last executing test programs: 58.911602065s ago: executing program 4 (id=985): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000300)={0x48, 0x2, r1, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x14, r2}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r0, 0x3ba0, &(0x7f0000000100)={0x44, 0xa, r2, 0x0, r1}) 58.738474404s ago: executing program 4 (id=988): syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x9c, 0x0, @wg}}}}}, 0x0) syz_emit_ethernet(0x9e, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x300, 0x4e22, 0x7c, 0x0, @wg=@data={0x4, 0x0, 0x0, '\x00'/100}}}}}}, 0x0) 58.60472691s ago: executing program 4 (id=989): open_tree(0xffffffffffffff9c, 0x0, 0x89901) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x882) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='map_files\x00') ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000280)={{0x70000, 0xe000, 0xc, 0x6, 0x4, 0xa, 0x3, 0xe, 0x7, 0x9, 0x4, 0x8}, {0x2, 0xb000, 0xe, 0x13, 0x1, 0x7, 0x3, 0x10, 0x0, 0x46, 0x6}, {0x1, 0x315a4c100da1da58, 0x4, 0x1, 0x5, 0x5, 0xc3, 0x6, 0xb, 0x6, 0x3, 0x3}, {0xeeee0000, 0x4000, 0x1a, 0xc, 0x7f, 0x6, 0x8, 0x7f, 0x9, 0x2, 0x4, 0x6}, {0x9000, 0x8000000, 0x0, 0xd, 0x9, 0x2d, 0x5, 0xc, 0xfc, 0x0, 0x3, 0x7}, {0xdddd1000, 0x8092000, 0x8, 0xb5, 0x6, 0x7, 0x12, 0x1, 0xbf, 0x18, 0x4, 0x4}, {0x1, 0x1, 0xc, 0x9, 0x0, 0xf, 0x10, 0x3, 0x6, 0x0, 0x80, 0x9}, {0x80a0000, 0xffff, 0x4, 0x4, 0xff, 0x3, 0x0, 0xf9, 0x1, 0xfc, 0x0, 0xfe}, {0x5000, 0xadd8}, {0xfffff000, 0x17}, 0x4004000f, 0x0, 0xd000, 0x100, 0x100000001, 0x0, 0xdddd1000, [0x5, 0x3, 0x4000000000000008, 0x7]}) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000002c0)=[@code={0xa, 0x5d, {"b8010000000f01c166bad104ec0fdb4d70b99f030000b8feffffffba000000000f300f20578f292098953200000066baf80cb8e68af88def66bafc0c66ed2666420fc737ff4d49c4c155f3e9"}}], 0x5d}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 57.622762501s ago: executing program 2 (id=993): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x66) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0x800fa11, 0xffffffff}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000011c0)='net/protocols\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f0000003900)=""/4104, 0x1008}], 0x1, 0x73, 0x0) syz_open_dev$vim2m(0x0, 0x7fff, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="01000000050010000500000005"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r3}, &(0x7f0000000380)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r4 = syz_open_dev$loop(&(0x7f0000000200), 0x5, 0x86100) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000580)={r0, 0x8, {0x2a00, 0x80010000, 0x0, 0xf73, 0x0, 0x0, 0x6, 0x1f, 0x1c, "fee80100000000000000a0e9a1af1ea09dc2b7fb0a010000020000000000030000000000000100000000000000000000000000000000001b00", "a1195397bab22d00a726a7e7c1ee80f85f819e01077d3d458dac00000090cd0000000000e6ffffffffffffff00", "90be8b1c5a0000000000000000000000000000000027a84ba70000ddffffff00", [0x100400000004, 0xa]}}) r6 = syz_open_dev$loop(&(0x7f0000000300), 0x7, 0xc0240) ioctl$LOOP_CHANGE_FD(r4, 0x4c06, r6) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r7 = syz_open_dev$vim2m(&(0x7f0000000200), 0x1, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r7, 0xc02c564a, &(0x7f0000000340)={0x5, 0x34424752, 0x3, @stepwise={0x2, 0xfff, 0x8, 0x4, 0x2, 0x81}}) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$UFFDIO_COPY(r5, 0xc028aa03, &(0x7f0000000040)={&(0x7f000032a000/0x4000)=nil, &(0x7f00006fa000/0x4000)=nil, 0x4000}) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r8, 0x84, 0x17, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) 55.992324068s ago: executing program 4 (id=998): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x118, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0xf7, 0xc, "175bd8f5c573144d2373863d15b8264c305f0760e173075666c7bf4e86fbd0fc493b921e9ee1c0313c88cbd7aab7e04f4bd56991a6ac432061da4af6a1453460d81a9303350b790e35dc2cb080dd5e45baeec50f935ed525ebddabda7162667aeef1c22b8f8f10a5ccecf90cb58bf8f7c6439a3e634a1e4a21256361703de30a1be50bd32dc1356c888222fd0a3faffb9e297d9553e16c0b4e2b37402b4083ac3b69cc8a133279757075329473525e09081eca143c5210cdf73eded0167b2e744ee73f42d44b2257e8cbfdb297cd471c3cfbf8863c5932ee57b317b8c73e9dacac27e78373b850bc30379168017a8d41c9789f"}]}, @NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x5}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x36}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}, @NFTA_EXTHDR_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x1cc}}, 0x0) 53.355090766s ago: executing program 4 (id=1000): r0 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f00000000c0), 0x2, 0x0) writev(r0, &(0x7f0000001800)=[{&(0x7f0000000400)="e6fc7619a32391536bbf04ed8840b969e23788b05b3aaebf440b20915b85d3573a609627d977184ae6726323575fcb0ce6a04a32daa6fdd9d44e3c9ef218bd3c53a9241d59c565370886667fd788e1b487aa1bc1d05225e2e85024f248f7312b1940bcf745ceba7740b5cfa3b0daba17c1259755c83e4300c0bc0d3edbc2310be3ce16f6f1a824c7b9ba5f99e68f9f77364e", 0x92}, {&(0x7f0000000580)="87c97c35daaf2da495d7b73037c026ef9a925fbcac5f09fb94f677bbfef3246b6225a460f3497fdf4594cd7249ef1b653cc3b34f6a582665421757ef726771ad809cb8382a9efe6dc7d5b9bca92d4a896662049c4f96d6d066ef63adf7eaa9630e7b8fec14382f0996d0f4a3097a6d655c06a9f0b332bb5c412496907a127e651de5842b5be0225589dcf740f6ad42baddfaaa4e619f4335ffe0704910f9c175e98759a682306012894471cc47084857d9e55c35adcaf95de0abd4569d924bcd0b8434c2e450bfb05c8ed633b6778e3fec98f124328661374f3219569ce3383e358a0ed738", 0xe5}, {&(0x7f0000000780)="2d0c5d02018bee63b6c544c8f7c900e4c3ed2ff77043410013e4cb05189d20557272425c11dc955fb062599cb761d4e84923e9ddc646db591c250e2f295385381595efaeac4cc785d04764e9c0142d45f425b3287a716ca106ab7327b0bf408111cab3c248d42baa62849276fec31ec2ce1c618d640e", 0x76}, {&(0x7f0000000800)="f1f2db858ff3785e98a490011543664e77f6453d042f713854a61e7f2143e58e74aed195a43829628e54a42b25e5bbdbaf0a67cceede15f930b36f2e315ddb51b968f0c1518bd3bd907e3956ad542725c4a1034cef14db60540a02ef6a815cb234e1ec0a71c384f0c7a74b7041b5dd21764339b06c91791a3ec55fe411b23dff31a411b68e0b358e8992b07e755b50881cfd72fb90278d8314ada835dc31ec3c8b148066e9e1be2016965315c908a6371b6b3184f025010afa1d5e1ee12fba4299b37e8fff5806136363a5d40b1495d15ddaddd2d92e4050d6ba8603748b0b86910371279bd75f51d7f3c91e6c199068c066d2c1974fe0f848191ea99ebab274deba6c252c67b49a854c994e8afd78c10cae9f3b8e8b876fd653a3832580a58bf3d7e98fbde3740505c7ef0d9a877fa941c31929bb0a7b40b97dc70b9cd3665894e73405ca5ca5ebb3ec5c9c79bac33e5556b7869722f2c3203d7524ff1163a3b4b0b53b7bf9aaac54f7147c5dd0dd635b25951ec5ce04a88757225eeea6d3c2a6a29e19d2c21a55127fbc0c27cc9037a97f05b1fac30a15fed3a3a93fea45d7e2c27fa35ca3b0d1f4e0f5b17d330bd299c0c24a6046c269f46d34e66097142b6cde4f8243a18190e12ed3d5ac211c5333bde604f136a7382dbaff890d494920e03513a595505b4caed9bc11f2d742d1cb59fa3b277f9a4d80cf640c606c2d7533c67e6fe1ecc2523ba52afb3efe6a15cd7b71cdf914b1d7846212e02ae4199ecf3cd7f2c1c7a11d5e84fff04bab51edefdc97febc03d89ab82e41617a3c8e2b1c6873d96a3d1c45f37cc69c374736ebea0ae6f7248d2ac24c41506a7ba766b53031db477a0f808a68b13e8a67665fda9afaedb96aec31ff52727736c0435f52122cba3957ee3093fd2b834844aa8282cc0d6e8df7e8bb4a0881aeed6a021d49a09940573dcd809a93382950fe67100978e50e6eb7370304dcf6d05f33dae53fb385ca330ee4378a1140de769c3db98b6ea58ebb13bcbbc0554013e588e9204ef74574741026c531cbdd3875e55dd2651d5230a3cc22d370fa560e9843de14cde54bbfe41de6a0b1e4d4e42e1506a449e0654a6f95e2f7bc6f99c30c2af94004c94c0b7125ff28143b29371ef4bfb57778ad0fb120011877d7e587747b5632e2f0610333d51c54b08d824dae7a0aa44f91ef290b284a35645e12256456e9bb15a55630125ed828af0ee68fdb67f4687363cf6c6ad2017f56dd0b34640b0df152b28389aa9ddff237c6428012bd40eca0152b557644d22eea10c5371f1caa021669001339e99dd36e37651e27a72d40739f5720d8792f91a1d8095c2961610bc4b92e218a6862e357fcf0732d30113e416549a49001128dbee2349ecd1c6f005f2d0dbf617d2d12ce40114d3ab11821cacdfcf76e371b3bc3046e87785f2a35b4289cf58c477df4c850ef088bcc4eb1ad8ea7961f2be050951f18bb45c62a3210272fe78e111772d8ea426f6f2d474c74c1af51fda8cd3855ce3bb344683ee095ac8b52a4027c4ec65094f77a4cbd27fd3ceb9d2bb37069d480f28fad1aa880d715105f0bf7eb9c710a890d6462c0ff899017232a270fb0ac1221c6babf819238af3bc22e32731fdddbddfb80105dfbe12f4a8246ad7679aa6508a3fa4e4c6b09098905bfb360182266d7616e675296ed204ff737c6146020af88d099ce0ee371a47b9e9ae8fab9f9521794c48fc13ca5bfa7e88b769a6136ca742634708f63506d1f83fb7e31a68bea657de2779ef2cd6c9c9ab74939781b4feffeb73cce61c1630e53343bb7b6cffc2ebe85e07033ae9a360badc44a82d0bf214f3b66b28e653259daa404626a61d5fe8e57837fb5a0b6b6ebfb4bcdd8c818fd27f7594e9544b9352361236dff033207b098a23aa4fde8dc2f1fc6d6ec481c5f2c3a58618b0d49fcd0ba1253214da96420a4b4bff1603d607ff5eeeea70c0bcd95385da3c5c8d59c89492a4f24ebd6493fbb7a75f80ae5bfede32f4aebf7c2625277d74340ec43337d57620226072cb2b61e05f39cfcf833942e09e9c577348c3bb75822673b4350625610efc36f063f64378d3781474011e5719c67519705877ca0d18114ee294851856a68d128784b87e4745c30797bc396c7cead1cb75021859a8d7ab55bce80d584541ca8b0806d16a6e57d41011984e6cd63cd588ed9585720e7eb34eddcbbc0730fa7a27fc0324e7f4ca4f3f3aed7e9dcb791214c9674cbabc784dee2ae751768285d9b19da6638d9107b186340b0a45a7d5f310371ba8010c2d7efcc99de69769dba9e3d3824ebf8880a0e19b5e01bfb9a62e8416564aae6cee6cf199024ee900c60c7924e7b3dc37faa1786772799311762a5f226898ea8f95a0aa4963863ef5f7e103c8bb9dd9f35fe417cd7e05e30c7cbd7a6f9bb60d1c685cbb20c573e8c19a65bd00042f09e7857acf853677b8a66c09bd690cdfa24b9206f3182023f17e5bb442c7500078cfdcd624338ab8efffbe41337311c46d631e065390381824928e6d0828eb190ecec2367d5abc6b89c98b43c58395007e5b4c8eee67cb71ecfc71cc6aaa66d1ce7e12390f494c547370d71dd6df3e767bf0fb0f4601331d2680e5d1c0cb11356424ab9514b7e492c61a2a178ea08d91d74a7723d7c7294e4e012332f2d31303f6080f6868a03a58b2dc11f8b5d5e876051aa176f41729084205e04c3bd3ff4bc2e66848785d07b1f395de529e08f7673971115eed0bc9b89bd9e1665d8fad72130e29e57f381c6582ac54cc72d9cb7f43500c00b8a79a79a7084e918800b1a601490b8e508128c4c2c7bc0b2669d957a4e413d208295dcb1a5da8aac7120d0887499b22b55f06fe56f61d0b2078fc778ded03eb9a676b603f10122eb40e9e73a4bc9cddd5e6c98af8c33ee5d040eca69e80f545faa260e1cc88b5c2343979e88951d360f2ff86128ba3618b4cb32220eee68f512ba3ce64ab2a0df9956b87bccdc1c3f297023a9f8a0162a146d2e37ade4bdff151fcc54cd817e4a52f9571f7f02f2e9735600596147ad6bc208868951274bb5e36245c4189bd5649e4c90ad07acf69e0a1d185c6c3cb180515a320aa083b2456635fbe8e44897f9fe0346c74f83132a782f8161f6061ccf1ad7927ae7e408d26af1d1eb3df5e5648aff5287b07d400fdac16a95a335d36c2b7ee5b6012ffa60d1752d011d598d435201e2db58faf858c498a92f0dc8077f7dd3fbae7882cea457c18d545f45ee720d3dc16c66addd11bb9186d5e7cabcd8c8e5fc4ab800d09480e9b6ab25c8338ebe5d46ff68e240bb4db312a29883892632b41092c242b58c67913138790d767a4529cc39ae0bbbcb394b65cbe64696b416ca72fe51fdbc82782cf1a6f32187e6ada21ebe239a0724d5c0e584f06636bba28c4a5f0433cbe1d0ef0d1f28296474166876a370324bdca977288cfb260cb3d19233f76d165deafe1e4eebc47a99ce8c026d884deb3c0390e57e274986ea10e307dc633cf7f550a6ebc3664109394bfd4b08d2da67db8e5c6d965c19fe1570c1e986b2d95b94af504c51efb50139972a6a73a1e467b381e5a2f14c3b7b3fb623e27855726a0fe729813332ecacdf6d5777aa1ddf5b202697d888e67e2492b59fa9f5b5a2676ee99b343921466bb4d559d4005d5e48b8b69c927602d7a088e6f55bf3c14daa1f603ee38fc347720d3698538598065cf4e1e2580117a8dbde2981d4f045187f4a7571af0168bde86982f500b2ac4a1acb99e0e5c4a033270fe5ebbc6d88a733ef67cffcce024c7bc25afe3a2ad3f42269da10c85136d95e41183f488a8491d9285d96e65e733e9c05a6098a0d00d38a56865b22c7478cdaa5ae3bba391b6d0bea51235c3a4ba8c7d13d093b265b662fe168a7a74424aeee74fb5483d559f9261cbef1a231aef7ee63b4bc51968d5fcff99ecc69a9bd2b67818bf15c75132596ac1ab7e08ad595d3743eba69aac7d886948816abe22a38097cf945eaf19102e82d8b1768c4c5dc63881cb5f230a632e27648aa06c9dc5619d8df533f8a018d59a88a2cc994935c65e4dbe7d7374cbb4503e4f9e8129d8c4ff28a099401fd1bd4004ba26fac615d964dec66424057f2f5900506f784e93379c13167f14a6bad1baf4b839790e96867b5cd4232bbd56ae8ef3d1ae29e6785d6a2f50e0eccec15a9aed16c4200ca4450d987410c8239904da461a9fcb244b9d5511c717c895ffd900cceb34dc9bb6913c152515a795db6752fc01209e12ab1df8374c9539a2b8f3110b158b5c66c4e12628a63ca26458c4402c536192f2dd503a13546ef4904a4bcbaf8bc1b546e38c5350e8d5fe5c3ff629a3d003508d35b80e3574597cde7bfced63b73d9112333725579454dbccbf9dd778af9adc5ddc4f1d34a053ba40a01c691c795fbf67ede90b00349c6e06e6941db8e2c1d16d00f9b1c07bd5f2caab7cb2d2c662c1aff4a6cbc4a02b4b1e1583cfb98242b562b85ef4ced955cf8e2bf60de2c393f18ca54e84e1a06684ea9b466d24cdef999688af14dab2936f308808a492d20aaa5e5da930c3b4894a7d349098a90296e59a9a523795a5b32519ab8dac31511ab656f2c2357461c2329d37ac929edb478edfce278f8ac0ebee32090a5dcffbde10c2da6743981aef3278e4df90c207aa9eba0cb902ba2d2ee4eb81eb4a299ac948d6ecadbaaabc054f01d8efa43151a8463e049dd7471c8c77a53cee9b4bd9a3b81b19b2cbdec936bf33416a0367ee3b8febf12a76ea9fd1aa7b6f2159b692d2b5cbccb27a5909c9cc904d9fa655e303eb821e5601ba160bfda0605165b926fb7f2aca383d9d671682705304c5343d849565309c6650234f345b3c986c71200e8f0328f0e0b01dfc6022ac435a88932031c6fe42dc7a259906adb025df1fe16738df6cd6fcd34836083af4e836f421533483235cc1d15cf4a91c3a849542d00d5cfb73ff30fe09d9b8a449048dfc90d959499e8ed54bf37668ed7ef2a14ad844562566498463bdec9944d097fe2f7e15b499104496948907be03c38fcca78637b7430f0a4176dae5427de06c3154b965ed947431bf71b2849b4edad9bc9f662e33fccf40a2fc5cc412530c8feaac6c77b6533901ea087402d96836627528f33a9254cd27432d173236033faf4dbd2825c5831c06d5cec80e6a06dc194f3217a85acf0e71b6ea9004582d9689f545cc8778a4e2c86db1f6e3f4fe6d30788c71de96c89c65e3fab50f1bf3e904111c0bfc5c5b4236259103c84d003f156fc3e842881faff943011693afed31cddeb1e1c2d439d91e9768b94b00b3a7a7bb0d56e3033929ef1171fc9802beaffa3e17958570055a68ce0a43c967e49a56e7419092660e98137085a288610433dc176f3a61eaded48b1446f72d2d114d852ad03a2874123251084b1dc384e2945c38df3e7bc241a536aff72a000efe0b9c9d926f7fccd056a9b62133f511d2eb6d7887d6e50e02245edb73d84af61b6d6a5fd67a8d3a90ca7caa04f7a67bce47c7247cc381f4af0dcfd1604c0c2dc7fe89d8e87670fca230c6b191c4070032f6704a90da6dd65f5ce5b8d36717b9851c31c5dee974928267bea736f8a617366870a856b7f1ba87f3134083dc5f7a7b1542caa3feb1c8291dbc9f3f6ad0688aafe56b52d7c3d4a675a1b3690d0444003ea78705bd50fd9e6206bc0e8f3bcb53b86cdbe881ec5843c5804f44b130f34f571c6b5e26149898f64b18dc06a3ec1437f4df8a71c2595441648da62eb926212a02ec08c6634", 0x1000}], 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x1, 0x4, 0x101, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFULA_CFG_MODE={0xa, 0x2, {0x4, 0x3}}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000004) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) socket(0x29, 0x1, 0x6) bpf$MAP_CREATE(0xb00000000000014, &(0x7f0000000000)=ANY=[], 0x48) r3 = socket$inet_udp(0x2, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xc, 0xf, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000100)={0x3, 0x0, [{0x38, 0x2, 0x0, 0x0, @irqchip={0x0, 0x7d}}, {0x3, 0x3, 0x1, 0x0, @msi={0x8, 0x2, 0x8, 0x6432}}, {0x2, 0x5, 0x0, 0x0, @msi={0x1b0717e3, 0x5, 0x0, 0xa3}}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0x4, &(0x7f0000002380)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2000}, [@call={0x85, 0x0, 0x0, 0x27}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x25}, 0x94) r5 = syz_open_procfs(0x0, &(0x7f0000000800)='net/rpc\x00') openat(r5, &(0x7f0000000d00)='nfsd.fh/channel\x00', 0x4000, 0x0) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x2, 0x5, 0x82, 0x3}, {0x3ff, 0x9, 0xfd, 0xfc1}]}, 0x10) read(0xffffffffffffffff, 0x0, 0x53) write(r2, &(0x7f0000000380)='200000', 0x6) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406a053b030000000000010902220001010080320904000001030000000921110100012217000705810340"], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0022170000000600ff0901a10185020901150026ff00750895098102c0"], 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000000200), 0x0, 0x0) syz_usb_ep_write(r6, 0x81, 0x0, 0x0) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x0) syz_usb_disconnect(r7) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) 52.543667486s ago: executing program 2 (id=1002): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e010203010902"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x101000) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000180)={&(0x7f0000000140)=[{0x7, 0x0, 0x2000, &(0x7f0000000080)="ce"}], 0x1}) 51.279713722s ago: executing program 1 (id=1006): r0 = socket(0x2b, 0x1, 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='file0\x00', 0x2, 0x1ff) write(r1, &(0x7f0000000200)='/syonfig\x00'/18, 0x12) r2 = openat(0xffffffffffffffff, &(0x7f00000002c0)='file0\x00', 0x0, 0x0) read(r2, &(0x7f0000000000), 0x12) symlink(&(0x7f0000000000), &(0x7f0000000100)='my_configfs\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='my_configfs\x00', 0x0, 0x0) statx(r3, &(0x7f0000000240)='./file0\x00', 0x1000, 0x200, 0x0) sendmmsg$unix(r0, &(0x7f0000013800)=[{{&(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x20010}}], 0x1, 0x20008001) clock_gettime(0x0, &(0x7f0000000000)) accept4$alg(r0, 0x0, 0x0, 0x800) syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000201c1b091c00000000000109022d0001000060000904008002030000000921080400012205000905810320"], 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000400)={'dummy0\x00'}) bind$xdp(r4, &(0x7f00000000c0)={0x2c, 0x1, 0x0, 0x800002d}, 0x10) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000000)=0x4, 0x4) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) recvmsg(r5, &(0x7f0000002c00)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast2}}, 0x80, &(0x7f0000001b80)=[{0x0}, {0x0}, {&(0x7f0000001940)=""/96, 0x60}, {&(0x7f00000019c0)=""/39, 0x27}, {&(0x7f0000001a00)=""/244, 0xf4}, {&(0x7f0000001b00)=""/68, 0x44}], 0x6, &(0x7f0000001c00)=""/4096, 0x1000}, 0x1) r6 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x5c) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, 0x0, 0x0) syz_usb_connect$uac1(0x6, 0x105, &(0x7f0000000440)=ANY=[@ANYBLOB="86a112010002000000ff6a0801004000010203010902f30003010ac0ff09040000f0000100000a240109003f000201020824050300f1c1b90824040400302c7408240502077d59fc0924030601040102070d240606020302000400060081072404030af0f50904010000010200000904010101010200000924020107050380010924020202000800010a2402023506020005020924020107040408e9090501090002ec0005072501000600000904020000010200000904020101010279c8b269d95139f187a721d500000924020107040504070a2402010303090a72d00e24020107020400c3380232b6140a2402010e020a05ffc50000000000000200ffbb4e223a080905"], &(0x7f0000000900)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x250, 0x2, 0x8, 0x2, 0xff, 0xe}, 0x99, &(0x7f00000005c0)=ANY=[@ANYBLOB="050f99000307100214e5fc002d1002428df973016e426e0afd5d84715d4d4dc4fdb9583eb139b48d35d61d6b83b306f9db07ac9a4a1a8447d16010010c77a57b5e9b6d37532eb4f3451845896a73b2bda7c91096be8c7d1fc1f03772af8ba125deef619904ea7b136fc2afbb7e6fca297702fb1f578fed804bb65ba6a7ef715c376cdad5f0a95d9cbb5a011996558d088eea3140b92bf9ceaa561b"], 0x1, [{0x5e, &(0x7f0000000380)=ANY=[@ANYBLOB="5e03fccc89f1ce319abfbb491d34927490ad39f5e63d03db19fa895115f1bf2018d6c8e097fcea7e1d288c81affb413275cbe1c9be586c2e69aea282ffe4a5b248614c16a8ad84c588f61ce35f8badbb522d66926465ff495b0df1d14b07d3fc6648500dc493ee47b38c"]}]}) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x3, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, {0xa, 0x0, 0x4, @empty}, 0x0, {[0x3, 0x0, 0x0, 0x1, 0xacd, 0x8, 0x1]}}, 0x5c) setsockopt$MRT6_FLUSH(r6, 0x29, 0xd4, &(0x7f0000000340)=0x6, 0x4) 50.370756178s ago: executing program 4 (id=1009): connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) r2 = add_key$keyring(&(0x7f0000000600), &(0x7f0000000640)={'syz', 0x2}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x38, 0x30, 0x30, 0x30, 0x36, 0x31, 0x30, 0x37, 0x30, 0x31]}, &(0x7f0000000100)={0x0, "00112233444566778899aabbccddeeff00112233445566778899aabbccddeeff0011fb2fa087e1a5a490aabbccddeeff001122334455667788d9aabbccddeeff", 0x41}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000840)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x38}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x3d}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61, 0x30, 0x66, 0x64, 0x30, 0x63, 0x66]}, &(0x7f0000000740)={0x0, "001122334b0c66778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbddddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x35, 0x30, 0x35, 0x30, 0x30, 0x30, 0x39, 0x51, 0x64, 0x62, 0x30, 0x64, 0x30, 0x30, 0x37]}, &(0x7f0000000580)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccdd2233445566778899aabbccddeeff00", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) r3 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x34, 0x62, 0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x31, 0x30, 0x37, 0x63, 0x66, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff0011223344556677878d486ca0bac53400112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x33, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) r4 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @desc2}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x64, 0x67, 0x37, 0x32, 0x30, 0x66, 0x30, 0x39, 0x30, 0x32, 0x65, 0x35, 0x38, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x32, 0x30, 0x32, 0x30, 0x30, 0x30, 0x66, 0x30, 0x30, 0x62, 0xf]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x44}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f00000006c0)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @desc1}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa00000000ff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000008c0)="fe0103fdbaeaa7343cbf46a5bf0705ab6fad6a36eb7476810d59bdf946902c2053847d96d8b480b9b32c4e5d1b743c07a92a731d80a3093da9a089b3fd922ab36db115f39aab8c0fd63b50a85915be91a51eb89ebfb30e0e1a5004b18c68260b1be94374e1e92510613589fe8038f5f94e5d517994eb1aeb88da050f8ec989c22fa443a87bdfae947a58aa7bf1d127286e487b17abc06353d11072f70af886", 0xa8, r3) keyctl$KEYCTL_MOVE(0x1e, r4, r1, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x16) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) write$tun(r0, 0x0, 0xfdef) 48.638599423s ago: executing program 2 (id=1012): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil) ptrace(0x10, r1) (async) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) (async) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) waitid(0x2, r3, 0x0, 0x4, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=0x0, @ANYBLOB="5d5b00000000000010001a000c000a8005000800deff000014003500677265300000000000000000000000007686c0a5348f4362789ca01e1ce2e1af7630bf5f76ea7e264f2364f3fba6e030258ddce7b41438ef79691dd89294301e"], 0x44}}, 0x0) (async) socket$kcm(0x2, 0xa, 0x2) (async) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f071, 0x2}) (async) socket$inet6(0xa, 0x80002, 0x0) (async) r5 = socket$key(0xf, 0x3, 0x2) (async) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, &(0x7f0000000140)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) get_robust_list(0x0, &(0x7f0000000900)=0x0, &(0x7f0000000940)) (async) r6 = fsopen(&(0x7f00000000c0)='bfs\x00', 0x0) write$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000100)={'full', 0x20, 0xfffffffffffff9b1, 0x20, 0x100}, 0x2f) (async) fsmount(r6, 0x0, 0x81) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000017c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r5, @ANYBLOB='\a'], 0x0) 47.145610106s ago: executing program 1 (id=1014): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ac00000000010505000000faff0000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff02000000000000009d0000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffac1e00010800074000000001180006801400040000"], 0xac}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="020000000400000008000000"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000600)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000500)="c96dc46e1494817cc9868c9f5fdac55a20b5a646d546fd690dd1a314e77d9afbd0abb1a8e92ca718ddcbccd8074f5a47fee69354d307a64be4d4ed0d690592aa19bcf56cca26a8a0c244feec27f5f662724123beae7532303eedf8c918da10d9b60f0e3960f0e8060820a18b1118039f066e94f9d8a313beb8c4cb82d0419d98eff978cb7824e5a7a0b94477386b5aa7c2fa00825d294316be9fceff2b9267cf537b45418a0bf419f2927148d10e2aef7ab298af841bd8f5c68e4329ddea4980d6c6613a7fb8c236b1b3ca928032cb897c738e4eb070427230d20d5e74852cba7e94626b30a5ed73495f4c6c6c183b0959925893ec38ef0e7c4a94f5", 0xfc, r2}, 0x68) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000002f00090027bd70000000000004"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x10) 43.962427683s ago: executing program 2 (id=1016): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) connect$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x5, 0x0, 0x1, 0x48, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}}, 0x14) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) syz_open_pts(0xffffffffffffffff, 0xea283) r2 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000040)='asymmetric\x00', 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40240) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r3, 0x40045402, &(0x7f0000000040)=0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f00000083c0)={{0x3, 0x0, 0x0, 0x3, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f00000000c0)={0x3, 