last executing test programs: 12.196013231s ago: executing program 0 (id=1615): ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(0xffffffffffffffff, 0x3b82, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000498b4d000000010902240001000000000904000002214c6a0009050702000000da000905890e"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff000000004e04010000000000d3400202010000004704000001ed00007b130000000000001d440200000000007a0a00fe00ffffffc3030000e1000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af69912435f1a864a710aad58db6a6c3692e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5be14ecf7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e347a8ad880d2cd829b847400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c35b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af8612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5e69048ddff6da409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18ec0ae564162a27afea62d84f3a10746443d64364f50000e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc286463a2b1e992894269f478341d02d0f5ad4bcb524a5a17f48a7382f13d000000225d85ae49cee383dc5049076b98fb6853ab39e415140200000020cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a22048516d6aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe0e669e5e20100005353193f82ade69d0540059fe6c7fe7cd8697502c7596566d6740300da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc02290beaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24c87afce829ba0f85da6d8a8f18ea40ab959f6074ab2a4009b9e5f07ab5138aa6e3d37fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e6b0b384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208160fb04c98375b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27feeb741680f6f2f9a6a8346962a350845ffa0d829e4f79ad7d87906943408e6df3adbfd03aac93df8866fb010aecfed9092ca4d0f3e1116a0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a530600d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe92c7719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b1dba94a6ea80c33ead5722c3293986e02c8e0a6dda1eca493f14795bd068826fe8df15efaaeea831555877f958a19e499666a38d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a8784d0899ed888141e2fae6691d1aee1da02ba516467df3e7d1daac19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa57d2c93f49c47944fec01a8aa7749f3187e9efb00000000e0884160b765b07ec9ba020362310223c81e48d6d3b6e5b50d45248efe43a409773e3ed01cd663f3aaab9e1c0000f43b64bb54e5b30be3399e3dd1eb1cfd1935a323023fe5792879833c7eb356b95cfb135045b1d8f7da2fa5bfedef411d0791523a9e64c884e9dfed9cd413afe66bd8ee831cdb34726fe0434fbf44c7b33a853330bcaf37ba4e36705807468b37d32087e599165f1bce015145444ef5967b443222f46173cc876015b2d1874be9846f7c1653c02d2ef9a75fdc45820c69bbe1cb575f9aa21aa9d3d58bd5e5fe026142a72e24049b8400c4a28b2d5db8d5f53cb354fba19975fb0b3739baae51cb4b034993ef1463dcdba2da419b320420efdd091d7f6e83c8ac2ccc6c9392a42a33907421ab847c9590c213eda9a7e1db598a23e75a3c0933fc803ca994a86476b995c37c445f68fd"], &(0x7f00000001c0)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) close(r3) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, &(0x7f0000000400)) syz_usb_control_io$hid(r0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000600)={0x3c, 0x0, 0x603, 0x70bd2c, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x808}, 0x10) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000040)=ANY=[@ANYBLOB="402a26000000260e0ca0707759a8b4c958297a7548aeceb8f27108f6802b5ee7c1ff7b3c598b9460ad5b2c4e"], &(0x7f00000000c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000003c0)={0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="003179000000fd502df3fd9f633c2968ee14fb"], &(0x7f0000000300)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x2}}) syz_usb_connect(0x1, 0x36, 0x0, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r5 = request_key(&(0x7f0000000340)='id_legacy\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f00000003c0)='/dev/vsock\x00', 0xfffffffffffffffe) request_key(&(0x7f0000000040)='id_legacy\x00', &(0x7f0000000900)={'syz', 0x0}, 0x0, r5) add_key(&(0x7f0000000940)='id_resolver\x00', &(0x7f0000000980)={'syz', 0x0}, &(0x7f0000000ac0)="44f36b5e4c4f1f4c98d84264ea2547def7d01c5839116a843dded2e1e58884ed4741c00aace16560f0f054baf14a7f7c0e6518380099b39ef7b5c9b6d93df1338ff9eda33d0f50b731b637b52d39d1b0fa2b5ddef3cd0d2ef201f3044a94f415be032c066233897199bcab65b311bd790e11d6ca25e238ab959d19fbf6ebcb874a73e3dc0b60e8d0d17c12acf5af6ee82299148a9093be5cdbbe55398a30c64d7e403d72eb1d14165cc8e509e180c7e803334e9ffe3076fd44a987f0efd54f47c71f5852f7294f391770aa8485c9e7674aabccdc997832592ac79790875db013db71aa08", 0xe4, r5) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000040)) 10.531633669s ago: executing program 3 (id=1620): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r2, 0x28, 0x2, &(0x7f00000000c0)=0x33, 0x8) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r3, &(0x7f0000000140)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0xfde1, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @dest_unreach={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @local, @loopback}}}}, 0xfdef) process_vm_readv(0x0, &(0x7f0000000240), 0x1000000000000271, 0x0, 0x0, 0x0) listen(r2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffdfffffffffe, 0xfa11, 0xffffffff}, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r5 = accept4(r2, 0x0, 0x0, 0x0) sendto(r5, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) recvfrom(0xffffffffffffffff, &(0x7f00000001c0)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xa4, 0x0, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000080)={@remote, r1}, 0x14) 10.293403767s ago: executing program 2 (id=1621): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(camellia)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) mbind(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x4000, &(0x7f0000000280)=0x4, 0x0, 0x4) (async) accept4(r0, 0x0, 0x0, 0x800) (async, rerun: 64) unshare(0x0) (async, rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket(0x1f, 0x807, 0x200000) sendto$inet6(r1, &(0x7f00000007c0)="7800000018002507b9199b02ffff48000203be04020406050a02040c5c000900580006050a0000000d0085a168d0bf46d32345653600648d27000b000a1f070849935ade4a460c89b6ec0cff3959547f509058ad86c902007a00004a32000407160012000a0000000000e000e21800003b6ed538f6523250", 0x78, 0x2251197285d76a80, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x8031, 0xffffffffffffffff, 0x40ead000) (async) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000050000001e917f07b7fb"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xf, 0x2a, &(0x7f0000000280)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) (rerun: 32) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) (async) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) (async) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0xc0800) recvmmsg$unix(r3, &(0x7f0000002400)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000100), 0x6e, &(0x7f0000001bc0)=[{&(0x7f0000000180)=""/87, 0x57}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000001840)=""/27, 0x1b}, {&(0x7f0000001880)=""/228, 0xe4}, {&(0x7f0000001980)=""/44, 0x2c}, {&(0x7f00000019c0)=""/234, 0xea}, {&(0x7f0000001ac0)=""/208, 0xd0}], 0x7}}, {{&(0x7f0000001c40)=@abs, 0x6e, &(0x7f00000020c0)=[{&(0x7f0000001cc0)=""/160, 0xa0}, {&(0x7f0000001d80)=""/61, 0x3d}, {&(0x7f0000001dc0)=""/42, 0x2a}, {&(0x7f0000001e00)=""/109, 0x6d}, {&(0x7f0000001e80)=""/32, 0x20}, {&(0x7f0000001ec0)=""/136, 0x88}, {&(0x7f0000001f80)}, {&(0x7f0000001fc0)=""/255, 0xff}], 0x8}}, {{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f0000002140)=""/47, 0x2f}, {&(0x7f0000002180)=""/114, 0x72}, {&(0x7f0000002200)=""/206, 0xce}, {&(0x7f00000004c0)=""/151, 0x97}], 0x4}}], 0x4, 0x0, 0x0) close(0xffffffffffffffff) (async) r4 = socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 64) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000640), 0x800100, 0x0) (rerun: 64) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x2000000002) r7 = dup(r6) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x400000000000006) (async) mmap$qrtrtun(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000006, 0x10, r7, 0xffffffffffff7fff) (async) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0xffbfffff, @empty, 0x8}, 0x1c) (async) connect$netlink(r4, &(0x7f00000000c0)=@unspec, 0xc) socket$nl_route(0x10, 0x3, 0x0) (async) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000005c0)=0xc) 10.041767211s ago: executing program 2 (id=1623): syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') r0 = socket(0x1, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000001000104feffff7f0300000000000006", @ANYRES32=r3, @ANYBLOB="600000008008000008000300", @ANYRES32=r1], 0x35}, 0x1, 0xd, 0x0, 0x480c5}, 0x10) 9.87407387s ago: executing program 2 (id=1626): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000000200)='9p\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000340)={0x3, 0x1}, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r4 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f0000000080)="13", 0x1, 0xfffffffffffffffd) keyctl$read(0xb, r4, &(0x7f0000000240)=""/112, 0x349b7f55) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r5 = syz_open_dev$dvb_demux(0x0, 0x0, 0x20000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4040040}, 0x4001) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r5, 0x40146f2c, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002b40)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 8.008863626s ago: executing program 0 (id=1633): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000c00)=@newtfilter={0x84, 0x2c, 0xd2f, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x6558, r3, {}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0x58, 0x2, [@TCA_U32_SEL={0x54, 0x5, {0x4, 0x8, 0x4, 0x4, 0x2, 0x4, 0x6, 0x769, [{0x40, 0x2, 0x80000000, 0x401}, {0xfffffff9, 0x9, 0x2, 0x8}, {0x7, 0x7, 0x101, 0x2}, {0x1, 0x6, 0xfffffffc, 0xffff}]}}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) 7.719568898s ago: executing program 0 (id=1634): r0 = syz_usb_connect$uac2(0x3, 0x7b, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x2466, 0x8010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x9, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) pipe(&(0x7f0000000000)) unshare(0x400) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x6}, 0x1c) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x34) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) syz_open_procfs(0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000700)={0x2c, 0x0, &(0x7f00000005c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44d}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_connect$uac2(0x3, 0x7b, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x2466, 0x8010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x9, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0}) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) (async) pipe(&(0x7f0000000000)) (async) unshare(0x400) (async) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x6}, 0x1c) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x34) (async) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) (async) syz_open_procfs(0x0, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000700)={0x2c, 0x0, &(0x7f00000005c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44d}}, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$uac2(r0, 0x0, 0x0) (async) 7.318689034s ago: executing program 2 (id=1635): mmap(&(0x7f0000331000/0x2000)=nil, 0x2000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x185042, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) io_setup(0x5, 0x0) r3 = eventfd2(0x0, 0x80001) io_submit(0x0, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r3}]) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800, 0xfffffffffffffffd, 0x2000000000000}, 0x0, &(0x7f0000000080)={0x1f, 0x3, 0x9117}, 0x0, 0x0) shutdown(r2, 0x0) file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000240), 0x18, 0x800) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f00000002c0)={'NETMAP\x00'}, &(0x7f00000006c0)=0x1e) r4 = syz_open_dev$loop(&(0x7f0000000180), 0x800000000000006, 0x128202) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="34000000180000040000000000000000020080fdff02000700000004081005002343fe70100016800c000880080001"], 0x34}, 0x1, 0x0, 0x0, 0x20000845}, 0x24044800) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYBLOB="340000001100050026bd7000ffdbdf25070fef93", @ANYRES32=r6, @ANYBLOB="cfe819000000000014001a80100005"], 0x34}, 0x1, 0x0, 0x0, 0x2800c895}, 0x20040854) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000001ac0)={r0, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1a, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a85a056f5d759ded130e04d528539f3d328973747a75df8a69ea917deb7d6193b3e7772fd29f35239d200", "24431a1e77a68e174f000000000000000010e200", [0x0, 0x6]}}) r8 = dup(r4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r8}, &(0x7f0000000000), &(0x7f0000000040)=r8}, 0x20) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xec}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r8, 0x89f1, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r8, 0xc0189375, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000680)={r8, 0x20, &(0x7f0000000640)={0x0, 0x0, 0x0, &(0x7f0000000580)=""/149, 0x95}}, 0x10) 7.253920479s ago: executing program 3 (id=1636): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@rand_addr=0x64010101, @in=@rand_addr=0x64010101, 0x0, 0x8001, 0x4e24, 0x0, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x0, 0x0, 0x800, 0x7}, {0x0, 0x0, 0xe6}, 0x0, 0x20, 0x0, 0x0, 0x2}, {{@in=@multicast2, 0x404d3, 0x2b}, 0x0, @in=@loopback, 0x3506}}, 0xe8) socket$key(0xf, 0x3, 0x2) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @broadcast}, &(0x7f0000000240)=0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000280)={'ip6tnl0\x00', 0x0, 0x4, 0x7, 0x0, 0x6, 0xa, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7800, 0x10, 0x10, 0x2}}) r3 = getuid() socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) connect$unix(r5, &(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000340)={{{@in6=@empty, @in6=@remote, 0x4e21, 0x2, 0x4e20, 0xde35, 0x2, 0x20, 0xa0, 0x0, r2, r3}, {0x6, 0x100000001, 0x967, 0x7, 0xdb, 0x5, 0x6, 0x1fd}, {0x124be184, 0x5, 0x2, 0xe}, 0x3, 0x6e6bb9, 0x2, 0x0, 0x2, 0x4}, {{@in=@loopback, 0x4d4, 0xff}, 0x2, @in=@empty, 0x3501, 0x3, 0x2, 0x9, 0x2, 0x3ff, 0x9}}, 0xe8) syz_open_dev$vim2m(&(0x7f00000001c0), 0x9, 0x2) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0xc7c, 0x2) r8 = socket$inet6(0xa, 0x80002, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0xeae, 0x9, 0x5}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000804}, 0x20040084) sendmsg$nl_route_sched(r10, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x24, 0x2a, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r12, {0x10}, {}, {0xa, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x8000) sendto$inet6(r8, 0x0, 0x0, 0x240880c0, &(0x7f0000000140)={0xa, 0xe1f, 0x0, @mcast1}, 0x1c) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000640)=0x5, 0x21) sendto$inet6(r8, 0x0, 0x0, 0x4010, 0x0, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r7, 0xc008561c, &(0x7f0000000100)={0xf0f009, 0x2}) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000000406010100000000000000000700000d0500010006"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) 6.623483956s ago: executing program 3 (id=1637): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0xa, 0x0, 0x9, 0x50, 0x8, 0x2fa11, 0x401}, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x20, 0x0, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) tkill(r3, 0x7) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xcfa42, 0x0) sendfile(r4, r4, 0x0, 0x200000) tkill(r3, 0x27) ptrace$ARCH_SET_CPUID(0x1e, r3, 0x0, 0x1012) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x4808c1, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000dc0)={0x0, 0x1, 0x3, 0x0, 0x13, "00176a0000fcf7ffffa5e8673608f7ecfeff00"}) r6 = syz_open_pts(r5, 0x8182) dup3(r6, r5, 0x0) ioctl$TIOCMBIS(r5, 0x5416, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x154}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) socket(0x29, 0x2, 0x6) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r8, &(0x7f0000000040)=ANY=[], 0x118) gettid() sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000040900010073797a300000000068000000060a01040000000000000000010000004000048020000180070001007274000014000280080002400000000108000140000000031c0001800b00010072656a65637400000c000280080001400000000108000b40000000000900010073797a300000000014000000110001"], 0xf0}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[], 0x7c}}, 0x2000c450) 6.287794298s ago: executing program 4 (id=1638): r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000000100)="1c0000005e001f3814584707f9f4ffffff0000000d000000f3f800", 0x1b) 6.260161245s ago: executing program 2 (id=1639): sendmsg$NFT_MSG_GETCHAIN(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80a0}, 0x4000) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="c36100001001000061107e000000000004000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xd2, &(0x7f0000001ac0)=""/210, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = memfd_secret(0x0) r2 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000070904000001020d0000052406000105240000000d240f0100000000000000000006241a00000809058103000200fe000904010001020d00000904010102020d00000905820200020942f90905030210"], 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000140), 0x1, 0x2) ioctl$VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000040)={0x7, @win={{0xada7, 0x2, 0x6, 0x8}, 0x7, 0x4, 0x0, 0x2005, 0x0, 0x3}}) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) r4 = syz_usb_connect$hid(0x4, 0x3f, &(0x7f0000000140)=ANY=[@ANYBLOB="12010002000000206a05c9f4f67387191e1409022d00010109900009b5721778687105aa092100000701225f0d090581039f07a10780090502030004088306"], &(0x7f0000001a40)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x250, 0x2, 0x8, 0x7, 0xff, 0xff}, 0x18, &(0x7f0000001bc0)=ANY=[@ANYBLOB="400b00000210100a08e10000000f0001000000000003100b5f484880b7ec9114820590b666aec61da450b09225a5af70d9ceb96cced426", @ANYRESDEC=r0, @ANYRES32=r0, @ANYRES64=r1, @ANYRESDEC=r0, @ANYRESOCT=r2, @ANYRES8=r2], 0x7, [{0xe1, &(0x7f0000001cc0)=@string={0xe1, 0x3, "5a984c717b07f40d333e96ce5716a717129eb08648e0418fd197e2d0f37de2551d7ad4fbd487f69e728f3f98d87aa39f5c80508dca9ca6db928c021fe4aa905f38aaeb9096843285db8b225362a5d2b2872cff88beb5ef5f834fb631e7a0da9c55622ace1397cb7bbc3d54e9924b20b228fc21384f165d0bb8c2bbdf6fbffa5d4eabe636c76a5391c299311a01dd5e923836e974ec83e344bd4104ed6700cb3fb221557165794af2df7c65dbcbccc264f8a3ca8777b37c48fee02185c9351771c6eda848fd9a6196b288d6158fc065eaaf178bb8a486f7a0b3453be360a83c"}}, {0x4, &(0x7f0000001640)=@lang_id={0x4, 0x3, 0x861}}, {0x3a, &(0x7f0000000280)=@string={0x3a, 0x3, "c1c4054c34792f9df8624414a4dec9bde0480327a1ebea58432476f7b40ad5411e8fe4d3aab9bbbfc33c7b430fdb43c611e4a8ffd3be2a0a"}}, {0x4, &(0x7f0000001700)=@lang_id={0x4, 0x3, 0x44d}}, {0xe8, &(0x7f0000001780)=@string={0xe8, 0x3, "57425e8ef9c70867bcb1c80e1b0fc4dbbf36db3a56413738e897cf35c42dd479da576c826794581f795f3f444fd558f3c30a38ce675d364c7f4685f9423a31862b0c378eb9dceaa53c5df8a4e45403ab3d4db29bf77254278a43392478c309264ce9c52bb9af43563f2dbf84ad7f1c41f86ff38ee80a9e7a6f427b9a228789d0d6a0f6099f089e95f7f88411fbdd374e5abbd6ea1b2912c3227ac7a9fde6b6f48dfe055ab14ff3ff83c6e570eb679c79a5da12633aecce7563c8742b522b70ab89873644928dd5f1d0f62b0374a23569dc361e386508b719a09e86856f2e859d12686a9e0886"}}, {0xf2, &(0x7f0000001880)=@string={0xf2, 0x3, "54e6482a8f342799d6d8f902ce81b0a3f06b88dcf59643d72a04d7a93d23c5ed1ee9795aca244ef4a69a6724f2fa53e29739d6f3de25001a9b43d6ed3af0cc13bbb4251b2f1b02631cb198d1ff5cb6d62bbccd3b27fc3fb48d28dc0e17244578cf09cf84980e6e6a90c1da445531032eaf85fb61e7d89931dd46990635e4d411134915097c3e36532a6a1c01e496dc4182b846e6b5268c9ed86fd03f2e12fdb980e88cbafa9d29b5d09fa4254f24a1e2ae0c1ff407e7d1ecce75d5c1317cc689a34188250a0d058ae58a9bb9a54e827084ddaf06aad9873e56e6b8cee764248c7a9686a5a04982ea7b59376c9eaeb03f"}}, {0x90, &(0x7f0000001980)=@string={0x90, 0x3, "c11f5b942f74e3fbdfb1832f8442ecb0a840659c5b49a7286606cdeccde1f3715f17cc083ebddacd5a2bc47ba66714284f034db3bae0c7eba5ef093f20b49e9edc9c22ede659efa012530b741abe6de8232b93205ccedcc0da90c44734a976c4f6c0ab39820c0971b0723a4ad59196bbb094b117b5462cf143c8b661418a3ddbda6dfd6357ca420006fa124abf49"}}]}) syz_usb_control_io$hid(r4, &(0x7f0000000440)={0x24, &(0x7f00000002c0)={0x20, 0x5, 0x4c, {0x4c, 0x23, "aafb9850df283668d251c6775e2f9c24f9d16fe831cf2c29586b18a370f58db561789a1d63aeaee4bd319bd9524b4651a882dae40014188ae73ba38d5bb6062305800bc24adc4e5c8cd5"}}, &(0x7f0000001440)=ANY=[@ANYBLOB="0001000000395368ad2d59f4986222d096fd2993000a592f8f04fcda995241"], &(0x7f00000013c0)=ANY=[@ANYBLOB="0022123772000ad5b18bd3802a5e93e193d688830be06073"], &(0x7f00000003c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x8, 0x1, 0x1, {0x22, 0x256}}}}, &(0x7f0000000780)={0x2c, &(0x7f0000000480)=ANY=[@ANYBLOB="401523000000d9450fd2f5a3dcb7e47beb7f61ed5aa2270bb02faed98b5a33c63376438c696e4139e2"], &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x97}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0xe}, &(0x7f0000001c80)=ANY=[@ANYRES64=r4, @ANYRES8=0x0, @ANYRESHEX=r5, @ANYRESOCT, @ANYRES64=r1], &(0x7f0000000740)={0x20, 