last executing test programs: 3m44.08417168s ago: executing program 4 (id=406): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x0) write$P9_RREADDIR(r5, &(0x7f00000005c0)={0x4e, 0x29, 0x2, {0x2, [{{0x80, 0x0, 0x7}, 0x7ff, 0x80, 0x21, './debug/ieee80211/phy0/aql_enable'}]}}, 0x44) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000014c0)={@private, @multicast2}, &(0x7f0000001500)=0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r7, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r8, @ANYRES32=r8], 0x44}}, 0x2000800) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x58}, 0x1a2) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000300), 0x0) socket(0x40000000015, 0x5, 0x0) 3m42.851745363s ago: executing program 4 (id=407): openat$iommufd(0xffffffffffffff9c, 0x0, 0x88800, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r4, &(0x7f00000002c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback={0x0, 0xfffd}, 0x280020}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) 3m40.773591151s ago: executing program 4 (id=408): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x20) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='gid_map\x00') copy_file_range(r0, 0x0, r0, &(0x7f0000000080)=0xfffffffffffffff7, 0x8, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0xc) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, 0x0, 0x0) ioctl$XFS_IOC_GETBMAP(r2, 0xc0205826, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xc, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r4, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./tracing/events/enable\x00', 0x1, 0xc1) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x20) r6 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/netfilter\x00') lseek(r6, 0x1000000, 0x0) write(r5, &(0x7f0000000800)='0', 0x1) add_key$user(0x0, &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000140)="1f", 0x1, 0xfffffffffffffffe) add_key(&(0x7f0000000100)='asymmetric\x00', 0x0, &(0x7f00000001c0)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669630000000000000008666963617428a2e0861e1ae90d412073656c662d744a5374696e67206b65793059301306072a8648ce3d020106082a8648c93d0301070342000407e56b51affc19412c88926b775771039be2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301683142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000600)=ANY=[@ANYBLOB="550a0000000000006111780000000000180000000000000000000000000000009500000000000000384e719e7eab957623ae3b036ab8eedc8528da6d9a584714ef161763be26032d5fd7b55991540a078a273b858e0a3c91601ebdf2404399318a231f6a46fdfc5fac47c0e404746384ae59194c9e30a5e15d"], &(0x7f0000000000)='GPL\x00'}, 0x80) add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) add_key$user(&(0x7f0000006400), &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000400)="3e12d23d346cfdeb1716f738374bc1c03bee4423fa20837e6e86b86592e9be83d8ebbbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e43eba0b67b516be14a8b51a75bfd611b2d7ae6a21d056c2c5116a416a76b1a03dc55ea62d43c809e0ed6e56163fdab317afd5c34d614367e4425bb9a97e39fea3859296659bf4c2467159227ee717f4e959ac989e03926c4e20c2cda4efd37be90f502fd03e4748564d9694e12c10e5e09a6f74d38cf912a8675e4278b61daeede1cb2379ae16ed2e6", 0xcb, 0xfffffffffffffffe) 3m34.655762143s ago: executing program 4 (id=413): rt_tgsigqueueinfo(0x0, 0x0, 0x1b, &(0x7f0000000280)={0xc, 0x0, 0x4}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r0, 0x84, 0x17, &(0x7f0000000000), 0x10) r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x44e, 0x120b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xba4e7a40265e5c6b, 0x2c, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x8000, 0x9, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0xfc, 0x8}}}}}]}}]}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000a40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x0}) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, 0x0, 0x0) 3m28.068859708s ago: executing program 4 (id=421): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket(0x28, 0x1, 0x28) mount(&(0x7f0000000300)=@filename='./dev\x00', &(0x7f0000000200)='./dev\x00', &(0x7f0000000040)='romfs\x00', 0x0, 0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x6d, 0x0, &(0x7f0000002480)={0x5, 0xfffffffd, [0xbed, 0xabc, 0x379, 0x5c9]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x7, 0x4, 0x900, 0x6, 0x28, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x5, 0x8, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x3}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$I2C(&(0x7f0000000d80), 0x0, 0x101902) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r5, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x8446}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000100)={r6, 0x1}, 0x8) 3m24.82990096s ago: executing program 4 (id=425): r0 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) socket(0xa, 0x3, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000300)={0xf0f043, 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000300), 0x111, 0xa}}, 0x20) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) setsockopt$inet_mreqsrc(r2, 0x0, 0x28, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) socket$inet(0x2, 0x2, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0x8c, 0x24, 0x601, 0x1000000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xc}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x1, 0x0, 0x0, 0x0, 0xffff]}}]}}]}, 0x8c}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r3, 0x1, 0x3b, &(0x7f00000014c0)=""/145, &(0x7f0000000000)=0x91) r4 = socket$phonet(0x23, 0x2, 0x1) r5 = socket$kcm(0x29, 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001dc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad0e0e2b45d14ee446b840edaa1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c50ce6a8e9f65de13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87915ed063f608dddb03a95b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0fd9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000c3d51d9a161446b4373e06a9e07f8a000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b2844869"], &(0x7f0000000140)='GPL\x00'}, 0x48) r7 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r7, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000040)={r7, r6}) setsockopt$sock_int(r7, 0x1, 0x20, &(0x7f0000000180)=0x3, 0x4) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r8, 0x0, 0xe, 0x0, &(0x7f00000000c0)="00000000000000ce94327fc1a80c", 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r9 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x30, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r9, 0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bind$phonet(r4, &(0x7f0000000140)={0x23, 0x3, 0x10, 0x7}, 0x10) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c01000019000100000000000000000000000000000000000000000000000000640101020000000000000000000000000000fffd000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000000000000000000000000000000000000000000000000500000000000000faffb86b6e00000100000000000084000500ac1414aa000000000000000000000000000000002b0000000a000000ffffffff00000000000000000000000000000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000fe800000000000000000000000000030004000"/244], 0x13c}, 0x1, 0x0, 0x0, 0x9}, 0x4040000) 3m8.698632088s ago: executing program 32 (id=425): r0 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) socket(0xa, 0x3, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000300)={0xf0f043, 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000300), 0x111, 0xa}}, 0x20) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) setsockopt$inet_mreqsrc(r2, 0x0, 0x28, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) socket$inet(0x2, 0x2, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0x8c, 0x24, 0x601, 0x1000000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xc}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x1, 0x0, 0x0, 0x0, 0xffff]}}]}}]}, 0x8c}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r3, 0x1, 0x3b, &(0x7f00000014c0)=""/145, &(0x7f0000000000)=0x91) r4 = socket$phonet(0x23, 0x2, 0x1) r5 = socket$kcm(0x29, 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001dc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad0e0e2b45d14ee446b840edaa1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c50ce6a8e9f65de13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87915ed063f608dddb03a95b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0fd9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000c3d51d9a161446b4373e06a9e07f8a000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b2844869"], &(0x7f0000000140)='GPL\x00'}, 0x48) r7 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r7, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000040)={r7, r6}) setsockopt$sock_int(r7, 0x1, 0x20, &(0x7f0000000180)=0x3, 0x4) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r8, 0x0, 0xe, 0x0, &(0x7f00000000c0)="00000000000000ce94327fc1a80c", 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r9 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x30, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r9, 0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bind$phonet(r4, &(0x7f0000000140)={0x23, 0x3, 0x10, 0x7}, 0x10) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c01000019000100000000000000000000000000000000000000000000000000640101020000000000000000000000000000fffd000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000000000000000000000000000000000000000000000000500000000000000faffb86b6e00000100000000000084000500ac1414aa000000000000000000000000000000002b0000000a000000ffffffff00000000000000000000000000000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000fe800000000000000000000000000030004000"/244], 0x13c}, 0x1, 0x0, 0x0, 0x9}, 0x4040000) 1m14.399001304s ago: executing program 3 (id=677): syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000340)='.\x00', &(0x7f0000000400), 0x6, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000340)={0x0, 0x328000, 0x800, 0x9, 0x3}, 0x20) 1m14.088657423s ago: executing program 3 (id=678): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x6c}}, 0x4) 1m13.819552683s ago: executing program 3 (id=680): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socket(0x40000000015, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(des)\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socket(0x40000000015, 0x5, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x103401, 0x0) write$dsp(r2, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0x40045010, &(0x7f0000000040)=0x5f) ioctl$SNDCTL_DSP_RESET(r2, 0x5000, 0x0) 1m12.76576286s ago: executing program 3 (id=681): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket(0x28, 0x1, 0x28) mount(&(0x7f0000000300)=@filename='./dev\x00', &(0x7f0000000200)='./dev\x00', &(0x7f0000000040)='romfs\x00', 0x0, 0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_ethernet(0x6d, 0x0, &(0x7f0000002480)={0x5, 0xfffffffd, [0xbed, 0xabc, 0x379, 0x5c9]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x7, 0x4, 0x900, 0x6, 0x28, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x5, 0x8, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x3}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x8446}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000100)={r5, 0x1}, 0x8) 1m11.4337763s ago: executing program 3 (id=682): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x98}, 0x1a2) r5 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r5, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x14, 0x4}) socket(0x29, 0x3, 0x6) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r5, 0x40026f34, &(0x7f0000000040)=0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/mass_storage.usb0/num_buffers\x00', 0x1, 0x0) rmdir(0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x2, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x8, 0x40040001, 0x335}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 1m9.358979227s ago: executing program 3 (id=683): mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x30) r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, 0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r0, 0x0, r1, r2, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x6, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x317}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x0, 0x1, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x1000, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x2000, 0x2, 0xba}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r3, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) setsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, &(0x7f0000000340)={0x3, 0x1}, 0x2) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000), 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8000) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) 1m0.652688784s ago: executing program 5 (id=446): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$loop(&(0x7f0000000180), 0x75d, 0x2480) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_GET(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)={0x18, 0x1409, 0x1, 0x70bd2a, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x44810}, 0x840) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) r4 = socket$inet6(0xa, 0x80002, 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000001280)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r6, 0x84, 0x7a, &(0x7f0000000340)={r7, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) getsockopt$bt_hci(r5, 0x84, 0x6c, &(0x7f0000003140)=""/4095, &(0x7f0000000000)=0xfff) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000040)={0x200000000000001}, 0x8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0xf00, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 53.940241833s ago: executing program 33 (id=683): mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x30) r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, 0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r0, 0x0, r1, r2, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x6, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x317}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x0, 0x1, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x1000, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x2000, 0x2, 0xba}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r3, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) setsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, &(0x7f0000000340)={0x3, 0x1}, 0x2) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000), 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8000) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) 11.0093428s ago: executing program 0 (id=793): setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, 0x0, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000a80)={r2, r1, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xde9, &(0x7f0000000cc0)=ANY=[], 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$MRT_ADD_MFC_PROXY(r3, 0x0, 0xd2, &(0x7f0000000140)={@empty, @empty, 0x0, "1c6804d4a58b85e13e66ab6fafd10df8ab973be71cc99e43030305633956c3c4", 0xfffffc00, 0x9, 0xfffff536, 0xde5}, 0x3c) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x6, 'bridge0\x00', {0x2}, 0xdd40}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)={0x0, 'veth0_vlan\x00', {0x1}, 0x2}) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x4, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) 10.723453728s ago: executing program 0 (id=794): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x10, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x3, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, 0x0, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00000003c0)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e21, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, 0x108) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) connect$vsock_stream(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x2710, @hyper}, 0x10) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_init(0x4, 0x800) r2 = getpid() capset(&(0x7f0000000000)={0x20071026, r2}, &(0x7f0000000040)={0xc0f, 0x8, 0x9, 0x1, 0x0, 0xfff}) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000008c0)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) setsockopt$inet6_int(r3, 0x29, 0x42, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x40042c1) open$dir(&(0x7f0000000340)='./file1\x00', 0x212001, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) 9.428377647s ago: executing program 1 (id=796): syz_usb_connect(0x4, 0x0, 0x0, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x55, &(0x7f0000000840)=@string={0x55, 0x3, "428e1eaef454ecbf28e48657be835b354712296b98a5762c947658a865d45221e60fa594aceea5e4b0cbba920f862f6b11fc489afad77e5fb65be69911065a527ed906ea292c304d78f7fc1bc96510b29e9682"}}]}) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000880)=ANY=[@ANYBLOB="1c0000005e00019eb177", @ANYRES32=0x0], 0x1c}], 0x1, 0x0, 0x0, 0x810}, 0x0) 9.346889162s ago: executing program 2 (id=797): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r0 = socket(0x40000000015, 0x5, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(des)\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f0000000280), 0x0, 0x2, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="e64f2be8d3e7a2", 0x7) sendmsg$nl_route(r0, &(0x7f0000000600)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4c000}, 0x81) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x24044080) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x103401, 0x0) write$dsp(r5, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r5, 0x5001, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0x40045010, &(0x7f0000000040)=0x5f) ioctl$SNDCTL_DSP_RESET(r5, 0x5000, 0x0) 8.149558549s ago: executing program 2 (id=798): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x98}, 0x1a2) r5 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r5, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x14, 0x4}) 6.877998535s ago: executing program 2 (id=799): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x42) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f00008ec000/0x1000)=nil, 0x1000, 0xb635773f06ebbeee, 0x8031, r1, 0xc7f0c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r7, r8, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r7}, &(0x7f00000000c0), &(0x7f0000000700)=r6}, 0x20) sendmsg$inet(r5, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 6.687845255s ago: executing program 0 (id=800): mknod(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000140)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='nilfs2\x00', 0x0, 0x0) (fail_nth: 19) 5.50262363s ago: executing program 2 (id=801): ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000840)={'syztnl2\x00', &(0x7f0000000700)={'sit0\x00', 0x0, 0x7800, 0x1, 0x10001, 0x5, {{0x25, 0x4, 0x0, 0x3f, 0x94, 0x68, 0x0, 0x9, 0x29, 0x0, @rand_addr=0x64010101, @multicast2, {[@ra={0x94, 0x4}, @cipso={0x86, 0x10, 0x2, [{0x1, 0xa, "89ac16cca804d601"}]}, @timestamp_addr={0x44, 0x4, 0x82, 0x1, 0x6}, @noop, @lsrr={0x83, 0xb, 0x43, [@private=0xa010101, @multicast2]}, @lsrr={0x83, 0x17, 0x52, [@multicast1, @broadcast, @dev={0xac, 0x14, 0x14, 