0x9dc5, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0004}]}) close_range(r4, 0xffffffffffffffff, 0x0) add_key$keyring(0x0, &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x0, r2) r5 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r5, 0xc4c85512, &(0x7f0000000780)={{0x3, 0x0, 0x1000000}, 0x0, [0x0, 0x2, 0x0, 0xfffffffffffffffe, 0x1c00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x2, 0x0, 0xfffffffffffffffd, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x4, 0x9, 0x0, 0x0, 0x1, 0x5, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd451, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x2000000000, 0x0, 0x0, 0x0, 0x0, 0x40800000000000, 0x0, 0x10000, 0x7785, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffffffe, 0x0, 0x5, 0x0, 0x3, 0x10, 0xfffffffffffffffe, 0x0, 0x80000000, 0x4, 0x0, 0x0, 0x40, 0x0, 0x59ed, 0x1000000000000000, 0x0, 0x4001ff, 0x0, 0x0, 0x0, 0x3, 0xd, 0x100000000, 0x0, 0xa, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x8, 0x2, 0x0, 0x80000000000, 0x0, 0x3f92, 0x0, 0x0, 0xb4b, 0x1, 0x0, 0x80000000, 0x5, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x80000001]}) r6 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) fsmount(r6, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/mdstat\x00', 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000001c0)={0x4, 0x2, 0x3, 0xdffffffe, 0x7, 0x5646, 0x151, 0x10000101}, 0x20) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c000c0006"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) keyctl$dh_compute(0x17, &(0x7f0000000380), 0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)={'cmac(camellia-asm)\x00'}}) 43.648263485s ago: executing program 1 (id=1017): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) waitid(0x2, 0xffffffffffffffff, 0x0, 0x8, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f0000000400)={0x0, 'batadv0\x00', {0x5}}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newtfilter={0x24, 0x11, 0x1, 0x691522eb, 0x0, {0x0, 0x0, 0x74, r1, {0x10, 0x7}, {}, {0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x80}, 0x0) 41.606429757s ago: executing program 0 (id=1020): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x12) r1 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=[@nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @control_nat=0x600a, 0x7fdc95ce, 0x8000000000000001, 0xffffffff}}, @set_irq_handler={0xc8, 0x20, {0xd7}}, @nested_amd_invlpga={0x17d, 0x20, {0x3f000, 0x7feb}}, @wr_drn={0x68, 0x20, {0x0, 0x3}}, @set_irq_handler={0xc8, 0x20, {0xd7, 0x1}}], 0xb8}) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, &(0x7f0000000100)="c4416f7c660046a28000c0fe000000004e0fc7980800000066b824000f00d8c4c229a94f03f40f01f866420fd9a49e8000c0fec7442400f6000000c744240209000000ff1c24d801", 0x48}], 0x1, 0x28, &(0x7f00000001c0)=[@dstype0={0x6, 0xb}], 0x1) ioctl$BTRFS_IOC_BALANCE(r1, 0x5000940c, 0x0) ioctl$XFS_IOC_INUMBERS(0xffffffffffffffff, 0x80405880, &(0x7f0000000200)={{0x6, 0x5, 0x1000, 0xf7cb, 0x8}, [{0x4, 0x200000, 0x9, 0x8}, {0xdcdf, 0x92, 0x8, 0x2}, {0x9, 0x7, 0x9, 0xd9}, {0x100, 0x2, 0x67, 0xf3}, {0xbb9, 0x7, 0x5, 0x49}, {0x3ff, 0x3, 0x7, 0x1}, {0x40, 0x80, 0x7, 0x6}]}) r2 = fsopen(&(0x7f0000000300)='pstore\x00', 0x0) r3 = fsmount(r2, 0x0, 0xf4) ioctl$AUTOFS_DEV_IOCTL_FAIL(r3, 0xc0189377, &(0x7f0000000340)={{0x1, 0x1, 0x18, r3, {0x4, 0x6}}, './file0\x00'}) ioctl$EVIOCGMASK(r4, 0x80104592, &(0x7f0000000480)={0x15, 0xd6, &(0x7f0000000380)="e8b832d6bcaeb6b0bb8942946fa8eba7209f4055acf71a9028b3022df1980c36b3d8c7aa43e6e097de50d7160c6296bd6d3d2830e33f5ad218af7b01aa2fce66dbf9c14cadf54f9de7f35aa6b8d0e3458ccc95e12df13e25dc36882e53dcae73bced2eb2c5ee261a5d81115b79eb113b4bef87d54f580be3c15c95b3a590d76f2fe027afc88fa86b38dc45eb987b689956ae028e6890fe5ccaca6b2f15c20e138ee547e50fb1c80f0a8f7b994588e0f43d68dd21a45d29226327aa0aafba0686a1ec05d23a0425083e7993b9b5f87bf90fae3a67b9c8"}) modify_ldt$write2(0x11, &(0x7f00000004c0)={0x6, 0x20000000, 0x400, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}, 0x10) r5 = openat$cgroup_pressure(r3, &(0x7f0000000500)='io.pressure\x00', 0x2, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r4, 0x401870cc, &(0x7f0000000540)={0x6d, 0x0, 0x6, 0x3}) epoll_ctl$EPOLL_CTL_DEL(r4, 0x2, r5) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000580), 0x2000) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000005c0), 0x4001, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f0000000600)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r6, 0x3b8d, &(0x7f00000006c0)={0x20, r7, &(0x7f0000000680)=[{0x1, 0x3}, {0x0, 0x3}, {0x0, 0x2}, {}, {0x1, 0x1}, {}, {0x0, 0x3}], 0xdeadbeef, 0x8, 0x7}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000700)={0x5f7e, 0x0, 0x1, 'queue1\x00', 0x9687}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r6, 0xd000943d, &(0x7f00000007c0)={0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0xa, "0a24f27b550946"}) ioctl$BTRFS_IOC_INO_LOOKUP(r5, 0xd0009412, &(0x7f00000017c0)={r8, 0x2}) setsockopt$RDS_GET_MR(r4, 0x114, 0x2, &(0x7f0000002900)={{&(0x7f00000027c0)=""/231, 0xe7}, &(0x7f00000028c0), 0x38}, 0x20) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002980), r3) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000029c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r9, &(0x7f0000002a80)={&(0x7f0000002940)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000002a40)={&(0x7f0000002a00)={0x38, r10, 0x200, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x9, 0x58}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x3c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x59}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000002ac0)=""/93) socket(0x2c, 0x5, 0x5) newfstatat(0xffffffffffffff9c, &(0x7f0000002bc0)='./file0\x00', &(0x7f0000002c00)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_mount_image$fuse(&(0x7f0000002b40), &(0x7f0000002b80)='./file0\x00', 0x4001, &(0x7f0000002d40)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, r12}, 0x2c, {}, 0x2c, {[{@blksize}, {@default_permissions}], [{@flag='dirsync'}, {@uid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x6}}, {@smackfshat={'smackfshat', 0x3d, 'nl80211\x00'}}, {@context={'context', 0x3d, 'staff_u'}}, {@permit_directio}]}}, 0x0, 0x0, &(0x7f0000002e80)="9b14e9ab0acadee4096e0f44ba9bee9de9e01713c2813e0d543005bf2f56665a9e1f4236b8b25b232c6991aa9c4a110cc74136ec179a2ef3b4ad56edf48f0fdf0cbf4d6037a475b63294e09ce7e441c2e844ac2141aede") 41.605843152s ago: executing program 3 (id=1021): unshare(0x6020400) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r0, 0x7a9, &(0x7f0000000000)={{@my=0x0, 0x2}, 0x0, 0xfd38, 0x9, 0x80000001, 0x0, 0x59, 0x1, 0x4373}) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x701001, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x1fa, 0x1, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0x2e3}]}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = socket$unix(0x1, 0x2, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000140), 0x2100) ioctl$SNDRV_TIMER_IOCTL_TREAD64(r6, 0x400454a4, &(0x7f0000000180)) getsockopt$sock_cred(r5, 0x1, 0x4d, 0x0, &(0x7f0000cab000)) 41.538700323s ago: executing program 2 (id=1022): getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = epoll_create1(0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOMMU_IOAS_ALLOW_IOVAS(0xffffffffffffffff, 0x3b82, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, 0x0, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x23f, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xcc}, 0x1, 0x0, 0x0, 0x10}, 0x40) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x4040040}, 0x20000094) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd2d, 0x25dfdbfd, {0x60, 0x0, 0x0, 0x0, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x2}}}]}, 0x3c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000000)={0xa0000001}) epoll_wait(r0, &(0x7f0000000040)=[{}], 0x1, 0x4d0d) ioctl$XFS_IOC_FSBULKSTAT_SINGLE(r2, 0xc0205866, &(0x7f0000000380)={&(0x7f0000000080)=0xed, 0x96, &(0x7f00000001c0)=[{}, {}], &(0x7f0000000340)}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file1/file2\x00', 0x4) 40.875611108s ago: executing program 0 (id=1023): socket$kcm(0x29, 0x5, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040), 0x482, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000140)={'filter\x00', 0x7, 0x4, 0x418, 0x330, 0x220, 0x220, 0x330, 0x330, 0x330, 0x4, &(0x7f0000000100), {[{{@arp={@rand_addr=0x64010100, @loopback, 0xffffff00, 0x0, 0x0, 0xb, {@mac=@broadcast, {[0x0, 0x0, 0xff]}}, {@mac=@remote, {[0xff, 0xff, 0xff, 0x0, 0xff]}}, 0x652, 0x4a73, 0x0, 0x57, 0x4, 0xe, 'veth1_to_team\x00', 'bridge_slave_1\x00', {}, {0xff}, 0x0, 0x30}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}, @empty, @empty, @broadcast, 0x4}}}, {{@arp={@multicast2, @private=0xa010102, 0xff000000, 0xffffffff, 0x8, 0x4, {@mac=@random="9df067c2b384", {[0x0, 0xff, 0x0, 0x0, 0xff]}}, {@mac=@link_local, {[0x0, 0xff, 0xff]}}, 0xd043, 0xc, 0x3, 0xcb3e, 0xf38, 0xa3a, 'ip6_vti0\x00', 'wlan0\x00', {0xff}, {0xff}, 0x0, 0x4}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast1, @loopback, 0x8, 0xffffffff}}}, {{@arp={@rand_addr=0x64010100, @empty, 0xff000000, 0x0, 0x1, 0x0, {@mac, {[0x0, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@local, {[0x0, 0x7f, 0x0, 0xff]}}, 0x81, 0x1, 0x203a, 0x2, 0x9213, 0x7, 'bridge0\x00', 'netpci0\x00', {0xff}, {0xff}, 0x0, 0x25}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x8, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x468) setsockopt$sock_timeval(r0, 0x1, 0x42, &(0x7f0000000000)={0x0, 0xea60}, 0x10) pipe(&(0x7f0000000080)) syz_usb_connect(0x4, 0x2d, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x40000000) syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x6, 0x1000, 0x1, 0x1ba}, &(0x7f0000000880), &(0x7f0000000100), &(0x7f0000000140)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f00000009c0)={0x0, 0x2e, 0xfff9}, 0x8) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) pwritev(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x4, 0x5) r4 = syz_open_dev$video4linux(&(0x7f0000000080), 0x200000000000, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0305602, &(0x7f0000000000)={0x1, 0x900, {0x4}}) bind$alg(0xffffffffffffffff, &(0x7f0000000380)={0x26, 'hash\x00', 0x0, 0x0, 'rmd160-generic\x00'}, 0x58) r5 = syz_io_uring_setup(0x5f38, &(0x7f00000005c0)={0x0, 0x2, 0x800, 0x3, 0x3}, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r6, r7, r8, 0x0) io_uring_enter(r5, 0x6516, 0x6d93, 0x8, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r5, 0x18, &(0x7f0000000200)={0x8e, 0xffffffffffffffff, 0x31, {0x7, 0x8000000000000003}, 0x2b}, 0x1) syz_create_resource$binfmt(&(0x7f00000003c0)='./file0\x00') mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0xdc3c, 0x0) r9 = socket(0x40000000015, 0x5, 0x0) connect$inet(r9, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r9, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) 40.573429055s ago: executing program 3 (id=1024): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ac00000000010505000000faff0000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff02000000000000009d0000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffac1e00010800074000000001180006801400040000"], 0xac}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xd, 0x0, &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000600)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000500)="c96dc46e1494817cc9868c9f5fdac55a20b5a646d546fd690dd1a314e77d9afbd0abb1a8e92ca718ddcbccd8074f5a47fee69354d307a64be4d4ed0d690592aa19bcf56cca26a8a0c244feec27f5f662724123beae7532303eedf8c918da10d9b60f0e3960f0e8060820a18b1118039f066e94f9d8a313beb8c4cb82d0419d98eff978cb7824e5a7a0b94477386b5aa7c2fa00825d294316be9fceff2b9267cf537b45418a0bf419f2927148d10e2aef7ab298af841bd8f5c68e4329ddea4980d6c6613a7fb8c236b1b3ca928032cb897c738e4eb070427230d20d5e74852cba7e94626b30a5ed73495f4c6c6c183b0959925893ec38ef0e7c4a94f5", 0xfc, r2}, 0x68) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000002f00090027bd70000000000004"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x10) 40.514363269s ago: executing program 1 (id=1025): socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(0xffffffffffffffff, 0xc2604110, &(0x7f0000000040)={0x0, [[0x1, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x80000000], [0xfa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]], '\x00', [{0x0, 0x1}, {}, {}, {}, {}, {0x3}], '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) futex(0x0, 0xf, 0x1, 0x0, 0x0, 0x200000) syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x7c0, 0x1125, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x17}}}}]}}]}}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r8 = dup(r7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r8, 0x0) r9 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000300)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r9, r10, r11, r12, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r14 = socket$inet6_tcp(0xa, 0x1, 0x0) r15 = dup(r14) syz_ublk_setup_queues(r15, r13, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x20, 0x2100, 0x10000004, 0x0, r15}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11dd, 0x1, 0xfffffffe, 0xaf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0xc3, 0x0, r15}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x2b7}}], 0x7ffffffe, 0x0, 0x0) r16 = dup(r5) syz_ublk_setup_queues(r16, r4, &(0x7f0000000680)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x20, 0x100, 0x10400004, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa806, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r16}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x80, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r16, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000340)='.\x00', 0xa50003d1) 38.253224226s ago: executing program 3 (id=1026): r0 = socket$inet6(0xa, 0x80001, 0x100) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000580)={0x0, {{0xa, 0x4e1f, 0x7, @mcast1, 0xabdf}}, 0x1}, 0x20000) (fail_nth: 7) 36.899208656s ago: executing program 3 (id=1027): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="38000000070a0104000000007fffffff020000000c00034000000000000000110900020073797a320000000009000100"], 0x38}, 0x1, 0x0, 0x0, 0x4001}, 0x20000014) 36.762911459s ago: executing program 0 (id=1028): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="d00000002002010400000000000000000a000000440001800c00028005400100210000002c00018014000300200100000000000000000000000000011400040000000000000000000000ffffac1414aa06000340000200003c0003800c00028005000100000000002c00018014000300fc00000000000000000000000000000014000400fe8000000000000000000000000000bb3c0002800c00028005000100000000002c0001"], 0xd0}}, 0x0) 35.272701643s ago: executing program 3 (id=1029): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='reno', 0x4) r1 = fsopen(&(0x7f00000001c0)='cifs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\xa3qf4I^\x01\x00\x01\x00\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R#\xca\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r7) sendmsg$ETHTOOL_MSG_STRSET_GET(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0193a2e89a00000000001fffffff04000180080002"], 0x20}}, 0x0) bind$packet(r5, &(0x7f0000000180)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @remote}, 0x14) close_range(r2, 0xffffffffffffffff, 0x0) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f0000000100)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) preadv(r10, &(0x7f00000000c0), 0x0, 0x0, 0x0) 34.91824773s ago: executing program 32 (id=1009): connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) r2 = add_key$keyring(&(0x7f0000000600), &(0x7f0000000640)={'syz', 0x2}, 0x0, 0x0, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x38, 0x30, 0x30, 0x30, 0x36, 0x31, 0x30, 0x37, 0x30, 0x31]}, &(0x7f0000000100)={0x0, "00112233444566778899aabbccddeeff00112233445566778899aabbccddeeff0011fb2fa087e1a5a490aabbccddeeff001122334455667788d9aabbccddeeff", 0x41}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000840)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x38}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x3d}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61, 0x30, 0x66, 0x64, 0x30, 0x63, 0x66]}, &(0x7f0000000740)={0x0, "001122334b0c66778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbddddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x35, 0x30, 0x35, 0x30, 0x30, 0x30, 0x39, 0x51, 0x64, 0x62, 0x30, 0x64, 0x30, 0x30, 0x37]}, &(0x7f0000000580)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccdd2233445566778899aabbccddeeff00", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) r3 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x34, 0x62, 0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x31, 0x30, 0x37, 0x63, 0x66, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff0011223344556677878d486ca0bac53400112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x33, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) r4 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @desc2}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x64, 0x67, 0x37, 0x32, 0x30, 0x66, 0x30, 0x39, 0x30, 0x32, 0x65, 0x35, 0x38, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x32, 0x30, 0x32, 0x30, 0x30, 0x30, 0x66, 0x30, 0x30, 0x62, 0xf]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x44}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f00000006c0)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @desc1}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa00000000ff00112233445566778899aabbccddeeff", 0x40}, 0x48, r1) add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000008c0)="fe0103fdbaeaa7343cbf46a5bf0705ab6fad6a36eb7476810d59bdf946902c2053847d96d8b480b9b32c4e5d1b743c07a92a731d80a3093da9a089b3fd922ab36db115f39aab8c0fd63b50a85915be91a51eb89ebfb30e0e1a5004b18c68260b1be94374e1e92510613589fe8038f5f94e5d517994eb1aeb88da050f8ec989c22fa443a87bdfae947a58aa7bf1d127286e487b17abc06353d11072f70af886", 0xa8, r3) keyctl$KEYCTL_MOVE(0x1e, r4, r1, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x16) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) write$tun(r0, 0x0, 0xfdef) 34.425208413s ago: executing program 0 (id=1031): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000002c0)={'syzkaller0\x00', 0x9001}) r1 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r1, &(0x7f0000000000)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) listen(r1, 0x5) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001c1122334400080000000500050000000580080008c1"], 0x4a) 34.109140778s ago: executing program 1 (id=1032): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, &(0x7f00000007c0)) r0 = syz_open_dev$video4linux(&(0x7f0000001380), 0x5, 0x0) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r1, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r1, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_connect(0x3, 0x32, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x5cf1, 0x0, 0x0, 0x41100, 0x21, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000480)=[{0x4, 0x5, 0xb, 0x3}, {0x3, 0x4, 0x6, 0x6}, {0x2, 0x2, 0xf}, {0x3, 0x4, 0xc, 0x1}, {0x2, 0x5, 0x2, 0x8}, {0x5, 0x2, 0x3, 0x1}], 0x10, 0x2}, 0x94) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd25, 0x25dfdbff, {{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x4, 0x0, 0xa, 0x0, 0x20, 0x87}, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000, 0xfffffffffffffffb}, {0x0, 0x1000, 0x200000000000000}, 0x800, 0x6e6bb0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x800}, 0x8008010) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000001fcffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000fbffca17ee7cc8cd38aeb32a891b802680ffffffffffff00"/98], 0xb8}}, 0x2c000010) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r5 = io_uring_setup(0x1b7c, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) r6 = socket$inet(0x2, 0x80001, 0x84) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 32.795519322s ago: executing program 3 (id=1033): r0 = syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000580)={'\x00', 0x200, 0x6, 0x1, 0x4, 0x0, "000000000000000000002ff6b03900", "000200", "000000f3", "dd00", ["95ec1df3a4a032c2ffffffff", "ffee4df1aa8d37a76e00", "070500110800c1024b00", "38a70ed483c99b9f1600d333"]}) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000205f14120200005d00000109022400010000600009040a80020300000009210604000122050009058103"], 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000180)={{0x12, 0x1, 0x201, 0xe8, 0x2b, 0xcb, 0x10, 0xc52, 0x2832, 0x6ce9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x6, 0x140, 0x9, "", [{{0x9, 0x4, 0x77, 0x9, 0x0, 0x9c, 0x71, 0x35, 0xb}}]}}]}}, &(0x7f0000000740)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x2, 0x1, 0x1, 0x20}, 0x17, &(0x7f0000000200)={0x5, 0xf, 0x17, 0x2, [@wireless={0xb, 0x10, 0x1, 0xc, 0x1, 0x9, 0x81, 0x8, 0x1}, @ext_cap={0x7, 0x10, 0x2, 0x1a, 0x1, 0x1, 0x68e9}]}, 0x4, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1840}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x40a}}, {0xaf, &(0x7f00000004c0)=@string={0xaf, 0x3, "0b18828628c25b80ad07118e6ff91f4651c537ce984593a07d132ed7ebd2b0318432465a1d7e0c2769ebb34a9c4f51f1a0bee27863fa53402ca48ad2fac608c1045a838d77eeed88095afe18c646bfc88166a0b1af9df0a9b6fd14371834aa0c9edd1d447cccf1c16d51a27b8985cf14bc025c5337a0f115f76b5655288b6e5b2efac79674d0ad45a5883eedc460a41b8d6e2bec261883a31a282cc38e8012189af52750e14b9ceeb98e9cfbad"}}, {0xb8, &(0x7f0000000680)=@string={0xb8, 0x3, "9ccbac9ae800fdba0f36490728bacfbca83ddef1a55072119b1dd1db7134bd5b6a9a32de25fe3ff09984943852848ae0bd359bf04a801e0ee871cc4da5d9a9e08d4f07ba60f8a21b9d143d217dd3da9cd8f86a82055411da463089ccc9848544a62df56ae5bfa7fc9ee9284670f18bb5673378e188b32307124071e68d25592e8af245d5b9820082288b5e3d2581c691c2b1f3b656e9030f9ac1951f854bd8c6467fd107345e0c1285a0189c4a9a848b851069be8084"}}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) r1 = socket$inet(0x2, 0x3, 0x1) sendmsg$inet(r1, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0xffff, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000240)='\b', 0x1}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0xfffe) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x5, 0x401d031, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) dup(r2) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$TUNSETCARRIER(r3, 0x400454e2, &(0x7f0000000080)=0x1) 31.826781539s ago: executing program 0 (id=1034): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x3, &(0x7f0000000280)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x8, 0xfffff00c}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000200)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x2, 0x0, 0x300}}}}}, 0x0) 30.568218967s ago: executing program 0 (id=1035): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x2, 0x1000, 0x1}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)=0x0) (async) r6 = io_uring_setup(0x4244, &(0x7f00000002c0)={0x0, 0xbede, 0x1, 0x1, 0x1f}) (async) r7 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r7, 0xaf01, 0x0) (async) ioctl$XFS_IOC_BULKSTAT(r7, 0x4008af04, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x4c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x4, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}}, 0x0) (async) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) (async) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r10 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r10, 0x107, 0x12, &(0x7f0000000140)={0x100, 0x6}, 0x4) setsockopt$packet_fanout_data(r10, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000180)=[{0x28, 0x20, 0x0, 0xfffff034}, {0x50, 0x1, 0x0, 0x80000000}, {0x6, 0x80, 0xfd, 0xfffffffd}]}, 0x10) syz_mount_image$fuse(0x0, 0x0, 0x3080020, 0x0, 0x0, 0x0, 0x0) (async) sendto$inet(r9, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) (async) r11 = syz_usb_connect$rtl8150(0x6, 0x3f, &(0x7f0000000400)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) (async) socket$inet6_sctp(0xa, 0x801, 0x84) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000ff6000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r12 = io_uring_setup(0x1b7c, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) r13 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r13, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) (async) io_uring_enter(r12, 0x7df2, 0x7721, 0x16, 0x0, 0x0) (async) r14 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x22) (async) r15 = memfd_secret(0x80000) syz_kvm_setup_cpu$x86(r14, r15, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000e00)=[@text16={0x10, &(0x7f0000000dc0)="672edd92900d0000c4e219cfa109000f32b895008ed8640f01c90f20a50f38081367f285e80f01d4660f380807", 0x2d}], 0x1, 0x60, &(0x7f0000000e40)=[@dstype0={0x6, 0x3}, @cstype3={0x5, 0xd}], 0x2) (async) syz_usb_control_io(r11, &(0x7f00000008c0)={0x2c, &(0x7f0000000440)={0x40, 