0x3, 0x1, 0x1a}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000c40)='attr/fscreate\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x22, 0x3, 0x50000}]}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000d00), 0xffffffffffffffff) syz_clone3(&(0x7f0000000080)={0x203818000, 0x0, 0x0, 0x0, {0x20080028}, 0x0, 0x0, 0x0, 0x0}, 0x58) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r9 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x10) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000588000/0x3000)=nil, 0x3000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r10, &(0x7f0000002140)={0x2020}, 0x2020) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000540)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x80, 0x1c, {0xf30, 0x2, 0xf, 0x7, 0xf, 0x40, 0x2, 0xfff, 0x7fff, 0x6, 0x5, 0x8}}, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xb, &(0x7f0000001580)=ANY=[@ANYBLOB="18000000010000000000000008000000180500002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000020b703000001000000850000000c00000095"], &(0x7f0000001500)='syzkaller\x00', 0xf, 0xff5, &(0x7f00000003c0)=""/4085, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7f}, 0x94) syz_usb_control_io$cdc_ncm(r2, &(0x7f0000001400)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 6.021457588s ago: executing program 0 (id=1641): ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(0xffffffffffffffff, 0x3b82, &(0x7f0000000000)={0x18, r0, 0xffffffee, 0x0, 0x0}) r1 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff000000004e04010000000000d3400202010000004704000001ed00007b130000000000001d440200000000007a0a00fe00ffffffc3030000e1000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af69912435f1a864a710aad58db6a6c3692e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5be14ecf7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e347a8ad880d2cd829b847400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c35b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af8612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5e69048ddff6da409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18ec0ae564162a27afea62d84f3a10746443d64364f50000e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc286463a2b1e992894269f478341d02d0f5ad4bcb524a5a17f48a7382f13d000000225d85ae49cee383dc5049076b98fb6853ab39e415140200000020cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a22048516d6aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe0e669e5e20100005353193f82ade69d0540059fe6c7fe7cd8697502c7596566d6740300da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc02290beaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24c87afce829ba0f85da6d8a8f18ea40ab959f6074ab2a4009b9e5f07ab5138aa6e3d37fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e6b0b384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208160fb04c98375b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27feeb741680f6f2f9a6a8346962a350845ffa0d829e4f79ad7d87906943408e6df3adbfd03aac93df8866fb010aecfed9092ca4d0f3e1116a0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a530600d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe92c7719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b1dba94a6ea80c33ead5722c3293986e02c8e0a6dda1eca493f14795bd068826fe8df15efaaeea831555877f958a19e499666a38d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a8784d0899ed888141e2fae6691d1aee1da02ba516467df3e7d1daac19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa57d2c93f49c47944fec01a8aa7749f3187e9efb00000000e0884160b765b07ec9ba020362310223c81e48d6d3b6e5b50d45248efe43a409773e3ed01cd663f3aaab9e1c0000f43b64bb54e5b30be3399e3dd1eb1cfd1935a323023fe5792879833c7eb356b95cfb135045b1d8f7da2fa5bfedef411d0791523a9e64c884e9dfed9cd413afe66bd8ee831cdb34726fe0434fbf44c7b33a853330bcaf37ba4e36705807468b37d32087e599165f1bce015145444ef5967b443222f46173cc876015b2d1874be9846f7c1653c02d2ef9a75fdc45820c69bbe1cb575f9aa21aa9d3d58bd5e5fe026142a72e24049b8400c4a28b2d5db8d5f53cb354fba19975fb0b3739baae51cb4b034993ef1463dcdba2da419b320420efdd091d7f6e83c8ac2ccc6c9392a42a33907421ab847c9590c213eda9a7e1db598a23e75a3c0933fc803ca994a86476b995c37c445f68fd"], &(0x7f00000001c0)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) close(r2) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, &(0x7f0000000400)) syz_usb_control_io$hid(r1, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000600)={0x3c, 0x0, 0x603, 0x70bd2c, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x808}, 0x10) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000001c0)={0x14, &(0x7f0000000040)=ANY=[@ANYBLOB="402a26000000260e0ca0707759a8b4c958297a7548aeceb8f27108f6802b5ee7c1ff7b3c598b9460ad5b2c4e"], &(0x7f00000000c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000003c0)={0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="003179000000fd502df3fd9f633c2968ee14fb"], &(0x7f0000000300)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x2}}) syz_usb_connect(0x1, 0x36, 0x0, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r4 = request_key(&(0x7f0000000340)='id_legacy\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f00000003c0)='/dev/vsock\x00', 0xfffffffffffffffe) request_key(&(0x7f0000000040)='id_legacy\x00', &(0x7f0000000900)={'syz', 0x0}, 0x0, r4) add_key(&(0x7f0000000940)='id_resolver\x00', &(0x7f0000000980)={'syz', 0x0}, &(0x7f0000000ac0)="44f36b5e4c4f1f4c98d84264ea2547def7d01c5839116a843dded2e1e58884ed4741c00aace16560f0f054baf14a7f7c0e6518380099b39ef7b5c9b6d93df1338ff9eda33d0f50b731b637b52d39d1b0fa2b5ddef3cd0d2ef201f3044a94f415be032c066233897199bcab65b311bd790e11d6ca25e238ab959d19fbf6ebcb874a73e3dc0b60e8d0d17c12acf5af6ee82299148a9093be5cdbbe55398a30c64d7e403d72eb1d14165cc8e509e180c7e803334e9ffe3076fd44a987f0efd54f47c71f5852f7294f391770aa8485c9e7674aabccdc997832592ac79790875db013db71aa08", 0xe4, r4) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000040)) 5.982414504s ago: executing program 4 (id=1642): capset(&(0x7f0000000440)={0x19980330}, &(0x7f0000000480)={0x7, 0x3ff, 0x962, 0x80000000, 0x4, 0x8}) socket$inet_udp(0x2, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, r3, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8800) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r5, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r6, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x800) 4.988340599s ago: executing program 0 (id=1645): keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x404000, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000100)={0x0}) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x1c3902, 0x0) sendfile(r1, r1, 0x0, 0x20f4ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) memfd_create(&(0x7f0000000180)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaaSc\xf3]WhI\xf4\x89\x85!mPl\x90\xa5\x93\x19\f\x9a\xae\xd5a\x9bU5\x1a\x86\x9d)5y\xef\x90\xea5\x81\xfeO;\xd4zh?\xbdW\xe0\x84\xe6\x9d\xcb\xcd\xb6\xad3\x7fWY\x02\xa2\x8baG\x00\x0e\x8e/\xc1\xaf\xd0\xbcH9\x04\x00\x00\x00z\x16\xdf\xf3hLpLaA\x89n]>,^M\x82\x8e\xe40\x97_\x809y)Z\xeb\x9d\xbawv\xe9\xc0\x16\xdc\xf5\xcb\xdb\x96\xd6\xba@\xa7\x1bl\xca\xe0\x1e3\x81\xc6S\x86\xf7\xf0\xba\x1b\x14N\xa2\x04\xdb\xb5X\xe4y\xef\xe8\xdb\xd5r\x11\xfb\xe4v\xbcV\xbb\x00\x96CR\xe0~5\x16=:A2\x9c\b\xd9\xa0CB\r\xe9\xb8$\xfe\x8d\xb1Gg\xa9\xac<\xbf\x10]\b9\xd9\x89\xaf\xa6\xd1\x10\x1fq\xba\x06_NW\xdb67Xv(\xa8\xce\x1b\xe6\xbd\x947\x8f)8\xe5\xb3\xac;\x7f+\xf67\xea\x1ei\x92w-)\xa1B/M\x0e7:9\xdb~V\xb7\xd5\x13^v\x14\xe6O\xea\x00\x87\x8dkG\xdf%\xebe\x83\xb97\x01| \xb3\xd8W\xe8o\x17\x97\xd9\x14o\x92\xb9\x9a\x8c\xd7\xcf\xa2\x11\xc3\xa5\xb3\xd2\xdeQ\xa7\x05\x7f\x99Lq(\xcd\\\xa2y\x14or\x1efn\xf2\x97\x96c\xda7\t,', 0x5) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0x301, 0xffffffffffbffff4) memfd_create(&(0x7f0000000040)='\x02R\xbb\xcf\x87T\xff\x00\x00\xe4G\xc1p\xd1\xac\x80\x00\x00\x00\x00\x00\x00\x7f|S', 0xc) get_mempolicy(0x0, 0x0, 0x203, &(0x7f0000394000/0x3000)=nil, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40801}, 0x4040850) unshare(0x8040480) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, 0x0, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a54000000030a0fdb00000000000000000a0060050900030073797a30000000000900010073797a310000000014000480080002403cb140bb08000140000000030a000700726f757465000000080005400000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) socket$pppl2tp(0x18, 0x1, 0x1) 4.866891459s ago: executing program 4 (id=1646): mknod(&(0x7f0000000040)='./file0\x00', 0x800, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x801) io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0xc8a0, 0xc000, 0x8, 0x23}) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={0x0, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000380), 0x1000a) mmap(&(0x7f0000105000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0xfffff000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r3) close(0xffffffffffffffff) close(r2) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r4, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) 3.449442936s ago: executing program 4 (id=1649): mmap(&(0x7f0000331000/0x2000)=nil, 0x2000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x185042, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) io_setup(0x5, 0x0) r3 = eventfd2(0x0, 0x80001) io_submit(0x0, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r3}]) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800, 0xfffffffffffffffd, 0x2000000000000}, 0x0, &(0x7f0000000080)={0x1f, 0x3, 0x9117}, 0x0, 0x0) shutdown(r2, 0x0) file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000240), 0x18, 0x800) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f00000002c0)={'NETMAP\x00'}, &(0x7f00000006c0)=0x1e) r4 = syz_open_dev$loop(&(0x7f0000000180), 0x800000000000006, 0x128202) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="34000000180000040000000000000000020080fdff02000700000004081005002343fe70100016800c000880080001"], 0x34}, 0x1, 0x0, 0x0, 0x20000845}, 0x24044800) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYBLOB="340000001100050026bd7000ffdbdf25070fef93", @ANYRES32=r6, @ANYBLOB="cfe819000000000014001a80100005"], 0x34}, 0x1, 0x0, 0x0, 0x2800c895}, 0x20040854) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000001ac0)={r0, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1a, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a85a056f5d759ded130e04d528539f3d328973747a75df8a69ea917deb7d6193b3e7772fd29f35239d200", "24431a1e77a68e174f000000000000000010e200", [0x0, 0x6]}}) r8 = dup(r4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r8}, &(0x7f0000000000), &(0x7f0000000040)=r8}, 0x20) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xec}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r8, 0x89f1, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r8, 0xc0189375, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000680)={r8, 0x20, &(0x7f0000000640)={0x0, 0x0, 0x0, &(0x7f0000000580)=""/149, 0x95}}, 0x10) 2.650882124s ago: executing program 3 (id=1651): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'ipvlan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x41, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r1}, @IFLA_HSR_SLAVE2={0x8, 0x2, r2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) 2.270741767s ago: executing program 1 (id=1652): r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000000100)="1c0000005e001f3814584707f9f4ffffff0000000d000000f3f800", 0x1b) 2.001286938s ago: executing program 4 (id=1653): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) r1 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8d32}) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f0000000080)=ANY=[@ANYRESDEC, @ANYRESHEX=r0], 0x0, 0x0, 0x0, 0x0}, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) (async) socket$kcm(0xa, 0x5, 0x0) (async) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) (async) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8d32}) (async) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f0000000080)=ANY=[@ANYRESDEC, @ANYRESHEX=r0], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) 1.992716586s ago: executing program 1 (id=1654): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda) listen(r0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0x6, 0x3, 0x40, 0x6, '\x00', 0x4000040}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.911248212s ago: executing program 3 (id=1655): ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(0xffffffffffffffff, 0x3b82, &(0x7f0000000000)={0x18, r0, 0xffffffee, 0x0, 0x0}) r1 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff000000004e04010000000000d3400202010000004704000001ed00007b130000000000001d440200000000007a0a00fe00ffffffc3030000e1000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af69912435f1a864a710aad58db6a6c3692e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5be14ecf7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e347a8ad880d2cd829b847400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c35b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af8612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5e69048ddff6da409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18ec0ae564162a27afea62d84f3a10746443d64364f50000e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc286463a2b1e992894269f478341d02d0f5ad4bcb524a5a17f48a7382f13d000000225d85ae49cee383dc5049076b98fb6853ab39e415140200000020cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a22048516d6aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe0e669e5e20100005353193f82ade69d0540059fe6c7fe7cd8697502c7596566d6740300da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc02290beaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24c87afce829ba0f85da6d8a8f18ea40ab959f6074ab2a4009b9e5f07ab5138aa6e3d37fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e6b0b384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208160fb04c98375b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27feeb741680f6f2f9a6a8346962a350845ffa0d829e4f79ad7d87906943408e6df3adbfd03aac93df8866fb010aecfed9092ca4d0f3e1116a0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a530600d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe92c7719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b1dba94a6ea80c33ead5722c3293986e02c8e0a6dda1eca493f14795bd068826fe8df15efaaeea831555877f958a19e499666a38d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a8784d0899ed888141e2fae6691d1aee1da02ba516467df3e7d1daac19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa57d2c93f49c47944fec01a8aa7749f3187e9efb00000000e0884160b765b07ec9ba020362310223c81e48d6d3b6e5b50d45248efe43a409773e3ed01cd663f3aaab9e1c0000f43b64bb54e5b30be3399e3dd1eb1cfd1935a323023fe5792879833c7eb356b95cfb135045b1d8f7da2fa5bfedef411d0791523a9e64c884e9dfed9cd413afe66bd8ee831cdb34726fe0434fbf44c7b33a853330bcaf37ba4e36705807468b37d32087e599165f1bce015145444ef5967b443222f46173cc876015b2d1874be9846f7c1653c02d2ef9a75fdc45820c69bbe1cb575f9aa21aa9d3d58bd5e5fe026142a72e24049b8400c4a28b2d5db8d5f53cb354fba19975fb0b3739baae51cb4b034993ef1463dcdba2da419b320420efdd091d7f6e83c8ac2ccc6c9392a42a33907421ab847c9590c213eda9a7e1db598a23e75a3c0933fc803ca994a86476b995c37c445f68fd"], &(0x7f00000001c0)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) close(r2) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, &(0x7f0000000400)) syz_usb_control_io$hid(r1, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000600)={0x3c, 0x0, 0x603, 0x70bd2c, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x808}, 0x10) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000001c0)={0x14, &(0x7f0000000040)=ANY=[@ANYBLOB="402a26000000260e0ca0707759a8b4c958297a7548aeceb8f27108f6802b5ee7c1ff7b3c598b9460ad5b2c4e"], &(0x7f00000000c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000003c0)={0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="003179000000fd502df3fd9f633c2968ee14fb"], &(0x7f0000000300)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x2}}) syz_usb_connect(0x1, 0x36, 0x0, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r4 = request_key(&(0x7f0000000340)='id_legacy\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f00000003c0)='/dev/vsock\x00', 0xfffffffffffffffe) request_key(&(0x7f0000000040)='id_legacy\x00', &(0x7f0000000900)={'syz', 0x0}, 0x0, r4) add_key(&(0x7f0000000940)='id_resolver\x00', &(0x7f0000000980)={'syz', 0x0}, &(0x7f0000000ac0)="44f36b5e4c4f1f4c98d84264ea2547def7d01c5839116a843dded2e1e58884ed4741c00aace16560f0f054baf14a7f7c0e6518380099b39ef7b5c9b6d93df1338ff9eda33d0f50b731b637b52d39d1b0fa2b5ddef3cd0d2ef201f3044a94f415be032c066233897199bcab65b311bd790e11d6ca25e238ab959d19fbf6ebcb874a73e3dc0b60e8d0d17c12acf5af6ee82299148a9093be5cdbbe55398a30c64d7e403d72eb1d14165cc8e509e180c7e803334e9ffe3076fd44a987f0efd54f47c71f5852f7294f391770aa8485c9e7674aabccdc997832592ac79790875db013db71aa08", 0xe4, r4) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000040)) 1.756644512s ago: executing program 2 (id=1656): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r0, 0xf503, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x460, 0x258, 0x268, 0x311, 0x258, 0x268, 0x390, 0x460, 0x460, 0x390, 0x460, 0x9, 0x0, {[{{@uncond, 0x160, 0x230, 0x258, 0x0, {0x9401}, [@common=@inet=@hashlimit2={{0x150}, {'hsr0\x00', {0x0, 0x9, 0x0, 0x0, 0x0, 0x5, 0x9}}}, @common=@unspec=@time={{0x38}, {0x0, 0x0, 0x0, 0xfffffffc}}]}, @common=@unspec=@NFQUEUE2={0x28}}, {{@uncond, 0x0, 0xd0, 0x138, 0xe4030000, {}, [@common=@ipv6header={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4c0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000010d804dd00000000000001090224000100000000090400000103000000092105000001220500090581030002"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) ppoll(&(0x7f0000000540)=[{}, {0xffffffffffffffff, 0x85}], 0x2, 0x0, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upt trusted:\x00'/24], 0x18, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) syz_usb_control_io(r2, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r4, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mincore(&(0x7f0000210000/0x3000)=nil, 0x3000, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000380)=[{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000600)="4fffe3ab59ae73fbb0d00ec31d80de9be9d8dd980cbcaee82f55347b63a9208372b62ee9b4b41c9a5e65a22dd6fb36b716b8dae8093edd78f440a3b4f000fe67eb7fbd7ea83559114724cf7cb29f2df5", 0x50}, {&(0x7f0000000700)="0182d70e3cd9cc3f39117f2a4367a40edd7898dd2f2df89f8651dbf90eb66017d090029d3f546d8623ee74a37cd0386ccea7cf44a20eec4b2cc050c46070169a80d3346ec8f7746c0a61b92fdc4484327c06460b875d04f4c30a3a4d739c9c6a4d3d5c760026514414941627aafaeb261bab05df31b071f22295d0d4aef40585b75fc25b682e4aca9c1859d1415d8c4164866c1fff300d7d38ba88348791f99e430a", 0xa2}], 0x2, &(0x7f0000000440)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x28044854}], 0x1, 0x804) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000800)=""/77, 0x4d}, {&(0x7f0000000200)=""/47, 0x2f}], 0x2}, 0x40010043) syz_usb_ep_write(r2, 0x81, 0x1, &(0x7f00000006c0)='P') sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2800000041000901feffffff00000000037c0000040042800c00018006000600"], 0x28}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 1.698500608s ago: executing program 1 (id=1657): ioctl$F2FS_IOC_SET_PIN_FILE(0xffffffffffffffff, 0x4004f50d, 0x0) r0 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000500)={0x0, 0x1, 0x10000, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90d, 0x7, '\x00', @p_u32=&(0x7f0000000580)=0xfffffffe}}) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f00000000c0)={0x2, 0xfffa, @empty}, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x12, 0x4, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1, 0x0, @multicast1, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) 1.13089885s ago: executing program 1 (id=1658): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="e7ffffff02000000040000001900000000200000", @ANYRES64=r0, @ANYBLOB='\x00'/20, @ANYRES32=r0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0d00000007000000040000000100000000000000"], 0x50) r1 = socket$tipc(0x1e, 0x7, 0x0) sendmsg$tipc(r1, &(0x7f0000000700)={&(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x3, {0x40, 0x4, 0x2}}, 0x10, &(0x7f0000000600)=[{&(0x7f0000000280)="f67f0ac1ae6d55c212fada6ca2fdf151e9cb7d09ba6ca174707054f779190dbb861529d994c4328b99b4a97b505e773cff57bea02b0bfd02aa960e5f37e18d102246cf1e27b90589b0d07fae0f191056d5a724cb4a5e77ffb5cddc1eda04942f7b315900fee072304ddf3da8d35b3c8811cd1206aac9f5cc926e564c5f037ca28a0a3e1d467cf5f97341de62ddb540246e25b75f364686728dca98f1d3e1004332810c5db6a63b29940bd3c951a3f287322fe4e5fd30d3d69eefe9b47fc2ba18d7de2bb28692201d7dc3bb2b924130dcb0f48eed904969f8d9530f1e46ec8b30da2e5297781499ebc6c5b63e4e0ba87d77b5d665a6", 0xf5}, {&(0x7f0000000540)="25e3911d3b4dcb9d4461e931fd0e8270943cc63f57aacb6f968e0f5384d7ba0a15eb4ef598bd6b565ae126b6c9890941c0e1921b34b3ff451116d49289a8fef6dcd3f4f6016883c1396d29812a8da67e9d85842d95232cddf765c2e617e7c784cec9169668c1ddf9a92bc2b5cb4bad93834054aa42a19e3301d2af377863f594115b701b823fae", 0x87}], 0x2, &(0x7f0000000640)="8937241e5e9ea4d59b488ca822778c5c4acb588dbade18b94a87b8fbbb3ef7389a4c981290e7511ea5950d3d96a5eb1825a18b6122481dc4036e441d2b19aa8eefe2b0b7c481abac69f8eeae773890496d42487cc94cadbc856034d1a90c2c2ef7bfb8e7ab0c537524d7903df13737445eb26fc401e92fb14d8e3790d5ed40ad8dc74b7b30ea21ca7d9a1e3fa87f72fe290b6a9c2687e4889778a67bae439b7660b8a7099701a205b6db81abafe70893ae898a9d", 