last executing test programs: 5.430757156s ago: executing program 0 (id=1134): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = io_uring_setup(0x5bec, &(0x7f0000000040)) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) r2 = syz_pidfd_open(0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)="7e799ede644a64411f897f00cfcfb4c9ad2f2988158a5753b3f24912963992ec3bf41df62e8de15674cc677d6b704614ddf177b79107a8a5f0806056194f8b5857b4c7c74cf2fde9521071c66400220c2fee630daa3ac61804d7df4394a44895b5fb75b62515618f30f424971a7f100111676ec675135559e67b306ca345bfd1796280a8ab41d7efd3f900"/154, 0x9a}, {&(0x7f0000002080)="3b9ae6ce9babea9b3ac891905b90d1b3882151c600fe676aa00281a76a6de76462c1e60939fcb4602b1de8fe7d200ee56a7f534e66cff629fe65016465a1c7f19842a740fc60e4c8aac25a98a98e25e19643e86244e170576d92c01d6676aac5e8dc87557a680466b5120356644bf40c3da7ab43ec87d07fc38fee1f0cdeafc5af859f8a446a03511f092c368c69d012dcb3e980e8e0334546929eefa072a51b35b7adb59cd217d37909c96120ae4af4636b93a5f01d5051ff8635e812938aeb624943859bb092de4336e9f27516c63905cebc3506bce931389605956c8d803fb1ab485436741f626135486b3f0f51b96ae11cce827aa7a00185fbde5d9e5c4ca7d600735eca3edbec502860ec22dbad11175d85278565152ee9f09d86a21cc3fac2f8d2379f17393982d5f87133b255f66907b317c1370f53105b02ec58cecb9547a46988fb09d739ab2ddc0b97709fc3287970388bb22ccde3d7c59c5d6cd238a1795be12988a50e4574fecc09cf24fb7582f0fa22b3b53293c7a78fad2bb07cec5adf668f5619dbd6342c0c9ce9d458e6e57b71ee80e4e3714860e90bcff26fd4694ee0ecb4896338a75c00c8b4413760824c0610bce4970f6907daecfd81b8feea0c43cf829bd3bb5275781351e59f2bf773ae23c51d3596eadb3b88ac00ccf20ab053fceb77128f0bd2fde9f8f086c68939cbee06270a0626c8cb9528a145c339d0954ac6999eebd70b5023035c6eb405eed66b7578a2055400402fb67ff5a6cd59faddab7a76be1ae5c11ebd9bd4fcd45f27150eddaf4dd72edeed631ff83c28d92d7942e0ba94e84bd6e6f23ff59722a6939bad169542ad26e23a74ac3aaaf6141c2227edf45f7433566d11f4f389677a59499429a890ecdf6cb36e31e6e27fbcecae83dfd21a9145c79e939630cf3bc1af5db9557edd3b99cdd48d81160027e1db55b72aa63e09f2ee0eec65355837ae2f5143221b23550ed3aa8d9d1ebfb6fcb40a7772f69b65ce53cff93a286341d794144f452bc1db5e5328d8006a3fb63bdeb274e42762cc76450c9a89b3b572f2908642310ab17eac45a2042da8347b260ce2c18031d4684677168a8c0dd8682aeee69bc520d3d3ea9eda0e65a5b239a19e6949b8ae8bf7ca170669bc4eb1dcd316e40ee4117c538672425e6e471c500bd447787013f7b8173d30a7ce01150aab53d41a4365b57345e932339a16f50a8070d1779a67bea29a48bde785c3982f1e9a813755d6e5fcfbd572310bb6eb5b9f1a7082cdab7e895e121e08649bee95967e24bed7ef2e1d7d9d956928ded539c3bcb935f200abb946313e7451a990705f6d8e81850e7d04a54f5ae02406afb318d7b7f6526790212217a2cf8913a1b0b01f67c0a905bd42f47b7e7f75278343a767eb2d2a1c5fede8fb3dfc31e750ba272a5e97585670c2b68215ff095d1c0352df440fa56ab10e7e74fae43b8e2a808237c9c6598f9adb43337598428af8e5acf971826f8172484bfdefc0ae919c25e8c563877f4e98673352c40735ae586130d0025c21731c4f516f6b32e435d1561bf9da6e837639c084ad66d1ed913ae5a0f5196eb82f3dc0c469ec8fa24e1ce4e0ece64a199fbbbee2c9ff3ddd2c91f12afc45fcae13f0cbbd19920e05088b4b83b4284e311b82ac674c763e01a0c4c7c210c004786bd879f3648fd55fbf017bcd5f6ad0ca34aed29b81a5ebaefba0a48c82947b76e483b05a13614fd4ae6e2a0c626be09fe3546f8ed586d4b66b925e9d5fa24693c4970209930f15b0456345f3052040ac0758f9bbbc89be13310f32967ce1893d965f62b1c46f7a346194cb32a323672bc8c0bfe129019703fb4527358caf3bbdf4f4682e122cafc1a5cbcf79c049b7ad315dd19c73d5f02bee47d7049b3a48aee21b0fad3fec4dbaea204bf2b6123366d3f2c994f37398db19b0f762fdbb5b9f57df80379b37f2dec6fa64d38791df8e8b02275f9e7852345487bd834a369ef9a59786d6e933bb8b8f0964080e0a290e2b67773d007701552158961fca2d986129d49aea98f3443f16ab6f1a972a046a2edf1e63259829eb55ca82ec9fd6043788d6481b59682bae462abe3f0ebae9525ce07e86cd446d05c00a0d447de4398b1e6cb382acddea70a40029dcc11d7936c1e1159f9ffc38f4857e2601ac3a124158c19e2afa31da68a3a26fa024fe6697bb9a05b20ca59481e415ada2e99a76cebceae2d784f98aaaa5abf5469d4d59417a36e9e4ad92a2d745e9733764ee73d30c1f45ccd97007d87ba86f016232939e1fa5d292c23ef6abd7ed732a37c6b79e17e1713d8ed8af270699322f2bc314ea3a3222b3ac34797dd6aba65e4409016001d44e254f5e26e3d17a7083e7d1b5ed920dcad89af06869e4f139350a6a2c9d2b7ab8e6a8335c3626777390fa39b00f9be959475169e1d57afb4b653305e234a7efa3874fb43a77073aaa6ed2e9f0a4f347b9121a974658403855ba850b68fc43279e9819db4975910b8ec26dcb16540ecad4fff8ebdf8b346bc3399dc696e50e3bd57a2f745cf8f5004b866c7d0546f02a5d1fd0e5dfd508472ef134a0754a1b6cf518135b7942f00e210f0eca3a59232b78b85d58aff63d034954e8e3e11dd87d407cf4c342e73a8adc7958a59a7b2b05da0256978338e7ae3fece3eb6f2afe815697013d735840a21f174d9ef2805fd7c39a3f26dbaa6c2dcfbfde678009dfa36134e05cf51f49a62567a7fbb632bdd270c2fb4089142ba97e0bbd30809709a2ba0ac5e8ab528a2fe3f0473ed0008ff40fac59410e75e71eda714b55d907ee1b20f47e4448a7d0decfd2f613936e37cf4e42ffa2e98fffc5bdf5a571e3953c791da245d623d561a54163c5af199364ba649e101b306acd272b59f0052d3f29a9b56cf33d2af536a4865a63a230c4c52d9efa125860b2c277eceb5c71b48d1d3945b788fb942600c7873dab1ef2d12b99f3c25c80613a4dfe539ff4485559c5d6ad259548c854f766e00a72621aa2ffee1ddf792cb7c766618c89b36ae6f33cca30d43330ff26da574f64ea4a832bc50333633c95bf576ded4509b2c36dae6a41af4793cad1815662746c0d37a8fb3fc8870ec683333a08bdde8a561acfc351039f4a32021805bd9aabe13d50ce9f3ddb347d49bb93833ffe591ab7ffdde8e100319e840969150f1a4d0534603f133a11cfcd28f8c11e52773c14dcf773944385f49ea02686bb096f48a5c65a5e75a20752b893ae4007c69bda4bcef24c440e1ca10dd16c5157e241b72592a015c82882f006d5d413a4f18209ba6046d6d7b368b4eeaf4cd068ec6de6bfd44c15a7d4d74b604ece53d45f55820c48141b36f8c9320c9ea5f6f245dbc1c06b0a9d64239ad5a61075d3fdc0ba9f7ed0084829ddd4684d54d624acc8b2e7f806b9b1d71d99ea00ba1305086d094884055f949e98ba1b47bfb6d7af668efd54d3ed1d90dae2f90d9f43c00f849fb75d50ee54817980457cd1096a6dc4e536362ff195fbc92b05f5e2b53b00b4fd868fcdad7bcc20947235bbbd13d3265f16a7b8a97f3cc0a59b71c560b4d543deda2b6db5691fb79b45b0291e170ac577dee31092293167b348efde2a3bb165887b06d546f267185d1217a03f00cb37aa8b228a9ff2dc381dc8fb4ee0e23975bcb2037a6ca704e449776f4a1d7be383c15400cdf3b50da702aab49099dbd02eaa628b30b8e25221f27a913672a4b579a0b847bb61a77ff05d684227cf10c31a7034b1c69849c60dd806c8e43b6a09a14615032001cc0d567ccf7aa6b488e724b59d4469ba46cf10625073fb4e3905cff547f4a2f731c0388b7d78c820f025aeb92ef19c2946e36687078f556897b77565aa29bf6a915370975fbea889d1d1cf506eeaa016e4d2c6fa003925e2dc1557036171d951d940d054f7afcb7a1581c16c68c86b2557ea7e70ec2f3b96e10b38b74ae76315b1a9e73faa0c335d5920c7a30235fee0567b3406fe7bf1f630f94c1069b857a4e52f434cdb5bd333c340c991c442226788d4dc6abc4c04b7f6f153c3c2e764ba80e215b416a0670b3cce5ac0d530f84088f8939ba04bda1655e540775028e68e2e855973aa0e40777a6b5053ec873a07a5b69c916a3aaf7926f305d196c751db617249fedfdc9df7e05c8baa00754af7d980750b6a7fc6771d74540b7472917f621ba65cc39f424f22985b51018f09be2e2a8a6b971b1ebf1336006f7a99fc398d6a7d3c2e18042865577115e37b3207946f27d8e5b494cd359983b64974a352ed016cb1fabb4c2bea4a1fa08767d16eef71faec9cb665a22a7b0fbec03cb689b631cc777d8b73fba566aaef149bd6b8972b2a2dbb7c159ecb1d05fdda312794dc20a73afce0312cf7e4f6d2a03766d27006c3b6829618e706e9a0df397deca1a4487978db81adb88d39d02eef2f9dced9377d5a6440be7f16024639a3e6c32172efabdc8a7f7615c8ba6dbb7d256fd9f646e26b8b4a4d4042b115db7677262de3ded3648cb81b91b29cafb7d51033f9df45bbc06d29fa19da631de0abcd69ff05808220bffa18a2474b1fb796a52a74d1840d20edfa11e6049c391499bcf1b13e1e87f2adbfea2e832da63520403146009b43830512536f32079e8719047cff14ebebf6528b681db45a4f21fbb22ee922fe64bc25f6098631ba3f66952a5e022e28fc786465d756c8d8353eb05c65fc6c1cb9d407d2f40bb21bcb5519d405670b07c389ec6405e66f9a6e73e77b480b66a21aa87422c20d424ee8584479883f12415abb654d112e68c75509a8a5a3438c22b865a816188ec3c5f01b1552454e77c1762867979d179fdda6486fa2c61a9da7f6aa587b76a60f14cbd674d5c954093a92bdc75f7e10810b42d91e98deae02c04890b1917011820660729f39cab4dbf5f9d160d53536e73523f311a30ef1f7991b236c99116e8787c26fdf7d3458f92bf7b82e2e718b5254ef259bd3c49767dab0f22d5d38112188ff3cfc721c92b84999225fa20a33ccbeb29efc63fb567f8af65575190286920965c4948c319105c85a285c67462c1f8c0c40f69ee98d2db89393938224ea8cc848afd7ac96f267e959e8ec0cfb59622430aed14bdb9ad633e0a83d81313b80f351b7e78bcd360dd2541463c14dad5761ef6fbf16e777b00d2df772caf03ba9788616455e2e5975589935f11b12bdf46eb505b6eb0add7aa1ee32a47c366935a5db807a9636a23a44e1f28a89a86d8a05e76b0edaa83a5acdf01554e04685fa21eb7c570a3a82f77c3923115e49fd4b52344fa13c07a4eb594f5e111f554b392d6fc7dad5c580e1a375a5a2e2afd929f44340944e562b9fdb9683037c6eb33d6730659cc101a7753b3e3dab48eeebaed140d44d306bfcd87309074c5abbe597e99f5d6c656201d602abb54f8ebc4ad1b1c0fc69bf00031513e948226d4e4ac858a0a5fce74f27acb4aa41537eb1a71833fd68f008f2968daa6d5efb407c2d6101ab49b34e4af085c12a3333a69ee695cf144c6a1675ef34728f790b6c487f6796c8849a1e1915a0ac85915c4920b814dfb63672aa5b9a762e2da108e526c4d9bfc4ced9bc5316e53d2bda96aa63a503a418c3fbc3a19d4554ec56144c97eabc735e2be59619bb7bb5885563650eaf4d502b9321fa4ec6a4afe2e13a29ed0cc33b6d4aa1e78b7f656281b7f6af36f429df75de69a0ef6228d74dcd211988beedf5cbb7155ea3606532995de2818df0bf80414ffd7b700368bdcbf0ce1b5a71f10e43df0e18e447f1d14469dd8290a21abb", 0x1000}], 0x2, &(0x7f0000000780), 0x0, 0x80}}, {{&(0x7f0000000600)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000300), 0x0, 0x0, 0x0, 0xc844}}, {{&(0x7f0000000900)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000000a40)=[{&(0x7f0000000980)="bff3c33bc10e5e1004ed56e32222b8b5836073c5698a52447097b2bb73ee6b7f837898233daa7eab384cc64c6e7fc32fbae182e024c552871e296755affa51ad9889a79292c84c78c3dd609377757788b6b203290ae280bb6d145978c8c1277ba291560592bb1f6beebed7ec1072dbc2a6074b5d662cdb2a69567668966c4b72ed2850da3b3a7fd88c8609f94c5a373b8438510d0aa933776218633f1995f77acc10aee1", 0xfffffffffffffe4e}], 0x1, &(0x7f0000000b00)=[@rights={{0x14, 0x1, 0x1, [r0]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [r3, r0, 0xffffffffffffffff, r4, r4, r4, r3, 0xffffffffffffffff, r3]}}, @rights={{0x20, 0x1, 0x1, [r0, r2, r3, r4]}}], 0x88}}], 0x3, 0x4) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x1, 0x0) fchdir(r6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{r8}, &(0x7f0000000200), &(0x7f00000005c0)=r7}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r8}, &(0x7f0000000240), &(0x7f0000000280)='%pS \x00'}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001380)={r8, &(0x7f00000004c0)}, 0x20) r9 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x100) lseek(r9, 0x1, 0x1) getdents(r9, &(0x7f0000001fc0)=""/184, 0xb8) close(0xffffffffffffffff) ioprio_get$uid(0x0, 0x0) r10 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|\x00\x17\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbb\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8\xbf\xe6\xb2M\b/\rp\xa5\x00\x00\x00\x00', 0x80, 0x1bb, 0x0) pipe(&(0x7f0000000040)) fanotify_mark(0xffffffffffffffff, 0x1, 0x40000019, 0xffffffffffffffff, 0x0) lseek(r10, 0x1, 0x3) 4.932453668s ago: executing program 1 (id=1142): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_open_dev$vim2m(&(0x7f0000000040), 0x5, 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r0}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x15, 0x5, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) read(r2, &(0x7f0000000040)=""/148, 0xffffff96) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r3) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000000c0)="d800000018008103e00312ba0d8105040a600300ff0f040b067c55a1bc000900b80006990700000015000500fef32702d3001500030001400200000901ac040098007f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b66bce0b42a9ecbee5de6ccd40dd6e4edef3d93452a92307f00000e970300"/216, 0xd8}], 0x1}, 0x48002) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000001c0)={'sit0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x700, 0x8000, 0x800, 0x7, {{0x20, 0x4, 0x0, 0x3, 0x80, 0x65, 0x0, 0x8, 0x29, 0x0, @loopback, @multicast1, {[@rr={0x7, 0x7, 0x54, [@private=0xa010100]}, @timestamp={0x44, 0x24, 0x7, 0x0, 0xc, [0x3, 0x1200000, 0x9, 0x9, 0x0, 0x2, 0x5, 0xffffffff]}, @rr={0x7, 0x7, 0x7e, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp={0x44, 0x18, 0x25, 0x0, 0x9, [0x3, 0xd, 0x78, 0x16, 0x5]}, @generic={0x89, 0xe, "afe0e3f21150d7227b3defd6"}, @noop, @timestamp={0x44, 0x10, 0x1b, 0x0, 0xa, [0xef, 0xffffff3b, 0x3]}]}}}}}) bpf$PROG_LOAD_XDP(0x41, &(0x7f0000000380)={0x18, 0x7, &(0x7f0000000080)=@framed={{}, [@jmp={0x5, 0x0, 0xe, 0x0, 0x0, 0x3}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', r4, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x19, 0xf, &(0x7f0000000080)=@ringbuf={{}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x39}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0xba}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$IMGETDEVINFO(0xffffffffffffffff, 0x80044944, &(0x7f0000000180)={0xd02}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) 4.46852747s ago: executing program 1 (id=1144): r0 = socket(0x840000000002, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000001dc0)=[{{&(0x7f00000001c0)={0x2, 0x2, @dev={0xac, 0x14, 0x14, 0x36}}, 0x10, &(0x7f0000000080)=[{&(0x7f00000003c0)="a90500000000746400010000000000009f3f699c9c78616e591ed0c6b856f985b867", 0x22}, {&(0x7f0000000100)="82", 0x1}], 0x2}}], 0x1, 0x24004044) 4.441658796s ago: executing program 1 (id=1145): unshare(0x60480) fcntl$notify(0xffffffffffffffff, 0x402, 0x80000029) 2.911345686s ago: executing program 1 (id=1148): r0 = syz_usb_connect$cdc_ncm(0x0, 0x8f, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109027d0002010080000904000001020d0000052406000105240000000d240f0103000000fd0000000406241aff072908241c01010900ef142413099f33760bf14377323063f9c8a04d113905241510000905810300020800040904010000020d00000904010102020d0000090582020002e1ad00090503020002", @ANYBLOB="c2112a54655c895c5d792d9ef1e887bc7f111e4d4ec51ced9ad5ba9c864cb9ac207d8376ed0d71acad9920b0612ae12d937dd001907e0631d3f735dac42d084a8f45a2b6618879d7ecb9668d999772e5794d36226bcac9cc050c1807872ec04792d676ab7f760456aa3ab9beae12650ac8819aa8943de088c23ed6d5946d12202a4890cf849cd34a54a3ba9ef08e1949ebedfe6518353456886e444605399df77e6caa1b4b5f47931887d590aba52c9d310be2e7c6c0"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = socket$inet(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e21, 0x0, @empty}, 0x1c) r3 = dup2(r2, r2) syz_io_uring_setup(0x512a, 0x0, 0x0, 0x0) shutdown(r3, 0x1) write$tun(r3, 0x0, 0x46) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00'}) socket(0x10, 0x3, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x8, 0x0, 0x0, 0x7fff7ffc}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) ioprio_set$uid(0x3, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0xc102, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40) close_range(r4, 0xffffffffffffffff, 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r6 = io_uring_setup(0x7c41, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x0, 0x33c}) io_uring_register$IORING_REGISTER_RING_FDS(r6, 0x14, &(0x7f0000001780), 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x9, 0x10, &(0x7f0000000240)=@raw=[@btf_id={0x18, 0x6, 0x3, 0x0, 0x5}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @btf_id={0x18, 0x2, 0x3, 0x0, 0x2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x26a}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @generic={0x3, 0x8, 0x9, 0x0, 0x1100}], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x42, '\x00', 0x0, 0x22, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000000, @void, @value}, 0x94) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000000)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0xff, 0x70, 0x4, 0x203, 0x7, 0x100, 0xfeba, 0x8, 0x104, 0x0, 0x100, 0xffa6}}, 0x0, 0x0, 0x0, 0x0}) 2.787700724s ago: executing program 0 (id=1149): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYRES64=r0, @ANYRES8=0x0, @ANYRESDEC, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000003000000010000000600"/28], 0x50) close(0x3) r1 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) ioctl$NS_GET_OWNER_UID(r1, 0xb704, &(0x7f0000000100)) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="80000000000201040000000000000000020000002400028014000180080001000000000008000200ac1e00010c00028005000100000000002400038014000180080001000000000008000200ac1414000c000280050001000000000024000180140001800800010008000200ac1414bb0c000280050001"], 0x80}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x11, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x7b}, @snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}, {}, {0x85, 0x0, 0x0, 0xb3}}]}, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x30, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$igmp(0x2, 0x3, 0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="88000000000201040000000000000000020080052400028014000180080001000000000008f90200ac1e00010c00028005000100000000002400038014000180080001000000000008000200ac1414000c00028005000100000000002c0001"], 0x88}}, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002540)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002380)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x2000}}) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r8 = getpid() lchown(&(0x7f0000000500)='./file0\x00', 0x0, 0x0) lremovexattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=@known='user.incfs.id\x00') r9 = syz_pidfd_open(r8, 0x0) setns(r9, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) close_range(r7, 0xffffffffffffffff, 0x0) setsockopt$MRT_FLUSH(r4, 0x0, 0xd0, &(0x7f0000000480)=0x2, 0x4) r10 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r10, 0x0) open(&(0x7f0000000000)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x162) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_clone(0x4020440, &(0x7f0000001900), 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600700, 0x19) 2.498325393s ago: executing program 0 (id=1153): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x2c, 0x140f, 0x1, 0x70bd29, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xb, 0x45, 'uverbs\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24048091}, 0x4000) write(r0, &(0x7f0000000140)="61b88a7fc314601ba4fb8d132388ac9064f2ba1d0ea2d7af7466a80059852ae28a0c8c4f7d70f9cadca8a459f738b95c1519f6b7d5091abde14aa5ddaf4f524b583e31f64ace6c7f874f563c41f9881964a97431f48c70d951905da35c827837e02f6bc1d6f8ba1eb0f5383d8c6806d31dae6531fe0dc82d640e265c478a0f00b5a7b35084ddfe1ce0b5a4c0ab5e55b6814ec6a3f906ae4449f047c68f79fbff61f194b907deff570a14962c4c7e7e4c3799b78b25", 0xb5) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000040)={0x17, 0xa, 0x2, "0506ef00", 0x56555959}) 2.475144911s ago: executing program 4 (id=1154): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) r1 = socket$kcm(0x2b, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000140)}], 0x2}], 0x1, 0x40800) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r2, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r2, 0x89f0, &(0x7f0000000000)) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) readv(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x20000000) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvmmsg(r6, &(0x7f00000049c0)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x20002020, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r5, 0x84, 0x7, &(0x7f0000000040), 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73f72cc9f0ba1f848140000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r8, &(0x7f00000000c0)={0x0, 0x8, &(0x7f0000000000)=[{&(0x7f0000000340)="5c00000013006bcd9e3fe3dc4e48aa31086b8703140000001f03000000330000040014000d000a000d0000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x840) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000300), 0x8) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) setsockopt$sock_attach_bpf(r1, 0x1, 0xd, &(0x7f0000000080), 0x24) 2.253061576s ago: executing program 0 (id=1157): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000440)={r0, 0x0, {0x0, 0x0, 0x0, 0x9, 0x800000000000, 0x0, 0x0, 0x10, 0x5, "240101c0c109000000000000000250ceaac500b1b3d741dd17bcc50d38ef2a565ef1e85c58d3650000000000000000000100", "a1163939c787a16c1ca43f8539f3d3289737f0374c72a964a0193b3e8772fd29f35239d20000000100", "24431a1e58a68e174f0000000000ef8a07580000000000002000", [0x5]}}) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x20000000000003, 0x8000000000000002, 0x0, 0x0, 0x10, 0xa, "c25f7e0d775e40aee623452107249fe0bdbfce2fe240da8dce81a69b0edc7a60ad337212006a3e508b8040c7bc6e583cc41170a13349e2cfcc4b64bd4fbf41ee", "a5526c3b6a46c15c42022ee6cc29fd6294ee5056c4e8602a8a28609c370633cd58cda9ddec304859946ea27fb0b97bb826884c3d749834ad1e6c00", "412d226bd7dc8ce5783126ae76e309616391f73ea9c19b4a27828e2d00195a1f", [0x2, 