0x3d}, @loopback, @dev={0xac, 0x14, 0x14, 0x33}]}, @timestamp_addr={0x44, 0x44, 0x4e, 0x1, 0x3, [{@multicast2, 0x10001}, {@rand_addr=0x64010102, 0x400}, {@remote, 0x7}, {@multicast2, 0x1000}, {@multicast2, 0x30d9}, {@multicast1, 0xd8}, {@private=0xa010102, 0x6}, {@private=0xa010100, 0x4}]}]}}}}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioprio_set$uid(0x3, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x1, 0x325}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 5.405815258s ago: executing program 1 (id=802): unshare(0x2040600) r0 = open(&(0x7f0000000000)='./file1\x00', 0x109042, 0x0) fcntl$addseals(r0, 0x409, 0x8e3652a1e0b94d91) 4.983298608s ago: executing program 1 (id=803): setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, 0x0, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000a80)={r2, r1, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0xde9, &(0x7f0000000cc0)=ANY=[], 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$MRT_ADD_MFC_PROXY(r3, 0x0, 0xd2, &(0x7f0000000140)={@empty, @empty, 0x0, "1c6804d4a58b85e13e66ab6fafd10df8ab973be71cc99e43030305633956c3c4", 0xfffffc00, 0x9, 0xfffff536, 0xde5}, 0x3c) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x6, 'bridge0\x00', {0x2}, 0xdd40}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)={0x0, 'veth0_vlan\x00', {0x1}, 0x2}) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x4, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) 4.868493819s ago: executing program 0 (id=804): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x39) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018410000fdffffff000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8946, &(0x7f0000000040)={'dummy0\x00', @random='\x00\x00\x00\x00\x00 '}) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) ioctl$vim2m_VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009"], 0x7c}}, 0x10) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r4, &(0x7f0000000540)={&(0x7f00000005c0)={0xa, 0x4e1f, 0x0, @mcast2, 0x7}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="12000000000000001100000067"], 0x25}, 0x8000) sendmsg$key(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x38}}, 0xc0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x2c}}, 0x800) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x0, 0x1, 0xac1d, 0x10000}) fcntl$lock(r0, 0x6, &(0x7f0000000280)={0x1, 0x3, 0xe, 0x5}) fcntl$lock(r5, 0x7, &(0x7f0000000240)={0x1, 0x2, 0x0, 0x9394}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004}, 0x4000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x9100, &(0x7f0000000140)={0x100073, 0x8a, 0x1c0000}, 0x20) 3.864658709s ago: executing program 1 (id=805): openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) setresuid(0x0, 0x0, 0xee01) syz_clone(0x1200200, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = inotify_init1(0x0) r1 = syz_open_dev$evdev(&(0x7f0000000240), 0x3ff, 0x21c0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f00000002c0)=[@in6={0xa, 0x4e23, 0x7, @local, 0x10}], 0x1c) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000001a00)=0x1ff) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f00000026c0)=0x6) openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x8081, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_REMOTE={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x29}}]}}}]}, 0x50}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./lower1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./lower2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000002c0)='./mnt\x00', &(0x7f0000000340)='overlay\x00', 0x0, &(0x7f0000000380)='lowerdir=lower1:lower2,upperdir=upper,workdir=work,index=on,nfs_export=on,uuid=off\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/file1\x00', 0xffffffffffffff9c, 0x0, 0x0) umount2(&(0x7f0000000600)='./mnt\x00', 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r3, 0x0) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x20020009, 0x0, &(0x7f0000000240)={0x20, 0x0, 0xfffc, 0x360, 0x7}, 0x1a, 0x7, 0x60000000, 0x0, 0x4, 0x101, 0x0}) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) preadv(r0, 0x0, 0x0, 0x5, 0x9) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$sock_buf(r4, 0x1, 0x1f, &(0x7f0000001680)=""/193, &(0x7f0000000180)=0xc1) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x50d000, 0x0) 3.076156753s ago: executing program 0 (id=806): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000004280)='/proc/partitions\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001b80)=ANY=[@ANYBLOB="60000000020601020000000000000000030000000200020073797a30000000000900020073797a3000000000f8ff04000700000010000300686173683a6e65742c69666163650000000001000700000005000400000000005db8a1be4c95a8c879f836b735b20638374ae5416ae036c3df851d9f65be0b262b197ad05ef756c7b3adb5b80d4fad6871abe0bc5708"], 0x60}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000090) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x5, 0xa, 0x10002}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0x3c}}, 0x8000) socket$netlink(0x10, 0x3, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000140)={{0xffff1000, 0xeeee8000, 0x4, 0xf6, 0x2, 0xf3, 0xd7, 0x8, 0x7, 0x1, 0x9, 0x5}, {0x50000, 0xc0a0c0f0f5000ded, 0xd, 0x5, 0x3, 0x8, 0x6, 0x0, 0x80, 0xfc, 0xfc, 0x4}, {0x200000, 0x10000, 0xb, 0x6, 0xff, 0x3, 0x0, 0x5, 0xef, 0x27, 0xd5, 0x2}, {0x4000, 0x80a0000, 0x9, 0x9, 0x8f, 0x4, 0x83, 0xfc, 0xb, 0x1, 0x9, 0x3}, {0xffffffff, 0x0, 0x3, 0x2, 0x6, 0x1, 0x9, 0x2, 0x3, 0x3, 0x0, 0xe4}, {0x200000, 0xffff1000, 0xf, 0x0, 0x3, 0x0, 0x4b, 0x9, 0x3, 0x0, 0x4, 0x30}, {0x1000, 0x9000, 0xc, 0x1, 0x8, 0x3, 0x2, 0x6, 0x91, 0x8, 0x9, 0x88}, {0x8000000, 0x9000, 0x10, 0x6, 0xc2, 0x8, 0x6, 0xd, 0x7, 0x3, 0x80, 0x87}, {0x6000, 0x8000}, {0xe9eb89d253be8b8b, 0x9}, 0x50000, 0x0, 0x0, 0x400408, 0x6, 0x0, 0xeeef0000, [0x6, 0x5, 0x5, 0xe]}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) sendmsg$netlink(r3, &(0x7f0000001900)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000001a00)={0x10, 0x25, 0x4, 0x70bd26, 0x25dfdbff}, 0x10}], 0x1, 0x0, 0x0, 0x20000801}, 0x40010) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r3) recvmmsg(r3, &(0x7f00000086c0)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000340)=""/154, 0x9a}, {&(0x7f0000000880)=""/4111, 0x100f}], 0x2}, 0xa}], 0x1, 0x8042, 0x0) write$char_usb(r2, &(0x7f0000000040)="e2", 0x12d8) syz_open_dev$ttys(0xc, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setpriority(0x2, 0xff, 0x0) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)) 2.083390204s ago: executing program 2 (id=807): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r0 = socket(0x40000000015, 0x5, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(des)\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f0000000280), 0x0, 0x2, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="e64f2be8d3e7a2", 0x7) sendmsg$nl_route(r0, &(0x7f0000000600)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4c000}, 0x81) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x24044080) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x103401, 0x0) write$dsp(r5, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r5, 0x5001, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0x40045010, &(0x7f0000000040)=0x5f) ioctl$SNDCTL_DSP_RESET(r5, 0x5000, 0x0) 1.573139786s ago: executing program 1 (id=808): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20, @local}, 0x10) semctl$SETVAL(0x0, 0x0, 0x10, &(0x7f0000008640)=0x3) socket$kcm(0x10, 0x2, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) r2 = syz_open_dev$midi(&(0x7f00000012c0), 0x2, 0x2) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r2, 0x810c5701, &(0x7f00000000c0)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f00000000c0)=0x7) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x58, 0x1, 0x2, 0x301, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x24000000}, 0x8000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) r7 = io_uring_setup(0x7fc0, &(0x7f0000000300)={0x0, 0xf368, 0x40, 0x0, 0xcd}) fcntl$lock(r7, 0x25, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x7f, 0xffffffffffffffff}) timer_create(0x2, 0x0, &(0x7f0000bbdffc)=0x0) accept$inet(r1, &(0x7f0000000280)={0x2, 0x0, @loopback}, &(0x7f0000000300)=0x10) syz_emit_ethernet(0x62, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv4={0x800, @tipc={{0xa, 0x4, 0x0, 0x3c, 0x54, 0x67, 0x0, 0x3, 0x6, 0x0, @rand_addr=0x64010100, @local, {[@rr={0x7, 0xb, 0x7, [@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010100]}, @lsrr={0x83, 0x3, 0xc8}, @lsrr={0x83, 0x3, 0x93}]}}, @payload_mcast={{{{{{0x2c, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x2, 0x5, 0x0, 0x1, 0x1, 0x0, 0x1, 0x800, 0x1, 0x1, 0x4e21, 0x4e22}, 0x1}, 0x3}, 0x1}}}}}}}, 0x0) timer_settime(r8, 0x0, &(0x7f00000002c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_delete(r8) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r5, @ANYRES32=r6, @ANYRES32, @ANYRES64=r0], 0x48) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) 1.036537976s ago: executing program 2 (id=809): r0 = open(&(0x7f0000000580)='./file0\x00', 0x503f80, 0x1a4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x3, &(0x7f0000000000)=[{0x20, 0x10, 0x4, 0xfffff00c}, {0x30, 0x0, 0xfd, 0x5ae9}, {0x6, 0x0, 0x7, 0x40000002}]}, 0x10) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r0, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1, {0x787}}, './file0\x00'}) io_setup(0x8, &(0x7f00000001c0)) r2 = syz_open_dev$video(&(0x7f0000000200), 0x4, 0x2) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000500)=@multiplanar_userptr={0x3, 0x6, 0x4, 0x8, 0x4, {0x77359400}, {0x3, 0x2, 0x5, 0xd7, 0x7f, 0x8, "3b235716"}, 0x10001, 0x2, {0x0}, 0xd}) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000003700), 0x2200) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r3, 0xc0145401, &(0x7f0000003740)={0xffffffffffffffff, 0x3, 0xa, 0x2, 0x98}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f00000002c0)=@ethtool_rxfh={0x47, 0x5, 0x101, 0x919, 0x0, "9a5b86", 0x7}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000b00000a48000000060a010400000000000000000a0000040900010073797a310000000014000480100001800c000100636f756e746572000900020073797a3200000000050007"], 0x70}, 0x1, 0x0, 0x0, 0x40}, 0x240400d0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00008feff0)={0x0}}, 0x4048880) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="020d0000100000002f3144a8edffffff03000600ff18000002004909000100000000000000001e0e080012000200010000d200000000000030006c540203009f7eae02000000adb20200000000f52c000000cdff00000001020014bb000001000000002300001300030005000020000002"], 0x80}}, 0x0) socket$key(0xf, 0x3, 0x2) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='loginuid\x00') writev(r6, &(0x7f0000000180)=[{&(0x7f0000000040)="c63d7c4e42804e07e0dc98dac6163db890d0f674458444fab10321e996e94da5e4572078f3b8513ad9013966ac306460eb6263fdcdcb51f755b6d1ad3c788cf99a7dd36e68931971b6467e6288d41b3bea4d7fa7175c7305050f8c7de5b2dd68c5cc26113b2eab649eee88d24bac0cb7d996298c3f5e332de5db6e94b22770ae9614616ab0222c33808f5112d06d6633b16f6dacd62689f793237cc2734a2185a7b198d375e4d8a6ac5e85d7b338a6216adfb3f57bb4a7fbf17ee363bc25a81e6770559827c1f6dce56a0dde851fa79650990ae057fd3523d018e554", 0xffffffffffffff2f}], 0x32) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}]}, &(0x7f0000000640)=0x10) getsockopt$bt_hci(r7, 0x84, 0x3, &(0x7f0000001680)=""/4103, &(0x7f0000000040)=0x1007) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001", @ANYRES32, @ANYRES16=r0, @ANYRESDEC=r8], 0x7c}, 0x1, 0x0, 0x0, 0x4040}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) 797.764266ms ago: executing program 1 (id=810): r0 = socket$inet_sctp(0x2, 0x5, 0x84) mkdir(&(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xb}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x30}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x54}, 0x1, 0x0, 0x0, 0x40080a5}, 0x20008040) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0) r4 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000a80)={0x0, &(0x7f0000000d00)=[@nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @control_area=0x6c, 0x7fff, 0x6, 0x1}}, @nested_amd_vmload={0x182, 0x18, 0x1}, @wr_crn={0x67, 0x20, {0x2, 0x8}}, @nested_load_syzos={0x136, 0x70, {0x3, 0xff, [@rdmsr={0x66, 0x18, {0x40000105}}, @nested_amd_vmsave={0x183, 0x18, 0x2}, @nested_load_syzos={0x136, 0x20, {0x3, 0x2}}]}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @control_area=0x53, 0x2, 0x400, 0x4}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @save_area=0x499, 0x4, 0x0, 0x200}}, @nested_amd_clgi={0x17f, 0x10}, @nested_create_vm={0x12d, 0x18, 0x2}, @enable_nested={0x12c, 0x18}, @rdmsr={0x66, 0x18, {0x9ed}}, @nested_load_code={0x12e, 0x94, {0x2, "6566450f388236450f011b48b800000000010000000f23c00f21f835020008000f23f88f69b0024800c7442400a9e00000c744240203000000c7442406000000000f01142466460f380116c4013dd2d4c744240030000000c744240283f9538cff2c24c744240028010000c7442402f35df7d4ff2c24c4c3bd5dd20f"}}, @cpuid={0x64, 0x18, {0x2, 0x4}}, @wrmsr={0x65, 0x20, {0x961, 0xabcd}}, @uexit={0x0, 0x18, 0x8}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control64=0x2029, 0x5, 0xfffffffffffff434, 0x1}}, @nested_load_code={0x12e, 0x5f, {0x1, "670fc72865410f01c280d703660fc7b4840e730000b9800000c00f3235008000000f30450f30c744240005010000c744240207000000ff2c2466450f32410f0865f0440fb1610d"}}, @set_irq_handler={0xc8, 0x20, {0xde, 0x2}}, @in_dx={0x69, 0x20, {0x55f3, 0x2}}, @nested_amd_clgi={0x17f, 0x10}, @in_dx={0x69, 0x20, {0x7761}}, @code={0xa, 0x8b, {"66baf80cb89a6af68aef66bafc0cec430f2207b9ed0a0000b800000000ba000000800f30c443195efd00f30f5d64e2d7b9800000c00f3235001000000f30440f30c74424000c000000c744240200500000ff1c24f04780ac2fd8b8000000c74424000b000000c744240217000000c7442406000000000f011c24"}}, @nested_amd_set_intercept={0x181, 0x30, {0x2, 0x0, 0x3}}, @nested_amd_stgi={0x17e, 0x10}, @wr_drn={0x68, 0x20, {0x4, 0x74eb}}, @nested_amd_invlpga={0x17d, 0x20, {0xdddd0000, 0xa0b5}}, @in_dx={0x69, 0x20, {0xd79c, 0x3}}], 0x4be}) ioctl$KVM_GET_REG_LIST(r4, 0xc008aeb0, &(0x7f0000000ac0)={0x4, [0x2, 0x2, 0x6, 0xe5a7]}) write(r3, &(0x7f0000000380)='1', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x3, 0x200000b, 0x2010, r1, 0x0) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x40400, 0x0) readv(r5, &(0x7f0000001880)=[{&(0x7f0000000500)=""/215, 0xd7}], 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x3, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="9110bb000000000095"], &(0x7f0000000280)='GPL\x00'}, 0x94) r6 = openat$vicodec0(0xffffff9c, &(0x7f0000000500), 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r7 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {0x0}, {&(0x7f0000001480)="d1ffac", 0x3}], 0x3) ioctl$SCSI_IOCTL_GET_PCI(r7, 0x5393, &(0x7f0000000000)) ioctl$VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000000540)={0x0, 0x8, 0x80, "424b406dc352d0b6e74df67dc895e9293a25fd7c401d4f56777f959c8025a051", 0x3132564e}) sendmmsg$inet_sctp(r0, &(0x7f0000000500)=[{&(0x7f0000000000)=@in6={0xa, 0x4e20, 0x9, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x5d}, 0x1c, &(0x7f00000002c0)=[{&(0x7f00000000c0)='l', 0x1}], 0x1, &(0x7f0000000040)=ANY=[], 0x18, 0x14001}], 0x1, 0x4044040) 0s ago: executing program 0 (id=811): syz_emit_ethernet(0xbe, &(0x7f0000000000)={@empty, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x21}}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0xfeff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) kernel console output (not intermixed with test programs): ged:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 195.263769][ T6305] lowmem_reserve[]: 0 2499 2501 2501 2501 [ 195.263991][ T6305] Node 0 DMA32 free:1279488kB boost:0kB min:3920kB low:6452kB high:8984kB reserved_highatomic:0KB free_highatomic:0KB active_anon:712kB inactive_anon:34364kB active_file:54412kB inactive_file:188580kB unevictable:0kB writepending:736kB zspages:0kB present:3129332kB managed:2559328kB mlocked:0kB bounce:0kB free_pcp:17268kB local_pcp:5044kB free_cma:0kB [ 195.264113][ T6305] lowmem_reserve[]: 0 0 1 1 1 [ 195.264305][ T6305] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1832kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 195.264389][ T6305] lowmem_reserve[]: 0 0 0 0 0 [ 195.264581][ T6305] Node 1 Normal free:3945628kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 195.264688][ T6305] lowmem_reserve[]: 0 0 0 0 0 [ 195.264887][ T6305] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 195.265510][ T6305] Node 0 DMA32: 557*4kB (ME) 575*8kB (UME) 945*16kB (UM) 1006*32kB (UME) 674*64kB (UME) 362*128kB (UME) 161*256kB (UME) 48*512kB (UME) 21*1024kB (UM) 12*2048kB (UM) 250*4096kB (UM) = 1279484kB [ 195.266316][ T6305] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 195.266791][ T6305] Node 1 Normal: 1*4kB (U) 3*8kB (UM) 6*16kB (UM) 7*32kB (UM) 5*64kB (UM) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 962*4096kB (M) = 3945628kB [ 195.267522][ T6305] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 195.267563][ T6305] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 195.267604][ T6305] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 195.267644][ T6305] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 195.267685][ T6305] 64185 total pagecache pages [ 195.267744][ T6305] 0 pages in swap cache [ 195.267773][ T6305] Free swap = 124996kB [ 195.267832][ T6305] Total swap = 124996kB [ 195.267863][ T6305] 2097051 pages RAM [ 195.267893][ T6305] 0 pages HighMem/MovableOnly [ 195.267922][ T6305] 425146 pages reserved [ 195.267952][ T6305] 0 pages cma reserved [ 196.263675][ T6307] netlink: 32 bytes leftover after parsing attributes in process `syz.4.135'. [ 196.810237][ T5602] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 197.031826][ T5602] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 197.104771][ T5602] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 197.104805][ T5602] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 197.104832][ T5602] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 197.104855][ T5602] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 197.104898][ T5602] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.394137][ T5602] usb 2-1: config 0 descriptor?? [ 197.743689][ T5973] r8152-cfgselector 5-1: Unknown version 0x0000 [ 197.813435][ T5602] hdpvr 2-1:0.0: unexpected answer of status request, len -71 [ 197.813475][ T5602] hdpvr 2-1:0.0: device init failed [ 197.813574][ T5602] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -12 [ 197.816954][ T5973] r8152-cfgselector 5-1: No union descriptors [ 198.009368][ T5973] r8152-cfgselector 5-1: USB disconnect, device number 6 [ 198.024698][ T5602] usb 2-1: USB disconnect, device number 4 [ 198.299486][ T6324] netlink: 104 bytes leftover after parsing attributes in process `syz.1.141'. [ 199.488797][ T1000] usb 1-1: USB disconnect, device number 6 [ 200.464409][ T6340] netlink: 32 bytes leftover after parsing attributes in process `syz.0.146'. [ 205.040465][ T5780] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 205.221356][ T5780] usb 1-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice= 1.00 [ 205.224168][ T5780] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 205.224216][ T5780] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 1024 [ 205.224235][ T5780] usb 1-1: config 1 interface 1 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 205.224252][ T5780] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 34390, setting to 1024 [ 205.224270][ T5780] usb 1-1: config 1 interface 1 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 205.224298][ T5780] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.317195][ T6349] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 206.153260][ T6359] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 206.177678][ T6359] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 206.390035][ T6359] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 206.410746][ T6359] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 206.476949][ T6359] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 206.500116][ T6359] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 206.641302][ T5780] ims_pcu 1-1:1.0: Failed to set line coding, error: -71 [ 206.641698][ C0] ims_pcu 1-1:1.0: ims_pcu_irq - usb_submit_urb failed with result -1 [ 206.656262][ T5780] ims_pcu 1-1:1.0: probe with driver ims_pcu failed with error -71 [ 206.717532][ T6359] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 206.717633][ T6359] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 206.717648][ T6359] UDF-fs: warning (device loop4): udf_fill_super: No partition found (1) [ 206.843277][ T5780] usb 1-1: USB disconnect, device number 7 [ 207.230308][ T5973] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 207.324246][ T6369] netlink: 104 bytes leftover after parsing attributes in process `syz.2.153'. [ 209.620304][ T5973] usb 5-1: device descriptor read/64, error -71 [ 209.915991][ T6375] netlink: 76 bytes leftover after parsing attributes in process `syz.2.156'. [ 210.200468][ T5780] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 210.342829][ T6379] syz_tun: entered allmulticast mode [ 210.401334][ T5780] usb 3-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 210.419829][ T5780] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 210.419856][ T5780] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 210.454148][ T5780] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.454172][ T5780] usb 3-1: Product: syz [ 210.454184][ T5780] usb 3-1: Manufacturer: syz [ 210.454196][ T5780] usb 3-1: SerialNumber: syz [ 210.498451][ T5780] usb 3-1: config 0 descriptor?? [ 210.696538][ T6377] syz_tun: left allmulticast mode [ 211.230447][ T5780] usb 3-1: USB disconnect, device number 4 [ 211.827808][ T6409] netlink: 104 bytes leftover after parsing attributes in process `syz.1.165'. [ 213.226858][ T6411] netlink: 51 bytes leftover after parsing attributes in process `syz.2.167'. [ 215.966224][ T37] kauditd_printk_skb: 38 callbacks suppressed [ 215.986154][ T37] audit: type=1107 audit(1787520548.734:50): pid=6416 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='+4C%[N&jh*琒veTEP}?=nlf= 4H]կÒ=8GnVl7<&W;' [ 218.310737][ T5973] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 218.711960][ T1000] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 219.210214][ T6446] netlink: 104 bytes leftover after parsing attributes in process `syz.1.176'. [ 219.398547][ T5602] usb 5-1: new low-speed USB device number 9 using dummy_hcd [ 220.400325][ T5602] usb 5-1: Invalid ep0 maxpacket: 64 [ 220.543601][ T5602] usb 5-1: new low-speed USB device number 10 using dummy_hcd [ 220.710279][ T5602] usb 5-1: Invalid ep0 maxpacket: 64 [ 220.712263][ T5602] usb usb5-port1: attempt power cycle [ 222.290286][ T5602] usb 5-1: new low-speed USB device number 11 using dummy_hcd [ 222.399061][ T5597] Bluetooth: hci1: command 0x0406 tx timeout [ 224.091157][ T5602] usb 5-1: device descriptor read/8, error -71 [ 224.655449][ T6473] loop2: detected capacity change from 0 to 7 [ 225.836214][ T6473] Dev loop2: unable to read RDB block 7 [ 225.858391][ T6473] loop2: unable to read partition table [ 225.867557][ T6473] loop2: partition table beyond EOD, truncated [ 225.868001][ T6473] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 227.119141][ T6492] netlink: 104 bytes leftover after parsing attributes in process `syz.3.188'. [ 228.172343][ T5597] Bluetooth: hci3: command 0x0406 tx timeout [ 228.172386][ T5597] Bluetooth: hci4: command 0x0406 tx timeout [ 228.172522][ T5597] Bluetooth: hci0: command 0x0406 tx timeout [ 228.680452][ T5815] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 230.115354][ T5815] usb 5-1: Using ep0 maxpacket: 8 [ 230.116454][ T5815] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 230.137584][ T5815] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 230.137615][ T5815] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 230.137650][ T5815] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 230.137682][ T5815] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.226629][ T6506] cgroup: subsys name conflicts with all [ 230.283302][ T6503] FAULT_INJECTION: forcing a failure. [ 230.283302][ T6503] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.283329][ T6503] CPU: 0 UID: 0 PID: 6503 Comm: syz.3.192 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 230.283347][ T6503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 230.283356][ T6503] Call Trace: [ 230.283363][ T6503] [ 230.283369][ T6503] dump_stack_lvl+0xe8/0x150 [ 230.283398][ T6503] should_fail_ex+0x46b/0x600 [ 230.283426][ T6503] _copy_from_iter+0x1d3/0x1660 [ 230.283455][ T6503] ? _copy_from_iter+0x21b/0x1660 [ 230.283480][ T6503] ? __pfx__copy_from_iter+0x10/0x10 [ 230.283508][ T6503] ? __pfx__copy_from_iter+0x10/0x10 [ 230.283537][ T6503] copy_page_from_iter+0x219/0x2d0 [ 230.283564][ T6503] skb_copy_datagram_from_iter+0x2f4/0x720 [ 230.283673][ T6503] packet_sendmsg+0x35e2/0x4f80 [ 230.283753][ T6503] ? is_bpf_text_address+0x292/0x2b0 [ 230.283781][ T6503] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 230.283812][ T6503] ? __lock_acquire+0x683/0x2ce0 [ 230.283836][ T6503] ? smack_socket_sendmsg+0x1f8/0x5a0 [ 230.283851][ T6503] ? get_pid_task+0x20/0x1f0 [ 230.283876][ T6503] ? __pfx_packet_sendmsg+0x10/0x10 [ 230.283903][ T6503] ? __might_fault+0xaf/0x130 [ 230.283921][ T6503] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 230.283946][ T6503] ? __pfx_packet_sendmsg+0x10/0x10 [ 230.283965][ T6503] sock_sendmsg_nosec+0x13a/0x180 [ 230.284023][ T6503] __sys_sendto+0x41e/0x5d0 [ 230.284065][ T6503] ? __pfx___sys_sendto+0x10/0x10 [ 230.284108][ T6503] ? __pfx_ksys_write+0x10/0x10 [ 230.284135][ T6503] __x64_sys_sendto+0xde/0x100 [ 230.284161][ T6503] do_syscall_64+0x166/0x520 [ 230.284181][ T6503] ? trace_irq_disable+0x3b/0x140 [ 230.284197][ T6503] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.284214][ T6503] ? clear_bhb_loop+0x70/0xc0 [ 230.284258][ T6503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.284280][ T6503] RIP: 0033:0x7f274617e0d9 [ 230.284299][ T6503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 230.284315][ T6503] RSP: 002b:00007f27443d6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 230.284337][ T6503] RAX: ffffffffffffffda RBX: 00007f2746405fa0 RCX: 00007f274617e0d9 [ 230.284352][ T6503] RDX: 000000000000e90c RSI: 00002000000000c0 RDI: 000000000000000a [ 230.284365][ T6503] RBP: 00007f27443d6090 R08: 0000200000000540 R09: 0000000000000014 [ 230.284377][ T6503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 230.284389][ T6503] R13: 00007f2746406038 R14: 00007f2746405fa0 R15: 00007ffcd5c31f08 [ 230.284421][ T6503] [ 230.643217][ T5815] usbtmc 5-1:16.0: bulk endpoints not found [ 231.673724][ T5780] usb 5-1: USB disconnect, device number 13 [ 233.425320][ T6526] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.449600][ T6526] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.462574][ T6526] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.506261][ T6526] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.535249][ T6526] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.535893][ T6526] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.583827][ T6526] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.584456][ T6526] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.594075][ T6532] netlink: 8 bytes leftover after parsing attributes in process `syz.4.200'. [ 233.933657][ T5973] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 235.441109][ T5973] usb 4-1: device descriptor read/64, error -71 [ 235.642634][ T6526] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.656586][ T6526] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.770322][ T5973] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 236.202655][ T5973] usb 4-1: device descriptor read/64, error -71 [ 236.342265][ T5973] usb usb4-port1: attempt power cycle [ 239.247302][ T6552] Invalid logical block size (102) [ 240.434183][ T6553] binder: Unknown parameter 'pass' [ 242.512273][ T1000] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 243.241987][ T1000] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 243.244025][ T1000] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 243.244086][ T1000] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 243.244111][ T1000] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 243.244134][ T1000] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 243.244179][ T1000] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.384612][ T5843] usb 5-1: USB disconnect, device number 14 [ 246.696253][ T37] audit: type=1107 audit(1787520581.474:51): pid=6585 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='+4C%[N&jh*琒veTEP}?=nlf= 4H]կÒ=8GnVl7<&W;' [ 247.050377][ T5780] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 247.871093][ T5780] usb 4-1: Using ep0 maxpacket: 16 [ 247.874837][ T5780] usb 4-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 248.043952][ T5780] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 248.044024][ T5780] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 248.044102][ T5780] usb 4-1: config 0 has no interface number 0 [ 251.778271][ T5780] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.778293][ T5780] usb 4-1: Product: syz [ 251.778303][ T5780] usb 4-1: Manufacturer: syz [ 251.990712][ T5780] usb 4-1: config 0 descriptor?? [ 251.991422][ T5780] usb 4-1: can't set config #0, error -71 [ 252.060075][ T5780] usb 4-1: USB disconnect, device number 7 [ 255.971109][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.971170][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.828021][ T6653] netlink: 104 bytes leftover after parsing attributes in process `syz.2.236'. [ 259.133465][ T6667] syz_tun: entered allmulticast mode [ 259.151000][ T6667] syz_tun: left allmulticast mode [ 264.592816][ T6701] fuse: Bad value for 'rootmode' [ 268.345440][ T6720] jffs2: notice: (6720) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 268.598032][ T6727] netlink: 'syz.3.252': attribute type 12 has an invalid length. [ 268.598498][ T6727] netlink: 'syz.3.252': attribute type 12 has an invalid length. [ 268.598875][ T6727] netlink: 'syz.3.252': attribute type 12 has an invalid length. [ 268.599207][ T6727] netlink: 'syz.3.252': attribute type 12 has an invalid length. [ 270.611907][ T5696] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 271.839282][ T5696] usb 4-1: New USB device found, idVendor=056a, idProduct=0084, bcdDevice= 0.00 [ 271.870292][ T5696] usb 4-1: config 0 interface 0 has no altsetting 0 [ 271.870337][ T5696] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.918681][ T5696] usb 4-1: config 0 descriptor?? [ 272.326724][ T5696] usbhid 4-1:0.0: can't add hid device: -71 [ 272.329625][ T5696] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 272.373410][ T5696] usb 4-1: USB disconnect, device number 8 [ 272.570261][ T6762] FAULT_INJECTION: forcing a failure. [ 272.570261][ T6762] name failslab, interval 1, probability 0, space 0, times 0 [ 272.570304][ T6762] CPU: 0 UID: 0 PID: 6762 Comm: syz.3.259 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 272.570322][ T6762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 272.570343][ T6762] Call Trace: [ 272.570349][ T6762] [ 272.570356][ T6762] dump_stack_lvl+0xe8/0x150 [ 272.570385][ T6762] should_fail_ex+0x46b/0x600 [ 272.570414][ T6762] should_failslab+0xa8/0x100 [ 272.570433][ T6762] __kmalloc_cache_noprof+0xa0/0x6b0 [ 272.570451][ T6762] ? __pollwait+0x27f/0x430 [ 272.570466][ T6762] ? __pollwait+0x27f/0x430 [ 272.570487][ T6762] __pollwait+0x27f/0x430 [ 272.570504][ T6762] ? __pfx___pollwait+0x10/0x10 [ 272.570520][ T6762] pipe_poll+0x21e/0x5a0 [ 272.570537][ T6762] ? __pfx_pipe_poll+0x10/0x10 [ 272.570552][ T6762] do_sys_poll+0x92e/0xf50 [ 272.570575][ T6762] ? do_sys_poll+0x421/0xf50 [ 272.570604][ T6762] ? __pfx_do_sys_poll+0x10/0x10 [ 272.570624][ T6762] ? is_bpf_text_address+0x292/0x2b0 [ 272.570644][ T6762] ? is_bpf_text_address+0x26/0x2b0 [ 272.570664][ T6762] ? __pfx___pollwait+0x10/0x10 [ 272.570684][ T6762] ? __pfx_pollwake+0x10/0x10 [ 272.570704][ T6762] ? __pfx_pollwake+0x10/0x10 [ 272.570724][ T6762] ? __pfx_pollwake+0x10/0x10 [ 272.570744][ T6762] ? __pfx_pollwake+0x10/0x10 [ 272.570764][ T6762] ? __pfx_pollwake+0x10/0x10 [ 272.570784][ T6762] ? __pfx_pollwake+0x10/0x10 [ 272.570804][ T6762] ? __pfx_pollwake+0x10/0x10 [ 272.570845][ T6762] ? __pfx_pollwake+0x10/0x10 [ 272.570874][ T6762] ? __pfx_pollwake+0x10/0x10 [ 272.570930][ T6762] ? set_user_sigmask+0xcd/0x1c0 [ 272.570950][ T6762] ? __pfx_set_user_sigmask+0x10/0x10 [ 272.570968][ T6762] ? kmem_cache_free+0x187/0x6c0 [ 272.570984][ T6762] ? do_sys_openat2+0x14e/0x200 [ 272.571007][ T6762] __se_sys_ppoll+0x209/0x2b0 [ 272.571029][ T6762] ? __pfx___se_sys_ppoll+0x10/0x10 [ 272.571047][ T6762] ? __pfx_ksys_write+0x10/0x10 [ 272.571074][ T6762] ? __x64_sys_ppoll+0x20/0xc0 [ 272.571094][ T6762] do_syscall_64+0x166/0x520 [ 272.571116][ T6762] ? trace_irq_disable+0x3b/0x140 [ 272.571131][ T6762] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.571147][ T6762] ? clear_bhb_loop+0x70/0xc0 [ 272.571168][ T6762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.571184][ T6762] RIP: 0033:0x7f274617e0d9 [ 272.571198][ T6762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 272.571211][ T6762] RSP: 002b:00007f27443d6028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 272.571227][ T6762] RAX: ffffffffffffffda RBX: 00007f2746405fa0 RCX: 00007f274617e0d9 [ 272.571239][ T6762] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 272.571249][ T6762] RBP: 00007f27443d6090 R08: 0000000000000000 R09: 0000000000000000 [ 272.571259][ T6762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 272.571268][ T6762] R13: 00007f2746406038 R14: 00007f2746405fa0 R15: 00007ffcd5c31f08 [ 272.571291][ T6762] [ 276.491071][ T6779] netlink: 104 bytes leftover after parsing attributes in process `syz.3.264'. [ 277.924814][ T6781] binder: 6780:6781 ioctl c0306201 2000000004c0 returned -14 [ 277.971847][ T6781] binder: 6780:6781 ioctl c0306201 2000000001c0 returned -14 [ 277.997441][ T6781] binder: 6780:6781 ioctl c0306201 200000000480 returned -14 [ 278.031191][ T6781] binder: 6780:6781 ioctl c0306201 200000000340 returned -14 [ 278.216887][ T6787] syz_tun: entered allmulticast mode [ 278.334767][ T6782] syz_tun: left allmulticast mode [ 280.184135][ T37] audit: type=1107 audit(1787520614.964:52): pid=6795 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='+4C%[N&jh*琒veTEP}?=nlf= 4H]կÒ=8GnVl7<&W;' [ 280.760291][ T5606] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 280.910271][ T5606] usb 2-1: Using ep0 maxpacket: 16 [ 280.911275][ T5606] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 280.912874][ T5606] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 280.912901][ T5606] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 280.912921][ T5606] usb 2-1: config 0 has no interface number 0 [ 280.972324][ T5606] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.972347][ T5606] usb 2-1: Product: syz [ 280.972358][ T5606] usb 2-1: Manufacturer: syz [ 280.972368][ T5606] usb 2-1: SerialNumber: syz [ 281.009196][ T5606] usb 2-1: config 0 descriptor?? [ 281.044207][ T5606] uvcvideo 2-1:0.105: Found Unit with invalid ID 0 [ 281.588684][ T5606] uvcvideo 2-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 281.588726][ T5606] uvcvideo 2-1:0.105: No valid video chain found. [ 282.792357][ T36] usb 2-1: USB disconnect, device number 6 [ 287.176364][ T6824] netlink: 104 bytes leftover after parsing attributes in process `syz.1.277'. [ 289.422957][ T6845] syz_tun: entered allmulticast mode [ 289.432725][ T6842] syz_tun: left allmulticast mode [ 289.730280][ T5715] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 289.739082][ T6858] FAULT_INJECTION: forcing a failure. [ 289.739082][ T6858] name failslab, interval 1, probability 0, space 0, times 0 [ 289.739118][ T6858] CPU: 1 UID: 0 PID: 6858 Comm: syz.3.285 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 289.739144][ T6858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 289.739156][ T6858] Call Trace: [ 289.739164][ T6858] [ 289.739174][ T6858] dump_stack_lvl+0xe8/0x150 [ 289.739210][ T6858] should_fail_ex+0x46b/0x600 [ 289.739250][ T6858] should_failslab+0xa8/0x100 [ 289.739279][ T6858] __kvmalloc_node_noprof+0x17a/0x8a0 [ 289.739308][ T6858] ? io_alloc_cache_init+0x42/0x140 [ 289.739330][ T6858] ? io_alloc_cache_init+0x42/0x140 [ 289.739364][ T6858] io_alloc_cache_init+0x42/0x140 [ 289.739390][ T6858] io_ring_ctx_alloc+0x518/0xba0 [ 289.739421][ T6858] io_uring_create+0x50/0x990 [ 289.739447][ T6858] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 289.739475][ T6858] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 289.739499][ T6858] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 289.739542][ T6858] ? __pfx_ksys_write+0x10/0x10 [ 289.739593][ T6858] do_syscall_64+0x166/0x520 [ 289.739622][ T6858] ? trace_irq_disable+0x3b/0x140 [ 289.739644][ T6858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.739667][ T6858] ? clear_bhb_loop+0x70/0xc0 [ 289.739694][ T6858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.739717][ T6858] RIP: 0033:0x7f274617e0d9 [ 289.739737][ T6858] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 289.739754][ T6858] RSP: 002b:00007f27443d5ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 289.739776][ T6858] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007f274617e0d9 [ 289.739791][ T6858] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e26 [ 289.739805][ T6858] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 289.739818][ T6858] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 289.739832][ T6858] R13: 0000200000000890 R14: 00007f27443d5fd8 R15: 0000000000000000 [ 289.739866][ T6858] [ 289.900400][ T5715] usb 1-1: Using ep0 maxpacket: 16 [ 289.906700][ T5715] usb 1-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 289.993291][ T5715] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 289.993320][ T5715] usb 1-1: config 0 has no interface number 0 [ 290.031745][ T5715] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.031774][ T5715] usb 1-1: Product: syz [ 290.031789][ T5715] usb 1-1: Manufacturer: syz [ 290.031805][ T5715] usb 1-1: SerialNumber: syz [ 290.193324][ T5715] usb 1-1: config 0 descriptor?? [ 290.246281][ T5715] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 291.120603][ T6876] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 291.616551][ T5715] gspca_spca1528: reg_w err -110 [ 291.745294][ T5715] spca1528 1-1:0.1: probe with driver spca1528 failed with error -110 [ 297.200306][ T5696] usb 1-1: USB disconnect, device number 9 [ 298.982104][ T6907] syz_tun: entered allmulticast mode [ 299.004373][ T6906] syz_tun: left allmulticast mode [ 301.873977][ T6930] netlink: 104 bytes leftover after parsing attributes in process `syz.0.300'. [ 303.621103][ T5715] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 303.907786][ T5715] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 304.628577][ T5715] usb 4-1: unable to read config index 0 descriptor/all [ 304.628629][ T5715] usb 4-1: can't read configurations, error -71 [ 305.276697][ T6945] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 305.276853][ T6945] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 305.290269][ T36] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 305.463849][ T36] usb 3-1: Using ep0 maxpacket: 8 [ 305.474017][ T36] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 305.488080][ T36] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 305.503757][ T36] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 305.503786][ T36] usb 3-1: Product: syz [ 305.503802][ T36] usb 3-1: Manufacturer: syz [ 305.503817][ T36] usb 3-1: SerialNumber: syz [ 305.651053][ T5696] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 305.943820][ T36] usb 3-1: palm_os_3_probe - error -110 getting connection information [ 305.943898][ T36] visor 3-1:1.0: probe with driver visor failed with error -110 [ 305.961121][ T5696] usb 5-1: Using ep0 maxpacket: 8 [ 305.968642][ T5696] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 306.000030][ T5696] usb 5-1: config 0 has an invalid descriptor of length 84, skipping remainder of the config [ 306.000173][ T5696] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 306.000200][ T5696] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 193, changing to 11 [ 306.000228][ T5696] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 25667, setting to 1024 [ 306.000256][ T5696] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 306.060565][ T5696] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 306.060594][ T5696] usb 5-1: Product: syz [ 306.060608][ T5696] usb 5-1: Manufacturer: syz [ 306.060671][ T5696] usb 5-1: SerialNumber: syz [ 306.117845][ T5696] usb 5-1: config 0 descriptor?? [ 306.129658][ T6955] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 306.333260][ T6945] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 306.333357][ T6945] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 306.433414][ T5696] radio-si470x 5-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 306.433470][ T5696] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 306.672747][ T6955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 306.673418][ T6955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 306.941736][ T5696] radio-si470x 5-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 306.941765][ T5696] radio-si470x 5-1:0.0: si470x_get_scratch: si470x_get_report returned -110 [ 306.975105][ T5696] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -5 [ 307.064493][ T6945] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 307.064519][ T6945] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 307.167452][ T5696] usb 5-1: USB disconnect, device number 15 [ 307.531423][ T6945] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 307.531451][ T6945] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 308.139185][ T6967] syz_tun: entered allmulticast mode [ 308.149781][ T6966] syz_tun: left allmulticast mode [ 308.418465][ T6959] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 308.463217][ T6959] block device autoloading is deprecated and will be removed. [ 308.502298][ T6971] FAULT_INJECTION: forcing a failure. [ 308.502298][ T6971] name failslab, interval 1, probability 0, space 0, times 0 [ 308.502326][ T6971] CPU: 0 UID: 0 PID: 6971 Comm: syz.4.311 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 308.502344][ T6971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 308.502353][ T6971] Call Trace: [ 308.502359][ T6971] [ 308.502365][ T6971] dump_stack_lvl+0xe8/0x150 [ 308.502393][ T6971] should_fail_ex+0x46b/0x600 [ 308.502423][ T6971] should_failslab+0xa8/0x100 [ 308.502443][ T6971] kmem_cache_alloc_node_noprof+0xae/0x670 [ 308.502462][ T6971] ? __alloc_skb+0x1db/0x7a0 [ 308.502600][ T6971] ? __alloc_skb+0x1db/0x7a0 [ 308.502628][ T6971] __alloc_skb+0x1db/0x7a0 [ 308.502682][ T6971] tipc_msg_reverse+0x244/0x970 [ 308.502722][ T6971] tipc_sk_respond+0xef/0x2f0 [ 308.502743][ T6971] ? __pfx_tipc_sk_respond+0x10/0x10 [ 308.502768][ T6971] __tipc_shutdown+0xa20/0x15a0 [ 308.502785][ T6971] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 308.502826][ T6971] ? __pfx___tipc_shutdown+0x10/0x10 [ 308.502844][ T6971] ? __pfx_woken_wake_function+0x10/0x10 [ 308.502864][ T6971] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 308.502883][ T6971] ? lockdep_hardirqs_on+0x7b/0x110 [ 308.502907][ T6971] tipc_release+0x303/0x2500 [ 308.502923][ T6971] ? lock_acquire+0x106/0x350 [ 308.502948][ T6971] ? __pfx_tipc_release+0x10/0x10 [ 308.502962][ T6971] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 308.502986][ T6971] ? rwbase_write_lock+0x550/0x720 [ 308.503016][ T6971] __sock_release+0xa0/0x1f0 [ 308.503038][ T6971] ? __pfx_sock_close+0x10/0x10 [ 308.503057][ T6971] sock_close+0x1c/0x30 [ 308.503075][ T6971] __fput+0x42a/0xa80 [ 308.503100][ T6971] fput_close_sync+0x11f/0x240 [ 308.503119][ T6971] ? __pfx_fput_close_sync+0x10/0x10 [ 308.503146][ T6971] __x64_sys_close+0x7e/0x110 [ 308.503167][ T6971] do_syscall_64+0x166/0x520 [ 308.503186][ T6971] ? trace_irq_disable+0x3b/0x140 [ 308.503203][ T6971] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 308.503219][ T6971] ? clear_bhb_loop+0x70/0xc0 [ 308.503238][ T6971] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 308.503254][ T6971] RIP: 0033:0x7f53c2b4e0d9 [ 308.503268][ T6971] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 308.503281][ T6971] RSP: 002b:00007f53c0d85028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 308.503298][ T6971] RAX: ffffffffffffffda RBX: 00007f53c2dd6090 RCX: 00007f53c2b4e0d9 [ 308.503584][ T6971] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009 [ 308.503594][ T6971] RBP: 00007f53c0d85090 R08: 0000000000000000 R09: 0000000000000000 [ 308.503603][ T6971] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 308.503612][ T6971] R13: 00007f53c2dd6128 R14: 00007f53c2dd6090 R15: 00007ffc1685b1f8 [ 308.503640][ T6971] [ 311.235701][ T5815] usb 3-1: USB disconnect, device number 5 [ 314.244371][ T7010] netlink: 104 bytes leftover after parsing attributes in process `syz.4.322'. [ 314.290264][ T5780] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 314.412071][ T7012] syz_tun: entered allmulticast mode [ 314.413858][ T7011] syz_tun: left allmulticast mode [ 314.442103][ T5780] usb 2-1: Using ep0 maxpacket: 32 [ 314.443481][ T5780] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 314.447547][ T5780] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 314.447572][ T5780] usb 2-1: config 0 has no interfaces? [ 314.486937][ T5780] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 314.486958][ T5780] usb 2-1: Product: syz [ 314.486969][ T5780] usb 2-1: Manufacturer: syz [ 314.486979][ T5780] usb 2-1: SerialNumber: syz [ 314.508629][ T5780] usb 2-1: config 0 descriptor?? [ 314.640294][ T5815] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 314.792920][ T5815] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 314.795571][ T5815] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 314.795591][ T5815] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 314.796901][ T5815] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 314.796920][ T5815] usb 3-1: SerialNumber: syz [ 314.797964][ T5780] usb 2-1: USB disconnect, device number 7 [ 315.229479][ T7006] netlink: 12 bytes leftover after parsing attributes in process `syz.2.321'. [ 315.484914][ T7019] netlink: 92 bytes leftover after parsing attributes in process `syz.4.326'. [ 315.629113][ T5815] usb 3-1: 0:2 : does not exist [ 315.930602][ T5780] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 316.091263][ T5780] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 316.124925][ T5780] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.124952][ T5780] usb 2-1: Product: syz [ 316.124968][ T5780] usb 2-1: Manufacturer: syz [ 316.124983][ T5780] usb 2-1: SerialNumber: syz [ 316.790598][ T5780] usb 2-1: config 0 descriptor?? [ 316.811076][ T5780] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 317.470512][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.470601][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.297637][ T5780] gspca_sunplus: reg_w_riv err -110 [ 318.297751][ T5780] sunplus 2-1:0.0: probe with driver sunplus failed with error -110 [ 318.629429][ T5815] usb 3-1: USB disconnect, device number 6 [ 319.558728][ T6683] udevd[6683]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 319.841077][ T5815] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 319.867998][ T5696] usb 2-1: USB disconnect, device number 8 [ 320.274690][ T7055] MTD: Couldn't look up './dev': -15 [ 322.877086][ T7067] sd 0:0:1:0: PR command failed: 1026 [ 322.877147][ T7067] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 322.877192][ T7067] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 322.878124][ T7067] FAULT_INJECTION: forcing a failure. [ 322.878124][ T7067] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 322.878157][ T7067] CPU: 0 UID: 0 PID: 7067 Comm: syz.1.338 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 322.878182][ T7067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 322.878195][ T7067] Call Trace: [ 322.878203][ T7067] [ 322.878212][ T7067] dump_stack_lvl+0xe8/0x150 [ 322.878251][ T7067] should_fail_ex+0x46b/0x600 [ 322.878292][ T7067] _copy_from_iter+0x1d3/0x1660 [ 322.878329][ T7067] ? rcu_is_watching+0x16/0xb0 [ 322.878360][ T7067] ? trace_kmem_cache_alloc+0x29/0xe0 [ 322.878399][ T7067] ? __pfx__copy_from_iter+0x10/0x10 [ 322.878430][ T7067] ? __alloc_skb+0x27a/0x7a0 [ 322.878464][ T7067] ? __alloc_skb+0x27a/0x7a0 [ 322.878502][ T7067] ? netlink_sendmsg+0x650/0xb40 [ 322.878629][ T7067] ? skb_put+0x112/0x210 [ 322.878677][ T7067] netlink_sendmsg+0x6c0/0xb40 [ 322.878713][ T7067] ? __pfx_netlink_sendmsg+0x10/0x10 [ 322.878740][ T7067] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 322.878768][ T7067] ? __kernel_text_address+0xd/0x30 [ 322.878787][ T7067] ? unwind_get_return_address+0x4d/0x90 [ 322.878814][ T7067] ? __pfx_netlink_sendmsg+0x10/0x10 [ 322.878842][ T7067] sock_sendmsg_nosec+0x13a/0x180 [ 322.878875][ T7067] ____sys_sendmsg+0x565/0x870 [ 322.878898][ T7067] ? __might_fault+0xaf/0x130 [ 322.878927][ T7067] ? __pfx_____sys_sendmsg+0x10/0x10 [ 322.878959][ T7067] ? import_iovec+0x73/0xa0 [ 322.878989][ T7067] ___sys_sendmsg+0x2a5/0x360 [ 322.879012][ T7067] ? __lock_acquire+0x683/0x2ce0 [ 322.879049][ T7067] ? __pfx____sys_sendmsg+0x10/0x10 [ 322.879112][ T7067] ? __fget_files+0x2a/0x420 [ 322.879140][ T7067] ? __fget_files+0x3a8/0x420 [ 322.879179][ T7067] __x64_sys_sendmsg+0x1b7/0x290 [ 322.879207][ T7067] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 322.879253][ T7067] do_syscall_64+0x166/0x520 [ 322.879280][ T7067] ? trace_irq_disable+0x3b/0x140 [ 322.879303][ T7067] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.879325][ T7067] ? clear_bhb_loop+0x70/0xc0 [ 322.879352][ T7067] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.879374][ T7067] RIP: 0033:0x7f02254ae0d9 [ 322.879395][ T7067] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 322.879413][ T7067] RSP: 002b:00007f02236e5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 322.879437][ T7067] RAX: ffffffffffffffda RBX: 00007f0225736090 RCX: 00007f02254ae0d9 [ 322.879452][ T7067] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 322.879464][ T7067] RBP: 00007f02236e5090 R08: 0000000000000000 R09: 0000000000000000 [ 322.879477][ T7067] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 322.879489][ T7067] R13: 00007f0225736128 R14: 00007f0225736090 R15: 00007ffcc839f098 [ 322.879523][ T7067] [ 322.912902][ T5815] usb 3-1: device descriptor read/64, error -71 [ 323.225625][ T5815] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 323.398911][ T37] audit: type=1107 audit(1787520658.174:53): pid=7071 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='+4C%[N&jh*琒veTEP}?=nlf= 4H]կÒ=8GnVl7<&W;' [ 323.835554][ T5696] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 325.011283][ T5696] usb 1-1: Using ep0 maxpacket: 16 [ 325.039786][ T5696] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 325.054189][ T5696] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 325.054209][ T5696] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 325.054223][ T5696] usb 1-1: config 0 has no interface number 0 [ 325.131215][ T5696] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.131243][ T5696] usb 1-1: Product: syz [ 325.131258][ T5696] usb 1-1: Manufacturer: syz [ 325.131272][ T5696] usb 1-1: SerialNumber: syz [ 325.947046][ T5696] usb 1-1: config 0 descriptor?? [ 327.238475][ T5696] uvcvideo 1-1:0.105: Found Unit with invalid ID 0 [ 327.302727][ T5696] uvcvideo 1-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 327.302754][ T5696] uvcvideo 1-1:0.105: No valid video chain found. [ 327.382866][ T5696] usb 1-1: USB disconnect, device number 10 [ 328.082921][ T5815] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 328.250312][ T5815] usb 4-1: Using ep0 maxpacket: 8 [ 328.251829][ T5815] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 328.277034][ T5815] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 328.277065][ T5815] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 328.277115][ T5815] usb 4-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 328.277162][ T5815] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 328.421001][ T5815] usbtmc 4-1:16.0: bulk endpoints not found [ 328.533550][ T5715] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 328.719936][ T5715] usb 2-1: Using ep0 maxpacket: 32 [ 329.123425][ T5715] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 0.00 [ 329.123490][ T5715] usb 2-1: no configurations [ 329.123503][ T5715] usb 2-1: can't read configurations, error -22 [ 329.394586][ T5602] usb 3-1: new low-speed USB device number 9 using dummy_hcd [ 330.228136][ T5715] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 330.310310][ T5606] usb 4-1: USB disconnect, device number 11 [ 330.400574][ T5715] usb 2-1: Using ep0 maxpacket: 32 [ 330.401555][ T5715] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 0.00 [ 330.401612][ T5715] usb 2-1: no configurations [ 330.401625][ T5715] usb 2-1: can't read configurations, error -22 [ 330.402180][ T5715] usb usb2-port1: attempt power cycle [ 330.409202][ T5602] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 330.433044][ T5602] usb 3-1: config 1 interface 0 altsetting 1 endpoint 0x82 is Bulk; changing to Interrupt [ 330.433129][ T5602] usb 3-1: config 1 interface 0 altsetting 1 endpoint 0x3 is Bulk; changing to Interrupt [ 330.433194][ T5602] usb 3-1: config 1 interface 0 has no altsetting 0 [ 330.498268][ T5602] usb 3-1: string descriptor 0 read error: -22 [ 330.498525][ T5602] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.555735][ T7117] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 330.556072][ T7117] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 330.675186][ T5602] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 330.750432][ T5715] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 330.777277][ T5715] usb 2-1: Using ep0 maxpacket: 32 [ 330.778105][ T5715] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 0.00 [ 330.778163][ T5715] usb 2-1: no configurations [ 330.778176][ T5715] usb 2-1: can't read configurations, error -22 [ 330.811561][ T5602] usb 3-1: USB disconnect, device number 9 [ 330.900261][ T5715] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 330.923781][ T5715] usb 2-1: Using ep0 maxpacket: 32 [ 330.925215][ T5715] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 0.00 [ 330.925272][ T5715] usb 2-1: no configurations [ 330.925289][ T5715] usb 2-1: can't read configurations, error -22 [ 330.926591][ T5715] usb usb2-port1: unable to enumerate USB device [ 331.124848][ T7129] 9p: Bad value for 'wfdno' [ 331.511858][ T37] audit: type=1107 audit(1787520666.294:54): pid=7135 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='+4C%[N&jh*琒veTEP}?=nlf= 4H]կÒ=8GnVl7<&W;' [ 331.950269][ T1000] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 332.122692][ T1000] usb 2-1: Using ep0 maxpacket: 16 [ 332.126203][ T1000] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 332.128931][ T1000] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 332.128959][ T1000] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 332.128978][ T1000] usb 2-1: config 0 has no interface number 0 [ 332.179076][ T1000] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.179104][ T1000] usb 2-1: Product: syz [ 332.179125][ T1000] usb 2-1: Manufacturer: syz [ 332.179135][ T1000] usb 2-1: SerialNumber: syz [ 332.226992][ T1000] usb 2-1: config 0 descriptor?? [ 332.293805][ T1000] uvcvideo 2-1:0.105: Found Unit with invalid ID 0 [ 332.460690][ T1000] uvcvideo 2-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 332.460729][ T1000] uvcvideo 2-1:0.105: No valid video chain found. [ 332.740274][ T7150] netlink: 104 bytes leftover after parsing attributes in process `syz.4.362'. [ 332.857074][ T5815] usb 2-1: USB disconnect, device number 13 [ 335.950378][ T1000] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 336.351538][ T1000] usb 4-1: Using ep0 maxpacket: 32 [ 337.377634][ T1000] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 337.377697][ T1000] usb 4-1: no configurations [ 337.377710][ T1000] usb 4-1: can't read configurations, error -22 [ 337.799560][ T1000] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 337.980319][ T1000] usb 4-1: Using ep0 maxpacket: 32 [ 337.982022][ T1000] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 337.982081][ T1000] usb 4-1: no configurations [ 337.982090][ T1000] usb 4-1: can't read configurations, error -22 [ 337.991472][ T1000] usb usb4-port1: attempt power cycle [ 339.001280][ T1000] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 339.730329][ T1000] usb 4-1: device descriptor read/8, error -71 [ 342.771762][ T7209] Bluetooth: MGMT ver 1.23 [ 343.419295][ T7224] netlink: 104 bytes leftover after parsing attributes in process `syz.2.383'. [ 345.355768][ T37] audit: type=1107 audit(1787520680.134:55): pid=7233 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='+4C%[N&jh*琒veTEP}?