0xf, 0x73, {0x73, 0xd, "654d74c54d1739a8deec29f14ed4ce57c8f1a26c8b6d64ab131910e7d62226ec78ae343dc2571b2838fb571021bb00b0de3af922b8118a6197b63518dca1897178ff144d2279dd10eefa59edbf298436835fbf0ff220442c993e4b8b77b53bfde2ddf5cc80bd2ebcb13da775809ef45c26"}}, &(0x7f00000004c0)={0x0, 0x3, 0x31, @string={0x31, 0x3, "86d406365da5ed0e9b3e0179b5ed746d102b8ccd2f77cb62f57ceb82886b904ef60b68dbb0d3b1a1b451076dda2a10"}}, &(0x7f0000000500)={0x0, 0xf, 0x9a, {0x5, 0xf, 0x9a, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0xc, 0x9, 0x2, 0xf6f}, @generic={0x83, 0x10, 0x4, "8fa5653f9f12f7cfa6ab7aa5412f2fa2e0a02326d0a6cc2323ad09c7763a6c6417fc2ceca281607264f90f7f33333b8333fe9d75b31286fb66739dc41dc0969bff2aa7ba8cdf4fdb82b4a406f6db6caa2189ba7f41347438cefa1537127d2443ded6faa7a1c2dbf18b78ed63681e45bd7fd4ed1ec698239bf2e9e9edec933fc6"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x0, 0x3, 0x4, 0x400, 0x7}]}}, &(0x7f0000000840)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x3, 0x6, 0x8, "b22b6718", "5d4ec374"}}, &(0x7f0000000880)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x60, 0x4, 0x4, 0x3, 0x1000, 0x8}}}, &(0x7f0000000d00)={0x84, &(0x7f0000000900)={0x20, 0xb, 0x39, "2d1a7b9a3fd985e931824b9a5ffbc4b777fb8a6d89d311ff85416b21fa56ef82b5cd7ea9e53c23a8e441f839931fdea5aa3996692f9085b62a"}, &(0x7f0000000940)={0x0, 0xa, 0x1, 0x7f}, &(0x7f0000000980)={0x0, 0x8, 0x1, 0x63}, &(0x7f00000009c0)={0x20, 0x0, 0x4, {0x0, 0x3}}, &(0x7f0000000a00)={0x20, 0x0, 0x4, {0x1, 0x53}}, &(0x7f0000000a40)={0x40, 0x7, 0x2, 0x4}, &(0x7f0000000a80)={0x40, 0x9, 0x1, 0x1}, &(0x7f0000000ac0)={0x40, 0xb, 0x2, "8492"}, &(0x7f0000000b00)={0x40, 0xf, 0x2, 0xa0}, &(0x7f0000000b40)={0x40, 0x13, 0x6, @random="5c30698dc00c"}, &(0x7f0000000b80)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000bc0)={0x40, 0x19, 0x2, "48c2"}, &(0x7f0000000c00)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000c40)={0x40, 0x1c, 0x1, 0x7}, &(0x7f0000000c80)={0x40, 0x1e, 0x1, 0x9}, &(0x7f0000000cc0)={0x40, 0x21, 0x1, 0x5}}) (async) syz_ublk_setup_queues(0xffffffffffffffff, r5, &(0x7f0000000340)={0x0, 0xce8e, 0x20, 0x1, 0x1f5, 0x0, r6}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xae5f, 0x10000, 0xfffffffe, 0x21f, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8efb, 0x10, 0x3, 0x12b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xedf, 0x11020, 0x2, 0x39d}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfe71, 0x100, 0x0, 0x186}}], 0x4, &(0x7f0000000200)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0107520, 0x700, 0x0, 0x0, 0x0, {0xff7f}, 0x0, r4, '\x00', {0xa, 0xca2, 0x0, 0x0}}, &(0x7f00000003c0)) 29.890721176s ago: executing program 2 (id=1036): r0 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2) r1 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r1, &(0x7f00000001c0)={0x11, 0x0, r2, 0x1, 0x10}, 0x14) connect$can_bcm(r1, &(0x7f0000000080)={0x1d, r2}, 0x10) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000180)=0x2102, 0x4) sendmsg$netlink(r1, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000640)=ANY=[@ANYBLOB="0201140084dc18000e1a80009f0001852900002f0600ac141430e0000001808a8972bd0b72e41082b1a3d206", @ANYBLOB="195460834a99a429f70514ac92908eb82b8ec5cab5831001a79783e8ccd53ac56f0173563f96330997b4f72b9079748e1de27c238f03bf"], 0xdd12}], 0x1, 0x0, 0x0, 0x10008882}, 0x44840) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x9b0000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x9b0905, 0xfffffff7, '\x00', @p_u8=&(0x7f00000000c0)}}) 29.598747562s ago: executing program 1 (id=1037): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x1000) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r0, 0x0) syz_clone3(&(0x7f000000dd80)={0xa04400, 0x0, 0x0, 0x0, {0x12}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x80) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f00000000c0)={0x1, 0x1, 0x2, &(0x7f0000000000)={0xd, "90f5000000f3c9f1bd0d00"}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = semget$private(0x0, 0x1, 0x8) semctl$IPC_STAT(r3, 0x0, 0x2, &(0x7f0000000000)=""/242) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$XFS_IOC_START_COMMIT(r2, 0x80585882, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PTP_ENABLE_PPS(r5, 0x40043d04, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) r7 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000000200)=0x9, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}, @in={0x2, 0x4e21, @local}], 0x20) unshare(0x22020600) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000600)={r8, 0x0, 0x0, 0xffffffff00000000}, 0x20) listen(r7, 0x7) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) listen(r6, 0x7) r9 = socket$inet6_sctp(0xa, 0x0, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000140)={'wlan0\x00'}) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRES32=r4, @ANYRES32=r4, @ANYRESHEX, @ANYRES64=r4], 0x24}, 0x1, 0x0, 0x0, 0x20008800}, 0x4000c810) 0s ago: executing program 33 (id=1033): r0 = syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000580)={'\x00', 0x200, 0x6, 0x1, 0x4, 0x0, "000000000000000000002ff6b03900", "000200", "000000f3", "dd00", ["95ec1df3a4a032c2ffffffff", "ffee4df1aa8d37a76e00", "070500110800c1024b00", "38a70ed483c99b9f1600d333"]}) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000205f14120200005d00000109022400010000600009040a80020300000009210604000122050009058103"], 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000180)={{0x12, 0x1, 0x201, 0xe8, 0x2b, 0xcb, 0x10, 0xc52, 0x2832, 0x6ce9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x6, 0x140, 0x9, "", [{{0x9, 0x4, 0x77, 0x9, 0x0, 0x9c, 0x71, 0x35, 0xb}}]}}]}}, &(0x7f0000000740)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x2, 0x1, 0x1, 0x20}, 0x17, &(0x7f0000000200)={0x5, 0xf, 0x17, 0x2, [@wireless={0xb, 0x10, 0x1, 0xc, 0x1, 0x9, 0x81, 0x8, 0x1}, @ext_cap={0x7, 0x10, 0x2, 0x1a, 0x1, 0x1, 0x68e9}]}, 0x4, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1840}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x40a}}, {0xaf, &(0x7f00000004c0)=@string={0xaf, 0x3, "0b18828628c25b80ad07118e6ff91f4651c537ce984593a07d132ed7ebd2b0318432465a1d7e0c2769ebb34a9c4f51f1a0bee27863fa53402ca48ad2fac608c1045a838d77eeed88095afe18c646bfc88166a0b1af9df0a9b6fd14371834aa0c9edd1d447cccf1c16d51a27b8985cf14bc025c5337a0f115f76b5655288b6e5b2efac79674d0ad45a5883eedc460a41b8d6e2bec261883a31a282cc38e8012189af52750e14b9ceeb98e9cfbad"}}, {0xb8, &(0x7f0000000680)=@string={0xb8, 0x3, "9ccbac9ae800fdba0f36490728bacfbca83ddef1a55072119b1dd1db7134bd5b6a9a32de25fe3ff09984943852848ae0bd359bf04a801e0ee871cc4da5d9a9e08d4f07ba60f8a21b9d143d217dd3da9cd8f86a82055411da463089ccc9848544a62df56ae5bfa7fc9ee9284670f18bb5673378e188b32307124071e68d25592e8af245d5b9820082288b5e3d2581c691c2b1f3b656e9030f9ac1951f854bd8c6467fd107345e0c1285a0189c4a9a848b851069be8084"}}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) r1 = socket$inet(0x2, 0x3, 0x1) sendmsg$inet(r1, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0xffff, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000240)='\b', 0x1}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0xfffe) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x5, 0x401d031, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) dup(r2) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$TUNSETCARRIER(r3, 0x400454e2, &(0x7f0000000080)=0x1) kernel console output (not intermixed with test programs): gs_usb 5-1:0.0: Configuring for 1 interfaces [ 206.815021][ T6082] gs_usb 5-1:0.0: Couldn't get bit timing const for channel 0 (-EREMOTEIO) [ 206.815092][ T6082] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -121 [ 206.891795][ T5679] usb 3-1: USB disconnect, device number 38 [ 206.974917][ T7273] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 207.023158][ T31] usb 5-1: USB disconnect, device number 40 [ 207.134889][ T7273] usb 4-1: Using ep0 maxpacket: 8 [ 207.135699][ T7273] usb 4-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=99.1a [ 207.136243][ T7273] usb 4-1: config 0 has no interfaces? [ 207.139165][ T7273] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.139191][ T7273] usb 4-1: Product: syz [ 207.139205][ T7273] usb 4-1: Manufacturer: syz [ 207.139220][ T7273] usb 4-1: SerialNumber: syz [ 207.188546][ T7273] usb 4-1: config 0 descriptor?? [ 207.328436][ T8132] netlink: 52 bytes leftover after parsing attributes in process `syz.0.761'. [ 207.353052][ T8135] FAULT_INJECTION: forcing a failure. [ 207.353052][ T8135] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 207.353092][ T8135] CPU: 1 UID: 0 PID: 8135 Comm: syz.1.762 Tainted: G L syzkaller #0 PREEMPT(full) [ 207.353118][ T8135] Tainted: [L]=SOFTLOCKUP [ 207.353125][ T8135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 207.353137][ T8135] Call Trace: [ 207.353145][ T8135] [ 207.353154][ T8135] dump_stack_lvl+0xe8/0x150 [ 207.353188][ T8135] should_fail_ex+0x410/0x560 [ 207.353220][ T8135] _copy_from_user+0x2d/0xb0 [ 207.353248][ T8135] ___sys_recvmsg+0x173/0x5a0 [ 207.353277][ T8135] ? lock_acquire+0x115/0x350 [ 207.353302][ T8135] ? __pfx____sys_recvmsg+0x10/0x10 [ 207.353337][ T8135] ? ktime_get_ts64+0xa9/0x410 [ 207.353384][ T8135] do_recvmmsg+0x31a/0x7f0 [ 207.353421][ T8135] ? __pfx_do_recvmmsg+0x10/0x10 [ 207.353459][ T8135] ? get_timespec64+0x119/0x1b0 [ 207.353481][ T8135] ? __pfx_get_timespec64+0x10/0x10 [ 207.353511][ T8135] __x64_sys_recvmmsg+0x1b7/0x250 [ 207.353543][ T8135] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 207.353583][ T8135] do_syscall_64+0x166/0x520 [ 207.353610][ T8135] ? trace_irq_disable+0x3b/0x140 [ 207.353631][ T8135] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.353651][ T8135] ? clear_bhb_loop+0x70/0xc0 [ 207.353675][ T8135] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.353695][ T8135] RIP: 0033:0x7fcb7619e159 [ 207.353714][ T8135] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 207.353732][ T8135] RSP: 002b:00007fcb7706d028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 207.353753][ T8135] RAX: ffffffffffffffda RBX: 00007fcb76425fa0 RCX: 00007fcb7619e159 [ 207.353768][ T8135] RDX: 00000000000006f5 RSI: 0000200000000440 RDI: 0000000000000003 [ 207.353781][ T8135] RBP: 00007fcb7706d090 R08: 0000200000000480 R09: 0000000000000000 [ 207.353794][ T8135] R10: 0000002000000022 R11: 0000000000000246 R12: 0000000000000002 [ 207.353807][ T8135] R13: 00007fcb76426038 R14: 00007fcb76425fa0 R15: 00007fcb7654fa48 [ 207.353837][ T8135] [ 207.421968][ T31] usb 4-1: USB disconnect, device number 52 [ 207.652276][ T8142] netlink: 'syz.4.764': attribute type 3 has an invalid length. [ 207.781835][ T8145] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.782238][ T8145] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 207.814880][ T6083] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 207.965553][ T6083] usb 2-1: Using ep0 maxpacket: 16 [ 207.966168][ T6083] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 207.968373][ T6083] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 207.972055][ T6083] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.972082][ T6083] usb 2-1: Product: syz [ 207.972097][ T6083] usb 2-1: Manufacturer: syz [ 207.972111][ T6083] usb 2-1: SerialNumber: syz [ 207.974164][ T6083] usb 2-1: config 0 descriptor?? [ 207.980949][ T5679] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 208.000967][ T6083] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 208.001002][ T6083] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 208.094944][ T6082] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 208.175711][ T5679] usb 1-1: device descriptor read/64, error -71 [ 208.194896][ T31] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 208.224984][ T6082] usb 5-1: device descriptor read/64, error -71 [ 208.344854][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 208.345639][ T31] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 208.346634][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 208.346652][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 208.346695][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.348963][ T31] usb 4-1: config 0 descriptor?? [ 208.444959][ T5679] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 208.464924][ T6082] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 208.575699][ T5679] usb 1-1: device descriptor read/64, error -71 [ 208.594892][ T6082] usb 5-1: device descriptor read/64, error -71 [ 208.599116][ T6083] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 208.685524][ T5679] usb usb1-port1: attempt power cycle [ 208.706086][ T6082] usb usb5-port1: attempt power cycle [ 208.756809][ T8155] netlink: 52 bytes leftover after parsing attributes in process `syz.3.768'. [ 208.788812][ T8155] netlink: 52 bytes leftover after parsing attributes in process `syz.3.768'. [ 208.853611][ T31] savu 0003:1E7D:2D5A.0006: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 209.005206][ T6083] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 209.005228][ T6083] em28xx 2-1:0.0: board has no eeprom [ 209.035100][ T5679] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 209.052739][ T6082] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 209.054938][ T25] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 209.065599][ T6082] usb 5-1: device descriptor read/8, error -71 [ 209.068700][ T5679] usb 1-1: device descriptor read/8, error -71 [ 209.099972][ T6092] usb 4-1: USB disconnect, device number 53 [ 209.204882][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 209.205591][ T25] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 209.206522][ T25] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 209.206544][ T25] usb 3-1: config 0 has no interface number 0 [ 209.208273][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.208289][ T25] usb 3-1: Product: syz [ 209.208301][ T25] usb 3-1: Manufacturer: syz [ 209.208314][ T25] usb 3-1: SerialNumber: syz [ 209.210897][ T25] usb 3-1: config 0 descriptor?? [ 209.219345][ T25] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 209.219372][ T25] usb 3-1: selecting invalid altsetting 1 [ 209.219386][ T25] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 209.230359][ T25] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 209.230731][ T25] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 209.230780][ T25] usb 3-1: media controller created [ 209.249059][ T25] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 209.307253][ T6082] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 209.334945][ T5679] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 209.338642][ T6082] usb 5-1: device descriptor read/8, error -71 [ 209.355517][ T5679] usb 1-1: device descriptor read/8, error -71 [ 209.364880][ T6083] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 209.364905][ T6083] em28xx 2-1:0.0: dvb set to bulk mode. [ 209.385749][ T31] em28xx 2-1:0.0: Binding DVB extension [ 209.422178][ T25] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 209.422233][ T25] zl10353_read_register: readreg error (reg=127, ret==-71) [ 209.422622][ T25] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 209.451888][ T6082] usb usb5-port1: unable to enumerate USB device [ 209.465272][ T5679] usb usb1-port1: unable to enumerate USB device [ 209.488901][ T5679] usb 2-1: USB disconnect, device number 35 [ 209.510988][ T8140] em28xx 2-1:0.0: writing to i2c device at 0xe failed (error=-19) [ 209.532876][ T5679] em28xx 2-1:0.0: Disconnecting em28xx [ 209.566362][ T25] usb 3-1: USB disconnect, device number 39 [ 209.570776][ T31] em28xx 2-1:0.0: Registering input extension [ 209.571011][ T5679] em28xx 2-1:0.0: Closing input extension [ 209.652941][ T5679] em28xx: Freeing device [ 209.954894][ T5679] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 209.986016][ T6082] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 209.988689][ T8173] syzkaller0: entered promiscuous mode [ 209.988705][ T8173] syzkaller0: entered allmulticast mode [ 210.114880][ T5679] usb 2-1: Using ep0 maxpacket: 16 [ 210.115826][ T5679] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 210.117224][ T5679] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 210.119426][ T5679] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.119454][ T5679] usb 2-1: Product: syz [ 210.119469][ T5679] usb 2-1: Manufacturer: syz [ 210.119483][ T5679] usb 2-1: SerialNumber: syz [ 210.121651][ T5679] usb 2-1: config 0 descriptor?? [ 210.130488][ T5679] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 210.130521][ T5679] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 210.157995][ T6082] usb 4-1: Using ep0 maxpacket: 32 [ 210.172369][ T6082] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 210.198631][ T6082] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 210.198660][ T6082] usb 4-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 210.198678][ T6082] usb 4-1: config 0 interface 0 has no altsetting 0 [ 210.236613][ T6082] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.236641][ T6082] usb 4-1: Product: syz [ 210.236655][ T6082] usb 4-1: Manufacturer: syz [ 210.236670][ T6082] usb 4-1: SerialNumber: syz [ 210.239147][ T6082] usb 4-1: config 0 descriptor?? [ 210.645773][ T8170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.646367][ T8170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.649510][ T6082] gs_usb 4-1:0.0: Configuring for 1 interfaces [ 210.828188][ T8180] fuse: Unknown parameter 'group_id00000000000000000000' [ 210.853422][ T6082] gs_usb 4-1:0.0: Couldn't get bit timing const for channel 0 (-EREMOTEIO) [ 210.853486][ T6082] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -121 [ 210.939473][ T5679] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 211.003200][ T5679] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 211.003231][ T5679] em28xx 2-1:0.0: board has no eeprom [ 211.058711][ T25] usb 4-1: USB disconnect, device number 54 [ 211.087408][ T5679] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 211.087437][ T5679] em28xx 2-1:0.0: dvb set to bulk mode. [ 211.089418][ T6095] em28xx 2-1:0.0: Binding DVB extension [ 211.121411][ T5679] usb 2-1: USB disconnect, device number 36 [ 211.137472][ T5679] em28xx 2-1:0.0: Disconnecting em28xx [ 211.217888][ T8190] ip_tables: iptables: counters copy to user failed while replacing table [ 211.223729][ T8190] xt_hashlimit: size too large, truncated to 1048576 [ 211.233367][ T6095] em28xx 2-1:0.0: Registering input extension [ 211.234013][ T5679] em28xx 2-1:0.0: Closing input extension [ 211.236056][ T8192] netlink: 8 bytes leftover after parsing attributes in process `syz.4.783'. [ 211.282775][ T5679] em28xx: Freeing device [ 211.433908][ T8196] 8021q: adding VLAN 0 to HW filter on device bond0 [ 211.438758][ T8196] 8021q: adding VLAN 0 to HW filter on device team0 [ 211.444542][ T8196] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 211.518859][ T8196] veth1_vlan: left promiscuous mode [ 211.520066][ T8196] veth0_vlan: left promiscuous mode [ 211.521461][ T8196] veth0_vlan: entered promiscuous mode [ 211.526263][ T8196] veth1_vlan: entered promiscuous mode [ 211.530865][ T8196] veth1_macvtap: left promiscuous mode [ 211.531895][ T8196] veth0_macvtap: left promiscuous mode [ 211.532889][ T8196] veth0_macvtap: entered promiscuous mode [ 211.533875][ T8196] veth1_macvtap: entered promiscuous mode [ 211.549668][ T8199] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 211.555654][ T8196] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 211.565798][ T8196] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 211.571083][ T8196] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 211.572963][ T8196] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 211.638508][ T8196] 8021q: adding VLAN 0 to HW filter on device bond1 [ 211.640279][ T8196] 8021q: adding VLAN 0 to HW filter on device bond2 [ 211.653955][ T8196] 8021q: adding VLAN 0 to HW filter on device bond3 [ 211.667786][ T8196] 8021q: adding VLAN 0 to HW filter on device bond4 [ 211.772806][ T8203] FAULT_INJECTION: forcing a failure. [ 211.772806][ T8203] name failslab, interval 1, probability 0, space 0, times 0 [ 211.772842][ T8203] CPU: 0 UID: 0 PID: 8203 Comm: syz.3.785 Tainted: G L syzkaller #0 PREEMPT(full) [ 211.772868][ T8203] Tainted: [L]=SOFTLOCKUP [ 211.772876][ T8203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 211.772887][ T8203] Call Trace: [ 211.772895][ T8203] [ 211.772904][ T8203] dump_stack_lvl+0xe8/0x150 [ 211.772937][ T8203] should_fail_ex+0x410/0x560 [ 211.772964][ T8203] ? __alloc_skb+0x1db/0x7a0 [ 211.772989][ T8203] should_failslab+0xa8/0x100 [ 211.773015][ T8203] ? __alloc_skb+0x1db/0x7a0 [ 211.773039][ T8203] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 211.773059][ T8203] ? __alloc_skb+0x18d/0x7a0 [ 211.773084][ T8203] ? __alloc_skb+0x1db/0x7a0 [ 211.773116][ T8203] __alloc_skb+0x1db/0x7a0 [ 211.773145][ T8203] netlink_sendmsg+0x5d4/0xb40 [ 211.773175][ T8203] ? __pfx_netlink_sendmsg+0x10/0x10 [ 211.773204][ T8203] ? apparmor_socket_sendmsg+0x98/0x360 [ 211.773231][ T8203] ? __pfx_netlink_sendmsg+0x10/0x10 [ 211.773250][ T8203] sock_sendmsg_nosec+0x13a/0x180 [ 211.773277][ T8203] ____sys_sendmsg+0x54e/0x850 [ 211.773311][ T8203] ? __pfx_____sys_sendmsg+0x10/0x10 [ 211.773348][ T8203] ? import_iovec+0x73/0xa0 [ 211.773377][ T8203] ___sys_sendmsg+0x2a5/0x360 [ 211.773404][ T8203] ? __lock_acquire+0x747/0x2de0 [ 211.773430][ T8203] ? __pfx____sys_sendmsg+0x10/0x10 [ 211.773471][ T8203] ? kstrtouint+0x6e/0xe0 [ 211.773517][ T8203] ? __fget_files+0x2a/0x420 [ 211.773544][ T8203] ? __fget_files+0x3a2/0x420 [ 211.773580][ T8203] __sys_sendmmsg+0x273/0x4d0 [ 211.773613][ T8203] ? __pfx___sys_sendmmsg+0x10/0x10 [ 211.773650][ T8203] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 211.773692][ T8203] ? ksys_write+0x242/0x270 [ 211.773714][ T8203] ? __pfx_ksys_write+0x10/0x10 [ 211.773739][ T8203] __x64_sys_sendmmsg+0xa0/0xc0 [ 211.773772][ T8203] do_syscall_64+0x166/0x520 [ 211.773797][ T8203] ? trace_irq_disable+0x3b/0x140 [ 211.773815][ T8203] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.773832][ T8203] ? clear_bhb_loop+0x70/0xc0 [ 211.773852][ T8203] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.773870][ T8203] RIP: 0033:0x7f20e7b9e159 [ 211.773887][ T8203] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.773902][ T8203] RSP: 002b:00007f20e5dd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 211.773920][ T8203] RAX: ffffffffffffffda RBX: 00007f20e7e26090 RCX: 00007f20e7b9e159 [ 211.773933][ T8203] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000007 [ 211.773945][ T8203] RBP: 00007f20e5dd5090 R08: 0000000000000000 R09: 0000000000000000 [ 211.773956][ T8203] R10: 00000000000000fc R11: 0000000000000246 R12: 0000000000000001 [ 211.773967][ T8203] R13: 00007f20e7e26128 R14: 00007f20e7e26090 R15: 00007f20e7f4fa48 [ 211.773995][ T8203] [ 211.876664][ T8205] netlink: 20 bytes leftover after parsing attributes in process `syz.0.787'. [ 211.899438][ T5679] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 212.049207][ T5679] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 212.050548][ T5679] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 212.050575][ T5679] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 212.050613][ T5679] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.219590][ T12] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.219626][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 212.219659][ T12] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.219683][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 212.277550][ T1168] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.277586][ T1168] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 212.321088][ T5679] usb 2-1: usb_control_msg returned -32 [ 212.321121][ T5679] usbtmc 2-1:16.0: can't read capabilities [ 212.346021][ T8199] netlink: 'syz.1.784': attribute type 1 has an invalid length. [ 212.374171][ T8210] netlink: 16 bytes leftover after parsing attributes in process `syz.3.788'. [ 212.384901][ T1168] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.384935][ T1168] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 212.684945][ T25] usb 5-1: new full-speed USB device number 45 using dummy_hcd [ 212.846376][ T25] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 212.847653][ T25] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 212.847679][ T25] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 212.847722][ T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.851314][ T25] usb 5-1: config 0 descriptor?? [ 212.856624][ T25] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 212.856669][ T25] dvb-usb: bulk message failed: -22 (3/0) [ 212.867085][ T25] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 212.867862][ T25] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 212.867920][ T25] usb 5-1: media controller created [ 212.871268][ T25] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 212.875283][ T5679] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 212.877502][ T25] dvb-usb: bulk message failed: -22 (6/0) [ 212.877577][ T25] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 212.880554][ T25] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input39 [ 212.882840][ T25] dvb-usb: schedule remote query interval to 150 msecs. [ 212.882860][ T25] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 213.049259][ T6083] dvb-usb: bulk message failed: -22 (1/0) [ 213.049296][ T6083] dvb-usb: error while querying for an remote control event. [ 213.053830][ T8214] dvb-usb: bulk message failed: -22 (2/0) [ 213.053938][ T8214] FAULT_INJECTION: forcing a failure. [ 213.053938][ T8214] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 213.053959][ T8214] CPU: 0 UID: 0 PID: 8214 Comm: syz.4.790 Tainted: G L syzkaller #0 PREEMPT(full) [ 213.053980][ T8214] Tainted: [L]=SOFTLOCKUP [ 213.053984][ T8214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 213.053992][ T8214] Call Trace: [ 213.053997][ T8214] [ 213.054004][ T8214] dump_stack_lvl+0xe8/0x150 [ 213.054031][ T8214] should_fail_ex+0x410/0x560 [ 213.054052][ T8214] _copy_to_user+0x31/0xb0 [ 213.054073][ T8214] i2cdev_read+0x13b/0x250 [ 213.054091][ T8214] ? __pfx_i2cdev_read+0x10/0x10 [ 213.054105][ T8214] vfs_read+0x213/0xa80 [ 213.054130][ T8214] ? __pfx_vfs_read+0x10/0x10 [ 213.054150][ T8214] ? __fget_files+0x2a/0x420 [ 213.054172][ T8214] ? __fget_files+0x2a/0x420 [ 213.054191][ T8214] ? __fget_files+0x3a2/0x420 [ 213.054210][ T8214] ? __fget_files+0x2a/0x420 [ 213.054238][ T8214] ksys_read+0x150/0x270 [ 213.054249][ T8214] ? __pfx_ksys_read+0x10/0x10 [ 213.054265][ T8214] do_syscall_64+0x166/0x520 [ 213.054280][ T8214] ? trace_irq_disable+0x3b/0x140 [ 213.054298][ T8214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.054315][ T8214] ? clear_bhb_loop+0x70/0xc0 [ 213.054348][ T8214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.054367][ T8214] RIP: 0033:0x7f350979e159 [ 213.054386][ T8214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 213.054402][ T8214] RSP: 002b:00007f350a673028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 213.054426][ T8214] RAX: ffffffffffffffda RBX: 00007f3509a25fa0 RCX: 00007f350979e159 [ 213.054440][ T8214] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 213.054450][ T8214] RBP: 00007f350a673090 R08: 0000000000000000 R09: 0000000000000000 [ 213.054464][ T8214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 213.054477][ T8214] R13: 00007f3509a26038 R14: 00007f3509a25fa0 R15: 00007f3509b4fa48 [ 213.054506][ T8214] [ 213.058102][ T6083] usb 5-1: USB disconnect, device number 45 [ 213.068656][ T5679] usb 4-1: Using ep0 maxpacket: 8 [ 213.105464][ T5679] usb 4-1: New USB device found, idVendor=0458, idProduct=5014, bcdDevice= 0.00 [ 213.144364][ T6083] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 213.169152][ T5679] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 254, changing to 11 [ 213.169203][ T5679] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.300806][ T5679] usb 4-1: config 0 descriptor?? [ 213.464930][ T25] usb 3-1: new full-speed USB device number 40 using dummy_hcd [ 213.529392][ T8226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 213.529929][ T8226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 213.615728][ T25] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 213.617293][ T25] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 213.617310][ T25] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 213.617363][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.619862][ T25] usb 3-1: config 0 descriptor?? [ 213.624944][ T25] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 213.624997][ T25] dvb-usb: bulk message failed: -22 (3/0) [ 213.628519][ T25] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 213.631519][ T25] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 213.631572][ T25] usb 3-1: media controller created [ 213.633107][ T25] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 213.639474][ T25] dvb-usb: bulk message failed: -22 (6/0) [ 213.639553][ T25] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 213.642551][ T25] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input40 [ 213.644702][ T25] dvb-usb: schedule remote query interval to 150 msecs. [ 213.644724][ T25] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 213.782381][ T5679] input: HID 0458:5014 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5014.0007/input/input41 [ 213.809265][ T25] dvb-usb: bulk message failed: -22 (1/0) [ 213.809319][ T25] dvb-usb: error while querying for an remote control event. [ 213.838847][ T8228] dvb-usb: bulk message failed: -22 (2/0) [ 213.841078][ T25] usb 3-1: USB disconnect, device number 40 [ 213.928784][ T8234] fuse: Bad value for 'user_id' [ 213.928797][ T8234] fuse: Bad value for 'user_id' [ 214.008683][ T5679] kye 0003:0458:5014.0007: input,hiddev1,hidraw0: USB HID v7f.fc Device [HID 0458:5014] on usb-dummy_hcd.3-1/input0 [ 214.016096][ T25] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 214.272336][ T25] usb 4-1: USB disconnect, device number 55 [ 214.505538][ T8245] fuse: Unknown parameter '0xffffffffffffffff0x000000000000000b' [ 214.558452][ T25] usb 2-1: USB disconnect, device number 37 [ 214.710543][ T8248] netlink: 'syz.1.805': attribute type 32 has an invalid length. [ 214.979417][ T8256] netlink: 'syz.2.807': attribute type 5 has an invalid length. [ 215.391057][ T8240] netlink: 12 bytes leftover after parsing attributes in process `syz.4.802'. [ 215.391081][ T8240] netlink: 8 bytes leftover after parsing attributes in process `syz.4.802'. [ 215.391270][ T8240] netlink: 12 bytes leftover after parsing attributes in process `syz.4.802'. [ 215.391285][ T8240] netlink: 8 bytes leftover after parsing attributes in process `syz.4.802'. [ 215.391461][ T8240] netlink: 12 bytes leftover after parsing attributes in process `syz.4.802'. [ 215.391475][ T8240] netlink: 8 bytes leftover after parsing attributes in process `syz.4.802'. [ 215.392941][ T8240] netlink: 12 bytes leftover after parsing attributes in process `syz.4.802'. [ 215.392960][ T8240] netlink: 8 bytes leftover after parsing attributes in process `syz.4.802'. [ 215.393737][ T8240] netlink: 12 bytes leftover after parsing attributes in process `syz.4.802'. [ 215.604887][ T31] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 215.754862][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 215.755694][ T31] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 215.756775][ T31] usb 3-1: config 157 interface 0 has no altsetting 0 [ 215.759211][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.759233][ T31] usb 3-1: Product: syz [ 215.759246][ T31] usb 3-1: Manufacturer: syz [ 215.759260][ T31] usb 3-1: SerialNumber: syz [ 215.954889][ T7273] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 216.035006][ T5679] usb 1-1: new full-speed USB device number 43 using dummy_hcd [ 216.092393][ T8276] fuse: Bad value for 'user_id' [ 216.092412][ T8276] fuse: Bad value for 'user_id' [ 216.105189][ T7273] usb 2-1: Using ep0 maxpacket: 32 [ 216.107464][ T7273] usb 2-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 216.111407][ T7273] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.111434][ T7273] usb 2-1: Product: syz [ 216.111449][ T7273] usb 2-1: Manufacturer: syz [ 216.111462][ T7273] usb 2-1: SerialNumber: syz [ 216.116366][ T7273] usb 2-1: config 0 descriptor?? [ 216.153704][ T7273] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 216.153798][ T7273] dvb-usb: bulk message failed: -22 (4/0) [ 216.153813][ T7273] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 216.153924][ T7273] dvb-usb: bulk message failed: -22 (5/0) [ 216.153936][ T7273] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 216.167688][ T5679] usb 1-1: device descriptor read/64, error -71 [ 216.176851][ T7273] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 216.178723][ T7273] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 216.178775][ T7273] usb 2-1: media controller created [ 216.210652][ T7273] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 216.257683][ T7273] usb 2-1: selecting invalid altsetting 3 [ 216.257708][ T7273] ttusb2: set interface to alts=3 failed [ 216.317877][ T7273] DVB: Unable to find symbol tda10086_attach() [ 216.317894][ T7273] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 216.318632][ T7273] dvb-usb: bulk message failed: -22 (4/0) [ 216.318645][ T7273] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 216.318737][ T7273] dvb-usb: bulk message failed: -22 (5/0) [ 216.318750][ T7273] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 216.318814][ T7273] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 216.405570][ T5679] usb 1-1: new full-speed USB device number 44 using dummy_hcd [ 216.413753][ T8272] ttusb2: more than 2 i2c messages at a time is not handled yet. TODO. [ 216.413921][ T8272] dvb-usb: bulk message failed: -22 (7/0) [ 216.426900][ T8272] ttusb2: there might have been an error during control message transfer. (rlen = 3, was 0) [ 216.426957][ T8272] ttusb2: i2c transfer failed. [ 216.504332][ T25] usb 2-1: USB disconnect, device number 38 [ 216.536510][ T5679] usb 1-1: device descriptor read/64, error -71 [ 216.589407][ T25] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 216.646581][ T5679] usb usb1-port1: attempt power cycle [ 216.984950][ T5679] usb 1-1: new full-speed USB device number 45 using dummy_hcd [ 217.005395][ T5679] usb 1-1: device descriptor read/8, error -71 [ 217.245096][ T5679] usb 1-1: new full-speed USB device number 46 using dummy_hcd [ 217.272384][ T5679] usb 1-1: device descriptor read/8, error -71 [ 217.375314][ T5679] usb usb1-port1: unable to enumerate USB device [ 217.864921][ T25] usb 5-1: new full-speed USB device number 46 using dummy_hcd [ 217.960875][ T31] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 217.989572][ T31] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 217.989943][ T31] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 217.989995][ T31] usb 3-1: media controller created [ 217.995867][ T25] usb 5-1: device descriptor read/64, error -71 [ 218.058884][ T31] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 218.145243][ T31] zl10353_read_register: readreg error (reg=127, ret==-71) [ 218.182720][ T8298] __nla_validate_parse: 11 callbacks suppressed [ 218.182742][ T8298] netlink: 20 bytes leftover after parsing attributes in process `syz.2.818'. [ 218.234852][ T25] usb 5-1: new full-speed USB device number 47 using dummy_hcd [ 218.295449][ T31] dvb_usb_gl861 3-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 218.299003][ T31] usb 3-1: USB disconnect, device number 41 [ 218.334484][ T8302] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.363527][ T8302] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.374923][ T25] usb 5-1: device descriptor read/64, error -71 [ 218.406877][ T8305] input: syz0 as /devices/virtual/input/input42 [ 218.495889][ T25] usb usb5-port1: attempt power cycle [ 218.565234][ T5679] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 218.719001][ T5679] usb 4-1: unable to get BOS descriptor or descriptor too short [ 218.719492][ T5679] usb 4-1: not running at top speed; connect to a high speed hub [ 218.719524][ T5679] usb 4-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 218.720468][ T5679] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 218.720500][ T5679] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 218.723765][ T5679] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.723790][ T5679] usb 4-1: Product: syz [ 218.723804][ T5679] usb 4-1: Manufacturer: syz [ 218.723822][ T5679] usb 4-1: SerialNumber: syz [ 218.864898][ T25] usb 5-1: new full-speed USB device number 48 using dummy_hcd [ 218.885559][ T25] usb 5-1: device descriptor read/8, error -71 [ 219.022044][ T5679] usb 4-1: USB disconnect, device number 56 [ 219.023606][ T8311] netlink: 8 bytes leftover after parsing attributes in process `syz.1.823'. [ 219.051450][ T8311] netlink: 24 bytes leftover after parsing attributes in process `syz.1.823'. [ 219.051539][ T8311] netlink: 4 bytes leftover after parsing attributes in process `syz.1.823'. [ 219.063800][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 219.144889][ T25] usb 5-1: new full-speed USB device number 49 using dummy_hcd [ 219.167500][ T25] usb 5-1: device descriptor read/8, error -71 [ 219.277365][ T25] usb usb5-port1: unable to enumerate USB device [ 219.336645][ T8317] netlink: 'syz.1.825': attribute type 10 has an invalid length. [ 219.471925][ T8323] fuse: Bad value for 'fd' [ 219.611821][ T8328] netlink: 'syz.3.830': attribute type 28 has an invalid length. [ 219.611844][ T8328] netlink: 'syz.3.830': attribute type 3 has an invalid length. [ 219.611857][ T8328] netlink: 132 bytes leftover after parsing attributes in process `syz.3.830'. [ 219.842456][ T8336] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 220.055313][ T7273] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 220.148932][ T8347] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 220.195387][ T8350] FAULT_INJECTION: forcing a failure. [ 220.195387][ T8350] name failslab, interval 1, probability 0, space 0, times 0 [ 220.195411][ T8350] CPU: 0 UID: 0 PID: 8350 Comm: syz.0.838 Tainted: G L syzkaller #0 PREEMPT(full) [ 220.195427][ T8350] Tainted: [L]=SOFTLOCKUP [ 220.195431][ T8350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 220.195437][ T8350] Call Trace: [ 220.195441][ T8350] [ 220.195446][ T8350] dump_stack_lvl+0xe8/0x150 [ 220.195467][ T8350] should_fail_ex+0x410/0x560 [ 220.195484][ T8350] should_failslab+0xa8/0x100 [ 220.195500][ T8350] __kmalloc_cache_noprof+0xa3/0x600 [ 220.195512][ T8350] ? netdevice_event+0x3aa/0x8a0 [ 220.195523][ T8350] ? netdevice_event+0x3aa/0x8a0 [ 220.195537][ T8350] netdevice_event+0x3aa/0x8a0 [ 220.195548][ T8350] ? rcu_is_watching+0x16/0xb0 [ 220.195563][ T8350] ? __up_read+0x29c/0x930 [ 220.195580][ T8350] ? __pfx_netdevice_event+0x10/0x10 [ 220.195591][ T8350] ? __pfx_del_netdev_ips+0x10/0x10 [ 220.195600][ T8350] ? __pfx_is_eth_port_of_netdev_filter+0x10/0x10 [ 220.195611][ T8350] ? __pfx_add_default_gids+0x10/0x10 [ 220.195626][ T8350] ? __pfx_is_ndev_for_default_gid_filter+0x10/0x10 [ 220.195643][ T8350] ? __pfx_add_netdev_ips+0x10/0x10 [ 220.195653][ T8350] ? __pfx_is_eth_port_of_netdev_filter+0x10/0x10 [ 220.195671][ T8350] notifier_call_chain+0x1a5/0x3d0 [ 220.195692][ T8350] netif_set_mac_address+0x393/0x4d0 [ 220.195712][ T8350] ? __pfx_netif_set_mac_address+0x10/0x10 [ 220.195728][ T8350] ? down_write+0x16b/0x200 [ 220.195747][ T8350] ? do_setlink+0x993/0x4670 [ 220.195765][ T8350] do_setlink+0x9ad/0x4670 [ 220.195779][ T8350] ? unwind_get_return_address+0x4d/0x90 [ 220.195801][ T8350] ? __pfx_do_setlink+0x10/0x10 [ 220.195816][ T8350] ? __lock_acquire+0x747/0x2de0 [ 220.195834][ T8350] ? kasan_save_track+0x4f/0x80 [ 220.195846][ T8350] ? kasan_save_track+0x3e/0x80 [ 220.195857][ T8350] ? __kasan_kmalloc+0x93/0xb0 [ 220.195868][ T8350] ? __kmalloc_cache_noprof+0x321/0x600 [ 220.195887][ T8350] ? __pfx___mutex_trylock_common+0x10/0x10 [ 220.195903][ T8350] ? rcu_is_watching+0x16/0xb0 [ 220.195916][ T8350] ? trace_contention_end+0x3d/0x140 [ 220.195931][ T8350] ? __mutex_lock+0x30b/0x1550 [ 220.195951][ T8350] ? rtnl_newlink+0xc10/0x1c30 [ 220.195966][ T8350] ? __pfx___mutex_lock+0x10/0x10 [ 220.195986][ T8350] ? full_name_hash+0x92/0xe0 [ 220.196005][ T8350] rtnl_newlink+0x15a3/0x1c30 [ 220.196026][ T8350] ? __pfx_rtnl_newlink+0x10/0x10 [ 220.196039][ T8350] ? do_syscall_64+0x166/0x520 [ 220.196079][ T8350] ? kasan_quarantine_put+0xbb/0x1f0 [ 220.196091][ T8350] ? lockdep_hardirqs_on+0x7b/0x110 [ 220.196107][ T8350] ? nlmon_xmit+0xb0/0x100 [ 220.196120][ T8350] ? kmem_cache_free+0x182/0x650 [ 220.196137][ T8350] ? __lock_acquire+0x747/0x2de0 [ 220.196154][ T8350] ? __local_bh_enable_ip+0xd6/0x140 [ 220.196168][ T8350] ? lockdep_hardirqs_on+0x7b/0x110 [ 220.196182][ T8350] ? __dev_queue_xmit+0x29b/0x3820 [ 220.196192][ T8350] ? __local_bh_enable_ip+0xd6/0x140 [ 220.196205][ T8350] ? __dev_queue_xmit+0x29b/0x3820 [ 220.196219][ T8350] ? lock_acquire+0x115/0x350 [ 220.196230][ T8350] ? __pfx_rtnl_newlink+0x10/0x10 [ 220.196250][ T8350] ? __pfx_rtnl_newlink+0x10/0x10 [ 220.196263][ T8350] rtnetlink_rcv_msg+0x802/0xc00 [ 220.196279][ T8350] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 220.196293][ T8350] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 220.196306][ T8350] ? ref_tracker_free+0x689/0x830 [ 220.196322][ T8350] ? __pfx_ref_tracker_free+0x10/0x10 [ 220.196340][ T8350] netlink_rcv_skb+0x226/0x4a0 [ 220.196353][ T8350] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 220.196368][ T8350] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 220.196385][ T8350] ? netlink_deliver_tap+0x2e/0x1b0 [ 220.196396][ T8350] ? netlink_deliver_tap+0x2e/0x1b0 [ 220.196410][ T8350] netlink_unicast+0x7bd/0x940 [ 220.196431][ T8350] netlink_sendmsg+0x813/0xb40 [ 220.196447][ T8350] ? __pfx_netlink_sendmsg+0x10/0x10 [ 220.196462][ T8350] ? apparmor_socket_sendmsg+0x98/0x360 [ 220.196477][ T8350] ? __pfx_netlink_sendmsg+0x10/0x10 [ 220.196487][ T8350] sock_sendmsg_nosec+0x13a/0x180 [ 220.196501][ T8350] ____sys_sendmsg+0x54e/0x850 [ 220.196519][ T8350] ? __pfx_____sys_sendmsg+0x10/0x10 [ 220.196538][ T8350] ? import_iovec+0x73/0xa0 [ 220.196554][ T8350] ___sys_sendmsg+0x2a5/0x360 [ 220.196571][ T8350] ? __lock_acquire+0x747/0x2de0 [ 220.196585][ T8350] ? __pfx____sys_sendmsg+0x10/0x10 [ 220.196620][ T8350] ? __fget_files+0x2a/0x420 [ 220.196642][ T8350] ? __fget_files+0x3a2/0x420 [ 220.196673][ T8350] __x64_sys_sendmsg+0x1b1/0x290 [ 220.196699][ T8350] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 220.196742][ T8350] do_syscall_64+0x166/0x520 [ 220.196763][ T8350] ? trace_irq_disable+0x3b/0x140 [ 220.196774][ T8350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.196785][ T8350] ? clear_bhb_loop+0x70/0xc0 [ 220.196798][ T8350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.196809][ T8350] RIP: 0033:0x7fb51879e159 [ 220.196821][ T8350] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 220.196830][ T8350] RSP: 002b:00007fb51968a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 220.196842][ T8350] RAX: ffffffffffffffda RBX: 00007fb518a25fa0 RCX: 00007fb51879e159 [ 220.196850][ T8350] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 220.196856][ T8350] RBP: 00007fb51968a090 R08: 0000000000000000 R09: 0000000000000000 [ 220.196863][ T8350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 220.196869][ T8350] R13: 00007fb518a26038 R14: 00007fb518a25fa0 R15: 00007fb518b4fa48 [ 220.196885][ T8350] [ 220.197213][ T8350] team0: entered allmulticast mode [ 220.197223][ T8350] team_slave_0: entered allmulticast mode [ 220.197232][ T8350] team_slave_1: entered allmulticast mode [ 220.197565][ T8350] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 220.205254][ T7273] usb 4-1: Using ep0 maxpacket: 32 [ 220.208847][ T7273] usb 4-1: unable to get BOS descriptor or descriptor too short [ 220.208896][ T7273] usb 4-1: New USB device found, idVendor=2a39, idProduct=3f8c, bcdDevice= 0.40 [ 220.215191][ T7273] usb 4-1: language id specifier not provided by device, defaulting to English [ 220.218907][ T7273] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.218933][ T7273] usb 4-1: Product: syz [ 220.218947][ T7273] usb 4-1: Manufacturer: syz [ 220.218961][ T7273] usb 4-1: SerialNumber: syz [ 220.588768][ T7273] usb 4-1: 1:1 : bogus bTerminalLink 5 [ 220.794892][ T6092] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 220.838001][ T7273] usb 4-1: USB disconnect, device number 57 [ 220.877428][ T8358] fuse: Bad value for 'fd' [ 220.948589][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 220.949903][ T6092] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 220.951645][ T6092] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 220.951676][ T6092] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 220.951701][ T6092] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 220.951726][ T6092] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 220.957212][ T6092] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.957238][ T6092] usb 1-1: Product: syz [ 220.957252][ T6092] usb 1-1: Manufacturer: syz [ 220.957265][ T6092] usb 1-1: SerialNumber: syz [ 220.966393][ T6092] usb 1-1: config 0 descriptor?? [ 220.969122][ T8355] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 220.978296][ T6092] usb 1-1: ucan: probing device on interface #0 [ 220.978324][ T6092] usb 1-1: ucan: invalid endpoint configuration [ 220.978338][ T6092] usb 1-1: ucan: probe failed; try to update the device firmware [ 221.498635][ T8370] netlink: 8 bytes leftover after parsing attributes in process `syz.3.843'. [ 221.531863][ T8373] netlink: 8 bytes leftover after parsing attributes in process `syz.4.846'. [ 221.850592][ T8381] openvswitch: netlink: IP tunnel dst address not specified [ 221.850626][ T8381] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 222.290693][ T8402] netlink: 20 bytes leftover after parsing attributes in process `syz.4.854'. [ 222.444900][ T25] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 222.616031][ T25] usb 2-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 222.619898][ T25] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.619933][ T25] usb 2-1: Product: syz [ 222.619947][ T25] usb 2-1: Manufacturer: syz [ 222.619960][ T25] usb 2-1: SerialNumber: syz [ 222.623358][ T25] usb 2-1: config 0 descriptor?? [ 222.714872][ T6083] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 222.875577][ T6083] usb 3-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 222.877069][ T6083] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 222.877085][ T6083] usb 3-1: config 1 has no interface number 0 [ 222.878271][ T6083] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 222.878295][ T6083] usb 3-1: config 1 has no interface number 0 [ 222.879209][ T6083] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 222.879232][ T6083] usb 3-1: config 1 has no interface number 0 [ 222.880372][ T6083] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 222.880394][ T6083] usb 3-1: config 1 has no interface number 0 [ 222.883760][ T6083] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.883787][ T6083] usb 3-1: Product: syz [ 222.883801][ T6083] usb 3-1: Manufacturer: syz [ 222.883840][ T6083] usb 3-1: SerialNumber: syz [ 222.986213][ T6083] usb 3-1: 3:0 : does not exist [ 222.986238][ T6083] usb 3-1: 3:0 : does not exist [ 223.319845][ T8413] netlink: 'syz.1.852': attribute type 39 has an invalid length. [ 223.386919][ T12] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 223.388482][ T8398] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 223.546204][ T7273] usb 1-1: USB disconnect, device number 47 [ 223.889216][ T8405] bond0: option downdelay: invalid value (18446744071562067968) [ 223.889241][ T8405] bond0: option downdelay: allowed values 0 - 2147483647 [ 223.940329][ T8405] bond0 (unregistering): Released all slaves [ 223.963615][ T8424] netlink: 8 bytes leftover after parsing attributes in process `syz.3.859'. [ 224.662504][ T6082] usb 3-1: USB disconnect, device number 42 [ 225.107434][ T25] usb 2-1: f81604_read: reg: 105 failed: -ETIMEDOUT [ 225.107464][ T25] f81604 2-1:0.0: Setting termination of CH#1 failed: -ETIMEDOUT [ 225.107490][ T25] f81604 2-1:0.0: probe with driver f81604 failed with error -110 [ 225.235652][ T6092] usb 2-1: USB disconnect, device number 39 [ 226.101201][ T8473] warning: `syz.0.874' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 226.151603][ T8473] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 226.151628][ T8473] syzkaller1: group set to 0 [ 226.244876][ T25] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 226.263134][ T8462] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 226.394971][ T25] usb 4-1: Using ep0 maxpacket: 8 [ 226.411842][ T25] usb 4-1: unable to get BOS descriptor or descriptor too short [ 226.411892][ T25] usb 4-1: New USB device found, idVendor=2b73, idProduct=0013, bcdDevice= 0.40 [ 226.412373][ T8454] netlink: 'syz.1.870': attribute type 16 has an invalid length. [ 226.412392][ T8454] netlink: 'syz.1.870': attribute type 17 has an invalid length. [ 226.421580][ T8454] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 226.423718][ T8462] syzkaller1: entered promiscuous mode [ 226.423739][ T8462] syzkaller1: entered allmulticast mode [ 226.449457][ T25] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 226.449474][ T25] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 226.449514][ T25] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 226.513740][ T8454] netlink: 20 bytes leftover after parsing