0xb4, 0x8040}, 0x20000080) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000080)) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r3 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r3, &(0x7f0000000240), 0x10) connect$vsock_stream(r3, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) 918.803538ms ago: executing program 0 (id=1659): syz_emit_ethernet(0x3e, &(0x7f0000000380)={@local, @remote, @val={@void, {0x8100, 0x3, 0x1, 0x3}}, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010102, @local, {[@timestamp_prespec={0x44, 0x4, 0xbe}]}}, {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000040)=0x3) set_mempolicy(0x8006, 0x0, 0x5) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) socket(0x2, 0x80805, 0x0) close(0x3) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/sockstat\x00') getsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000000180)={@mcast2, 0x0}, 0x0) bind$packet(r2, &(0x7f00000002c0)={0x11, 0x0, r3, 0x1, 0x1, 0x6, @local}, 0x14) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r4, 0x5404) write$sequencer(r4, &(0x7f0000000080)=[@t={0x81, 0x5, 0x0, 0x9}], 0x8) pread64(r2, &(0x7f0000000500)=""/8, 0x8, 0xffffffff) openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x30, 0x10, 0x801, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x104}, [@IFLA_MASTER={0x8}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x30}}, 0x4) bind$inet(r5, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00 \x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000400000000000000000000000000000000000000005e7128cf8537d7d8d364609846c658d9ee1342b2473f3403063ac4bc34a763617340140c0125bc62b89cf151f75d1f9cb51ce2df243c1e1e07904d4ed233a012bcdebccdf3b9aa0f4575e02f4de777154685cf619349c4de8202a0fda01f74c6407f3912c7a154ac218b4bc6058f405ffd8ecc42cb3ade94d622370567089143ac0a6730f4b9d2008396e16a0bf82b54562db8f6e0703e45c3907ad9e9ede5b848394c71f5418c3bf736c01b0eab8882cb2c8ec54aafa2f4d1b01b989afcbf33243ad8c98169b39f"], 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000400)=ANY=[@ANYRES64, @ANYRES32=r8, @ANYBLOB, @ANYRES32=r7, @ANYRES8=r1], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x5054}, 0x94) syz_usb_ep_read(0xffffffffffffffff, 0x2, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000003c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x420000, 0x0) 901.371534ms ago: executing program 1 (id=1660): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x0) close(0x3) close(0x4) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r2) r3 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r3, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004091) write$cgroup_devices(r2, &(0x7f0000000100)=ANY=[], 0xfffffeff) sendmsg$kcm(r0, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x2400c094) 546.732661ms ago: executing program 3 (id=1661): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b00"/11], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1, 0x10, 0x0, &(0x7f0000001fc0)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_generic(r0, 0x0, 0x4008094) ioctl$XFS_IOC_AG_GEOMETRY(r1, 0xc080583d, &(0x7f0000000200)={0x7a, 0x7, 0x7, 0xc31a, 0x4, 0x81, 0x8, 0x800}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000001080)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x41, 0x0, @multicast2}, 0x20020003}}, 0x2e) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x2}}, 0x2e) r5 = timerfd_create(0x1, 0x800) close(r5) r6 = socket(0x1e, 0x1, 0x0) connect$tipc(r6, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r6, &(0x7f0000000340), 0x2000011a) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r8, 0x1, 0x0, 0x7000000, {{}, {}, {0x8, 0x11, 0x2007ff}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$NFT_MSG_GETGEN(r6, 0x0, 0x40000) r9 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r9, 0x1, 0x25, &(0x7f0000000540)=0x550, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) sendto$inet6(r9, 0x0, 0x0, 0x20000080, &(0x7f0000006080)={0xa, 0x4e1f, 0x80000004, @loopback, 0x55}, 0x1c) sendmsg$IPVS_CMD_NEW_DAEMON(r6, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c850}, 0x4000005) 446.963046ms ago: executing program 4 (id=1662): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x10004, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100}, 0x0) close(0xffffffffffffffff) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) 0s ago: executing program 1 (id=1663): mmap(&(0x7f0000331000/0x2000)=nil, 0x2000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x185042, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) io_setup(0x5, 0x0) r3 = eventfd2(0x0, 0x80001) io_submit(0x0, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r3}]) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800, 0xfffffffffffffffd, 0x2000000000000}, 0x0, &(0x7f0000000080)={0x1f, 0x3, 0x9117}, 0x0, 0x0) shutdown(r2, 0x0) file_getattr(0xffffffffffffffff, 0x0, &(0x7f0000000240), 0x18, 0x800) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f00000002c0)={'NETMAP\x00'}, &(0x7f00000006c0)=0x1e) r4 = syz_open_dev$loop(&(0x7f0000000180), 0x800000000000006, 0x128202) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="34000000180000040000000000000000020080fdff02000700000004081005002343fe70100016800c000880080001"], 0x34}, 0x1, 0x0, 0x0, 0x20000845}, 0x24044800) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYBLOB="340000001100050026bd7000ffdbdf25070fef93", @ANYRES32=r6, @ANYBLOB="cfe819000000000014001a80100005"], 0x34}, 0x1, 0x0, 0x0, 0x2800c895}, 0x20040854) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000001ac0)={r0, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1a, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a85a056f5d759ded130e04d528539f3d328973747a75df8a69ea917deb7d6193b3e7772fd29f35239d200", "24431a1e77a68e174f000000000000000010e200", [0x0, 0x6]}}) r8 = dup(r4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r8}, &(0x7f0000000000), &(0x7f0000000040)=r8}, 0x20) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xec}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r8, 0x89f1, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r8, 0xc0189375, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000680)={r8, 0x20, &(0x7f0000000640)={0x0, 0x0, 0x0, &(0x7f0000000580)=""/149, 0x95}}, 0x10) kernel console output (not intermixed with test programs): 359.389863][ T9] usb 1-1: USB disconnect, device number 45 [ 359.437415][ T9953] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 359.451905][ T1603] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 359.498440][ T9954] syzkaller1: entered promiscuous mode [ 359.531154][ T9954] syzkaller1: entered allmulticast mode [ 359.637451][ T1603] usb 2-1: config 0 has an invalid interface number: 255 but max is 0 [ 359.656106][ T1603] usb 2-1: config 0 has no interface number 0 [ 359.683799][ T1603] usb 2-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 359.697690][ T1603] usb 2-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 359.712935][ T1603] usb 2-1: config 0 interface 255 has no altsetting 0 [ 359.724854][ T1603] usb 2-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 359.735636][ T1603] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.744166][ T1603] usb 2-1: Product: syz [ 359.749459][ T1603] usb 2-1: Manufacturer: syz [ 359.755501][ T1603] usb 2-1: SerialNumber: syz [ 359.786117][ T1603] usb 2-1: config 0 descriptor?? [ 359.828100][ T9960] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1298'. [ 360.019111][ T9947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 360.053992][ T9947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.096047][ T1603] usb 2-1: ignoring: probably an ADSL modem [ 360.498684][ T1603] cxacru 2-1:0.255: usbatm_usb_probe: bind failed: -19! [ 361.295116][ T5764] usb 2-1: USB disconnect, device number 46 [ 361.753547][ T5624] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 361.861648][ T5764] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 362.041865][ T5764] usb 2-1: Using ep0 maxpacket: 32 [ 362.062907][ T5764] usb 2-1: unable to get BOS descriptor or descriptor too short [ 362.093536][ T5764] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 362.128047][ T5688] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 362.141615][ T5764] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 362.156389][ T30] kauditd_printk_skb: 1691 callbacks suppressed [ 362.156429][ T30] audit: type=1326 audit(1784216905.146:6611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9974 comm="syz.3.1304" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff3a5f9de59 code=0x7ffc0000 [ 362.221687][ T5764] usb 2-1: config 14 has no interface number 0 [ 362.241984][ T5764] usb 2-1: config 14 has no interface number 1 [ 362.278338][ T30] audit: type=1326 audit(1784216905.206:6612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9974 comm="syz.3.1304" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7ff3a5f97bd7 code=0x7ffc0000 [ 362.309499][ T5764] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 362.350391][ T30] audit: type=1326 audit(1784216905.216:6613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9974 comm="syz.3.1304" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff3a5f3f1d9 code=0x7ffc0000 [ 362.361719][ T5688] usb 5-1: Using ep0 maxpacket: 32 [ 362.397240][ T5764] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 362.429739][ T30] audit: type=1326 audit(1784216905.226:6614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9974 comm="syz.3.1304" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7ff3a5f97bd7 code=0x7ffc0000 [ 362.430840][ T5764] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 362.487080][ T5688] usb 5-1: unable to get BOS descriptor or descriptor too short [ 362.504492][ T5688] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 362.513031][ T5688] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 362.534675][ T5688] usb 5-1: config 14 has no interface number 0 [ 362.550440][ T30] audit: type=1326 audit(1784216905.226:6615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9974 comm="syz.3.1304" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff3a5f3f1d9 code=0x7ffc0000 [ 362.554304][ T5688] usb 5-1: config 14 has no interface number 1 [ 362.586130][ T5764] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 362.612735][ T5764] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 362.650354][ T5764] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 362.669467][ T5688] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 362.690830][ T30] audit: type=1326 audit(1784216905.226:6616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9974 comm="syz.3.1304" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7ff3a5f97bd7 code=0x7ffc0000 [ 362.718844][ T5688] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 362.736474][ T5764] usb 2-1: config 14 interface 57 has no altsetting 0 [ 362.747491][ T5764] usb 2-1: config 14 interface 228 has no altsetting 0 [ 362.763429][ T5688] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 362.783448][ T5764] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 362.799195][ T5764] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.808263][ T5688] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 362.827416][ T5764] usb 2-1: Product: syz [ 362.835173][ T5688] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 362.846992][ T5764] usb 2-1: Manufacturer: syz [ 362.856183][ T5764] usb 2-1: SerialNumber: syz [ 362.865088][ T30] audit: type=1326 audit(1784216905.226:6617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9974 comm="syz.3.1304" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff3a5f3f1d9 code=0x7ffc0000 [ 362.872447][ T5688] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 362.959749][ T5688] usb 5-1: config 14 interface 57 has no altsetting 0 [ 362.970015][ T30] audit: type=1326 audit(1784216905.236:6619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9974 comm="syz.3.1304" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7ff3a5f97bd7 code=0x7ffc0000 [ 363.006244][ T5688] usb 5-1: config 14 interface 228 has no altsetting 0 [ 363.032117][ T5688] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 363.044117][ T30] audit: type=1326 audit(1784216905.246:6620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9974 comm="syz.3.1304" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff3a5f3f1d9 code=0x7ffc0000 [ 363.073461][ T5688] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.099883][ T5688] usb 5-1: Product: syz [ 363.110884][ T30] audit: type=1326 audit(1784216905.246:6621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9974 comm="syz.3.1304" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7ff3a5f97bd7 code=0x7ffc0000 [ 363.137967][ T5688] usb 5-1: Manufacturer: syz [ 363.147052][ T9974] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 363.151623][ T24] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 363.176397][ T5688] usb 5-1: SerialNumber: syz [ 363.325828][ T5764] legousbtower 2-1:14.57: interrupt endpoints not found [ 363.426095][ T9996] trusted_key: encrypted_key: key user:syz not found [ 363.628629][ T5688] legousbtower 5-1:14.57: interrupt endpoints not found [ 363.741301][ T5764] legousbtower 2-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 363.757041][ T5764] legousbtower 2-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 364.029373][ T5688] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 126.131 build 57981 [ 364.070378][ T5688] legousbtower 5-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 364.513987][ T5688] usb 2-1: USB disconnect, device number 47 [ 364.553989][ T5688] legousbtower 2-1:14.228: LEGO USB Tower #-160 now disconnected [ 364.797619][ T9992] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 364.819254][ T9992] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 365.003061][ T5624] usb 1-1: device descriptor read/64, error -71 [ 365.281587][ T5624] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 365.475751][ T5624] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 365.491689][ T5624] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 365.508249][ T5624] usb 1-1: config 0 descriptor?? [ 365.564924][ T5688] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 365.731570][ T5688] usb 4-1: Using ep0 maxpacket: 8 [ 365.743383][ T5688] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 365.745551][T10005] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 365.753468][ T5688] usb 4-1: config 0 has no interface number 0 [ 365.771335][ T5688] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 365.782725][T10005] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 365.787678][ T5688] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 365.803374][ T5688] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 365.827636][ T5688] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 365.855537][ T5688] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 365.881695][ T5633] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 365.890692][ T5688] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 365.930598][ T5688] usb 4-1: config 0 descriptor?? [ 365.935227][ T5624] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 365.954855][ T5688] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 365.970592][ T5624] [drm:udl_init] *ERROR* Selecting channel failed [ 366.038578][ T5624] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 2 [ 366.047403][ T5624] [drm] Initialized udl on minor 2 [ 366.053796][ T5633] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 366.078992][ T5624] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 366.089010][ T5633] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 366.089790][ T5688] usb 5-1: USB disconnect, device number 50 [ 366.102869][ T5624] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 366.119128][ T1603] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 366.128070][ T5633] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 366.142162][ T1603] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 366.155549][ T5633] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 366.169936][ T1603] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 366.180972][ T5633] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 366.192834][ T5633] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 366.201403][ T5633] usb 3-1: Manufacturer: syz [ 366.214429][ T5624] usb 1-1: USB disconnect, device number 47 [ 366.223726][ T5633] usb 3-1: config 0 descriptor?? [ 366.239510][ T5688] legousbtower 5-1:14.228: LEGO USB Tower #-159 now disconnected [ 366.642804][ T5633] hid_parser_main: 45 callbacks suppressed [ 366.642828][ T5633] appleir 0003:05AC:8243.0010: unknown main item tag 0x0 [ 366.702359][ T5633] appleir 0003:05AC:8243.0010: hiddev1,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 366.845926][T10032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 366.872567][T10032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 366.875097][ T1603] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 366.959507][T10052] netlink: 'syz.4.1329': attribute type 14 has an invalid length. [ 367.078051][ T1603] usb 1-1: Using ep0 maxpacket: 8 [ 367.094540][ T1603] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 367.125826][ T1603] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 367.155241][ T1603] usb 1-1: can't read configurations, error -61 [ 367.312054][ T1603] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 367.483030][ T1603] usb 1-1: Using ep0 maxpacket: 8 [ 367.497756][ T1603] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 367.523429][ T1603] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 367.545919][ T1603] usb 1-1: can't read configurations, error -61 [ 367.572150][ T1603] usb usb1-port1: attempt power cycle [ 367.951681][ T1603] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 367.984131][ T1603] usb 1-1: Using ep0 maxpacket: 8 [ 367.991302][ T1603] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 368.007240][ T1603] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 368.015859][ T1603] usb 1-1: can't read configurations, error -61 [ 368.173526][ T1603] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 368.219842][ T1603] usb 1-1: Using ep0 maxpacket: 8 [ 368.232434][ T1603] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 368.259528][ T1603] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 368.292754][ T1603] usb 1-1: can't read configurations, error -61 [ 368.311986][ T1603] usb usb1-port1: unable to enumerate USB device [ 368.457566][ T30] kauditd_printk_skb: 203 callbacks suppressed [ 368.457583][ T30] audit: type=1326 audit(1784216911.456:6824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10075 comm="syz.3.1338" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff3a5f9de59 code=0x0 [ 368.512036][ T5688] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 368.675342][ T5688] usb 2-1: config 0 has an invalid interface number: 255 but max is 0 [ 368.694304][ T5688] usb 2-1: config 0 has no interface number 0 [ 368.711423][ T5688] usb 2-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 368.725095][ T24] usb 3-1: USB disconnect, device number 47 [ 368.726047][T10082] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 368.758120][ T5688] usb 2-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 368.776938][ T5688] usb 2-1: config 0 interface 255 has no altsetting 0 [ 368.797491][ T5688] usb 2-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 368.807662][ T5688] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.835118][ T5688] usb 2-1: Product: syz [ 368.843660][ T5688] usb 2-1: Manufacturer: syz [ 368.848601][ T5688] usb 2-1: SerialNumber: syz [ 368.875339][ T5764] usb 5-1: new full-speed USB device number 51 using dummy_hcd [ 368.898596][ T5688] usb 2-1: config 0 descriptor?? [ 369.076039][ T5764] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 369.092775][ T5764] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 369.105037][ T5764] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 369.117561][ T5764] usb 5-1: New USB device found, idVendor=05ac, idProduct=0324, bcdDevice= 0.00 [ 369.128014][ T5764] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.160510][T10069] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 369.184797][T10069] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 369.222446][ T24] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 369.235856][ T5764] usb 5-1: config 0 descriptor?? [ 369.319901][ T5688] usb 2-1: ignoring: probably an ADSL modem [ 369.441638][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 369.452848][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 369.464636][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 369.475698][ T24] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 369.501542][ T0] NOHZ tick-stop error: local softirq work is pending, handler #102!!! [ 369.520381][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.553201][ T24] usb 3-1: config 0 descriptor?? [ 369.701542][ T0] NOHZ tick-stop error: local softirq work is pending, handler #102!!! [ 369.723440][ T5688] cxacru 2-1:0.255: usbatm_usb_probe: bind failed: -19! [ 369.787563][T10100] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 369.844140][T10100] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 369.889286][T10083] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1340'. [ 369.927924][T10083] netlink: 'syz.4.1340': attribute type 1 has an invalid length. [ 369.952334][T10083] netlink: 'syz.4.1340': attribute type 2 has an invalid length. [ 369.978364][ T5764] hid (null): report_id 50709 is invalid [ 369.987718][ T5764] hid (null): invalid report_size -1989051830 [ 370.022028][ T5764] hid (null): invalid report_size 1077464617 [ 370.036024][ T5764] magicmouse 0003:05AC:0324.0011: unknown main item tag 0x0 [ 370.044200][ T5764] magicmouse 0003:05AC:0324.0011: unknown main item tag 0x0 [ 370.053369][ T5764] magicmouse 0003:05AC:0324.0011: unknown main item tag 0x0 [ 370.062101][ T5764] magicmouse 0003:05AC:0324.0011: unknown main item tag 0x0 [ 370.070933][ T5764] magicmouse 0003:05AC:0324.0011: unknown main item tag 0x0 [ 370.082715][ T5764] magicmouse 0003:05AC:0324.0011: unknown main item tag 0x0 [ 370.090275][ T5764] magicmouse 0003:05AC:0324.0011: unknown main item tag 0x0 [ 370.108037][ T5764] magicmouse 0003:05AC:0324.0011: unknown main item tag 0x0 [ 370.118582][ T24] corsair 0003:1B1C:1B02.0012: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.2-1/input0 [ 370.141815][ T5764] magicmouse 0003:05AC:0324.0011: unknown main item tag 0x0 [ 370.158378][ T5764] magicmouse 0003:05AC:0324.0011: report_id 50709 is invalid [ 370.180946][ T5764] magicmouse 0003:05AC:0324.0011: item 0 2 1 8 parsing failed [ 370.203001][ T5764] magicmouse 0003:05AC:0324.0011: magicmouse hid parse failed [ 370.246807][ T5764] magicmouse 0003:05AC:0324.0011: probe with driver magicmouse failed with error -22 [ 370.293026][ T5764] usb 5-1: USB disconnect, device number 51 [ 370.430181][ T5633] usb 2-1: USB disconnect, device number 48 [ 370.592848][ T1603] usb 3-1: USB disconnect, device number 48 [ 371.070823][T10112] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1348'. [ 371.202864][T10115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 371.239493][T10115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 371.349795][T10118] openvswitch: netlink: IP tunnel dst address not specified [ 371.441033][T10120] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 371.501935][T10124] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1354'. [ 371.708461][T10131] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1357'. [ 371.738127][T10136] openvswitch: netlink: Flow actions attr not present in new flow. [ 371.749755][T10131] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1357'. [ 371.769431][T10131] netlink: 'syz.2.1357': attribute type 13 has an invalid length. [ 371.788366][T10131] netlink: 'syz.2.1357': attribute type 12 has an invalid length. [ 371.920333][T10139] program syz.0.1361 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 371.938584][T10139] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1361'. [ 371.978467][T10141] warning: `syz.4.1362' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 372.057907][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.066435][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.074833][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.082894][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.091113][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.099182][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.107314][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.115433][ T9] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 372.115667][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.132627][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.140547][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.148652][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.157194][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.165228][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.173301][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.181285][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.189628][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.198039][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.206672][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.214592][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.222834][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.230672][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.239237][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.247875][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.256094][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.264410][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.272726][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.281199][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.289232][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.293945][ T9] usb 2-1: device descriptor read/64, error -71 [ 372.297511][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.312540][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.320464][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.328522][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.336579][ T5623] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 372.539116][T10160] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1367'. [ 372.598008][T10163] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 372.623712][ T9] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 372.782485][ T9] usb 2-1: device descriptor read/64, error -71 [ 372.798705][T10168] binder: 10167:10168 ioctl c0945662 2000000000c0 returned -22 [ 372.816070][T10161] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1369'. [ 372.912028][ T9] usb usb2-port1: attempt power cycle [ 372.977343][T10177] binder: 10175:10177 ioctl 40809440 200000005c80 returned -22 [ 373.002738][T10177] binder: 10175:10177 ioctl c0306201 2000000004c0 returned -22 [ 373.269729][T10191] FAULT_INJECTION: forcing a failure. [ 373.269729][T10191] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 373.271701][ T5764] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 373.283298][ T9] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 373.303517][T10191] CPU: 0 UID: 0 PID: 10191 Comm: syz.4.1381 Tainted: G L syzkaller #0 PREEMPT(full) [ 373.303548][T10191] Tainted: [L]=SOFTLOCKUP [ 373.303555][T10191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 373.303565][T10191] Call Trace: [ 373.303572][T10191] [ 373.303580][T10191] dump_stack_lvl+0xe8/0x150 [ 373.303613][T10191] should_fail_ex+0x40c/0x560 [ 373.303640][T10191] _copy_from_user+0x2d/0xb0 [ 373.303754][T10191] drm_ioctl+0x617/0xba0 [ 373.303818][T10191] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 373.303872][T10191] ? __pfx_drm_ioctl+0x10/0x10 [ 373.303902][T10191] ? __fget_files+0x2a/0x420 [ 373.303929][T10191] ? bpf_lsm_file_ioctl+0x9/0x20 [ 373.303963][T10191] ? __pfx_drm_ioctl+0x10/0x10 [ 373.303982][T10191] __se_sys_ioctl+0xfc/0x170 [ 373.304001][T10191] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.304022][T10191] do_syscall_64+0x174/0x580 [ 373.304050][T10191] ? clear_bhb_loop+0x40/0x90 [ 373.304073][T10191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.304091][T10191] RIP: 0033:0x7f3b4e19de59 [ 373.304109][T10191] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 373.304124][T10191] RSP: 002b:00007f3b4f13c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 373.304143][T10191] RAX: ffffffffffffffda RBX: 00007f3b4e425fa0 RCX: 00007f3b4e19de59 [ 373.304157][T10191] RDX: 0000200000000500 RSI: 00000000c03864bc RDI: 0000000000000003 [ 373.304169][T10191] RBP: 00007f3b4f13c090 R08: 0000000000000000 R09: 0000000000000000 [ 373.304180][T10191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 373.304191][T10191] R13: 00007f3b4e426038 R14: 00007f3b4e425fa0 R15: 00007f3b4e54fa48 [ 373.304219][T10191] [ 373.332397][T10192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 373.357331][ T9] usb 2-1: device descriptor read/8, error -71 [ 373.403267][T10192] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 373.527149][ T24] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 373.555547][ T5764] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 373.573644][ T5764] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 373.587535][ T5764] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 373.603780][ T5764] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 373.624836][ T5764] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.631685][T10194] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 373.649843][ T5764] usb 3-1: Product: syz [ 373.659087][ T5764] usb 3-1: Manufacturer: syz [ 373.669272][ T5764] usb 3-1: SerialNumber: syz [ 373.685828][ T5764] usb 3-1: config 0 descriptor?? [ 373.693527][ T24] usb 1-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 373.703969][T10179] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 373.711720][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.720167][T10179] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 373.749142][ T5764] usb 3-1: ucan: probing device on interface #0 [ 373.757057][ T24] usb 1-1: Product: syz [ 373.762179][ T24] usb 1-1: Manufacturer: syz [ 373.767277][ T24] usb 1-1: SerialNumber: syz [ 373.782228][ T24] usb 1-1: config 0 descriptor?? [ 373.791850][ T9] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 373.796535][ T24] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 373.813215][ T9] usb 2-1: device descriptor read/8, error -71 [ 373.818562][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 373.830808][ T24] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 373.841934][ T24] usb 1-1: media controller created [ 373.869563][T10189] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 373.875157][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 373.888798][T10189] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 373.922382][ T9] usb usb2-port1: unable to enumerate USB device [ 373.952073][ T24] DVB: Unable to find symbol mt352_attach() [ 374.001146][T10187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.017151][ T24] DVB: Unable to find symbol nxt6000_attach() [ 374.017217][T10187] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.035400][ T24] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 374.049132][ T24] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input20 [ 374.065350][ T24] dvb-usb: schedule remote query interval to 1000 msecs. [ 374.077651][ T24] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 374.090068][ T24] dvb-usb: bulk message failed: -22 (7/0) [ 374.098193][ T24] dvb-usb: bulk message failed: -22 (7/0) [ 374.110512][ T24] usb 1-1: USB disconnect, device number 52 [ 374.210677][ T5764] ucan 3-1:0.0 can0: registered device [ 374.237946][ T24] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 374.347602][ T5764] ucan 3-1:0.0 can0: firmware string: unknown [ 375.169604][T10232] binder: 10230:10232 ioctl 40809440 200000005c80 returned -22 [ 375.205688][T10232] binder: 10230:10232 ioctl c0306201 2000000004c0 returned -22 [ 375.458297][ T5285] ucan 3-1:0.0 can0: bit-timing not yet defined [ 375.658584][ T5633] usb 3-1: USB disconnect, device number 49 [ 375.670649][ T5285] ucan 3-1:0.0 can0: could not stop device, code: -71 [ 375.686838][ T5285] ucan 3-1:0.0 can0: could not reset device, code: -19 [ 375.770057][T10243] macsec1: entered promiscuous mode [ 376.103787][T10253] loop4: detected capacity change from 0 to 2640 [ 376.139036][T10253] buffer_io_error: 11 callbacks suppressed [ 376.139055][T10253] Buffer I/O error on dev loop4, logical block 0, async page read [ 376.236726][T10253] Buffer I/O error on dev loop4, logical block 0, async page read [ 376.318893][T10253] Buffer I/O error on dev loop4, logical block 0, async page read [ 376.374360][T10253] Buffer I/O error on dev loop4, logical block 0, async page read [ 376.426918][T10253] Buffer I/O error on dev loop4, logical block 0, async page read [ 376.437305][T10253] Buffer I/O error on dev loop4, logical block 0, async page read [ 376.449325][T10253] Buffer I/O error on dev loop4, logical block 0, async page read [ 376.461825][T10253] Buffer I/O error on dev loop4, logical block 0, async page read [ 376.533127][T10253] ldm_validate_partition_table(): Disk read failed. [ 376.625536][T10253] Buffer I/O error on dev loop4, logical block 0, async page read [ 376.684726][T10253] Buffer I/O error on dev loop4, logical block 0, async page read [ 376.736332][T10253] Dev loop4: unable to read RDB block 0 [ 376.803061][T10253] loop4: unable to read partition table [ 376.894897][T10253] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 377.480252][ T30] audit: type=1326 audit(1784216920.476:6825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10281 comm="syz.2.1399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 377.614285][ T30] audit: type=1326 audit(1784216920.476:6826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10281 comm="syz.2.1399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 377.619925][T10285] input: syz0 as /devices/virtual/input/input21 [ 377.714411][T10280] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1393'. [ 377.748835][ T30] audit: type=1326 audit(1784216920.516:6827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10281 comm="syz.2.1399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 377.852939][ T30] audit: type=1326 audit(1784216920.516:6828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10281 comm="syz.2.1399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 377.961667][ T24] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 377.979278][ T30] audit: type=1326 audit(1784216920.516:6829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10281 comm="syz.2.1399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 378.083295][ T30] audit: type=1326 audit(1784216920.516:6830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10281 comm="syz.2.1399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 378.177742][ T24] usb 1-1: config 0 has an invalid interface number: 255 but max is 0 [ 378.220519][ T24] usb 1-1: config 0 has no interface number 0 [ 378.247218][ T30] audit: type=1326 audit(1784216920.516:6831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10281 comm="syz.2.1399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 378.277153][ T24] usb 1-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 378.300177][ T24] usb 1-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 378.328607][ T30] audit: type=1326 audit(1784216920.526:6832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10281 comm="syz.2.1399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 378.365337][ T24] usb 1-1: config 0 interface 255 has no altsetting 0 [ 378.402967][ T24] usb 1-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 378.417492][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.475206][ T30] audit: type=1326 audit(1784216920.526:6833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10281 comm="syz.2.1399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 378.510411][ T24] usb 1-1: Product: syz [ 378.514819][ T24] usb 1-1: Manufacturer: syz [ 378.519569][ T24] usb 1-1: SerialNumber: syz [ 378.535430][ T24] usb 1-1: config 0 descriptor?? [ 378.552924][ T30] audit: type=1326 audit(1784216920.526:6834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10281 comm="syz.2.1399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 378.585315][T10295] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 378.597058][T10295] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 378.785706][T10289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 378.812132][T10289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 378.865278][ T24] usb 1-1: ignoring: probably an ADSL modem [ 379.196844][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.203453][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.268907][ T24] cxacru 1-1:0.255: usbatm_usb_probe: bind failed: -19! [ 379.425105][T10311] syzkaller1: entered promiscuous mode [ 379.445515][T10311] syzkaller1: entered allmulticast mode [ 379.973991][ T5624] usb 1-1: USB disconnect, device number 53 [ 380.290556][T10327] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1410'. [ 380.350648][T10327] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1410'. [ 381.071734][ T24] usb 3-1: new low-speed USB device number 50 using dummy_hcd [ 381.197578][T10341] syzkaller1: entered promiscuous mode [ 381.203509][T10341] syzkaller1: entered allmulticast mode [ 381.233417][ T24] usb 3-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 381.243249][ T24] usb 3-1: config 32 interface 0 altsetting 0 endpoint 0x85 is Bulk; changing to Interrupt [ 381.253444][ T24] usb 3-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 381.264272][ T24] usb 3-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 381.273850][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.630587][ T24] usb 3-1: string descriptor 0 read error: -71 [ 381.651622][ T5624] usb 1-1: new low-speed USB device number 54 using dummy_hcd [ 381.787794][ T24] usb 3-1: USB disconnect, device number 50 [ 381.825271][ T5624] usb 1-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 381.866619][ T5624] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 is Bulk; changing to Interrupt [ 381.898879][ T5624] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 381.921319][ T5624] usb 1-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 381.939096][ T5624] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 382.296843][ T5624] usb 1-1: string descriptor 0 read error: -71 [ 382.401089][T10356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 382.411994][ T5624] usb 1-1: USB disconnect, device number 54 [ 382.429740][T10356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 382.449306][T10356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 382.475908][T10356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 382.598842][T10361] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1421'. [ 382.641359][T10363] FAULT_INJECTION: forcing a failure. [ 382.641359][T10363] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.658364][T10363] CPU: 1 UID: 0 PID: 10363 Comm: syz.2.1422 Tainted: G L syzkaller #0 PREEMPT(full) [ 382.658396][T10363] Tainted: [L]=SOFTLOCKUP [ 382.658403][T10363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 382.658414][T10363] Call Trace: [ 382.658421][T10363] [ 382.658429][T10363] dump_stack_lvl+0xe8/0x150 [ 382.658463][T10363] should_fail_ex+0x40c/0x560 [ 382.658491][T10363] _copy_to_user+0x31/0xb0 [ 382.658518][T10363] __se_sys_prlimit64+0x997/0xbc0 [ 382.658575][T10363] ? __pfx___se_sys_prlimit64+0x10/0x10 [ 382.658600][T10363] ? ksys_write+0x242/0x270 [ 382.658630][T10363] ? __pfx_ksys_write+0x10/0x10 [ 382.658664][T10363] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.658686][T10363] do_syscall_64+0x174/0x580 [ 382.658712][T10363] ? trace_irq_disable+0x3b/0x140 [ 382.658736][T10363] ? clear_bhb_loop+0x40/0x90 [ 382.658758][T10363] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.658775][T10363] RIP: 0033:0x7fd12c79de59 [ 382.658793][T10363] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 382.658809][T10363] RSP: 002b:00007fd12d5f4028 EFLAGS: 00000246 ORIG_RAX: 000000000000012e [ 382.658830][T10363] RAX: ffffffffffffffda RBX: 00007fd12ca25fa0 RCX: 00007fd12c79de59 [ 382.658844][T10363] RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000000 [ 382.658855][T10363] RBP: 00007fd12d5f4090 R08: 0000000000000000 R09: 0000000000000000 [ 382.658866][T10363] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000001 [ 382.658878][T10363] R13: 00007fd12ca26038 R14: 00007fd12ca25fa0 R15: 00007fd12cb4fa48 [ 382.658907][T10363] [ 382.753007][T10365] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1423'. [ 382.830827][ T30] kauditd_printk_skb: 266 callbacks suppressed [ 382.830847][ T30] audit: type=1326 audit(1784216925.826:7101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10364 comm="syz.2.1423" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd12c79de59 code=0x0 [ 382.881706][ T24] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 383.033864][ T24] usb 2-1: unable to get BOS descriptor or descriptor too short [ 383.042814][ T24] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 383.056838][ T24] usb 2-1: New USB device found, idVendor=2a39, idProduct=3fd2, bcdDevice= 0.40 [ 383.066339][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.081759][ T24] usb 2-1: Product: syz [ 383.091620][ T24] usb 2-1: Manufacturer: syz [ 383.102133][ T24] usb 2-1: SerialNumber: syz [ 383.163408][ T5624] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 383.324169][ T5624] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 383.335332][ T5624] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 383.345753][ T24] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 383.361362][ T5624] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 383.371922][ T5624] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 383.373088][ T24] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 383.383295][ T5624] usb 1-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 383.399346][ T5624] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.417619][ T5624] usb 1-1: config 0 descriptor?? [ 383.484916][ T24] usb 2-1: USB disconnect, device number 53 [ 383.544935][ T5771] udevd[5771]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 383.800913][ T5624] hdpvr 1-1:0.0: unexpected answer of status request, len -32 [ 383.814708][ T5624] hdpvr 1-1:0.0: device init failed [ 383.824505][ T5624] hdpvr 1-1:0.0: probe with driver hdpvr failed with error -12 [ 384.501576][ T1603] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 384.616918][T10391] fuse: Bad value for 'fd' [ 384.698684][ T1603] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 384.739304][ T1603] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 384.788179][ T1603] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 384.830013][ T1603] usb 5-1: config 1 has no interface number 1 [ 384.854366][ T1603] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 384.903665][ T1603] usb 5-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 384.928676][T10395] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1432'. [ 384.957447][ T1603] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 384.978059][T10395] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1432'. [ 384.994033][ T1603] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.044558][ T1603] usb 5-1: Product: syz [ 385.070573][ T1603] usb 5-1: Manufacturer: syz [ 385.085750][ T1603] usb 5-1: SerialNumber: syz [ 385.445880][T10401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 385.461411][T10380] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1427'. [ 385.521364][T10401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 385.608542][T10402] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1434'. [ 385.666550][T10401] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1434'. [ 385.725989][T10402] openvswitch: netlink: Flow key attr not present in new flow. [ 385.775331][T10401] openvswitch: netlink: Flow key attr not present in new flow. [ 385.828320][ T30] audit: type=1326 audit(1784216928.826:7102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10406 comm="syz.1.1436" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2279de59 code=0x7ffc0000 [ 385.899935][ T30] audit: type=1326 audit(1784216928.826:7103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10406 comm="syz.1.1436" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2279de59 code=0x7ffc0000 [ 385.930402][T10401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 385.964943][T10401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 385.995933][ T30] audit: type=1326 audit(1784216928.876:7104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10406 comm="syz.1.1436" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2279de59 code=0x7ffc0000 [ 386.001632][ T9] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 386.081041][T10401] syzkaller0: tun_chr_ioctl cmd 1074025673 [ 386.111335][ T30] audit: type=1326 audit(1784216928.876:7105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10406 comm="syz.1.1436" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f6a2279de59 code=0x7ffc0000 [ 386.144983][T10401] sctp: [Deprecated]: syz.3.1434 (pid 10401) Use of int in max_burst socket option. [ 386.144983][T10401] Use struct sctp_assoc_value instead [ 386.171677][T10402] syzkaller0: tun_chr_ioctl cmd 35108 [ 386.222651][ T30] audit: type=1326 audit(1784216928.886:7106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10406 comm="syz.1.1436" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2279de59 code=0x7ffc0000 [ 386.284146][ T9] usb 3-1: config 0 has an invalid interface number: 255 but max is 0 [ 386.300308][ T9] usb 3-1: config 0 has no interface number 0 [ 386.300392][ T30] audit: type=1326 audit(1784216928.886:7107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10406 comm="syz.1.1436" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2279de59 code=0x7ffc0000 [ 386.337659][ T30] audit: type=1326 audit(1784216928.886:7108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10406 comm="syz.1.1436" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2279de59 code=0x7ffc0000 [ 386.375964][ T9] usb 3-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 386.376009][ T30] audit: type=1326 audit(1784216928.886:7109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10406 comm="syz.1.1436" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2279de59 code=0x7ffc0000 [ 386.418623][ T30] audit: type=1326 audit(1784216928.886:7110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10406 comm="syz.1.1436" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2279de59 code=0x7ffc0000 [ 386.455387][ T9] usb 3-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 386.505264][ T9] usb 3-1: config 0 interface 255 has no altsetting 0 [ 386.533184][ T9] usb 3-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 386.554092][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.583846][ T9] usb 3-1: Product: syz [ 386.601884][ T9] usb 3-1: Manufacturer: syz [ 386.644656][ T9] usb 3-1: SerialNumber: syz [ 386.710270][ T9] usb 3-1: config 0 descriptor?? [ 386.867673][T10410] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1437'. [ 386.990216][T10405] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 387.072156][T10405] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 387.091999][T10413] netlink: 'syz.3.1438': attribute type 1 has an invalid length. [ 387.121310][ T9] usb 3-1: ignoring: probably an ADSL modem [ 387.354020][T10413] 8021q: adding VLAN 0 to HW filter on device bond1 [ 387.379270][ T5633] usb 1-1: USB disconnect, device number 55 [ 387.519836][ T9] cxacru 3-1:0.255: usbatm_usb_probe: bind failed: -19! [ 387.638392][T10415] bond1: (slave veth3): Enslaving as an active interface with a down link [ 387.988807][T10416] vlan2: entered allmulticast mode [ 388.071666][T10416] veth0_to_bond: entered allmulticast mode [ 388.148378][T10416] veth0_to_bond: entered promiscuous mode [ 388.184909][T10416] veth0_to_bond: left promiscuous mode [ 388.222873][T10416] bond1: (slave vlan2): making interface the new active one [ 388.258131][T10416] veth0_to_bond: entered promiscuous mode [ 388.294190][ T1603] usb 5-1: No endpoint at altset 1, falling back to MIDI 1.0 [ 388.310508][T10416] vlan2: entered promiscuous mode [ 388.315977][ T1603] usb 5-1: MIDIStreaming interface descriptor not found [ 388.332294][T10416] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 388.415713][ T5633] usb 3-1: USB disconnect, device number 51 [ 388.589948][ T1603] usb 5-1: USB disconnect, device number 52 [ 388.824864][ T5952] udevd[5952]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 389.013105][ T9] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 389.193481][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 389.211212][ T9] usb 3-1: New USB device found, idVendor=0582, idProduct=0050, bcdDevice= 0.40 [ 389.226724][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.240054][ T9] usb 3-1: Product: syz [ 389.248219][ T9] usb 3-1: Manufacturer: syz [ 389.256296][ T9] usb 3-1: SerialNumber: syz [ 389.296840][ T9] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 389.513012][ T5709] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 389.528498][ T9] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 389.660923][ T9] usb 3-1: USB disconnect, device number 52 [ 389.672010][ T5709] usb 5-1: Using ep0 maxpacket: 32 [ 389.699881][ T5709] usb 5-1: unable to get BOS descriptor or descriptor too short [ 389.726247][ T5709] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 389.726343][ T5709] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 389.726365][ T5709] usb 5-1: config 14 contains an unexpected descriptor of type 0x1, skipping [ 389.726384][ T5709] usb 5-1: config 14 has no interface number 0 [ 389.726401][ T5709] usb 5-1: config 14 has no interface number 1 [ 389.726526][ T5709] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 389.726550][ T5709] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 389.726574][ T5709] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 389.726598][ T5709] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 389.726622][ T5709] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 389.726711][ T5709] usb 5-1: config 14 interface 57 has no altsetting 0 [ 389.726731][ T5709] usb 5-1: config 14 interface 228 has no altsetting 0 [ 389.730304][ T5709] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 389.950858][ T5771] udevd[5771]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 390.055670][ T5709] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.083347][ T5709] usb 5-1: Product: syz [ 390.096420][ T5709] usb 5-1: Manufacturer: syz [ 390.109180][ T5709] usb 5-1: SerialNumber: syz [ 390.251705][ T5764] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 390.320325][T10465] netlink: 'syz.2.1455': attribute type 1 has an invalid length. [ 390.417006][ T5764] usb 1-1: config 0 has an invalid interface number: 255 but max is 0 [ 390.427336][ T5764] usb 1-1: config 0 has no interface number 0 [ 390.439119][ T5764] usb 1-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 390.454956][ T5764] usb 1-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 390.501617][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 390.581255][ T5709] legousbtower 5-1:14.57: interrupt endpoints not found [ 390.673163][ T5764] usb 1-1: config 0 interface 255 has no altsetting 0 [ 390.736290][ T5764] usb 1-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 390.750713][T10465] 8021q: adding VLAN 0 to HW filter on device bond1 [ 390.822376][ T5764] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.845333][ T5764] usb 1-1: Product: syz [ 390.861922][ T5764] usb 1-1: Manufacturer: syz [ 390.884250][T10474] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.898524][ T5709] legousbtower 5-1:14.228: get version request failed: -71 [ 390.957628][ T5764] usb 1-1: SerialNumber: syz [ 390.976475][T10474] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.996751][ T5764] usb 1-1: config 0 descriptor?? [ 391.002177][ T5709] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 391.060269][ T5709] usb 5-1: USB disconnect, device number 53 [ 391.071969][ T0] NOHZ tick-stop error: local softirq work is pending, handler #102!!! [ 391.148624][T10469] bond1: (slave veth3): Enslaving as an active interface with a down link [ 391.213478][T10470] vlan2: entered allmulticast mode [ 391.219725][T10470] veth0_to_bond: entered allmulticast mode [ 391.222207][T10459] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 391.242235][T10459] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 391.257279][T10470] veth0_to_bond: entered promiscuous mode [ 391.267579][ T5764] usb 1-1: ignoring: probably an ADSL modem [ 391.282807][T10470] veth0_to_bond: left promiscuous mode [ 391.297355][T10470] bond1: (slave vlan2): making interface the new active one [ 391.317852][T10470] veth0_to_bond: entered promiscuous mode [ 391.333409][T10470] vlan2: entered promiscuous mode [ 391.346577][T10470] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 391.649031][T10483] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1458'. [ 391.669621][ T5764] cxacru 1-1:0.255: usbatm_usb_probe: bind failed: -19! [ 391.874518][T10491] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 391.883790][ T5709] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 392.055148][ T5709] usb 2-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 392.069444][ T5709] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 392.087232][ T5709] usb 2-1: config 0 descriptor?? [ 392.108854][ T5709] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 392.395606][ T1603] usb 1-1: USB disconnect, device number 56 [ 392.506462][ T5709] cpia1 2-1:0.0: unexpected state after lo power cmd: 00 [ 392.616194][T10495] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[5639] was attempted by " Àÿ Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ /dev/nullb0 @   ( &  -½p üÛß%\x0c   F    \ [ 392.722185][ T5709] gspca_cpia1: usb_control_msg 02, error -32 [ 392.725620][T10486] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.082356][T10486] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.140786][T10486] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.203250][T10486] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.255755][T10486] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.280477][T10486] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.308756][T10486] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.333600][T10486] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.382355][T10486] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.419466][T10486] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.471711][ T5764] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 393.685715][ T5764] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 393.695810][ T5764] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 393.708572][ T5764] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 393.720261][ T5764] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 393.736342][ T5764] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 393.748048][ T5764] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 393.757129][ T5764] usb 3-1: Product: syz [ 393.762907][ T5764] usb 3-1: Manufacturer: syz [ 393.791226][ T5764] cdc_wdm 3-1:1.0: skipping garbage [ 393.832501][ T5764] cdc_wdm 3-1:1.0: skipping garbage [ 393.857771][ T5764] cdc_wdm 3-1:1.0: cdc-wdm1: USB WDM device [ 393.880352][ T5764] cdc_wdm 3-1:1.0: Unknown control protocol [ 393.912889][ T5709] gspca_cpia1: usb_control_msg 02, error -110 [ 393.929328][ T5709] cpia1 2-1:0.0: only firmware version 1 is supported (got: 0) [ 394.078180][ T5709] usb 3-1: USB disconnect, device number 53 [ 394.126791][T10518] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 394.284577][T10521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 394.341438][T10521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 394.719292][ T5633] usb 2-1: USB disconnect, device number 54 [ 395.094722][T10539] capability: warning: `syz.4.1477' uses deprecated v2 capabilities in a way that may be insecure [ 395.347303][T10547] netlink: 'syz.4.1480': attribute type 1 has an invalid length. [ 395.486261][T10531] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 395.506455][T10531] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 395.523577][T10544] syzkaller0: entered promiscuous mode [ 395.556084][T10531] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 395.559766][T10551] binder: BINDER_SET_CONTEXT_MGR already set [ 395.576737][T10531] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 395.577852][T10544] syzkaller0: entered allmulticast mode [ 395.595059][T10551] binder: 10549:10551 ioctl 4018620d 200000004a80 returned -16 [ 395.620067][T10551] binder: 10549:10551 unknown command 1919251317 [ 395.631263][T10531] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 395.634550][T10551] binder: 10549:10551 ioctl c0306201 2000000004c0 returned -22 [ 395.646141][T10531] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 395.677511][T10531] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 395.683986][T10531] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 395.695001][T10551] binder_alloc: 10549: binder_alloc_buf, no vma [ 395.711843][T10531] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 395.724192][T10531] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 395.740381][T10547] 8021q: adding VLAN 0 to HW filter on device bond2 [ 395.836605][T10548] bond2: (slave veth5): Enslaving as an active interface with a down link [ 395.958094][T10557] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 396.346437][T10564] fuse: Unknown parameter '' [ 396.508541][T10576] netlink: 5128 bytes leftover after parsing attributes in process `syz.2.1490'. [ 396.524989][T10576] netlink: 5128 bytes leftover after parsing attributes in process `syz.2.1490'. [ 396.535338][T10576] netlink: 640 bytes leftover after parsing attributes in process `syz.2.1490'. [ 396.805627][T10584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 396.832312][T10584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 397.261748][ T9] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 397.449809][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 397.462049][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 397.473905][ T9] usb 1-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 397.485865][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.498806][ T9] usb 1-1: config 0 descriptor?? [ 397.855233][ T9] hid-led 0003:27B8:01ED.0013: probe with driver hid-led failed with error -71 [ 397.953551][ T9] usb 1-1: USB disconnect, device number 57 [ 398.220066][T10608] xt_hashlimit: size too large, truncated to 1048576 [ 398.519159][T10613] FAULT_INJECTION: forcing a failure. [ 398.519159][T10613] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 398.582351][T10613] CPU: 0 UID: 0 PID: 10613 Comm: syz.4.1499 Tainted: G L syzkaller #0 PREEMPT(full) [ 398.582384][T10613] Tainted: [L]=SOFTLOCKUP [ 398.582391][T10613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 398.582402][T10613] Call Trace: [ 398.582410][T10613] [ 398.582418][T10613] dump_stack_lvl+0xe8/0x150 [ 398.582453][T10613] should_fail_ex+0x40c/0x560 [ 398.582479][T10613] _copy_from_user+0x2d/0xb0 [ 398.582506][T10613] ip6gre_tunnel_siocdevprivate+0x1fb/0x720 [ 398.582634][T10613] ? __pfx_ip6gre_tunnel_siocdevprivate+0x10/0x10 [ 398.582679][T10613] ? __pfx___mutex_lock+0x10/0x10 [ 398.582706][T10613] ? full_name_hash+0x92/0xe0 [ 398.582737][T10613] dev_ifsioc+0xb56/0x1360 [ 398.582842][T10613] dev_ioctl+0x84c/0x1150 [ 398.582872][T10613] sock_ioctl+0x753/0x7e0 [ 398.582932][T10613] ? __pfx_sock_ioctl+0x10/0x10 [ 398.582956][T10613] ? __fget_files+0x3a2/0x420 [ 398.582980][T10613] ? __fget_files+0x2a/0x420 [ 398.583005][T10613] ? bpf_lsm_file_ioctl+0x9/0x20 [ 398.583028][T10613] ? __pfx_sock_ioctl+0x10/0x10 [ 398.583049][T10613] __se_sys_ioctl+0xfc/0x170 [ 398.583068][T10613] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.583096][T10613] do_syscall_64+0x174/0x580 [ 398.583121][T10613] ? trace_irq_disable+0x3b/0x140 [ 398.583144][T10613] ? clear_bhb_loop+0x40/0x90 [ 398.583166][T10613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.583185][T10613] RIP: 0033:0x7f3b4e19de59 [ 398.583204][T10613] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 398.583221][T10613] RSP: 002b:00007f3b4f13c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 398.583241][T10613] RAX: ffffffffffffffda RBX: 00007f3b4e425fa0 RCX: 00007f3b4e19de59 [ 398.583256][T10613] RDX: 0000200000000300 RSI: 00000000000089f3 RDI: 0000000000000003 [ 398.583268][T10613] RBP: 00007f3b4f13c090 R08: 0000000000000000 R09: 0000000000000000 [ 398.583281][T10613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 398.583293][T10613] R13: 00007f3b4e426038 R14: 00007f3b4e425fa0 R15: 00007f3b4e54fa48 [ 398.583323][T10613] [ 399.283678][ T5764] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 399.484081][ T5764] usb 2-1: Using ep0 maxpacket: 16 [ 399.507449][ T5764] usb 2-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 399.528306][T10630] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1504'. [ 399.551700][ T5764] usb 2-1: config 0 interface 0 has no altsetting 0 [ 399.565836][ T5764] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 399.606593][ T5764] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.620102][T10630] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1504'. [ 399.650832][ T5764] usb 2-1: config 0 descriptor?? [ 400.145274][ T5764] mcp2221 0003:04D8:00DD.0014: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 400.275951][T10634] FAULT_INJECTION: forcing a failure. [ 400.275951][T10634] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 400.338739][T10634] CPU: 0 UID: 0 PID: 10634 Comm: syz.0.1506 Tainted: G L syzkaller #0 PREEMPT(full) [ 400.338776][T10634] Tainted: [L]=SOFTLOCKUP [ 400.338783][T10634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 400.338793][T10634] Call Trace: [ 400.338801][T10634] [ 400.338809][T10634] dump_stack_lvl+0xe8/0x150 [ 400.338841][T10634] should_fail_ex+0x40c/0x560 [ 400.338869][T10634] _copy_from_user+0x2d/0xb0 [ 400.338896][T10634] ___sys_sendmsg+0x1c6/0x360 [ 400.338999][T10634] ? __lock_acquire+0x683/0x2cf0 [ 400.339027][T10634] ? __pfx____sys_sendmsg+0x10/0x10 [ 400.339087][T10634] ? __fget_files+0x2a/0x420 [ 400.339111][T10634] ? __fget_files+0x3a2/0x420 [ 400.339143][T10634] __x64_sys_sendmsg+0x1b1/0x290 [ 400.339171][T10634] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 400.339215][T10634] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 400.339235][T10634] do_syscall_64+0x174/0x580 [ 400.339262][T10634] ? trace_irq_disable+0x3b/0x140 [ 400.339286][T10634] ? clear_bhb_loop+0x40/0x90 [ 400.339309][T10634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 400.339328][T10634] RIP: 0033:0x7f973af9de59 [ 400.339347][T10634] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 400.339363][T10634] RSP: 002b:00007f973be29028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 400.339382][T10634] RAX: ffffffffffffffda RBX: 00007f973b225fa0 