=nlf= 4H]կÒ=8GnVl7<&W;' [ 345.374039][ T5842] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 345.530338][ T5842] usb 3-1: Using ep0 maxpacket: 32 [ 345.531968][ T5842] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 345.532028][ T5842] usb 3-1: no configurations [ 345.532042][ T5842] usb 3-1: can't read configurations, error -22 [ 345.661898][ T5842] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 345.740736][ T5715] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 345.814105][ T5842] usb 3-1: Using ep0 maxpacket: 32 [ 345.827176][ T5842] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 345.827265][ T5842] usb 3-1: no configurations [ 345.827281][ T5842] usb 3-1: can't read configurations, error -22 [ 345.865482][ T5842] usb usb3-port1: attempt power cycle [ 345.910217][ T5715] usb 4-1: Using ep0 maxpacket: 16 [ 345.913045][ T5715] usb 4-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 345.919542][ T5715] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 345.919575][ T5715] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 345.919598][ T5715] usb 4-1: config 0 has no interface number 0 [ 345.975415][ T5715] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.975446][ T5715] usb 4-1: Product: syz [ 345.975464][ T5715] usb 4-1: Manufacturer: syz [ 345.975481][ T5715] usb 4-1: SerialNumber: syz [ 346.276715][ T5715] usb 4-1: config 0 descriptor?? [ 346.310374][ T5842] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 346.422661][ T5842] usb 3-1: Using ep0 maxpacket: 32 [ 346.423478][ T5842] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 346.423545][ T5842] usb 3-1: no configurations [ 346.423560][ T5842] usb 3-1: can't read configurations, error -22 [ 346.550236][ T5842] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 346.571170][ T5842] usb 3-1: Using ep0 maxpacket: 32 [ 346.571981][ T5842] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 346.572042][ T5842] usb 3-1: no configurations [ 346.572055][ T5842] usb 3-1: can't read configurations, error -22 [ 346.573601][ T5842] usb usb3-port1: unable to enumerate USB device [ 346.768967][ T5715] uvcvideo 4-1:0.105: Found Unit with invalid ID 0 [ 346.780251][ T5715] uvcvideo 4-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 346.780288][ T5715] uvcvideo 4-1:0.105: No valid video chain found. [ 346.980275][ T5606] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 346.990711][ T5842] usb 4-1: USB disconnect, device number 16 [ 347.110274][ T5606] usb 1-1: device descriptor read/64, error -71 [ 348.331518][ T5606] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 348.470287][ T5606] usb 1-1: device descriptor read/64, error -71 [ 349.425812][ T5606] usb usb1-port1: attempt power cycle [ 349.887627][ T7262] overlayfs: missing 'lowerdir' [ 350.130877][ T7268] netlink: 104 bytes leftover after parsing attributes in process `syz.0.396'. [ 351.858423][ T7269] comedi comedi4: comedi_config --init_data is deprecated [ 351.931917][ T7269] netlink: 32 bytes leftover after parsing attributes in process `syz.1.397'. [ 355.610478][ T5606] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 355.770355][ T5606] usb 4-1: Using ep0 maxpacket: 32 [ 355.771450][ T5606] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 355.771491][ T5606] usb 4-1: no configurations [ 355.771500][ T5606] usb 4-1: can't read configurations, error -22 [ 355.920249][ T5606] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 356.073578][ T5606] usb 4-1: Using ep0 maxpacket: 32 [ 356.088417][ T5606] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 356.088485][ T5606] usb 4-1: no configurations [ 356.088501][ T5606] usb 4-1: can't read configurations, error -22 [ 356.110222][ T5606] usb usb4-port1: attempt power cycle [ 356.126579][ T7288] netlink: 87 bytes leftover after parsing attributes in process `syz.2.405'. [ 356.652578][ T5606] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 356.681219][ T5606] usb 4-1: Using ep0 maxpacket: 32 [ 356.682365][ T5606] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 356.682408][ T5606] usb 4-1: no configurations [ 356.682417][ T5606] usb 4-1: can't read configurations, error -22 [ 357.660254][ T5606] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 357.697093][ T5606] usb 4-1: Using ep0 maxpacket: 32 [ 357.719963][ T5606] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 357.720014][ T5606] usb 4-1: no configurations [ 357.720026][ T5606] usb 4-1: can't read configurations, error -22 [ 357.783950][ T5606] usb usb4-port1: unable to enumerate USB device [ 360.842071][ T7304] MTD: Couldn't look up './dev': -15 [ 366.190370][ T5696] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 366.220282][ T5606] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 366.341609][ T5696] usb 5-1: Using ep0 maxpacket: 32 [ 366.342555][ T5696] usb 5-1: New USB device found, idVendor=044e, idProduct=120b, bcdDevice= 0.00 [ 366.343779][ T5696] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 366.343803][ T5696] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 366.343822][ T5696] usb 5-1: config 0 interface 0 has no altsetting 0 [ 366.343847][ T5696] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.374072][ T5696] usb 5-1: config 0 descriptor?? [ 366.413001][ T5606] usb 4-1: Using ep0 maxpacket: 8 [ 366.458921][ T5606] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 366.487318][ T5606] usb 4-1: config 0 has an invalid descriptor of length 84, skipping remainder of the config [ 366.487378][ T5606] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 366.487407][ T5606] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 193, changing to 11 [ 366.487435][ T5606] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 25667, setting to 1024 [ 366.487462][ T5606] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 366.589222][ T5606] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 366.589252][ T5606] usb 4-1: Product: syz [ 366.589269][ T5606] usb 4-1: Manufacturer: syz [ 366.589284][ T5606] usb 4-1: SerialNumber: syz [ 366.688286][ T5606] usb 4-1: config 0 descriptor?? [ 366.702347][ T7313] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 366.938151][ T5606] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 366.938180][ T5606] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 367.447235][ T5606] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 367.447264][ T5606] radio-si470x 4-1:0.0: si470x_get_scratch: si470x_get_report returned -110 [ 367.447595][ T5606] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -5 [ 368.466119][ T5696] hid-alps 0003:044E:120B.0001: failed read register (-71) [ 368.466224][ T5696] hid-alps 0003:044E:120B.0001: failed U1_DEV_CTRL_1 (-71) [ 369.333763][ T5715] usb 4-1: USB disconnect, device number 21 [ 369.585149][ T7346] netlink: 104 bytes leftover after parsing attributes in process `syz.1.417'. [ 370.466815][ T5696] hid-alps 0003:044E:120B.0001: hidraw0: USB HID v80.00 Joystick [HID 044e:120b] on usb-dummy_hcd.4-1/input0 [ 372.157010][ T5696] usb 5-1: USB disconnect, device number 16 [ 373.985778][ T7341] fido_id[7341]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 373.997616][ T7354] MTD: Couldn't look up './dev': -15 [ 376.040973][ T7360] FAULT_INJECTION: forcing a failure. [ 376.040973][ T7360] name failslab, interval 1, probability 0, space 0, times 0 [ 376.041023][ T7360] CPU: 0 UID: 0 PID: 7360 Comm: syz.1.423 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 376.041047][ T7360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 376.041064][ T7360] Call Trace: [ 376.041072][ T7360] [ 376.041081][ T7360] dump_stack_lvl+0xe8/0x150 [ 376.041119][ T7360] should_fail_ex+0x46b/0x600 [ 376.041156][ T7360] should_failslab+0xa8/0x100 [ 376.041183][ T7360] kmem_cache_alloc_noprof+0xa4/0x660 [ 376.041218][ T7360] ? skb_clone+0x212/0x3a0 [ 376.041240][ T7360] ? skb_clone+0x212/0x3a0 [ 376.041270][ T7360] skb_clone+0x212/0x3a0 [ 376.041298][ T7360] __netlink_deliver_tap+0x413/0x860 [ 376.041336][ T7360] ? netlink_deliver_tap+0x2e/0x1b0 [ 376.041362][ T7360] netlink_deliver_tap+0x19c/0x1b0 [ 376.041388][ T7360] netlink_unicast+0x7b8/0x990 [ 376.041422][ T7360] netlink_sendmsg+0x813/0xb40 [ 376.041464][ T7360] ? __pfx_netlink_sendmsg+0x10/0x10 [ 376.041492][ T7360] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 376.041521][ T7360] ? __kernel_text_address+0xd/0x30 [ 376.041544][ T7360] ? unwind_get_return_address+0x4d/0x90 [ 376.041575][ T7360] ? __pfx_netlink_sendmsg+0x10/0x10 [ 376.041599][ T7360] sock_sendmsg_nosec+0x13a/0x180 [ 376.041629][ T7360] ____sys_sendmsg+0x565/0x870 [ 376.041650][ T7360] ? __might_fault+0xaf/0x130 [ 376.041678][ T7360] ? __pfx_____sys_sendmsg+0x10/0x10 [ 376.041709][ T7360] ? import_iovec+0x73/0xa0 [ 376.041736][ T7360] ___sys_sendmsg+0x2a5/0x360 [ 376.041757][ T7360] ? __lock_acquire+0x683/0x2ce0 [ 376.041786][ T7360] ? __pfx____sys_sendmsg+0x10/0x10 [ 376.041844][ T7360] ? __fget_files+0x2a/0x420 [ 376.041873][ T7360] ? __fget_files+0x3a8/0x420 [ 376.041913][ T7360] __x64_sys_sendmsg+0x1b7/0x290 [ 376.041940][ T7360] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 376.041988][ T7360] do_syscall_64+0x166/0x520 [ 376.042017][ T7360] ? trace_irq_disable+0x3b/0x140 [ 376.042039][ T7360] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.042062][ T7360] ? clear_bhb_loop+0x70/0xc0 [ 376.042090][ T7360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.042121][ T7360] RIP: 0033:0x7f02254ae0d9 [ 376.042141][ T7360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.042159][ T7360] RSP: 002b:00007f0223706028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 376.042182][ T7360] RAX: ffffffffffffffda RBX: 00007f0225735fa0 RCX: 00007f02254ae0d9 [ 376.042198][ T7360] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000007 [ 376.042211][ T7360] RBP: 00007f0223706090 R08: 0000000000000000 R09: 0000000000000000 [ 376.042225][ T7360] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 376.042237][ T7360] R13: 00007f0225736038 R14: 00007f0225735fa0 R15: 00007ffcc839f098 [ 376.042273][ T7360] [ 379.094725][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.094799][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.300360][ T5696] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 379.300565][ T5845] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 379.450288][ T5696] usb 2-1: Using ep0 maxpacket: 8 [ 379.450469][ T5845] usb 4-1: Using ep0 maxpacket: 8 [ 379.478096][ T5696] usb 2-1: New USB device found, idVendor=07c0, idProduct=1125, bcdDevice= 0.40 [ 379.501747][ T5696] usb 2-1: config 1 interface 0 has no altsetting 0 [ 379.504123][ T5845] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 379.506743][ T5845] usb 4-1: config 0 has an invalid descriptor of length 84, skipping remainder of the config [ 379.506787][ T5845] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 379.506809][ T5845] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 193, changing to 11 [ 379.507145][ T5696] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.507164][ T5696] usb 2-1: Product: syz [ 379.507176][ T5696] usb 2-1: Manufacturer: syz [ 379.507189][ T5696] usb 2-1: SerialNumber: syz [ 379.509133][ T5845] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 25667, setting to 1024 [ 379.509166][ T5845] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 379.622461][ T5845] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 379.622487][ T5845] usb 4-1: Product: syz [ 379.622502][ T5845] usb 4-1: Manufacturer: syz [ 379.622515][ T5845] usb 4-1: SerialNumber: syz [ 379.675409][ T5845] usb 4-1: config 0 descriptor?? [ 379.677355][ T7375] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 379.894166][ T5845] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 379.894196][ T5845] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 380.146135][ T7375] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 380.146803][ T7375] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 380.239221][ T5696] usbhid 2-1:1.0: can't add hid device: -71 [ 380.239477][ T5696] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 380.272686][ T5696] usb 2-1: USB disconnect, device number 14 [ 380.445452][ T5845] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 380.445479][ T5845] radio-si470x 4-1:0.0: si470x_get_scratch: si470x_get_report returned -110 [ 380.445816][ T5845] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -5 [ 380.752303][ T7392] netlink: 104 bytes leftover after parsing attributes in process `syz.1.433'. [ 381.799914][ T5845] usb 4-1: USB disconnect, device number 22 [ 381.987388][ T7396] netlink: 104 bytes leftover after parsing attributes in process `syz.2.434'. [ 383.206904][ T7402] MTD: Couldn't look up './dev': -15 [ 386.076484][ T7421] MTD: Couldn't look up './dev': -15 [ 388.602202][ T7430] MTD: Couldn't look up './dev': -15 [ 391.402044][ T7431] netlink: 24 bytes leftover after parsing attributes in process `syz.2.442'. [ 391.940308][ T5696] usb 1-1: new low-speed USB device number 14 using dummy_hcd [ 392.069429][ T7431] netlink: 6 bytes leftover after parsing attributes in process `syz.2.442'. [ 392.085618][ T7431] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 392.131527][ T5696] usb 1-1: Invalid ep0 maxpacket: 64 [ 392.332089][ T5696] usb 1-1: new low-speed USB device number 15 using dummy_hcd [ 392.503045][ T5696] usb 1-1: Invalid ep0 maxpacket: 64 [ 392.503907][ T5696] usb usb1-port1: attempt power cycle [ 392.900258][ T5696] usb 1-1: new low-speed USB device number 16 using dummy_hcd [ 393.858508][ T5696] usb 1-1: Invalid ep0 maxpacket: 64 [ 394.110260][ T5696] usb 1-1: new low-speed USB device number 17 using dummy_hcd [ 394.127972][ T60] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 394.221360][ T60] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 394.227017][ T60] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 394.231934][ T60] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 394.264752][ T60] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 394.297319][ T5696] usb 1-1: Invalid ep0 maxpacket: 64 [ 394.301419][ T5696] usb usb1-port1: unable to enumerate USB device [ 394.451044][ T7472] MTD: Couldn't look up './dev': -15 [ 396.943383][ T4902] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 396.954050][ T4902] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 396.979270][ T4902] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 396.984167][ T4902] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 397.004148][ T4902] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 397.234845][ T7480] MTD: Couldn't look up './dev': -15 [ 399.488252][ T4902] Bluetooth: hci5: command tx timeout [ 401.561776][ T4902] Bluetooth: hci5: command tx timeout [ 401.792647][ T7512] overlayfs: missing 'lowerdir' [ 402.308904][ T5606] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 402.550191][ T5606] usb 2-1: device descriptor read/64, error -71 [ 402.874854][ T5606] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 403.010245][ T5602] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 403.050294][ T5606] usb 2-1: device descriptor read/64, error -71 [ 403.174855][ T5602] usb 3-1: Using ep0 maxpacket: 32 [ 403.175678][ T5606] usb usb2-port1: attempt power cycle [ 403.178648][ T5602] usb 3-1: New USB device found, idVendor=12d1, idProduct=1441, bcdDevice=46.21 [ 403.189915][ T5602] usb 3-1: config 5 has an invalid interface number: 164 but max is 0 [ 403.189947][ T5602] usb 3-1: config 5 has no interface number 0 [ 403.189997][ T5602] usb 3-1: config 5 interface 164 altsetting 6 endpoint 0x9 has invalid wMaxPacketSize 0 [ 403.190022][ T5602] usb 3-1: config 5 interface 164 has no altsetting 0 [ 403.261190][ T5602] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.261220][ T5602] usb 3-1: Product: syz [ 403.261237][ T5602] usb 3-1: Manufacturer: syz [ 403.261253][ T5602] usb 3-1: SerialNumber: syz [ 403.643253][ T4902] Bluetooth: hci5: command tx timeout [ 403.666358][ T5606] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 403.687633][ T5602] rndis_host 3-1:5.164: invalid descriptor buffer length [ 403.687658][ T5602] rndis_host 3-1:5.164: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 403.694385][ T5606] usb 2-1: device descriptor read/8, error -71 [ 403.699708][ T5602] option 3-1:5.164: GSM modem (1-port) converter detected [ 403.966009][ T5602] usb 3-1: USB disconnect, device number 14 [ 403.980352][ T5606] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 404.000939][ T5606] usb 2-1: device descriptor read/8, error -71 [ 404.066537][ T5602] option 3-1:5.164: device disconnected [ 404.112371][ T5606] usb usb2-port1: unable to enumerate USB device [ 405.382260][ T37] audit: type=1326 audit(1787520740.154:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7504 comm="syz.1.459" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f02254ae0d9 code=0x0 [ 405.726411][ T4902] Bluetooth: hci5: command tx timeout [ 405.792013][ T1191] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 406.056200][ T7527] syz_tun: entered allmulticast mode [ 406.960290][ T5845] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 407.284898][ T5845] usb 2-1: Using ep0 maxpacket: 32 [ 407.288775][ T5845] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 407.309638][ T5845] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 407.309661][ T5845] usb 2-1: config 0 has no interface number 0 [ 407.309710][ T5845] usb 2-1: config 0 interface 12 has no altsetting 0 [ 408.064378][ T5845] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.064410][ T5845] usb 2-1: Product: syz [ 408.064426][ T5845] usb 2-1: Manufacturer: syz [ 408.066434][ T5845] usb 2-1: SerialNumber: syz [ 408.115640][ T5845] usb 2-1: config 0 descriptor?? [ 408.651688][ T7566] netlink: 16 bytes leftover after parsing attributes in process `syz.1.469'. [ 408.651743][ T7566] netlink: 8 bytes leftover after parsing attributes in process `syz.1.469'. [ 408.792351][ T1191] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.454953][ T7577] netlink: 12 bytes leftover after parsing attributes in process `syz.0.475'. [ 410.473436][ T7577] netlink: 104 bytes leftover after parsing attributes in process `syz.0.475'. [ 411.467345][ T5845] f81534 2-1:0.12: f81534_set_register: reg: 1003 data: 40 failed: -32 [ 411.467408][ T5845] f81534 2-1:0.12: f81534_find_config_idx: read failed: -32 [ 411.467425][ T5845] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -32 [ 411.467524][ T5845] f81534 2-1:0.12: probe with driver f81534 failed with error -32 [ 411.713418][ T5845] usb 2-1: USB disconnect, device number 19 [ 415.007153][ T1191] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.380839][ T5815] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 416.530424][ T5815] usb 3-1: Using ep0 maxpacket: 32 [ 416.531436][ T5815] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 416.532391][ T5815] usb 3-1: config 0 has no interfaces? [ 416.539349][ T5815] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 416.539378][ T5815] usb 3-1: Product: syz [ 416.539393][ T5815] usb 3-1: Manufacturer: syz [ 416.539409][ T5815] usb 3-1: SerialNumber: syz [ 416.598760][ T5815] usb 3-1: config 0 descriptor?? [ 416.878564][ T5815] usb 3-1: USB disconnect, device number 15 [ 417.251488][ T1191] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.344779][ T7617] sit0: entered promiscuous mode [ 417.409376][ T7617] netlink: 'syz.3.487': attribute type 1 has an invalid length. [ 417.409399][ T7617] netlink: 1 bytes leftover after parsing attributes in process `syz.3.487'. [ 420.367070][ T7630] syz_tun: entered allmulticast mode [ 421.445780][ T7650] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 421.445805][ T7650] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 422.071014][ T7461] bridge0: port 1(bridge_slave_0) entered blocking state [ 422.071229][ T7461] bridge0: port 1(bridge_slave_0) entered disabled state [ 422.071451][ T7461] bridge_slave_0: entered allmulticast mode [ 422.102087][ T7461] bridge_slave_0: entered promiscuous mode [ 422.126813][ T7461] bridge0: port 2(bridge_slave_1) entered blocking state [ 422.126931][ T7461] bridge0: port 2(bridge_slave_1) entered disabled state [ 422.127122][ T7461] bridge_slave_1: entered allmulticast mode [ 422.152573][ T7461] bridge_slave_1: entered promiscuous mode [ 424.331212][ T7461] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 425.462984][ T7461] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 426.039351][ T7679] syz_tun: entered allmulticast mode [ 426.053842][ T7461] team0: Port device team_slave_0 added [ 426.064360][ T7461] team0: Port device team_slave_1 added [ 427.284265][ T1191] bridge_slave_1: left allmulticast mode [ 427.284384][ T1191] bridge_slave_1: left promiscuous mode [ 427.360570][ T1191] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.520269][ T5845] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 427.556519][ T37] audit: type=1107 audit(1787520762.334:57): pid=7693 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='+4C%[N&jh*琒veTEP}?