attributes in process `syz.1.870'. [ 226.530741][ T25] usb 4-1: language id specifier not provided by device, defaulting to English [ 226.545440][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.545466][ T25] usb 4-1: Product: syz [ 226.545481][ T25] usb 4-1: Manufacturer: syz [ 226.545496][ T25] usb 4-1: SerialNumber: syz [ 226.684921][ T7275] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 226.759755][ T8482] netlink: 20 bytes leftover after parsing attributes in process `syz.0.877'. [ 226.837365][ T7275] usb 5-1: Using ep0 maxpacket: 32 [ 226.838038][ T7275] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 226.843388][ T7275] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 226.843409][ T7275] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x2 has invalid wMaxPacketSize 0 [ 226.843432][ T7275] usb 5-1: config 0 interface 0 has no altsetting 0 [ 226.843465][ T7275] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.880638][ T7275] usb 5-1: config 0 descriptor?? [ 227.340793][ T7275] corsair-cpro 0003:1B1C:0C10.0008: unknown main item tag 0x0 [ 227.340818][ T7275] corsair-cpro 0003:1B1C:0C10.0008: unknown main item tag 0x0 [ 227.340837][ T7275] corsair-cpro 0003:1B1C:0C10.0008: unknown main item tag 0x0 [ 227.340852][ T7275] corsair-cpro 0003:1B1C:0C10.0008: unknown main item tag 0x0 [ 227.340867][ T7275] corsair-cpro 0003:1B1C:0C10.0008: unknown main item tag 0x0 [ 227.355951][ T7275] corsair-cpro 0003:1B1C:0C10.0008: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.4-1/input0 [ 227.472278][ T7275] corsair-cpro 0003:1B1C:0C10.0008: probe with driver corsair-cpro failed with error -90 [ 227.559981][ T31] usb 5-1: USB disconnect, device number 50 [ 227.809236][ T8488] netlink: 16 bytes leftover after parsing attributes in process `syz.1.879'. [ 228.256576][ T8494] fuse: Bad value for 'fd' [ 228.970146][ T25] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 228.990094][ T25] usb 4-1: USB disconnect, device number 58 [ 229.044878][ T7275] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 229.054618][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 229.194950][ T7275] usb 2-1: Using ep0 maxpacket: 8 [ 229.195631][ T7275] usb 2-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 5.b7 [ 229.196740][ T7275] usb 2-1: config 0 has an invalid interface number: 122 but max is 0 [ 229.196764][ T7275] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 229.196783][ T7275] usb 2-1: config 0 has no interface number 0 [ 229.196819][ T7275] usb 2-1: config 0 interface 122 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 229.199004][ T7275] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.199029][ T7275] usb 2-1: Product: syz [ 229.199043][ T7275] usb 2-1: Manufacturer: syz [ 229.199057][ T7275] usb 2-1: SerialNumber: syz [ 229.202095][ T7275] usb 2-1: config 0 descriptor?? [ 229.417139][ T7275] usb 2-1: NFC: intf ffff88803580a000 id ffffffff8f85c540 [ 229.427722][ T7275] usb 2-1: USB disconnect, device number 40 [ 229.768471][ T8521] FAULT_INJECTION: forcing a failure. [ 229.768471][ T8521] name failslab, interval 1, probability 0, space 0, times 0 [ 229.768508][ T8521] CPU: 0 UID: 0 PID: 8521 Comm: syz.4.889 Tainted: G L syzkaller #0 PREEMPT(full) [ 229.768534][ T8521] Tainted: [L]=SOFTLOCKUP [ 229.768542][ T8521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 229.768554][ T8521] Call Trace: [ 229.768562][ T8521] [ 229.768569][ T8521] dump_stack_lvl+0xe8/0x150 [ 229.768601][ T8521] should_fail_ex+0x410/0x560 [ 229.768631][ T8521] should_failslab+0xa8/0x100 [ 229.768668][ T8521] __kmalloc_cache_noprof+0xa3/0x600 [ 229.768692][ T8521] ? __kmalloc_cache_noprof+0x14d/0x600 [ 229.768712][ T8521] ? sctp_add_bind_addr+0x8c/0x370 [ 229.768734][ T8521] ? sctp_add_bind_addr+0x8c/0x370 [ 229.768760][ T8521] sctp_add_bind_addr+0x8c/0x370 [ 229.768786][ T8521] sctp_copy_local_addr_list+0x31a/0x4e0 [ 229.768811][ T8521] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 229.768835][ T8521] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 229.768859][ T8521] ? sctp_v6_is_any+0x64/0x80 [ 229.768884][ T8521] ? sctp_copy_one_addr+0x93/0x360 [ 229.768907][ T8521] sctp_bind_addr_copy+0xb3/0x3c0 [ 229.768930][ T8521] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 229.768964][ T8521] sctp_connect_new_asoc+0x2ff/0x6b0 [ 229.768994][ T8521] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 229.769026][ T8521] ? __local_bh_enable_ip+0xd6/0x140 [ 229.769052][ T8521] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 229.769082][ T8521] ? security_sctp_bind_connect+0x7e/0x2c0 [ 229.769109][ T8521] sctp_sendmsg+0x159b/0x2d00 [ 229.769146][ T8521] ? kstrtouint+0x6e/0xe0 [ 229.769168][ T8521] ? __pfx_sctp_sendmsg+0x10/0x10 [ 229.769193][ T8521] ? lock_acquire+0x115/0x350 [ 229.769217][ T8521] ? get_pid_task+0x20/0x1f0 [ 229.769253][ T8521] ? aa_sock_msg_perm+0xf5/0x210 [ 229.769279][ T8521] ? sock_rps_record_flow+0x19/0x350 [ 229.769306][ T8521] ? inet_sendmsg+0x298/0x320 [ 229.769331][ T8521] ? __pfx_inet_sendmsg+0x10/0x10 [ 229.769354][ T8521] sock_sendmsg_nosec+0x10e/0x180 [ 229.769382][ T8521] __sys_sendto+0x408/0x5a0 [ 229.769409][ T8521] ? ksys_write+0x1e6/0x270 [ 229.769437][ T8521] ? __pfx___sys_sendto+0x10/0x10 [ 229.769460][ T8521] ? __mutex_unlock_slowpath+0x731/0x900 [ 229.769513][ T8521] ? __pfx_ksys_write+0x10/0x10 [ 229.769538][ T8521] __x64_sys_sendto+0xde/0x100 [ 229.769569][ T8521] do_syscall_64+0x166/0x520 [ 229.769597][ T8521] ? trace_irq_disable+0x3b/0x140 [ 229.769617][ T8521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 229.769639][ T8521] ? clear_bhb_loop+0x70/0xc0 [ 229.769672][ T8521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 229.769692][ T8521] RIP: 0033:0x7f350979e159 [ 229.769710][ T8521] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 229.769727][ T8521] RSP: 002b:00007f350a673028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 229.769748][ T8521] RAX: ffffffffffffffda RBX: 00007f3509a25fa0 RCX: 00007f350979e159 [ 229.769762][ T8521] RDX: 0000000000034000 RSI: 0000200000000300 RDI: 0000000000000003 [ 229.769776][ T8521] RBP: 00007f350a673090 R08: 0000200000000000 R09: 000000000000001c [ 229.769790][ T8521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 229.769803][ T8521] R13: 00007f3509a26038 R14: 00007f3509a25fa0 R15: 00007f3509b4fa48 [ 229.769836][ T8521] [ 229.836033][ T32] audit: type=1326 audit(1790727926.037:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8522 comm="syz.4.890" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f350979e159 code=0x0 [ 230.112716][ T7275] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 230.193187][ T8534] netlink: 'syz.0.891': attribute type 10 has an invalid length. [ 230.212627][ T8534] 8021q: adding VLAN 0 to HW filter on device bond0 [ 230.214211][ T8534] bond0: entered allmulticast mode [ 230.214231][ T8534] bond_slave_0: entered allmulticast mode [ 230.214247][ T8534] bond_slave_1: entered allmulticast mode [ 230.235576][ T7275] usb 5-1: device descriptor read/64, error -71 [ 230.248259][ T8534] team0: Port device bond0 added [ 230.475280][ T7275] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 230.514926][ T25] usb 1-1: new full-speed USB device number 48 using dummy_hcd [ 230.605650][ T7275] usb 5-1: device descriptor read/64, error -71 [ 230.676495][ T25] usb 1-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f7.3f [ 230.680118][ T25] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 230.680147][ T25] usb 1-1: config 0 has no interface number 0 [ 230.680196][ T25] usb 1-1: config 0 interface 2 altsetting 2 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 230.680223][ T25] usb 1-1: config 0 interface 2 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 230.680247][ T25] usb 1-1: config 0 interface 2 altsetting 2 endpoint 0x82 has invalid maxpacket 192, setting to 64 [ 230.680272][ T25] usb 1-1: config 0 interface 2 has no altsetting 0 [ 230.682251][ T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.682277][ T25] usb 1-1: Product: syz [ 230.682292][ T25] usb 1-1: Manufacturer: syz [ 230.682307][ T25] usb 1-1: SerialNumber: syz [ 230.719564][ T7275] usb usb5-port1: attempt power cycle [ 230.794050][ T25] usb 1-1: config 0 descriptor?? [ 230.801766][ T8534] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 230.801901][ T8534] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 230.822809][ T25] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 231.037150][ T31] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 231.064944][ T7275] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 231.090558][ T7275] usb 5-1: device descriptor read/8, error -71 [ 231.118383][ T6092] usb 1-1: USB disconnect, device number 48 [ 231.184833][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 231.187589][ T31] usb 4-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 231.190695][ T31] usb 4-1: config 0 has an invalid interface number: 10 but max is 0 [ 231.190724][ T31] usb 4-1: config 0 has no interface number 0 [ 231.190758][ T31] usb 4-1: config 0 interface 10 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 231.190784][ T31] usb 4-1: config 0 interface 10 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 231.190805][ T31] usb 4-1: config 0 interface 10 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 231.190844][ T31] usb 4-1: config 0 interface 10 has no altsetting 0 [ 231.192844][ T31] usb 4-1: New USB device strings: Mfr=93, Product=0, SerialNumber=0 [ 231.192869][ T31] usb 4-1: Manufacturer: syz [ 231.218476][ T8556] netlink: 8 bytes leftover after parsing attributes in process `syz.2.898'. [ 231.300973][ T31] usb 4-1: config 0 descriptor?? [ 231.326079][ T7275] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 231.349873][ T7275] usb 5-1: device descriptor read/8, error -71 [ 231.455191][ T7275] usb usb5-port1: unable to enumerate USB device [ 231.509966][ T8552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 231.510633][ T8552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 231.514930][ T32] audit: type=1326 audit(1790727927.707:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8551 comm="syz.3.897" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 231.514983][ T32] audit: type=1326 audit(1790727927.707:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8551 comm="syz.3.897" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 231.516032][ T32] audit: type=1326 audit(1790727927.717:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8551 comm="syz.3.897" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 231.516077][ T32] audit: type=1326 audit(1790727927.717:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8551 comm="syz.3.897" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 231.516115][ T32] audit: type=1326 audit(1790727927.717:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8551 comm="syz.3.897" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 231.516372][ T32] audit: type=1326 audit(1790727927.717:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8551 comm="syz.3.897" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 231.516646][ T32] audit: type=1326 audit(1790727927.717:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8551 comm="syz.3.897" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 231.517293][ T32] audit: type=1326 audit(1790727927.717:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8551 comm="syz.3.897" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 231.517516][ T32] audit: type=1326 audit(1790727927.717:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8551 comm="syz.3.897" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 231.736898][ T7275] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 231.886732][ T7275] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 231.889560][ T7275] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 231.889585][ T7275] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 231.890768][ T7275] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 231.890793][ T7275] usb 3-1: SerialNumber: syz [ 232.057951][ T31] usbhid 4-1:0.10: can't add hid device: -71 [ 232.058056][ T31] usbhid 4-1:0.10: probe with driver usbhid failed with error -71 [ 232.060738][ T31] usb 4-1: USB disconnect, device number 59 [ 232.084974][ T6092] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 232.117813][ T8559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.123503][ T8559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.236034][ T6092] usb 1-1: Using ep0 maxpacket: 8 [ 232.236766][ T6092] usb 1-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=99.1a [ 232.237870][ T6092] usb 1-1: config 0 has an invalid interface number: 239 but max is 0 [ 232.237895][ T6092] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 232.237906][ T6092] usb 1-1: config 0 has no interface number 0 [ 232.237930][ T6092] usb 1-1: config 0 interface 239 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 232.237941][ T6092] usb 1-1: config 0 interface 239 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 232.244347][ T6092] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.244364][ T6092] usb 1-1: Product: syz [ 232.244373][ T6092] usb 1-1: Manufacturer: syz [ 232.244380][ T6092] usb 1-1: SerialNumber: syz [ 232.261153][ T6092] usb 1-1: config 0 descriptor?? [ 232.376373][ T8579] netlink: 64 bytes leftover after parsing attributes in process `syz.3.906'. [ 232.644085][ T8593] netlink: 312 bytes leftover after parsing attributes in process `syz.1.907'. [ 232.657028][ T8593] netlink: 1 bytes leftover after parsing attributes in process `syz.1.907'. [ 232.664717][ T8593] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 232.917676][ T6092] ath6kl: Failed to submit usb control message: -71 [ 232.917729][ T6092] ath6kl: unable to send the bmi data to the device: -71 [ 232.917744][ T6092] ath6kl: Unable to send get target info: -71 [ 232.919447][ T6092] ath6kl: Failed to init ath6kl core: -71 [ 232.920927][ T6092] ath6kl_usb 1-1:0.239: probe with driver ath6kl_usb failed with error -71 [ 232.942994][ T6092] usb 1-1: USB disconnect, device number 49 [ 232.990787][ T8596] netlink: 64 bytes leftover after parsing attributes in process `syz.4.908'. [ 233.344994][ T5679] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 233.471342][ T8593] nvme nvme0: failed to connect socket: -512 [ 233.497306][ T5679] usb 4-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 233.498672][ T5679] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 233.498703][ T5679] usb 4-1: config 0 interface 0 has no altsetting 0 [ 233.498755][ T5679] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.503655][ T5679] usb 4-1: config 0 descriptor?? [ 233.506334][ T8601] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 233.832843][ T8601] netlink: 8 bytes leftover after parsing attributes in process `syz.3.909'. [ 233.852254][ T8609] netlink: 'syz.1.912': attribute type 2 has an invalid length. [ 233.868987][ T8613] netlink: 'syz.1.912': attribute type 2 has an invalid length. [ 234.014893][ T31] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 234.021753][ T8616] xt_CT: No such helper "pptp" [ 234.089052][ T5679] razer 0003:1532:010D.0009: unknown main item tag 0x0 [ 234.089111][ T5679] razer 0003:1532:010D.0009: unknown main item tag 0x0 [ 234.089139][ T5679] razer 0003:1532:010D.0009: unknown main item tag 0x0 [ 234.089166][ T5679] razer 0003:1532:010D.0009: unknown main item tag 0x0 [ 234.089199][ T5679] razer 0003:1532:010D.0009: unknown main item tag 0x0 [ 234.091003][ T5679] razer 0003:1532:010D.0009: unknown main item tag 0x0 [ 234.091034][ T5679] razer 0003:1532:010D.0009: unknown main item tag 0x0 [ 234.091676][ T5679] razer 0003:1532:010D.0009: unknown main item tag 0x0 [ 234.091707][ T5679] razer 0003:1532:010D.0009: unknown main item tag 0x0 [ 234.091733][ T5679] razer 0003:1532:010D.0009: unknown main item tag 0x0 [ 234.110602][ T5679] razer 0003:1532:010D.0009: unexpected long global item [ 234.112666][ T5679] razer 0003:1532:010D.0009: probe with driver razer failed with error -22 [ 234.204875][ T31] usb 5-1: Using ep0 maxpacket: 32 [ 234.212828][ T31] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 234.232955][ T31] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 234.232991][ T31] usb 5-1: config 0 has no interface number 0 [ 234.251417][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.251440][ T31] usb 5-1: Product: syz [ 234.251459][ T31] usb 5-1: Manufacturer: syz [ 234.251485][ T31] usb 5-1: SerialNumber: syz [ 234.279499][ T31] usb 5-1: config 0 descriptor?? [ 234.282747][ T31] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 234.373360][ T6092] usb 4-1: USB disconnect, device number 60 [ 234.437604][ T8621] fuse: Bad value for 'fd' [ 234.486038][ T8610] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.487329][ T8610] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.514886][ T31] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 234.524560][ T31] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 234.570845][ T7275] usb 3-1: invalid UAC_HEADER (v1) [ 234.755816][ T7275] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 234.762753][ T7275] usb 3-1: USB disconnect, device number 43 [ 234.770140][ T8625] netlink: 28 bytes leftover after parsing attributes in process `syz.0.917'. [ 234.774166][ T8625] netlink: 8 bytes leftover after parsing attributes in process `syz.0.917'. [ 234.821879][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 234.958468][ T8630] FAULT_INJECTION: forcing a failure. [ 234.958468][ T8630] name failslab, interval 1, probability 0, space 0, times 0 [ 234.958503][ T8630] CPU: 0 UID: 0 PID: 8630 Comm: syz.0.919 Tainted: G L syzkaller #0 PREEMPT(full) [ 234.958528][ T8630] Tainted: [L]=SOFTLOCKUP [ 234.958534][ T8630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 234.958561][ T8630] Call Trace: [ 234.958570][ T8630] [ 234.958576][ T8630] dump_stack_lvl+0xe8/0x150 [ 234.958607][ T8630] should_fail_ex+0x410/0x560 [ 234.958634][ T8630] should_failslab+0xa8/0x100 [ 234.958661][ T8630] __kvmalloc_node_noprof+0x176/0x820 [ 234.958691][ T8630] ? do_ipt_set_ctl+0x962/0xe20 [ 234.958717][ T8630] ? do_sock_setsockopt+0x17c/0x1b0 [ 234.958741][ T8630] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 234.958765][ T8630] ? do_syscall_64+0x166/0x520 [ 234.958793][ T8630] ? translate_table+0x193/0x1f80 [ 234.958814][ T8630] ? translate_table+0x193/0x1f80 [ 234.958845][ T8630] translate_table+0x193/0x1f80 [ 234.958890][ T8630] ? __pfx_translate_table+0x10/0x10 [ 234.958913][ T8630] ? lock_acquire+0x115/0x350 [ 234.958952][ T8630] ? _copy_from_user+0x94/0xb0 [ 234.958984][ T8630] do_ipt_set_ctl+0xa53/0xe20 [ 234.959016][ T8630] ? rcu_is_watching+0x16/0xb0 [ 234.959042][ T8630] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 234.959082][ T8630] ? __mutex_unlock_slowpath+0x731/0x900 [ 234.959115][ T8630] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 234.959154][ T8630] nf_setsockopt+0x26f/0x290 [ 234.959183][ T8630] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 234.959209][ T8630] do_sock_setsockopt+0x17c/0x1b0 [ 234.959240][ T8630] __x64_sys_setsockopt+0x13d/0x1b0 [ 234.959272][ T8630] do_syscall_64+0x166/0x520 [ 234.959297][ T8630] ? trace_irq_disable+0x3b/0x140 [ 234.959317][ T8630] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.959337][ T8630] ? clear_bhb_loop+0x70/0xc0 [ 234.959360][ T8630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.959380][ T8630] RIP: 0033:0x7fb51879e159 [ 234.959398][ T8630] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 234.959414][ T8630] RSP: 002b:00007fb51968a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 234.959435][ T8630] RAX: ffffffffffffffda RBX: 00007fb518a25fa0 RCX: 00007fb51879e159 [ 234.959448][ T8630] RDX: 0000000000000040 RSI: 0004000000000000 RDI: 0000000000000003 [ 234.959460][ T8630] RBP: 00007fb51968a090 R08: 0000000000000260 R09: 0000000000000000 [ 234.959472][ T8630] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 234.959484][ T8630] R13: 00007fb518a26038 R14: 00007fb518a25fa0 R15: 00007fb518b4fa48 [ 234.959512][ T8630] [ 235.173945][ T8635] netlink: 40 bytes leftover after parsing attributes in process `syz.0.922'. [ 235.380924][ T8639] cifs: Unknown parameter 'f,' [ 235.409102][ T8646] loop4: detected capacity change from 0 to 2640 [ 235.410800][ T8646] Buffer I/O error on dev loop4, logical block 0, lost async page write [ 235.437288][ T5631] Buffer I/O error on dev loop4, logical block 3, async page read [ 235.525959][ T8649] xt_policy: output policy not valid in PREROUTING and INPUT [ 235.577146][ T6082] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 235.734990][ T6082] usb 2-1: Using ep0 maxpacket: 32 [ 235.739088][ T6082] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 235.740236][ T6082] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.742702][ T6082] usb 2-1: config 0 descriptor?? [ 235.963774][ T6082] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 235.972995][ T6082] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 235.974023][ T6082] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 235.974107][ T6082] usb 2-1: media controller created [ 236.008268][ T6082] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 236.132675][ T8639] workqueue: Failed to create a rescuer kthread for wq "dio/fuse": -EINTR [ 236.169620][ T6082] az6027: usb out operation failed. (-71) [ 236.170072][ T6082] az6027: usb out operation failed. (-71) [ 236.170085][ T6082] stb0899_attach: Driver disabled by Kconfig [ 236.170095][ T6082] az6027: no front-end attached [ 236.170095][ T6082] [ 236.170499][ T6082] az6027: usb out operation failed. (-71) [ 236.170511][ T6082] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 236.226912][ T6082] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input43 [ 236.233158][ T6082] dvb-usb: schedule remote query interval to 400 msecs. [ 236.233204][ T6082] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 236.275315][ T6082] usb 2-1: USB disconnect, device number 41 [ 236.338257][ T8659] bridge0: port 3(veth0) entered blocking state [ 236.338364][ T8659] bridge0: port 3(veth0) entered disabled state [ 236.338531][ T8659] veth0: entered allmulticast mode [ 236.344632][ T8659] veth0: entered promiscuous mode [ 236.348206][ T8659] bridge0: port 3(veth0) entered blocking state [ 236.348338][ T8659] bridge0: port 3(veth0) entered forwarding state [ 236.409757][ T6082] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 236.519421][ T8662] netlink: 28 bytes leftover after parsing attributes in process `syz.2.930'. [ 236.658911][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 236.659422][ T7275] usb 5-1: USB disconnect, device number 55 [ 236.674816][ T7275] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 236.756934][ T8672] FAULT_INJECTION: forcing a failure. [ 236.756934][ T8672] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 236.756970][ T8672] CPU: 1 UID: 0 PID: 8672 Comm: syz.0.933 Tainted: G L syzkaller #0 PREEMPT(full) [ 236.756998][ T8672] Tainted: [L]=SOFTLOCKUP [ 236.757005][ T8672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 236.757016][ T8672] Call Trace: [ 236.757024][ T8672] [ 236.757032][ T8672] dump_stack_lvl+0xe8/0x150 [ 236.757065][ T8672] should_fail_ex+0x410/0x560 [ 236.757093][ T8672] _copy_from_user+0x2d/0xb0 [ 236.757120][ T8672] kstrtouint_from_user+0xd6/0x180 [ 236.757144][ T8672] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 236.757175][ T8672] ? lock_acquire+0x115/0x350 [ 236.757201][ T8672] proc_fail_nth_write+0x8e/0x210 [ 236.757223][ T8672] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 236.757252][ T8672] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 236.757271][ T8672] vfs_write+0x296/0xba0 [ 236.757298][ T8672] ? __pfx_vfs_write+0x10/0x10 [ 236.757318][ T8672] ? __fget_files+0x2a/0x420 [ 236.757348][ T8672] ? __fget_files+0x3a2/0x420 [ 236.757370][ T8672] ? __fget_files+0x2a/0x420 [ 236.757406][ T8672] ksys_write+0x150/0x270 [ 236.757430][ T8672] ? __pfx_ksys_write+0x10/0x10 [ 236.757466][ T8672] do_syscall_64+0x166/0x520 [ 236.757492][ T8672] ? trace_irq_disable+0x3b/0x140 [ 236.757512][ T8672] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 236.757532][ T8672] ? clear_bhb_loop+0x70/0xc0 [ 236.757556][ T8672] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 236.757575][ T8672] RIP: 0033:0x7fb51875e98e [ 236.757593][ T8672] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 236.757608][ T8672] RSP: 002b:00007fb519689fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 236.757629][ T8672] RAX: ffffffffffffffda RBX: 00007fb51968a6c0 RCX: 00007fb51875e98e [ 236.757643][ T8672] RDX: 0000000000000001 RSI: 00007fb51968a0a0 RDI: 0000000000000005 [ 236.757656][ T8672] RBP: 00007fb51968a090 R08: 0000000000000000 R09: 0000000000000000 [ 236.757668][ T8672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 236.757679][ T8672] R13: 00007fb518a26038 R14: 00007fb518a25fa0 R15: 00007fb518b4fa48 [ 236.757710][ T8672] [ 236.801434][ T7275] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 236.849271][ T7275] quatech2 5-1:0.51: device disconnected [ 237.039207][ T8678] fuse: Invalid rootmode [ 237.066030][ T8677] FAULT_INJECTION: forcing a failure. [ 237.066030][ T8677] name failslab, interval 1, probability 0, space 0, times 0 [ 237.066066][ T8677] CPU: 0 UID: 0 PID: 8677 Comm: syz.1.935 Tainted: G L syzkaller #0 PREEMPT(full) [ 237.066091][ T8677] Tainted: [L]=SOFTLOCKUP [ 237.066099][ T8677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 237.066110][ T8677] Call Trace: [ 237.066118][ T8677] [ 237.066126][ T8677] dump_stack_lvl+0xe8/0x150 [ 237.066160][ T8677] should_fail_ex+0x410/0x560 [ 237.066189][ T8677] should_failslab+0xa8/0x100 [ 237.066217][ T8677] __kmalloc_cache_noprof+0xa3/0x600 [ 237.066240][ T8677] ? __kmalloc_noprof+0x1ab/0x720 [ 237.066258][ T8677] ? apply_wqattrs_prepare+0x124/0xdc0 [ 237.066283][ T8677] ? apply_wqattrs_prepare+0x124/0xdc0 [ 237.066315][ T8677] apply_wqattrs_prepare+0x124/0xdc0 [ 237.066340][ T8677] ? pcpu_memcg_post_alloc_hook+0x8c/0x630 [ 237.066392][ T8677] ? pcpu_alloc_noprof+0x100f/0x1900 [ 237.066418][ T8677] ? pcpu_alloc_noprof+0x1036/0x1900 [ 237.066455][ T8677] __alloc_workqueue+0x11be/0x1fe0 [ 237.066501][ T8677] alloc_workqueue_noprof+0xe3/0x210 [ 237.066525][ T8677] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 237.066550][ T8677] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 237.066577][ T8677] nci_register_device+0x5c9/0xa00 [ 237.066616][ T8677] ? __pfx_nci_register_device+0x10/0x10 [ 237.066642][ T8677] ? __raw_spin_lock_init+0x45/0x100 [ 237.066672][ T8677] ? __raw_spin_lock_init+0x45/0x100 [ 237.066706][ T8677] ? __init_waitqueue_head+0xa8/0x150 [ 237.066737][ T8677] virtual_ncidev_open+0x129/0x1a0 [ 237.066766][ T8677] ? __pfx_virtual_ncidev_open+0x10/0x10 [ 237.066792][ T8677] misc_open+0x2d5/0x350 [ 237.066814][ T8677] chrdev_open+0x4d9/0x600 [ 237.066841][ T8677] ? __pfx_chrdev_open+0x10/0x10 [ 237.066865][ T8677] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 237.066892][ T8677] ? __pfx_chrdev_open+0x10/0x10 [ 237.066914][ T8677] do_dentry_open+0x816/0x1380 [ 237.066951][ T8677] vfs_open+0x3b/0x340 [ 237.066971][ T8677] ? path_openat+0x1428/0x1d60 [ 237.066994][ T8677] path_openat+0x1443/0x1d60 [ 237.067036][ T8677] do_file_open+0x23e/0x4a0 [ 237.067063][ T8677] ? __pfx_do_file_open+0x10/0x10 [ 237.067107][ T8677] ? _raw_spin_unlock+0x28/0x50 [ 237.067130][ T8677] ? alloc_fd+0x651/0x6c0 [ 237.067168][ T8677] do_sys_openat2+0x115/0x200 [ 237.067197][ T8677] ? __pfx_do_sys_openat2+0x10/0x10 [ 237.067224][ T8677] ? ksys_write+0x242/0x270 [ 237.067245][ T8677] ? __pfx_ksys_write+0x10/0x10 [ 237.067269][ T8677] __x64_sys_openat+0x138/0x170 [ 237.067303][ T8677] do_syscall_64+0x166/0x520 [ 237.067328][ T8677] ? trace_irq_disable+0x3b/0x140 [ 237.067348][ T8677] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 237.067369][ T8677] ? clear_bhb_loop+0x70/0xc0 [ 237.067394][ T8677] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 237.067414][ T8677] RIP: 0033:0x7fcb7619e159 [ 237.067433][ T8677] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 237.067451][ T8677] RSP: 002b:00007fcb7706d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 237.067480][ T8677] RAX: ffffffffffffffda RBX: 00007fcb76425fa0 RCX: 00007fcb7619e159 [ 237.067495][ T8677] RDX: 0000000000000002 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 237.067509][ T8677] RBP: 00007fcb7706d090 R08: 0000000000000000 R09: 0000000000000000 [ 237.067522][ T8677] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 237.067534][ T8677] R13: 00007fcb76426038 R14: 00007fcb76425fa0 R15: 00007fcb7654fa48 [ 237.067566][ T8677] [ 237.554359][ T8689] syzkaller0: entered promiscuous mode [ 237.554375][ T8689] syzkaller0: entered allmulticast mode [ 237.806887][ T8698] netlink: 28 bytes leftover after parsing attributes in process `syz.0.942'. [ 237.967907][ T5679] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 237.996965][ T8705] netlink: 8 bytes leftover after parsing attributes in process `syz.4.945'. [ 238.114859][ T5679] usb 2-1: Using ep0 maxpacket: 32 [ 238.115602][ T5679] usb 2-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 238.116609][ T5679] usb 2-1: config 0 has an invalid interface number: 10 but max is 0 [ 238.116635][ T5679] usb 2-1: config 0 has no interface number 0 [ 238.116689][ T5679] usb 2-1: config 0 interface 10 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 238.116717][ T5679] usb 2-1: config 0 interface 10 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 238.116741][ T5679] usb 2-1: config 0 interface 10 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 238.116769][ T5679] usb 2-1: config 0 interface 10 has no altsetting 0 [ 238.117749][ T5679] usb 2-1: New USB device strings: Mfr=93, Product=0, SerialNumber=0 [ 238.117774][ T5679] usb 2-1: Manufacturer: syz [ 238.130802][ T5679] usb 2-1: config 0 descriptor?? [ 238.186432][ T7275] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 238.279824][ T8711] FAULT_INJECTION: forcing a failure. [ 238.279824][ T8711] name failslab, interval 1, probability 0, space 0, times 0 [ 238.279875][ T8711] CPU: 0 UID: 0 PID: 8711 Comm: syz.4.947 Tainted: G L syzkaller #0 PREEMPT(full) [ 238.279905][ T8711] Tainted: [L]=SOFTLOCKUP [ 238.279914][ T8711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 238.279926][ T8711] Call Trace: [ 238.279934][ T8711] [ 238.279944][ T8711] dump_stack_lvl+0xe8/0x150 [ 238.279979][ T8711] should_fail_ex+0x410/0x560 [ 238.280010][ T8711] should_failslab+0xa8/0x100 [ 238.280040][ T8711] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 238.280065][ T8711] ? __kasan_kmalloc+0x93/0xb0 [ 238.280090][ T8711] ? snd_timer_instance_new+0x6a/0x260 [ 238.280120][ T8711] ? snd_timer_instance_new+0x6a/0x260 [ 238.280150][ T8711] ? __kmalloc_cache_noprof+0x14d/0x600 [ 238.280178][ T8711] kstrdup+0x42/0x100 [ 238.280204][ T8711] snd_timer_instance_new+0x6a/0x260 [ 238.280236][ T8711] snd_seq_timer_open+0x23e/0x620 [ 238.280270][ T8711] ? __pfx_snd_seq_timer_open+0x10/0x10 [ 238.280309][ T8711] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 238.280341][ T8711] snd_seq_queue_alloc+0x3ba/0x740 [ 238.280370][ T8711] snd_seq_ioctl_create_queue+0x7f/0x3c0 [ 238.280405][ T8711] snd_seq_oss_open+0x657/0xf40 [ 238.280441][ T8711] ? __pfx_snd_seq_oss_open+0x10/0x10 [ 238.280504][ T8711] ? rcu_is_watching+0x16/0xb0 [ 238.280532][ T8711] ? trace_contention_end+0x3d/0x140 [ 238.280579][ T8711] ? __pfx___mutex_lock+0x10/0x10 [ 238.280614][ T8711] ? __pfx_snd_seq_oss_event_input+0x10/0x10 [ 238.280633][ T8711] ? __pfx_free_devinfo+0x10/0x10 [ 238.280662][ T8711] ? do_raw_spin_unlock+0xf5/0x200 [ 238.280696][ T8711] ? soundcore_open+0x2da/0x490 [ 238.280730][ T8711] odev_open+0x67/0xa0 [ 238.280761][ T8711] chrdev_open+0x4d9/0x600 [ 238.280789][ T8711] ? __pfx_chrdev_open+0x10/0x10 [ 238.280813][ T8711] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 238.280851][ T8711] ? __pfx_chrdev_open+0x10/0x10 [ 238.280875][ T8711] do_dentry_open+0x816/0x1380 [ 238.280912][ T8711] vfs_open+0x3b/0x340 [ 238.280936][ T8711] ? path_openat+0x1428/0x1d60 [ 238.280961][ T8711] path_openat+0x1443/0x1d60 [ 238.281002][ T8711] do_file_open+0x23e/0x4a0 [ 238.281029][ T8711] ? __pfx_do_file_open+0x10/0x10 [ 238.281074][ T8711] ? _raw_spin_unlock+0x28/0x50 [ 238.281097][ T8711] ? alloc_fd+0x651/0x6c0 [ 238.281134][ T8711] do_sys_openat2+0x115/0x200 [ 238.281165][ T8711] ? __pfx_do_sys_openat2+0x10/0x10 [ 238.281193][ T8711] ? ksys_write+0x1fc/0x270 [ 238.281216][ T8711] ? __pfx_ksys_write+0x10/0x10 [ 238.281240][ T8711] __x64_sys_open+0x11e/0x150 [ 238.281272][ T8711] do_syscall_64+0x166/0x520 [ 238.281300][ T8711] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.281321][ T8711] ? clear_bhb_loop+0x70/0xc0 [ 238.281346][ T8711] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.281367][ T8711] RIP: 0033:0x7f350979e159 [ 238.281387][ T8711] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 238.281405][ T8711] RSP: 002b:00007f350a673028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 238.281428][ T8711] RAX: ffffffffffffffda RBX: 00007f3509a25fa0 RCX: 00007f350979e159 [ 238.281444][ T8711] RDX: 0000000000000110 RSI: 0000000000101000 RDI: 0000200000000000 [ 238.281457][ T8711] RBP: 00007f350a673090 R08: 0000000000000000 R09: 0000000000000000 [ 238.281470][ T8711] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 238.281483][ T8711] R13: 00007f3509a26038 R14: 00007f3509a25fa0 R15: 00007f3509b4fa48 [ 238.281516][ T8711] [ 238.335449][ T7275] usb 1-1: Using ep0 maxpacket: 8 [ 238.342053][ T7275] usb 1-1: unable to get BOS descriptor or descriptor too short [ 238.342101][ T7275] usb 1-1: New USB device found, idVendor=0c45, idProduct=628f, bcdDevice=4d.e2 [ 238.351290][ T7275] usb 1-1: config 5 has an invalid interface number: 198 but max is 1 [ 238.351320][ T7275] usb 1-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 238.351361][ T7275] usb 1-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 238.351393][ T7275] usb 1-1: config 5 has no interface number 0 [ 238.381600][ T8695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.386459][ T8695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 238.394558][ T7275] usb 1-1: New USB device strings: Mfr=77, Product=47, SerialNumber=112 [ 238.394610][ T7275] usb 1-1: Product: syz [ 238.394624][ T7275] usb 1-1: Manufacturer: syz [ 238.394638][ T7275] usb 1-1: SerialNumber: syz [ 238.409842][ T6092] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 238.437784][ T32] kauditd_printk_skb: 31 callbacks suppressed [ 238.437831][ T32] audit: type=1326 audit(1790727934.627:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8694 comm="syz.1.941" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 238.437876][ T32] audit: type=1326 audit(1790727934.627:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8694 comm="syz.1.941" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 238.461108][ T32] audit: type=1326 audit(1790727934.667:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8694 comm="syz.1.941" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 238.461215][ T32] audit: type=1326 audit(1790727934.667:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8694 comm="syz.1.941" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 238.461253][ T32] audit: type=1326 audit(1790727934.667:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8694 comm="syz.1.941" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 238.473962][ T32] audit: type=1326 audit(1790727934.667:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8694 comm="syz.1.941" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 238.474038][ T32] audit: type=1326 audit(1790727934.667:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8694 comm="syz.1.941" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 238.474076][ T32] audit: type=1326 audit(1790727934.667:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8694 comm="syz.1.941" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 238.481362][ T32] audit: type=1326 audit(1790727934.677:460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8694 comm="syz.1.941" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 238.481412][ T32] audit: type=1326 audit(1790727934.677:461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8694 comm="syz.1.941" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 238.546096][ T6092] usb 3-1: device descriptor read/64, error -71 [ 238.653877][ T7275] gspca_main: gspca_sn9c20x-2.14.0 probing 0c45:628f [ 238.657671][ T7275] gspca_sn9c20x: Write register 1000 failed -71 [ 238.657690][ T7275] gspca_sn9c20x: Device initialization failed [ 238.657790][ T7275] gspca_sn9c20x 1-1:5.198: probe with driver gspca_sn9c20x failed with error -71 [ 238.669580][ T7275] usb 1-1: USB disconnect, device number 50 [ 238.785003][ T6092] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 238.915076][ T6092] usb 3-1: device descriptor read/64, error -71 [ 239.011441][ T8717] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 239.025888][ T6092] usb usb3-port1: attempt power cycle [ 239.168625][ T5679] usbhid 2-1:0.10: can't add hid device: -71 [ 239.169479][ T5679] usbhid 2-1:0.10: probe with driver usbhid failed with error -71 [ 239.192275][ T5679] usb 2-1: USB disconnect, device number 42 [ 239.365681][ T6092] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 239.388108][ T6092] usb 3-1: device descriptor read/8, error -71 [ 239.457678][ T8727] netlink: 28 bytes leftover after parsing attributes in process `syz.3.953'. [ 239.612682][ T8733] fuse: Invalid rootmode [ 239.616281][ T7273] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 239.625435][ T6092] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 239.646620][ T6092] usb 3-1: device descriptor read/8, error -71 [ 239.670951][ T8735] netlink: 8 bytes leftover after parsing attributes in process `syz.3.957'. [ 239.745308][ T7273] usb 1-1: device descriptor read/64, error -71 [ 239.758061][ T6092] usb usb3-port1: unable to enumerate USB device [ 239.985168][ T7273] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 240.117047][ T7273] usb 1-1: device descriptor read/64, error -71 [ 240.225215][ T7273] usb usb1-port1: attempt power cycle [ 240.565238][ T7273] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 240.585709][ T7273] usb 1-1: device descriptor read/8, error -71 [ 240.830684][ T7273] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 240.834442][ T8751] netlink: 8 bytes leftover after parsing attributes in process `syz.1.961'. [ 240.846507][ T7273] usb 1-1: device descriptor read/8, error -71 [ 240.955891][ T7273] usb usb1-port1: unable to enumerate USB device [ 241.264914][ T6083] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 241.295058][ T7273] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 241.364878][ T31] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 241.425463][ T6083] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 241.426290][ T6083] usb 5-1: config 1 interface 0 altsetting 225 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 241.426317][ T6083] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 241.426329][ T6083] usb 5-1: config 1 interface 0 has no altsetting 0 [ 241.426347][ T6083] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.432714][ T6083] cdc_acm 5-1:1.0: probe with driver cdc_acm failed with error -22 [ 241.445145][ T7273] usb 4-1: Using ep0 maxpacket: 32 [ 241.447556][ T7273] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 241.448593][ T7273] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 241.448619][ T7273] usb 4-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 241.448639][ T7273] usb 4-1: config 0 interface 0 has no altsetting 0 [ 241.450542][ T7273] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.450563][ T7273] usb 4-1: Product: syz [ 241.450576][ T7273] usb 4-1: Manufacturer: syz [ 241.450590][ T7273] usb 4-1: SerialNumber: syz [ 241.456194][ T7273] usb 4-1: config 0 descriptor?? [ 241.525762][ T31] usb 2-1: device descriptor read/64, error -71 [ 241.545035][ T6095] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 241.637925][ T8757] binder: 8756:8757 ioctl c0306201 200000000080 returned -14 [ 241.640775][ T8757] binder: 8756:8757 ioctl c0306201 2000000003c0 returned -14 [ 241.662191][ T6083] usb 5-1: string descriptor 0 read error: -71 [ 241.678847][ T6095] usb 3-1: device descriptor read/64, error -71 [ 241.681589][ T6083] usb 5-1: USB disconnect, device number 56 [ 241.764855][ T31] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 241.877987][ T8755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.878463][ T8755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 241.880922][ T7273] gs_usb 4-1:0.0: Configuring for 1 interfaces [ 241.910070][ T31] usb 2-1: device descriptor read/64, error -71 [ 241.914911][ T6095] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 242.015138][ T31] usb usb2-port1: attempt power cycle [ 242.044854][ T6095] usb 3-1: device descriptor read/64, error -71 [ 242.081590][ T7273] gs_usb 4-1:0.0: Couldn't get bit timing const for channel 0 (-EREMOTEIO) [ 242.081629][ T7273] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -121 [ 242.155201][ T6095] usb usb3-port1: attempt power cycle [ 242.258812][ T8766] netlink: 28 bytes leftover after parsing attributes in process `syz.4.965'. [ 242.287038][ T6083] usb 4-1: USB disconnect, device number 61 [ 242.374971][ T31] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 242.395740][ T31] usb 2-1: device descriptor read/8, error -71 [ 242.518479][ T6095] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 242.604003][ T6095] usb 3-1: device descriptor read/8, error -71 [ 242.644911][ T31] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 242.665595][ T31] usb 2-1: device descriptor read/8, error -71 [ 242.764986][ T6083] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 242.775177][ T31] usb usb2-port1: unable to enumerate USB device [ 242.921632][ T6095] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 242.925519][ T6083] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 242.926067][ T6083] usb 5-1: config 0 has no interfaces? [ 242.932334][ T6083] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 242.932362][ T6083] usb 5-1: Product: syz [ 242.932376][ T6083] usb 5-1: Manufacturer: syz [ 242.932401][ T6083] usb 5-1: SerialNumber: syz [ 242.978429][ T6083] usb 5-1: config 0 descriptor?? [ 243.021477][ T6095] usb 3-1: device descriptor read/8, error -71 [ 243.161912][ T6095] usb usb3-port1: unable to enumerate USB device [ 243.656117][ T6083] usb 1-1: new full-speed USB device number 55 using dummy_hcd [ 243.805846][ T6083] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 243.807044][ T6083] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 243.807074][ T6083] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 243.807115][ T6083] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.054657][ T6083] usb 1-1: usb_control_msg returned -32 [ 244.054708][ T6083] usbtmc 1-1:16.0: can't read capabilities [ 244.549482][ T8790] netlink: 'syz.0.973': attribute type 1 has an invalid length. [ 245.234585][ T6083] usb 5-1: USB disconnect, device number 57 [ 245.511387][ T8797] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 247.871045][ T6083] usb 1-1: USB disconnect, device number 55 [ 247.947627][ T32] kauditd_printk_skb: 31 callbacks suppressed [ 247.947651][ T32] audit: type=1326 audit(1790727944.127:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8804 comm="syz.1.978" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 247.999445][ T32] audit: type=1326 audit(1790727944.197:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8804 comm="syz.1.978" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 248.040202][ T32] audit: type=1326 audit(1790727944.237:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8804 comm="syz.1.978" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 248.040250][ T32] audit: type=1326 audit(1790727944.237:496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8804 comm="syz.1.978" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 248.040289][ T32] audit: type=1326 audit(1790727944.237:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8804 comm="syz.1.978" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 248.044255][ T32] audit: type=1326 audit(1790727944.237:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8804 comm="syz.1.978" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 248.044300][ T32] audit: type=1326 audit(1790727944.237:499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8804 comm="syz.1.978" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 248.044339][ T32] audit: type=1326 audit(1790727944.237:500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8804 comm="syz.1.978" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 248.206972][ T8805] netlink: 28 bytes leftover after parsing attributes in process `syz.4.976'. [ 248.267814][ T32] audit: type=1326 audit(1790727944.467:501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8804 comm="syz.1.978" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 248.267912][ T32] audit: type=1326 audit(1790727944.467:502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8804 comm="syz.1.978" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcb7619e159 code=0x7ffc0000 [ 248.605289][ T6083] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 248.745067][ T6083] usb 4-1: device descriptor read/64, error -71 [ 248.866462][ T25] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 248.995068][ T6083] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 249.095086][ T25] usb 2-1: Using ep0 maxpacket: 32 [ 249.484972][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 249.564882][ T6083] usb 4-1: device descriptor read/64, error -71 [ 249.642910][ T25] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 249.660989][ T25] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 249.661019][ T25] usb 2-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 249.661040][ T25] usb 2-1: config 0 interface 0 has no altsetting 0 [ 249.692045][ T6083] usb usb4-port1: attempt power cycle [ 249.894847][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 249.914786][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 250.031293][ T25] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.031337][ T25] usb 2-1: Product: syz [ 250.031352][ T25] usb 2-1: Manufacturer: syz [ 250.031367][ T25] usb 2-1: SerialNumber: syz [ 250.067375][ T6083] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 250.094633][ T6083] usb 4-1: device descriptor read/8, error -71 [ 250.233739][ T8830] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 250.325101][ T6083] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 250.345527][ T6083] usb 4-1: device descriptor read/8, error -71 [ 250.465258][ T6083] usb usb4-port1: unable to enumerate USB device [ 250.561600][ T25] usb 2-1: config 0 descriptor?? [ 251.009143][ T8815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.010480][ T8815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.042984][ T25] gs_usb 2-1:0.0: Configuring for 1 interfaces [ 251.180472][ T8845] netlink: 28 bytes leftover after parsing attributes in process `syz.0.990'. [ 251.249098][ T25] gs_usb 2-1:0.0: Couldn't get bit timing const for channel 0 (-EREMOTEIO) [ 251.249240][ T25] gs_usb 2-1:0.0: probe with driver gs_usb failed with error -121 [ 251.462785][ T8847] netlink: 12 bytes leftover after parsing attributes in process `syz.0.991'. [ 251.462816][ T8847] netlink: 59 bytes leftover after parsing attributes in process `syz.0.991'. [ 251.494251][ T6081] usb 2-1: USB disconnect, device number 47 [ 251.737979][ T8854] netlink: 8 bytes leftover after parsing attributes in process `syz.0.994'. [ 252.015049][ T6083] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 252.707966][ T6083] usb 4-1: Using ep0 maxpacket: 32 [ 252.724091][ T6083] usb 4-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 252.880341][ T6083] usb 4-1: config 0 has an invalid interface number: 10 but max is 0 [ 252.880384][ T6083] usb 4-1: config 0 has no interface number 0 [ 252.880426][ T6083] usb 4-1: config 0 interface 10 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 252.880451][ T6083] usb 4-1: config 0 interface 10 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 252.880473][ T6083] usb 4-1: config 0 interface 10 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 252.880499][ T6083] usb 4-1: config 0 interface 10 has no altsetting 0 [ 252.893516][ T6083] usb 4-1: New USB device strings: Mfr=93, Product=0, SerialNumber=0 [ 252.893544][ T6083] usb 4-1: Manufacturer: syz [ 253.042358][ T6083] usb 4-1: config 0 descriptor?? [ 253.297546][ T8856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 253.298064][ T8856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 253.353766][ T32] kauditd_printk_skb: 1 callbacks suppressed [ 253.353785][ T32] audit: type=1326 audit(1790727949.547:504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8855 comm="syz.3.995" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 253.392264][ T32] audit: type=1326 audit(1790727949.547:505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8855 comm="syz.3.995" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 253.392344][ T32] audit: type=1326 audit(1790727949.587:506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8855 comm="syz.3.995" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 253.392384][ T32] audit: type=1326 