 86.711420][ T5866] ksys_write+0x150/0x270 [ 86.711449][ T5866] ? __pfx_ksys_write+0x10/0x10 [ 86.711487][ T5866] do_syscall_64+0x166/0x520 [ 86.711509][ T5866] ? trace_irq_disable+0x3b/0x140 [ 86.711528][ T5866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.711547][ T5866] ? clear_bhb_loop+0x70/0xc0 [ 86.711569][ T5866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.711587][ T5866] RIP: 0033:0x7f420d99e159 [ 86.711604][ T5866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.711618][ T5866] RSP: 002b:00007f420e7f4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.711638][ T5866] RAX: ffffffffffffffda RBX: 00007f420dc25fa0 RCX: 00007f420d99e159 [ 86.711651][ T5866] RDX: 0000000000000232 RSI: 00002000000004c0 RDI: 0000000000000004 [ 86.711662][ T5866] RBP: 00007f420e7f4090 R08: 0000000000000000 R09: 0000000000000000 [ 86.711673][ T5866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 86.711683][ T5866] R13: 00007f420dc26038 R14: 00007f420dc25fa0 R15: 00007f420dd4fa48 [ 86.711713][ T5866] [ 86.953963][ T1218] cfg80211: failed to load regulatory.db [ 87.093571][ T5871] netlink: 24 bytes leftover after parsing attributes in process `syz.3.48'. [ 87.100204][ T5871] netlink: 4 bytes leftover after parsing attributes in process `syz.3.48'. [ 87.423048][ T1220] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 87.575162][ T1220] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 87.596833][ T1220] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid maxpacket 57343, setting to 64 [ 87.596869][ T1220] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 87.602577][ T1220] usb 4-1: New USB device strings: Mfr=1, Product=66, SerialNumber=3 [ 87.602614][ T1220] usb 4-1: Product: syz [ 87.602627][ T1220] usb 4-1: Manufacturer: syz [ 87.602640][ T1220] usb 4-1: SerialNumber: syz [ 87.699605][ T1220] usb 4-1: config 0 descriptor?? [ 87.701019][ T5871] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 87.797507][ T5889] xt_ipcomp: unknown flags 1D [ 87.958367][ T1220] usb 4-1: USB disconnect, device number 3 [ 88.031419][ T5894] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 88.168958][ T5899] netlink: 40 bytes leftover after parsing attributes in process `syz.1.54'. [ 88.278030][ T5902] netlink: 72 bytes leftover after parsing attributes in process `syz.1.55'. [ 88.451054][ T5904] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.452288][ T5904] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.560154][ T5908] sctp: [Deprecated]: syz.1.57 (pid 5908) Use of struct sctp_assoc_value in delayed_ack socket option. [ 88.560154][ T5908] Use struct sctp_sack_info instead [ 88.900850][ T5904] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 88.924193][ T5904] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 89.084526][ T60] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.084568][ T60] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.084586][ T60] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.084604][ T60] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.234857][ T1218] usb 5-1: USB disconnect, device number 4 [ 89.327116][ T5930] netlink: 72 bytes leftover after parsing attributes in process `syz.2.64'. [ 89.683241][ T5947] netlink: 44 bytes leftover after parsing attributes in process `syz.2.70'. [ 89.774754][ T1218] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 89.923063][ T1218] usb 5-1: Using ep0 maxpacket: 16 [ 89.923783][ T1218] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 89.930059][ T1218] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 89.930088][ T1218] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 89.982348][ T1218] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.982374][ T1218] usb 5-1: Product: syz [ 89.982387][ T1218] usb 5-1: Manufacturer: syz [ 89.982401][ T1218] usb 5-1: SerialNumber: syz [ 90.021877][ T1218] usb 5-1: config 0 descriptor?? [ 90.037984][ T1218] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 90.038004][ T1218] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 90.137407][ T5706] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 90.281626][ T5956] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.282119][ T5956] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.295017][ T5706] usb 2-1: New USB device found, idVendor=08fd, idProduct=0002, bcdDevice=ca.fd [ 90.296199][ T5706] usb 2-1: config 0 has an invalid interface number: 255 but max is 0 [ 90.296221][ T5706] usb 2-1: config 0 has no interface number 0 [ 90.296256][ T5706] usb 2-1: config 0 interface 255 altsetting 172 has 0 endpoint descriptors, different from the interface descriptor's value: 20 [ 90.296279][ T5706] usb 2-1: config 0 interface 255 has no altsetting 0 [ 90.298637][ T5706] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.298658][ T5706] usb 2-1: Product: syz [ 90.298671][ T5706] usb 2-1: Manufacturer: syz [ 90.298684][ T5706] usb 2-1: SerialNumber: syz [ 90.306187][ T5706] usb 2-1: config 0 descriptor?? [ 90.527453][ T30] audit: type=1326 audit(1790390040.306:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5951 comm="syz.1.71" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f174459e159 code=0x7ffc0000 [ 90.529223][ T30] audit: type=1326 audit(1790390040.306:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5951 comm="syz.1.71" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f174459e159 code=0x7ffc0000 [ 90.532080][ T30] audit: type=1326 audit(1790390040.306:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5951 comm="syz.1.71" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f174459e159 code=0x7ffc0000 [ 90.539409][ T30] audit: type=1326 audit(1790390040.316:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5951 comm="syz.1.71" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f174459e159 code=0x7ffc0000 [ 90.539461][ T30] audit: type=1326 audit(1790390040.316:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5951 comm="syz.1.71" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f174459e159 code=0x7ffc0000 [ 90.541764][ T30] audit: type=1326 audit(1790390040.316:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5951 comm="syz.1.71" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f174459e159 code=0x7ffc0000 [ 90.541809][ T30] audit: type=1326 audit(1790390040.316:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5951 comm="syz.1.71" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f174459e159 code=0x7ffc0000 [ 90.541844][ T30] audit: type=1326 audit(1790390040.316:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5951 comm="syz.1.71" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f174459e159 code=0x7ffc0000 [ 90.544206][ T30] audit: type=1326 audit(1790390040.316:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5951 comm="syz.1.71" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f174459e159 code=0x7ffc0000 [ 90.544304][ T30] audit: type=1326 audit(1790390040.326:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5951 comm="syz.1.71" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f174459e159 code=0x7ffc0000 [ 90.808242][ T5975] netlink: 72 bytes leftover after parsing attributes in process `syz.2.76'. [ 90.833890][ T1218] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 90.835819][ T1218] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 90.869470][ T1218] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 90.869485][ T1218] em28xx 5-1:0.0: No AC97 audio processor [ 90.909080][ T1218] usb 5-1: USB disconnect, device number 5 [ 90.912821][ T1218] em28xx 5-1:0.0: Disconnecting em28xx [ 90.941166][ T1218] em28xx: Freeing device [ 90.961210][ T5956] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 90.994334][ T5956] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 91.166569][ T5691] usb 2-1: USB disconnect, device number 4 [ 91.253185][ T5983] FAULT_INJECTION: forcing a failure. [ 91.253185][ T5983] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 91.253216][ T5983] CPU: 0 UID: 0 PID: 5983 Comm: syz.4.78 Not tainted syzkaller #0 PREEMPT(full) [ 91.253236][ T5983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 91.253246][ T5983] Call Trace: [ 91.253253][ T5983] [ 91.253261][ T5983] dump_stack_lvl+0xe8/0x150 [ 91.253291][ T5983] should_fail_ex+0x410/0x560 [ 91.253318][ T5983] prepare_alloc_pages+0x223/0x600 [ 91.253353][ T5983] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 91.253378][ T5983] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 91.253403][ T5983] ? __pfx_policy_nodemask+0x10/0x10 [ 91.253426][ T5983] ? __pfx___mutex_lock+0x10/0x10 [ 91.253451][ T5983] ? aa_file_perm+0x18b/0x15f0 [ 91.253480][ T5983] alloc_pages_mpol+0x21e/0x390 [ 91.253511][ T5983] alloc_pages_noprof+0xb1/0x2b0 [ 91.253537][ T5983] anon_pipe_write+0xd8a/0x1a30 [ 91.253581][ T5983] ? __pfx_anon_pipe_write+0x10/0x10 [ 91.253609][ T5983] ? common_file_perm+0x20e/0x2b0 [ 91.253633][ T5983] ? bpf_lsm_file_permission+0x9/0x20 [ 91.253658][ T5983] ? security_file_permission+0x75/0x260 [ 91.253678][ T5983] ? rw_verify_area+0x203/0x4c0 [ 91.253702][ T5983] ? import_ubuf+0xfb/0x1d0 [ 91.253727][ T5983] aio_write+0x5d0/0x870 [ 91.253753][ T5983] ? __pfx_aio_write+0x10/0x10 [ 91.253806][ T5983] io_submit_one+0x798/0x13d0 [ 91.253838][ T5983] ? __pfx_io_submit_one+0x10/0x10 [ 91.253856][ T5983] ? lock_acquire+0x115/0x350 [ 91.253890][ T5983] ? __might_fault+0xaf/0x130 [ 91.253919][ T5983] __se_sys_io_submit+0x195/0x340 [ 91.253940][ T5983] ? __pfx___se_sys_io_submit+0x10/0x10 [ 91.253955][ T5983] ? ksys_write+0x242/0x270 [ 91.253994][ T5983] do_syscall_64+0x166/0x520 [ 91.254014][ T5983] ? trace_irq_disable+0x3b/0x140 [ 91.254031][ T5983] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.254049][ T5983] ? clear_bhb_loop+0x70/0xc0 [ 91.254072][ T5983] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.254090][ T5983] RIP: 0033:0x7f0a0b39e159 [ 91.254107][ T5983] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.254120][ T5983] RSP: 002b:00007f0a0c2f8028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 91.254139][ T5983] RAX: ffffffffffffffda RBX: 00007f0a0b625fa0 RCX: 00007f0a0b39e159 [ 91.254152][ T5983] RDX: 0000200000000300 RSI: 000000000000f000 RDI: 00007f0a0c2c7000 [ 91.254164][ T5983] RBP: 00007f0a0c2f8090 R08: 0000000000000000 R09: 0000000000000000 [ 91.254175][ T5983] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 91.254185][ T5983] R13: 00007f0a0b626038 R14: 00007f0a0b625fa0 R15: 00007f0a0b74fa48 [ 91.254215][ T5983] [ 91.668388][ T95] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.669390][ T95] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.669431][ T95] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.669461][ T95] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.967255][ T5992] netlink: 36 bytes leftover after parsing attributes in process `syz.2.82'. [ 91.969478][ T5992] Debayer B: ================= START STATUS ================= [ 91.969493][ T5992] Debayer B: Debayer Mean Window Size: 3 [ 91.969531][ T5992] Debayer B: ================== END STATUS ================== [ 91.970236][ T5992] netlink: 8 bytes leftover after parsing attributes in process `syz.2.82'. [ 91.970252][ T5992] netlink: 4 bytes leftover after parsing attributes in process `syz.2.82'. [ 92.028495][ T1220] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 92.077715][ T5994] Zero length message leads to an empty skb [ 92.173824][ T1220] usb 4-1: New USB device found, idVendor=1784, idProduct=0006, bcdDevice=bb.2f [ 92.174950][ T1220] usb 4-1: config 48 interface 0 altsetting 98 bulk endpoint 0x4 has invalid maxpacket 1024 [ 92.174977][ T1220] usb 4-1: config 48 interface 0 altsetting 98 has an endpoint descriptor with address 0x5A, changing to 0xA [ 92.175000][ T1220] usb 4-1: config 48 interface 0 altsetting 98 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 92.175022][ T1220] usb 4-1: config 48 interface 0 altsetting 98 endpoint 0xA has invalid wMaxPacketSize 0 [ 92.175041][ T1220] usb 4-1: config 48 interface 0 has no altsetting 0 [ 92.177298][ T1220] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.177319][ T1220] usb 4-1: Product: syz [ 92.177331][ T1220] usb 4-1: Manufacturer: syz [ 92.177344][ T1220] usb 4-1: SerialNumber: syz [ 92.242193][ T5988] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 92.406431][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 92.522591][ T5988] ip6erspan0: entered allmulticast mode [ 92.559239][ T1220] usb 4-1: USB disconnect, device number 4 [ 92.563147][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 92.574595][ T9] usb 3-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 92.596357][ T9] usb 3-1: string descriptor 0 read error: -22 [ 92.596493][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.647987][ T9] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 92.826857][ T9] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 92.841082][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 92.894612][ T9] usb 3-1: USB disconnect, device number 3 [ 92.983061][ T5971] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 93.038538][ T6013] fuse: Unknown parameter '' [ 93.115775][ T5971] usb 5-1: device descriptor read/64, error -71 [ 93.313387][ T6016] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.313977][ T6016] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.355177][ T5971] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 93.420227][ T6023] netlink: 72 bytes leftover after parsing attributes in process `syz.1.92'. [ 93.514214][ T5971] usb 5-1: device descriptor read/64, error -71 [ 93.597947][ T6016] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 93.601223][ T6027] faux_driver vgem: [drm] Unknown color mode 268435463; guessing buffer size. [ 93.625250][ T5971] usb usb5-port1: attempt power cycle [ 93.631035][ T6016] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 93.843914][ T50] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.845707][ T1009] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.845734][ T1009] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.845752][ T1009] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.850148][ T6030] 8021q: VLANs not supported on gre0 [ 93.944696][ T6038] FAULT_INJECTION: forcing a failure. [ 93.944696][ T6038] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 93.944725][ T6038] CPU: 0 UID: 0 PID: 6038 Comm: syz.1.96 Not tainted syzkaller #0 PREEMPT(full) [ 93.944744][ T6038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.944754][ T6038] Call Trace: [ 93.944761][ T6038] [ 93.944769][ T6038] dump_stack_lvl+0xe8/0x150 [ 93.944795][ T6038] should_fail_ex+0x410/0x560 [ 93.944816][ T6038] _copy_from_user+0x2d/0xb0 [ 93.944835][ T6038] ___sys_sendmsg+0x1c6/0x360 [ 93.944855][ T6038] ? __lock_acquire+0x747/0x2de0 [ 93.944873][ T6038] ? __pfx____sys_sendmsg+0x10/0x10 [ 93.944895][ T6038] ? __schedule+0x17f1/0x58f0 [ 93.944932][ T6038] ? __fget_files+0x2a/0x420 [ 93.944950][ T6038] ? __fget_files+0x3a2/0x420 [ 93.944976][ T6038] __x64_sys_sendmsg+0x1b1/0x290 [ 93.944998][ T6038] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 93.945032][ T6038] do_syscall_64+0x166/0x520 [ 93.945049][ T6038] ? trace_irq_disable+0x3b/0x140 [ 93.945064][ T6038] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.945079][ T6038] ? clear_bhb_loop+0x70/0xc0 [ 93.945097][ T6038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.945111][ T6038] RIP: 0033:0x7f174459e159 [ 93.945124][ T6038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.945135][ T6038] RSP: 002b:00007f17453ac028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.945151][ T6038] RAX: ffffffffffffffda RBX: 00007f1744825fa0 RCX: 00007f174459e159 [ 93.945161][ T6038] RDX: 000000000000c094 RSI: 0000200000000200 RDI: 0000000000000003 [ 93.945170][ T6038] RBP: 00007f17453ac090 R08: 0000000000000000 R09: 0000000000000000 [ 93.945178][ T6038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 93.945187][ T6038] R13: 00007f1744826038 R14: 00007f1744825fa0 R15: 00007f174494fa48 [ 93.945209][ T6038] [ 93.976129][ T5971] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 94.017758][ T5971] usb 5-1: device descriptor read/8, error -71 [ 94.307952][ T5971] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 94.417745][ T5971] usb 