=nlf= 4H]կÒ=8GnVl7<&W;' [ 427.600295][ T5602] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 427.770245][ T5602] usb 3-1: Using ep0 maxpacket: 16 [ 427.773462][ T5602] usb 3-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 427.814112][ T5602] usb 3-1: config 0 interface 0 has no altsetting 0 [ 427.814150][ T5602] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.850284][ T5845] usb 2-1: Using ep0 maxpacket: 16 [ 427.851174][ T5845] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=7b.55 [ 427.855445][ T5845] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 81 [ 427.888205][ T1191] bridge_slave_0: left allmulticast mode [ 427.888239][ T1191] bridge_slave_0: left promiscuous mode [ 427.896854][ T5845] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.896882][ T5845] usb 2-1: Product: syz [ 427.896897][ T5845] usb 2-1: Manufacturer: syz [ 427.896912][ T5845] usb 2-1: SerialNumber: syz [ 427.934254][ T1191] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.958018][ T5602] usb 3-1: config 0 descriptor?? [ 427.972197][ T5845] usb 2-1: config 0 descriptor?? [ 427.973913][ T7687] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 428.069022][ T5845] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 428.252874][ T7701] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.292449][ T7701] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.392150][ T7687] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.392463][ T7701] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.445677][ T7701] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.445827][ T7687] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.492505][ T5602] hid_mf 0003:0079:1846.0002: ignoring exceeding usage max [ 428.498836][ T5602] hid_mf 0003:0079:1846.0002: invalid report_size 35106 [ 428.498867][ T5602] hid_mf 0003:0079:1846.0002: item 0 2 1 7 parsing failed [ 428.526046][ T5602] hid_mf 0003:0079:1846.0002: HID parse failed. [ 428.526150][ T5602] hid_mf 0003:0079:1846.0002: probe with driver hid_mf failed with error -22 [ 428.598511][ T5602] usb 2-1: USB disconnect, device number 20 [ 428.629416][ T1527] usb 2-1: Failed to submit usb control message: -71 [ 428.629456][ T1527] usb 2-1: unable to send the bmi data to the device: -71 [ 428.629475][ T1527] usb 2-1: unable to get target info from device [ 428.629508][ T1527] usb 2-1: could not get target info (-71) [ 428.629935][ T1527] usb 2-1: could not probe fw (-71) [ 430.151285][ T7725] netlink: 'syz.3.516': attribute type 2 has an invalid length. [ 435.424502][ T1191] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 435.523936][ T1191] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 435.637607][ T1191] bond0 (unregistering): Released all slaves [ 436.865337][ T7461] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 436.865355][ T7461] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 436.865385][ T7461] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 436.948230][ T7461] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 436.948251][ T7461] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 436.948282][ T7461] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 437.052206][ T1000] usb 3-1: USB disconnect, device number 16 [ 440.461741][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.461799][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 442.029566][ T7461] hsr_slave_0: entered promiscuous mode [ 442.091816][ T7461] hsr_slave_1: entered promiscuous mode [ 442.096954][ T7461] debugfs: 'hsr0' already exists in 'hsr' [ 442.096982][ T7461] Cannot create hsr debugfs directory [ 442.150329][ T5606] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 442.310279][ T5606] usb 3-1: Using ep0 maxpacket: 32 [ 442.312402][ T5606] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 442.330769][ T5606] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.330800][ T5606] usb 3-1: Product: syz [ 442.330817][ T5606] usb 3-1: Manufacturer: syz [ 442.330833][ T5606] usb 3-1: SerialNumber: syz [ 442.426434][ T5606] usb 3-1: config 0 descriptor?? [ 442.528531][ T5606] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 443.124544][ T5606] gspca_ov534_9: reg_w failed -110 [ 443.233081][ T7811] Device name cannot be null; rc = [-22] [ 443.550127][ T5606] gspca_ov534_9: Unknown sensor 0000 [ 443.550235][ T5606] ov534_9 3-1:0.0: probe with driver ov534_9 failed with error -22 [ 447.059889][ T5696] usb 3-1: USB disconnect, device number 17 [ 447.114663][ T5248] 8021q: adding VLAN 0 to HW filter on device eth1 [ 447.363611][ T7831] FAULT_INJECTION: forcing a failure. [ 447.363611][ T7831] name failslab, interval 1, probability 0, space 0, times 0 [ 447.363649][ T7831] CPU: 1 UID: 0 PID: 7831 Comm: syz.1.540 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 447.363674][ T7831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 447.363688][ T7831] Call Trace: [ 447.363696][ T7831] [ 447.363713][ T7831] dump_stack_lvl+0xe8/0x150 [ 447.363752][ T7831] should_fail_ex+0x46b/0x600 [ 447.363792][ T7831] should_failslab+0xa8/0x100 [ 447.363820][ T7831] __kmalloc_noprof+0xfe/0x780 [ 447.363844][ T7831] ? __lock_acquire+0x683/0x2ce0 [ 447.363868][ T7831] ? __alloc_workqueue+0x111/0x1fe0 [ 447.363900][ T7831] ? __alloc_workqueue+0x111/0x1fe0 [ 447.363942][ T7831] __alloc_workqueue+0x111/0x1fe0 [ 447.363999][ T7831] alloc_workqueue_noprof+0xe3/0x210 [ 447.364039][ T7831] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 447.364078][ T7831] ? __asan_memcpy+0x40/0x70 [ 447.364112][ T7831] ? loop_set_status_from_info+0x17b/0x240 [ 447.364245][ T7831] loop_configure+0x646/0xdd0 [ 447.364287][ T7831] ? __pfx_loop_configure+0x10/0x10 [ 447.364312][ T7831] ? __lock_acquire+0x683/0x2ce0 [ 447.364370][ T7831] lo_ioctl+0xae6/0x2030 [ 447.364399][ T7831] ? unwind_next_frame+0x8f/0x2550 [ 447.364429][ T7831] ? __pfx_lo_ioctl+0x10/0x10 [ 447.364455][ T7831] ? is_bpf_text_address+0x26/0x2b0 [ 447.364496][ T7831] ? __lock_acquire+0x683/0x2ce0 [ 447.364523][ T7831] ? is_bpf_text_address+0x292/0x2b0 [ 447.364549][ T7831] ? is_bpf_text_address+0x26/0x2b0 [ 447.364579][ T7831] ? kernel_text_address+0xa5/0xe0 [ 447.364601][ T7831] ? __kernel_text_address+0xd/0x30 [ 447.364621][ T7831] ? unwind_get_return_address+0x4d/0x90 [ 447.364647][ T7831] ? __lock_acquire+0x683/0x2ce0 [ 447.364674][ T7831] ? __lock_acquire+0x683/0x2ce0 [ 447.364714][ T7831] ? __lock_acquire+0x683/0x2ce0 [ 447.364749][ T7831] ? __lock_acquire+0x683/0x2ce0 [ 447.364780][ T7831] ? __lock_acquire+0x683/0x2ce0 [ 447.364821][ T7831] ? unwind_next_frame+0x8f/0x2550 [ 447.364853][ T7831] ? is_bpf_text_address+0x26/0x2b0 [ 447.364894][ T7831] ? is_bpf_text_address+0x26/0x2b0 [ 447.364927][ T7831] ? is_bpf_text_address+0x292/0x2b0 [ 447.364955][ T7831] ? is_bpf_text_address+0x26/0x2b0 [ 447.364988][ T7831] ? kernel_text_address+0xa5/0xe0 [ 447.365010][ T7831] ? __kernel_text_address+0xd/0x30 [ 447.365032][ T7831] ? unwind_get_return_address+0x4d/0x90 [ 447.365055][ T7831] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 447.365078][ T7831] ? arch_stack_walk+0xfb/0x150 [ 447.365116][ T7831] ? stack_trace_save+0xa9/0x100 [ 447.365137][ T7831] ? __pfx_stack_trace_save+0x10/0x10 [ 447.365157][ T7831] ? kasan_save_track+0x4f/0x80 [ 447.365183][ T7831] ? stack_depot_save_flags+0x33/0x7f0 [ 447.365218][ T7831] ? __lock_acquire+0x683/0x2ce0 [ 447.365246][ T7831] ? kasan_save_track+0x4f/0x80 [ 447.365266][ T7831] ? kasan_save_track+0x3e/0x80 [ 447.365287][ T7831] ? kasan_save_free_info+0x40/0x50 [ 447.365316][ T7831] ? __kasan_slab_free+0x5c/0x80 [ 447.365337][ T7831] ? kfree+0x1c5/0x6d0 [ 447.365368][ T7831] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 447.365401][ T7831] ? security_file_ioctl+0xc3/0x2a0 [ 447.365433][ T7831] ? __se_sys_ioctl+0x47/0x170 [ 447.365451][ T7831] ? do_syscall_64+0x166/0x520 [ 447.365479][ T7831] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.365508][ T7831] ? __asan_memset+0x22/0x50 [ 447.365541][ T7831] ? blk_get_meta_cap+0x19d/0x780 [ 447.365576][ T7831] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 447.365615][ T7831] ? blkdev_common_ioctl+0x14b7/0x3250 [ 447.365654][ T7831] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 447.365687][ T7831] ? kasan_quarantine_put+0xbb/0x1f0 [ 447.365741][ T7831] ? tomoyo_path_number_perm+0x219/0x5f0 [ 447.365774][ T7831] ? tomoyo_path_number_perm+0x219/0x5f0 [ 447.365812][ T7831] ? do_vfs_ioctl+0x1184/0x1550 [ 447.365871][ T7831] ? __pfx_smack_file_ioctl+0x10/0x10 [ 447.365904][ T7831] ? __pfx_lo_ioctl+0x10/0x10 [ 447.365932][ T7831] blkdev_ioctl+0x5e6/0x750 [ 447.365966][ T7831] ? __pfx_blkdev_ioctl+0x10/0x10 [ 447.365994][ T7831] ? __fget_files+0x2a/0x420 [ 447.366027][ T7831] ? bpf_lsm_file_ioctl+0x9/0x20 [ 447.366061][ T7831] ? __pfx_blkdev_ioctl+0x10/0x10 [ 447.366092][ T7831] __se_sys_ioctl+0xff/0x170 [ 447.366116][ T7831] do_syscall_64+0x166/0x520 [ 447.366145][ T7831] ? trace_irq_disable+0x3b/0x140 [ 447.366168][ T7831] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.366189][ T7831] ? clear_bhb_loop+0x70/0xc0 [ 447.366211][ T7831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.366229][ T7831] RIP: 0033:0x7f02254ae0d9 [ 447.366246][ T7831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 447.366261][ T7831] RSP: 002b:00007f0223706028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 447.366281][ T7831] RAX: ffffffffffffffda RBX: 00007f0225735fa0 RCX: 00007f02254ae0d9 [ 447.366293][ T7831] RDX: 00002000000002c0 RSI: 0000000000004c0a RDI: 0000000000000006 [ 447.366304][ T7831] RBP: 00007f0223706090 R08: 0000000000000000 R09: 0000000000000000 [ 447.366314][ T7831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 447.366324][ T7831] R13: 00007f0225736038 R14: 00007f0225735fa0 R15: 00007ffcc839f098 [ 447.366350][ T7831] [ 451.460295][ T5815] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 451.618018][ T5815] usb 4-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 451.619476][ T5815] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 451.619509][ T5815] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 451.619534][ T5815] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 451.619578][ T5815] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.682678][ T7862] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 451.682803][ T7862] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 451.719622][ T5815] pl2303 4-1:1.0: pl2303 converter detected [ 451.740440][ T5815] usb 4-1: pl2303 converter now attached to ttyUSB0 [ 452.650327][ T5845] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 453.010764][ T7887] pl2303 4-1:1.0: pl2303_vendor_write - failed to write [0007]: -110 [ 453.030862][ T7887] pl2303 ttyUSB0: pl2303_get_line_request - failed: -32 [ 453.031281][ T7887] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 453.032026][ T7887] pl2303 4-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 453.079043][ T5845] usb 3-1: Using ep0 maxpacket: 32 [ 453.088127][ T5845] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 453.106807][ T5845] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 453.106845][ T5845] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 453.199681][ T5845] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 453.199712][ T5845] usb 3-1: Product: syz [ 453.199728][ T5845] usb 3-1: Manufacturer: syz [ 453.284565][ T5845] hub 3-1:4.0: USB hub found [ 453.310267][ T7887] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 453.681495][ T5845] hub 3-1:4.0: 2 ports detected [ 454.283562][ T7859] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 454.396374][ T7859] pl2303 ttyUSB0: error sending break = -32 [ 454.482873][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 454.723907][ T60] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 454.739324][ T60] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 454.757876][ T5815] usb 4-1: USB disconnect, device number 23 [ 454.795290][ T60] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 454.812001][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 454.840311][ T7903] netlink: 4 bytes leftover after parsing attributes in process `syz.2.553'. [ 454.840333][ T7903] netlink: 14 bytes leftover after parsing attributes in process `syz.2.553'. [ 455.163100][ T4902] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 455.163616][ T4902] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 455.164090][ T4902] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 455.184035][ T4902] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 455.188588][ T4902] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 455.280673][ T7883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 455.281412][ T7883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 455.939665][ T5815] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 455.969516][ T5815] pl2303 4-1:1.0: device disconnected [ 456.166272][ T5248] 8021q: adding VLAN 0 to HW filter on device eth2 [ 456.904314][ T5845] hub 3-1:4.0: hub_ext_port_status failed (err = -32) [ 457.283715][ T7927] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 457.288544][ T7927] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 457.545310][ T5602] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 457.546249][ T7928] netlink: 'syz.3.559': attribute type 2 has an invalid length. [ 457.750797][ T5602] usb 1-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 457.753407][ T5602] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.753435][ T5602] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 457.763073][ T5602] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.763103][ T5602] usb 1-1: Product: syz [ 457.763119][ T5602] usb 1-1: Manufacturer: syz [ 457.763135][ T5602] usb 1-1: SerialNumber: syz [ 457.850777][ T5845] usb 3-1: USB disconnect, device number 18 [ 457.870771][ T5602] usb 1-1: config 0 descriptor?? [ 458.419431][ T7932] syz_tun: entered allmulticast mode [ 458.529412][ T5845] usb 1-1: USB disconnect, device number 18 [ 458.766154][ T4902] Bluetooth: hci3: command tx timeout [ 459.985016][ T1191] hsr_slave_0: left promiscuous mode [ 460.387855][ T1191] hsr_slave_1: left promiscuous mode [ 460.393054][ T1191] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 460.393245][ T1191] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 461.383590][ T4902] Bluetooth: hci3: command tx timeout [ 461.401460][ T1191] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 461.401491][ T1191] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 462.986707][ T7978] netlink: 'syz.3.570': attribute type 2 has an invalid length. [ 463.400494][ T4902] Bluetooth: hci3: command tx timeout [ 465.257927][ T1191] veth1_macvtap: left promiscuous mode [ 465.485025][ T4902] Bluetooth: hci3: command tx timeout [ 465.586861][ T1191] veth0_macvtap: left promiscuous mode [ 465.850250][ T1191] veth1_vlan: left promiscuous mode [ 465.962565][ T1191] veth0_vlan: left promiscuous mode [ 466.246411][ T7989] FAULT_INJECTION: forcing a failure. [ 466.246411][ T7989] name failslab, interval 1, probability 0, space 0, times 0 [ 466.246449][ T7989] CPU: 0 UID: 0 PID: 7989 Comm: syz.2.576 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 466.246474][ T7989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 466.246498][ T7989] Call Trace: [ 466.246506][ T7989] [ 466.246515][ T7989] dump_stack_lvl+0xe8/0x150 [ 466.246553][ T7989] should_fail_ex+0x46b/0x600 [ 466.246594][ T7989] should_failslab+0xa8/0x100 [ 466.246622][ T7989] kmem_cache_alloc_noprof+0xa4/0x660 [ 466.246659][ T7989] ? do_getname+0x2e/0x250 [ 466.246686][ T7989] ? do_getname+0x2e/0x250 [ 466.246718][ T7989] do_getname+0x2e/0x250 [ 466.246741][ T7989] ? user_path_at+0x1e/0x160 [ 466.246774][ T7989] user_path_at+0x2a/0x160 [ 466.246808][ T7989] __se_sys_mount+0x2dc/0x420 [ 466.246841][ T7989] ? __pfx___se_sys_mount+0x10/0x10 [ 466.246876][ T7989] ? __x64_sys_mount+0x20/0xc0 [ 466.246905][ T7989] do_syscall_64+0x166/0x520 [ 466.246934][ T7989] ? trace_irq_disable+0x3b/0x140 [ 466.246958][ T7989] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.246980][ T7989] ? clear_bhb_loop+0x70/0xc0 [ 466.247006][ T7989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.247027][ T7989] RIP: 0033:0x7f3a578de0d9 [ 466.247048][ T7989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 466.247067][ T7989] RSP: 002b:00007f3a55b36028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 466.247090][ T7989] RAX: ffffffffffffffda RBX: 00007f3a57b65fa0 RCX: 00007f3a578de0d9 [ 466.247107][ T7989] RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 0000000000000000 [ 466.247120][ T7989] RBP: 00007f3a55b36090 R08: 0000200000000300 R09: 0000000000000000 [ 466.247134][ T7989] R10: 0000000000800400 R11: 0000000000000246 R12: 0000000000000001 [ 466.247147][ T7989] R13: 00007f3a57b66038 R14: 00007f3a57b65fa0 R15: 00007ffef06631f8 [ 466.247180][ T7989] [ 469.121616][ T8015] netlink: 'syz.1.583': attribute type 2 has an invalid length. [ 469.839622][ T1191] team0 (unregistering): Port device team_slave_1 removed [ 469.973499][ T1191] team0 (unregistering): Port device team_slave_0 removed [ 472.456063][ T8045] netlink: 32 bytes leftover after parsing attributes in process `syz.0.591'. [ 472.850198][ T5845] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 472.850467][ T5973] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 472.863968][ T8051] MTD: Couldn't look up './dev': -15 [ 474.663111][ T5973] usb 3-1: New USB device found, idVendor=9710, idProduct=7720, bcdDevice= 0.00 [ 474.665964][ T5845] usb 1-1: device descriptor read/64, error -71 [ 474.667347][ T5973] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 474.667377][ T5973] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 474.667401][ T5973] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 