audit(1790727949.587:507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8855 comm="syz.3.995" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 253.392422][ T32] audit: type=1326 audit(1790727949.587:508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8855 comm="syz.3.995" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 253.517528][ T32] audit: type=1326 audit(1790727949.717:509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8855 comm="syz.3.995" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 253.520389][ T32] audit: type=1326 audit(1790727949.717:510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8855 comm="syz.3.995" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 253.520979][ T32] audit: type=1326 audit(1790727949.717:511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8855 comm="syz.3.995" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 253.522605][ T32] audit: type=1326 audit(1790727949.717:512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8855 comm="syz.3.995" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 253.522674][ T32] audit: type=1326 audit(1790727949.717:513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8855 comm="syz.3.995" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 253.648053][ T0] NOHZ tick-stop error: local softirq work is pending, handler #88!!! [ 253.957964][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 254.044774][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 254.764810][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 254.834768][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 254.864764][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 255.014755][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 255.609450][ T6083] usbhid 4-1:0.10: can't add hid device: -71 [ 255.609573][ T6083] usbhid 4-1:0.10: probe with driver usbhid failed with error -71 [ 255.652474][ T6083] usb 4-1: USB disconnect, device number 66 [ 256.153862][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.153920][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.606161][ T6081] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 256.695102][ T6083] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 256.744930][ T6081] usb 4-1: device descriptor read/64, error -71 [ 256.861170][ T6083] usb 5-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 256.863301][ T6083] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 256.863347][ T6083] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.995058][ T6081] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 257.056704][ T25] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 257.150098][ T6081] usb 4-1: device descriptor read/64, error -71 [ 257.206332][ T25] usb 3-1: Using ep0 maxpacket: 16 [ 257.207070][ T25] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 257.207805][ T25] usb 3-1: config 0 has no interfaces? [ 257.211487][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.211511][ T25] usb 3-1: Product: syz [ 257.211530][ T25] usb 3-1: Manufacturer: syz [ 257.211568][ T25] usb 3-1: SerialNumber: syz [ 257.264460][ T6081] usb usb4-port1: attempt power cycle [ 257.279277][ T25] usb 3-1: config 0 descriptor?? [ 257.346242][ T8883] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 257.395337][ T6083] wacom 0003:056A:033B.000A: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 257.404469][ T6083] wacom 0003:056A:033B.000A: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.4-1/input0 [ 257.451771][ T6083] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/0003:056A:033B.000A/input/input44 [ 257.657569][ T6081] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 257.675721][ T6081] usb 4-1: device descriptor read/8, error -71 [ 257.924852][ T6081] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 257.947018][ T6081] usb 4-1: device descriptor read/8, error -71 [ 258.065545][ T6081] usb usb4-port1: unable to enumerate USB device [ 258.125707][ T6081] usb 5-1: USB disconnect, device number 58 [ 258.278755][ T8894] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1008'. [ 258.294120][ T6083] usb 2-1: new full-speed USB device number 48 using dummy_hcd [ 258.455719][ T6083] usb 2-1: New USB device found, idVendor=1b1c, idProduct=1c09, bcdDevice= 0.00 [ 258.456960][ T6083] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 258.457006][ T6083] usb 2-1: config 0 interface 0 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 258.457034][ T6083] usb 2-1: config 0 interface 0 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 258.457059][ T6083] usb 2-1: config 0 interface 0 has no altsetting 0 [ 258.457090][ T6083] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.461063][ T6083] usb 2-1: config 0 descriptor?? [ 259.448506][ T8904] sg_write: data in/out 241152/136 bytes for SCSI command 0x0-- guessing data in; [ 259.448506][ T8904] program syz.3.1010 not setting count and/or reply_len properly [ 259.482163][ T8904] FAULT_INJECTION: forcing a failure. [ 259.482163][ T8904] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 259.482233][ T8904] CPU: 1 UID: 0 PID: 8904 Comm: syz.3.1010 Tainted: G L syzkaller #0 PREEMPT(full) [ 259.482261][ T8904] Tainted: [L]=SOFTLOCKUP [ 259.482269][ T8904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 259.482281][ T8904] Call Trace: [ 259.482289][ T8904] [ 259.482297][ T8904] dump_stack_lvl+0xe8/0x150 [ 259.482330][ T8904] should_fail_ex+0x410/0x560 [ 259.482362][ T8904] _copy_from_iter+0x1d3/0x1660 [ 259.482389][ T8904] ? pfn_valid+0x125/0x4c0 [ 259.482419][ T8904] ? pfn_valid+0x446/0x4c0 [ 259.482446][ T8904] ? __pfx__copy_from_iter+0x10/0x10 [ 259.482469][ T8904] ? bvec_try_merge_page+0x1d4/0x280 [ 259.482502][ T8904] ? bio_add_page+0x2f4/0x700 [ 259.482533][ T8904] copy_page_from_iter+0x219/0x2d0 [ 259.482560][ T8904] blk_rq_map_user_iov+0xcb1/0x1840 [ 259.482600][ T8904] ? __pfx_blk_rq_map_user_iov+0x10/0x10 [ 259.482641][ T8904] ? import_ubuf+0xfb/0x1d0 [ 259.482669][ T8904] blk_rq_map_user_io+0x2ae/0x440 [ 259.482698][ T8904] ? __pfx_blk_rq_map_user_io+0x10/0x10 [ 259.482735][ T8904] ? sg_common_write+0xb2c/0x1310 [ 259.482769][ T8904] ? __mutex_unlock_slowpath+0x731/0x900 [ 259.482797][ T8904] ? alloc_pages_noprof+0x140/0x2b0 [ 259.482826][ T8904] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 259.482865][ T8904] sg_common_write+0xc73/0x1310 [ 259.482906][ T8904] ? __pfx_sg_common_write+0x10/0x10 [ 259.482939][ T8904] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 259.482963][ T8904] ? ___ratelimit+0x584/0x8e0 [ 259.482993][ T8904] sg_write+0xaf3/0xf10 [ 259.483028][ T8904] ? __pfx_sg_write+0x10/0x10 [ 259.483058][ T8904] ? __pfx_aa_file_perm+0x10/0x10 [ 259.483113][ T8904] ? bpf_lsm_file_permission+0x9/0x20 [ 259.483145][ T8904] ? security_file_permission+0x75/0x260 [ 259.483175][ T8904] ? rw_verify_area+0x203/0x4c0 [ 259.483205][ T8904] ? __pfx_sg_write+0x10/0x10 [ 259.483231][ T8904] vfs_write+0x296/0xba0 [ 259.483255][ T8904] ? __pfx_vfs_write+0x10/0x10 [ 259.483276][ T8904] ? __fget_files+0x2a/0x420 [ 259.483307][ T8904] ? __fget_files+0x2a/0x420 [ 259.483332][ T8904] ? __fget_files+0x3a2/0x420 [ 259.483358][ T8904] ? __fget_files+0x2a/0x420 [ 259.483392][ T8904] ksys_write+0x150/0x270 [ 259.483413][ T8904] ? __pfx_ksys_write+0x10/0x10 [ 259.483443][ T8904] do_syscall_64+0x166/0x520 [ 259.483468][ T8904] ? trace_irq_disable+0x3b/0x140 [ 259.483488][ T8904] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.483508][ T8904] ? clear_bhb_loop+0x70/0xc0 [ 259.483532][ T8904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.483551][ T8904] RIP: 0033:0x7f20e7b9e159 [ 259.483570][ T8904] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 259.483587][ T8904] RSP: 002b:00007f20e5df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 259.483609][ T8904] RAX: ffffffffffffffda RBX: 00007f20e7e25fa0 RCX: 00007f20e7b9e159 [ 259.483623][ T8904] RDX: 00000000000000b2 RSI: 0000200000000040 RDI: 0000000000000003 [ 259.483636][ T8904] RBP: 00007f20e5df6090 R08: 0000000000000000 R09: 0000000000000000 [ 259.483648][ T8904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 259.483660][ T8904] R13: 00007f20e7e26038 R14: 00007f20e7e25fa0 R15: 00007f20e7f4fa48 [ 259.483690][ T8904] [ 260.370053][ T6082] usb 3-1: USB disconnect, device number 52 [ 261.866724][ T6083] usbhid 2-1:0.0: can't add hid device: -71 [ 261.866832][ T6083] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 261.912508][ T6083] usb 2-1: USB disconnect, device number 48 [ 261.984979][ T25] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 262.145106][ T25] usb 4-1: Using ep0 maxpacket: 32 [ 262.146287][ T25] usb 4-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 262.148064][ T25] usb 4-1: config 0 has an invalid interface number: 10 but max is 0 [ 262.148090][ T25] usb 4-1: config 0 has no interface number 0 [ 262.148128][ T25] usb 4-1: config 0 interface 10 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 262.148154][ T25] usb 4-1: config 0 interface 10 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 262.148176][ T25] usb 4-1: config 0 interface 10 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 262.148201][ T25] usb 4-1: config 0 interface 10 has no altsetting 0 [ 262.151176][ T25] usb 4-1: New USB device strings: Mfr=93, Product=0, SerialNumber=0 [ 262.151203][ T25] usb 4-1: Manufacturer: syz [ 262.255380][ T25] usb 4-1: config 0 descriptor?? [ 262.477301][ T8907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 262.480917][ T8907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 262.517000][ T32] kauditd_printk_skb: 3 callbacks suppressed [ 262.517020][ T32] audit: type=1326 audit(1790727958.717:517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8906 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 262.517064][ T32] audit: type=1326 audit(1790727958.717:518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8906 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 262.522866][ T32] audit: type=1326 audit(1790727958.717:519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8906 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 262.531129][ T32] audit: type=1326 audit(1790727958.717:520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8906 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 262.585545][ T32] audit: type=1326 audit(1790727958.787:521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8906 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 262.709458][ T32] audit: type=1326 audit(1790727958.897:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8906 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 262.709536][ T32] audit: type=1326 audit(1790727958.897:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8906 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 262.709575][ T32] audit: type=1326 audit(1790727958.897:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8906 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 262.802172][ T32] audit: type=1326 audit(1790727958.997:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8906 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 262.834992][ T32] audit: type=1326 audit(1790727959.007:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8906 comm="syz.3.1011" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 262.860422][ T6083] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 263.027559][ T6083] usb 3-1: Using ep0 maxpacket: 16 [ 263.028853][ T6083] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 263.031328][ T6083] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 263.031379][ T6083] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 263.171184][ T6083] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.171212][ T6083] usb 3-1: Product: syz [ 263.171226][ T6083] usb 3-1: Manufacturer: syz [ 263.171240][ T6083] usb 3-1: SerialNumber: syz [ 263.327622][ T6083] usb 3-1: 0:2 : does not exist [ 263.823853][ T25] usbhid 4-1:0.10: can't add hid device: -71 [ 263.823967][ T25] usbhid 4-1:0.10: probe with driver usbhid failed with error -71 [ 263.870151][ T25] usb 4-1: USB disconnect, device number 71 [ 263.882696][ T8924] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1014'. [ 263.961640][ T6083] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 265.507811][ T6083] usb 3-1: USB disconnect, device number 53 [ 265.933434][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 266.273545][ T8934] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1017'. [ 267.067299][ T8934] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 267.067328][ T8934] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 267.205833][ T8934] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 267.205867][ T8934] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 267.307439][ T8940] fuse: Bad value for 'fd' [ 267.828068][ T8943] fuse: Bad value for 'fd' [ 269.931951][ T8953] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1024'. [ 270.889858][ T31] usb 2-1: new full-speed USB device number 49 using dummy_hcd [ 271.107135][ T31] usb 2-1: New USB device found, idVendor=07c0, idProduct=1125, bcdDevice= 0.00 [ 271.108250][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 271.108281][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 271.108302][ T31] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 271.108341][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.111496][ T31] usb 2-1: config 0 descriptor?? [ 271.467335][ T8966] FAULT_INJECTION: forcing a failure. [ 271.467335][ T8966] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 271.467373][ T8966] CPU: 1 UID: 0 PID: 8966 Comm: syz.3.1026 Tainted: G L syzkaller #0 PREEMPT(full) [ 271.467389][ T8966] Tainted: [L]=SOFTLOCKUP [ 271.467393][ T8966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 271.467399][ T8966] Call Trace: [ 271.467404][ T8966] [ 271.467409][ T8966] dump_stack_lvl+0xe8/0x150 [ 271.467430][ T8966] should_fail_ex+0x410/0x560 [ 271.467446][ T8966] _copy_to_user+0x31/0xb0 [ 271.467463][ T8966] simple_read_from_buffer+0xe1/0x170 [ 271.467490][ T8966] proc_fail_nth_read+0x1bb/0x230 [ 271.467502][ T8966] ? common_file_perm+0x20e/0x2b0 [ 271.467517][ T8966] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 271.467530][ T8966] ? rw_verify_area+0x24a/0x4c0 [ 271.467547][ T8966] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 271.467558][ T8966] vfs_read+0x213/0xa80 [ 271.467577][ T8966] ? __pfx___mutex_lock+0x10/0x10 [ 271.467593][ T8966] ? __pfx_vfs_read+0x10/0x10 [ 271.467609][ T8966] ? __fget_files+0x2a/0x420 [ 271.467626][ T8966] ? __fget_files+0x3a2/0x420 [ 271.467641][ T8966] ? __fget_files+0x2a/0x420 [ 271.467660][ T8966] ksys_read+0x150/0x270 [ 271.467671][ T8966] ? __pfx_ksys_read+0x10/0x10 [ 271.467687][ T8966] do_syscall_64+0x166/0x520 [ 271.467701][ T8966] ? trace_irq_disable+0x3b/0x140 [ 271.467712][ T8966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.467724][ T8966] ? clear_bhb_loop+0x70/0xc0 [ 271.467736][ T8966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.467747][ T8966] RIP: 0033:0x7f20e7b5e98e [ 271.467758][ T8966] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 271.467767][ T8966] RSP: 002b:00007f20e5df5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 271.467779][ T8966] RAX: ffffffffffffffda RBX: 00007f20e5df66c0 RCX: 00007f20e7b5e98e [ 271.467786][ T8966] RDX: 000000000000000f RSI: 00007f20e5df60a0 RDI: 0000000000000004 [ 271.467793][ T8966] RBP: 00007f20e5df6090 R08: 0000000000000000 R09: 0000000000000000 [ 271.467800][ T8966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 271.467806][ T8966] R13: 00007f20e7e26038 R14: 00007f20e7e25fa0 R15: 00007f20e7f4fa48 [ 271.467822][ T8966] [ 271.962580][ T8961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.973758][ T8961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.765043][ T31] usbhid 2-1:0.0: can't add hid device: -71 [ 274.765148][ T31] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 274.881853][ T31] usb 2-1: USB disconnect, device number 49 [ 277.237110][ T31] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 277.383908][ T8985] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 277.404848][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 277.405583][ T31] usb 4-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 277.406534][ T31] usb 4-1: config 0 has an invalid interface number: 10 but max is 0 [ 277.406557][ T31] usb 4-1: config 0 has no interface number 0 [ 277.406595][ T31] usb 4-1: config 0 interface 10 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 277.406621][ T31] usb 4-1: config 0 interface 10 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 277.406643][ T31] usb 4-1: config 0 interface 10 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 277.406669][ T31] usb 4-1: config 0 interface 10 has no altsetting 0 [ 277.407666][ T31] usb 4-1: New USB device strings: Mfr=93, Product=0, SerialNumber=0 [ 277.407689][ T31] usb 4-1: Manufacturer: syz [ 277.410706][ T31] usb 4-1: config 0 descriptor?? [ 277.711624][ T5615] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 277.728403][ T5615] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 277.729206][ T5615] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 277.729807][ T5615] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 277.730226][ T5615] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 277.791379][ T8983] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 277.791950][ T8983] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 278.258030][ T32] kauditd_printk_skb: 6 callbacks suppressed [ 278.258052][ T32] audit: type=1326 audit(1790727974.377:533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8982 comm="syz.3.1033" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 278.258098][ T32] audit: type=1326 audit(1790727974.377:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8982 comm="syz.3.1033" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 278.258160][ T32] audit: type=1326 audit(1790727974.377:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8982 comm="syz.3.1033" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 278.258199][ T32] audit: type=1326 audit(1790727974.377:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8982 comm="syz.3.1033" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 278.258237][ T32] audit: type=1326 audit(1790727974.377:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8982 comm="syz.3.1033" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 278.259176][ T32] audit: type=1326 audit(1790727974.457:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8982 comm="syz.3.1033" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 278.259221][ T32] audit: type=1326 audit(1790727974.457:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8982 comm="syz.3.1033" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 278.259292][ T32] audit: type=1326 audit(1790727974.457:540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8982 comm="syz.3.1033" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 278.985379][ T32] audit: type=1326 audit(1790727975.177:541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8982 comm="syz.3.1033" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 278.985454][ T32] audit: type=1326 audit(1790727975.187:542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8982 comm="syz.3.1033" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e7b9e159 code=0x7ffc0000 [ 280.185768][ T5615] Bluetooth: hci5: command tx timeout [ 282.311487][ T5615] Bluetooth: hci5: command tx timeout [ 284.094682][ C0] sched: DL replenish lagged too much [ 286.688707][ T5615] Bluetooth: hci5: command tx timeout [ 289.847621][ T5619] Bluetooth: hci5: command tx timeout [ 318.747257][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 318.764364][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 327.022854][ T31] usbhid 4-1:0.10: can't add hid device: -32 [ 327.022973][ T31] usbhid 4-1:0.10: probe with driver usbhid failed with error -32 [ 379.359655][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.522076][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 393.032630][ T4985] udevd[4985]: worker [8963] /devices/platform/dummy_hcd.3/usb4/4-1 is taking a long time [ 405.789804][ T5619] Bluetooth: hci5: command 0x0406 tx timeout [ 417.493093][ T33] INFO: task syz.4.1009:8896 blocked for more than 144 seconds. [ 417.493124][ T33] Tainted: G L syzkaller #0 [ 417.493135][ T33] Blocked by coredump. [ 417.493141][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 417.493151][ T33] task:syz.4.1009 state:D stack:25608 pid:8896 tgid:8896 ppid:5633 task_flags:0x40044c flags:0x00080002 [ 417.493210][ T33] Call Trace: [ 417.493221][ T33] [ 417.493234][ T33] __schedule+0x17db/0x58f0 [ 417.493293][ T33] ? __pfx___schedule+0x10/0x10 [ 417.493328][ T33] ? schedule+0x90/0x2b0 [ 417.493356][ T33] schedule+0x164/0x2b0 [ 417.493383][ T33] schedule_preempt_disabled+0x13/0x30 [ 417.493408][ T33] rwsem_down_read_slowpath+0x6ba/0x920 [ 417.493439][ T33] ? rwsem_down_read_slowpath+0x57f/0x920 [ 417.493474][ T33] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 417.493524][ T33] down_read+0x9c/0x330 [ 417.493552][ T33] ? sched_cache_exit_mm+0xef/0x190 [ 417.493583][ T33] exit_mm+0x77/0x240 [ 417.493606][ T33] do_exit+0x6cd/0x2360 [ 417.493635][ T33] ? __pfx_do_exit+0x10/0x10 [ 417.493659][ T33] ? do_raw_spin_lock+0x12b/0x2f0 [ 417.493696][ T33] do_group_exit+0x22d/0x2f0 [ 417.493715][ T33] ? _raw_spin_unlock_irq+0x23/0x50 [ 417.493743][ T33] get_signal+0x121b/0x12c0 [ 417.493798][ T33] arch_do_signal_or_restart+0xbb/0x860 [ 417.493831][ T33] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 417.493859][ T33] ? vm_mmap_pgoff+0x23d/0x4e0 [ 417.493902][ T33] exit_to_user_mode_loop+0x10e/0x770 [ 417.493925][ T33] ? rcu_is_watching+0x16/0xb0 [ 417.493955][ T33] do_syscall_64+0x328/0x520 [ 417.493982][ T33] ? trace_irq_disable+0x3b/0x140 [ 417.494003][ T33] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.494024][ T33] ? clear_bhb_loop+0x70/0xc0 [ 417.494049][ T33] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.494070][ T33] RIP: 0033:0x7f350979dec2 [ 417.494088][ T33] RSP: 002b:00007f3509b4faf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 417.494109][ T33] RAX: fffffffffffffffc RBX: 0000000000000000 RCX: 00007f350979dec2 [ 417.494124][ T33] RDX: 0000000000000000 RSI: 0000000000402000 RDI: 0000000000000000 [ 417.494137][ T33] RBP: 0000000000000022 R08: 00000000ffffffff R09: 0000000000000000 [ 417.494150][ T33] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000000003 [ 417.494162][ T33] R13: 0000000000000003 R14: 0000000000000000 R15: 00007f3509a25fa0 [ 417.494193][ T33] [ 417.494202][ T33] INFO: task syz.4.1009:8899 blocked for more than 144 seconds. [ 417.494219][ T33] Tainted: G L syzkaller #0 [ 417.494230][ T33] Blocked by coredump. [ 417.494236][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 417.494245][ T33] task:syz.4.1009 state:D stack:26192 pid:8899 tgid:8896 ppid:5633 task_flags:0x40044c flags:0x00080002 [ 417.510851][ T33] Call Trace: [ 417.510861][ T33] [ 417.510875][ T33] __schedule+0x17db/0x58f0 [ 417.510932][ T33] ? __pfx___schedule+0x10/0x10 [ 417.510967][ T33] ? schedule+0x90/0x2b0 [ 417.510995][ T33] schedule+0x164/0x2b0 [ 417.511022][ T33] schedule_preempt_disabled+0x13/0x30 [ 417.511047][ T33] rwsem_down_read_slowpath+0x6ba/0x920 [ 417.511078][ T33] ? rwsem_down_read_slowpath+0x57f/0x920 [ 417.511113][ T33] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 417.511164][ T33] down_read+0x9c/0x330 [ 417.511193][ T33] ? sched_cache_exit_mm+0xef/0x190 [ 417.511224][ T33] exit_mm+0x77/0x240 [ 417.511247][ T33] do_exit+0x6cd/0x2360 [ 417.511268][ T33] ? __asan_memset+0x22/0x50 [ 417.511284][ T33] ? __pfx_do_exit+0x10/0x10 [ 417.511308][ T33] ? do_raw_spin_lock+0x12b/0x2f0 [ 417.511346][ T33] do_group_exit+0x22d/0x2f0 [ 417.511365][ T33] ? _raw_spin_unlock_irq+0x23/0x50 [ 417.511393][ T33] get_signal+0x121b/0x12c0 [ 417.511439][ T33] arch_do_signal_or_restart+0xbb/0x860 [ 417.511472][ T33] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 417.511521][ T33] exit_to_user_mode_loop+0x10e/0x770 [ 417.511544][ T33] ? rcu_is_watching+0x16/0xb0 [ 417.511573][ T33] do_syscall_64+0x328/0x520 [ 417.511599][ T33] ? trace_irq_disable+0x3b/0x140 [ 417.511620][ T33] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.511641][ T33] ? clear_bhb_loop+0x70/0xc0 [ 417.511666][ T33] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.511686][ T33] RIP: 0033:0x7f350979e159 [ 417.511705][ T33] RSP: 002b:00007f350a673028 EFLAGS: 00000246 ORIG_RAX: 000000000000013e [ 417.511727][ T33] RAX: 0000000000224dc0 RBX: 00007f3509a25fa0 RCX: 00007f350979e159 [ 417.511742][ T33] RDX: 0000000000000000 RSI: 00000000ffffff9a RDI: 0000200000000240 [ 417.511762][ T33] RBP: 00007f350983506b R08: 