5-1: device descriptor read/8, error -71 [ 94.547587][ T5971] usb usb5-port1: unable to enumerate USB device [ 94.734802][ T6059] netlink: 12 bytes leftover after parsing attributes in process `syz.0.104'. [ 94.804766][ T6061] netlink: 16 bytes leftover after parsing attributes in process `syz.3.105'. [ 94.812854][ T6061] veth1_to_team: entered promiscuous mode [ 94.824979][ T6061] veth1_to_team: left promiscuous mode [ 95.159735][ T6064] netlink: 72 bytes leftover after parsing attributes in process `syz.1.106'. [ 98.793000][ C1] sched: DL replenish lagged too much [ 99.999127][ T0] NOHZ tick-stop error: local softirq work is pending, handler #ca!!! [ 100.519712][ T0] NOHZ tick-stop error: local softirq work is pending, handler #4a!!! [ 100.539667][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 100.579097][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 101.109615][ T0] NOHZ tick-stop error: local softirq work is pending, handler #10a!!! [ 101.150139][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 101.188759][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 101.538856][ T0] NOHZ tick-stop error: local softirq work is pending, handler #48!!! [ 101.560117][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 101.579899][ T0] NOHZ tick-stop error: local softirq work is pending, handler #88!!! [ 191.054856][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 191.068416][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 234.175920][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 234.188130][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 237.933632][ T5615] Bluetooth: hci2: command tx timeout [ 237.933674][ T5615] Bluetooth: hci4: command tx timeout [ 237.933700][ T5615] Bluetooth: hci1: command 0x0406 tx timeout [ 237.933784][ T5615] Bluetooth: hci0: command 0x0406 tx timeout [ 237.933827][ T5615] Bluetooth: hci3: command 0x0406 tx timeout [ 254.468657][ T31] INFO: task kworker/0:0:9 blocked for more than 143 seconds. [ 254.468683][ T31] Not tainted syzkaller #0 [ 254.468693][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 254.468707][ T31] task:kworker/0:0 state:D stack:22080 pid:9 tgid:9 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 254.468759][ T31] Workqueue: events reg_todo [ 254.468801][ T31] Call Trace: [ 254.468808][ T31] [ 254.468820][ T31] __schedule+0x17db/0x58f0 [ 254.468847][ T31] ? update_protect_slice+0x128/0x210 [ 254.468897][ T31] ? do_raw_spin_unlock+0xf5/0x200 [ 254.468930][ T31] ? __pfx___schedule+0x10/0x10 [ 254.468960][ T31] ? schedule+0x90/0x2b0 [ 254.468985][ T31] schedule+0x164/0x2b0 [ 254.469009][ T31] schedule_preempt_disabled+0x13/0x30 [ 254.469030][ T31] __mutex_lock+0x7c1/0x1550 [ 254.469059][ T31] ? __mutex_lock+0x5d4/0x1550 [ 254.469086][ T31] ? reg_process_self_managed_hints+0x8d/0x160 [ 254.469111][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 254.469133][ T31] ? reg_process_self_managed_hint+0x1ab/0x4d0 [ 254.469155][ T31] ? __pfx_reg_process_self_managed_hint+0x10/0x10 [ 254.469184][ T31] ? preempt_schedule_common+0x7f/0xd0 [ 254.469205][ T31] ? reg_todo+0x8da/0xa40 [ 254.469225][ T31] ? preempt_schedule_thunk+0x16/0x40 [ 254.469251][ T31] reg_process_self_managed_hints+0x8d/0x160 [ 254.469276][ T31] reg_todo+0x8df/0xa40 [ 254.469301][ T31] ? process_scheduled_works+0x97a/0x1630 [ 254.469326][ T31] process_scheduled_works+0xc3d/0x1630 [ 254.469380][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 254.469411][ T31] ? assign_work+0x3cf/0x5d0 [ 254.469439][ T31] worker_thread+0xa47/0xfb0 [ 254.469491][ T31] kthread+0x38b/0x480 [ 254.469510][ T31] ? __pfx_worker_thread+0x10/0x10 [ 254.469533][ T31] ? __pfx_kthread+0x10/0x10 [ 254.469553][ T31] ret_from_fork+0x514/0xb70 [ 254.469574][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 254.469592][ T31] ? __switch_to+0xc89/0x1420 [ 254.469620][ T31] ? __pfx_kthread+0x10/0x10 [ 254.469640][ T31] ret_from_fork_asm+0x1a/0x30 [ 254.469684][ T31] [ 254.469840][ T31] INFO: task kworker/0:11:5971 blocked for more than 143 seconds. [ 254.469855][ T31] Not tainted syzkaller #0 [ 254.469864][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 254.469872][ T31] task:kworker/0:11 state:D stack:27112 pid:5971 tgid:5971 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 254.469930][ T31] Workqueue: events_power_efficient crda_timeout_work [ 254.469953][ T31] Call Trace: [ 254.469959][ T31] [ 254.469970][ T31] __schedule+0x17db/0x58f0 [ 254.470021][ T31] ? __pfx___schedule+0x10/0x10 [ 254.470051][ T31] ? schedule+0x90/0x2b0 [ 254.470076][ T31] schedule+0x164/0x2b0 [ 254.470099][ T31] schedule_preempt_disabled+0x13/0x30 [ 254.470120][ T31] __mutex_lock+0x7c1/0x1550 [ 254.470149][ T31] ? __mutex_lock+0x5d4/0x1550 [ 254.470176][ T31] ? crda_timeout_work+0x16/0x80 [ 254.470201][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 254.470239][ T31] ? rcu_is_watching+0x16/0xb0 [ 254.470261][ T31] ? process_scheduled_works+0x97a/0x1630 [ 254.470286][ T31] crda_timeout_work+0x16/0x80 [ 254.470308][ T31] process_scheduled_works+0xc3d/0x1630 [ 254.470362][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 254.470391][ T31] ? assign_work+0x3cf/0x5d0 [ 254.470420][ T31] worker_thread+0xa47/0xfb0 [ 254.470458][ T31] ? __kthread_parkme+0x71/0x1f0 [ 254.470494][ T31] kthread+0x38b/0x480 [ 254.470513][ T31] ? __pfx_worker_thread+0x10/0x10 [ 254.470535][ T31] ? __pfx_kthread+0x10/0x10 [ 254.470555][ T31] ret_from_fork+0x514/0xb70 [ 254.470576][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 254.470594][ T31] ? __switch_to+0xc89/0x1420 [ 254.470621][ T31] ? __pfx_kthread+0x10/0x10 [ 254.470640][ T31] ret_from_fork_asm+0x1a/0x30 [ 254.470684][ T31] [ 254.470705][ T31] [ 254.470705][ T31] Showing all locks held in the system: [ 254.470712][ T31] locks held by kthreadd/2: 2, last CPU#0: [ 254.470725][ T31] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 254.470771][ T31] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 254.470820][ T31] locks held by kworker/0:0/9: 4, on CPU#0: [ 254.470832][ T31] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.470881][ T31] #1: ffffc900000e7c40 (reg_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.470936][ T31] #2: ffffffff90254c80 (rtnl_mutex){+.