RCX: 00007f973af9de59 [ 400.339396][T10634] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000004 [ 400.339411][T10634] RBP: 00007f973be29090 R08: 0000000000000000 R09: 0000000000000000 [ 400.339430][T10634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 400.339441][T10634] R13: 00007f973b226038 R14: 00007f973b225fa0 R15: 00007f973b34fa48 [ 400.339470][T10634] [ 400.611544][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 400.721526][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 400.737750][T10621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 400.762010][T10621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 400.830329][ T5764] usb 2-1: USB disconnect, device number 55 [ 401.200878][ T30] kauditd_printk_skb: 64 callbacks suppressed [ 401.200895][ T30] audit: type=1326 audit(1784216944.196:7175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.2.1509" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 401.288532][ T30] audit: type=1326 audit(1784216944.236:7176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.2.1509" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 401.344900][ T30] audit: type=1326 audit(1784216944.266:7177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.2.1509" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 401.484728][ T30] audit: type=1326 audit(1784216944.266:7178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.2.1509" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 401.584608][ T151] vlan2: left promiscuous mode [ 401.609155][ T30] audit: type=1326 audit(1784216944.266:7179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.2.1509" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 401.656429][T10655] FAULT_INJECTION: forcing a failure. [ 401.656429][T10655] name failslab, interval 1, probability 0, space 0, times 0 [ 401.684394][ T30] audit: type=1326 audit(1784216944.266:7180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.2.1509" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 401.711806][T10655] CPU: 1 UID: 0 PID: 10655 Comm: syz.1.1512 Tainted: G L syzkaller #0 PREEMPT(full) [ 401.711865][T10655] Tainted: [L]=SOFTLOCKUP [ 401.711873][T10655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 401.711889][T10655] Call Trace: [ 401.711902][T10655] [ 401.711911][T10655] dump_stack_lvl+0xe8/0x150 [ 401.711946][T10655] should_fail_ex+0x40c/0x560 [ 401.711973][T10655] should_failslab+0xa8/0x100 [ 401.712003][T10655] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 401.712026][T10655] ? local_lock_release+0x9c/0x160 [ 401.712132][T10655] ? __alloc_skb+0x1d7/0x7a0 [ 401.712154][T10655] ? __alloc_skb+0x1d7/0x7a0 [ 401.712186][T10655] __alloc_skb+0x1d7/0x7a0 [ 401.712216][T10655] netlink_ack+0x136/0xb30 [ 401.712303][T10655] ? __pfx_genl_rcv_msg+0x10/0x10 [ 401.712324][T10655] ? __pfx_tipc_nl_compat_recv+0x10/0x10 [ 401.712393][T10655] ? __pfx_ref_tracker_free+0x10/0x10 [ 401.712450][T10655] ? __asan_memcpy+0x40/0x70 [ 401.712478][T10655] netlink_rcv_skb+0x2a4/0x4a0 [ 401.712505][T10655] ? __pfx_genl_rcv_msg+0x10/0x10 [ 401.712529][T10655] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 401.712568][T10655] ? down_read+0x2be/0x330 [ 401.712590][T10655] genl_rcv+0x28/0x40 [ 401.712609][T10655] netlink_unicast+0x7bb/0x940 [ 401.712650][T10655] netlink_sendmsg+0x813/0xb40 [ 401.712677][T10655] ? __pfx_netlink_sendmsg+0x10/0x10 [ 401.712699][T10655] ? aa_sock_msg_perm+0xf1/0x1b0 [ 401.712750][T10655] ? __pfx_netlink_sendmsg+0x10/0x10 [ 401.712767][T10655] sock_sendmsg_nosec+0x13a/0x180 [ 401.712791][T10655] ____sys_sendmsg+0x54e/0x850 [ 401.712822][T10655] ? __pfx_____sys_sendmsg+0x10/0x10 [ 401.712859][T10655] ? import_iovec+0x73/0xa0 [ 401.712913][T10655] ___sys_sendmsg+0x2a5/0x360 [ 401.712935][T10655] ? __lock_acquire+0x683/0x2cf0 [ 401.712959][T10655] ? __pfx____sys_sendmsg+0x10/0x10 [ 401.713007][T10655] ? __fget_files+0x2a/0x420 [ 401.713026][T10655] ? __fget_files+0x3a2/0x420 [ 401.713052][T10655] __x64_sys_sendmsg+0x1b1/0x290 [ 401.713077][T10655] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 401.713113][T10655] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.713130][T10655] do_syscall_64+0x174/0x580 [ 401.713152][T10655] ? trace_irq_disable+0x3b/0x140 [ 401.713171][T10655] ? clear_bhb_loop+0x40/0x90 [ 401.713190][T10655] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.713206][T10655] RIP: 0033:0x7f6a2279de59 [ 401.713222][T10655] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 401.713235][T10655] RSP: 002b:00007f6a23586028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 401.713251][T10655] RAX: ffffffffffffffda RBX: 00007f6a22a26090 RCX: 00007f6a2279de59 [ 401.713263][T10655] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000008 [ 401.713273][T10655] RBP: 00007f6a23586090 R08: 0000000000000000 R09: 0000000000000000 [ 401.713283][T10655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 401.713292][T10655] R13: 00007f6a22a26128 R14: 00007f6a22a26090 R15: 00007f6a22b4fa48 [ 401.713316][T10655] [ 402.024529][ T30] audit: type=1326 audit(1784216944.266:7181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.2.1509" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 402.049646][ T30] audit: type=1326 audit(1784216944.266:7182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.2.1509" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 402.075234][ T30] audit: type=1326 audit(1784216944.276:7183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.2.1509" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 402.101814][ T30] audit: type=1326 audit(1784216944.276:7184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.2.1509" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd12c79de59 code=0x7ffc0000 [ 402.209755][T10657] syzkaller0: entered promiscuous mode [ 402.238459][T10657] syzkaller0: entered allmulticast mode [ 403.022762][ T6569] vlan2: left promiscuous mode [ 403.082238][T10675] fuse: Bad value for 'fd' [ 403.237200][T10678] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1520'. [ 404.076006][T10695] FAULT_INJECTION: forcing a failure. [ 404.076006][T10695] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 404.141684][T10695] CPU: 0 UID: 0 PID: 10695 Comm: syz.4.1524 Tainted: G L syzkaller #0 PREEMPT(full) [ 404.141715][T10695] Tainted: [L]=SOFTLOCKUP [ 404.141722][T10695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 404.141733][T10695] Call Trace: [ 404.141741][T10695] [ 404.141749][T10695] dump_stack_lvl+0xe8/0x150 [ 404.141783][T10695] should_fail_ex+0x40c/0x560 [ 404.141811][T10695] _copy_from_iter+0x1d3/0x1660 [ 404.141834][T10695] ? kmem_cache_alloc_node_noprof+0x1d1/0x610 [ 404.141857][T10695] ? rcu_is_watching+0x15/0xb0 [ 404.141916][T10695] ? trace_kmem_cache_alloc+0x29/0xe0 [ 404.141940][T10695] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 404.141962][T10695] ? __pfx__copy_from_iter+0x10/0x10 [ 404.141985][T10695] ? __alloc_skb+0x276/0x7a0 [ 404.142011][T10695] ? __alloc_skb+0x276/0x7a0 [ 404.142039][T10695] ? netlink_sendmsg+0x650/0xb40 [ 404.142058][T10695] ? skb_put+0x112/0x210 [ 404.142087][T10695] netlink_sendmsg+0x6c0/0xb40 [ 404.142115][T10695] ? __pfx_netlink_sendmsg+0x10/0x10 [ 404.142138][T10695] ? aa_sock_msg_perm+0xf1/0x1b0 [ 404.142163][T10695] ? __pfx_netlink_sendmsg+0x10/0x10 [ 404.142181][T10695] sock_sendmsg_nosec+0x13a/0x180 [ 404.142208][T10695] ____sys_sendmsg+0x54e/0x850 [ 404.142242][T10695] ? __pfx_____sys_sendmsg+0x10/0x10 [ 404.142278][T10695] ? import_iovec+0x73/0xa0 [ 404.142307][T10695] ___sys_sendmsg+0x2a5/0x360 [ 404.142334][T10695] ? __lock_acquire+0x683/0x2cf0 [ 404.142363][T10695] ? __pfx____sys_sendmsg+0x10/0x10 [ 404.142422][T10695] ? __fget_files+0x2a/0x420 [ 404.142446][T10695] ? __fget_files+0x3a2/0x420 [ 404.142479][T10695] __x64_sys_sendmsg+0x1b1/0x290 [ 404.142511][T10695] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 404.142554][T10695] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.142574][T10695] do_syscall_64+0x174/0x580 [ 404.142599][T10695] ? trace_irq_disable+0x3b/0x140 [ 404.142622][T10695] ? clear_bhb_loop+0x40/0x90 [ 404.142644][T10695] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.142664][T10695] RIP: 0033:0x7f3b4e19de59 [ 404.142681][T10695] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 404.142697][T10695] RSP: 002b:00007f3b4f11b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 404.142717][T10695] RAX: ffffffffffffffda RBX: 00007f3b4e426090 RCX: 00007f3b4e19de59 [ 404.142730][T10695] RDX: 0000000004000050 RSI: 0000200000000000 RDI: 0000000000000006 [ 404.142743][T10695] RBP: 00007f3b4f11b090 R08: 0000000000000000 R09: 0000000000000000 [ 404.142754][T10695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 404.142764][T10695] R13: 00007f3b4e426128 R14: 00007f3b4e426090 R15: 00007f3b4e54fa48 [ 404.142791][T10695] [ 404.722122][ T5764] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 404.892675][ T5764] usb 3-1: Using ep0 maxpacket: 16 [ 404.913376][ T5764] usb 3-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 404.925425][ T5764] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 404.963371][ T5764] usb 3-1: Product: syz [ 404.981731][ T5764] usb 3-1: Manufacturer: syz [ 404.995646][ T5764] usb 3-1: SerialNumber: syz [ 405.028319][ T5764] usb 3-1: config 0 descriptor?? [ 405.038773][T10700] syz.1.1526 (10700): drop_caches: 2 [ 405.276766][ T5764] usb 3-1: USB disconnect, device number 54 [ 405.283173][ T5688] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 405.448971][ T5688] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 405.458366][ T5688] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 405.473012][ T5688] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 405.494115][ T5688] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 405.516424][ T5688] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 405.528099][ T5688] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 405.541420][ T5688] usb 5-1: Product: syz [ 405.550554][ T5688] usb 5-1: Manufacturer: syz [ 405.596860][ T5688] cdc_wdm 5-1:1.0: skipping garbage [ 405.598421][T10701] syz.1.1526 (10701): drop_caches: 2 [ 405.631627][ T5688] cdc_wdm 5-1:1.0: skipping garbage [ 405.649853][ T5688] cdc_wdm 5-1:1.0: cdc-wdm1: USB WDM device [ 405.674130][ T5688] cdc_wdm 5-1:1.0: Unknown control protocol [ 405.904474][T10719] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1532'. [ 405.969848][ T5688] usb 5-1: USB disconnect, device number 54 [ 406.180650][T10729] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1536'. [ 406.688773][T10739] FAULT_INJECTION: forcing a failure. [ 406.688773][T10739] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 406.708477][T10729] bridge0: port 2(@) entered disabled state [ 406.717551][T10729] bridge0: port 1(bridge_slave_0) entered disabled state [ 406.731594][ T5633] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 406.784090][T10739] CPU: 0 UID: 0 PID: 10739 Comm: syz.1.1538 Tainted: G L syzkaller #0 PREEMPT(full) [ 406.784114][T10739] Tainted: [L]=SOFTLOCKUP [ 406.784118][T10739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 406.784126][T10739] Call Trace: [ 406.784134][T10739] [ 406.784142][T10739] dump_stack_lvl+0xe8/0x150 [ 406.784176][T10739] should_fail_ex+0x40c/0x560 [ 406.784202][T10739] _copy_from_user+0x2d/0xb0 [ 406.784232][T10739] generic_map_update_batch+0x651/0x9a0 [ 406.784259][T10739] ? __pfx_generic_map_update_batch+0x10/0x10 [ 406.784270][T10739] ? __fget_files+0x2a/0x420 [ 406.784288][T10739] ? __pfx_generic_map_update_batch+0x10/0x10 [ 406.784298][T10739] bpf_map_do_batch+0x391/0x630 [ 406.784321][T10739] __sys_bpf+0xbe5/0xd90 [ 406.784352][T10739] ? __pfx___sys_bpf+0x10/0x10 [ 406.784385][T10739] ? __fget_files+0x2a/0x420 [ 406.784428][T10739] ? ksys_write+0x242/0x270 [ 406.784458][T10739] ? __pfx_ksys_write+0x10/0x10 [ 406.784476][T10739] __x64_sys_bpf+0xba/0xd0 [ 406.784488][T10739] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.784502][T10739] do_syscall_64+0x174/0x580 [ 406.784529][T10739] ? trace_irq_disable+0x3b/0x140 [ 406.784553][T10739] ? clear_bhb_loop+0x40/0x90 [ 406.784576][T10739] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.784595][T10739] RIP: 0033:0x7f6a2279de59 [ 406.784613][T10739] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 406.784627][T10739] RSP: 002b:00007f6a235a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 406.784639][T10739] RAX: ffffffffffffffda RBX: 00007f6a22a25fa0 RCX: 00007f6a2279de59 [ 406.784646][T10739] RDX: 0000000000000038 RSI: 0000200000001880 RDI: 000000000000001a [ 406.784653][T10739] RBP: 00007f6a235a7090 R08: 0000000000000000 R09: 0000000000000000 [ 406.784659][T10739] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 406.784665][T10739] R13: 00007f6a22a26038 R14: 00007f6a22a25fa0 R15: 00007f6a22b4fa48 [ 406.784682][T10739] [ 407.221735][ T5633] usb 3-1: Using ep0 maxpacket: 16 [ 407.268798][ T5633] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 407.301807][ T5633] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 407.343623][ T5633] usb 3-1: config 0 has no interface number 0 [ 407.361097][ T5633] usb 3-1: config 0 interface 41 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 407.377069][ T5633] usb 3-1: config 0 interface 41 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 407.390702][ T5633] usb 3-1: config 0 interface 41 has no altsetting 0 [ 407.400021][ T5633] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 407.411184][ T5633] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.421518][T10742] ipvlan0: entered promiscuous mode [ 407.432559][T10742] ipvlan0: left promiscuous mode [ 407.440068][ T5633] usb 3-1: Product: syz [ 407.451611][ T5633] usb 3-1: Manufacturer: syz [ 407.461919][ T5633] usb 3-1: SerialNumber: syz [ 407.482783][ T5633] usb 3-1: config 0 descriptor?? [ 407.500602][ T5633] sr9700 3-1:0.41: probe with driver sr9700 failed with error -22 [ 407.726504][T10722] netlink: 'syz.2.1533': attribute type 3 has an invalid length. [ 407.755681][T10722] netlink: 666 bytes leftover after parsing attributes in process `syz.2.1533'. [ 407.786102][T10722] netlink: 3680 bytes leftover after parsing attributes in process `syz.2.1533'. [ 407.848612][T10722] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 407.899667][T10722] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 407.947635][ T9] usb 3-1: USB disconnect, device number 55 [ 408.041599][ T5633] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 408.222236][ T5633] usb 5-1: Using ep0 maxpacket: 16 [ 408.261437][ T5633] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 408.283210][ T5633] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 408.318456][ T5633] usb 5-1: Product: syz [ 408.331240][ T5633] usb 5-1: Manufacturer: syz [ 408.349408][ T5633] usb 5-1: SerialNumber: syz [ 408.369183][ T5633] usb 5-1: config 0 descriptor?? [ 408.402641][T10768] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1550'. [ 408.425624][T10768] openvswitch: netlink: EtherType 0 is less than min 600 [ 408.604274][T10776] fuse: Bad value for 'fd' [ 408.618757][ T5633] usb 5-1: USB disconnect, device number 55 [ 409.118792][ T5764] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 409.239925][T10782] xt_hashlimit: size too large, truncated to 1048576 [ 409.357063][ T5764] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 409.381665][ T5764] usb 2-1: config 220 has an invalid descriptor of length 22, skipping remainder of the config [ 409.427468][ T5764] usb 2-1: config 220 has no interface number 2 [ 409.454499][ T5764] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 409.517577][ T5764] usb 2-1: config 220 interface 0 has no altsetting 0 [ 409.548394][ T5764] usb 2-1: config 220 interface 76 has no altsetting 0 [ 409.576361][ T5764] usb 2-1: config 220 interface 1 has no altsetting 0 [ 409.632049][ T5764] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 409.670667][ T5764] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.715946][ T5764] usb 2-1: Product: syz [ 409.727001][ T5764] usb 2-1: Manufacturer: syz [ 409.750361][ T5764] usb 2-1: SerialNumber: syz [ 410.058767][T10771] fuse: Bad value for 'fd' [ 410.128472][ T5764] uvcvideo 2-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 410.139507][ T5764] uvcvideo 2-1:220.0: No valid video chain found. [ 410.148256][ T5764] usb 2-1: selecting invalid altsetting 0 [ 410.242272][ T5764] usb 2-1: selecting invalid altsetting 0 [ 410.279091][ T5764] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 410.341966][ T5764] usb 2-1: USB disconnect, device number 56 [ 410.841883][ T5633] usb 1-1: new full-speed USB device number 58 using dummy_hcd [ 410.921162][T10800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 410.946432][T10801] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1558'. [ 410.962220][T10800] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 411.035204][ T5633] usb 1-1: unable to get BOS descriptor or descriptor too short [ 411.069537][ T5633] usb 1-1: not running at top speed; connect to a high speed hub [ 411.109890][ T5633] usb 1-1: config 5 has an invalid interface number: 150 but max is 0 [ 411.126596][ T5633] usb 1-1: config 5 has no interface number 0 [ 411.130870][T10804] tipc: Enabled bearer , priority 10 [ 411.147243][ T5633] usb 1-1: config 5 interface 150 has no altsetting 0 [ 411.160733][ T5633] usb 1-1: New USB device found, idVendor=046d, idProduct=c281, bcdDevice=7a.a6 [ 411.199324][ T5633] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.226627][ T5633] usb 1-1: Product: syz [ 411.245709][ T5633] usb 1-1: Manufacturer: syz [ 411.261008][ T5633] usb 1-1: SerialNumber: syz [ 411.520746][T10810] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 411.527780][T10810] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 411.844591][ T5633] usb 1-1: USB disconnect, device number 58 [ 411.889327][T10821] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 411.904828][T10821] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 411.986483][T10810] vhci_hcd vhci_hcd.0: Device attached [ 412.211804][ T5688] usb 38-1: SetAddress Request (2) to port 0 [ 412.224663][ T5688] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 412.262737][ T10] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 412.423486][ T10] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 412.434731][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 412.456582][ T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 412.490342][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 412.542553][ T10] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 412.583936][ T10] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 412.616617][ T10] usb 5-1: Product: syz [ 412.637030][ T10] usb 5-1: Manufacturer: syz [ 412.673049][ T10] cdc_wdm 5-1:1.0: skipping garbage [ 412.691178][ T10] cdc_wdm 5-1:1.0: skipping garbage [ 412.709591][ T10] cdc_wdm 5-1:1.0: cdc-wdm1: USB WDM device [ 412.728647][T10812] vhci_hcd: connection reset by peer [ 412.733207][ T10] cdc_wdm 5-1:1.0: Unknown control protocol [ 412.781634][ T6567] vhci_hcd vhci_hcd.2: stop threads [ 412.803810][ T6567] vhci_hcd vhci_hcd.2: release socket [ 412.824876][ T6567] vhci_hcd vhci_hcd.2: disconnect device [ 412.948255][ T10] usb 5-1: USB disconnect, device number 56 [ 412.976426][T10837] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1571'. [ 413.310269][T10848] netlink: 'syz.4.1573': attribute type 1 has an invalid length. [ 413.626598][T10854] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 413.670468][T10856] fuse: Bad value for 'fd' [ 413.749149][T10854] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1575'. [ 413.770054][T10858] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.781285][T10858] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.921588][ T5633] usb 3-1: new full-speed USB device number 56 using dummy_hcd [ 413.961025][T10860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.973483][T10860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 414.063548][T10862] netlink: 5128 bytes leftover after parsing attributes in process `syz.1.1579'. [ 414.095813][T10862] netlink: 5128 bytes leftover after parsing attributes in process `syz.1.1579'. [ 414.123288][ T5633] usb 3-1: unable to get BOS descriptor or descriptor too short [ 414.135966][ T5633] usb 3-1: not running at top speed; connect to a high speed hub [ 414.146922][T10862] netlink: 640 bytes leftover after parsing attributes in process `syz.1.1579'. [ 414.147115][ T5633] usb 3-1: config 9 has an invalid interface number: 124 but max is 0 [ 414.194315][ T5633] usb 3-1: config 9 has no interface number 0 [ 414.222698][ T5633] usb 3-1: config 9 interface 124 altsetting 195 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 414.268684][ T5633] usb 3-1: config 9 interface 124 altsetting 195 endpoint 0xB has an invalid bInterval 0, changing to 4 [ 414.291666][ T5633] usb 3-1: config 9 interface 124 altsetting 195 endpoint 0xB has invalid wMaxPacketSize 0 [ 414.303247][ T5633] usb 3-1: config 9 interface 124 has no altsetting 0 [ 414.314616][ T5633] usb 3-1: New USB device found, idVendor=fff0, idProduct=fff0, bcdDevice=42.b4 [ 414.324432][ T5633] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.332915][ T5633] usb 3-1: Product: syz [ 414.350557][ T5633] usb 3-1: Manufacturer: syz [ 414.369383][ T5633] usb 3-1: SerialNumber: syz [ 414.656110][T10856] tipc: Enabling of bearer rejected, failed to enable media [ 414.770490][ T30] kauditd_printk_skb: 255 callbacks suppressed [ 414.770508][ T30] audit: type=1326 audit(1784216957.766:7440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10874 comm="syz.4.1582" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b4e19de59 code=0x7ffc0000 [ 414.812643][ T5633] usbtest 3-1:9.124: couldn't get endpoints, -71 [ 414.830358][ T5633] usbtest 3-1:9.124: probe with driver usbtest failed with error -71 [ 414.880654][ T5633] usb 3-1: USB disconnect, device number 56 [ 414.922160][ T30] audit: type=1326 audit(1784216957.856:7441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10874 comm="syz.4.1582" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b4e19de59 code=0x7ffc0000 [ 415.023791][ T30] audit: type=1326 audit(1784216957.856:7442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10874 comm="syz.4.1582" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f3b4e19de59 code=0x7ffc0000 [ 415.101093][ T30] audit: type=1326 audit(1784216957.856:7443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10874 comm="syz.4.1582" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b4e19de59 code=0x7ffc0000 [ 415.148823][ T30] audit: type=1326 audit(1784216957.856:7444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10874 comm="syz.4.1582" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b4e19de59 code=0x7ffc0000 [ 415.186238][ T30] audit: type=1326 audit(1784216957.856:7445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10874 comm="syz.4.1582" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f3b4e19de59 code=0x7ffc0000 [ 415.211088][ T30] audit: type=1326 audit(1784216957.856:7446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10874 comm="syz.4.1582" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b4e19de59 code=0x7ffc0000 [ 415.236081][ T30] audit: type=1326 audit(1784216957.856:7447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10874 comm="syz.4.1582" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b4e19de59 code=0x7ffc0000 [ 415.338939][ T30] audit: type=1326 audit(1784216957.856:7448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10874 comm="syz.4.1582" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f3b4e19de59 code=0x7ffc0000 [ 415.381707][ T30] audit: type=1326 audit(1784216957.856:7449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10874 comm="syz.4.1582" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b4e19de59 code=0x7ffc0000 [ 415.667993][T10881] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1583'. [ 415.898972][T10881] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 417.358730][ T5688] usb 38-1: device descriptor read/8, error -110 [ 417.721621][ T5633] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 417.794449][ T5688] usb usb38-port1: attempt power cycle [ 417.912084][ T5633] usb 5-1: Using ep0 maxpacket: 32 [ 417.928128][ T5633] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 417.951117][ T5633] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 417.986312][ T5633] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 418.016337][ T5633] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 418.058482][ T5633] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 418.095400][ T5633] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 418.159089][ T5633] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 418.197189][ T5633] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.239717][ T5633] usb 5-1: config 0 descriptor?? [ 418.404933][ T5688] usb usb38-port1: unable to enumerate USB device [ 418.486110][ T5633] usblp 5-1:0.0: usblp1: USB Bidirectional printer dev 57 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 418.605242][ T5633] usb 5-1: USB disconnect, device number 57 [ 418.666273][ T5633] usblp1: removed [ 419.024168][ T5633] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 419.202207][ T5633] usb 5-1: Using ep0 maxpacket: 32 [ 419.216875][ T5633] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 419.251548][ T5633] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 419.281724][ T5633] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 419.301789][ T5633] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 419.323961][ T5633] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 419.334028][ T10] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 419.360827][ T5633] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 419.399077][ T5633] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 419.422472][ T5633] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.476220][ T5633] usb 5-1: config 0 descriptor?? [ 419.514311][ T10] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 419.550162][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 419.570354][ T10] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 419.601961][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 419.623112][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 419.657457][ T10] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 419.701593][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 419.733341][ T5633] usblp 5-1:0.0: usblp1: USB Bidirectional printer dev 58 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 419.744645][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 419.769971][ T10] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 419.803766][T10921] binder: 10920:10921 ioctl 40809440 200000005c80 returned -22 [ 419.808164][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 419.828534][T10921] binder: 10920:10921 ioctl c0306201 2000000004c0 returned -22 [ 419.840031][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 419.851300][ T10] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 419.915709][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 419.924664][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 419.936066][ T10] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 419.976804][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 419.989831][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 420.004725][ T10] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 420.019377][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 420.028079][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 420.046512][ T10] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 420.061628][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 420.072700][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 420.083976][ T10] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 420.102927][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 420.119548][ T10] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 420.141055][ T10] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 420.162541][ T10] usb 2-1: Product: syz [ 420.170219][ T10] usb 2-1: Manufacturer: syz [ 420.184898][ T10] usb 2-1: SerialNumber: syz [ 420.206206][ T10] usb 2-1: config 0 descriptor?? [ 420.228108][ T10] yurex 2-1:0.0: USB YUREX device now attached to Yurex #2 [ 420.262699][ T5764] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 420.344110][T10934] FAULT_INJECTION: forcing a failure. [ 420.344110][T10934] name failslab, interval 1, probability 0, space 0, times 0 [ 420.357989][T10934] CPU: 0 UID: 0 PID: 10934 Comm: syz.3.1601 Tainted: G L syzkaller #0 PREEMPT(full) [ 420.358022][T10934] Tainted: [L]=SOFTLOCKUP [ 420.358029][T10934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 420.358039][T10934] Call Trace: [ 420.358047][T10934] [ 420.358055][T10934] dump_stack_lvl+0xe8/0x150 [ 420.358089][T10934] should_fail_ex+0x40c/0x560 [ 420.358116][T10934] should_failslab+0xa8/0x100 [ 420.358145][T10934] __kmalloc_cache_noprof+0xa8/0x660 [ 420.358170][T10934] ? vhost_task_create+0x123/0x380 [ 420.358220][T10934] ? vhost_task_create+0x123/0x380 [ 420.358248][T10934] vhost_task_create+0x123/0x380 [ 420.358273][T10934] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 420.358311][T10934] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 420.358333][T10934] ? __pfx_vhost_task_create+0x10/0x10 [ 420.358364][T10934] ? __pfx_vhost_task_fn+0x10/0x10 [ 420.358393][T10934] ? __lock_acquire+0x683/0x2cf0 [ 420.358416][T10934] ? __kasan_slab_free+0x5c/0x80 [ 420.358439][T10934] ? kfree+0x1c5/0x640 [ 420.358461][T10934] kvm_mmu_post_init_vm+0x147/0x2b0 [ 420.358495][T10934] kvm_arch_vcpu_ioctl_run+0x11f/0x2070 [ 420.358530][T10934] ? look_up_lock_class+0x57/0x110 [ 420.358557][T10934] ? register_lock_class+0x31/0x2e0 [ 420.358579][T10934] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 420.358602][T10934] ? __lock_acquire+0x683/0x2cf0 [ 420.358628][T10934] ? __mutex_lock+0x30d/0x1550 [ 420.358658][T10934] ? kasan_quarantine_put+0xbb/0x1f0 [ 420.358703][T10934] ? do_raw_write_lock+0x11d/0x260 [ 420.358739][T10934] kvm_vcpu_ioctl+0xa61/0xfd0 [ 420.358777][T10934] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 420.358796][T10934] ? hook_file_ioctl+0x1f0/0x5f0 [ 420.358841][T10934] ? __fget_files+0x2a/0x420 [ 420.358869][T10934] ? __fget_files+0x2a/0x420 [ 420.358891][T10934] ? __fget_files+0x3a2/0x420 [ 420.358912][T10934] ? __fget_files+0x2a/0x420 [ 420.358937][T10934] ? bpf_lsm_file_ioctl+0x9/0x20 [ 420.358959][T10934] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 420.358980][T10934] __se_sys_ioctl+0xfc/0x170 [ 420.358996][T10934] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.359015][T10934] do_syscall_64+0x174/0x580 [ 420.359044][T10934] ? clear_bhb_loop+0x40/0x90 [ 420.359067][T10934] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.359086][T10934] RIP: 0033:0x7ff3a5f9de59 [ 420.359103][T10934] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 420.359117][T10934] RSP: 002b:00007ff3a6ec5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 420.359137][T10934] RAX: ffffffffffffffda RBX: 00007ff3a6225fa0 RCX: 00007ff3a5f9de59 [ 420.359151][T10934] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 420.359163][T10934] RBP: 00007ff3a6ec5090 R08: 0000000000000000 R09: 0000000000000000 [ 420.359175][T10934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 420.359186][T10934] R13: 00007ff3a6226038 R14: 00007ff3a6225fa0 R15: 00007ff3a634fa48 [ 420.359217][T10934] [ 420.431657][ T5764] usb 1-1: Using ep0 maxpacket: 32 [ 420.755751][ T5764] usb 1-1: unable to get BOS descriptor or descriptor too short [ 420.773510][ T5764] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 420.783738][ T5764] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 420.792655][ T5764] usb 1-1: config 14 has no interface number 0 [ 420.799104][ T5764] usb 1-1: config 14 has no interface number 1 [ 420.805583][ T5764] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 420.817568][ T5764] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 420.829699][ T5764] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 420.841375][ T5764] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 420.842675][ T9] usb 2-1: USB disconnect, device number 57 [ 420.853588][ T5764] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 420.877736][T10938] trusted_key: encrypted_key: master key parameter 'user' is invalid [ 420.904756][ T9] yurex 2-1:0.0: USB YUREX #2 now disconnected [ 420.924790][ T5764] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 420.938789][ T5764] usb 1-1: config 14 interface 57 has no altsetting 0 [ 420.946093][ T5764] usb 1-1: config 14 interface 228 has no altsetting 0 [ 420.966526][ T5764] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 420.976838][ T5764] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.000602][ T5764] usb 1-1: Product: syz [ 421.042639][ T5764] usb 1-1: Manufacturer: syz [ 421.052425][ T5764] usb 1-1: SerialNumber: syz [ 421.125029][T10938] netlink: 'syz.2.1602': attribute type 16 has an invalid length. [ 421.141353][ T9] usb 5-1: USB disconnect, device number 58 [ 421.178139][ T9] usblp1: removed [ 421.285818][T10946] pim6reg1: entered promiscuous mode [ 421.296732][T10946] pim6reg1: entered allmulticast mode [ 421.494479][ T5764] legousbtower 1-1:14.57: interrupt endpoints not found [ 421.903543][ T5764] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 421.951715][ T5764] legousbtower 1-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 422.106606][T10929] FAULT_INJECTION: forcing a failure. [ 422.106606][T10929] name failslab, interval 1, probability 0, space 0, times 0 [ 422.123948][T10929] CPU: 1 UID: 0 PID: 10929 Comm: syz.0.1599 Tainted: G L syzkaller #0 PREEMPT(full) [ 422.123981][T10929] Tainted: [L]=SOFTLOCKUP [ 422.123987][T10929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 422.123996][T10929] Call Trace: [ 422.124003][T10929] [ 422.124011][T10929] dump_stack_lvl+0xe8/0x150 [ 422.124043][T10929] should_fail_ex+0x40c/0x560 [ 422.124068][T10929] should_failslab+0xa8/0x100 [ 422.124096][T10929] __kmalloc_noprof+0xfe/0x720 [ 422.124120][T10929] ? tomoyo_encode+0x2ad/0x570 [ 422.124138][T10929] ? tomoyo_encode+0x2ad/0x570 [ 422.124162][T10929] tomoyo_encode+0x2ad/0x570 [ 422.124188][T10929] tomoyo_realpath_from_path+0x5fa/0x640 [ 422.124221][T10929] tomoyo_check_open_permission+0x229/0x470 [ 422.124250][T10929] ? tomoyo_check_open_permission+0x1d3/0x470 [ 422.124276][T10929] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 422.124304][T10929] ? __asan_memset+0x22/0x50 [ 422.124360][T10929] security_file_open+0xa9/0x240 [ 422.124386][T10929] do_dentry_open+0x4a0/0x1380 [ 422.124417][T10929] vfs_open+0x3b/0x340 [ 422.124436][T10929] ? path_openat+0x2e2d/0x3830 [ 422.124464][T10929] path_openat+0x2e44/0x3830 [ 422.124494][T10929] ? kasan_save_track+0x3e/0x80 [ 422.124517][T10929] ? do_sys_openat2+0xcc/0x200 [ 422.124539][T10929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.124577][T10929] do_file_open+0x23e/0x4a0 [ 422.124609][T10929] ? __pfx_do_file_open+0x10/0x10 [ 422.124662][T10929] ? _raw_spin_unlock+0x28/0x50 [ 422.124684][T10929] ? alloc_fd+0x651/0x6c0 [ 422.124713][T10929] do_sys_openat2+0x115/0x200 [ 422.124738][T10929] ? __pfx_do_sys_openat2+0x10/0x10 [ 422.124760][T10929] ? exc_page_fault+0x6a/0xc0 [ 422.124792][T10929] ? do_user_addr_fault+0xc4a/0x1340 [ 422.124822][T10929] __x64_sys_openat+0x138/0x170 [ 422.124847][T10929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.124867][T10929] do_syscall_64+0x174/0x580 [ 422.124891][T10929] ? trace_irq_disable+0x3b/0x140 [ 422.124915][T10929] ? clear_bhb_loop+0x40/0x90 [ 422.124938][T10929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.124957][T10929] RIP: 0033:0x7f973af5e68e [ 422.124975][T10929] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 422.124990][T10929] RSP: 002b:00007f973be28b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 422.125010][T10929] RAX: ffffffffffffffda RBX: 00007f973be296c0 RCX: 00007f973af5e68e [ 422.125024][T10929] RDX: 0000000000000002 RSI: 00007f973be28c00 RDI: ffffffffffffff9c [ 422.125036][T10929] RBP: 00007f973be29090 R08: 0000000000000000 R09: 0000000000000000 [ 422.125048][T10929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 422.125060][T10929] R13: 00007f973b226038 R14: 00007f973b225fa0 R15: 00007f973b34fa48 [ 422.125087][T10929] [ 422.125185][T10929] ERROR: Out of memory at tomoyo_realpath_from_path. [ 422.526139][ T9] usb 1-1: USB disconnect, device number 59 [ 422.558509][ T9] legousbtower 1-1:14.228: LEGO USB Tower #-159 now disconnected [ 422.713089][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.723508][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.711900][ T9] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 423.933180][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 424.078090][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 424.088395][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 424.099014][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 424.109540][ T9] usb 1-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 424.120739][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.132782][ T9] usb 1-1: config 0 descriptor?? [ 424.573070][ T9] hdpvr 1-1:0.0: unexpected answer of status request, len -32 [ 424.601970][ T9] hdpvr 1-1:0.0: device init failed [ 424.612778][ T9] hdpvr 1-1:0.0: probe with driver hdpvr failed with error -12 [ 424.634212][ T6567] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.646031][ T5633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.656350][ T62] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.678160][ T5764] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.698417][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.854143][T10994] syzkaller1: entered promiscuous mode [ 424.867479][T10994] syzkaller1: entered allmulticast mode [ 425.276645][ T62] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.302485][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.317932][ T5633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.722904][T11017] xt_l2tp: v2 doesn't support IP mode [ 427.026551][T11026] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 427.107262][T11026] bond3 (unregistering): Released all slaves [ 427.182566][ T5633] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 427.305563][ T1603] usb 1-1: USB disconnect, device number 60 [ 427.391630][ T5633] usb 5-1: Using ep0 maxpacket: 32 [ 427.405730][ T5633] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 427.418824][ T5633] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.454255][ T5633] usb 5-1: config 0 descriptor?? [ 427.705532][ T5633] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 427.723405][ T5633] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 427.756665][ T5633] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 427.771820][ T5633] usb 5-1: media controller created [ 427.782562][ T29] usb 2-1: new full-speed USB device number 58 using dummy_hcd [ 427.813859][ T5633] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 427.832221][ T5709] net_ratelimit: 8 callbacks suppressed [ 427.832240][ T5709] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.861634][ T9] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 427.984513][ T29] usb 2-1: config 8 has an invalid interface number: 92 but max is 0 [ 427.994723][ T29] usb 2-1: config 8 has no interface number 0 [ 428.010703][ T29] usb 2-1: config 8 interface 92 has no altsetting 0 [ 428.022570][ T29] usb 2-1: New USB device found, idVendor=06e1, idProduct=a334, bcdDevice=c4.9f [ 428.032434][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.040641][ T29] usb 2-1: Product: syz [ 428.045714][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 428.046058][ T29] usb 2-1: Manufacturer: syz [ 428.082517][ T9] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 428.101624][ T29] usb 2-1: SerialNumber: syz [ 428.116658][ T9] usb 1-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 428.129783][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.144688][ T9] usb 1-1: Product: syz [ 428.149012][ T9] usb 1-1: Manufacturer: syz [ 428.155252][ T9] usb 1-1: SerialNumber: syz [ 428.190879][ T12] syzkaller0: tun_net_xmit 48 [ 428.215905][T11043] loop4: detected capacity change from 0 to 2640 [ 428.228924][T11043] buffer_io_error: 11 callbacks suppressed [ 428.228940][T11043] Buffer I/O error on dev loop4, logical block 0, async page read [ 428.247108][ T7273] Buffer I/O error on dev loop4, logical block 0, async page read [ 428.258022][T11043] Buffer I/O error on dev loop4, logical block 0, async page read [ 428.269717][ T7273] Buffer I/O error on dev loop4, logical block 0, async page read [ 428.278847][T11043] Buffer I/O error on dev loop4, logical block 0, async page read [ 428.289001][ T7273] Buffer I/O error on dev loop4, logical block 0, async page read [ 428.298274][ T7273] Buffer I/O error on dev loop4, logical block 0, async page read [ 428.307049][T11043] Buffer I/O error on dev loop4, logical block 0, async page read [ 428.323013][ T5633] az6027: usb out operation failed. (-71) [ 428.344014][ T5633] stb0899_attach: Driver disabled by Kconfig [ 428.352570][T11043] Buffer I/O error on dev loop4, logical block 0, async page read [ 428.362062][ T5633] az6027: no front-end attached [ 428.362062][ T5633] [ 428.370661][ T5633] az6027: usb out operation failed. (-71) [ 428.386551][ T5633] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 428.395860][T11043] Buffer I/O error on dev loop4, logical block 0, async page read [ 428.408972][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.432005][ T5633] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input23 [ 428.467014][T11043] ldm_validate_partition_table(): Disk read failed. [ 428.516262][T11043] Dev loop4: unable to read RDB block 0 [ 428.527945][ T5633] dvb-usb: schedule remote query interval to 400 msecs. [ 428.567401][ T5633] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 428.582003][T11043] loop4: unable to read partition table [ 428.590268][ T29] dvb-usb: found a 'KWorld/ADSTech Instant DVB-T USB2.0' in warm state. [ 428.602312][ T29] dvb-usb: bulk message failed: -22 (3/0) [ 428.614159][ T29] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 428.624663][ T29] dvbdev: DVB: registering new adapter (KWorld/ADSTech Instant DVB-T USB2.0) [ 428.627588][T11043] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 