0x1ff]}) 1.841596316s ago: executing program 4 (id=1159): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="0213000002"], 0x10}}, 0x0) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="021200000200"], 0x10}, 0x1, 0x0, 0x100000000000000}, 0x0) 1.76207761s ago: executing program 2 (id=1160): unshare(0x22020400) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x12, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x3, 0x2, 0x3, 0x1, 0x0, 0x4}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x13, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f0000000080), 0x80, 0x412000) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x189000, 0x0) timer_create(0x0, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) recvmsg$kcm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000100)=""/64, 0x40}, {0x0}], 0x2}, 0x23) timer_settime(r1, 0x0, &(0x7f0000000340)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_delete(r1) readv(r0, &(0x7f0000002540), 0x0) 1.67567564s ago: executing program 1 (id=1161): socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_sctp(0x2, 0x1, 0x84) socket$tipc(0x1e, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) openat$fb0(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 1.600280451s ago: executing program 0 (id=1162): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0x1, 0x80000000}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x10012, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000000640)=""/4112, 0x1010}], 0x1, 0x4000, 0x0) ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f00000000c0)=0xfffffffa) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r2) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x30, r3, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0x4, 0x7, 0xfffffffb, 0x5}}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x4000080) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x893}, 0x20040894) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x2, 0x300) (async) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0x1, 0x80000000}, 0x1c) (async) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x10012, r1, 0x0) (async) syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') (async) preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000000640)=""/4112, 0x1010}], 0x1, 0x4000, 0x0) (async) ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f00000000c0)=0xfffffffa) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r2) (async) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x30, r3, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0x4, 0x7, 0xfffffffb, 0x5}}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x4000080) (async) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x893}, 0x20040894) (async) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) (async) 1.59958144s ago: executing program 4 (id=1163): r0 = socket$inet6(0x10, 0x2, 0x6) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040), 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x4) syz_io_uring_complete(0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(0x0, r5) getsockname$packet(r5, 0x0, &(0x7f00000003c0)) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x4000) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB="24000000021401006abd700002dcdf2508000100000000000900020073797a32000000007f9f108cffca6623b74202a42fc9acd30a4974b7cc30501aeb4f", @ANYBLOB, @ANYRES32=r2], 0x29}, 0x1, 0x0, 0x0, 0x10000801}, 0x40810) sendto$inet6(r0, &(0x7f0000000180)="100000001200058f", 0x8, 0x20014094, 0x0, 0x0) 1.547652018s ago: executing program 4 (id=1164): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000004ffffffff000000000300000000000000000000000300000000000000000000000000000200000000000000000000000602"], 0x0, 0x56, 0x0, 0x8, 0x0, 0x0, @void, @value}, 0x28) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = getuid() sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="340000001900010928bd700000000000021800000000ff090010000008000100ac14140008001900a3793832f74c4ca50855d710ce02f7f00f7298c9bb4e164f79a068c8bcb3fca4dd9d516f4ab4436da5f032eb0e0251a948de9196ad4007b3f130e2c11ee84d44543adf980b79cfa3e463b9658815c5ef50137f13009ae69f131c9ed7d48544c66e7c90e1b63660063c167781b42d43231941f972618c61068fd7be1e58ead96b6a7f0456afd2d361b1f2619cfdb9d5071446eedc250990c59d53c39e9fd065cb7ae4bcbe708acc44d7f894fa51e76c89bcd0ff5a55289ebf06", @ANYRES32=r1, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB], 0x34}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000001dc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)='./file0\x00') r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, '\x00', 0x3c}}, 0x1c) 1.519709605s ago: executing program 2 (id=1165): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x20042800}, 0x24040800) 1.476460733s ago: executing program 1 (id=1166): r0 = inotify_init1(0x80800) inotify_add_watch(r0, &(0x7f0000000000)='./cgroup\x00', 0x62000030) r1 = inotify_init1(0x80000) inotify_add_watch(r1, &(0x7f0000000080)='./cgroup\x00', 0x2000434) unlink(&(0x7f0000000040)='./cgroup\x00') unshare(0x68040200) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000000000040040455070000000000010902"], 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000200)=[{0x6}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) r3 = add_key$user(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)="d42ce5702c39941d926a541c50687b1a1b86284a05c44cea1789f72b751f791b71c1252e8af5fb", 0x27, 0xfffffffffffffffe) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000140)={r3, 0xfffffffffffffe59, 0xffffffffffffff47}, &(0x7f0000000180)={'enc=', 'pkcs1', ' hash=', {'sha224-ce\x00'}}, &(0x7f0000000280)="de65b1f55ef5953a5dc574bc45e10ecad5d6b4ad75461a590c7fb0ab8b7ec1100d6b75ddb436d9ce21c5958e26da65a4b4a027ad5ef098eb18db1485a5cd5da812e29684201cffb4da494163f226d6769bc8825bd0fbbe868d9d435f122b4b3f4c992f169fa30d655c8d02e5878e34d840a2ca365c7bb8429b57694c038538b651a38b4dd0c05fd0dbe0c43c55d118eaf90f259681878c42456e866fb64a7fcaf9dd04bc940912b7c9d420016d615124c05a56a0948be391357af42599", &(0x7f0000001340)=""/4095) 1.45211576s ago: executing program 4 (id=1167): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x46}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8, 0x2, @udp6=r2}]}}}]}, 0x38}, 0x1, 0xba01}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000100000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000500000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000200)='mm_page_alloc\x00', r3}, 0x10) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaa", @ANYRES32=0x41424344], 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="2703020059", 0x5}, {0x0}, {0x0}], 0x3}, 0x0) r5 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a9850", 0x4, 0xfffffffffffffffe) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4800000010", @ANYRES32=r7, @ANYBLOB="ebffff"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0xb, 0x4000010, r4, 0xdf363000) r8 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r5, r8, r5}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = dup(r10) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r12, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r10, r12, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r12, 0xae80, 0x0) r13 = socket$netlink(0x10, 0x3, 0x15) sendmsg$netlink(r13, &(0x7f0000003500)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)={0xe0, 0x13, 0x1, 0x0, 0x0, "", [@generic="a94d188bd1855a1aba41556d25460f53f79a1108370d915cf9415cb64d8e04265abb1b8e2f5fb9a3fb4a58092d01eede78d21ed06dededb2b4f7c2e1162bc1ce06230ebb9fff55931db1defa4be0074e6d0f075f55fe01b10484f25dc71509c90b69f3fc3b074fbcee3ad47fc06adea10aff24744a0b575df003eea71c09aa8dd6c99e976e52ced9db5374ebf355255bc4443cff556d92cab26e619331db0d1afbf130f357715e4a9a558d3856728cc1f979a12f561c525aee0b7e0a9746b60e130ea44aef3632265e01f64f79"]}, 0xe0}], 0x1, 0x0, 0x0, 0x4000}, 0x0) gettid() socket$inet_udplite(0x2, 0x2, 0x88) 1.367361224s ago: executing program 0 (id=1168): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080), 0x0) r1 = socket(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) socket$packet(0x11, 0x2, 0x300) (async) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000040)={0x4, 0x6}, 0x4) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6}]}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xc, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000006b113a000000000085"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x41100, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xc, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000006b113a000000000085"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x41100, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r6 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r6, 0x8922, &(0x7f0000000000)={'team0\x00', 0x401}) close(r4) (async) close(r4) recvmmsg(r1, &(0x7f0000005580)=[{{0x0, 0x0, 0x0, 0xfffffde1}, 0x2e59}], 0x1, 0x0, 0x0) (async) recvmmsg(r1, &(0x7f0000005580)=[{{0x0, 0x0, 0x0, 0xfffffde1}, 0x2e59}], 0x1, 0x0, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000800)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r7}, 0xc) setsockopt$sock_int(r1, 0x1, 0x22, &(0x7f0000000180)=0x6, 0x4) r8 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x48340, 0x0) syncfs(r3) (async) syncfs(r3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800"/15, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_usb_connect(0x3, 0x3f, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002466c3940841706002fbb0102030109022d00013003b008090400620394982fd7090504030000000e060d0508"], 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000240)=0x5) dup(r8) ioctl$sock_ifreq(r4, 0x89a3, &(0x7f0000000180)={'veth1_to_hsr\x00', @ifru_mtu=0x10000}) write(r1, &(0x7f0000000380)="240000001e005f0214e0ffffffffff8dd5d6d87c998ff807000000000000000000000003", 0x7e) epoll_create1(0x80000) creat(&(0x7f00000001c0)='./bus\x00', 0x80) (async) r9 = creat(&(0x7f00000001c0)='./bus\x00', 0x80) close(r9) (async) close(r9) syz_io_uring_setup(0x66e, &(0x7f0000000240)={0x0, 0x0, 0x10100}, &(0x7f0000000380), &(0x7f0000000200)) mount$9p_fd(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000580)=ANY=[]) socket$netlink(0x10, 0x3, 0x1) (async) socket$netlink(0x10, 0x3, 0x1) 1.366760851s ago: executing program 2 (id=1169): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f00000000c0)=0x81) r1 = syz_io_uring_setup(0x239, &(0x7f0000000540)={0x0, 0x79d7, 0x10100}, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) r4 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r4, 0x3000) socket$inet(0x2, 0x802, 0x1) io_uring_enter(r1, 0x2def, 0xdcc0, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000180)={0x1, &(0x7f0000000100)=[{0x6, 0x6, 0x5, 0x2}]}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x165642, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) socket$rxrpc(0x21, 0x2, 0xa) ioctl$KVM_NMI(r7, 0xae9a) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r5, 0x8008ae9d, &(0x7f0000000240)=""/108) fallocate(r0, 0x28, 0xfffffffffffffffb, 0x2) timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400)) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r10, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000300) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r11 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x100000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r10, 0x8208ae63, &(0x7f0000000600)={0x1, 0x0, @pic={0x2a, 0xc0, 0x7, 0x0, 0xfb, 0x0, 0xb, 0x4, 0x3, 0x0, 0x3, 0x58, 0x94, 0x5, 0x9, 0xff}}) ioctl$KVM_SET_REGS(r11, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x0, 0x0, 0x20000020000017c, 0x7, 0x13, 0xf1, 0x6, 0x87fffffffffffe, 0x6, 0xfffffffffffffffd, 0x9, 0x7, 0x7, 0x0, 0xbdb], 0x6000, 0x1d48c2}) ioctl$KVM_RUN(r11, 0xae80, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000001c0)=@abs={0x2, 0x0, 0x4e20}, 0x6e) timer_create(0xfffffffd, 0x0, &(0x7f0000000000)) 1.268370274s ago: executing program 3 (id=1170): add_key(0x0, 0x0, &(0x7f0000000100)="305c0605e182d1447ad1ad83700398d1c7d7982b8f57fb20a3adc9e3baa292ce8f0a861e6417acfc8648ad", 0x2b, 0xfffffffffffffffe) r0 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a9850a9d77f", 0x7, 0xfffffffffffffffe) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4800000010000504", @ANYBLOB="ebffffffffffffff280012800b00010065"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x110) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x11, 0x3, &(0x7f0000000280)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) sendfile(r2, r1, 0x0, 0x3a) r4 = add_key$user(&(0x7f00000003c0), &(0x7f0000000240)={'syz', 0x2}, &(0x7f0000000180)="336df3779a85e1f1275803424cec2278086c876e52ea72d0ff75d3320098da3fd386cdca203ea945e975976938a8911fbf9f10f6e0a8667a2005efd263e6d4984b7f4dc103000000a64daa0712874901aa82eec94cd7e2c4b8cdfef4a4bb41ca2a", 0x61, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r4, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e0000000400000008000000080000000000", @ANYRES32], 0x50) r9 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r9, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r9, 0x4008af03, &(0x7f0000002100)) ioctl$VHOST_GET_VRING_ENDIAN(r9, 0x4028af11, &(0x7f00000001c0)={0x0, 0x1}) ioctl$VHOST_VSOCK_SET_RUNNING(r9, 0x4004af61, &(0x7f0000001980)=0x1) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) ioctl$KVM_RUN(r8, 0xae80, 0x0) 1.182767633s ago: executing program 3 (id=1171): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r0 = socket$kcm(0x2b, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) readv(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000000) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f0000000040), 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10, 0x0, 0x0, 0x0, 0x218, 0x300}, 0x200048cc) 1.123567842s ago: executing program 2 (id=1172): r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000010651fbe347b2c2b00000c000180080001"], 0x20}}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000000100)=""/101, &(0x7f00000000c0)=0x65) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) io_setup(0xc9f, &(0x7f0000000000)=0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/meminfo\x00', 0x0, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r5) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)={0x24, r6, 0x1, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1374}]}, 0x24}}, 0x0) io_submit(r4, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}]) mount$afs(&(0x7f0000000e00)=ANY=[@ANYBLOB='%'], &(0x7f0000000e40)='.\x00', &(0x7f0000000e80), 0x3000000, 0x0) 1.056417064s ago: executing program 4 (id=1173): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000, @void, @value}, 0x94) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a7042b10460d810082190102030109021b00010000000009040000018984aa0009050c", @ANYRES16], 0x0) prlimit64(0x0, 0xe, &(0x7f0000001080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f00000000c0)={0x327ff, 0x32200}) 840.736355ms ago: executing program 3 (id=1174): r0 = socket$inet(0x2, 0x2, 0x1) r1 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x4, 0x2ffffffff}, 0x2e) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) inotify_init() openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r4, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {0x0, 0x80001, 0xffffffffffffffff, 0x10, 0xf3b4c9b41808b3e, @in={0x2, 0x4e24, @multicast2}}}, 0xa0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e21, 0x8000000, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000600)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000100)=@gcm_256={{0x303}, "0f78fbc54b6c106c", "75fd7583f127c5c356354c80ea765edaa15f377fb214e20fda1b0241bed67dc4", "b1726789", "fb442565fb00"}, 0x38) sendto$inet6(r5, &(0x7f00000001c0), 0xffffffffffffff13, 0x0, 0x0, 0x3000137) syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) sendmsg$can_j1939(r6, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000280)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\x8b\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\x1c)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000040), 0x10, &(0x7f00000000c0)=[{&(0x7f00000007c0)="08006d2a81496b273d", 0x9}], 0x1}, 0x800) modify_ldt$write(0x1, &(0x7f0000000080)={0x9, 0x100000, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) 175.659277ms ago: executing program 3 (id=1175): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd}) (async) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000) (async) r1 = syz_open_dev$swradio(&(0x7f0000000040), 0x1, 0x2) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000000)={0xfffffffa, 0xb, 0x4}) (async) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000680)=""/188) 84.477989ms ago: executing program 3 (id=1176): r0 = memfd_secret(0x80000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_open_dev$sg(0x0, 0x0, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x6, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000380)=@ethtool_drvinfo={0x3, "a4c3eabfbc4a051fc8f66eedf1c6676b4e9ac471123ee41b102a78284f881840", "c493c69907ac61ee57f3ff6656218f8c880cab0b7f5f977f29b54144914986b5", "7795433781033bb967429b7c68c2566066943f3a566d7fd05557583a535a3b9e", "cba936683f411a1265d9ffb369dbe16de72fd8ee91c60f531196c136add25f43", "3fda464b4ffcb83f5c89e20fe8814b4e26bb81519905d65c5a0ae43be09d9f7b", "9900255a099270427859ce54", 0x43dd5e67, 0x9, 0x4, 0x5, 0xfffffffe}}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x800, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f00000001c0)={&(0x7f0000000500)="17da7a5ebbbacddc1a526a3443217f32492e305a5027f0d0160c3f4d5be98de2275d641bef6d4de59a05af", 0x2b}) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f0000000240)={&(0x7f0000000580)="2f71280b14c432658eba472d0e6c2e8eb90ae8596c296b23c0beed6bfec2fb0114e581b561d56b08f16ed7429f9087a71a8237567633649505b3c5795118e30cfb01ea253a11dae06f3549ee3f7e1996385e2bbb1efb637dbea32795d5265634a1db99fb87c68619c3983a6f9ffc2924682d6926626f7b1db9500f5c4c82197e6ff94ca83d9ffcf1c0897af067da97445a70a7d78177489ee422aab99e8e6262683c58b9c95bb85fee4bc4332c3299", 0xaf}) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, &(0x7f0000000480)={0x7, 0x0, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000800)={&(0x7f0000000780)=[0x0, 0x0], &(0x7f00000007c0)=[0x0], 0x2, 0x0, 0xcccccccc}) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f0000000940)={&(0x7f0000000880)="2b89513bf77a6770824cf843938f4b3846461471494aff16b224c3131df103a5b12a3a9a0fd76ccde5782623d16f3a5792b23209352ff01513bddf313f772764f650bc855258573423c60968c59f98ba", 0x50}) ioctl$DRM_IOCTL_MODE_GETENCODER(r0, 0xc01464a6, &(0x7f0000000980)) ioctl$DRM_IOCTL_MODE_GETENCODER(r0, 0xc01464a6, &(0x7f00000009c0)) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000a40)={&(0x7f0000000a00), 0x0, 0xc00}) mmap(&(0x7f000081c000/0x4000)=nil, 0x4000, 0x1000007, 0x2010, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, &(0x7f0000000280)=@get={0x1, 0x0, 0x1}) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='affs\x00', 0x8000, 0x0) getdents64(r0, &(0x7f0000000100), 0x0) 83.805228ms ago: executing program 2 (id=1177): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000004ffffffff000000000300000000000000000000000300000000000000000000000000000200000000000000000000000602"], 0x0, 0x56, 0x0, 0x8, 0x0, 0x0, @void, @value}, 0x28) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = getuid() sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="340000001900010928bd700000000000021800000000ff090010000008000100ac14140008001900a3793832f74c4ca50855d710ce02f7f00f7298c9bb4e164f79a068c8bcb3fca4dd9d516f4ab4436da5f032eb0e0251a948de9196ad4007b3f130e2c11ee84d44543adf980b79cfa3e463b9658815c5ef50137f13009ae69f131c9ed7d48544c66e7c90e1b63660063c167781b42d43231941f972618c61068fd7be1e58ead96b6a7f0456afd2d361b1f2619cfdb9d5071446eedc250990c59d53c39e9fd065cb7ae4bcbe708acc44d7f894fa51e76c89bcd0ff5a55289ebf06", @ANYRES32=r1, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB], 0x34}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000001dc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)='./file0\x00') r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, '\x00', 0x3c}}, 0x1c) 45.900804ms ago: executing program 3 (id=1178): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x20000045, &(0x7f00000002c0)={0xa, 0x2, 0x395, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='highspeed\x00', 0xa) shutdown(r0, 0x1) 0s ago: executing program 2 (id=1179): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(r1, 0x80046402, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r3, 0x0, 0x78) close(r3) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000007940)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000540)='B', 0x1}], 0x1}}], 0x1, 0x24044845) r4 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f00000004c0)={&(0x7f0000c2b000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000005380)=""/231, 0xe7, 0x1, 0x0}, &(0x7f00000064c0)=0x88) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000001c0)={'dummy0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACSEC_VALIDATION={0x5, 0xd, 0x1}, @IFLA_MACSEC_REPLAY_PROTECT={0x5}]}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x0) ioctl$DRM_IOCTL_AUTH_MAGIC(r1, 0x40046411, &(0x7f0000000140)=0x5145) move_mount(r3, 0x0, r2, 0x0, 0x67) socket$nl_route(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(r1, 0x80046402, &(0x7f0000000040)=0x200) kernel console output (not intermixed with test programs): 774bd5 #0 PREEMPT(full) [ 147.501480][ T6832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 147.501487][ T6832] Call Trace: [ 147.501492][ T6832] [ 147.501500][ T6832] dump_stack_lvl+0x189/0x250 [ 147.501519][ T6832] ? __pfx____ratelimit+0x10/0x10 [ 147.501534][ T6832] ? __pfx_dump_stack_lvl+0x10/0x10 [ 147.501548][ T6832] ? __pfx__printk+0x10/0x10 [ 147.501565][ T6832] ? __pfx___might_resched+0x10/0x10 [ 147.501578][ T6832] ? fs_reclaim_acquire+0x7d/0x100 [ 147.501592][ T6832] should_fail_ex+0x414/0x560 [ 147.501608][ T6832] should_failslab+0xa8/0x100 [ 147.501624][ T6832] __kmalloc_cache_noprof+0x70/0x3d0 [ 147.501638][ T6832] ? vb2_vmalloc_get_userptr+0x5f/0x450 [ 147.501656][ T6832] vb2_vmalloc_get_userptr+0x5f/0x450 [ 147.501673][ T6832] ? __pfx_vb2_vmalloc_get_userptr+0x10/0x10 [ 147.501688][ T6832] __buf_prepare+0xf4f/0x4740 [ 147.501713][ T6832] ? __pfx___buf_prepare+0x10/0x10 [ 147.501728][ T6832] ? is_bpf_text_address+0x26/0x2b0 [ 147.501742][ T6832] ? is_bpf_text_address+0x292/0x2b0 [ 147.501759][ T6832] ? is_bpf_text_address+0x26/0x2b0 [ 147.501772][ T6832] ? kernel_text_address+0xa5/0xe0 [ 147.501783][ T6832] ? __kernel_text_address+0xd/0x40 [ 147.501793][ T6832] ? unwind_get_return_address+0x4d/0x90 [ 147.501806][ T6832] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 147.501824][ T6832] ? arch_stack_walk+0xfc/0x150 [ 147.501865][ T6832] ? __lock_acquire+0xab9/0xd20 [ 147.501933][ T6832] vb2_core_prepare_buf+0xad/0x2c0 [ 147.501951][ T6832] __video_do_ioctl+0xc9b/0xdb0 [ 147.501971][ T6832] ? __pfx___video_do_ioctl+0x10/0x10 [ 147.501993][ T6832] video_usercopy+0x86e/0x14f0 [ 147.502014][ T6832] ? __pfx___video_do_ioctl+0x10/0x10 [ 147.502029][ T6832] ? __pfx_video_usercopy+0x10/0x10 [ 147.502042][ T6832] ? smack_file_ioctl+0x2a9/0x340 [ 147.502063][ T6832] ? __fget_files+0x2a/0x420 [ 147.502078][ T6832] ? __fget_files+0x3a0/0x420 [ 147.502094][ T6832] v4l2_ioctl+0x18a/0x1e0 [ 147.502108][ T6832] ? __pfx_v4l2_ioctl+0x10/0x10 [ 147.502123][ T6832] __se_sys_ioctl+0xf9/0x170 [ 147.502137][ T6832] do_syscall_64+0xfa/0x3b0 [ 147.502150][ T6832] ? lockdep_hardirqs_on+0x9c/0x150 [ 147.502164][ T6832] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.502173][ T6832] ? clear_bhb_loop+0x60/0xb0 [ 147.502185][ T6832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.502195][ T6832] RIP: 0033:0x7fefcc38e969 [ 147.502205][ T6832] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 147.502214][ T6832] RSP: 002b:00007fefcd18c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 147.502225][ T6832] RAX: ffffffffffffffda RBX: 00007fefcc5b5fa0 RCX: 00007fefcc38e969 [ 147.502233][ T6832] RDX: 0000200000000200 RSI: 00000000c058565d RDI: 0000000000000004 [ 147.502239][ T6832] RBP: 00007fefcd18c090 R08: 0000000000000000 R09: 0000000000000000 [ 147.502246][ T6832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 147.502251][ T6832] R13: 0000000000000000 R14: 00007fefcc5b5fa0 R15: 00007ffc1444a058 [ 147.502268][ T6832] [ 147.814289][ C0] vkms_vblank_simulate: vblank timer overrun [ 148.095837][ T6848] /dev/sg0: Can't lookup blockdev [ 148.238351][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 148.768440][ T5869] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 148.887245][ T6861] FAULT_INJECTION: forcing a failure. [ 148.887245][ T6861] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 148.900584][ T5873] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 148.908211][ T5869] usb 4-1: device descriptor read/64, error -71 [ 148.927500][ T6861] CPU: 0 UID: 0 PID: 6861 Comm: syz.2.255 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 148.927517][ T6861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 148.927523][ T6861] Call Trace: [ 148.927528][ T6861] [ 148.927533][ T6861] dump_stack_lvl+0x189/0x250 [ 148.927551][ T6861] ? __pfx____ratelimit+0x10/0x10 [ 148.927567][ T6861] ? __pfx_dump_stack_lvl+0x10/0x10 [ 148.927580][ T6861] ? __pfx__printk+0x10/0x10 [ 148.927602][ T6861] should_fail_ex+0x414/0x560 [ 148.927619][ T6861] _copy_to_user+0x31/0xb0 [ 148.927631][ T6861] simple_read_from_buffer+0xe1/0x170 [ 148.927648][ T6861] proc_fail_nth_read+0x1df/0x250 [ 148.927665][ T6861] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 148.927677][ T6861] ? rw_verify_area+0x258/0x650 [ 148.927689][ T6861] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 148.927699][ T6861] vfs_read+0x1fd/0x980 [ 148.927711][ T6861] ? bpf_get_current_cgroup_id+0x1d/0x340 [ 148.927730][ T6861] ? __pfx_vfs_read+0x10/0x10 [ 148.927741][ T6861] ? __lock_acquire+0xab9/0xd20 [ 148.927758][ T6861] ? __might_fault+0xb0/0x130 [ 148.927776][ T6861] ksys_read+0x145/0x250 [ 148.927790][ T6861] ? __pfx_ksys_read+0x10/0x10 [ 148.927802][ T6861] ? rcu_is_watching+0x15/0xb0 [ 148.927815][ T6861] ? trace_sys_enter+0x25/0x120 [ 148.927828][ T6861] do_syscall_64+0xfa/0x3b0 [ 148.927842][ T6861] ? lockdep_hardirqs_on+0x9c/0x150 [ 148.927855][ T6861] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.927865][ T6861] ? clear_bhb_loop+0x60/0xb0 [ 148.927877][ T6861] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.927887][ T6861] RIP: 0033:0x7fefcc38d37c [ 148.927897][ T6861] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 148.927906][ T6861] RSP: 002b:00007fefcd18c030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 148.927917][ T6861] RAX: ffffffffffffffda RBX: 00007fefcc5b5fa0 RCX: 00007fefcc38d37c [ 148.927925][ T6861] RDX: 000000000000000f RSI: 00007fefcd18c0a0 RDI: 0000000000000004 [ 148.927931][ T6861] RBP: 00007fefcd18c090 R08: 0000000000000000 R09: 0000000000000000 [ 148.927937][ T6861] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001 [ 148.927942][ T6861] R13: 0000000000000000 R14: 00007fefcc5b5fa0 R15: 00007ffc1444a058 [ 148.927958][ T6861] [ 149.155023][ C0] vkms_vblank_simulate: vblank timer overrun [ 149.248523][ T5873] usb 5-1: Using ep0 maxpacket: 16 [ 149.255708][ T5873] usb 5-1: config 4 has an invalid interface number: 37 but max is 0 [ 149.265289][ T5873] usb 5-1: config 4 has no interface number 0 [ 149.277187][ T5873] usb 5-1: config 4 interface 37 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 149.287681][ T5873] usb 5-1: config 4 interface 37 has no altsetting 0 [ 149.291825][ T5869] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 149.324731][ T5873] usb 5-1: New USB device found, idVendor=0b05, idProduct=9202, bcdDevice=94.4f [ 149.334118][ T5873] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.342324][ T5873] usb 5-1: Product: syz [ 149.348689][ T5873] usb 5-1: Manufacturer: syz [ 149.357500][ T5873] usb 5-1: SerialNumber: syz [ 149.401030][ T6855] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 149.428232][ T5869] usb 4-1: device descriptor read/64, error -71 [ 149.505093][ T6865] tipc: Enabled bearer , priority 0 [ 149.538628][ T5869] usb usb4-port1: attempt power cycle [ 149.583154][ T6862] tipc: Resetting bearer [ 149.668853][ T5873] usb 5-1: USB disconnect, device number 4 [ 149.880155][ T5869] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 149.920621][ T5869] usb 4-1: device descriptor read/8, error -71 [ 150.160419][ T5869] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 150.188981][ T5869] usb 4-1: device descriptor read/8, error -71 [ 150.312399][ T5869] usb usb4-port1: unable to enumerate USB device [ 150.455941][ T6876] Illegal XDP return value 4294967274 on prog (id 72) dev N/A, expect packet loss! [ 151.245778][ T6879] netlink: 'syz.2.257': attribute type 4 has an invalid length. [ 151.978312][ T24] usb 2-1: new low-speed USB device number 13 using dummy_hcd [ 152.171424][ T24] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 152.243156][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 152.306899][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 12645, setting to 8 [ 152.393753][ T24] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 152.467268][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.635093][ T24] hub 2-1:1.0: bad descriptor, ignoring hub [ 152.682081][ T24] hub 2-1:1.0: probe with driver hub failed with error -5 [ 152.742845][ T24] cdc_wdm 2-1:1.0: skipping garbage [ 152.785479][ T24] cdc_wdm 2-1:1.0: skipping garbage [ 152.816913][ T24] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 154.391561][ T1627] usb 2-1: USB disconnect, device number 13 [ 154.821992][ T6897] No source specified [ 155.730437][ T6903] fuse: Bad value for 'fd' [ 157.458741][ T6908] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 158.523333][ T6862] tipc: Disabling bearer [ 159.050405][ T6921] netlink: 'syz.3.271': attribute type 1 has an invalid length. [ 159.098519][ T6921] netlink: 224 bytes leftover after parsing attributes in process `syz.3.271'. [ 159.670182][ T6929] sctp: [Deprecated]: syz.3.275 (pid 6929) Use of int in maxseg socket option. [ 159.670182][ T6929] Use struct sctp_assoc_value instead [ 159.843496][ T6935] netlink: 236 bytes leftover after parsing attributes in process `syz.0.276'. [ 159.927775][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 159.927792][ T30] audit: type=1400 audit(1748498025.778:159): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=6934 comm="syz.3.278" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 160.658166][ T956] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 160.863007][ T956] usb 1-1: Using ep0 maxpacket: 8 [ 160.878430][ T956] usb 1-1: config 162 has an invalid interface number: 97 but max is 0 [ 160.891755][ T956] usb 1-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 160.904754][ T6954] FAULT_INJECTION: forcing a failure. [ 160.904754][ T6954] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 160.918912][ T956] usb 1-1: config 162 has no interface number 0 [ 160.925223][ T956] usb 1-1: config 162 interface 97 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 160.944727][ T6954] CPU: 1 UID: 0 PID: 6954 Comm: syz.2.282 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 160.944753][ T6954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 160.944765][ T6954] Call Trace: [ 160.944772][ T6954] [ 160.944781][ T6954] dump_stack_lvl+0x189/0x250 [ 160.944812][ T6954] ? __pfx____ratelimit+0x10/0x10 [ 160.944839][ T6954] ? __pfx_dump_stack_lvl+0x10/0x10 [ 160.944864][ T6954] ? __pfx__printk+0x10/0x10 [ 160.944893][ T6954] ? __might_fault+0xb0/0x130 [ 160.944931][ T6954] should_fail_ex+0x414/0x560 [ 160.944960][ T6954] _copy_from_user+0x2d/0xb0 [ 160.944981][ T6954] kvm_vm_ioctl+0x680/0xc60 [ 160.945009][ T6954] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 160.945037][ T6954] ? do_vfs_ioctl+0x12ba/0x1990 [ 160.945063][ T6954] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 160.945092][ T6954] ? kasan_quarantine_put+0xdd/0x220 [ 160.945125][ T6954] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 160.945151][ T6954] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 160.945175][ T6954] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 160.945197][ T6954] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 160.945221][ T6954] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 160.945270][ T6954] ? __lock_acquire+0xab9/0xd20 [ 160.945294][ T6954] ? __asan_memset+0x22/0x50 [ 160.945316][ T6954] ? smack_file_ioctl+0x302/0x340 [ 160.945342][ T6954] ? __pfx_smack_file_ioctl+0x10/0x10 [ 160.945375][ T6954] ? __fget_files+0x2a/0x420 [ 160.945401][ T6954] ? __fget_files+0x3a0/0x420 [ 160.945428][ T6954] ? __fget_files+0x2a/0x420 [ 160.945458][ T6954] ? bpf_lsm_file_ioctl+0x9/0x20 [ 160.945479][ T6954] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 160.945502][ T6954] __se_sys_ioctl+0xf9/0x170 [ 160.945527][ T6954] do_syscall_64+0xfa/0x3b0 [ 160.945552][ T6954] ? lockdep_hardirqs_on+0x9c/0x150 [ 160.945578][ T6954] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.945597][ T6954] ? clear_bhb_loop+0x60/0xb0 [ 160.945620][ T6954] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.945639][ T6954] RIP: 0033:0x7fefcc38e969 [ 160.945656][ T6954] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 160.945672][ T6954] RSP: 002b:00007fefcd18c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 160.945691][ T6954] RAX: ffffffffffffffda RBX: 00007fefcc5b5fa0 RCX: 00007fefcc38e969 [ 160.945706][ T6954] RDX: 0000200000000140 RSI: 000000004010ae68 RDI: 0000000000000004 [ 160.945719][ T6954] RBP: 00007fefcd18c090 R08: 0000000000000000 R09: 0000000000000000 [ 160.945731][ T6954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 160.945742][ T6954] R13: 0000000000000000 R14: 00007fefcc5b5fa0 R15: 00007ffc1444a058 [ 160.945771][ T6954] [ 160.947174][ T956] usb 1-1: config 162 interface 97 altsetting 1 endpoint 0x85 has invalid wMaxPacketSize 0 [ 161.336634][ T956] usb 1-1: config 162 interface 97 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 161.350870][ T956] usb 1-1: config 162 interface 97 has no altsetting 0 [ 161.359007][ T956] usb 1-1: New USB device found, idVendor=0c2e, idProduct=0700, bcdDevice= 4.3b [ 161.369171][ T956] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.386301][ T6962] netlink: 9280 bytes leftover after parsing attributes in process `syz.4.285'. [ 161.609126][ T6945] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 161.728651][ T6945] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 161.749960][ T956] usb 1-1: string descriptor 0 read error: -71 [ 161.763432][ T956] metro_usb 1-1:162.97: interrupt-out endpoint missing [ 161.857173][ T6968] netlink: 4 bytes leftover after parsing attributes in process `syz.4.286'. [ 162.483271][ T956] usb 1-1: USB disconnect, device number 5 [ 164.078509][ T5869] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 164.251115][ T6995] netlink: 40 bytes leftover after parsing attributes in process `syz.2.295'. [ 164.288709][ T5869] usb 2-1: Using ep0 maxpacket: 32 [ 164.364996][ T5869] usb 2-1: config 1 has an invalid interface number: 236 but max is 0 [ 164.423287][ T5869] usb 2-1: config 1 has no interface number 0 [ 164.453433][ T5869] usb 2-1: config 1 interface 236 altsetting 2 endpoint 0x5 has invalid wMaxPacketSize 0 [ 164.453642][ T5869] usb 2-1: config 1 interface 236 altsetting 2 bulk endpoint 0x5 has invalid maxpacket 0 [ 164.453857][ T5869] usb 2-1: config 1 interface 236 has no altsetting 0 [ 164.582276][ T5869] usb 2-1: config 1 has an invalid interface number: 236 but max is 0 [ 164.590686][ T5869] usb 2-1: config 1 has no interface number 0 [ 164.596908][ T5869] usb 2-1: config 1 interface 236 altsetting 2 endpoint 0x5 has invalid wMaxPacketSize 0 [ 164.616844][ T5869] usb 2-1: config 1 interface 236 altsetting 2 bulk endpoint 0x5 has invalid maxpacket 0 [ 164.634355][ T5869] usb 2-1: config 1 interface 236 has no altsetting 0 [ 164.644216][ T5869] usb 2-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=aa.6a [ 164.657763][ T5869] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.699432][ T5869] usb 2-1: Product: syz [ 164.717849][ T5869] usb 2-1: Manufacturer: syz [ 164.725448][ T5869] usb 2-1: SerialNumber: syz [ 164.748362][ T5869] ti_usb_3410_5052 2-1:1.236: TI USB 5052 2 port adapter converter detected [ 164.968240][ T5873] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 165.042962][ T956] usb 2-1: USB disconnect, device number 14 [ 165.125462][ T7010] FAULT_INJECTION: forcing a failure. [ 165.125462][ T7010] name failslab, interval 1, probability 0, space 0, times 0 [ 165.154715][ T5873] usb 3-1: unable to get BOS descriptor or descriptor too short [ 165.163977][ T5873] usb 3-1: not running at top speed; connect to a high speed hub [ 165.180915][ T5873] usb 3-1: config 6 has an invalid interface number: 179 but max is 0 [ 165.183086][ T7010] CPU: 1 UID: 0 PID: 7010 Comm: syz.0.301 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 165.183111][ T7010] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 165.183122][ T7010] Call Trace: [ 165.183130][ T7010] [ 165.183138][ T7010] dump_stack_lvl+0x189/0x250 [ 165.183169][ T7010] ? __pfx____ratelimit+0x10/0x10 [ 165.183196][ T7010] ? __pfx_dump_stack_lvl+0x10/0x10 [ 165.183222][ T7010] ? __pfx__printk+0x10/0x10 [ 165.183256][ T7010] ? __pfx___might_resched+0x10/0x10 [ 165.183280][ T7010] ? fs_reclaim_acquire+0x7d/0x100 [ 165.183307][ T7010] should_fail_ex+0x414/0x560 [ 165.183336][ T7010] should_failslab+0xa8/0x100 [ 165.183366][ T7010] __kmalloc_noprof+0xcb/0x4f0 [ 165.183390][ T7010] ? kfree+0x4d/0x440 [ 165.183411][ T7010] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 165.183445][ T7010] tomoyo_realpath_from_path+0xe3/0x5d0 [ 165.183475][ T7010] ? tomoyo_domain+0xda/0x130 [ 165.183498][ T7010] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 165.183522][ T7010] tomoyo_path_number_perm+0x1e8/0x5a0 [ 165.183549][ T7010] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 165.183589][ T7010] ? __lock_acquire+0xab9/0xd20 [ 165.183631][ T7010] ? __fget_files+0x2a/0x420 [ 165.183661][ T7010] ? __fget_files+0x2a/0x420 [ 165.183686][ T7010] ? __fget_files+0x3a0/0x420 [ 165.183711][ T7010] ? __fget_files+0x2a/0x420 [ 165.183741][ T7010] security_file_ioctl+0xcb/0x2d0 [ 165.183769][ T7010] __se_sys_ioctl+0x47/0x170 [ 165.183794][ T7010] do_syscall_64+0xfa/0x3b0 [ 165.183819][ T7010] ? lockdep_hardirqs_on+0x9c/0x150 [ 165.183850][ T7010] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.183868][ T7010] ? clear_bhb_loop+0x60/0xb0 [ 165.183890][ T7010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.183908][ T7010] RIP: 0033:0x7fa88d78e969 [ 165.183925][ T7010] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 165.183941][ T7010] RSP: 002b:00007fa88e58f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 165.183968][ T7010] RAX: ffffffffffffffda RBX: 00007fa88d9b5fa0 RCX: 00007fa88d78e969 [ 165.183991][ T7010] RDX: 0000200000000000 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 165.184006][ T7010] RBP: 00007fa88e58f090 R08: 0000000000000000 R09: 0000000000000000 [ 165.184023][ T7010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 165.184034][ T7010] R13: 0000000000000000 R14: 00007fa88d9b5fa0 R15: 00007fffdb5c7ee8 [ 165.184063][ T7010] [ 165.184125][ T7010] ERROR: Out of memory at tomoyo_realpath_from_path. [ 165.198139][ T5873] usb 3-1: config 6 has no interface number 0 [ 165.525554][ T7014] netlink: 'syz.0.302': attribute type 1 has an invalid length. [ 165.545732][ T7014] netlink: 172 bytes leftover after parsing attributes in process `syz.0.302'. [ 165.548165][ T5873] usb 3-1: config 6 interface 179 has no altsetting 0 [ 165.570647][ T5873] usb 3-1: New USB device found, idVendor=061d, idProduct=c120, bcdDevice= 2.18 [ 165.580800][ T5873] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.590533][ T5873] usb 3-1: Product: syz [ 165.594723][ T5873] usb 3-1: Manufacturer: syz [ 165.608142][ T5873] usb 3-1: SerialNumber: syz [ 165.739165][ T7023] FAULT_INJECTION: forcing a failure. [ 165.739165][ T7023] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 165.804059][ T7023] CPU: 0 UID: 0 PID: 7023 Comm: syz.1.304 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 165.804089][ T7023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 165.804100][ T7023] Call Trace: [ 165.804107][ T7023] [ 165.804115][ T7023] dump_stack_lvl+0x189/0x250 [ 165.804146][ T7023] ? __pfx____ratelimit+0x10/0x10 [ 165.804173][ T7023] ? __pfx_dump_stack_lvl+0x10/0x10 [ 165.804199][ T7023] ? __pfx__printk+0x10/0x10 [ 165.804228][ T7023] ? __might_fault+0xb0/0x130 [ 165.804267][ T7023] should_fail_ex+0x414/0x560 [ 165.804297][ T7023] _copy_from_user+0x2d/0xb0 [ 165.804318][ T7023] ___sys_sendmsg+0x158/0x2a0 [ 165.804351][ T7023] ? __pfx____sys_sendmsg+0x10/0x10 [ 165.804416][ T7023] ? __fget_files+0x2a/0x420 [ 165.804444][ T7023] ? __fget_files+0x3a0/0x420 [ 165.804481][ T7023] __x64_sys_sendmsg+0x19b/0x260 [ 165.804502][ T7023] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 165.804530][ T7023] ? __pfx_ksys_write+0x10/0x10 [ 165.804559][ T7023] ? do_syscall_64+0xbe/0x3b0 [ 165.804589][ T7023] do_syscall_64+0xfa/0x3b0 [ 165.804616][ T7023] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.804634][ T7023] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 165.804653][ T7023] ? clear_bhb_loop+0x60/0xb0 [ 165.804676][ T7023] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.804694][ T7023] RIP: 0033:0x7fbfe2d8e969 [ 165.804710][ T7023] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 165.804726][ T7023] RSP: 002b:00007fbfe3c98038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 165.804746][ T7023] RAX: ffffffffffffffda RBX: 00007fbfe2fb5fa0 RCX: 00007fbfe2d8e969 [ 165.804761][ T7023] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000007 [ 165.804773][ T7023] RBP: 00007fbfe3c98090 R08: 0000000000000000 R09: 0000000000000000 [ 165.804784][ T7023] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 165.804794][ T7023] R13: 0000000000000000 R14: 00007fbfe2fb5fa0 R15: 00007ffe9a930d68 [ 165.804821][ T7023] [ 166.067241][ T5873] quatech2 3-1:6.179: Quatech 2nd gen USB to Serial Driver converter detected [ 166.077079][ T5873] usb 3-1: qt2_attach - failed to power on unit: -71 [ 166.084163][ T5873] quatech2 3-1:6.179: probe with driver quatech2 failed with error -71 [ 166.096327][ T5873] usb 3-1: USB disconnect, device number 6 [ 166.580235][ T7031] netlink: 104 bytes leftover after parsing attributes in process `syz.3.307'. [ 166.844683][ T30] audit: type=1326 audit(1748498032.698:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7044 comm="syz.1.313" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 166.891223][ T30] audit: type=1326 audit(1748498032.698:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7044 comm="syz.1.313" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 167.110651][ T30] audit: type=1326 audit(1748498032.728:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7044 comm="syz.1.313" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 167.142895][ T5824] Bluetooth: hci3: ACL packet too small [ 167.154055][ T30] audit: type=1326 audit(1748498032.728:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7044 comm="syz.1.313" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 167.179239][ T30] audit: type=1326 audit(1748498032.728:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7044 comm="syz.1.313" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 167.675705][ T7042] sctp: failed to load transform for md5: -4 [ 167.771894][ T30] audit: type=1326 audit(1748498032.728:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7044 comm="syz.1.313" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 167.850031][ T30] audit: type=1326 audit(1748498032.728:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7044 comm="syz.1.313" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 167.937342][ T7057] overlayfs: failed to resolve './file1': -2 [ 168.128851][ T30] audit: type=1326 audit(1748498032.728:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7044 comm="syz.1.313" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 168.151584][ T30] audit: type=1326 audit(1748498032.728:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7044 comm="syz.1.313" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 168.173175][ T30] audit: type=1326 audit(1748498032.728:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7044 comm="syz.1.313" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 168.287609][ T7063] netlink: 4 bytes leftover after parsing attributes in process `syz.2.315'. [ 168.954671][ T7068] FAULT_INJECTION: forcing a failure. [ 168.954671][ T7068] name failslab, interval 1, probability 0, space 0, times 0 [ 168.967783][ T7068] CPU: 0 UID: 0 PID: 7068 Comm: syz.0.316 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 168.967808][ T7068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 168.967819][ T7068] Call Trace: [ 168.967827][ T7068] [ 168.967834][ T7068] dump_stack_lvl+0x189/0x250 [ 168.967866][ T7068] ? __pfx____ratelimit+0x10/0x10 [ 168.967894][ T7068] ? __pfx_dump_stack_lvl+0x10/0x10 [ 168.967920][ T7068] ? __pfx__printk+0x10/0x10 [ 168.967965][ T7068] should_fail_ex+0x414/0x560 [ 168.967995][ T7068] should_failslab+0xa8/0x100 [ 168.968025][ T7068] __kmalloc_cache_noprof+0x70/0x3d0 [ 168.968055][ T7068] ? sctp_add_bind_addr+0x8c/0x370 [ 168.968086][ T7068] sctp_add_bind_addr+0x8c/0x370 [ 168.968118][ T7068] sctp_copy_local_addr_list+0x30b/0x4e0 [ 168.968149][ T7068] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 168.968177][ T7068] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 168.968208][ T7068] ? sctp_v6_is_any+0x64/0x80 [ 168.968230][ T7068] ? sctp_copy_one_addr+0x93/0x360 [ 168.968261][ T7068] sctp_bind_addr_copy+0xb3/0x3c0 [ 168.968291][ T7068] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 168.968321][ T7068] sctp_connect_new_asoc+0x2e0/0x690 [ 168.968347][ T7068] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 168.968373][ T7068] ? __rcu_read_unlock+0x84/0xe0 [ 168.968390][ T7068] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 168.968414][ T7068] ? sctp_endpoint_lookup_assoc+0x22f/0x260 [ 168.968439][ T7068] __sctp_connect+0x5ba/0xd50 [ 168.968475][ T7068] ? __pfx___sctp_connect+0x10/0x10 [ 168.968508][ T7068] sctp_inet_connect+0x12e/0x1e0 [ 168.968546][ T7068] __sys_connect+0x313/0x440 [ 168.968572][ T7068] ? __pfx___schedule+0x10/0x10 [ 168.968597][ T7068] ? __pfx___sys_connect+0x10/0x10 [ 168.968653][ T7068] __x64_sys_connect+0x7a/0x90 [ 168.968681][ T7068] do_syscall_64+0xfa/0x3b0 [ 168.968707][ T7068] ? lockdep_hardirqs_on+0x9c/0x150 [ 168.968732][ T7068] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.968752][ T7068] ? clear_bhb_loop+0x60/0xb0 [ 168.968774][ T7068] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.968792][ T7068] RIP: 0033:0x7fa88d78e969 [ 168.968809][ T7068] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 168.968825][ T7068] RSP: 002b:00007fa88e56e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 168.968845][ T7068] RAX: ffffffffffffffda RBX: 00007fa88d9b6080 RCX: 00007fa88d78e969 [ 168.968859][ T7068] RDX: 000000000000001c RSI: 0000200000000000 RDI: 000000000000000a [ 168.968871][ T7068] RBP: 00007fa88e56e090 R08: 0000000000000000 R09: 0000000000000000 [ 168.968883][ T7068] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 168.968894][ T7068] R13: 0000000000000000 R14: 00007fa88d9b6080 R15: 00007fffdb5c7ee8 [ 168.968925][ T7068] [ 171.948405][ T5873] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 172.464382][ T5873] usb 2-1: Using ep0 maxpacket: 32 [ 172.517441][ T5873] usb 2-1: config 0 has an invalid interface number: 203 but max is 0 [ 172.526293][ T5873] usb 2-1: config 0 has no interface number 0 [ 172.538526][ T5873] usb 2-1: config 0 interface 203 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 172.555886][ T5873] usb 2-1: New USB device found, idVendor=07ca, idProduct=a805, bcdDevice=85.9f [ 172.582558][ T5873] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.608398][ T5873] usb 2-1: Product: syz [ 172.614815][ T5873] usb 2-1: Manufacturer: syz [ 172.635982][ T5873] usb 2-1: SerialNumber: syz [ 172.647029][ T5873] usb 2-1: config 0 descriptor?? [ 172.882522][ T5873] usb 2-1: USB disconnect, device number 15 [ 173.951481][ T7102] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 173.962222][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 173.962237][ T30] audit: type=1326 audit(1748498039.818:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7099 comm="syz.2.326" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fefcc38e969 code=0x0 [ 174.338206][ T1627] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 174.507487][ T1627] usb 2-1: Using ep0 maxpacket: 8 [ 174.558366][ T1627] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 174.588256][ T1627] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 8 [ 174.623332][ T1627] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 174.647607][ T1627] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.672743][ T1627] usb 2-1: Product: Ř됅繣톲杽⊖఻䬞粼倆ᒖ쉼Ȩ쐜짝ㅻ䚡帰汅ᕂ쨦≋↾쿪불꩟︹⿯鹪帡⹬蔞ﱴ⥸冐෷鼤ﲒ䷝炟刚舟ﯤ淍묋難ﻸ૳仧茫ձ爐㖪齱퟇班粕꽇锽瀃䪺ܓȐ杈醯獔䲺蠞藔ꃈ肳㉾ᦛ嚶袏趟误맚锄 [ 174.709457][ T30] audit: type=1400 audit(1748498040.558:174): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=7108 comm="syz.4.328" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 174.727353][ T1627] usb 2-1: Manufacturer: ᠉ [ 174.736121][ T1627] usb 2-1: SerialNumber: 惊꽲ꢱힻ铫●飝善㺽褛멏 [ 174.987156][ T5869] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 175.432865][ T5869] usb 3-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 175.446953][ T5869] usb 3-1: config 0 interface 0 has no altsetting 0 [ 175.457638][ T5869] usb 3-1: New USB device found, idVendor=0458, idProduct=5019, bcdDevice= 0.00 [ 175.467948][ T5869] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.492024][ T5869] usb 3-1: config 0 descriptor?? [ 175.896865][ T7122] fuse: Bad value for 'fd' [ 176.704003][ T5869] kye 0003:0458:5019.0002: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 176.718471][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 176.725355][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 176.732267][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 177.074962][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 177.107646][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 177.124081][ T1627] cdc_ncm 2-1:1.0: bind() failure [ 177.148174][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 177.157280][ T1627] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 177.164195][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 177.178247][ T1627] cdc_ncm 2-1:1.1: bind() failure [ 177.188221][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 177.208125][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 177.214903][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 177.222586][ T1627] usb 2-1: USB disconnect, device number 16 [ 177.254826][ T5869] kye 0003:0458:5019.0002: unknown main item tag 0x0 [ 177.268226][ T5869] kye 0003:0458:5019.0002: hidraw0: USB HID v0.00 Device [HID 0458:5019] on usb-dummy_hcd.2-1/input0 [ 177.282077][ T5869] kye 0003:0458:5019.0002: tablet-enabling feature report not found [ 177.292782][ T5869] kye 0003:0458:5019.0002: tablet enabling failed [ 177.333735][ T7136] netlink: 8 bytes leftover after parsing attributes in process `syz.4.339'. [ 177.344621][ T7136] netlink: 24 bytes leftover after parsing attributes in process `syz.4.339'. [ 177.479331][ T5869] usb 3-1: USB disconnect, device number 7 [ 177.625661][ T7145] netlink: 'syz.2.341': attribute type 4 has an invalid length. [ 177.668306][ T5876] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 177.746235][ T7148] FAULT_INJECTION: forcing a failure. [ 177.746235][ T7148] name failslab, interval 1, probability 0, space 0, times 0 [ 177.787248][ T7148] CPU: 1 UID: 0 PID: 7148 Comm: syz.3.342 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 177.787275][ T7148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 177.787286][ T7148] Call Trace: [ 177.787294][ T7148] [ 177.787302][ T7148] dump_stack_lvl+0x189/0x250 [ 177.787332][ T7148] ? __pfx____ratelimit+0x10/0x10 [ 177.787359][ T7148] ? __pfx_dump_stack_lvl+0x10/0x10 [ 177.787385][ T7148] ? __pfx__printk+0x10/0x10 [ 177.787418][ T7148] ? __pfx___might_resched+0x10/0x10 [ 177.787446][ T7148] should_fail_ex+0x414/0x560 [ 177.787476][ T7148] should_failslab+0xa8/0x100 [ 177.787503][ T7148] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 177.787529][ T7148] ? __alloc_skb+0x112/0x2d0 [ 177.787561][ T7148] __alloc_skb+0x112/0x2d0 [ 177.787588][ T7148] netlink_sendmsg+0x5c6/0xb30 [ 177.787621][ T7148] ? __pfx_netlink_sendmsg+0x10/0x10 [ 177.787655][ T7148] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 177.787682][ T7148] ? __pfx_netlink_sendmsg+0x10/0x10 [ 177.787710][ T7148] __sock_sendmsg+0x219/0x270 [ 177.787734][ T7148] sock_write_iter+0x258/0x330 [ 177.787756][ T7148] ? __pfx_sock_write_iter+0x10/0x10 [ 177.787789][ T7148] ? __lock_acquire+0xab9/0xd20 [ 177.787819][ T7148] do_iter_readv_writev+0x515/0x6e0 [ 177.787849][ T7148] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 177.787878][ T7148] ? bpf_lsm_file_permission+0x9/0x20 [ 177.787897][ T7148] ? security_file_permission+0x75/0x290 [ 177.787923][ T7148] ? rw_verify_area+0x258/0x650 [ 177.787951][ T7148] vfs_writev+0x306/0x9a0 [ 177.787973][ T7148] ? __lock_acquire+0xab9/0xd20 [ 177.787995][ T7148] ? __pfx_vfs_writev+0x10/0x10 [ 177.788027][ T7148] ? __fget_files+0x2a/0x420 [ 177.788061][ T7148] ? __fget_files+0x3a0/0x420 [ 177.788085][ T7148] ? __fget_files+0x2a/0x420 [ 177.788120][ T7148] do_writev+0x14d/0x2d0 [ 177.788140][ T7148] ? __pfx_do_writev+0x10/0x10 [ 177.788155][ T7148] ? rcu_is_watching+0x15/0xb0 [ 177.788184][ T7148] ? do_syscall_64+0xbe/0x3b0 [ 177.788216][ T7148] do_syscall_64+0xfa/0x3b0 [ 177.788242][ T7148] ? lockdep_hardirqs_on+0x9c/0x150 [ 177.788268][ T7148] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.788287][ T7148] ? clear_bhb_loop+0x60/0xb0 [ 177.788310][ T7148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.788328][ T7148] RIP: 0033:0x7f85cd58e969 [ 177.788346][ T7148] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 177.788362][ T7148] RSP: 002b:00007f85ce4ac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 177.788382][ T7148] RAX: ffffffffffffffda RBX: 00007f85cd7b5fa0 RCX: 00007f85cd58e969 [ 177.788397][ T7148] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000008 [ 177.788409][ T7148] RBP: 00007f85ce4ac090 R08: 0000000000000000 R09: 0000000000000000 [ 177.788421][ T7148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 177.788432][ T7148] R13: 0000000000000000 R14: 00007f85cd7b5fa0 R15: 00007ffd8855bd68 [ 177.788461][ T7148] [ 177.848432][ T5876] usb 5-1: device descriptor read/64, error -71 [ 177.932501][ T30] audit: type=1400 audit(1748498043.788:175): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=7150 comm="syz.2.343" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 178.359285][ T5876] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 178.597471][ T5876] usb 5-1: device descriptor read/64, error -71 [ 178.664761][ T30] audit: type=1326 audit(1748498044.338:176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm="syz.3.344" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 178.686703][ T30] audit: type=1326 audit(1748498044.338:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm="syz.3.344" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 178.710726][ T30] audit: type=1326 audit(1748498044.338:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm="syz.3.344" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 178.732545][ T30] audit: type=1326 audit(1748498044.338:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 178.753346][ T5876] usb usb5-port1: attempt power cycle [ 178.796405][ T30] audit: type=1326 audit(1748498044.338:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 178.879400][ T30] audit: type=1326 audit(1748498044.348:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 179.117954][ T30] audit: type=1326 audit(1748498044.348:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 179.142409][ T30] audit: type=1326 audit(1748498044.348:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 179.679068][ T7167] netlink: 60 bytes leftover after parsing attributes in process `syz.2.347'. [ 179.770530][ T5876] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 179.782475][ T30] audit: type=1326 audit(1748498044.348:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 179.805931][ T30] audit: type=1326 audit(1748498044.348:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 179.832606][ T5876] usb 5-1: device descriptor read/8, error -71 [ 179.844797][ T30] audit: type=1326 audit(1748498044.348:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 179.875720][ T30] audit: type=1326 audit(1748498044.348:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 179.958134][ T30] audit: type=1326 audit(1748498044.358:188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 179.995505][ T30] audit: type=1326 audit(1748498044.358:189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 180.101636][ T30] audit: type=1326 audit(1748498044.358:190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 180.122601][ T5876] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 180.162813][ T5876] usb 5-1: device descriptor read/8, error -71 [ 180.838766][ T7183] netlink: 188 bytes leftover after parsing attributes in process `syz.2.350'. [ 180.855701][ T30] audit: type=1326 audit(1748498044.368:191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7153 comm=04 exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 180.958679][ T5876] usb usb5-port1: unable to enumerate USB device [ 181.350447][ T7195] 9pnet_fd: Insufficient options for proto=fd [ 183.189195][ T7230] input: syz0 as /devices/virtual/input/input6 [ 183.547888][ T7233] netlink: 28 bytes leftover after parsing attributes in process `syz.3.369'. [ 185.937714][ T7233] openvswitch: netlink: Flow key attr not present in new flow. [ 187.264306][ T7248] input: syz0 as /devices/virtual/input/input7 [ 187.283999][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 187.284013][ T30] audit: type=1326 audit(1748498053.128:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7247 comm="syz.1.375" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbfe2d8e969 code=0x0 [ 187.321764][ T7244] ptrace attach of "./syz-executor exec"[5832] was attempted by ""[7244] [ 187.635474][ T7263] process 'syz.4.379' launched './file2' with NULL argv: empty string added [ 188.412554][ T5892] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 188.645070][ T5892] usb 1-1: Using ep0 maxpacket: 16 [ 188.751290][ T5892] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 188.904077][ T5892] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 189.008028][ T5892] usb 1-1: config 0 interface 0 has no altsetting 0 [ 189.080984][ T5892] usb 1-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.00 [ 189.169176][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.274702][ T5892] usb 1-1: config 0 descriptor?? [ 191.465514][ T7257] overlayfs: missing 'lowerdir' [ 191.637311][ T7295] Bluetooth: MGMT ver 1.23 [ 191.683683][ T7302] netlink: 16 bytes leftover after parsing attributes in process `syz.2.385'. [ 191.693404][ T7302] openvswitch: netlink: Flow actions attr not present in new flow. [ 191.919925][ T7300] 9pnet_fd: Insufficient options for proto=fd [ 192.706571][ T5892] usbhid 1-1:0.0: can't add hid device: -71 [ 192.713794][ T5892] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 192.787673][ T7312] overlayfs: missing 'lowerdir' [ 192.921386][ T5892] usb 1-1: USB disconnect, device number 6 [ 193.192767][ T7324] FAULT_INJECTION: forcing a failure. [ 193.192767][ T7324] name failslab, interval 1, probability 0, space 0, times 0 [ 193.207154][ T7324] CPU: 0 UID: 0 PID: 7324 Comm: syz.0.393 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 193.207181][ T7324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 193.207192][ T7324] Call Trace: [ 193.207200][ T7324] [ 193.207208][ T7324] dump_stack_lvl+0x189/0x250 [ 193.207238][ T7324] ? __pfx____ratelimit+0x10/0x10 [ 193.207265][ T7324] ? __pfx_dump_stack_lvl+0x10/0x10 [ 193.207290][ T7324] ? __pfx__printk+0x10/0x10 [ 193.207322][ T7324] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 