474.667425][ T5973] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 474.667447][ T5973] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 474.667487][ T5973] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.817303][ T8044] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 474.817433][ T8044] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 474.817555][ T8044] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 474.891128][ T5973] mos7720 3-1:1.0: Moschip 2 port adapter converter detected [ 474.930261][ T5845] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 475.131826][ T5845] usb 1-1: device descriptor read/64, error -71 [ 475.241597][ T5845] usb usb1-port1: attempt power cycle [ 475.320412][ T5973] usb 3-1: Moschip 2 port adapter converter now attached to ttyUSB0 [ 475.618626][ T5973] usb 3-1: Moschip 2 port adapter converter now attached to ttyUSB1 [ 476.054244][ T5973] usb 3-1: USB disconnect, device number 19 [ 476.229586][ T5973] moschip7720 ttyUSB0: Moschip 2 port adapter converter now disconnected from ttyUSB0 [ 476.294696][ T5973] moschip7720 ttyUSB1: Moschip 2 port adapter converter now disconnected from ttyUSB1 [ 476.295925][ T5973] mos7720 3-1:1.0: device disconnected [ 476.784460][ T8075] netlink: 144 bytes leftover after parsing attributes in process `syz.3.599'. [ 476.784488][ T8075] openvswitch: netlink: Flow key attr not present in new flow. [ 477.244557][ T5248] 8021q: adding VLAN 0 to HW filter on device eth3 [ 477.260407][ T8080] 9p: Bad value for 'rfdno' [ 477.525568][ T37] audit: type=1800 audit(1787520812.284:58): pid=8090 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.2.603" name=3A202E31323334352E2E2E2E2028313829207238203D2030783363333130303030300A202020202020323A202E31323334352E2E382E20283835292063616C6C2070632B360A202020202020333A202E2E2E2E2E2E2E2E382E2028313829207230203D203078313130303030303066666666666666660A202020202020353A202E2E2E2E2E2E2E2E382E202836362920696620773820733E2030783020676F746F2070632B300A202020202020363A202E2E2E2E2E2E2E2E2E2E20283138292072 dev="tmpfs" ino=707 res=0 errno=0 [ 479.826587][ T8109] MTD: Couldn't look up './dev': -15 [ 481.230647][ T8113] netlink: 68 bytes leftover after parsing attributes in process `syz.2.606'. [ 482.051361][ T8120] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 483.468843][ T5248] 8021q: adding VLAN 0 to HW filter on device eth4 [ 483.631230][ T8159] mtrr: base(0x6d6c642f7665642f000) is not aligned on a size(0x6e6f6d2d000) boundary [ 483.660410][ T8159] process 'syz.2.617' launched './file0' with NULL argv: empty string added [ 485.286358][ T7891] bridge0: port 1(bridge_slave_0) entered blocking state [ 485.286527][ T7891] bridge0: port 1(bridge_slave_0) entered disabled state [ 485.286743][ T7891] bridge_slave_0: entered allmulticast mode [ 485.329104][ T7891] bridge_slave_0: entered promiscuous mode [ 485.554996][ T37] audit: type=1326 audit(1787521076.326:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8189 comm="syz.2.623" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3a578de0d9 code=0x0 [ 485.674811][ T7891] bridge0: port 2(bridge_slave_1) entered blocking state [ 485.674953][ T7891] bridge0: port 2(bridge_slave_1) entered disabled state [ 485.675157][ T7891] bridge_slave_1: entered allmulticast mode [ 485.725401][ T7891] bridge_slave_1: entered promiscuous mode [ 486.148632][ T7891] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 486.169963][ T7891] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 487.942224][ T7891] team0: Port device team_slave_0 added [ 488.218298][ T8238] netlink: 104 bytes leftover after parsing attributes in process `syz.1.632'. [ 489.084698][ T7891] team0: Port device team_slave_1 added [ 490.960926][ T5842] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 491.461260][ T5842] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 491.578016][ T5842] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 491.597313][ T5842] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.597345][ T5842] usb 3-1: Product: syz [ 491.597361][ T5842] usb 3-1: Manufacturer: syz [ 491.597378][ T5842] usb 3-1: SerialNumber: syz [ 491.776558][ T7891] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 491.776577][ T7891] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 491.776608][ T7891] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 492.146298][ T7891] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 492.146315][ T7891] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 492.146339][ T7891] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 492.458408][ T5842] snd-usb-6fire 3-1:1.0: unknown device firmware state received from device: [ 492.458430][ T5842] eb aa 55 88 00 00 00 00 [ 492.458565][ T5842] snd-usb-6fire 3-1:1.0: probe with driver snd-usb-6fire failed with error -5 [ 492.936984][ T12] bridge_slave_1: left allmulticast mode [ 492.937023][ T12] bridge_slave_1: left promiscuous mode [ 492.937295][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 494.443422][ T8311] comedi comedi3: pcl730: I/O base address not correctly aligned [ 494.511666][ T12] bridge_slave_0: left allmulticast mode [ 494.511705][ T12] bridge_slave_0: left promiscuous mode [ 494.524844][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 494.529047][ T5845] usb 3-1: USB disconnect, device number 20 [ 494.693355][ T8318] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 494.693383][ T8318] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 494.740213][ T5606] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 494.890147][ T5606] usb 1-1: Using ep0 maxpacket: 16 [ 494.891153][ T5606] usb 1-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 494.893367][ T5606] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 494.893393][ T5606] usb 1-1: config 0 has no interface number 0 [ 494.953561][ T5606] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.953591][ T5606] usb 1-1: Product: syz [ 494.953751][ T5606] usb 1-1: Manufacturer: syz [ 494.953769][ T5606] usb 1-1: SerialNumber: syz [ 495.030322][ T5606] usb 1-1: config 0 descriptor?? [ 495.086142][ T5606] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 495.815834][ T8344] netlink: 'syz.1.655': attribute type 5 has an invalid length. [ 495.847513][ T8344] overlayfs: failed to resolve 'lower2': -2 [ 495.905014][ T5606] gspca_spca1528: reg_w err -71 [ 495.930239][ T5606] spca1528 1-1:0.1: probe with driver spca1528 failed with error -71 [ 495.952596][ T5606] usb 1-1: USB disconnect, device number 22 [ 496.561261][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 497.921620][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 498.438546][ T12] bond0 (unregistering): Released all slaves [ 500.417562][ T7891] hsr_slave_0: entered promiscuous mode [ 500.457263][ T7891] hsr_slave_1: entered promiscuous mode [ 500.458383][ T7891] debugfs: 'hsr0' already exists in 'hsr' [ 500.458410][ T7891] Cannot create hsr debugfs directory [ 501.074831][ T5602] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 501.165386][ T12] hsr_slave_0: left promiscuous mode [ 501.200302][ T12] hsr_slave_1: left promiscuous mode [ 501.209066][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 501.250290][ T5602] usb 2-1: Using ep0 maxpacket: 8 [ 501.251354][ T5602] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 501.253956][ T5602] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 501.253986][ T5602] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 501.254051][ T5602] usb 2-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 501.254097][ T5602] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.255613][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 501.369775][ T5602] usbtmc 2-1:16.0: bulk endpoints not found [ 501.421758][ T8398] MTD: Couldn't look up './dev': -15 [ 503.373633][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 503.373705][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 504.863746][ T8410] netlink: 104 bytes leftover after parsing attributes in process `syz.2.674'. [ 505.906491][ T8412] ======================================================= [ 505.906491][ T8412] WARNING: The mand mount option has been deprecated and [ 505.906491][ T8412] and is ignored by this kernel. Remove the mand [ 505.906491][ T8412] option from the mount to silence this warning. [ 505.906491][ T8412] ======================================================= [ 505.907207][ T8412] Smack: duplicate mount options [ 506.701221][ T12] team0 (unregistering): Port device team_slave_1 removed [ 506.962724][ T12] team0 (unregistering): Port device team_slave_0 removed [ 507.772024][ T8430] MTD: Couldn't look up './dev': -15 [ 510.944991][ T36] usb 2-1: USB disconnect, device number 21 [ 511.584553][ T8447] netlink: 104 bytes leftover after parsing attributes in process `syz.0.685'. [ 514.894428][ T60] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 514.959270][ T60] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 514.994301][ T60] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 515.041573][ T60] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 515.049809][ T60] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 515.326188][ T4902] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 517.743756][ T8472] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 517.828563][ T4902] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 518.110214][ T5715] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 518.225314][ T8503] MTD: Couldn't look up './dev': -15 [ 519.092023][ T5715] usb 2-1: device descriptor read/64, error -71 [ 519.954453][ T8511] MTD: Couldn't look up './dev': -15 [ 522.347678][ T5248] 8021q: adding VLAN 0 to HW filter on device eth5 [ 522.699964][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 522.718962][ T60] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 522.808680][ T60] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 522.821201][ T60] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 522.837241][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 524.840840][ T12] bridge_slave_1: left allmulticast mode [ 524.840879][ T12] bridge_slave_1: left promiscuous mode [ 524.843017][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 525.065941][ T60] Bluetooth: hci3: command tx timeout [ 526.396251][ T12] bridge_slave_0: left allmulticast mode [ 526.396281][ T12] bridge_slave_0: left promiscuous mode [ 526.396497][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.694183][ T8560] capability: warning: `syz.0.707' uses 32-bit capabilities (legacy support in use) [ 526.814316][ T8563] MTD: Couldn't look up './dev': -15 [ 527.090294][ T60] Bluetooth: hci3: command tx timeout [ 527.223635][ T36] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 527.769452][ T4902] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 527.855498][ T4902] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 527.857267][ T4902] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 527.933581][ T4902] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 527.935118][ T4902] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 528.686493][ T36] usb 2-1: Using ep0 maxpacket: 32 [ 528.687355][ T36] usb 2-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 528.713649][ T36] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 528.713680][ T36] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 528.713748][ T36] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 528.751163][ T36] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.751195][ T36] usb 2-1: Product: syz [ 528.751211][ T36] usb 2-1: Manufacturer: syz [ 528.751227][ T36] usb 2-1: SerialNumber: syz [ 528.846409][ T36] usb 2-1: interface 2 not found [ 529.101064][ T5780] usb 2-1: USB disconnect, device number 24 [ 529.197666][ T60] Bluetooth: hci3: command tx timeout [ 530.157086][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 530.202148][ T60] Bluetooth: hci5: command tx timeout [ 530.478356][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 530.565698][ T12] bond0 (unregistering): Released all slaves [ 531.250369][ T60] Bluetooth: hci3: command tx timeout [ 531.469571][ T5587] syz_tun (unregistering): left allmulticast mode [ 531.583381][ T8596] sg_write: data in/out 458716/90 bytes for SCSI command 0xfe-- guessing data in; [ 531.583381][ T8596] program syz.0.716 not setting count and/or reply_len properly [ 532.281413][ T60] Bluetooth: hci5: command tx timeout [ 534.372380][ T60] Bluetooth: hci5: command tx timeout [ 534.616766][ T12] hsr_slave_0: left promiscuous mode [ 534.700193][ T12] hsr_slave_1: left promiscuous mode [ 534.701860][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 534.799589][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 534.935256][ T13] IPVS: starting estimator thread 0... [ 535.070315][ T8621] IPVS: using max 8 ests per chain, 19200 per kthread [ 535.415697][ T37] audit: type=1107 audit(1787521126.196:60): pid=8624 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='+4C%[N&jh*琒veTEP}?=nlf= 4H]կÒ=8GnVl7<&W;' [ 536.441217][ T60] Bluetooth: hci5: command tx timeout [ 536.540151][ T5842] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 536.682755][ T12] team0 (unregistering): Port device team_slave_1 removed [ 536.697842][ T5842] usb 2-1: Using ep0 maxpacket: 16 [ 536.698819][ T5842] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 536.703446][ T5842] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 536.703472][ T5842] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 536.703490][ T5842] usb 2-1: config 0 has no interface number 0 [ 536.745571][ T5842] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.745604][ T5842] usb 2-1: Product: syz [ 536.745621][ T5842] usb 2-1: Manufacturer: syz [ 536.745642][ T5842] usb 2-1: SerialNumber: syz [ 536.780730][ T5842] usb 2-1: config 0 descriptor?? [ 536.805473][ T12] team0 (unregistering): Port device team_slave_0 removed [ 537.855360][ T8648] GUP no longer grows the stack in syz.0.729 (8648): 200000005000-200000008000 (200000004000) [ 537.855428][ T8648] CPU: 1 UID: 0 PID: 8648 Comm: syz.0.729 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 537.855455][ T8648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 537.855469][ T8648] Call Trace: [ 537.855478][ T8648] [ 537.855488][ T8648] dump_stack_lvl+0xe8/0x150 [ 537.855529][ T8648] fixup_user_fault+0x637/0x6f0 [ 537.855570][ T8648] fault_in_user_writeable+0x71/0xd0 [ 537.855600][ T8648] futex_lock_pi+0x7bf/0xac0 [ 537.855632][ T8648] ? futex_unqueue+0x211/0x240 [ 537.855672][ T8648] ? __pfx_futex_lock_pi+0x10/0x10 [ 537.855739][ T8648] ? __pfx_futex_wake_mark+0x10/0x10 [ 537.855790][ T8648] ? __pfx_userfaultfd_unmap_complete+0x10/0x10 [ 537.855830][ T8648] do_futex+0x330/0x4e0 [ 537.855875][ T8648] ? __pfx_do_futex+0x10/0x10 [ 537.855906][ T8648] ? __vm_munmap+0x2fe/0x3e0 [ 537.855943][ T8648] __se_sys_futex+0x3a8/0x450 [ 537.855981][ T8648] ? __pfx___se_sys_futex+0x10/0x10 [ 537.856011][ T8648] ? rcu_is_watching+0x16/0xb0 [ 537.856048][ T8648] ? __x64_sys_futex+0x21/0xf0 [ 537.856079][ T8648] do_syscall_64+0x166/0x520 [ 537.856109][ T8648] ? trace_irq_disable+0x3b/0x140 [ 537.856132][ T8648] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.856156][ T8648] ? clear_bhb_loop+0x70/0xc0 [ 537.856187][ T8648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.856211][ T8648] RIP: 0033:0x7fcd3c19e0d9 [ 537.856232][ T8648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 537.856252][ T8648] RSP: 002b:00007fcd3a3f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 537.856277][ T8648] RAX: ffffffffffffffda RBX: 00007fcd3c425fa0 RCX: 00007fcd3c19e0d9 [ 537.856293][ T8648] RDX: 0000000000000001 RSI: 000000000000008d RDI: 0000200000004000 [ 537.856308][ T8648] RBP: 00007fcd3c235024 R08: 0000000000000000 R09: 0000000000000001 [ 537.856323][ T8648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 537.856336][ T8648] R13: 00007fcd3c426038 R14: 00007fcd3c425fa0 R15: 00007ffe645ab588 [ 537.856373][ T8648] [ 538.193342][ T5842] usb 2-1: USB disconnect, device number 25 [ 538.779890][ T8661] netlink: 16 bytes leftover after parsing attributes in process `syz.1.731'. [ 541.214495][ T5248] 8021q: adding VLAN 0 to HW filter on device eth6 [ 542.839952][ T8715] netlink: 104 bytes leftover after parsing attributes in process `syz.0.741'. [ 544.166297][ T8727] MTD: Couldn't look up './dev': -15 [ 545.470202][ T5715] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 545.630224][ T5715] usb 1-1: Using ep0 maxpacket: 8 [ 545.647883][ T8520] bridge0: port 1(bridge_slave_0) entered blocking state [ 545.648836][ T8520] bridge0: port 1(bridge_slave_0) entered disabled state [ 545.649886][ T8520] bridge_slave_0: entered allmulticast mode [ 545.755879][ T5715] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 545.757197][ T5715] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 545.757225][ T5715] usb 1-1: config 0 has no interface number 0 [ 545.757270][ T5715] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 545.757288][ T5715] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 545.757307][ T5715] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 545.757325][ T5715] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 545.757341][ T5715] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 545.757371][ T5715] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 546.225106][ T8520] bridge_slave_0: entered promiscuous mode [ 546.693736][ T5715] usb 1-1: config 0 descriptor?? [ 546.699676][ T8520] bridge0: port 2(bridge_slave_1) entered blocking state [ 546.699805][ T8520] bridge0: port 2(bridge_slave_1) entered disabled state [ 546.724116][ T8520] bridge_slave_1: entered allmulticast mode [ 546.766823][ T8520] bridge_slave_1: entered promiscuous mode [ 546.976648][ T8725] netlink: 'syz.0.744': attribute type 1 has an invalid length. [ 547.136092][ T5715] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 547.200137][ T5715] usb 1-1: USB disconnect, device number 23 [ 547.311251][ T5715] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 547.333915][ T8520] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 547.457033][ T8520] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 547.459664][ T5248] 8021q: adding VLAN 0 to HW filter on device eth7 [ 547.633867][ T8520] team0: Port device team_slave_0 added [ 547.761887][ T8520] team0: Port device team_slave_1 added [ 548.512537][ T8763] netlink: 8 bytes leftover after parsing attributes in process `syz.2.745'. [ 548.512564][ T8763] netlink: 12 bytes leftover after parsing attributes in process `syz.2.745'. [ 548.512594][ T8763] netlink: 'syz.2.745': attribute type 20 has an invalid length. [ 548.689454][ T8570] bridge0: port 1(bridge_slave_0) entered blocking state [ 548.689583][ T8570] bridge0: port 1(bridge_slave_0) entered disabled state [ 548.689790][ T8570] bridge_slave_0: entered allmulticast mode [ 548.720739][ T8570] bridge_slave_0: entered promiscuous mode [ 548.776368][ T8771] netlink: 76 bytes leftover after parsing attributes in process `syz.1.753'. [ 548.954903][ T8570] bridge0: port 2(bridge_slave_1) entered blocking state [ 548.955035][ T8570] bridge0: port 2(bridge_slave_1) entered disabled state [ 548.955240][ T8570] bridge_slave_1: entered