+.}-{4:4}, at: reg_todo+0x1c/0xa40 [ 254.470981][ T31] #3: ffff888055310800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_process_self_managed_hints+0x8d/0x160 [ 254.471029][ T31] locks held by kworker/0:1/10: 3, last CPU#0: [ 254.471041][ T31] #0: ffff8880324e3d40 ((wq_completion)wg-kex-wg2#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.471094][ T31] #1: ffffc900000f7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.471153][ T31] #2: ffff88802c1e0d18 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 254.471208][ T31] locks held by kworker/u8:0/12: 3, last CPU#0: [ 254.471220][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.471269][ T31] #1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.471318][ T31] #2: ffff888055310800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 254.471362][ T31] locks held by kworker/u8:1/13: 3, last CPU#0: [ 254.471375][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.471423][ T31] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.471470][ T31] #2: ffff888055530800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 254.471516][ T31] locks held by khungtaskd/31: 1, last CPU#0: [ 254.471529][ T31] #0: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 254.471572][ T31] locks held by kworker/u8:2/42: 6, last CPU#0: [ 254.471585][ T31] #0: ffff888020ab6140 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.471632][ T31] #1: ffffc90000b27c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.471678][ T31] #2: ffff8880349c20e8 (&type->s_umount_key#34){++++}-{4:4}, at: super_trylock_shared+0x23/0xf0 [ 254.471732][ T31] #3: ffff8880349c0c98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x205/0x3b0 [ 254.471777][ T31] #4: ffff8880349d6938 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1fbf/0x2200 [ 254.471825][ T31] #5: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 254.471868][ T31] locks held by kworker/1:1/44: 2, last CPU#1: [ 254.471880][ T31] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.471937][ T31] #1: ffffc90000b47c40 ((work_completion)(&(&tbl->gc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.471987][ T31] locks held by kworker/u8:3/50: 3, last CPU#0: [ 254.471999][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.472048][ T31] #1: ffffc90000bb7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.472096][ T31] #2: ffff8880557b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 254.472140][ T31] locks held by kworker/u9:0/52: 5, on CPU#1: [ 254.472152][ T31] #0: ffff888033073140 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.472200][ T31] #1: ffffc90000bd7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.472249][ T31] #2: ffff88807a254ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 254.472293][ T31] #3: ffff88807a2540b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 254.472342][ T31] #4: ffffffff903dbd40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 254.472391][ T31] locks held by kworker/u8:4/60: 3, last CPU#0: [ 254.472403][ T31] #0: ffff8880342c3140 ((wq_completion)wg-kex-wg0#5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.472457][ T31] #1: ffffc9000202fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.472506][ T31] #2: ffff88802c1e3698 (&cookie->lock){++++}-{4:4}, at: wg_cookie_add_mac_to_packet+0x3e/0x1a0 [ 254.472558][ T31] locks held by kworker/u8:5/95: 3, last CPU#0: [ 254.472570][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.472619][ T31] #1: ffffc90002507c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.472669][ T31] #2: ffff888033660258 (&devlink->lock_key#3){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 254.472729][ T31] locks held by kworker/u8:6/200: 3, last CPU#0: [ 254.472742][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.472790][ T31] #1: ffffc90002edfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.472839][ T31] #2: ffff888055170800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 254.472883][ T31] locks held by kworker/1:2/989: 3, last CPU#1: [ 254.472901][ T31] #0: ffff888057358940 ((wq_completion)wg-kex-wg1#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.490059][ T31] #1: ffffc90004bf7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.490134][ T31] #2: ffff88802c1e5c58 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 254.490192][ T31] locks held by kworker/u8:7/1009: 4, last CPU#0: [ 254.490205][ T31] #0: ffff8880342c0940 ((wq_completion)wg-kex-wg2#3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.490259][ T31] #1: ffffc9000400fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.490309][ T31] #2: ffff88807f7b9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 254.490363][ T31] #3: ffff88802c1e4888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 254.490416][ T31] locks held by kworker/u8:8/1155: 3, last CPU#0: [ 254.490428][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.490477][ T31] #1: ffffc900050b7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.490527][ T31] #2: ffff88807d343258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 254.490585][ T31] locks held by kworker/0:3/1220: 4, on CPU#0: [ 254.490597][ T31] #0: ffff888057358940 ((wq_completion)wg-kex-wg1#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.490650][ T31] #1: ffffc90005377c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.490710][ T31] #2: ffff88807ed91440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 254.490764][ T31] #3: ffff88802c1e5c58 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x59c/0x9b0 [ 254.490828][ T31] locks held by kworker/R-ipv6_/3195: 3, on CPU#1: [ 254.490840][ T31] #0: ffff888032c79140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.490920][ T31] #1: ffffc9000dcb7c20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.490968][ T31] #2: ffffffff90254c80 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 254.491016][ T31] locks held by kworker/R-bat_e/3226: 3, last CPU#1: [ 254.491029][ T31] #0: ffff888032f57140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.491075][ T31] #1: ffffc9000ddc7c20 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.491124][ T31] #2: ffffffff8ed5ca40 (rcu_callback){....}-{0:0}, at: rcu_core+0x8a8/0x1260 [ 254.491169][ T31] locks held by kworker/u9:1/4931: 4, on CPU#0: [ 254.491182][ T31] #0: ffff888076b33140 ((wq_completion)hci2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.491231][ T31] #1: ffffc900101d7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.491279][ T31] #2: ffff888033008ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 254.491324][ T31] #3: ffff8880330080b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 254.491374][ T31] locks held by klogd/4971: 1, last CPU#0: [ 254.491386][ T31] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 254.491429][ T31] locks held by udevd/4982: 3, last CPU#0: [ 254.491442][ T31] #0: ffffffff8f4f2a38 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 254.491487][ T31] #1: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 254.491528][ T31] #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x4a0 [ 254.491575][ T31] locks held by dhcpcd/5276: 1, last CPU#0: [ 254.491587][ T31] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 254.491630][ T31] locks held by getty/5373: 2, on CPU#0: [ 254.491642][ T31] #0: ffff8880362260a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 254.491694][ T31] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 254.491742][ T31] locks held by syz-executor/5603: 1, last CPU#0: [ 254.491753][ T31] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 254.491792][ T31] locks held by kworker/u9:4/5620: 5, on CPU#1: [ 254.491804][ T31] #0: ffff888033075140 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.491852][ T31] #1: ffffc90003effc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.491906][ T31] #2: ffff88802a734ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 254.491946][ T31] #3: ffff88802a7340b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 254.491993][ T31] #4: ffffffff903dbd40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 254.492041][ T31] locks held by kworker/0:4/5621: 2, last CPU#0: [ 254.492054][ T31] #0: ffff888057358540 ((wq_completion)wg-crypt-wg1#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.492107][ T31] #1: ffffc90003f1fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.492158][ T31] locks held by kworker/u9:6/5627: 5, on CPU#1: [ 254.492170][ T31] #0: ffff888034b7b140 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.492218][ T31] #1: ffffc90003f6fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.492267][ T31] #2: ffff888079e54ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 254.492310][ T31] #3: ffff888079e540b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 254.492357][ T31] #4: ffffffff903dbd40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 254.492404][ T31] locks held by kworker/u9:7/5628: 7, on CPU#0: [ 254.492417][ T31] #0: ffff88807fad9140 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.492465][ T31] #1: ffffc90003f7fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.492514][ T31] #2: ffff888021b64ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 254.492555][ T31] #3: ffff888021b640b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 254.492604][ T31] #4: ffffffff903dbd40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 254.492652][ T31] #5: ffff88807fadf2f8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x550 [ 254.492708][ T31] #6: ffffffff8ed62ce8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 254.492758][ T31] locks held by syz-executor/5631: 3, last CPU#0: [ 254.492769][ T31] #0: ffffffff8f4f2a38 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_check_open_permission+0x1d3/0x470 [ 254.492815][ T31] #1: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 254.492858][ T31] #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: page_ext_get+0x22/0x2e0 [ 254.492909][ T31] locks held by syz-executor/5634: 1, last CPU#0: [ 254.492922][ T31] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 254.510429][ T31] locks held by kworker/0:6/5677: 2, last CPU#0: [ 254.510444][ T31] #0: ffff888035104d40 ((wq_completion)wg-crypt-wg2#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.510500][ T31] #1: ffffc900041afc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.510550][ T31] locks held by kworker/0:7/5684: 4, last CPU#0: [ 254.510562][ T31] #0: ffff888057359140 ((wq_completion)wg-kex-wg1#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.510616][ T31] #1: ffffc9000422fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.510675][ T31] #2: ffff88807ed95440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x14e/0x9f0 [ 254.510729][ T31] #3: ffff88802c1e20e8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x15f/0x9f0 [ 254.510785][ T31] locks held by kworker/1:5/5699: 2, last CPU#1: [ 254.510798][ T31] #0: ffff888057358540 ((wq_completion)wg-crypt-wg1#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.510851][ T31] #1: ffffc90004737c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.510919][ T31] locks held by kworker/1:10/5964: 5, last CPU#1: [ 254.510932][ T31] #0: ffff88801b06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.510981][ T31] #1: ffffc9000491fc40 ((work_completion)(&hcd->wakeup_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.511029][ T31] #2: ffff888020fd51d8 (&dev->mutex){....}-{4:4}, at: usb_remote_wakeup+0x23/0x120 [ 254.511075][ T31] #3: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 254.511117][ T31] #4: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x4a0 [ 254.511165][ T31] locks held by kworker/1:11/5965: 3, last CPU#1: [ 254.511178][ T31] #0: ffff8880324e3d40 ((wq_completion)wg-kex-wg2#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.511230][ T31] #1: ffffc90005257c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.511289][ T31] #2: ffff888077e41440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 254.511345][ T31] locks held by kworker/0:9/5969: 3, last CPU#0: [ 254.511357][ T31] #0: ffff888035105140 ((wq_completion)wg-kex-wg2#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.511410][ T31] #1: ffffc90005337c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.511468][ T31] #2: ffff88807f7b9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 254.511522][ T31] locks held by kworker/0:11/5971: 3, on CPU#0: [ 254.511535][ T31] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.511584][ T31] #1: ffffc90005357c40 ((crda_timeout).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.511632][ T31] #2: ffffffff90254c80 (rtnl_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x16/0x80 [ 254.511679][ T31] locks held by kworker/0:12/5972: 2, last CPU#0: [ 254.511692][ T31] #0: ffff8880324e3540 ((wq_completion)wg-crypt-wg2#3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.511745][ T31] #1: ffffc90004dd7c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 254.511796][ T31] locks held by syz.4.87/6006: 2, last CPU#0: [ 254.511808][ T31] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 254.511850][ T31] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 254.511901][ T31] locks held by syz.0.104/6058: 1, on CPU#0: [ 254.511914][ T31] #0: ffffffff8ed62ce8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 254.511964][ T31] locks held by syz.3.105/6061: 2, last CPU#0: [ 254.511977][ T31] #0: ffff88802aa469b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 254.512026][ T31] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 254.512075][ T31] [ 254.512080][ T31] ============================================= [ 254.512080][ T31] [ 254.512103][ T31] NMI backtrace for cpu 0 [ 254.512122][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 254.512164][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 254.512185][ T31] Call Trace: [ 254.512197][ T31] [ 254.512209][ T31] dump_stack_lvl+0xe8/0x150 [ 254.512264][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 254.512306][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 254.512369][ T31] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 254.512400][ T31] sys_info+0x135/0x170 [ 254.512424][ T31] watchdog+0xfd7/0x1030 [ 254.512450][ T31] ? watchdog+0x1c7/0x1030 [ 254.512474][ T31] kthread+0x38b/0x480 [ 254.512493][ T31] ? __pfx_watchdog+0x10/0x10 [ 254.512508][ T31] ? __pfx_kthread+0x10/0x10 [ 254.512527][ T31] ret_from_fork+0x514/0xb70 [ 254.512548][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 254.512565][ T31] ? __switch_to+0xc89/0x1420 [ 254.512592][ T31] ? __pfx_kthread+0x10/0x10 [ 254.512611][ T31] ret_from_fork_asm+0x1a/0x30 [ 254.512652][ T31] [ 254.512659][ T31] Sending NMI from CPU 0 to CPUs 1: [ 254.512692][ C1] NMI backtrace for cpu 1 [ 254.512707][ C1] CPU: 1 UID: 0 PID: 3226 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full) [ 254.512751][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 254.512775][ C1] Workqueue: bat_events batadv_tt_purge [ 254.512813][ C1] RIP: 0010:synproxy_send_client_synack+0x349/0xde0 [ 254.512858][ C1] Code: 42 0f b6 04 28 84 c0 0f 85 ee 06 00 00 66 c7 03 40 00 48 8b 44 24 58 48 8d 98 c0 09 00 00 48 89 d8 48 c1 e8 03 42 0f b6 04 28 <84> c0 0f 85 e5 06 00 00 0f b6 1b 49 8d 7f 08 48 89 f8 48 c1 e8 03 [ 254.512873][ C1] RSP: 0018:ffffc90000a18340 EFLAGS: 00000a06 [ 254.512888][ C1] RAX: 0000000000000000 RBX: ffff888079195940 RCX: ffff888032fbddc0 [ 254.512902][ C1] RDX: 8000000000000100 RSI: 