0000000000000000 R09: 0000000000000000 [ 417.511775][ T33] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 417.511788][ T33] R13: 00007f3509a26038 R14: 00007f3509a25fa0 R15: 00007f3509b4fa48 [ 417.511821][ T33] [ 417.511830][ T33] INFO: task syz.4.1009:8900 blocked for more than 144 seconds. [ 417.511849][ T33] Tainted: G L syzkaller #0 [ 417.511860][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 417.511870][ T33] task:syz.4.1009 state:D stack:25944 pid:8900 tgid:8896 ppid:5633 task_flags:0x400040 flags:0x00080002 [ 417.511921][ T33] Call Trace: [ 417.511928][ T33] [ 417.511940][ T33] __schedule+0x17db/0x58f0 [ 417.511993][ T33] ? __pfx___schedule+0x10/0x10 [ 417.512027][ T33] ? schedule+0x90/0x2b0 [ 417.512055][ T33] schedule+0x164/0x2b0 [ 417.512083][ T33] schedule_preempt_disabled+0x13/0x30 [ 417.512109][ T33] rwsem_down_write_slowpath+0x87d/0x1080 [ 417.512134][ T33] ? rwsem_down_write_slowpath+0x498/0x1080 [ 417.512164][ T33] ? __pfx_rwsem_down_write_slowpath+0x10/0x10 [ 417.512226][ T33] down_write+0x1bc/0x200 [ 417.512255][ T33] ? __pfx_down_write+0x10/0x10 [ 417.512295][ T33] __se_sys_mbind+0x989/0x10e0 [ 417.512330][ T33] ? __pfx___se_sys_mbind+0x10/0x10 [ 417.512365][ T33] ? __se_sys_futex+0x3a8/0x450 [ 417.512401][ T33] ? rcu_is_watching+0x16/0xb0 [ 417.512431][ T33] ? __x64_sys_mbind+0x21/0xf0 [ 417.512459][ T33] do_syscall_64+0x166/0x520 [ 417.512486][ T33] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.512507][ T33] ? clear_bhb_loop+0x70/0xc0 [ 417.512533][ T33] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.512554][ T33] RIP: 0033:0x7f350979e159 [ 417.512571][ T33] RSP: 002b:00007f350a652028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed [ 417.512592][ T33] RAX: ffffffffffffffda RBX: 00007f3509a26090 RCX: 00007f350979e159 [ 417.512606][ T33] RDX: 0000000000000004 RSI: 0000000000800000 RDI: 0000200000001000 [ 417.512620][ T33] RBP: 00007f350983506b R08: 0000000000000000 R09: 0000000000000002 [ 417.512634][ T33] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 417.512647][ T33] R13: 00007f3509a26128 R14: 00007f3509a26090 R15: 00007f3509b4fa48 [ 417.512680][ T33] [ 417.512710][ T33] [ 417.512710][ T33] Showing all locks held in the system: [ 417.512720][ T33] locks held by kworker/u8:0/12: 4, last CPU#1: [ 417.512736][ T33] #0: ffff888076012940 ((wq_completion)wg-kex-wg1#7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.512805][ T33] #1: ffffc90000117c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.512861][ T33] #2: ffff888033519440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 417.512912][ T33] #3: ffff88802bf6dc58 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 417.512963][ T33] locks held by kworker/u8:1/13: 4, last CPU#1: [ 417.512977][ T33] #0: ffff888033657940 ((wq_completion)wg-kex-wg2#7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.513036][ T33] #1: ffffc90000127c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.513090][ T33] #2: ffff888078ba5440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 417.513139][ T33] #3: ffff88802bf6c888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 417.513190][ T33] locks held by kworker/1:0/25: 4, on CPU#1: [ 417.513205][ T33] #0: ffff888057d2bd40 ((wq_completion)wg-kex-wg2#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.513263][ T33] #1: ffffc900001f7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.513329][ T33] #2: ffff888078ba5440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 417.513379][ T33] #3: ffff88802bf6c888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x59c/0x9b0 [ 417.513428][ T33] locks held by kworker/u8:2/30: 4, on CPU#1: [ 417.513443][ T33] #0: ffff88802eea1140 ((wq_completion)wg-kex-wg1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.513498][ T33] #1: ffffc90000a57c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.513553][ T33] #2: ffff88807c569440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 417.513603][ T33] #3: ffff88807f655c58 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 417.513653][ T33] locks held by kworker/1:1/31: 5, last CPU#1: [ 417.513668][ T33] #0: ffff88801fed9140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.513721][ T33] #1: ffffc90000a67c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.513781][ T33] #2: ffff88802a3da1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 417.513833][ T33] #3: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 417.513882][ T33] #4: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 417.513933][ T33] locks held by khungtaskd/33: 1, last CPU#0: [ 417.513947][ T33] #0: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 417.513998][ T33] locks held by kworker/u8:3/50: 2, last CPU#0: [ 417.514012][ T33] #0: ffff88802eea7140 ((wq_completion)wg-kex-wg2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.514066][ T33] #1: ffffc90000bb7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.514123][ T33] locks held by kworker/u8:4/60: 4, last CPU#1: [ 417.514137][ T33] #0: ffff888033655140 ((wq_completion)wg-kex-wg1#3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.514196][ T33] #1: ffffc9000201fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.514250][ T33] #2: ffff888033cd1440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 417.514299][ T33] #3: ffff88807f6520e8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 417.514352][ T33] locks held by kworker/u8:5/138: 4, last CPU#0: [ 417.514367][ T33] #0: ffff88802eea6940 ((wq_completion)wg-kex-wg0#9){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.514426][ T33] #1: ffffc90002e1fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.514479][ T33] #2: ffff88807f069440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 417.514528][ T33] #3: ffff88802bf6aad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 417.514577][ T33] locks held by kworker/u8:6/155: 3, on CPU#0: [ 417.514592][ T33] #0: ffff88802ad88940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.532481][ T33] #1: ffffc90002e6fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.532552][ T33] #2: ffffffff90254cc0 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 417.532609][ T33] locks held by kworker/u8:7/159: 3, last CPU#0: [ 417.532625][ T33] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.532679][ T33] #1: ffffc90002ecfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.532734][ T33] #2: ffff8880661f0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 417.532793][ T33] locks held by kworker/u8:8/1019: 4, last CPU#0: [ 417.532808][ T33] #0: ffff888076012940 ((wq_completion)wg-kex-wg1#7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.532867][ T33] #1: ffffc90004ee7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.532921][ T33] #2: ffff888033519440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 417.532973][ T33] #3: ffff88802bf6d270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 417.533025][ T33] locks held by kworker/u8:9/1151: 2, last CPU#0: [ 417.533040][ T33] #0: ffff8880232f1140 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.533094][ T33] #1: ffffc90005337c40 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.533148][ T33] locks held by kworker/u8:10/1160: 3, last CPU#1: [ 417.533163][ T33] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.533216][ T33] #1: ffffc900052d7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.533271][ T33] #2: ffff8880663f0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 417.533321][ T33] locks held by kworker/u8:11/1168: 4, last CPU#1: [ 417.533336][ T33] #0: ffff888033657940 ((wq_completion)wg-kex-wg2#7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.533393][ T33] #1: ffffc90005487c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.533447][ T33] #2: ffff888078ba5440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 417.533497][ T33] #3: ffff88802bf6bea0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 417.533561][ T33] locks held by kworker/1:2/3109: 3, last CPU#1: [ 417.533576][ T33] #0: ffff88807e667940 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.533635][ T33] #1: ffffc9000df4fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.533702][ T33] #2: ffff88807f653ea0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 417.533761][ T33] locks held by kworker/R-bat_e/3228: 2, last CPU#0: [ 417.533776][ T33] #0: ffff888032af4140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.533831][ T33] #1: ffffc9000e18fc20 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.533888][ T33] locks held by udevd/4985: 3, last CPU#1: [ 417.533903][ T33] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 417.533953][ T33] #1: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 417.534004][ T33] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: page_ext_get+0x22/0x2e0 [ 417.534055][ T33] locks held by dhcpcd/5279: 2, last CPU#1: [ 417.534070][ T33] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_number_perm+0x219/0x5f0 [ 417.534121][ T33] #1: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 417.534170][ T33] locks held by dhcpcd/5280: 2, last CPU#0: [ 417.534184][ T33] #0: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 417.534232][ T33] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x4a0 [ 417.534285][ T33] locks held by getty/5375: 2, on CPU#0: [ 417.534299][ T33] #0: ffff88802ac0a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 417.534347][ T33] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 417.534401][ T33] locks held by syz-executor/5605: 1, last CPU#0: [ 417.534416][ T33] #0: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 417.534465][ T33] locks held by kworker/u9:2/5615: 4, on CPU#0: [ 417.534479][ T33] #0: ffff88807f61d940 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.534534][ T33] #1: ffffc9000393fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 417.534588][ T33] #2: ffff8880688acea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 417.534638][ T33] #3: ffff8880688ac0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 421.190228][ T33] locks held by syz-executor/5632: 2, last CPU#1: [ 421.190246][ T33] #0: ffff88802b7a82e0 (&xt[i].mutex){+.+.}-{4:4}, at: xt_find_table_lock+0x55/0x400 [ 421.190301][ T33] #1: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 421.190352][ T33] locks held by syz-executor/5634: 1, last CPU#1: [ 421.190367][ T33] #0: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 421.190428][ T33] locks held by syz-executor/5635: 1, last CPU#1: [ 421.190443][ T33] #0: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: __page_table_check_zero+0x6c/0x430 [ 421.190499][ T33] locks held by kworker/0:4/5672: 4, last CPU#0: [ 421.190514][ T33] #0: ffff888032973d40 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.190568][ T33] #1: ffffc90004a0fc40 ((work_completion)(&(&mc->mca_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.190622][ T33] #2: ffff888076915530 (&idev->mc_lock){+.+.}-{4:4}, at: mld_mca_work+0x52/0x440 [ 421.190675][ T33] #3: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: igmp6_send+0x1b1/0x1140 [ 421.190731][ T33] locks held by kworker/1:4/5706: 4, last CPU#1: [ 421.190745][ T33] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.190801][ T33] #1: ffffc90004ec7c40 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.190856][ T33] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x274/0x1890 [ 421.190902][ T33] #3: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: nf_conntrack_free+0x97/0x710 [ 421.190957][ T33] locks held by kworker/1:5/5707: 3, last CPU#1: [ 421.190972][ T33] #0: ffff88802da05540 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191031][ T33] #1: ffffc90004ed7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191095][ T33] #2: ffff88807f656640 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 421.191146][ T33] locks held by kworker/1:7/6079: 3, last CPU#1: [ 421.191161][ T33] #0: ffff888078863d40 ((wq_completion)wg-kex-wg0#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191218][ T33] #1: ffffc9000729fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191283][ T33] #2: ffff88807f657028 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 421.191332][ T33] locks held by kworker/1:8/6080: 3, on CPU#1: [ 421.191347][ T33] #0: ffff88807e42ed40 ((wq_completion)wg-kex-wg1#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191411][ T33] #1: ffffc9000808fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191478][ T33] #2: ffff88802bf6d270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 421.191528][ T33] locks held by kworker/1:11/6083: 2, last CPU#1: [ 421.191543][ T33] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191596][ T33] #1: ffffc900084b7c40 ((work_completion)(&(&tbl->gc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191652][ T33] locks held by kworker/0:8/6087: 3, on CPU#0: [ 421.191666][ T33] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191720][ T33] #1: ffffc900088dfc40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191773][ T33] #2: ffffffff90254cc0 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 421.191831][ T33] locks held by kworker/0:11/6090: 3, last CPU#0: [ 421.191846][ T33] #0: ffff88802da05540 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191903][ T33] #1: ffffc90006f17c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.191969][ T33] #2: ffff88807f655c58 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 421.192019][ T33] locks held by kworker/0:13/6092: 4, last CPU#0: [ 421.192034][ T33] #0: ffff888078863d40 ((wq_completion)wg-kex-wg0#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.192091][ T33] #1: ffffc90008d07c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.192157][ T33] #2: ffff888032c39440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x14e/0x9f0 [ 421.192206][ T33] #3: ffff88802a1bf028 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x15f/0x9f0 [ 421.192256][ T33] locks held by kworker/0:14/6095: 3, on CPU#0: [ 421.192270][ T33] #0: ffff88807e42ed40 ((wq_completion)wg-kex-wg1#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.192328][ T33] #1: ffffc90006807c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.192401][ T33] #2: ffff88802bf6d270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 421.192458][ T33] locks held by syz.4.1009/8896: 1, on CPU#1: [ 421.192473][ T33] #0: ffff88807b59f180 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x77/0x240 [ 421.192520][ T33] locks held by syz.4.1009/8899: 1, on CPU#0: [ 421.192534][ T33] #0: ffff88807b59f180 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x77/0x240 [ 421.192579][ T33] locks held by syz.4.1009/8900: 1, on CPU#1: [ 421.192593][ T33] #0: ffff88807b59f180 (&mm->mmap_lock){++++}-{4:4}, at: __se_sys_mbind+0x989/0x10e0 [ 421.192645][ T33] locks held by syz.4.1009/8901: 2, last CPU#1: [ 421.192660][ T33] #0: ffff88807b59f180 (&mm->mmap_lock){++++}-{4:4}, at: madvise_lock+0x152/0x2e0 [ 421.192709][ T33] #1: ffffe8ffffd28768 (&acomp_ctx->mutex){+.+.}-{4:4}, at: zswap_store+0xcb7/0x2050 [ 421.192764][ T33] locks held by udevd/8963: 3, last CPU#1: [ 421.192779][ T33] #0: ffff88804f9c2740 (&type->i_mutex_dir_key#4){++++}-{4:4}, at: lookup_slow+0x46/0x70 [ 421.192839][ T33] #1: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 421.192887][ T33] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 421.192939][ T33] locks held by syz.3.1033/8983: 4, last CPU#1: [ 421.192954][ T33] #0: ffff88802a268e00 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 421.193008][ T33] #1: ffffffff905ff080 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 [ 421.193060][ T33] #2: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 421.193107][ T33] #3: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 421.193157][ T33] locks held by syz-executor/8989: 4, last CPU#1: [ 421.193172][ T33] #0: ffffffff90246448 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x524/0x780 [ 421.193223][ T33] #1: ffffffff90254cc0 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d5/0x820 [ 421.193273][ T33] #2: ffffffff8eeac630 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 421.193321][ T33] #3: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 421.193372][ T33] locks held by syz.0.1035/8997: 1, on CPU#0: [ 421.193393][ T33] #0: ffffffff8ed62c68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 421.193450][ T33] locks held by kworker/u8:12/8999: 4, last CPU#1: [ 421.193464][ T33] #0: ffff88802eea6940 ((wq_completion)wg-kex-wg0#9){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.193523][ T33] #1: ffffc900059d7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 421.193578][ T33] #2: ffff88807f069440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 421.193627][ T33] #3: ffff88802bf6b4b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 421.193680][ T33] [ 421.193686][ T33] ============================================= [ 421.193686][ T33] [ 421.193698][ T33] NMI backtrace for cpu 1 [ 421.193734][ T33] CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 421.193788][ T33] Tainted: [L]=SOFTLOCKUP [ 421.193804][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 421.193826][ T33] Call Trace: [ 421.193842][ T33] [ 421.193860][ T33] dump_stack_lvl+0xe8/0x150 [ 421.193902][ T33] nmi_cpu_backtrace+0x274/0x2d0 [ 421.193925][ T33] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 421.193958][ T33] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 421.193984][ T33] sys_info+0x135/0x170 [ 421.194003][ T33] watchdog+0xfd7/0x1030 [ 421.194031][ T33] ? watchdog+0x1c7/0x1030 [ 421.194058][ T33] kthread+0x38b/0x480 [ 421.194079][ T33] ? __pfx_watchdog+0x10/0x10 [ 421.194098][ T33] ? __pfx_kthread+0x10/0x10 [ 421.194120][ T33] ret_from_fork+0x514/0xb70 [ 421.194142][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 421.194161][ T33] ? __switch_to+0xc89/0x1420 [ 421.194191][ T33] ? __pfx_kthread+0x10/0x10 [ 421.194212][ T33] ret_from_fork_asm+0x1a/0x30 [ 421.194256][ T33] [ 421.194264][ T33] Sending NMI from CPU 1 to CPUs 0: [ 421.194301][ C0] NMI backtrace for cpu 0 [ 421.194317][ C0] CPU: 0 UID: 0 PID: 3228 Comm: kworker/R-bat_e Tainted: G L syzkaller #0 PREEMPT(full) [ 421.194341][ C0] Tainted: [L]=SOFTLOCKUP [ 421.194348][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 421.194366][ C0] Workqueue: bat_events batadv_dat_purge [ 421.194386][ C0] RIP: 0010:check_preemption_disabled+0x3/0xd0 [ 421.194414][ C0] Code: 6d 8c 48 c7 c6 60 ad 6d 8c eb 1c 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 <41> 56 53 65 8b 05 1b bd ae 07 65 48 8b 0d eb bc ae 07 85 c9 74 0c [ 421.194430][ C0] RSP: 0018:ffffc90000006e50 EFLAGS: 00000282 [ 421.194445][ C0] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 8000000000000101 [ 421.194457][ C0] RDX: 8000000000000100 RSI: ffffffff8c6dad60 RDI: ffffffff8c6dad20 [ 421.194471][ C0] RBP: 000000000000001e R08: 0000000000000100 R09: 0000000000000000 [ 421.194484][ C0] R10: ffffc90000007040 R11: fffff52000000e0e R12: dffffc0000000000 [ 421.194497][ C0] R13: 0000000000000002 R14: ffff8880216dd930 R15: ffff888034615420 [ 421.194511][ C0] FS: 0000000000000000(0000) GS:ffff888124cc8000(0000) knlGS:0000000000000000 [ 421.194526][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 421.194539][ C0] CR2: 000055557ceb24e8 CR3: 0000000076c9c000 CR4: 00000000003526f0 [ 421.194554][ C0] Call Trace: [ 421.194562][ C0] [ 421.194569][ C0] rcu_lockdep_current_cpu_online+0x39/0x120 [ 421.194595][ C0] rcu_read_lock_held+0x1e/0x50 [ 421.194619][ C0] fib_table_lookup+0x2c0/0x16e0 [ 421.194654][ C0] __inet_dev_addr_type+0x2fc/0x560 [ 421.194670][ C0] ? stack_depot_save_flags+0x33/0x7f0 [ 421.194689][ C0] ? __inet_dev_addr_type+0x159/0x560 [ 421.194705][ C0] ? __pfx___inet_dev_addr_type+0x10/0x10 [ 421.194726][ C0] ? inet_addr_type_dev_table+0x25/0x190 [ 421.194745][ C0] ? inet_addr_type_dev_table+0x25/0x190 [ 421.194764][ C0] ? inet_addr_type_dev_table+0x25/0x190 [ 421.194785][ C0] ip_route_me_harder+0x45a/0xfe0 [ 421.194810][ C0] ? __pfx_ip_route_me_harder+0x10/0x10 [ 421.194833][ C0] ? __alloc_skb+0x27a/0x7a0 [ 421.194860][ C0] ? __cookie_v4_init_sequence+0x273/0x510 [ 421.194882][ C0] ? kmem_cache_alloc_node_noprof+0x3be/0x610 [ 421.194916][ C0] synproxy_send_tcp+0x332/0x670 [ 421.194942][ C0] synproxy_send_client_synack+0x89b/0xde0 [ 421.194972][ C0] ? __pfx_synproxy_send_client_synack+0x10/0x10 [ 421.194997][ C0] ? nft_jhash_dump+0x394/0x440 [ 421.195020][ C0] ? synproxy_pernet+0x45/0x270 [ 421.195048][ C0] nft_synproxy_eval_v4+0x362/0x4e0 [ 421.195076][ C0] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 421.195102][ C0] ? nf_ip_checksum+0x13c/0x510 [ 421.195131][ C0] nft_synproxy_do_eval+0x389/0x5d0 [ 421.195159][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 421.195184][ C0] ? __lock_acquire+0x747/0x2de0 [ 421.195211][ C0] nft_do_chain+0x48d/0x1b10 [ 421.195241][ C0] ? __lock_acquire+0x747/0x2de0 [ 421.195262][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 421.195290][ C0] ? __local_bh_enable_ip+0xd6/0x140 [ 421.195314][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 421.195350][ C0] nft_do_chain_ipv4+0x195/0x290 [ 421.195375][ C0] ? ipt_do_table+0x2b9/0x15d0 [ 421.195399][ C0] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 421.195423][ C0] ? iptable_mangle_hook+0x18a/0x4c0 [ 421.195449][ C0] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 421.195476][ C0] nf_hook_slow+0xc5/0x220 [ 421.195500][ C0] NF_HOOK+0x21f/0x3c0 [ 421.195526][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 421.195552][ C0] ? NF_HOOK+0x9e/0x3c0 [ 421.195575][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 421.195602][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 421.195630][ C0] ? ip_local_deliver+0x113/0x190 [ 421.195657][ C0] NF_HOOK+0x336/0x3c0 [ 421.195682][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 421.195707][ C0] ? NF_HOOK+0x9e/0x3c0 [ 421.195731][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 421.195756][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 421.195781][ C0] ? ip_rcv_core+0x88d/0xd50 [ 421.195808][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 421.195832][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 421.195857][ C0] process_backlog+0xa6b/0x18b0 [ 421.195882][ C0] ? process_backlog+0x3de/0x18b0 [ 421.195918][ C0] __napi_poll+0xaa/0x330 [ 421.195941][ C0] net_rx_action+0x61d/0xf50 [ 421.195969][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 421.196005][ C0] handle_softirqs+0x226/0x860 [ 421.196030][ C0] ? do_softirq+0x77/0xd0 [ 421.196056][ C0] ? batadv_dat_purge+0x2d7/0x3c0 [ 421.196076][ C0] do_softirq+0x77/0xd0 [ 421.196099][ C0] [ 421.196105][ C0] [ 421.196113][ C0] __local_bh_enable_ip+0x100/0x140 [ 421.196137][ C0] batadv_dat_purge+0x2d7/0x3c0 [ 421.196158][ C0] ? process_scheduled_works+0x97a/0x1630 [ 421.196183][ C0] process_scheduled_works+0xc3d/0x1630 [ 421.196222][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 421.196246][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 421.196276][ C0] ? assign_work+0x3af/0x5d0 [ 421.196301][ C0] rescuer_thread+0x7c5/0x10e0 [ 421.196331][ C0] ? rescuer_thread+0xb8/0x10e0 [ 421.196371][ C0] kthread+0x38b/0x480 [ 421.196389][ C0] ? __pfx_rescuer_thread+0x10/0x10 [ 421.196414][ C0] ? __pfx_kthread+0x10/0x10 [ 421.196433][ C0] ret_from_fork+0x514/0xb70 [ 421.196453][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 421.196471][ C0] ? __switch_to+0xc89/0x1420 [ 421.196498][ C0] ? __pfx_kthread+0x10/0x10 [ 421.196517][ C0] ret_from_fork_asm+0x1a/0x30 [ 421.196553][ C0] [ 422.907925][ T33] Kernel panic - not syncing: hung_task: blocked tasks [ 425.919041][ T33] CPU: 0 UID: 0 PID: 33 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 425.929739][ T33] Tainted: [L]=SOFTLOCKUP [ 425.934067][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 425.944130][ T33] Call Trace: [ 425.947423][ T33] [ 425.950362][ T33] vpanic+0x56d/0xa60 [ 425.954360][ T33] ? __pfx___schedule+0x10/0x10 [ 425.959228][ T33] ? __pfx_vpanic+0x10/0x10 [ 425.963765][ T33] panic+0xc5/0xd0 [ 425.967502][ T33] ? __pfx_panic+0x10/0x10 [ 425.971939][ T33] ? preempt_schedule_common+0x7f/0xd0 [ 425.977424][ T33] ? preempt_schedule_thunk+0x16/0x40 [ 425.982809][ T33] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 425.989004][ T33] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 425.995276][ T33] watchdog+0x1030/0x1030 [ 425.999625][ T33] ? watchdog+0x1c7/0x1030 [ 426.004059][ T33] kthread+0x38b/0x480 [ 426.008135][ T33] ? __pfx_watchdog+0x10/0x10 [ 426.012821][ T33] ? __pfx_kthread+0x10/0x10 [ 426.017532][ T33] ret_from_fork+0x514/0xb70 [ 426.022137][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 426.027278][ T33] ? __switch_to+0xc89/0x1420 [ 426.032015][ T33] ? __pfx_kthread+0x10/0x10 [ 426.036625][ T33] ret_from_fork_asm+0x1a/0x30 [ 426.041427][ T33] [ 426.044733][ T33] Kernel Offset: disabled [ 426.049058][ T33] Rebooting in 86400 seconds..