allmulticast mode [ 548.979584][ T8570] bridge_slave_1: entered promiscuous mode [ 549.038481][ T8520] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 549.038500][ T8520] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 549.038536][ T8520] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 549.150286][ T5780] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 549.196521][ T8520] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 549.196540][ T8520] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 549.196571][ T8520] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 549.301516][ T5780] usb 2-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 549.303197][ T5780] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 549.303224][ T5780] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 549.310758][ T5780] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.310826][ T5780] usb 2-1: Product: syz [ 549.310870][ T5780] usb 2-1: Manufacturer: syz [ 549.310913][ T5780] usb 2-1: SerialNumber: syz [ 549.446164][ T5780] usb 2-1: config 0 descriptor?? [ 549.517264][ T8570] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 549.560341][ T8570] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 549.796373][ T8570] team0: Port device team_slave_0 added [ 549.836732][ T8520] hsr_slave_0: entered promiscuous mode [ 549.839771][ T8520] hsr_slave_1: entered promiscuous mode [ 549.869291][ T8520] debugfs: 'hsr0' already exists in 'hsr' [ 549.869317][ T8520] Cannot create hsr debugfs directory [ 549.887236][ T8570] team0: Port device team_slave_1 added [ 549.993389][ T5780] usb 2-1: USB disconnect, device number 26 [ 551.922714][ T8570] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 551.922728][ T8570] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 551.922748][ T8570] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 552.049525][ T8570] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 552.049545][ T8570] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 552.049576][ T8570] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 554.035664][ T8570] hsr_slave_0: entered promiscuous mode [ 554.037160][ T8570] hsr_slave_1: entered promiscuous mode [ 554.038211][ T8570] debugfs: 'hsr0' already exists in 'hsr' [ 554.038238][ T8570] Cannot create hsr debugfs directory [ 559.464579][ T8874] netlink: 76 bytes leftover after parsing attributes in process `syz.2.769'. [ 559.701391][ T5815] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 559.852777][ T5815] usb 3-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 559.854338][ T5815] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.854365][ T5815] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 559.857785][ T5815] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.857813][ T5815] usb 3-1: Product: syz [ 559.857828][ T5815] usb 3-1: Manufacturer: syz [ 559.857844][ T5815] usb 3-1: SerialNumber: syz [ 559.942682][ T5815] usb 3-1: config 0 descriptor?? [ 560.075088][ T8884] sg_write: data in/out 548864/136 bytes for SCSI command 0x0-- guessing data in; [ 560.075088][ T8884] program syz.1.772 not setting count and/or reply_len properly [ 560.643845][ T1000] usb 3-1: USB disconnect, device number 21 [ 560.991892][ T8909] netlink: 12 bytes leftover after parsing attributes in process `syz.1.775'. [ 561.192783][ T8910] netlink: 104 bytes leftover after parsing attributes in process `syz.1.775'. [ 563.050807][ T8917] netlink: 'syz.1.777': attribute type 1 has an invalid length. [ 563.050861][ T8917] netlink: 'syz.1.777': attribute type 1 has an invalid length. [ 563.053578][ T8917] iwpm_send_hello: Unable to send a nlmsg [ 564.876234][ T8928] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 568.207349][ T8983] netlink: 76 bytes leftover after parsing attributes in process `syz.1.788'. [ 568.288160][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.288261][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 568.326987][ T36] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 568.510126][ T5715] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 568.512175][ T36] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 568.512233][ T36] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 568.514159][ T36] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 568.514212][ T36] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 568.514236][ T36] usb 3-1: config 0 interface 0 has no altsetting 0 [ 568.515601][ T36] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 568.515660][ T36] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 568.515683][ T36] usb 3-1: config 0 interface 0 has no altsetting 0 [ 568.518938][ T36] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 568.519007][ T36] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 568.519038][ T36] usb 3-1: config 0 interface 0 has no altsetting 0 [ 568.602439][ T36] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 568.602500][ T36] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 568.602526][ T36] usb 3-1: config 0 interface 0 has no altsetting 0 [ 568.626726][ T36] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 568.626888][ T36] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 568.626962][ T36] usb 3-1: config 0 interface 0 has no altsetting 0 [ 568.684129][ T5715] usb 2-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 568.689581][ T36] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 568.689634][ T36] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 568.689658][ T36] usb 3-1: config 0 interface 0 has no altsetting 0 [ 568.718058][ T5715] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 568.718107][ T5715] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 568.751437][ T36] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 568.751487][ T36] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 568.751508][ T36] usb 3-1: config 0 interface 0 has no altsetting 0 [ 568.765854][ T36] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 568.765912][ T36] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 568.765938][ T36] usb 3-1: config 0 interface 0 has no altsetting 0 [ 568.832114][ T5715] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.832144][ T5715] usb 2-1: Product: syz [ 568.832159][ T5715] usb 2-1: Manufacturer: syz [ 568.832174][ T5715] usb 2-1: SerialNumber: syz [ 568.838674][ T36] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 568.838705][ T36] usb 3-1: Product: syz [ 568.838722][ T36] usb 3-1: Manufacturer: syz [ 568.838737][ T36] usb 3-1: SerialNumber: syz [ 568.957569][ T5715] usb 2-1: config 0 descriptor?? [ 568.976120][ T36] usb 3-1: config 0 descriptor?? [ 569.006383][ T36] yurex 3-1:0.0: Could not find endpoints [ 569.272061][ T5815] usb 3-1: USB disconnect, device number 22 [ 569.618527][ T8570] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 569.636876][ T5815] usb 2-1: USB disconnect, device number 27 [ 569.836612][ T8570] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 569.846436][ T8570] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 570.049251][ T9008] netlink: 12 bytes leftover after parsing attributes in process `syz.2.795'. [ 570.067511][ T9008] netlink: 104 bytes leftover after parsing attributes in process `syz.2.795'. [ 570.932978][ T8570] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 570.993818][ T8570] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 571.111119][ T8570] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 571.131993][ T5715] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 571.493553][ T5715] usb 1-1: Using ep0 maxpacket: 8 [ 571.498401][ T5715] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 571.501770][ T5715] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 571.501799][ T5715] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 571.501851][ T5715] usb 1-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 571.501896][ T5715] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.586147][ T5715] usbtmc 1-1:16.0: bulk endpoints not found [ 572.932716][ T8570] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 573.557151][ T8570] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 573.736916][ T5780] usb 1-1: USB disconnect, device number 24 [ 575.093765][ T9037] FAULT_INJECTION: forcing a failure. [ 575.093765][ T9037] name failslab, interval 1, probability 0, space 0, times 0 [ 575.093805][ T9037] CPU: 0 UID: 0 PID: 9037 Comm: syz.0.800 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 575.093830][ T9037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 575.093844][ T9037] Call Trace: [ 575.093853][ T9037] [ 575.093862][ T9037] dump_stack_lvl+0xe8/0x150 [ 575.093901][ T9037] should_fail_ex+0x46b/0x600 [ 575.093949][ T9037] should_failslab+0xa8/0x100 [ 575.093978][ T9037] __kmalloc_cache_noprof+0xa0/0x6b0 [ 575.094002][ T9037] ? shrinker_alloc+0x59/0xb10 [ 575.094031][ T9037] ? shrinker_alloc+0x59/0xb10 [ 575.094068][ T9037] shrinker_alloc+0x59/0xb10 [ 575.094100][ T9037] ? __rt_spin_lock_init+0x3e/0x50 [ 575.094147][ T9037] sget_fc+0xe41/0x1a60 [ 575.094179][ T9037] ? __pfx_super_s_dev_test+0x10/0x10 [ 575.094216][ T9037] ? __pfx_super_s_dev_set+0x10/0x10 [ 575.094251][ T9037] ? __pfx_sget_fc+0x10/0x10 [ 575.094281][ T9037] ? mntput_no_expire+0x1c/0x1c0 [ 575.094304][ T9037] ? mntput_no_expire+0x1c/0x1c0 [ 575.094328][ T9037] ? mntput_no_expire+0x190/0x1c0 [ 575.094361][ T9037] sget_dev+0xab/0xf0 [ 575.094391][ T9037] ? __pfx_sget_dev+0x10/0x10 [ 575.094424][ T9037] ? rcu_is_watching+0x16/0xb0 [ 575.094452][ T9037] ? kfree+0x4d/0x6d0 [ 575.094489][ T9037] nilfs_get_tree+0x19d/0x850 [ 575.094522][ T9037] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 575.094555][ T9037] ? vfs_parse_fs_qstr+0x163/0x1e0 [ 575.094593][ T9037] ? __pfx_nilfs_get_tree+0x10/0x10 [ 575.094626][ T9037] ? cap_capable+0x123/0x460 [ 575.094660][ T9037] ? safesetid_security_capable+0xa9/0x1a0 [ 575.094701][ T9037] vfs_get_tree+0x92/0x2a0 [ 575.094737][ T9037] do_new_mount+0x319/0xdc0 [ 575.094764][ T9037] ? cap_capable+0x123/0x460 [ 575.094800][ T9037] ? __pfx_do_new_mount+0x10/0x10 [ 575.094831][ T9037] ? ns_capable+0x89/0xe0 [ 575.094860][ T9037] ? path_mount+0x647/0x1050 [ 575.094893][ T9037] ? user_path_at+0xd4/0x160 [ 575.094925][ T9037] __se_sys_mount+0x31d/0x420 [ 575.094967][ T9037] ? __pfx___se_sys_mount+0x10/0x10 [ 575.095003][ T9037] ? __x64_sys_mount+0x20/0xc0 [ 575.095034][ T9037] do_syscall_64+0x166/0x520 [ 575.095063][ T9037] ? trace_irq_disable+0x3b/0x140 [ 575.095086][ T9037] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.095109][ T9037] ? clear_bhb_loop+0x70/0xc0 [ 575.095137][ T9037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.095160][ T9037] RIP: 0033:0x7fcd3c19e0d9 [ 575.095181][ T9037] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 575.095201][ T9037] RSP: 002b:00007fcd3a3f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 575.095224][ T9037] RAX: ffffffffffffffda RBX: 00007fcd3c425fa0 RCX: 00007fcd3c19e0d9 [ 575.095241][ T9037] RDX: 0000200000000000 RSI: 0000200000000100 RDI: 0000200000000140 [ 575.095256][ T9037] RBP: 00007fcd3a3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 575.095270][ T9037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 575.095283][ T9037] R13: 00007fcd3c426038 R14: 00007fcd3c425fa0 R15: 00007ffe645ab588 [ 575.095317][ T9037] [ 577.559546][ T9061] netlink: 76 bytes leftover after parsing attributes in process `syz.0.806'. [ 577.648763][ T8520] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 577.700430][ T8520] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 577.708248][ T8520] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 577.774233][ T8520] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 577.788076][ T8520] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 577.950204][ T5715] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 578.022529][ T8520] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 578.073400][ T8520] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 578.180460][ T5715] usb 1-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 578.183948][ T5715] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 578.183978][ T5715] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 578.187741][ T5715] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.187772][ T5715] usb 1-1: Product: syz [ 578.187789][ T5715] usb 1-1: Manufacturer: syz [ 578.187805][ T5715] usb 1-1: SerialNumber: syz [ 578.288486][ T8520] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 578.396125][ T5715] usb 1-1: config 0 descriptor?? [ 579.222672][ T8570] 8021q: adding VLAN 0 to HW filter on device bond0 [ 579.597470][ T8570] 8021q: adding VLAN 0 to HW filter on device team0 [ 579.657969][ T1191] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.658126][ T1191] bridge0: port 1(bridge_slave_0) entered forwarding state [ 579.724962][ T1000] usb 1-1: USB disconnect, device number 25 [ 579.812375][ T1022] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.812495][ T1022] bridge0: port 2(bridge_slave_1) entered forwarding state [ 579.872951][ T8520] 8021q: adding VLAN 0 to HW filter on device bond0 [ 580.139000][ T8520] 8021q: adding VLAN 0 to HW filter on device team0 [ 580.218018][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 580.218164][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 580.346184][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.346459][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 580.509453][ T1191] ------------[ cut here ]------------ [ 580.509468][ T1191] in_task() && kcov_mode_enabled(mode) [ 580.509493][ T1191] WARNING: kernel/kcov.c:894 at kcov_remote_start+0x5d6/0x710, CPU#0: kworker/u8:13/1191 [ 580.509542][ T1191] Modules linked in: [ 580.509582][ T1191] CPU: 0 UID: 0 PID: 1191 Comm: kworker/u8:13 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 580.509611][ T1191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 580.509626][ T1191] Workqueue: events_unbound cfg80211_wiphy_work [ 580.509654][ T1191] RIP: 0010:kcov_remote_start+0x5d6/0x710 [ 580.509679][ T1191] Code: 03 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 11 f7 02 03 90 0f 0b 90 eb d1 90 0f 0b 90 0f b7 83 c0 04 00 00 e9 ab fa ff ff 90 <0f> 0b 90 eb 04 90 0f 0b 90 e8 0c b8 8a 09 89 c0 48 c7 c7 c0 52 a3 [ 580.509700][ T1191] RSP: 0018:ffffc900062cf9d8 EFLAGS: 00010202 [ 580.509719][ T1191] RAX: 0000000000000000 RBX: ffff888028ce0000 RCX: 8000000000000001 [ 580.509737][ T1191] RDX: 0000000000000000 RSI: ffffffff8bcbc060 RDI: ffffffff8bcbc020 [ 580.509753][ T1191] RBP: ffff88803eb0a780 R08: ffffffff8b52ee52 R09: 0000000000000000 [ 580.509768][ T1191] R10: 0000000000000000 R11: ffffffff8e1c3740 R12: dffffc0000000000 [ 580.509784][ T1191] R13: ffff888021fa5ef8 R14: 0000000000000000 R15: ffff888062931180 [ 580.509800][ T1191] FS: 0000000000000000(0000) GS:ffff888125bf4000(0000) knlGS:0000000000000000 [ 580.509818][ T1191] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 580.509834][ T1191] CR2: 00007ffe645aa80c CR3: 000000005f61e000 CR4: 00000000003526f0 [ 580.509854][ T1191] Call Trace: [ 580.509863][ T1191] [ 580.509879][ T1191] ieee80211_iface_work+0x20c/0x1010 [ 580.509928][ T1191] cfg80211_wiphy_work+0x29e/0x420 [ 580.509956][ T1191] ? process_scheduled_works+0x97a/0x1630 [ 580.510067][ T1191] process_scheduled_works+0xc3d/0x1630 [ 580.510138][ T1191] ? __pfx_process_scheduled_works+0x10/0x10 [ 580.510187][ T1191] ? assign_work+0x3cf/0x5d0 [ 580.510236][ T1191] worker_thread+0xa47/0xfb0 [ 580.510289][ T1191] kthread+0x38b/0x470 [ 580.510321][ T1191] ? __pfx_worker_thread+0x10/0x10 [ 580.510344][ T1191] ? __pfx_kthread+0x10/0x10 [ 580.510381][ T1191] ret_from_fork+0x514/0xb70 [ 580.510418][ T1191] ? __pfx_ret_from_fork+0x10/0x10 [ 580.510453][ T1191] ? __switch_to+0xc89/0x1420 [ 580.510485][ T1191] ? __pfx_kthread+0x10/0x10 [ 580.510516][ T1191] ret_from_fork_asm+0x1a/0x30 [ 580.510550][ T1191] [ 580.510573][ T1191] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 580.510589][ T1191] CPU: 0 UID: 0 PID: 1191 Comm: kworker/u8:13 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 580.510612][ T1191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 580.510624][ T1191] Workqueue: events_unbound cfg80211_wiphy_work [ 580.510647][ T1191] Call Trace: [ 580.510655][ T1191] [ 580.510663][ T1191] vpanic+0x56d/0xa60 [ 580.510683][ T1191] ? __pfx__printk+0x10/0x10 [ 580.510706][ T1191] ? __pfx_vpanic+0x10/0x10 [ 580.510734][ T1191] ? is_bpf_text_address+0x292/0x2b0 [ 580.510757][ T1191] ? is_bpf_text_address+0x26/0x2b0 [ 580.510796][ T1191] panic+0xc5/0xd0 [ 580.510825][ T1191] ? __pfx_panic+0x10/0x10 [ 580.510866][ T1191] ? ret_from_fork_asm+0x1a/0x30 [ 580.510892][ T1191] __warn+0x315/0x4c0 [ 580.510910][ T1191] ? kcov_remote_start+0x5d6/0x710 [ 580.510931][ T1191] ? kcov_remote_start+0x5d6/0x710 [ 580.510949][ T1191] __report_bug+0x276/0x570 [ 580.510977][ T1191] ? kcov_remote_start+0x5d6/0x710 [ 580.510997][ T1191] ? __pfx___report_bug+0x10/0x10 [ 580.511024][ T1191] ? __pfx_rtlock_slowlock_locked+0x10/0x10 [ 580.511047][ T1191] ? rt_spin_lock+0x1e2/0x400 [ 580.511066][ T1191] ? rt_spin_lock+0x1e2/0x400 [ 580.511086][ T1191] ? kcov_remote_start+0x5d6/0x710 [ 580.511103][ T1191] report_bug+0x16b/0x220 [ 580.511127][ T1191] ? kcov_remote_start+0x5d6/0x710 [ 580.511143][ T1191] ? kcov_remote_start+0x5d8/0x710 [ 580.511160][ T1191] handle_bug+0x9c/0x200 [ 580.511186][ T1191] exc_invalid_op+0x1a/0x50 [ 580.511213][ T1191] asm_exc_invalid_op+0x1a/0x20 [ 580.511233][ T1191] RIP: 0010:kcov_remote_start+0x5d6/0x710 [ 580.511252][ T1191] Code: 03 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 11 f7 02 03 90 0f 0b 90 eb d1 90 0f 0b 90 0f b7 83 c0 04 00 00 e9 ab fa ff ff 90 <0f> 0b 90 eb 04 90 0f 0b 90 e8 0c b8 8a 09 89 c0 48 c7 c7 c0 52 a3 [ 580.511269][ T1191] RSP: 0018:ffffc900062cf9d8 EFLAGS: 00010202 [ 580.511287][ T1191] RAX: 0000000000000000 RBX: ffff888028ce0000 RCX: 8000000000000001 [ 580.511301][ T1191] RDX: 0000000000000000 RSI: ffffffff8bcbc060 RDI: ffffffff8bcbc020 [ 580.511315][ T1191] RBP: ffff88803eb0a780 R08: ffffffff8b52ee52 R09: 0000000000000000 [ 580.511328][ T1191] R10: 0000000000000000 R11: ffffffff8e1c3740 R12: dffffc0000000000 [ 580.511341][ T1191] R13: ffff888021fa5ef8 R14: 0000000000000000 R15: ffff888062931180 [ 580.511361][ T1191] ? rt_spin_lock+0x1e2/0x400 [ 580.511386][ T1191] ? kcov_remote_start+0xeb/0x710 [ 580.511409][ T1191] ieee80211_iface_work+0x20c/0x1010 [ 580.511449][ T1191] cfg80211_wiphy_work+0x29e/0x420 [ 580.511472][ T1191] ? process_scheduled_works+0x97a/0x1630 [ 580.511495][ T1191] process_scheduled_works+0xc3d/0x1630 [ 580.511545][ T1191] ? __pfx_process_scheduled_works+0x10/0x10 [ 580.511584][ T1191] ? assign_work+0x3cf/0x5d0 [ 580.511611][ T1191] worker_thread+0xa47/0xfb0 [ 580.511693][ T1191] kthread+0x38b/0x470 [ 580.511722][ T1191] ? __pfx_worker_thread+0x10/0x10 [ 580.511744][ T1191] ? __pfx_kthread+0x10/0x10 [ 580.511772][ T1191] ret_from_fork+0x514/0xb70 [ 580.511804][ T1191] ? __pfx_ret_from_fork+0x10/0x10 [ 580.511831][ T1191] ? __switch_to+0xc89/0x1420 [ 580.511861][ T1191] ? __pfx_kthread+0x10/0x10 [ 580.511891][ T1191] ret_from_fork_asm+0x1a/0x30 [ 580.511927][ T1191] [ 580.514167][ T1191] Kernel Offset: disabled