428.635304][ T29] usb 2-1: media controller created [ 428.657280][ T5633] usb 5-1: USB disconnect, device number 59 [ 428.666935][ T29] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 428.757066][ T29] dvb-usb: bulk message failed: -22 (6/0) [ 428.777294][ T29] dvb-usb: no frontend was attached by 'KWorld/ADSTech Instant DVB-T USB2.0' [ 428.804022][ T29] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input24 [ 428.824751][ T5633] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 428.852888][ T29] dvb-usb: schedule remote query interval to 150 msecs. [ 428.872364][ T5709] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.889353][ T29] dvb-usb: KWorld/ADSTech Instant DVB-T USB2.0 successfully initialized and connected. [ 428.930271][ T29] usb 2-1: USB disconnect, device number 58 [ 429.094395][T11038] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.125505][T11038] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.157550][ T29] dvb-usb: KWorld/ADSTech Instant DVB-T USB2.0 successfully deinitialized and disconnected. [ 429.273487][ T9] usb 1-1: USB disconnect, device number 61 [ 429.551649][ T5633] usb 3-1: new full-speed USB device number 57 using dummy_hcd [ 429.753824][ T5633] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 429.796564][ T5633] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 429.838480][T11068] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1643'. [ 429.855791][ T5633] usb 3-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 429.878561][T11068] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 429.913121][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.923982][ T5633] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 429.955122][ T5633] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 429.973303][ T5633] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.997695][ T5633] usb 3-1: Product: syz [ 430.018848][ T5633] usb 3-1: Manufacturer: syz [ 430.041229][ T5633] usb 3-1: SerialNumber: syz [ 430.078823][T11058] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 430.278059][T11071] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 430.353066][T11058] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 430.392817][ T6567] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.406441][ T1603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.415781][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.427524][ T5709] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.495403][ T30] kauditd_printk_skb: 167 callbacks suppressed [ 430.495443][ T30] audit: type=1326 audit(1784216973.496:7617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11072 comm="syz.0.1645" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f973af9de59 code=0x7ffc0000 [ 430.627998][ T30] audit: type=1326 audit(1784216973.536:7618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11072 comm="syz.0.1645" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f973af9de59 code=0x7ffc0000 [ 430.766923][ T30] audit: type=1326 audit(1784216973.536:7619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11072 comm="syz.0.1645" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f973af9de59 code=0x7ffc0000 [ 430.889393][ T30] audit: type=1326 audit(1784216973.536:7620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11072 comm="syz.0.1645" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f973af9de59 code=0x7ffc0000 [ 431.053818][ T30] audit: type=1326 audit(1784216973.536:7621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11072 comm="syz.0.1645" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f973af9de59 code=0x7ffc0000 [ 431.190015][ T30] audit: type=1326 audit(1784216973.536:7622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11072 comm="syz.0.1645" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f973af9de59 code=0x7ffc0000 [ 431.314273][ T30] audit: type=1326 audit(1784216973.536:7623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11072 comm="syz.0.1645" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f973af9de59 code=0x7ffc0000 [ 431.423800][ T30] audit: type=1326 audit(1784216973.536:7624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11072 comm="syz.0.1645" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f973af9de59 code=0x7ffc0000 [ 431.457338][T11084] fuse: Bad value for 'fd' [ 431.573935][ T30] audit: type=1326 audit(1784216973.536:7625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11072 comm="syz.0.1645" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f973af9de59 code=0x7ffc0000 [ 431.733548][ T30] audit: type=1326 audit(1784216973.536:7626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11072 comm="syz.0.1645" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f973af9de59 code=0x7ffc0000 [ 432.466338][T11088] loop4: detected capacity change from 0 to 2640 [ 432.554356][T11088] ldm_validate_partition_table(): Disk read failed. [ 432.608624][T11088] Dev loop4: unable to read RDB block 0 [ 432.644435][T11088] loop4: unable to read partition table [ 432.662113][T11088] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 432.975574][T11094] ipvlan0: entered promiscuous mode [ 433.023591][T11094] ipvlan0: left promiscuous mode [ 433.513707][ T29] net_ratelimit: 11 callbacks suppressed [ 433.513736][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.557437][ T5633] cdc_ncm 3-1:1.0: bind() failure [ 433.651630][ T5633] cdc_ncm 3-1:1.1: probe with driver cdc_ncm failed with error -71 [ 433.706709][ T5633] cdc_mbim 3-1:1.1: probe with driver cdc_mbim failed with error -71 [ 433.766778][ T5633] usbtest 3-1:1.1: probe with driver usbtest failed with error -71 [ 433.781804][ T5709] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 433.817981][T11104] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 433.862163][ T5633] usb 3-1: USB disconnect, device number 57 [ 433.974671][ T5709] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 434.048942][ T5709] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.072348][ T1603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 434.129477][ T5709] usb 5-1: config 0 descriptor?? [ 434.351299][ T5633] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 434.531667][ T5633] usb 3-1: Using ep0 maxpacket: 16 [ 434.551961][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 434.555364][ T5633] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 434.590409][T11111] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.606778][ T5633] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 434.618972][T11111] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.636337][ T5633] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.688032][ T5633] usb 3-1: config 0 descriptor?? [ 434.811846][ T5709] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 434.857998][ T5709] [drm:udl_init] *ERROR* Selecting channel failed [ 435.019332][ T5709] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 435.075663][ T5709] [drm] Initialized udl on minor 2 [ 435.129216][ T5709] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 435.158419][T11122] tipc: Cannot configure node identity twice [ 435.181425][ T5709] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 435.184801][ T29] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 435.208563][T11123] trusted_key: encrypted_key: master key parameter 'trusted:' is invalid [ 435.272413][ T5709] usb 5-1: USB disconnect, device number 60 [ 435.293187][ T5633] mcp2221 0003:04D8:00DD.0015: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 435.296354][T11121] xt_hashlimit: size too large, truncated to 1048576 [ 435.334827][ T29] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 435.349208][T11122] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 435.362412][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 435.391310][ T29] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 435.511907][ C0] ================================================================== [ 435.513896][ T151] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 435.520461][ C0] BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x10b0/0x12a0 [ 435.536877][ C0] Read of size 1 at addr ffff888052807fff by task rcu_preempt/16 [ 435.544698][ C0] [ 435.547050][ C0] CPU: 0 UID: 0 PID: 16 Comm: rcu_preempt Tainted: G L syzkaller #0 PREEMPT(full) [ 435.547087][ C0] Tainted: [L]=SOFTLOCKUP [ 435.547096][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 435.547111][ C0] Call Trace: [ 435.547120][ C0] [ 435.547130][ C0] dump_stack_lvl+0xe8/0x150 [ 435.547170][ C0] print_address_description+0x55/0x1e0 [ 435.547238][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 435.547269][ C0] print_report+0x58/0x70 [ 435.547297][ C0] kasan_report+0x117/0x150 [ 435.547332][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 435.547357][ C0] mcp2221_raw_event+0x10b0/0x12a0 [ 435.547378][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 435.547412][ C0] ? down_trylock+0x50/0xb0 [ 435.547431][ C0] __hid_input_report+0x41c/0x580 [ 435.547460][ C0] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 435.547565][ C0] hid_irq_in+0x492/0x710 [ 435.547633][ C0] __usb_hcd_giveback_urb+0x374/0x530 [ 435.547708][ C0] dummy_timer+0xac3/0x4b40 [ 435.547770][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 435.547793][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 435.547823][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 435.547878][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 435.547909][ C0] hrtimer_run_softirq+0x17a/0x240 [ 435.547936][ C0] handle_softirqs+0x225/0x840 [ 435.547961][ C0] ? __irq_exit_rcu+0xca/0x220 [ 435.547988][ C0] __irq_exit_rcu+0xca/0x220 [ 435.548012][ C0] irq_exit_rcu+0x9/0x30 [ 435.548032][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 435.548061][ C0] [ 435.548068][ C0] [ 435.548075][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 435.548099][ C0] RIP: 0010:finish_task_switch+0x417/0xc60 [ 435.548126][ C0] Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 63 fa 3c 0a e8 8e a9 39 00 fb 4c 8b 65 c8 <49> 8d bc 24 f8 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 435.548146][ C0] RSP: 0018:ffffc90000157840 EFLAGS: 00000206 [ 435.548167][ C0] RAX: 00000000000f45a5 RBX: ffff8880b863bf20 RCX: 0000000080000001 [ 435.548185][ C0] RDX: 0000000000000000 RSI: ffffffff8e22b72d RDI: ffffffff8c4bd980 [ 435.548201][ C0] RBP: ffffc90000157890 R08: ffffffff905781f7 R09: 1ffffffff20af03e [ 435.548217][ C0] R10: dffffc0000000000 R11: fffffbfff20af03f R12: ffff88801dec0000 [ 435.548232][ C0] R13: ffff8880b863bee8 R14: dffffc0000000000 R15: 1ffff110170c77e4 [ 435.548268][ C0] __schedule+0x17e1/0x56c0 [ 435.548298][ C0] ? __lock_acquire+0x683/0x2cf0 [ 435.548339][ C0] ? __pfx___schedule+0x10/0x10 [ 435.548372][ C0] ? schedule+0x90/0x2b0 [ 435.548399][ C0] schedule+0x164/0x2b0 [ 435.548427][ C0] schedule_timeout+0x152/0x2c0 [ 435.548451][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 435.548477][ C0] ? __pfx_process_timeout+0x10/0x10 [ 435.548503][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 435.548532][ C0] ? prepare_to_swait_event+0x322/0x350 [ 435.548558][ C0] rcu_gp_fqs_loop+0x30c/0x11f0 [ 435.548592][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 435.548622][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 435.548654][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 435.548683][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 435.548721][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 435.548751][ C0] rcu_gp_kthread+0x9e/0x2b0 [ 435.548783][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 435.548813][ C0] ? __kthread_parkme+0x71/0x1f0 [ 435.548841][ C0] ? __kthread_parkme+0x196/0x1f0 [ 435.548871][ C0] kthread+0x388/0x470 [ 435.548902][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 435.548931][ C0] ? __pfx_kthread+0x10/0x10 [ 435.548960][ C0] ret_from_fork+0x514/0xb70 [ 435.549013][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 435.549045][ C0] ? __switch_to+0xc89/0x1420 [ 435.549070][ C0] ? __pfx_kthread+0x10/0x10 [ 435.549100][ C0] ret_from_fork_asm+0x1a/0x30 [ 435.549128][ C0] [ 435.549136][ C0] [ 435.929159][ C0] Allocated by task 5627: [ 435.933478][ C0] kasan_save_track+0x3e/0x80 [ 435.938171][ C0] __kasan_kmalloc+0x93/0xb0 [ 435.942864][ C0] __kmalloc_noprof+0x375/0x720 [ 435.947723][ C0] tomoyo_realpath_from_path+0xef/0x640 [ 435.953281][ C0] tomoyo_path_number_perm+0x246/0x5f0 [ 435.958748][ C0] tomoyo_path_mknod+0x14a/0x1a0 [ 435.963705][ C0] security_path_mknod+0x176/0x370 [ 435.968900][ C0] may_o_create+0x2d/0x370 [ 435.973426][ C0] path_openat+0xfab/0x3830 [ 435.977948][ C0] do_file_open+0x23e/0x4a0 [ 435.982645][ C0] do_sys_openat2+0x115/0x200 [ 435.987332][ C0] __x64_sys_openat+0x138/0x170 [ 435.992285][ C0] do_syscall_64+0x174/0x580 [ 435.996891][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.002787][ C0] [ 436.005148][ C0] Freed by task 5627: [ 436.009117][ C0] kasan_save_track+0x3e/0x80 [ 436.013801][ C0] kasan_save_free_info+0x40/0x50 [ 436.018911][ C0] __kasan_slab_free+0x5c/0x80 [ 436.023681][ C0] kfree+0x1c5/0x640 [ 436.027580][ C0] tomoyo_realpath_from_path+0x605/0x640 [ 436.033216][ C0] tomoyo_path_number_perm+0x246/0x5f0 [ 436.038767][ C0] tomoyo_path_mknod+0x14a/0x1a0 [ 436.043711][ C0] security_path_mknod+0x176/0x370 [ 436.048832][ C0] may_o_create+0x2d/0x370 [ 436.053260][ C0] path_openat+0xfab/0x3830 [ 436.057782][ C0] do_file_open+0x23e/0x4a0 [ 436.062317][ C0] do_sys_openat2+0x115/0x200 [ 436.066996][ C0] __x64_sys_openat+0x138/0x170 [ 436.071941][ C0] do_syscall_64+0x174/0x580 [ 436.076536][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.082690][ C0] [ 436.085013][ C0] The buggy address belongs to the object at ffff888052806000 [ 436.085013][ C0] which belongs to the cache kmalloc-4k of size 4096 [ 436.099069][ C0] The buggy address is located 4095 bytes to the right of [ 436.099069][ C0] allocated 4096-byte region [ffff888052806000, ffff888052807000) [ 436.114007][ C0] [ 436.116353][ C0] The buggy address belongs to the physical page: [ 436.122968][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x52800 [ 436.131767][ C0] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 436.140435][ C0] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 436.148117][ C0] page_type: f5(slab) [ 436.152116][ C0] raw: 00fff00000000040 ffff88801b004140 dead000000000100 dead000000000122 [ 436.161153][ C0] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 436.169761][ C0] head: 00fff00000000040 ffff88801b004140 dead000000000100 dead000000000122 [ 436.178441][ C0] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 436.187134][ C0] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 436.195813][ C0] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 436.204482][ C0] page dumped because: kasan: bad access detected [ 436.210893][ C0] page_owner tracks the page as allocated [ 436.216625][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4990, tgid 4990 (udevd), ts 209695917270, free_ts 209599901081 [ 436.236901][ C0] post_alloc_hook+0x1f9/0x250 [ 436.241689][ C0] get_page_from_freelist+0x21fa/0x2270 [ 436.247255][ C0] __alloc_frozen_pages_noprof+0x18d/0x380 [ 436.253071][ C0] allocate_slab+0x79/0x5e0 [ 436.257685][ C0] refill_objects+0x2d5/0x350 [ 436.262447][ C0] __pcs_replace_empty_main+0x2bf/0x6b0 [ 436.268002][ C0] __kmalloc_noprof+0x485/0x720 [ 436.272863][ C0] tomoyo_realpath_from_path+0xef/0x640 [ 436.278497][ C0] tomoyo_path_perm+0x283/0x560 [ 436.283447][ C0] security_inode_getattr+0x12b/0x310 [ 436.288913][ C0] __x64_sys_newfstat+0x133/0x270 [ 436.293954][ C0] do_syscall_64+0x174/0x580 [ 436.298549][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.304537][ C0] page last free pid 5771 tgid 5771 stack trace: [ 436.310950][ C0] __free_frozen_pages+0xc1e/0xd10 [ 436.316083][ C0] __slab_free+0x274/0x2c0 [ 436.320511][ C0] qlist_free_all+0x99/0x100 [ 436.325111][ C0] kasan_quarantine_reduce+0x148/0x160 [ 436.330567][ C0] __kasan_slab_alloc+0x22/0x80 [ 436.335416][ C0] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 436.340907][ C0] do_getname+0x2e/0x250 [ 436.345159][ C0] vfs_fstatat+0x45/0x170 [ 436.349510][ C0] __x64_sys_newfstatat+0x151/0x200 [ 436.354810][ C0] do_syscall_64+0x174/0x580 [ 436.359511][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.365412][ C0] [ 436.367816][ C0] Memory state around the buggy address: [ 436.373609][ C0] ffff888052807e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 436.381746][ C0] ffff888052807f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 436.389902][ C0] >ffff888052807f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 436.397985][ C0] ^ [ 436.405963][ C0] ffff888052808000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 436.414022][ C0] ffff888052808080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 436.422077][ C0] ================================================================== [ 436.430331][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 436.437633][ C0] CPU: 0 UID: 0 PID: 16 Comm: rcu_preempt Tainted: G L syzkaller #0 PREEMPT(full) [ 436.448500][ C0] Tainted: [L]=SOFTLOCKUP [ 436.452997][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 436.463059][ C0] Call Trace: [ 436.466357][ C0] [ 436.469295][ C0] vpanic+0x56c/0xa60 [ 436.473304][ C0] ? __pfx_vpanic+0x10/0x10 [ 436.477824][ C0] panic+0xc5/0xd0 [ 436.481690][ C0] ? __pfx_panic+0x10/0x10 [ 436.486121][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 436.491406][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 436.496693][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 436.501981][ C0] check_panic_on_warn+0x89/0xb0 [ 436.506928][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 436.512255][ C0] end_report+0x73/0x170 [ 436.516526][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 436.521904][ C0] kasan_report+0x128/0x150 [ 436.526432][ C0] ? mcp2221_raw_event+0x10b0/0x12a0 [ 436.531721][ C0] mcp2221_raw_event+0x10b0/0x12a0 [ 436.536846][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 436.542773][ C0] ? down_trylock+0x50/0xb0 [ 436.547548][ C0] __hid_input_report+0x41c/0x580 [ 436.552606][ C0] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 436.558080][ C0] hid_irq_in+0x492/0x710 [ 436.562509][ C0] __usb_hcd_giveback_urb+0x374/0x530 [ 436.567885][ C0] dummy_timer+0xac3/0x4b40 [ 436.572416][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 436.577365][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 436.583182][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 436.588207][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 436.593601][ C0] hrtimer_run_softirq+0x17a/0x240 [ 436.598728][ C0] handle_softirqs+0x225/0x840 [ 436.603489][ C0] ? __irq_exit_rcu+0xca/0x220 [ 436.608266][ C0] __irq_exit_rcu+0xca/0x220 [ 436.612952][ C0] irq_exit_rcu+0x9/0x30 [ 436.617204][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 436.622953][ C0] [ 436.625887][ C0] [ 436.628843][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 436.634834][ C0] RIP: 0010:finish_task_switch+0x417/0xc60 [ 436.640663][ C0] Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 63 fa 3c 0a e8 8e a9 39 00 fb 4c 8b 65 c8 <49> 8d bc 24 f8 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 436.660322][ C0] RSP: 0018:ffffc90000157840 EFLAGS: 00000206 [ 436.666517][ C0] RAX: 00000000000f45a5 RBX: ffff8880b863bf20 RCX: 0000000080000001 [ 436.674490][ C0] RDX: 0000000000000000 RSI: ffffffff8e22b72d RDI: ffffffff8c4bd980 [ 436.682657][ C0] RBP: ffffc90000157890 R08: ffffffff905781f7 R09: 1ffffffff20af03e [ 436.690891][ C0] R10: dffffc0000000000 R11: fffffbfff20af03f R12: ffff88801dec0000 [ 436.699040][ C0] R13: ffff8880b863bee8 R14: dffffc0000000000 R15: 1ffff110170c77e4 [ 436.707027][ C0] __schedule+0x17e1/0x56c0 [ 436.711581][ C0] ? __lock_acquire+0x683/0x2cf0 [ 436.716529][ C0] ? __pfx___schedule+0x10/0x10 [ 436.721508][ C0] ? schedule+0x90/0x2b0 [ 436.725852][ C0] schedule+0x164/0x2b0 [ 436.730013][ C0] schedule_timeout+0x152/0x2c0 [ 436.734879][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 436.740375][ C0] ? __pfx_process_timeout+0x10/0x10 [ 436.745665][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 436.751743][ C0] ? prepare_to_swait_event+0x322/0x350 [ 436.757315][ C0] rcu_gp_fqs_loop+0x30c/0x11f0 [ 436.762169][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 436.767390][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 436.773505][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 436.779018][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 436.784261][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 436.790084][ C0] rcu_gp_kthread+0x9e/0x2b0 [ 436.794778][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 436.799990][ C0] ? __kthread_parkme+0x71/0x1f0 [ 436.805089][ C0] ? __kthread_parkme+0x196/0x1f0 [ 436.810210][ C0] kthread+0x388/0x470 [ 436.814384][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 436.819586][ C0] ? __pfx_kthread+0x10/0x10 [ 436.824191][ C0] ret_from_fork+0x514/0xb70 [ 436.828981][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 436.834099][ C0] ? __switch_to+0xc89/0x1420 [ 436.838790][ C0] ? __pfx_kthread+0x10/0x10 [ 436.843649][ C0] ret_from_fork_asm+0x1a/0x30 [ 436.848433][ C0] [ 436.851876][ C0] Kernel Offset: disabled [ 436.856233][ C0] Rebooting in 86400 seconds..