0000000000000100 RDI: ffff88816a321804 [ 254.512915][ C1] RBP: ffffc90000a18450 R08: 0000000000000100 R09: 1ffff1102d46430c [ 254.512929][ C1] R10: dffffc0000000000 R11: ffffed102d46430d R12: ffff8881696a5b40 [ 254.512946][ C1] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88816a321800 [ 254.512958][ C1] FS: 0000000000000000(0000) GS:ffff888124dca000(0000) knlGS:0000000000000000 [ 254.512971][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 254.512982][ C1] CR2: 000055555ba24a38 CR3: 000000000eb48000 CR4: 00000000003526f0 [ 254.512998][ C1] Call Trace: [ 254.513004][ C1] [ 254.513018][ C1] ? __pfx_synproxy_send_client_synack+0x10/0x10 [ 254.513043][ C1] ? nft_socket_cgroup_subtree_level+0x154/0x340 [ 254.513068][ C1] ? synproxy_pernet+0x45/0x270 [ 254.513097][ C1] nft_synproxy_eval_v4+0x362/0x4e0 [ 254.513126][ C1] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 254.513152][ C1] ? nf_ip_checksum+0x13c/0x510 [ 254.513179][ C1] nft_synproxy_do_eval+0x389/0x5d0 [ 254.513207][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 254.513233][ C1] ? __lock_acquire+0x747/0x2de0 [ 254.513254][ C1] ? __lock_acquire+0x747/0x2de0 [ 254.513277][ C1] nft_do_chain+0x48d/0x1b10 [ 254.513310][ C1] ? __lock_acquire+0x747/0x2de0 [ 254.513329][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 254.513358][ C1] ? __local_bh_enable_ip+0xd6/0x140 [ 254.513392][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 254.513430][ C1] nft_do_chain_ipv4+0x195/0x290 [ 254.513455][ C1] ? ipt_do_table+0x2b9/0x15d0 [ 254.513479][ C1] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 254.513507][ C1] ? iptable_mangle_hook+0x18a/0x4c0 [ 254.513536][ C1] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 254.513563][ C1] nf_hook_slow+0xc5/0x220 [ 254.513587][ C1] NF_HOOK+0x21f/0x3c0 [ 254.513613][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 254.513638][ C1] ? NF_HOOK+0x9e/0x3c0 [ 254.513662][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 254.513688][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 254.513718][ C1] ? ip_local_deliver+0x113/0x190 [ 254.513745][ C1] NF_HOOK+0x336/0x3c0 [ 254.513769][ C1] ? process_scheduled_works+0xc3d/0x1630 [ 254.513794][ C1] ? rescuer_thread+0x7c5/0x10e0 [ 254.513822][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 254.513847][ C1] ? NF_HOOK+0x9e/0x3c0 [ 254.513871][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 254.513896][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 254.513922][ C1] ? ip_rcv_core+0x88d/0xd50 [ 254.513948][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 254.513973][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 254.513999][ C1] process_backlog+0xa6b/0x18b0 [ 254.514025][ C1] ? process_backlog+0x3de/0x18b0 [ 254.514055][ C1] __napi_poll+0xaa/0x330 [ 254.514076][ C1] net_rx_action+0x61d/0xf50 [ 254.514105][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 254.514127][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 254.514155][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 254.514183][ C1] handle_softirqs+0x226/0x860 [ 254.514210][ C1] ? do_softirq+0x77/0xd0 [ 254.514236][ C1] ? batadv_tt_purge+0x4ae/0xa10 [ 254.514256][ C1] do_softirq+0x77/0xd0 [ 254.514280][ C1] [ 254.514286][ C1] [ 254.514293][ C1] __local_bh_enable_ip+0x100/0x140 [ 254.514319][ C1] batadv_tt_purge+0x4ae/0xa10 [ 254.514342][ C1] ? process_scheduled_works+0x97a/0x1630 [ 254.514368][ C1] process_scheduled_works+0xc3d/0x1630 [ 254.514415][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 254.514438][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 254.514469][ C1] ? assign_work+0x3af/0x5d0 [ 254.514496][ C1] rescuer_thread+0x7c5/0x10e0 [ 254.514527][ C1] ? rescuer_thread+0xb8/0x10e0 [ 254.514564][ C1] kthread+0x38b/0x480 [ 254.514583][ C1] ? __pfx_rescuer_thread+0x10/0x10 [ 254.514610][ C1] ? __pfx_kthread+0x10/0x10 [ 254.514629][ C1] ret_from_fork+0x514/0xb70 [ 254.514648][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 254.514666][ C1] ? __switch_to+0xc89/0x1420 [ 254.514693][ C1] ? __pfx_kthread+0x10/0x10 [ 254.514712][ C1] ret_from_fork_asm+0x1a/0x30 [ 254.514749][ C1] [ 254.799551][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 257.543111][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 257.552226][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 257.562285][ T31] Call Trace: [ 257.565574][ T31] [ 257.568511][ T31] vpanic+0x56d/0xa60 [ 257.572511][ T31] ? __pfx___schedule+0x10/0x10 [ 257.577373][ T31] ? __pfx_vpanic+0x10/0x10 [ 257.581901][ T31] panic+0xc5/0xd0 [ 257.585637][ T31] ? __pfx_panic+0x10/0x10 [ 257.590060][ T31] ? preempt_schedule_common+0x7f/0xd0 [ 257.595534][ T31] ? preempt_schedule_thunk+0x16/0x40 [ 257.600915][ T31] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 257.607085][ T31] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 257.613249][ T31] watchdog+0x1030/0x1030 [ 257.617599][ T31] ? watchdog+0x1c7/0x1030 [ 257.622027][ T31] kthread+0x38b/0x480 [ 257.626102][ T31] ? __pfx_watchdog+0x10/0x10 [ 257.630799][ T31] ? __pfx_kthread+0x10/0x10 [ 257.635405][ T31] ret_from_fork+0x514/0xb70 [ 257.640003][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 257.645120][ T31] ? __switch_to+0xc89/0x1420 [ 257.649902][ T31] ? __pfx_kthread+0x10/0x10 [ 257.654505][ T31] ret_from_fork_asm+0x1a/0x30 [ 257.659300][ T31] [ 257.662600][ T31] Kernel Offset: disabled [ 257.666921][ T31] Rebooting in 86400 seconds..