193.207346][ T7324] ? lockdep_hardirqs_on+0x9c/0x150 [ 193.207372][ T7324] should_fail_ex+0x414/0x560 [ 193.207404][ T7324] should_failslab+0xa8/0x100 [ 193.207430][ T7324] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 193.207454][ T7324] ? __alloc_skb+0x112/0x2d0 [ 193.207482][ T7324] __alloc_skb+0x112/0x2d0 [ 193.207509][ T7324] create_monitor_ctrl_open+0x156/0x880 [ 193.207532][ T7324] ? rcu_is_watching+0x15/0xb0 [ 193.207554][ T7324] ? cap_capable+0x11f/0x460 [ 193.207583][ T7324] ? __pfx_create_monitor_ctrl_open+0x10/0x10 [ 193.207607][ T7324] ? bpf_lsm_capable+0x9/0x20 [ 193.207635][ T7324] hci_sock_ioctl+0x2f2/0x910 [ 193.207655][ T7324] ? __pfx_smack_log+0x10/0x10 [ 193.207674][ T7324] sock_do_ioctl+0xd9/0x300 [ 193.207697][ T7324] ? __pfx_sock_do_ioctl+0x10/0x10 [ 193.207714][ T7324] ? smk_tskacc+0x2fc/0x370 [ 193.207735][ T7324] ? smack_file_ioctl+0x2a9/0x340 [ 193.207760][ T7324] sock_ioctl+0x576/0x790 [ 193.207785][ T7324] ? __pfx_sock_ioctl+0x10/0x10 [ 193.207803][ T7324] ? ksys_write+0x1e1/0x250 [ 193.207830][ T7324] ? bpf_lsm_file_ioctl+0x9/0x20 [ 193.207847][ T7324] ? __pfx_sock_ioctl+0x10/0x10 [ 193.207865][ T7324] __se_sys_ioctl+0xf9/0x170 [ 193.207888][ T7324] do_syscall_64+0xfa/0x3b0 [ 193.207912][ T7324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.207928][ T7324] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 193.207944][ T7324] ? clear_bhb_loop+0x60/0xb0 [ 193.207964][ T7324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.207980][ T7324] RIP: 0033:0x7fa88d78e969 [ 193.207996][ T7324] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 193.208011][ T7324] RSP: 002b:00007fa88e56e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 193.208028][ T7324] RAX: ffffffffffffffda RBX: 00007fa88d9b6080 RCX: 00007fa88d78e969 [ 193.208045][ T7324] RDX: 0000000000000000 RSI: 00000000800448d7 RDI: 0000000000000007 [ 193.208055][ T7324] RBP: 00007fa88e56e090 R08: 0000000000000000 R09: 0000000000000000 [ 193.208066][ T7324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 193.208076][ T7324] R13: 0000000000000000 R14: 00007fa88d9b6080 R15: 00007fffdb5c7ee8 [ 193.208104][ T7324] [ 194.079005][ T5892] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 194.328216][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.334580][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.518330][ T7333] FAULT_INJECTION: forcing a failure. [ 194.518330][ T7333] name failslab, interval 1, probability 0, space 0, times 0 [ 194.948287][ T7333] CPU: 0 UID: 0 PID: 7333 Comm: syz.3.398 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 194.948317][ T7333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 194.948328][ T7333] Call Trace: [ 194.948337][ T7333] [ 194.948345][ T7333] dump_stack_lvl+0x189/0x250 [ 194.948377][ T7333] ? __pfx____ratelimit+0x10/0x10 [ 194.948407][ T7333] ? __pfx_dump_stack_lvl+0x10/0x10 [ 194.948434][ T7333] ? __pfx__printk+0x10/0x10 [ 194.948470][ T7333] ? __pfx___might_resched+0x10/0x10 [ 194.948499][ T7333] should_fail_ex+0x414/0x560 [ 194.948530][ T7333] should_failslab+0xa8/0x100 [ 194.948560][ T7333] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 194.948589][ T7333] ? __alloc_skb+0x112/0x2d0 [ 194.948622][ T7333] __alloc_skb+0x112/0x2d0 [ 194.948653][ T7333] netlink_sendmsg+0x5c6/0xb30 [ 194.948690][ T7333] ? __pfx_netlink_sendmsg+0x10/0x10 [ 194.948725][ T7333] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 194.948743][ T7333] ? __pfx_netlink_sendmsg+0x10/0x10 [ 194.948771][ T7333] __sock_sendmsg+0x219/0x270 [ 194.948798][ T7333] sock_write_iter+0x258/0x330 [ 194.948822][ T7333] ? __pfx_sock_write_iter+0x10/0x10 [ 194.948855][ T7333] ? __lock_acquire+0xab9/0xd20 [ 194.948887][ T7333] do_iter_readv_writev+0x515/0x6e0 [ 194.948917][ T7333] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 194.948949][ T7333] ? bpf_lsm_file_permission+0x9/0x20 [ 194.948969][ T7333] ? security_file_permission+0x75/0x290 [ 194.948996][ T7333] ? rw_verify_area+0x258/0x650 [ 194.949024][ T7333] vfs_writev+0x306/0x9a0 [ 194.949047][ T7333] ? __lock_acquire+0xab9/0xd20 [ 194.949070][ T7333] ? __pfx_vfs_writev+0x10/0x10 [ 194.949109][ T7333] ? __fget_files+0x2a/0x420 [ 194.949142][ T7333] ? __fget_files+0x3a0/0x420 [ 194.949169][ T7333] ? __fget_files+0x2a/0x420 [ 194.949206][ T7333] do_writev+0x14d/0x2d0 [ 194.949227][ T7333] ? __pfx_do_writev+0x10/0x10 [ 194.949251][ T7333] ? do_syscall_64+0xbe/0x3b0 [ 194.949283][ T7333] do_syscall_64+0xfa/0x3b0 [ 194.949309][ T7333] ? lockdep_hardirqs_on+0x9c/0x150 [ 194.949335][ T7333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.949354][ T7333] ? clear_bhb_loop+0x60/0xb0 [ 194.949377][ T7333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.949396][ T7333] RIP: 0033:0x7f85cd58e969 [ 194.949417][ T7333] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 194.949435][ T7333] RSP: 002b:00007f85ce4ac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 194.949455][ T7333] RAX: ffffffffffffffda RBX: 00007f85cd7b5fa0 RCX: 00007f85cd58e969 [ 194.949470][ T7333] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000b [ 194.949483][ T7333] RBP: 00007f85ce4ac090 R08: 0000000000000000 R09: 0000000000000000 [ 194.949495][ T7333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 194.949507][ T7333] R13: 0000000000000000 R14: 00007f85cd7b5fa0 R15: 00007ffd8855bd68 [ 194.949538][ T7333] [ 195.521166][ T7340] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 195.528454][ T7340] IPv6: NLM_F_CREATE should be set when creating new route [ 196.215751][ T7356] netlink: 16 bytes leftover after parsing attributes in process `syz.1.404'. [ 196.265647][ T7356] openvswitch: netlink: Flow actions attr not present in new flow. [ 196.328287][ T7360] netlink: 8 bytes leftover after parsing attributes in process `syz.4.407'. [ 196.352617][ T7360] netlink: 'syz.4.407': attribute type 21 has an invalid length. [ 196.490080][ T7359] @: renamed from vlan0 (while UP) [ 196.658148][ T5876] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 196.853790][ T5876] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 196.872242][ T5876] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 196.913892][ T5876] usb 5-1: config 220 has no interface number 2 [ 196.936601][ T5876] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 196.974130][ T5876] usb 5-1: config 220 interface 0 has no altsetting 0 [ 197.216621][ T5876] usb 5-1: config 220 interface 76 has no altsetting 0 [ 197.230727][ T5876] usb 5-1: config 220 interface 1 has no altsetting 0 [ 197.250978][ T5876] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 197.260496][ T5876] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.295389][ T5892] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 197.304818][ T5892] usb 3-1: can't read configurations, error -71 [ 197.321996][ T5876] usb 5-1: Product: syz [ 197.330945][ T5876] usb 5-1: Manufacturer: syz [ 197.340297][ T5876] usb 5-1: SerialNumber: syz [ 198.339141][ T5876] usb 5-1: selecting invalid altsetting 0 [ 198.345401][ T5876] usb 5-1: Found UVC 7.01 device syz (8086:0b07) [ 198.368270][ T5876] usb 5-1: No valid video chain found. [ 198.393733][ T5876] usb 5-1: selecting invalid altsetting 0 [ 198.421525][ T5876] usbtest 5-1:220.1: probe with driver usbtest failed with error -22 [ 198.436280][ T7383] io-wq is not configured for unbound workers [ 198.452351][ T5876] usb 5-1: USB disconnect, device number 9 [ 198.558655][ T7387] FAULT_INJECTION: forcing a failure. [ 198.558655][ T7387] name failslab, interval 1, probability 0, space 0, times 0 [ 198.571744][ T7387] CPU: 0 UID: 0 PID: 7387 Comm: syz.2.415 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 198.571770][ T7387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 198.571782][ T7387] Call Trace: [ 198.571790][ T7387] [ 198.571798][ T7387] dump_stack_lvl+0x189/0x250 [ 198.571827][ T7387] ? __pfx____ratelimit+0x10/0x10 [ 198.571853][ T7387] ? __pfx_dump_stack_lvl+0x10/0x10 [ 198.571878][ T7387] ? __pfx__printk+0x10/0x10 [ 198.571912][ T7387] ? __pfx___might_resched+0x10/0x10 [ 198.571946][ T7387] should_fail_ex+0x414/0x560 [ 198.571982][ T7387] should_failslab+0xa8/0x100 [ 198.572017][ T7387] __kmalloc_cache_noprof+0x70/0x3d0 [ 198.572043][ T7387] ? shmem_init_fs_context+0x57/0x260 [ 198.572072][ T7387] shmem_init_fs_context+0x57/0x260 [ 198.572101][ T7387] alloc_fs_context+0x64e/0x7d0 [ 198.572135][ T7387] do_new_mount+0x10e/0xa40 [ 198.572166][ T7387] __se_sys_mount+0x317/0x410 [ 198.572199][ T7387] ? __pfx___se_sys_mount+0x10/0x10 [ 198.572223][ T7387] ? rcu_is_watching+0x15/0xb0 [ 198.572252][ T7387] ? do_syscall_64+0xbe/0x3b0 [ 198.572278][ T7387] ? __x64_sys_mount+0x20/0xc0 [ 198.572308][ T7387] do_syscall_64+0xfa/0x3b0 [ 198.572335][ T7387] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.572352][ T7387] ? asm_sysvec_call_function_single+0x1a/0x20 [ 198.572372][ T7387] ? clear_bhb_loop+0x60/0xb0 [ 198.572395][ T7387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.572415][ T7387] RIP: 0033:0x7fefcc38e969 [ 198.572432][ T7387] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 198.572449][ T7387] RSP: 002b:00007fefcd16b038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 198.572469][ T7387] RAX: ffffffffffffffda RBX: 00007fefcc5b6080 RCX: 00007fefcc38e969 [ 198.572484][ T7387] RDX: 0000200000000000 RSI: 0000200000000240 RDI: 0000000000000000 [ 198.572496][ T7387] RBP: 00007fefcd16b090 R08: 0000200000000300 R09: 0000000000000000 [ 198.572509][ T7387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 198.572520][ T7387] R13: 0000000000000000 R14: 00007fefcc5b6080 R15: 00007ffc1444a058 [ 198.572550][ T7387] [ 198.908143][ T5892] IPVS: starting estimator thread 0... [ 199.010839][ T7389] IPVS: using max 24 ests per chain, 57600 per kthread [ 201.526331][ T5138] Bluetooth: hci3: command 0x0406 tx timeout [ 201.532553][ T5138] Bluetooth: hci1: command 0x0406 tx timeout [ 201.538735][ T5824] Bluetooth: hci4: command 0x0406 tx timeout [ 201.544795][ T5824] Bluetooth: hci2: command 0x0406 tx timeout [ 202.879066][ T7426] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.887969][ T7426] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.011160][ T7426] bridge_slave_0: left allmulticast mode [ 203.029673][ T7426] bridge_slave_0: left promiscuous mode [ 203.047957][ T7426] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.092850][ T7426] bridge_slave_1: left allmulticast mode [ 203.109055][ T7426] bridge_slave_1: left promiscuous mode [ 203.123790][ T7426] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.195186][ T7426] bond0: (slave bond_slave_0): Releasing backup interface [ 203.217933][ T7426] bond0: (slave bond_slave_1): Releasing backup interface [ 203.280969][ T7426] team0: Port device team_slave_0 removed [ 203.291767][ T5876] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 203.307976][ T7426] team0: Port device team_slave_1 removed [ 203.328856][ T7426] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 203.362748][ T7426] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 203.386793][ T7426] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 203.412568][ T7426] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 203.490106][ T5876] usb 3-1: unable to get BOS descriptor or descriptor too short [ 203.504047][ T5876] usb 3-1: not running at top speed; connect to a high speed hub [ 203.527712][ T5876] usb 3-1: config 5 has an invalid interface number: 246 but max is 0 [ 203.538258][ T5876] usb 3-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 203.550293][ T5876] usb 3-1: config 5 has no interface number 0 [ 203.556731][ T5876] usb 3-1: config 5 interface 246 altsetting 4 endpoint 0x3 has invalid maxpacket 255, setting to 64 [ 203.570209][ T5876] usb 3-1: config 5 interface 246 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 203.584786][ T5876] usb 3-1: config 5 interface 246 has no altsetting 0 [ 203.584813][ T7426] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 203.600146][ T5876] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=f5.e4 [ 203.615333][ T5876] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.615702][ T7426] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 203.623716][ T5876] usb 3-1: Product: syz [ 203.641221][ T5876] usb 3-1: Manufacturer: syz [ 203.646025][ T5876] usb 3-1: SerialNumber: syz [ 203.653873][ T7426] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 203.669916][ T7426] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 203.875713][ T7444] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 203.906221][ T10] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 204.565477][ T5873] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 204.626501][ T5876] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 204.672706][ T12] usb 3-1: Failed to submit usb control message: -71 [ 204.697114][ T5876] usb 3-1: USB disconnect, device number 10 [ 204.713433][ T12] usb 3-1: unable to send the bmi data to the device: -71 [ 204.748163][ T12] usb 3-1: unable to get target info from device [ 204.773946][ T12] usb 3-1: could not get target info (-71) [ 204.813016][ T12] usb 3-1: could not probe fw (-71) [ 206.288178][ T10] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 207.268214][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 207.282187][ T10] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 207.298127][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.310974][ T10] usb 4-1: config 0 descriptor?? [ 207.361072][ T7501] netlink: 8 bytes leftover after parsing attributes in process `syz.2.451'. [ 207.468332][ T5869] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 207.633113][ T5869] usb 5-1: Using ep0 maxpacket: 16 [ 207.653115][ T5869] usb 5-1: too many endpoints for config 0 interface 0 altsetting 64: 255, using maximum allowed: 30 [ 207.682279][ T10] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 207.699756][ T5869] usb 5-1: config 0 interface 0 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 207.701421][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 207.723835][ T10] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 207.732281][ T10] usb 4-1: media controller created [ 207.786668][ T7508] loop6: detected capacity change from 0 to 524287999 [ 207.847105][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 208.179186][ T5869] usb 5-1: config 0 interface 0 has no altsetting 0 [ 208.185868][ T5869] usb 5-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 208.200702][ T5869] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.219011][ T5869] usb 5-1: config 0 descriptor?? [ 208.282344][ T10] az6027: usb out operation failed. (-71) [ 208.315760][ T10] az6027: usb out operation failed. (-71) [ 208.334824][ T10] stb0899_attach: Driver disabled by Kconfig [ 208.351655][ T10] az6027: no front-end attached [ 208.351655][ T10] [ 208.364084][ T10] az6027: usb out operation failed. (-71) [ 208.374614][ T7518] openvswitch: netlink: IP tunnel dst address not specified [ 208.382414][ T10] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 208.395676][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input9 [ 208.445255][ T10] dvb-usb: schedule remote query interval to 400 msecs. [ 208.471806][ T10] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 208.496108][ T10] usb 4-1: USB disconnect, device number 14 [ 208.719590][ T7524] overlayfs: failed to clone lowerpath [ 209.260647][ T5869] kye 0003:0458:5013.0003: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 209.278494][ T5869] kye 0003:0458:5013.0003: unknown main item tag 0x0 [ 209.485932][ T5869] kye 0003:0458:5013.0003: hidraw0: USB HID v0.07 Device [HID 0458:5013] on usb-dummy_hcd.4-1/input0 [ 209.662942][ T5869] kye 0003:0458:5013.0003: tablet-enabling feature report not found [ 209.678734][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 209.714873][ T10] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 209.723746][ T5869] kye 0003:0458:5013.0003: tablet enabling failed [ 209.794472][ T5869] usb 5-1: USB disconnect, device number 10 [ 209.830636][ T7530] netlink: 40 bytes leftover after parsing attributes in process `syz.0.457'. [ 210.325673][ T7542] netlink: 4 bytes leftover after parsing attributes in process `syz.3.460'. [ 211.693117][ T7564] netlink: 40 bytes leftover after parsing attributes in process `syz.4.470'. [ 211.895340][ T7575] overlayfs: failed to resolve './cgroup': -2 [ 212.021197][ T7574] netlink: 8 bytes leftover after parsing attributes in process `syz.3.473'. [ 212.156466][ T7578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.473'. [ 213.613054][ T7601] FAULT_INJECTION: forcing a failure. [ 213.613054][ T7601] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 213.638124][ T5828] Bluetooth: hci3: ACL packet too small [ 213.638333][ T7601] CPU: 1 UID: 0 PID: 7601 Comm: syz.4.481 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 213.638359][ T7601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 213.638370][ T7601] Call Trace: [ 213.638378][ T7601] [ 213.638386][ T7601] dump_stack_lvl+0x189/0x250 [ 213.638417][ T7601] ? __pfx____ratelimit+0x10/0x10 [ 213.638444][ T7601] ? __pfx_dump_stack_lvl+0x10/0x10 [ 213.638470][ T7601] ? __pfx__printk+0x10/0x10 [ 213.638499][ T7601] ? __might_fault+0xb0/0x130 [ 213.638537][ T7601] should_fail_ex+0x414/0x560 [ 213.638566][ T7601] _copy_from_user+0x2d/0xb0 [ 213.638587][ T7601] memdup_user+0x5e/0xd0 [ 213.638609][ T7601] strndup_user+0x68/0xd0 [ 213.638631][ T7601] __se_sys_request_key+0x12b/0x340 [ 213.638657][ T7601] ? ksys_write+0x22a/0x250 [ 213.638680][ T7601] ? __pfx___se_sys_request_key+0x10/0x10 [ 213.638712][ T7601] ? do_syscall_64+0xbe/0x3b0 [ 213.638743][ T7601] do_syscall_64+0xfa/0x3b0 [ 213.638769][ T7601] ? lockdep_hardirqs_on+0x9c/0x150 [ 213.638794][ T7601] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.638813][ T7601] ? clear_bhb_loop+0x60/0xb0 [ 213.638835][ T7601] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.638853][ T7601] RIP: 0033:0x7fcfed98e969 [ 213.638870][ T7601] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 213.638885][ T7601] RSP: 002b:00007fcfee7cf038 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 213.638912][ T7601] RAX: ffffffffffffffda RBX: 00007fcfedbb5fa0 RCX: 00007fcfed98e969 [ 213.638927][ T7601] RDX: 0000200000000240 RSI: 0000200000000200 RDI: 0000200000000140 [ 213.638941][ T7601] RBP: 00007fcfee7cf090 R08: 0000000000000000 R09: 0000000000000000 [ 213.638952][ T7601] R10: fffffffffffffff9 R11: 0000000000000246 R12: 0000000000000001 [ 213.638965][ T7601] R13: 0000000000000000 R14: 00007fcfedbb5fa0 R15: 00007ffde3683298 [ 213.638994][ T7601] [ 213.683249][ T7603] netlink: 44 bytes leftover after parsing attributes in process `syz.0.479'. [ 214.257081][ T7612] fuse: Bad value for 'fd' [ 215.351698][ T7618] netlink: 40 bytes leftover after parsing attributes in process `syz.4.487'. [ 217.315130][ T7653] fuse: Bad value for 'fd' [ 217.760918][ T7657] overlayfs: failed to clone upperpath [ 218.050147][ T7660] netlink: 8 bytes leftover after parsing attributes in process `syz.3.499'. [ 218.526116][ T7663] netlink: 40 bytes leftover after parsing attributes in process `syz.4.500'. [ 218.634950][ T7670] netlink: 4 bytes leftover after parsing attributes in process `syz.0.503'. [ 219.921445][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 220.101876][ T7682] xt_HMARK: proto mask must be zero with L3 mode [ 220.278486][ T1627] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 220.468129][ T1627] usb 5-1: Using ep0 maxpacket: 32 [ 220.479882][ T1627] usb 5-1: unable to get BOS descriptor or descriptor too short [ 220.488762][ T1627] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 220.510811][ T1627] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 220.520231][ T1627] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.538135][ T1627] usb 5-1: Product: syz [ 220.542373][ T1627] usb 5-1: Manufacturer: syz [ 220.546988][ T1627] usb 5-1: SerialNumber: syz [ 220.953644][ T1627] usb 5-1: Cannot retrieve CPort count: 0 [ 220.960995][ T1627] usb 5-1: Cannot retrieve CPort count: -5 [ 220.993156][ T1627] es2_ap_driver 5-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 221.175852][ T956] usb 5-1: USB disconnect, device number 11 [ 221.430428][ T7710] netlink: 'syz.0.514': attribute type 2 has an invalid length. [ 222.274952][ T7729] netlink: 'syz.3.518': attribute type 1 has an invalid length. [ 222.381950][ T7732] netlink: 4 bytes leftover after parsing attributes in process `syz.1.520'. [ 222.456569][ T7727] overlayfs: failed to resolve './file2': -2 [ 223.537424][ T7754] netlink: 4 bytes leftover after parsing attributes in process `syz.3.527'. [ 224.895759][ T30] audit: type=1400 audit(1748498090.748:213): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=7770 comm="syz.3.534" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 225.240901][ T7778] netlink: 256 bytes leftover after parsing attributes in process `syz.2.532'. [ 225.532319][ T7780] FAULT_INJECTION: forcing a failure. [ 225.532319][ T7780] name failslab, interval 1, probability 0, space 0, times 0 [ 225.532352][ T7780] CPU: 0 UID: 0 PID: 7780 Comm: syz.4.536 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 225.532377][ T7780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 225.532389][ T7780] Call Trace: [ 225.532396][ T7780] [ 225.532405][ T7780] dump_stack_lvl+0x189/0x250 [ 225.532436][ T7780] ? __pfx____ratelimit+0x10/0x10 [ 225.532470][ T7780] ? __pfx_dump_stack_lvl+0x10/0x10 [ 225.532497][ T7780] ? __pfx__printk+0x10/0x10 [ 225.532532][ T7780] ? __pfx___might_resched+0x10/0x10 [ 225.532563][ T7780] should_fail_ex+0x414/0x560 [ 225.532594][ T7780] should_failslab+0xa8/0x100 [ 225.532624][ T7780] __kmalloc_cache_noprof+0x70/0x3d0 [ 225.532652][ T7780] ? mpi_alloc+0x52/0x140 [ 225.532681][ T7780] mpi_alloc+0x52/0x140 [ 225.532707][ T7780] mpi_read_raw_data+0x139/0x970 [ 225.532740][ T7780] dh_set_secret+0x186/0x310 [ 225.532764][ T7780] ? crypto_create_tfm_node+0x83/0x3f0 [ 225.532789][ T7780] ? __pfx_dh_set_secret+0x10/0x10 [ 225.532820][ T7780] ? crypto_alloc_tfm_node+0x3c1/0x3f0 [ 225.532849][ T7780] __keyctl_dh_compute+0x507/0xca0 [ 225.532875][ T7780] ? __might_fault+0xb0/0x130 [ 225.532905][ T7780] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 225.532935][ T7780] ? __lock_acquire+0xab9/0xd20 [ 225.532986][ T7780] keyctl_dh_compute+0x109/0x160 [ 225.533007][ T7780] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 225.533035][ T7780] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 225.533056][ T7780] ? vfs_write+0x8d8/0xa90 [ 225.533095][ T7780] __se_sys_keyctl+0x423/0x910 [ 225.533125][ T7780] ? __pfx___se_sys_keyctl+0x10/0x10 [ 225.533155][ T7780] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 225.533188][ T7780] ? __fget_files+0x3a0/0x420 [ 225.533222][ T7780] ? fput+0xa0/0xd0 [ 225.533242][ T7780] ? ksys_write+0x22a/0x250 [ 225.533269][ T7780] ? __pfx_ksys_write+0x10/0x10 [ 225.533291][ T7780] ? rcu_is_watching+0x15/0xb0 [ 225.533325][ T7780] ? do_syscall_64+0xbe/0x3b0 [ 225.533351][ T7780] ? __x64_sys_keyctl+0x20/0xc0 [ 225.533381][ T7780] do_syscall_64+0xfa/0x3b0 [ 225.533407][ T7780] ? lockdep_hardirqs_on+0x9c/0x150 [ 225.533433][ T7780] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.533460][ T7780] ? clear_bhb_loop+0x60/0xb0 [ 225.533484][ T7780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.533503][ T7780] RIP: 0033:0x7fcfed98e969 [ 225.533520][ T7780] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 225.533538][ T7780] RSP: 002b:00007fcfee7cf038 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 225.533559][ T7780] RAX: ffffffffffffffda RBX: 00007fcfedbb5fa0 RCX: 00007fcfed98e969 [ 225.533577][ T7780] RDX: 0000200000000240 RSI: 0000200000000140 RDI: 0000000000000017 [ 225.533591][ T7780] RBP: 00007fcfee7cf090 R08: 0000000000000000 R09: 0000000000000000 [ 225.533604][ T7780] R10: 0000000000000045 R11: 0000000000000246 R12: 0000000000000001 [ 225.533616][ T7780] R13: 0000000000000000 R14: 00007fcfedbb5fa0 R15: 00007ffde3683298 [ 225.533647][ T7780] [ 225.988287][ T7791] netlink: 40 bytes leftover after parsing attributes in process `syz.4.538'. [ 226.015105][ T7795] netlink: 4 bytes leftover after parsing attributes in process `syz.3.541'. [ 226.072758][ T7787] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 226.599114][ T7787] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 227.010650][ T7814] FAULT_INJECTION: forcing a failure. [ 227.010650][ T7814] name failslab, interval 1, probability 0, space 0, times 0 [ 227.023517][ T7814] CPU: 0 UID: 0 PID: 7814 Comm: syz.4.543 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 227.023543][ T7814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 227.023555][ T7814] Call Trace: [ 227.023567][ T7814] [ 227.023576][ T7814] dump_stack_lvl+0x189/0x250 [ 227.023606][ T7814] ? __pfx____ratelimit+0x10/0x10 [ 227.023632][ T7814] ? __pfx_dump_stack_lvl+0x10/0x10 [ 227.023656][ T7814] ? __pfx__printk+0x10/0x10 [ 227.023686][ T7814] ? __pfx___might_resched+0x10/0x10 [ 227.023709][ T7814] ? fs_reclaim_acquire+0x7d/0x100 [ 227.023733][ T7814] should_fail_ex+0x414/0x560 [ 227.023763][ T7814] should_failslab+0xa8/0x100 [ 227.023790][ T7814] __kmalloc_noprof+0xcb/0x4f0 [ 227.023814][ T7814] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 227.023841][ T7814] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 227.023870][ T7814] genl_family_rcv_msg_doit+0xb8/0x300 [ 227.023894][ T7814] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 227.023917][ T7814] ? rcu_is_watching+0x15/0xb0 [ 227.023942][ T7814] ? cap_capable+0x11f/0x460 [ 227.023966][ T7814] ? safesetid_security_capable+0xa9/0x1a0 [ 227.023993][ T7814] ? bpf_lsm_capable+0x9/0x20 [ 227.024016][ T7814] ? security_capable+0x7e/0x2e0 [ 227.024058][ T7814] genl_rcv_msg+0x60e/0x790 [ 227.024084][ T7814] ? __pfx_genl_rcv_msg+0x10/0x10 [ 227.024104][ T7814] ? __pfx_ila_xlat_nl_cmd_add_mapping+0x10/0x10 [ 227.024146][ T7814] netlink_rcv_skb+0x21c/0x490 [ 227.024173][ T7814] ? __pfx_genl_rcv_msg+0x10/0x10 [ 227.024193][ T7814] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 227.024245][ T7814] ? down_read+0x1ad/0x2e0 [ 227.024265][ T7814] genl_rcv+0x28/0x40 [ 227.024282][ T7814] netlink_unicast+0x758/0x8d0 [ 227.024316][ T7814] netlink_sendmsg+0x805/0xb30 [ 227.024353][ T7814] ? __pfx_netlink_sendmsg+0x10/0x10 [ 227.024389][ T7814] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 227.024406][ T7814] ? __pfx_netlink_sendmsg+0x10/0x10 [ 227.024432][ T7814] __sock_sendmsg+0x219/0x270 [ 227.024456][ T7814] ____sys_sendmsg+0x505/0x830 [ 227.024495][ T7814] ? __pfx_____sys_sendmsg+0x10/0x10 [ 227.024535][ T7814] ? import_iovec+0x74/0xa0 [ 227.024559][ T7814] ___sys_sendmsg+0x21f/0x2a0 [ 227.024590][ T7814] ? __pfx____sys_sendmsg+0x10/0x10 [ 227.024658][ T7814] ? __fget_files+0x2a/0x420 [ 227.024685][ T7814] ? __fget_files+0x3a0/0x420 [ 227.024721][ T7814] __x64_sys_sendmsg+0x19b/0x260 [ 227.024741][ T7814] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 227.024770][ T7814] ? __pfx_ksys_write+0x10/0x10 [ 227.024800][ T7814] ? do_syscall_64+0xbe/0x3b0 [ 227.024832][ T7814] do_syscall_64+0xfa/0x3b0 [ 227.024861][ T7814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 227.024878][ T7814] ? asm_sysvec_call_function_single+0x1a/0x20 [ 227.024897][ T7814] ? clear_bhb_loop+0x60/0xb0 [ 227.024921][ T7814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 227.024938][ T7814] RIP: 0033:0x7fcfed98e969 [ 227.024955][ T7814] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 227.024972][ T7814] RSP: 002b:00007fcfee7ae038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 227.024992][ T7814] RAX: ffffffffffffffda RBX: 00007fcfedbb6080 RCX: 00007fcfed98e969 [ 227.025007][ T7814] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000006 [ 227.025019][ T7814] RBP: 00007fcfee7ae090 R08: 0000000000000000 R09: 0000000000000000 [ 227.025030][ T7814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 227.025040][ T7814] R13: 0000000000000000 R14: 00007fcfedbb6080 R15: 00007ffde3683298 [ 227.025081][ T7814] [ 228.434112][ T7828] netlink: 256 bytes leftover after parsing attributes in process `syz.2.550'. [ 228.885162][ T7830] 9pnet: p9_errstr2errno: server reported unknown error @΂(Q0x0000000000000007 [ 229.513333][ T7839] netlink: 40 bytes leftover after parsing attributes in process `syz.1.554'. [ 229.618791][ T7843] netlink: 'syz.3.555': attribute type 11 has an invalid length. [ 229.724294][ T7852] netlink: 256 bytes leftover after parsing attributes in process `syz.2.559'. [ 229.750244][ T7852] netlink: 44 bytes leftover after parsing attributes in process `syz.2.559'. [ 229.789210][ T956] IPVS: starting estimator thread 0... [ 229.997388][ T7853] netlink: 60 bytes leftover after parsing attributes in process `syz.1.560'. [ 230.433962][ T7857] netlink: 4 bytes leftover after parsing attributes in process `syz.4.558'. [ 230.444140][ T7855] IPVS: using max 31 ests per chain, 74400 per kthread [ 231.683086][ T7881] netlink: 40 bytes leftover after parsing attributes in process `syz.4.567'. [ 232.570944][ T7898] overlayfs: failed to clone upperpath [ 232.655075][ T7899] fuse: Bad value for 'fd' [ 233.296233][ T7911] FAULT_INJECTION: forcing a failure. [ 233.296233][ T7911] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 233.386536][ T7916] netlink: 'syz.4.577': attribute type 3 has an invalid length. [ 233.394711][ T7916] netlink: 224 bytes leftover after parsing attributes in process `syz.4.577'. [ 233.418652][ T7911] CPU: 1 UID: 0 PID: 7911 Comm: syz.2.576 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 233.418680][ T7911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 233.418691][ T7911] Call Trace: [ 233.418699][ T7911] [ 233.418707][ T7911] dump_stack_lvl+0x189/0x250 [ 233.418740][ T7911] ? __pfx____ratelimit+0x10/0x10 [ 233.418765][ T7911] ? __pfx_dump_stack_lvl+0x10/0x10 [ 233.418788][ T7911] ? __pfx__printk+0x10/0x10 [ 233.418821][ T7911] ? __might_fault+0xb0/0x130 [ 233.418856][ T7911] should_fail_ex+0x414/0x560 [ 233.418881][ T7911] _copy_to_iter+0x3f5/0x16f0 [ 233.418910][ T7911] ? seq_read_iter+0xb7/0xe10 [ 233.418938][ T7911] ? __pfx__copy_to_iter+0x10/0x10 [ 233.418969][ T7911] ? do_raw_spin_unlock+0x122/0x240 [ 233.419009][ T7911] seq_read_iter+0x2e4/0xe10 [ 233.419043][ T7911] ? __asan_memset+0x22/0x50 [ 233.419067][ T7911] seq_read+0x2e2/0x3d0 [ 233.419084][ T7911] ? __lock_acquire+0xab9/0xd20 [ 233.419109][ T7911] ? __pfx_seq_read+0x10/0x10 [ 233.419133][ T7911] ? __import_iovec+0x40e/0x7f0 [ 233.419159][ T7911] ? __pfx_seq_read+0x10/0x10 [ 233.419176][ T7911] proc_reg_read+0x1e9/0x2e0 [ 233.419199][ T7911] vfs_readv+0x5a2/0x840 [ 233.419213][ T7911] ? __pfx_proc_reg_read+0x10/0x10 [ 233.419236][ T7911] ? __pfx_vfs_readv+0x10/0x10 [ 233.419264][ T7911] ? __fget_files+0x2a/0x420 [ 233.419292][ T7911] ? __fget_files+0x3a0/0x420 [ 233.419315][ T7911] ? __fget_files+0x2a/0x420 [ 233.419346][ T7911] __x64_sys_preadv+0x197/0x2a0 [ 233.419372][ T7911] ? __pfx___x64_sys_preadv+0x10/0x10 [ 233.419393][ T7911] ? rcu_is_watching+0x15/0xb0 [ 233.419418][ T7911] ? do_syscall_64+0xbe/0x3b0 [ 233.419446][ T7911] do_syscall_64+0xfa/0x3b0 [ 233.419468][ T7911] ? lockdep_hardirqs_on+0x9c/0x150 [ 233.419490][ T7911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.419507][ T7911] ? clear_bhb_loop+0x60/0xb0 [ 233.419527][ T7911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.419543][ T7911] RIP: 0033:0x7fefcc38e969 [ 233.419557][ T7911] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 233.419572][ T7911] RSP: 002b:00007fefcd18c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 233.419591][ T7911] RAX: ffffffffffffffda RBX: 00007fefcc5b5fa0 RCX: 00007fefcc38e969 [ 233.419603][ T7911] RDX: 0000000000000002 RSI: 0000200000000180 RDI: 0000000000000005 [ 233.419614][ T7911] RBP: 00007fefcd18c090 R08: 0000000000002081 R09: 0000000000000000 [ 233.419625][ T7911] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 233.419635][ T7911] R13: 0000000000000000 R14: 00007fefcc5b5fa0 R15: 00007ffc1444a058 [ 233.419661][ T7911] [ 234.968526][ T43] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 235.219278][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 235.463603][ T43] usb 3-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 235.510837][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.554845][ T43] usb 3-1: Product: syz [ 235.567213][ T43] usb 3-1: Manufacturer: syz [ 235.586103][ T43] usb 3-1: SerialNumber: syz [ 235.620103][ T43] usb 3-1: config 0 descriptor?? [ 235.628668][ T7945] capability: warning: `syz.1.587' uses 32-bit capabilities (legacy support in use) [ 235.630816][ T43] visor 3-1:0.0: Sony Clie 3.5 converter detected [ 236.107444][ T7956] bridge0: port 2(bridge_slave_1) entered disabled state [ 236.115238][ T7956] bridge0: port 1(bridge_slave_0) entered disabled state [ 236.168467][ T7956] bridge0: entered allmulticast mode [ 236.205955][ T7957] bridge_slave_1: left allmulticast mode [ 236.220896][ T7957] bridge_slave_1: left promiscuous mode [ 236.229716][ T7957] bridge0: port 2(bridge_slave_1) entered disabled state [ 236.244262][ T7957] bridge_slave_0: left allmulticast mode [ 236.250146][ T7957] bridge_slave_0: left promiscuous mode [ 236.255950][ T7957] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.024275][ T43] usb 3-1: clie_3_5_startup: get config number failed: -71 [ 238.034981][ T43] visor 3-1:0.0: probe with driver visor failed with error -71 [ 238.065480][ T43] usb 3-1: USB disconnect, device number 11 [ 238.339256][ T8003] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 239.719229][ T8017] overlayfs: failed to clone upperpath [ 240.067758][ T8011] fuse: Bad value for 'fd' [ 240.690873][ T8025] netlink: 4 bytes leftover after parsing attributes in process `syz.0.613'. [ 241.198484][ T8033] Cache volume key already in use (9p,(null),@) [ 242.063143][ T8047] fuse: Unknown parameter 'cRd8' [ 242.194055][ T8052] sctp: [Deprecated]: syz.2.624 (pid 8052) Use of struct sctp_assoc_value in delayed_ack socket option. [ 242.194055][ T8052] Use struct sctp_sack_info instead [ 244.325392][ T8074] Cache volume key already in use (9p,(null),@) [ 244.676602][ T8083] netlink: 4 bytes leftover after parsing attributes in process `syz.2.632'. [ 245.700988][ T8096] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 248.976595][ T8126] netlink: 4 bytes leftover after parsing attributes in process `syz.4.646'. [ 248.994679][ T8125] lo speed is unknown, defaulting to 1000 [ 249.147960][ T30] audit: type=1400 audit(1748498114.858:214): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=8128 comm="syz.0.648" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 249.297689][ T8136] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 249.977676][ T8145] netlink: 12 bytes leftover after parsing attributes in process `syz.4.654'. [ 250.206077][ T8143] netlink: 8 bytes leftover after parsing attributes in process `syz.0.653'. [ 252.034763][ T8168] 9p: Unknown access argument : -22 [ 252.358821][ T8166] netlink: 4 bytes leftover after parsing attributes in process `syz.0.660'. [ 252.723941][ T30] audit: type=1400 audit(1748498118.408:215): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=8172 comm="syz.2.663" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 252.853849][ T8180] overlayfs: failed to clone upperpath [ 254.816558][ T8189] 9pnet_fd: Insufficient options for proto=fd [ 255.985394][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.992023][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.513938][ T30] audit: type=1400 audit(1748498123.298:216): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=8220 comm="syz.1.676" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 258.078633][ T8231] netlink: 8 bytes leftover after parsing attributes in process `syz.4.678'. [ 258.642547][ T8236] 9pnet_fd: Insufficient options for proto=fd [ 258.656687][ T8238] netlink: 44 bytes leftover after parsing attributes in process `syz.3.682'. [ 258.665936][ T8237] netlink: 44 bytes leftover after parsing attributes in process `syz.3.682'. [ 258.759485][ T8240] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 261.190234][ T8267] overlayfs: failed to clone upperpath [ 263.183380][ T956] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 263.527126][ T956] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 247, changing to 11 [ 263.610972][ T956] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1072, setting to 1024 [ 263.759749][ T956] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 64 [ 263.772300][ T956] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 263.782026][ T956] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.798093][ T956] usb 3-1: Product: syz [ 263.802297][ T956] usb 3-1: Manufacturer: syz [ 263.806908][ T956] usb 3-1: SerialNumber: syz [ 263.831983][ T8295] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 264.013078][ T8310] lo speed is unknown, defaulting to 1000 [ 264.048973][ T956] cdc_ncm 3-1:1.0: bind() failure [ 264.066070][ T956] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 264.085770][ T956] cdc_ncm 3-1:1.1: bind() failure [ 264.107631][ T956] usb 3-1: USB disconnect, device number 12 [ 264.745452][ T8327] overlayfs: failed to clone upperpath [ 268.010070][ T8364] netlink: 'syz.1.717': attribute type 10 has an invalid length. [ 268.031906][ T8364] bond0: (slave wlan1): Opening slave failed [ 269.771322][ T8399] netlink: 4 bytes leftover after parsing attributes in process `syz.2.732'. [ 271.298132][ T5876] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 271.380376][ T8424] lo speed is unknown, defaulting to 1000 [ 271.448999][ T5876] usb 3-1: Using ep0 maxpacket: 32 [ 271.463801][ T5876] usb 3-1: unable to get BOS descriptor or descriptor too short [ 271.479951][ T5876] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 271.498553][ T5876] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 271.517230][ T5876] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.535287][ T5876] usb 3-1: Product: syz [ 271.543107][ T5876] usb 3-1: Manufacturer: syz [ 271.553472][ T5876] usb 3-1: SerialNumber: syz [ 271.665305][ T30] audit: type=1326 audit(1748498137.518:217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.1.741" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbfe2d8e969 code=0x0 [ 271.856639][ T5876] usb 3-1: Cannot retrieve CPort count: 0 [ 271.864035][ T5876] usb 3-1: Cannot retrieve CPort count: -5 [ 271.869958][ T5876] es2_ap_driver 3-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 272.083008][ T30] audit: type=1326 audit(1748498137.938:218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8415 comm="syz.4.738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcfed98e969 code=0x7fc00000 [ 272.310265][ T8441] overlayfs: failed to clone upperpath [ 273.948228][ T1627] usb 3-1: USB disconnect, device number 13 [ 274.231813][ T30] audit: type=1326 audit(1748498140.088:219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8476 comm="syz.2.761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fefcc38e969 code=0x7ffc0000 [ 275.065326][ T30] audit: type=1326 audit(1748498140.088:220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8476 comm="syz.2.761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fefcc38e969 code=0x7ffc0000 [ 275.086831][ T30] audit: type=1326 audit(1748498140.088:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8476 comm="syz.2.761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fefcc38e969 code=0x7ffc0000 [ 275.178149][ T30] audit: type=1326 audit(1748498140.088:222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8476 comm="syz.2.761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fefcc38e969 code=0x7ffc0000 [ 275.223937][ T30] audit: type=1326 audit(1748498140.118:223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8476 comm="syz.2.761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=93 compat=0 ip=0x7fefcc38e969 code=0x7ffc0000 [ 275.302871][ T30] audit: type=1326 audit(1748498140.118:224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8476 comm="syz.2.761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fefcc38e969 code=0x7ffc0000 [ 275.451627][ T30] audit: type=1326 audit(1748498140.118:225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8476 comm="syz.2.761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7fefcc38e969 code=0x7ffc0000 [ 275.475410][ T30] audit: type=1326 audit(1748498140.118:226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8476 comm="syz.2.761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fefcc38e969 code=0x7ffc0000 [ 276.416694][ T8469] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 276.441433][ T8506] netlink: 14 bytes leftover after parsing attributes in process `syz.0.769'. [ 276.592387][ T8506] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 276.604671][ T8506] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 276.615876][ T8506] bond0 (unregistering): Released all slaves [ 276.738506][ T1627] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 276.784557][ T8516] warning: `syz.0.772' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 277.022346][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 277.022373][ T30] audit: type=1400 audit(1748498142.878:246): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=8523 comm="syz.0.775" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 277.068087][ T1627] usb 3-1: Using ep0 maxpacket: 32 [ 277.090712][ T1627] usb 3-1: unable to get BOS descriptor or descriptor too short [ 277.104745][ T1627] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 277.130466][ T1627] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 277.150522][ T1627] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.174326][ T1627] usb 3-1: Product: syz [ 277.188091][ T1627] usb 3-1: Manufacturer: syz [ 277.198597][ T1627] usb 3-1: SerialNumber: syz [ 277.422859][ T1627] usb 3-1: Cannot retrieve CPort count: 0 [ 277.448277][ T1627] usb 3-1: Cannot retrieve CPort count: -5 [ 277.468343][ T1627] es2_ap_driver 3-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 277.825973][ T8539] netlink: 4 bytes leftover after parsing attributes in process `syz.3.778'. [ 277.838971][ T8539] netlink: 8 bytes leftover after parsing attributes in process `syz.3.778'. [ 278.166080][ T8548] netlink: 'syz.0.781': attribute type 30 has an invalid length. [ 279.839461][ T1627] usb 3-1: USB disconnect, device number 14 [ 280.289532][ T30] audit: type=1400 audit(1748498146.138:247): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=8571 comm="syz.0.789" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 282.171814][ T8586] netlink: 8 bytes leftover after parsing attributes in process `syz.3.792'. [ 282.188340][ T8586] netlink: 4 bytes leftover after parsing attributes in process `syz.3.792'. [ 283.311278][ T8611] netlink: 40 bytes leftover after parsing attributes in process `syz.3.801'. [ 284.873795][ T8639] siw: device registration error -23 [ 284.882367][ T8639] input: syz1 as /devices/virtual/input/input11 [ 285.420789][ T8649] netlink: 40 bytes leftover after parsing attributes in process `syz.3.815'. [ 285.591661][ T8650] tipc: Enabling of bearer rejected, failed to enable media [ 286.691124][ T8682] FAULT_INJECTION: forcing a failure. [ 286.691124][ T8682] name failslab, interval 1, probability 0, space 0, times 0 [ 286.723150][ T8682] CPU: 0 UID: 0 PID: 8682 Comm: syz.2.826 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 286.723177][ T8682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 286.723185][ T8682] Call Trace: [ 286.723191][ T8682] [ 286.723198][ T8682] dump_stack_lvl+0x189/0x250 [ 286.723228][ T8682] ? __pfx____ratelimit+0x10/0x10 [ 286.723254][ T8682] ? __pfx_dump_stack_lvl+0x10/0x10 [ 286.723277][ T8682] ? __pfx__printk+0x10/0x10 [ 286.723311][ T8682] ? __pfx___might_resched+0x10/0x10 [ 286.723335][ T8682] ? fs_reclaim_acquire+0x7d/0x100 [ 286.723358][ T8682] should_fail_ex+0x414/0x560 [ 286.723386][ T8682] should_failslab+0xa8/0x100 [ 286.723414][ T8682] __kmalloc_noprof+0xcb/0x4f0 [ 286.723439][ T8682] ? security_inode_init_security+0x107/0x3f0 [ 286.723459][ T8682] ? dquot_alloc_inode+0x166/0xa50 [ 286.723492][ T8682] security_inode_init_security+0x107/0x3f0 [ 286.723512][ T8682] ? __pfx_shmem_initxattrs+0x10/0x10 [ 286.723545][ T8682] ? __pfx_security_inode_init_security+0x10/0x10 [ 286.723567][ T8682] ? set_cached_acl+0xd2/0x180 [ 286.723587][ T8682] ? simple_acl_create+0x184/0x1b0 [ 286.723612][ T8682] shmem_mknod+0x1f6/0x3e0 [ 286.723639][ T8682] vfs_mknod+0x37f/0x3c0 [ 286.723670][ T8682] do_mknodat+0x385/0x4d0 [ 286.723695][ T8682] ? __pfx_do_mknodat+0x10/0x10 [ 286.723719][ T8682] ? getname_flags+0x1e5/0x540 [ 286.723754][ T8682] __x64_sys_mknod+0x8c/0xa0 [ 286.723779][ T8682] do_syscall_64+0xfa/0x3b0 [ 286.723803][ T8682] ? lockdep_hardirqs_on+0x9c/0x150 [ 286.723828][ T8682] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.723847][ T8682] ? clear_bhb_loop+0x60/0xb0 [ 286.723870][ T8682] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.723888][ T8682] RIP: 0033:0x7fefcc38e969 [ 286.723905][ T8682] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 286.723921][ T8682] RSP: 002b:00007fefcd18c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 286.723941][ T8682] RAX: ffffffffffffffda RBX: 00007fefcc5b5fa0 RCX: 00007fefcc38e969 [ 286.723955][ T8682] RDX: 0000000000000705 RSI: 0000000000002480 RDI: 00002000000017c0 [ 286.723968][ T8682] RBP: 00007fefcd18c090 R08: 0000000000000000 R09: 0000000000000000 [ 286.723980][ T8682] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 286.723992][ T8682] R13: 0000000000000000 R14: 00007fefcc5b5fa0 R15: 00007ffc1444a058 [ 286.724022][ T8682] [ 287.023910][ T8686] netlink: 40 bytes leftover after parsing attributes in process `syz.3.827'. [ 287.804030][ T8703] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 287.829236][ T8703] IPv6: addrconf: prefix option has invalid lifetime [ 290.225380][ T8747] 9pnet_fd: Insufficient options for proto=fd [ 291.605039][ T8778] netlink: 8 bytes leftover after parsing attributes in process `syz.0.860'. [ 291.868619][ T8784] netlink: 4 bytes leftover after parsing attributes in process `syz.1.858'. [ 292.683092][ T8793] netlink: 40 bytes leftover after parsing attributes in process `syz.1.863'. [ 292.788136][ T30] audit: type=1400 audit(1748498158.628:248): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=8794 comm="syz.0.866" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 292.977797][ T8809] No such timeout policy "syz0" [ 293.088717][ T1627] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 293.749404][ T1627] usb 3-1: Using ep0 maxpacket: 8 [ 293.769185][ T1627] usb 3-1: config 162 has an invalid interface number: 84 but max is 2 [ 293.777716][ T1627] usb 3-1: config 162 has an invalid interface number: 3 but max is 2 [ 293.798571][ T1627] usb 3-1: config 162 has no interface number 0 [ 293.804887][ T1627] usb 3-1: config 162 has no interface number 1 [ 293.816061][ T1627] usb 3-1: config 162 interface 84 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 293.829250][ T1627] usb 3-1: config 162 interface 2 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 293.840016][ T1627] usb 3-1: config 162 interface 2 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 293.854932][ T1627] usb 3-1: config 162 interface 2 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 293.882031][ T1627] usb 3-1: config 162 interface 2 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 293.892586][ T1627] usb 3-1: config 162 interface 2 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 293.905771][ T1627] usb 3-1: config 162 interface 84 has no altsetting 0 [ 293.912876][ T1627] usb 3-1: config 162 interface 2 has no altsetting 0 [ 293.920350][ T1627] usb 3-1: config 162 interface 3 has no altsetting 0 [ 294.391227][ T1627] usb 3-1: New USB device found, idVendor=0e8d, idProduct=763f, bcdDevice=9b.23 [ 294.413971][ T1627] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.428384][ T1627] usb 3-1: Product: syz [ 294.432588][ T1627] usb 3-1: Manufacturer: syz [ 294.446276][ T1627] usb 3-1: SerialNumber: syz [ 294.672751][ T8835] netlink: 60 bytes leftover after parsing attributes in process `syz.1.876'. [ 294.798420][ T5828] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 294.830240][ T1627] usb 3-1: USB disconnect, device number 15 [ 294.854054][ T8838] netlink: 40 bytes leftover after parsing attributes in process `syz.0.878'. [ 295.270705][ T8846] netlink: 4 bytes leftover after parsing attributes in process `syz.1.880'. [ 296.102777][ T8854] netlink: 8 bytes leftover after parsing attributes in process `syz.1.881'. [ 296.130330][ T8854] netlink: 4 bytes leftover after parsing attributes in process `syz.1.881'. [ 296.196021][ T30] audit: type=1400 audit(1748498162.048:249): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=8848 comm="syz.2.883" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 297.709600][ T8882] netlink: 40 bytes leftover after parsing attributes in process `syz.0.894'. [ 297.795043][ T8885] netlink: 4 bytes leftover after parsing attributes in process `syz.2.892'. [ 298.757821][ T8897] netlink: 'syz.2.898': attribute type 12 has an invalid length. [ 298.795382][ T8897] netlink: 'syz.2.898': attribute type 29 has an invalid length. [ 298.821722][ T8897] netlink: 148 bytes leftover after parsing attributes in process `syz.2.898'. [ 298.978566][ T8897] netlink: 'syz.2.898': attribute type 1 has an invalid length. [ 299.030151][ T8897] netlink: 'syz.2.898': attribute type 2 has an invalid length. [ 299.155832][ T8897] netlink: 39 bytes leftover after parsing attributes in process `syz.2.898'. [ 299.863315][ T30] audit: type=1400 audit(1748498165.658:250): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=8906 comm="syz.2.902" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 300.476472][ T8924] netlink: 4 bytes leftover after parsing attributes in process `syz.1.906'. [ 303.397476][ T8954] netlink: 24 bytes leftover after parsing attributes in process `syz.4.910'. [ 304.813603][ T8970] netlink: 4 bytes leftover after parsing attributes in process `syz.4.918'. [ 305.454907][ T8972] netlink: 28 bytes leftover after parsing attributes in process `syz.3.914'. [ 305.660348][ T8977] netlink: 27 bytes leftover after parsing attributes in process `syz.0.921'. [ 305.680995][ T8977] netlink: 20 bytes leftover after parsing attributes in process `syz.0.921'. [ 305.981357][ T8952] netlink: 28 bytes leftover after parsing attributes in process `syz.1.915'. [ 306.074901][ T30] audit: type=1326 audit(1748498171.788:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8949 comm="syz.3.914" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 306.096709][ T30] audit: type=1326 audit(1748498171.788:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8949 comm="syz.3.914" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f85cd58d2d0 code=0x7ffc0000 [ 306.202530][ T30] audit: type=1326 audit(1748498171.788:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8949 comm="syz.3.914" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 306.705201][ T30] audit: type=1326 audit(1748498171.788:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8949 comm="syz.3.914" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 306.753329][ T8990] netlink: 'syz.4.924': attribute type 4 has an invalid length. [ 306.786569][ T8989] Cache volume key already in use (9p,(null),@) [ 306.805219][ T30] audit: type=1326 audit(1748498171.788:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8949 comm="syz.3.914" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 306.832483][ T30] audit: type=1326 audit(1748498171.788:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8949 comm="syz.3.914" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 306.854990][ T30] audit: type=1326 audit(1748498171.788:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8949 comm="syz.3.914" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 306.988362][ T30] audit: type=1326 audit(1748498171.788:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8949 comm="syz.3.914" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85cd58e969 code=0x7ffc0000 [ 307.057214][ T30] audit: type=1326 audit(1748498172.658:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8951 comm="syz.1.915" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfe2d8e969 code=0x7ffc0000 [ 307.730169][ T30] audit: type=1326 audit(1748498172.658:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8951 comm="syz.1.915" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbfe2d8d2d0 code=0x7ffc0000 [ 307.978537][ T1627] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 308.030514][ T9015] netlink: 'syz.1.929': attribute type 10 has an invalid length. [ 308.122633][ T9011] sch_tbf: burst 0 is lower than device lo mtu (18) ! [ 308.146633][ T1627] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 308.156525][ T1627] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.173425][ T1627] usb 3-1: config 0 descriptor?? [ 308.187769][ T9018] netlink: 40 bytes leftover after parsing attributes in process `syz.0.932'. [ 308.480194][ T1627] [drm] vendor descriptor length:6 data:06 5f 01 00 00 00 00 00 00 00 00 [ 308.498187][ T1627] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 308.869576][ T9028] overlayfs: failed to resolve './file1/file0': -2 [ 309.367679][ T1627] [drm:udl_init] *ERROR* Selecting channel failed [ 309.791248][ T1627] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 2 [ 309.821670][ T1627] [drm] Initialized udl on minor 2 [ 309.842100][ T1627] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 309.861934][ T1627] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 309.874184][ T5869] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 309.894858][ T1627] usb 3-1: USB disconnect, device number 16 [ 309.903504][ T5869] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 310.190006][ T9044] netlink: 248 bytes leftover after parsing attributes in process `syz.4.941'. [ 310.233953][ T9044] netlink: 12 bytes leftover after parsing attributes in process `syz.4.941'. [ 312.295242][ T9070] netlink: 20 bytes leftover after parsing attributes in process `syz.1.949'. [ 312.378328][ T9070] netlink: 20 bytes leftover after parsing attributes in process `syz.1.949'. [ 312.610668][ T9076] netlink: 40 bytes leftover after parsing attributes in process `syz.0.950'. [ 312.702237][ T9085] FAULT_INJECTION: forcing a failure. [ 312.702237][ T9085] name failslab, interval 1, probability 0, space 0, times 0 [ 312.747322][ T9085] CPU: 1 UID: 0 PID: 9085 Comm: syz.2.951 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 312.747351][ T9085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 312.747362][ T9085] Call Trace: [ 312.747369][ T9085] [ 312.747378][ T9085] dump_stack_lvl+0x189/0x250 [ 312.747408][ T9085] ? __pfx____ratelimit+0x10/0x10 [ 312.747435][ T9085] ? __pfx_dump_stack_lvl+0x10/0x10 [ 312.747461][ T9085] ? __pfx__printk+0x10/0x10 [ 312.747496][ T9085] ? __pfx___might_resched+0x10/0x10 [ 312.747525][ T9085] should_fail_ex+0x414/0x560 [ 312.747554][ T9085] should_failslab+0xa8/0x100 [ 312.747585][ T9085] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 312.747614][ T9085] ? __alloc_skb+0x112/0x2d0 [ 312.747642][ T9085] __alloc_skb+0x112/0x2d0 [ 312.747672][ T9085] tc_ctl_action+0x809/0xbd0 [ 312.747700][ T9085] ? __pfx_tc_ctl_action+0x10/0x10 [ 312.747730][ T9085] ? rcu_is_watching+0x15/0xb0 [ 312.747797][ T9085] ? __pfx_tc_ctl_action+0x10/0x10 [ 312.747819][ T9085] rtnetlink_rcv_msg+0x779/0xb70 [ 312.747848][ T9085] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 312.747872][ T9085] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 312.747901][ T9085] ? ref_tracker_free+0x63a/0x7d0 [ 312.747925][ T9085] ? __copy_skb_header+0xa7/0x550 [ 312.747954][ T9085] netlink_rcv_skb+0x21c/0x490 [ 312.747982][ T9085] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 312.748021][ T9085] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 312.748064][ T9085] ? netlink_deliver_tap+0x2e/0x1b0 [ 312.748088][ T9085] ? netlink_deliver_tap+0x2e/0x1b0 [ 312.748119][ T9085] netlink_unicast+0x758/0x8d0 [ 312.748155][ T9085] netlink_sendmsg+0x805/0xb30 [ 312.748190][ T9085] ? __pfx_netlink_sendmsg+0x10/0x10 [ 312.748225][ T9085] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 312.748242][ T9085] ? __pfx_netlink_sendmsg+0x10/0x10 [ 312.748270][ T9085] __sock_sendmsg+0x219/0x270 [ 312.748296][ T9085] ____sys_sendmsg+0x505/0x830 [ 312.748333][ T9085] ? __pfx_____sys_sendmsg+0x10/0x10 [ 312.748372][ T9085] ? import_iovec+0x74/0xa0 [ 312.748397][ T9085] ___sys_sendmsg+0x21f/0x2a0 [ 312.748430][ T9085] ? __pfx____sys_sendmsg+0x10/0x10 [ 312.748497][ T9085] ? __fget_files+0x2a/0x420 [ 312.748523][ T9085] ? __fget_files+0x3a0/0x420 [ 312.748561][ T9085] __x64_sys_sendmsg+0x19b/0x260 [ 312.748581][ T9085] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 312.748610][ T9085] ? __pfx_ksys_write+0x10/0x10 [ 312.748641][ T9085] ? do_syscall_64+0xbe/0x3b0 [ 312.748673][ T9085] do_syscall_64+0xfa/0x3b0 [ 312.748699][ T9085] ? lockdep_hardirqs_on+0x9c/0x150 [ 312.748725][ T9085] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 312.748745][ T9085] ? clear_bhb_loop+0x60/0xb0 [ 312.748769][ T9085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 312.748788][ T9085] RIP: 0033:0x7fefcc38e969 [ 312.748806][ T9085] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 312.748824][ T9085] RSP: 002b:00007fefcd14a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 312.748845][ T9085] RAX: ffffffffffffffda RBX: 00007fefcc5b6160 RCX: 00007fefcc38e969 [ 312.748860][ T9085] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000008 [ 312.748872][ T9085] RBP: 00007fefcd14a090 R08: 0000000000000000 R09: 0000000000000000 [ 312.748885][ T9085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 312.748896][ T9085] R13: 0000000000000000 R14: 00007fefcc5b6160 R15: 00007ffc1444a058 [ 312.748928][ T9085] [ 316.438161][ T24] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 316.647279][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 316.727635][ T24] usb 3-1: config 0 has an invalid interface number: 151 but max is 0 [ 317.240688][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.247581][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.320620][ T24] usb 3-1: config 0 has no interface number 0 [ 317.326783][ T24] usb 3-1: config 0 interface 151 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 317.338433][ T24] usb 3-1: config 0 interface 151 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 317.353351][ T24] usb 3-1: New USB device found, idVendor=0499, idProduct=6bb7, bcdDevice=68.2f [ 317.362682][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.370860][ T24] usb 3-1: Product: syz [ 317.375035][ T24] usb 3-1: Manufacturer: syz [ 317.379737][ T24] usb 3-1: SerialNumber: syz [ 317.387298][ T24] usb 3-1: config 0 descriptor?? [ 317.600098][ T9158] fuse: Unknown parameter 'f40x0000000000000006' [ 318.296243][ T24] usb 3-1: USB disconnect, device number 17 [ 319.918800][ T9219] fuse: Bad value for 'fd' [ 320.186861][ T9223] netlink: 40 bytes leftover after parsing attributes in process `syz.1.984'. [ 320.533923][ T9207] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.980'. [ 321.976998][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 321.977016][ T30] audit: type=1400 audit(1748498187.828:267): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=9241 comm="syz.0.990" saddr=0.0.0.224 src=20000 daddr=224.0.0.1 dest=20000 netif=wpan0 [ 322.617703][ T9254] FAULT_INJECTION: forcing a failure. [ 322.617703][ T9254] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 322.630894][ T9254] CPU: 0 UID: 0 PID: 9254 Comm: syz.2.992 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 322.630920][ T9254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 322.630932][ T9254] Call Trace: [ 322.630940][ T9254] [ 322.630948][ T9254] dump_stack_lvl+0x189/0x250 [ 322.630978][ T9254] ? __pfx____ratelimit+0x10/0x10 [ 322.631006][ T9254] ? __pfx_dump_stack_lvl+0x10/0x10 [ 322.631032][ T9254] ? __pfx__printk+0x10/0x10 [ 322.631062][ T9254] ? __might_fault+0xb0/0x130 [ 322.631100][ T9254] should_fail_ex+0x414/0x560 [ 322.631130][ T9254] _copy_from_user+0x2d/0xb0 [ 322.631151][ T9254] ___sys_sendmsg+0x158/0x2a0 [ 322.631190][ T9254] ? __pfx____sys_sendmsg+0x10/0x10 [ 322.631256][ T9254] ? __fget_files+0x2a/0x420 [ 322.631284][ T9254] ? __fget_files+0x3a0/0x420 [ 322.631322][ T9254] __x64_sys_sendmsg+0x19b/0x260 [ 322.631344][ T9254] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 322.631372][ T9254] ? __pfx_ksys_write+0x10/0x10 [ 322.631402][ T9254] ? do_syscall_64+0xbe/0x3b0 [ 322.631434][ T9254] do_syscall_64+0xfa/0x3b0 [ 322.631462][ T9254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.631480][ T9254] ? asm_sysvec_call_function_single+0x1a/0x20 [ 322.631500][ T9254] ? clear_bhb_loop+0x60/0xb0 [ 322.631523][ T9254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.631542][ T9254] RIP: 0033:0x7fefcc38e969 [ 322.631559][ T9254] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 322.631576][ T9254] RSP: 002b:00007fefcd14a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 322.631597][ T9254] RAX: ffffffffffffffda RBX: 00007fefcc5b6160 RCX: 00007fefcc38e969 [ 322.631612][ T9254] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 322.631624][ T9254] RBP: 00007fefcd14a090 R08: 0000000000000000 R09: 0000000000000000 [ 322.631636][ T9254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 322.631647][ T9254] R13: 0000000000000000 R14: 00007fefcc5b6160 R15: 00007ffc1444a058 [ 322.631677][ T9254] [ 323.944973][ T9261] netlink: 28 bytes leftover after parsing attributes in process `syz.1.994'. [ 325.546866][ T9278] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1000'. [ 325.718390][ T5876] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 325.998951][ T5876] usb 3-1: Using ep0 maxpacket: 32 [ 326.101832][ T5876] usb 3-1: config 0 has an invalid interface number: 30 but max is 0 [ 326.114030][ T5876] usb 3-1: config 0 has no interface number 0 [ 326.159647][ T5876] usb 3-1: New USB device found, idVendor=061d, idProduct=c180, bcdDevice=fc.f0 [ 326.196722][ T5876] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.214253][ T5876] usb 3-1: Product: syz [ 326.219450][ T5876] usb 3-1: Manufacturer: syz [ 326.227774][ T5876] usb 3-1: SerialNumber: syz [ 326.241972][ T5876] usb 3-1: config 0 descriptor?? [ 326.279823][ T5876] quatech2 3-1:0.30: Quatech 2nd gen USB to Serial Driver converter detected [ 326.696112][ T9304] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1006'. [ 327.418121][ T30] audit: type=1326 audit(1748498192.758:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9293 comm="syz.0.1006" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa88d78e969 code=0x7ffc0000 [ 327.441391][ T5876] usb 3-1: qt2_attach - failed to power on unit: -71 [ 327.457468][ T5876] quatech2 3-1:0.30: probe with driver quatech2 failed with error -71 [ 327.537536][ T5876] usb 3-1: USB disconnect, device number 18 [ 327.547386][ T30] audit: type=1326 audit(1748498192.758:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9293 comm="syz.0.1006" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa88d78e969 code=0x7ffc0000 [ 327.798135][ T30] audit: type=1326 audit(1748498192.768:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9293 comm="syz.0.1006" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fa88d78d2d0 code=0x7ffc0000 [ 327.837433][ T9311] batadv_slave_0: entered promiscuous mode [ 327.942643][ T30] audit: type=1326 audit(1748498192.768:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9293 comm="syz.0.1006" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa88d78e969 code=0x7ffc0000 [ 327.986743][ T30] audit: type=1326 audit(1748498192.768:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9293 comm="syz.0.1006" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa88d78e969 code=0x7ffc0000 [ 328.154608][ T30] audit: type=1326 audit(1748498192.768:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9293 comm="syz.0.1006" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa88d78e969 code=0x7ffc0000 [ 328.190726][ T30] audit: type=1326 audit(1748498192.768:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9293 comm="syz.0.1006" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa88d78e969 code=0x7ffc0000 [ 328.218097][ T30] audit: type=1326 audit(1748498192.768:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9293 comm="syz.0.1006" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa88d78e969 code=0x7ffc0000 [ 328.888727][ T30] audit: type=1326 audit(1748498192.768:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9293 comm="syz.0.1006" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7fa88d78e969 code=0x7ffc0000 [ 328.913702][ T30] audit: type=1326 audit(1748498192.768:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9293 comm="syz.0.1006" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa88d78e969 code=0x7ffc0000 [ 329.208163][ T1627] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 329.491869][ T1627] usb 3-1: config 64 has an invalid interface number: 73 but max is 0 [ 329.517719][ T1627] usb 3-1: config 64 has no interface number 0 [ 329.529231][ T1627] usb 3-1: config 64 interface 73 has no altsetting 0 [ 329.541607][ T1627] usb 3-1: New USB device found, idVendor=0a5c, idProduct=2033, bcdDevice=a8.de [ 329.563605][ T1627] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 329.571930][ T1627] usb 3-1: Product: syz [ 329.576143][ T1627] usb 3-1: Manufacturer: syz [ 329.580865][ T1627] usb 3-1: SerialNumber: syz [ 329.706675][ T9339] 9pnet_fd: Insufficient options for proto=fd [ 329.797617][ T1627] usb 3-1: USB disconnect, device number 19 [ 331.331586][ T9366] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 331.355012][ T9366] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 332.085621][ T9367] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1032'. [ 332.191634][ T9367] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 332.232202][ T9383] FAULT_INJECTION: forcing a failure. [ 332.232202][ T9383] name failslab, interval 1, probability 0, space 0, times 0 [ 332.258963][ T9383] CPU: 1 UID: 0 PID: 9383 Comm: syz.2.1036 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 332.258986][ T9383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 332.258994][ T9383] Call Trace: [ 332.259001][ T9383] [ 332.259008][ T9383] dump_stack_lvl+0x189/0x250 [ 332.259036][ T9383] ? __pfx____ratelimit+0x10/0x10 [ 332.259057][ T9383] ? __pfx_dump_stack_lvl+0x10/0x10 [ 332.259080][ T9383] ? __pfx__printk+0x10/0x10 [ 332.259110][ T9383] ? __pfx___might_resched+0x10/0x10 [ 332.259129][ T9383] ? fs_reclaim_acquire+0x7d/0x100 [ 332.259147][ T9383] should_fail_ex+0x414/0x560 [ 332.259170][ T9383] should_failslab+0xa8/0x100 [ 332.259194][ T9383] __kmalloc_noprof+0xcb/0x4f0 [ 332.259211][ T9383] ? kfree+0x4d/0x440 [ 332.259227][ T9383] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 332.259254][ T9383] tomoyo_realpath_from_path+0xe3/0x5d0 [ 332.259278][ T9383] ? tomoyo_domain+0xda/0x130 [ 332.259296][ T9383] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 332.259315][ T9383] tomoyo_path_number_perm+0x1e8/0x5a0 [ 332.259337][ T9383] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 332.259371][ T9383] ? __lock_acquire+0xab9/0xd20 [ 332.259406][ T9383] ? __fget_files+0x2a/0x420 [ 332.259438][ T9383] ? __fget_files+0x2a/0x420 [ 332.259458][ T9383] ? __fget_files+0x3a0/0x420 [ 332.259480][ T9383] ? __fget_files+0x2a/0x420 [ 332.259504][ T9383] security_file_ioctl+0xcb/0x2d0 [ 332.259526][ T9383] __se_sys_ioctl+0x47/0x170 [ 332.259548][ T9383] do_syscall_64+0xfa/0x3b0 [ 332.259570][ T9383] ? lockdep_hardirqs_on+0x9c/0x150 [ 332.259591][ T9383] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.259608][ T9383] ? clear_bhb_loop+0x60/0xb0 [ 332.259626][ T9383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.259640][ T9383] RIP: 0033:0x7fefcc38e969 [ 332.259654][ T9383] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 332.259666][ T9383] RSP: 002b:00007fefcd18c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 332.259681][ T9383] RAX: ffffffffffffffda RBX: 00007fefcc5b5fa0 RCX: 00007fefcc38e969 [ 332.259692][ T9383] RDX: 0000200000000000 RSI: 0000000000005412 RDI: 0000000000000003 [ 332.259701][ T9383] RBP: 00007fefcd18c090 R08: 0000000000000000 R09: 0000000000000000 [ 332.259710][ T9383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 332.259719][ T9383] R13: 0000000000000000 R14: 00007fefcc5b5fa0 R15: 00007ffc1444a058 [ 332.259744][ T9383] [ 332.259751][ T9383] ERROR: Out of memory at tomoyo_realpath_from_path. [ 332.559318][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 333.762980][ T9406] netlink: 'syz.1.1044': attribute type 6 has an invalid length. [ 333.785051][ T9409] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 333.801890][ T9409] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 333.931016][ T9416] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1049'. [ 333.965153][ T9416] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1049'. [ 334.065948][ T9421] syz_tun: entered allmulticast mode [ 334.075345][ T9420] syz_tun: left allmulticast mode [ 335.342412][ T9451] netlink: 'syz.3.1061': attribute type 13 has an invalid length. [ 337.213852][ T9483] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1072'. [ 341.295918][ T9542] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1089'. [ 342.248526][ T1627] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 343.493875][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 343.493892][ T30] audit: type=1326 audit(1748498209.348:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9557 comm="syz.0.1097" exe="/root/syz-executor" sig=31 arch=c000003e syscall=39 compat=0 ip=0x7fa88d785927 code=0x0 [ 343.877919][ T9570] IPVS: set_ctl: invalid protocol: 255 255.255.255.255:20003 [ 346.661742][ T30] audit: type=1326 audit(1748498212.508:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9631 comm="syz.4.1120" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fcfed98e969 code=0x0 [ 346.799844][ T9645] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1126'. [ 346.811730][ T9645] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 347.841998][ T9653] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1127'. [ 349.708265][ T5869] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 349.805542][ T9704] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1138'. [ 349.817765][ T9704] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 349.827153][ T9704] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 349.868077][ T5869] usb 3-1: Using ep0 maxpacket: 16 [ 349.883395][ T5869] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 349.908085][ T5869] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.916127][ T5869] usb 3-1: Product: syz [ 349.931393][ T5869] usb 3-1: Manufacturer: syz [ 349.936036][ T5869] usb 3-1: SerialNumber: syz [ 349.951240][ T9709] 9pnet_fd: Insufficient options for proto=fd [ 349.958680][ T5869] usb 3-1: config 0 descriptor?? [ 350.173248][ T5869] dvb_usb_dtv5100 3-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 350.200089][ T5869] usb 3-1: USB disconnect, device number 21 [ 352.409969][ T9743] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1150'. [ 352.423607][ T9741] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1149'. [ 352.507090][ T9745] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1151'. [ 352.696362][ T9755] netlink: 'syz.4.1154': attribute type 10 has an invalid length. [ 352.705619][ T9755] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 352.714225][ T9755] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 352.726754][ T9755] netlink: 'syz.4.1154': attribute type 10 has an invalid length. [ 352.734821][ T9755] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1154'. [ 352.744085][ T9755] batadv0: entered promiscuous mode [ 352.749350][ T9755] batadv0: entered allmulticast mode [ 352.755886][ T9755] bond0: (slave batadv0): Releasing backup interface [ 352.764801][ T9755] bridge0: port 1(batadv0) entered blocking state [ 352.771498][ T9755] bridge0: port 1(batadv0) entered disabled state [ 352.873635][ T9762] FAULT_INJECTION: forcing a failure. [ 352.873635][ T9762] name failslab, interval 1, probability 0, space 0, times 0 [ 352.897223][ T9762] CPU: 1 UID: 0 PID: 9762 Comm: syz.2.1158 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 352.897252][ T9762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 352.897265][ T9762] Call Trace: [ 352.897273][ T9762] [ 352.897282][ T9762] dump_stack_lvl+0x189/0x250 [ 352.897314][ T9762] ? __pfx____ratelimit+0x10/0x10 [ 352.897342][ T9762] ? __pfx_dump_stack_lvl+0x10/0x10 [ 352.897370][ T9762] ? __pfx__printk+0x10/0x10 [ 352.897415][ T9762] should_fail_ex+0x414/0x560 [ 352.897447][ T9762] should_failslab+0xa8/0x100 [ 352.897478][ T9762] __kmalloc_cache_noprof+0x70/0x3d0 [ 352.897512][ T9762] ? sctp_add_bind_addr+0x8c/0x370 [ 352.897545][ T9762] sctp_add_bind_addr+0x8c/0x370 [ 352.897579][ T9762] sctp_copy_local_addr_list+0x30b/0x4e0 [ 352.897612][ T9762] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 352.897642][ T9762] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 352.897673][ T9762] ? sctp_v6_is_any+0x64/0x80 [ 352.897694][ T9762] ? sctp_copy_one_addr+0x93/0x360 [ 352.897728][ T9762] sctp_bind_addr_copy+0xb3/0x3c0 [ 352.897758][ T9762] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 352.897789][ T9762] sctp_connect_new_asoc+0x2e0/0x690 [ 352.897816][ T9762] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 352.897836][ T9762] ? __local_bh_enable_ip+0x12d/0x1c0 [ 352.897870][ T9762] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 352.897889][ T9762] ? security_sctp_bind_connect+0x7e/0x2e0 [ 352.897919][ T9762] sctp_sendmsg+0x155c/0x2810 [ 352.897955][ T9762] ? __pfx_sctp_sendmsg+0x10/0x10 [ 352.897997][ T9762] ? sock_rps_record_flow+0x19/0x400 [ 352.898019][ T9762] ? inet_sendmsg+0x2f4/0x370 [ 352.898044][ T9762] __sock_sendmsg+0x19c/0x270 [ 352.898072][ T9762] ____sys_sendmsg+0x52d/0x830 [ 352.898108][ T9762] ? __pfx_____sys_sendmsg+0x10/0x10 [ 352.898148][ T9762] ? import_iovec+0x74/0xa0 [ 352.898173][ T9762] ___sys_sendmsg+0x21f/0x2a0 [ 352.898206][ T9762] ? __pfx____sys_sendmsg+0x10/0x10 [ 352.898276][ T9762] ? __fget_files+0x2a/0x420 [ 352.898304][ T9762] ? __fget_files+0x3a0/0x420 [ 352.898344][ T9762] __sys_sendmmsg+0x227/0x430 [ 352.898369][ T9762] ? __pfx___sys_sendmmsg+0x10/0x10 [ 352.898385][ T9762] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 352.898443][ T9762] ? ksys_write+0x22a/0x250 [ 352.898470][ T9762] ? __pfx_ksys_write+0x10/0x10 [ 352.898498][ T9762] ? rcu_is_watching+0x15/0xb0 [ 352.898530][ T9762] __x64_sys_sendmmsg+0xa0/0xc0 [ 352.898551][ T9762] do_syscall_64+0xfa/0x3b0 [ 352.898578][ T9762] ? lockdep_hardirqs_on+0x9c/0x150 [ 352.898603][ T9762] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 352.898623][ T9762] ? clear_bhb_loop+0x60/0xb0 [ 352.898647][ T9762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 352.898667][ T9762] RIP: 0033:0x7fefcc38e969 [ 352.898684][ T9762] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 352.898702][ T9762] RSP: 002b:00007fefcd18c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 352.898723][ T9762] RAX: ffffffffffffffda RBX: 00007fefcc5b5fa0 RCX: 00007fefcc38e969 [ 352.898737][ T9762] RDX: 0000000000000001 RSI: 0000200000000a80 RDI: 0000000000000003 [ 352.898750][ T9762] RBP: 00007fefcd18c090 R08: 0000000000000000 R09: 0000000000000000 [ 352.898763][ T9762] R10: 000000000004c040 R11: 0000000000000246 R12: 0000000000000002 [ 352.898775][ T9762] R13: 0000000000000000 R14: 00007fefcc5b5fa0 R15: 00007ffc1444a058 [ 352.898807][ T9762] [ 353.262000][ T1322] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 353.271683][ T1322] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 353.490580][ T9773] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1163'. [ 353.584818][ T9777] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1164'. [ 353.789107][ T9784] lo speed is unknown, defaulting to 1000 [ 353.821328][ T30] audit: type=1326 audit(1748498219.678:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9783 comm="syz.1.1166" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbfe2d8e969 code=0x0 [ 353.907068][ T9786] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1168'. [ 354.143118][ T9804] kAFS: unparsable volume name [ 355.014667][ T9817] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1177'. [ 355.149376][ T9821] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN PTI [ 355.161484][ T9821] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 355.170019][ T9821] CPU: 1 UID: 0 PID: 9821 Comm: syz.2.1179 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) [ 355.181764][ T9821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 355.191933][ T9821] RIP: 0010:do_move_mount+0x27d/0xb10 [ 355.197420][ T9821] Code: e8 f8 30 84 ff 41 be ea ff ff ff 49 bd 00 00 00 00 00 fc ff df 48 8b 6c 24 18 4c 8b 7c 24 08 48 8d 5d 48 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 d4 eb e4 ff 48 8b 1b 31 ff 48 89 [ 355.217139][ T9821] RSP: 0018:ffffc9000c14fd30 EFLAGS: 00010206 [ 355.223217][ T9821] RAX: 0000000000000006 RBX: 0000000000000032 RCX: 0000000000080000 [ 355.231185][ T9821] RDX: ffffc9000c2c9000 RSI: 0000000000000066 RDI: 0000000000000067 [ 355.239151][ T9821] RBP: ffffffffffffffea R08: ffffffff8dc1683b R09: 1ffffffff1b82d07 [ 355.247124][ T9821] R10: dffffc0000000000 R11: fffffbfff1b82d08 R12: 0000000000000005 [ 355.255095][ T9821] R13: dffffc0000000000 R14: 00000000ffffffea R15: ffff8880354c7300 [ 355.263063][ T9821] FS: 00007fefcd18c6c0(0000) GS:ffff8881261c0000(0000) knlGS:0000000000000000 [ 355.271991][ T9821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 355.278605][ T9821] CR2: 0000000000000000 CR3: 000000007b536000 CR4: 00000000003526f0 [ 355.286579][ T9821] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 355.294543][ T9821] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 355.302511][ T9821] Call Trace: [ 355.305784][ T9821] [ 355.308718][ T9821] __se_sys_move_mount+0x413/0x590 [ 355.313841][ T9821] ? __pfx___se_sys_move_mount+0x10/0x10 [ 355.319491][ T9821] ? __fget_files+0x2a/0x420 [ 355.324093][ T9821] ? do_syscall_64+0xbe/0x3b0 [ 355.328775][ T9821] ? __x64_sys_move_mount+0x20/0xc0 [ 355.333979][ T9821] do_syscall_64+0xfa/0x3b0 [ 355.338496][ T9821] ? lockdep_hardirqs_on+0x9c/0x150 [ 355.343698][ T9821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.349765][ T9821] ? clear_bhb_loop+0x60/0xb0 [ 355.354452][ T9821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.360342][ T9821] RIP: 0033:0x7fefcc38e969 [ 355.364754][ T9821] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 355.384369][ T9821] RSP: 002b:00007fefcd18c038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ad [ 355.392783][ T9821] RAX: ffffffffffffffda RBX: 00007fefcc5b5fa0 RCX: 00007fefcc38e969 [ 355.400753][ T9821] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000007 [ 355.408719][ T9821] RBP: 00007fefcc410ab1 R08: 0000000000000067 R09: 0000000000000000 [ 355.416705][ T9821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 355.424682][ T9821] R13: 0000000000000000 R14: 00007fefcc5b5fa0 R15: 00007ffc1444a058 [ 355.432679][ T9821] [ 355.435702][ T9821] Modules linked in: [ 355.440168][ T9821] ---[ end trace 0000000000000000 ]--- [ 355.448633][ T9821] RIP: 0010:do_move_mount+0x27d/0xb10 [ 355.454197][ T9821] Code: e8 f8 30 84 ff 41 be ea ff ff ff 49 bd 00 00 00 00 00 fc ff df 48 8b 6c 24 18 4c 8b 7c 24 08 48 8d 5d 48 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 d4 eb e4 ff 48 8b 1b 31 ff 48 89 [ 355.475408][ T9821] RSP: 0018:ffffc9000c14fd30 EFLAGS: 00010206 [ 355.496225][ T9821] RAX: 0000000000000006 RBX: 0000000000000032 RCX: 0000000000080000 [ 355.504589][ T9821] RDX: ffffc9000c2c9000 RSI: 0000000000000066 RDI: 0000000000000067 [ 355.514051][ T9821] RBP: ffffffffffffffea R08: ffffffff8dc1683b R09: 1ffffffff1b82d07 [ 355.522306][ T9821] R10: dffffc0000000000 R11: fffffbfff1b82d08 R12: 0000000000000005 [ 355.538068][ T9821] R13: dffffc0000000000 R14: 00000000ffffffea R15: ffff8880354c7300 [ 355.546314][ T9821] FS: 00007fefcd18c6c0(0000) GS:ffff8881260c0000(0000) knlGS:0000000000000000 [ 355.559141][ T9821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 355.566649][ T9821] CR2: 000000110c335d0e CR3: 000000007b536000 CR4: 00000000003526f0 [ 355.575684][ T9821] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 355.585105][ T9821] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 355.593647][ T9821] Kernel panic - not syncing: Fatal exception [ 355.599894][ T9821] Kernel Offset: disabled [ 355.604228][ T9821] Rebooting in 86400 seconds..